lance0/xfr v0.9.3

on GitHub

Added

• Server --bind flag (#38) — xfr serve --bind <IP> binds TCP, QUIC, and UDP data listeners to a specific address. Validates against -4/-6 flags and rejects unspecified addresses (::, 0.0.0.0).

Changed

• Server sends random payloads (#34) — server-side TCP and UDP send paths now use random bytes by default in reverse and bidirectional modes, matching the client's default-on behavior.

Fixed

• QUIC dual-stack on Windows (#39) — QUIC server endpoint now creates its UDP socket via socket2 with explicit IPV6_V6ONLY handling instead of relying on Quinn's Endpoint::server(). On Windows/macOS where IPV6_V6ONLY defaults to true, binding to [::] would only accept IPv6 connections.
• Server random payload on single-port TCP reverse (#34) — the single-port TCP handler (DataHello path used by all modern clients) was missing random_payload = true, causing reverse-mode downloads to still send zeros.

Security

• quinn-proto DoS fix — updated quinn-proto 0.11.13 → 0.11.14 (RUSTSEC-2026-0037, severity 8.7)

Full Changelog: v0.9.2...v0.9.3