Commit Graph

Select branches

Hide Pull Requests

4.0

gh-pages

master

#1

#10

#102

#103

#104

#107

#109

#11

#114

#116

#119

#12

#120

#123

#128

#129

#13

#130

#133

#136

#14

#144

#145

#147

#148

#15

#150

#154

#160

#164

#170

#171

#172

#173

#177

#179

#182

#183

#184

#185

#186

#187

#191

#192

#193

#197

#2

#201

#207

#208

#209

#21

#214

#219

#22

#220

#227

#233

#234

#235

#239

#24

#241

#245

#246

#249

#25

#251

#254

#255

#256

#257

#258

#259

#260

#264

#265

#267

#268

#269

#270

#271

#272

#272

#274

#275

#276

#277

#278

#279

#280

#281

#282

#283

#284

#285

#286

#287

#288

#289

#290

#290

#291

#292

#293

#294

#296

#297

#298

#299

#3

#30

#300

#302

#303

#304

#305

#306

#307

#308

#310

#311

#311

#313

#313

#314

#314

#315

#315

#316

#316

#317

#317

#34

#39

#4

#42

#43

#44

#44

#46

#49

#5

#50

#51

#54

#55

#56

#58

#6

#61

#63

#64

#66

#67

#68

#7

#72

#74

#75

#77

#79

#8

#82

#85

#9

#90

#94

#96

#98

#99

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

2.0

2.1

2.2

2.3

2.4

2.5

2.6

2.7

2.8

2.9

3.0

3.1

3.2

3.3

3.4

3.5

3.6

Mono Color

• f100fd917c Merge pull request #310 from carrerasdarren-cell/fix/fail-closed-setsid master robertswiecki 2026-08-27 23:18:02 +02:00
• 660c20d237 contain: fail closed when setsid fails Darren Carreras 2026-08-27 12:47:15 -04:00
• 44e08fd4e5 make indent depend Robert Swiecki 2026-08-26 21:39:07 +02:00
• 60fe8833a8 Makefile: align OLD_EF submount test expectations with recursive remount Robert Swiecki 2026-08-26 21:36:45 +02:00
• 5beb5202d6 user: allow unprivileged user namespace creation when setgroups is denied Robert Swiecki 2026-08-26 21:33:15 +02:00
• 229682c59e Merge pull request #292 from M0nd0R/fix-mount-staging-escape Robert Swiecki 2026-08-26 21:20:27 +02:00
• ae5b35b2d0 Merge pull request #284 from h1-mrz/recursive-bind-mount-flags Robert Swiecki 2026-08-26 21:20:11 +02:00
• b0d163391c Merge pull request #283 from h1-mrz/harden-proc-mount-flags robertswiecki 2026-08-26 20:36:43 +02:00
• fc38d1257a Merge branch 'master' of github.com:google/nsjail Robert Swiecki 2026-08-26 20:20:49 +02:00
• 9304f3c475 Merge pull request #281 from attaboy11/integer_parsing Robert Swiecki 2026-08-26 20:19:52 +02:00
• 8dd3a7343f Merge pull request #293 from carrerasdarren-cell/unotify-atomic-reports Robert Swiecki 2026-08-26 20:19:16 +02:00
• 1a13dc98fa Merge pull request #268 from Vincent550102/reject_directory_stdio Robert Swiecki 2026-08-26 20:12:26 +02:00
• 012e316fe4 Merge pull request #299 from srkyn/fix-pdeathsig-setup-race robertswiecki 2026-08-26 20:11:25 +02:00
• 30d8e4013f Merge branch 'master' of github.com:google/nsjail Robert Swiecki 2026-08-26 20:09:35 +02:00
• 5d53b5c28b Merge pull request #282 from carrerasdarren-cell/nstun-cloud-local-destinations Robert Swiecki 2026-08-26 20:08:34 +02:00
