Robert Swiecki
1a13dc98fa
Merge pull request #268 from Vincent550102/reject_directory_stdio
...
Reject directory stdio fds unless explicitly passed
2026-08-26 20:12:26 +02:00
Robert Swiecki
30d8e4013f
Merge branch 'master' of github.com:google/nsjail
2026-08-26 20:09:35 +02:00
Robert Swiecki
5d53b5c28b
Merge pull request #282 from carrerasdarren-cell/nstun-cloud-local-destinations
...
nstun: block cloud-local service destinations
2026-08-26 20:08:34 +02:00
robertswiecki
8133324414
Merge pull request #288 from carrerasdarren-cell/fix/fail-closed-setgroups
...
user: fail closed when supplementary groups cannot be set
2026-08-26 20:05:57 +02:00
Robert Swiecki
79d12b54f2
Merge pull request #289 from carrerasdarren-cell/fix/nstun-policy-validation
...
nstun: reject invalid policy rule fields
2026-08-26 11:48:27 +02:00
skaiea13-ai
b4cff719c2
Limit nstun TCP receive buffers with a shared payload budget
...
Cap retained guest-to-host TCP payload across flows so a stalled sink cannot grow the supervisor toward the per-flow limit times the maximum flow count.
2026-08-22 04:30:29 +09:00
Darren Carreras
93c3cadb81
user: fail closed when supplementary groups cannot be set
...
An expected EPERM after denying setgroups in a new user namespace can still leave inherited supplementary groups attached to the child. Query the remaining group count and abort before exec unless the credential state is actually clean.
Add regression coverage for both an inherited-group failure and a clean no-groups launch.
2026-07-23 21:52:17 -04:00
Darren Carreras
0d905f1da2
nstun: reject invalid policy rule fields
2026-07-21 19:59:04 -04:00
Darren Carreras
bd9439b3f2
nstun: block cloud-local service destinations
2026-07-16 18:42:09 -04:00
Vincent550102
9d41a57452
Reject directory stdio fds unless explicitly passed
2026-05-11 20:04:39 +08:00
Robert Swiecki
6356dee0c6
Makefile/all: make libnl3 optional
2026-04-14 14:26:28 +02:00
Robert Swiecki
bcf9eca738
make depend
2026-04-11 22:09:01 +02:00
Robert Swiecki
ee2d05e874
Integrate a seccomp user notification to trace and log sandboxed filesystem and network operations
...
* Introduces a dedicated, async worker thread that monitors SECCOMP_RET_USER_NOTIF events
* Produces telemetry using protobufs to track resolved namespace paths, and network endpoints
2026-04-03 11:20:02 +02:00
Robert Swiecki
4f69b0bffb
Makefile: tests inbound connections properly
2026-04-03 02:22:18 +02:00
Robert Swiecki
508d9bf3b5
Refactor nstun TCP/UDP state machines and harden IPv6 handling
...
* Replace switch/goto dispatch with table-driven per-state handlers; deduplicate flow init
* Eliminate magic numbers - use named constants for buffer limits, timeouts, and struct sizes
* Block IPv4-compatible IPv6 addresses (SSRF) and cache redirect destinations per-flow
Replace switch/goto dispatch with table-driven per-state handlers; deduplicate flow init
Eliminate magic numbers: use named constants for buffer limits, timeouts, and struct sizes
Block IPv4-compatible IPv6 addresses (SSRF) and cache redirect destinations per-flow
2026-04-02 14:03:31 +02:00
Robert Swiecki
b6bf68c4c1
nstun: Harden networking stack and modernize to C++20
...
- Migrate TCP/UDP flow management to std::unique_ptr and packet parsing to std::span
- Add mandatory checksum validation for UDP (IPv4 optional, IPv6 per RFC 8200), closing parity with TCP/ICMP
- Handle IPv6 Authentication Header (AH) in extension header parser to prevent firewall rule bypass
- Add defense-in-depth MTU cap in tcp_process_data to prevent int32_t overflow in sequence arithmetic
- Fix uint16_t port loop overflow in HOST_TO_GUEST listener setup (infinite loop when dport_end=65535)
- Block SSRF via forged loopback/v4mapped destinations in both IPv4 and IPv6 TCP/UDP paths
- Extract policy evaluation and proxy encapsulation into standalone policy.cc and encap.cc modules
- Replace all raw inet_ntop+char[] patterns with ip4_to_string/ip6_to_string helpers
2026-04-01 19:38:13 +02:00
Robert Swiecki
2b1f4b0241
Makefile: reenable socks tests
2026-03-31 23:56:42 +02:00
Robert Swiecki
0381754dfc
nstun: add support for ENCAP_CONNECT - http connect encapsulation
2026-03-31 23:54:57 +02:00
Robert Swiecki
e49f75c528
Makefile: improved test (wget) for socks5
2026-03-31 07:51:59 +02:00
Robert Swiecki
0f8b4a389e
nstun: IPv6 implementation
2026-03-31 06:55:27 +02:00
Robert Swiecki
95617dd234
config+net: Refactored config.proto to make nstun the default user_net backend.
