Robert Swiecki
68832ab865
nstun: remove dead code, and change some functions to static
2026-04-02 01:31:57 +02:00
Robert Swiecki
1984f83a45
nstun/tcp: remove dead mss/window code
2026-04-02 01:18:26 +02:00
Robert Swiecki
15f730cdba
nstun: handle EPOLLHUP/EPOLLERR for TCP
2026-04-02 00:59:14 +02:00
Robert Swiecki
15e16bc93b
nstun: make Flow a base clase, with derivative classes for each supported proto
2026-04-02 00:52:22 +02:00
Robert Swiecki
1695944e40
tests - config for TCP/UDP redirection
2026-04-01 21:55:53 +02:00
Robert Swiecki
b6bf68c4c1
nstun: Harden networking stack and modernize to C++20
...
- Migrate TCP/UDP flow management to std::unique_ptr and packet parsing to std::span
- Add mandatory checksum validation for UDP (IPv4 optional, IPv6 per RFC 8200), closing parity with TCP/ICMP
- Handle IPv6 Authentication Header (AH) in extension header parser to prevent firewall rule bypass
- Add defense-in-depth MTU cap in tcp_process_data to prevent int32_t overflow in sequence arithmetic
- Fix uint16_t port loop overflow in HOST_TO_GUEST listener setup (infinite loop when dport_end=65535)
- Block SSRF via forged loopback/v4mapped destinations in both IPv4 and IPv6 TCP/UDP paths
- Extract policy evaluation and proxy encapsulation into standalone policy.cc and encap.cc modules
- Replace all raw inet_ntop+char[] patterns with ip4_to_string/ip6_to_string helpers
2026-04-01 19:38:13 +02:00
Robert Swiecki
2b1f4b0241
Makefile: reenable socks tests
2026-03-31 23:56:42 +02:00
Robert Swiecki
0381754dfc
nstun: add support for ENCAP_CONNECT - http connect encapsulation
2026-03-31 23:54:57 +02:00
Robert Swiecki
ea5d664561
nsjail: increase RLIMIT_NOFILE to min 8192
2026-03-31 08:32:40 +02:00
Robert Swiecki
e49f75c528
Makefile: improved test (wget) for socks5
2026-03-31 07:51:59 +02:00
Robert Swiecki
5151646146
nstun: IPv6 implementation
2026-03-31 07:49:52 +02:00
Robert Swiecki
0f8b4a389e
nstun: IPv6 implementation
2026-03-31 06:55:27 +02:00
Robert Swiecki
17836b71a3
nstun: use writev
2026-03-30 17:05:21 +02:00
Robert Swiecki
6b850698a5
nstun: use designated initializers with structs
2026-03-30 13:03:13 +02:00
Robert Swiecki
6c7788d62a
nstun: add missing TCP state - TcpState::CLOSING
2026-03-30 11:17:16 +02:00
Robert Swiecki
2ee9590ba6
nstun: use redirect_port correctly for REDIRECT's
2026-03-30 09:39:04 +02:00
Robert Swiecki
53584b422e
nstun: centralize src ip address checks to ip.cc
2026-03-30 09:25:37 +02:00
Robert Swiecki
033adf6128
nstun: faster downloads by draining upstream TCP sockets
2026-03-30 09:00:05 +02:00
Robert Swiecki
a2bd0b0ad1
nstun: Implement HOST_TO_GUEST forwarding
2026-03-30 07:12:52 +02:00
Robert Swiecki
1d5282c23c
net: remove encap for traffic rules (ip-route), it can be done via a backend
2026-03-29 14:37:19 +02:00
Robert Swiecki
dd3b8cdd27
nstun: ntohl is not always constexpr
2026-03-29 14:10:53 +02:00
Robert Swiecki
8c570c865b
nstun: increase MTU to 32kB, and stop clearing stack buffers where not needed
2026-03-29 14:07:47 +02:00
Robert Swiecki
95617dd234
config+net: Refactored config.proto to make nstun the default user_net backend.