• 8133324414 Merge pull request #288 from carrerasdarren-cell/fix/fail-closed-setgroups robertswiecki 2026-08-26 20:05:57 +02:00
• 16970c3fd9 Merge pull request #285 from h1-mrz/fail-loud-seccomp-unotify robertswiecki 2026-08-26 20:02:59 +02:00
• 79d12b54f2 Merge pull request #289 from carrerasdarren-cell/fix/nstun-policy-validation Robert Swiecki 2026-08-26 11:48:27 +02:00
• 1a923df739 nstun: drop IPv6 unspecified and multicast packets in SSRF gate Robert Swiecki 2026-08-26 11:45:35 +02:00
• 2ed350a0f2 Merge pull request #302 from mustafagozhamam/fix/nstun-parent-lifecycle robertswiecki 2026-08-26 09:23:13 +02:00
• c398ceda2f Merge pull request #300 from skaiea13-ai/codex/nstun-aggregate-budget robertswiecki 2026-08-25 21:20:12 +02:00
• 62f41cbfb7 Merge pull request #306 from Trithem90/fix/nstun-any-proxy-icmp robertswiecki 2026-08-25 21:19:00 +02:00
• 3bd39a9acf Merge pull request #303 from Trithem90/fix/nstun-host-to-guest-policy robertswiecki 2026-08-25 21:17:38 +02:00
• f9a32c024b Merge pull request #308 from Nexory/unotify-trace-path-siblings robertswiecki 2026-08-25 21:17:02 +02:00
• a36f97f24d Merge pull request #278 from sravan27/harden-cgroup-memory-cleanup robertswiecki 2026-08-25 21:16:05 +02:00
• 40a34d0170 Merge pull request #286 from srkyn/harden-no-new-privs-failure robertswiecki 2026-08-25 21:15:26 +02:00
• c39f43ddcb Merge pull request #304 from Trithem90/fix/nstun-zero-network-cidr robertswiecki 2026-08-25 21:14:35 +02:00
• d0363ed7d2 Merge pull request #280 from g0w6y/nstun_tcp_ack_window_validation robertswiecki 2026-08-25 15:54:34 +02:00
• 935cd6e0b8 unotify: trace faccessat2, truncate, statfs and the xattr syscalls Nexory 2026-08-25 05:17:02 +02:00
• c4a2631477 unotify: emit syscall numbers in the generated kafel policy Nexory 2026-08-25 05:12:28 +02:00
• b4cff719c2 Limit nstun TCP receive buffers with a shared payload budget skaiea13-ai 2026-08-22 04:30:29 +09:00
• 8a751f0166 nstun: fail closed for proxy actions matched by ICMP Trithem90 2026-08-21 13:57:16 +02:00
• 6673fe6758 nstun: preserve zero-network CIDR selectors Trithem90 2026-08-21 12:15:24 +02:00
• 70094631bb nstun: enforce HOST_TO_GUEST policy on inbound TCP and UDP Trithem90 2026-08-21 11:01:22 +02:00
• 9f166b999f Fix NSTUN parent lifecycle cleanup Mustafa 2026-08-18 21:31:15 +03:00
• 900f6649e2 contain: close parent-death signal setup race David Sarkisyan 2026-08-15 16:31:04 -04:00
• 6cd216d0aa Harden new mount API against symlink escapes during staging mundur 2026-07-28 01:36:17 +00:00
• 3ecde9562a unotify: write reports privately and atomically Darren Carreras 2026-07-27 20:13:14 -04:00
• 9b54e97fd4 Reject path traversal in mount destinations during jail staging mundur 2026-07-27 10:53:58 +00:00
• 5ebcc30bef Merge pull request #291 from yexinw-ctrl/statx-unotify-trace robertswiecki 2026-07-27 09:09:09 +02:00
• c20246ad0a unotify: trace statx yexinw 2026-07-27 00:10:11 +00:00