2026-03-29 13:59:40 +02:00
Robert Swiecki
254478dcf3
nstun: move checksum to a central file, use defer{} more liberally
2026-03-29 01:56:34 +01:00
Robert Swiecki
6276ae6be2
Add nstun, an experimental user-mode networking stack.
...
It provides lightweight IP-level connectivity for jailed processes via a TUN device and an epoll-based NAT proxy thread, as an alternative to pasta.
Supports TCP, UDP, and ICMP proxying with per-flow tracking, configurable firewall/redirect rules, SOCKS5 encapsulation for TCP and UDP.
2026-03-29 00:30:24 +01:00
Robert Swiecki
c0ff5eee8a
Makefile: test - shorten some tests from 2 to 1sec
2026-03-27 23:13:49 +01:00
Robert Swiecki
91e692a155
net: support for network rules
2026-03-27 21:24:23 +01:00
Robert Swiecki
d76d89c3f9
Makefile: more networking tests
2026-03-22 14:23:44 +01:00
Robert Swiecki
af79a9a1e7
Makefile+tests/: new seccomp tests
2026-03-22 10:30:13 +01:00
Robert Swiecki
d84a95ab9b
Makefile: tests for --chroot and --rw
2026-03-14 17:54:30 +01:00
Robert Swiecki
9af220ed07
Makefile: more local tests
2026-03-13 12:02:56 +01:00
Robert Swiecki
650d2b911d
mnt_newapi: honor generic mount flags for filesystem mounts
...
Parse generic mount options like ro , rw , nosuid , nodev , and noexec into nsjail remount flags instead of forwarding them to fsconfig() . Use the legacy remount path to apply final per-mount flags and remount the root recursively read-only so new-mount tmpfs behavior matches the legacy backend.
2026-03-13 11:50:54 +01:00
Robert Swiecki
f6df076d1f
Makefile: more tests #2
2026-03-11 22:16:13 +01:00
Robert Swiecki
a85ece3203
Makefile: more tests
2026-03-11 22:14:51 +01:00
Robert Swiecki
43e29559bc
Makefile: make depend
2026-03-11 21:05:40 +01:00
Robert Swiecki
10664fdd6f
Makefile: add rudimentary tests
2026-03-11 21:03:55 +01:00
Robert Swiecki
aa67120e86
pasta: allow for embedding of the pasta binary in the nsjail binary
2026-03-09 09:57:55 +01:00
Robert Swiecki
d20ea0a58a
Makefile: move 'install' before 'depend' which is automatic
2026-02-02 11:24:04 +01:00
Robert Swiecki
d8ea726682
Implement support for the new Linux mount API and refactor mount logic into dedicated files. Added the --experimental_mnt flag to allow forcing legacy or new mount behaviors.
2026-01-31 16:05:58 +01:00
Ishan Patel
607cacdc06
Packaging: Add Debian packaging support and install target
2026-01-30 23:34:23 +05:30
Robert Swiecki
04ad4b374b
Makefile: don't call pkg-config --cflags|libs protobuf for non-build targets, as each takes ~3 seconds to complete
2025-11-26 07:11:40 +01:00
Robert Swiecki
001bda0bc4
Makefile: parallel c++
2025-11-24 21:44:34 +01:00
Robert Swiecki
06350410ac
nsjail.h+all: move nsjail::NsJailConfig into struct nsj_t to avoid parameter duplicaiton. Now nsjail::NsJailConfig is the source of configuration truth for jails
2025-11-24 07:21:35 +01:00
Robert Swiecki
e5ef2d4631
Use -std=c++20 as it supports <version>
2025-05-09 17:17:25 +02:00
Robert Swiecki
5d31f8540a
make indent, also for json
2024-06-26 21:54:04 +02:00
Robert Swiecki
db7f0d0a23
.clang-format: use formatting based on .clang-format
2023-09-22 16:52:19 +02:00
Robert Swiecki
29f0a5b985
Makefile: indent .proto with the same cmd as *.cc *.h
2023-09-22 16:46:52 +02:00
Robert Swiecki
275de833ba
indent: use 'AlignEscapedNewlines: Right' to put backslashed in macros at ends of lines
2023-09-22 16:43:40 +02:00
Robert Swiecki
557633c1de
Makefile: move to c++17 to use [[maybe_unused]] and remove DEFER (actually not used) from macros.h
2023-09-21 08:29:36 +02:00
Robert Swiecki
439606be70
Makefile/indent: add AlwaysBreakBeforeMultilineStrings:false
2023-09-19 20:31:57 +02:00
Robert Swiecki
b32146cd78
Makefile: simplifications around config.pb.*
2023-09-18 21:29:30 +02:00
Robert Swiecki
cc4245d23a
make indent depend + style of comments
2022-11-22 22:15:01 +01:00
