3 Commits

Author	SHA1	Message	Date
Robert Swiecki	508d9bf3b5	Refactor nstun TCP/UDP state machines and harden IPv6 handling ... * Replace switch/goto dispatch with table-driven per-state handlers; deduplicate flow init * Eliminate magic numbers - use named constants for buffer limits, timeouts, and struct sizes * Block IPv4-compatible IPv6 addresses (SSRF) and cache redirect destinations per-flow Replace switch/goto dispatch with table-driven per-state handlers; deduplicate flow init Eliminate magic numbers: use named constants for buffer limits, timeouts, and struct sizes Block IPv4-compatible IPv6 addresses (SSRF) and cache redirect destinations per-flow	2026-04-02 14:03:31 +02:00
Robert Swiecki	15e16bc93b	nstun: make Flow a base clase, with derivative classes for each supported proto	2026-04-02 00:52:22 +02:00
Robert Swiecki	b6bf68c4c1	nstun: Harden networking stack and modernize to C++20 ... - Migrate TCP/UDP flow management to std::unique_ptr and packet parsing to std::span - Add mandatory checksum validation for UDP (IPv4 optional, IPv6 per RFC 8200), closing parity with TCP/ICMP - Handle IPv6 Authentication Header (AH) in extension header parser to prevent firewall rule bypass - Add defense-in-depth MTU cap in tcp_process_data to prevent int32_t overflow in sequence arithmetic - Fix uint16_t port loop overflow in HOST_TO_GUEST listener setup (infinite loop when dport_end=65535) - Block SSRF via forged loopback/v4mapped destinations in both IPv4 and IPv6 TCP/UDP paths - Extract policy evaluation and proxy encapsulation into standalone policy.cc and encap.cc modules - Replace all raw inet_ntop+char[] patterns with ip4_to_string/ip6_to_string helpers	2026-04-01 19:38:13 +02:00