Github/nsjail
1
0
Fork 0
mirror of https://github.com/google/nsjail.git synced 2026-08-30 18:41:30 -07:00
Code Issues Packages Projects Releases Wiki Activity

nstun: fail closed for proxy actions matched by ICMP

Browse Source
This commit is contained in:
Trithem90
2026-08-21 13:57:16 +02:00
parent 5ebcc30bef
commit 8a751f0166
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
nstun/icmp.cc
View File

@@ -178,6 +178,10 @@ void handle_icmp6(Context* ctx, const ip6_hdr* ip, std::span<const uint8_t> payl
if (rule.action == NSTUN_ACTION_DROP) {
LOG_D("ICMPv6 dropped by policy");
return;
} else if (rule.action == NSTUN_ACTION_ENCAP_SOCKS5 ||
rule.action == NSTUN_ACTION_ENCAP_CONNECT) {
LOG_D("Proxy encapsulation is not supported for ICMPv6, dropping");
return;
} else if (rule.action == NSTUN_ACTION_REJECT) {
LOG_D("ICMPv6 rejected by policy");
send_icmp6_error(ctx, ip, sizeof(ip6_hdr) + payload.size(),
@@ -298,6 +302,10 @@ void handle_icmp4(Context* ctx, const ip4_hdr* ip, std::span<const uint8_t> payl
if (rule.action == NSTUN_ACTION_DROP) {
LOG_D("ICMP dropped by policy");
return;
} else if (rule.action == NSTUN_ACTION_ENCAP_SOCKS5 ||
rule.action == NSTUN_ACTION_ENCAP_CONNECT) {
LOG_D("Proxy encapsulation is not supported for ICMP, dropping");
return;
} else if (rule.action == NSTUN_ACTION_REJECT) {
LOG_D("ICMP rejected by policy");
send_icmp4_error(ctx, ip, ntohs(ip->tot_len), ICMP_DEST_UNREACH,