2026-03-29 13:59:40 +02:00
Robert Swiecki
254478dcf3
nstun: move checksum to a central file, use defer{} more liberally
2026-03-29 01:56:34 +01:00
Robert Swiecki
6276ae6be2
Add nstun, an experimental user-mode networking stack.
...
It provides lightweight IP-level connectivity for jailed processes via a TUN device and an epoll-based NAT proxy thread, as an alternative to pasta.
Supports TCP, UDP, and ICMP proxying with per-flow tracking, configurable firewall/redirect rules, SOCKS5 encapsulation for TCP and UDP.
2026-03-29 00:30:24 +01:00
Robert Swiecki
c0ff5eee8a
Makefile: test - shorten some tests from 2 to 1sec
2026-03-27 23:13:49 +01:00
Robert Swiecki
91e692a155
net: support for network rules
2026-03-27 21:24:23 +01:00
Robert Swiecki
dec538154b
net: add F_SEAL_FUTURE_WRITE definition, if missing
2026-03-25 08:47:06 +01:00
Robert Swiecki
0fc9573263
Fix -Wctad-maybe-unsupported warning by adding an explicit deduction guide for Defer
2026-03-25 08:45:17 +01:00
Robert Swiecki
024c6fec42
mnt: put missing MS_ ST_ definitions in one place
2026-03-25 08:27:06 +01:00
Robert Swiecki
7a0a622db3
config.proto/net: add explicit ip4_enabled and ip6_enabled
2026-03-24 20:35:01 +01:00
Robert Swiecki
be530dd414
net/pasta: the -6/-4 condition should be reversed
2026-03-24 20:21:26 +01:00
Robert Swiecki
b1370d2315
Readme+man: updates for newer options
2026-03-23 22:14:10 +01:00
Robert Swiecki
5c21086f89
oom_score_adj + simpler pasta port forwarding config
2026-03-22 21:21:18 +01:00
Robert Swiecki
b3a82bfda7
test: port-mappings - make ports sam for UDP/TCP to make sure it is possible
2026-03-22 21:01:41 +01:00
Robert Swiecki
55a48e7c63
tests/: increase default time limit to 100s
2026-03-22 17:30:53 +01:00
Robert Swiecki
d76d89c3f9
Makefile: more networking tests
2026-03-22 14:23:44 +01:00
Robert Swiecki
adb3e30d76
net: move pasta child function into another func, and create a specific config for port mappings
2026-03-22 13:48:47 +01:00
Robert Swiecki
af79a9a1e7
Makefile+tests/: new seccomp tests
2026-03-22 10:30:13 +01:00
Robert Swiecki
daea5023b9
net: separate nat from port mappings
2026-03-22 09:56:58 +01:00
Robert Swiecki
af263a596d
net: improvement for execvpe(pasta) error message
2026-03-22 01:55:17 +01:00
Robert Swiecki
cb1935bcd0
net: support -t/-u for --splice-only
2026-03-22 01:18:19 +01:00
Robert Swiecki
701c71bb27
net: honor NSJAIL_PASTA_PATH
2026-03-22 01:07:26 +01:00
Robert Swiecki
d9b197c473
net: add support for mapping tcp/udp ports out
2026-03-22 00:03:15 +01:00
Robert Swiecki
d7ac1258a4
net: don't bring up 'lo' if it's already up
2026-03-21 01:42:45 +01:00
robertswiecki
f8869b8978
Merge pull request #259 from n-agi/fix-rlimit-def-scaling
...
Fix inherited rlimit handling for CLI options
2026-03-20 09:46:24 +01:00
n-agi
dc5338c637
Fix inherited rlimit handling for CLI options
2026-03-19 11:17:29 +00:00
Robert Swiecki
f78475530b
sandbox: log + make indent
2026-03-18 22:36:52 +01:00
robertswiecki
7850324516
Merge pull request #258 from tkeliris/fix-seccomp-string-concat
...
Fix handling of repeated seccomp_string entries
2026-03-18 22:35:26 +01:00
Tasos Keliris
db67cf1fd2
Fix handling of repeated seccomp_string entries
2026-03-18 10:41:10 +02:00
