enricobuehler
e707a962b6
Address findings from a repo security review:
- core: add a sliding-window anti-replay filter over the AEAD-authenticated
sequence in Session (poll_input/poll_frame), closing the input-replay gap the
data plane previously left to the LAN/VPN trust assumption. 4096-deep window,
unit-tested; the encrypted loopback suite confirms no false drops.
- clients: write the mTLS client private key 0600 and lock the config dir 0700
on Unix (it was world-readable at the umask default), re-locking existing
stores on load. pf-client-core::trust plus the probe's own identity writer.
Windows keeps the %APPDATA% ACL; Android/Apple already wrap the key.
- web: fix a post-login open redirect — resolve `next` via URL and require it to
stay same-origin, rejecting `/\evil.com` and tab/encoding variants the old
`!startsWith("//")` guard missed. Also fixes the dead safeNextPath helper.
- ci: SHA-256-pin the BtbN FFmpeg DLLs bundled into the signed Windows installer
(were fetched from the rolling `latest` tag unverified); fails closed on a
re-roll, matching the VB-CABLE gate.
- ci: fail-open fork-guard on the Windows/Apple host-mode PR build jobs that
share runner labels with the signing jobs. Definitive fix stays server-side
(Gitea outside-collaborator approval / isolated PR runners) — see the notes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
punktfunk — probe (reference client)
punktfunk-probe is the headless reference client for the punktfunk/1 protocol — a
command-line tool for testing, latency measurement, and validating host behavior. It's not a
streaming app you'd watch on; it connects, exercises a plane, and reports numbers. If you want to
actually stream, use the Linux, Windows,
Apple, or Android clients.
Because it links the same punktfunk-core as every other client, it's also the canonical
example of driving the protocol end to end: QUIC control plane, UDP data plane, and the side planes
(input, audio, rumble) over QUIC datagrams.
What it does
- Receives a real stream, writes a playable elementary stream (
.h265/.h264/.av1— the extension tracks the negotiated codec; the probe advertises all three and the host picks), and reports per-frame capture→received latency percentiles (the host stamps each frame with its capture clock). - Verification mode against a synthetic host — byte-checks deterministic test frames.
- Exercises every plane with scripted test traffic:
--input-test(mouse/keyboard),--mic-test(a 440 Hz Opus tone up to the host mic),--touch-test(a synthetic finger),--rich-input-test(DualSense touchpad + motion, logging the HID-output feedback that comes back). - Trust —
--pin <64-hex>pins the host fingerprint;--pair <PIN>runs the SPAKE2 pairing ceremony and prints the verified fingerprint to pin from then on. Without a pin it trusts on first use. - Discovery —
--discover [secs]browses the LAN for_punktfunk._udphosts and prints each (name, addr:port, pairing requirement, cert fingerprint), then exits. - Negotiation knobs —
--mode WxHxFPS,--remode(mid-stream mode change),--bitrate,--codec auto|h264|hevc|av1(preference; the host resolves),--audio-channels(stereo / 5.1 / 7.1),--compositor,--gamepad,--launch,--speed-test. Env:PUNKTFUNK_CLIENT_10BIT=1/PUNKTFUNK_CLIENT_444=1advertise the 10-bit / 4:4:4 client caps (for testing a host'sPUNKTFUNK_10BIT/PUNKTFUNK_444).
Usage
# stream 720p120 from a host, save the video, and print latency percentiles:
cargo run -p punktfunk-probe -- --mode 1280x720x120 --connect HOST:PORT --out /tmp/a.h265
# list hosts on the LAN:
cargo run -p punktfunk-probe -- --discover
# pair with a host that requires it (read the PIN off the host), then stream:
cargo run -p punktfunk-probe -- --connect HOST:PORT --pair 1234
cargo run -p punktfunk-probe -- --connect HOST:PORT --pin <64-hex> --input-test
Full flag reference is in the module doc-comment at the top of src/main.rs.
Related
- Project README — the host, the streaming clients, and the protocol
punktfunk-host punktfunk1-host— the persistent native-protocol listener to probe against (see the "Running on this box" section of the repo README /CLAUDE.md)