From 8a751f016698ef21565d8840125f30b7e3bc795b Mon Sep 17 00:00:00 2001 From: Trithem90 Date: Fri, 21 Aug 2026 13:57:16 +0200 Subject: [PATCH] nstun: fail closed for proxy actions matched by ICMP --- nstun/icmp.cc | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/nstun/icmp.cc b/nstun/icmp.cc index afab511..9000ace 100644 --- a/nstun/icmp.cc +++ b/nstun/icmp.cc @@ -178,6 +178,10 @@ void handle_icmp6(Context* ctx, const ip6_hdr* ip, std::span payl if (rule.action == NSTUN_ACTION_DROP) { LOG_D("ICMPv6 dropped by policy"); return; + } else if (rule.action == NSTUN_ACTION_ENCAP_SOCKS5 || + rule.action == NSTUN_ACTION_ENCAP_CONNECT) { + LOG_D("Proxy encapsulation is not supported for ICMPv6, dropping"); + return; } else if (rule.action == NSTUN_ACTION_REJECT) { LOG_D("ICMPv6 rejected by policy"); send_icmp6_error(ctx, ip, sizeof(ip6_hdr) + payload.size(), @@ -298,6 +302,10 @@ void handle_icmp4(Context* ctx, const ip4_hdr* ip, std::span payl if (rule.action == NSTUN_ACTION_DROP) { LOG_D("ICMP dropped by policy"); return; + } else if (rule.action == NSTUN_ACTION_ENCAP_SOCKS5 || + rule.action == NSTUN_ACTION_ENCAP_CONNECT) { + LOG_D("Proxy encapsulation is not supported for ICMP, dropping"); + return; } else if (rule.action == NSTUN_ACTION_REJECT) { LOG_D("ICMP rejected by policy"); send_icmp4_error(ctx, ip, ntohs(ip->tot_len), ICMP_DEST_UNREACH,