• 93c3cadb81 user: fail closed when supplementary groups cannot be set Darren Carreras 2026-07-21 18:10:46 -04:00
• 0d905f1da2 nstun: reject invalid policy rule fields Darren Carreras 2026-07-21 19:59:04 -04:00
• 3c9e848c61 contain: fail closed when no_new_privs cannot be set David Sarkisyan 2026-07-20 14:41:33 -04:00
• 70fc359713 mnt: apply per-mount nosuid/nodev/noexec recursively to recursive binds h1-mrz 2026-07-18 08:40:07 -04:00
• 09dd8be0c0 sandbox: fail loudly when seccomp_unotify is requested but unusable h1-mrz 2026-07-18 08:40:07 -04:00
• d01bfe3602 mnt: mount the auto-provisioned /proc nosuid,nodev,noexec h1-mrz 2026-07-18 08:13:16 -04:00
• bd9439b3f2 nstun: block cloud-local service destinations Darren Carreras 2026-07-16 18:42:09 -04:00
• 0a21f80078 Reject invalid integer command-line arguments attaboy11 2026-07-16 19:50:07 +01:00
• a460c1b6a0 nstun/tcp: validate guest ACK numbers against the send window g0w6y 2026-07-15 20:02:17 +05:30
• b190cd94db cgroup: clean up swap-only memory cgroups sravan27 2026-07-13 21:23:02 +05:30
• d6454b4640 Merge pull request #271 from Alvov1/use-core-scheduling robertswiecki 2026-06-18 08:48:14 +02:00
• 81784bfbac contain: add core scheduling support (PR_SCHED_CORE) Alexander Lvov 2026-06-10 14:22:40 +03:00
• 1595ebcdf1 Merge pull request #270 from philwo/fix-unused-result robertswiecki 2026-05-28 22:27:26 +02:00
• 5674c622c4 Merge pull request #269 from philwo/fix/exec-file-clobbered-by-positional-argv robertswiecki 2026-05-28 22:26:15 +02:00
• 7e4a6fb5a6 unotify: check return value of TextFormat::PrintToString Philipp Wollermann 2026-05-27 07:24:41 +09:00
• c4f20c7dae cmdline: stop overwriting --exec_file with positional argv[0] Philipp Wollermann 2026-05-24 10:26:35 +09:00
• 9d41a57452 Reject directory stdio fds unless explicitly passed Vincent550102 2026-05-11 20:04:39 +08:00
• 66ad78dc36 unotify: ignore ENOENT and EINPROGRESS when logging SECCOMP_IOCTL_NOTIF_SEND failures rsc 2026-05-08 09:41:43 +02:00
• 0c95a1f7a9 unotify: fix unotify implementation rsc 2026-05-07 06:51:10 +02:00
• 9853352c7c Merge pull request #265 from sharadboni/fix/double-free-nl-cache-initParent robertswiecki 2026-05-05 10:22:25 +02:00
• 5b52bf10f0 Merge pull request #264 from kiyoungkim-gg/patch-1 robertswiecki 2026-05-05 10:21:58 +02:00
• 831ddd215b net: remove redundant nl_cache_free calls to fix double-free in initParent Sharad Boni 2026-04-27 15:26:17 -07:00
• a1dd160283 Fix ESRCH in sched_setaffinity due to glibc TID caching with clone3 kiyoungkim-gg 2026-04-27 15:02:38 +09:00
• 6356dee0c6 Makefile/all: make libnl3 optional Robert Swiecki 2026-04-14 14:26:28 +02:00
• 388b9655a6 tests/pasta-nat: copy of nstun.cfg 4.0 Robert Swiecki 2026-04-13 22:41:07 +02:00
• 1d2fe133d2 sockproxy: [[nodiscard]] + TEMP_FAILURE_RETRY Robert Swiecki 2026-04-13 22:22:45 +02:00
• c6f49b7209 make depend Robert Swiecki 2026-04-13 21:50:38 +02:00
• 7db55fe5eb make indent Robert Swiecki 2026-04-13 21:49:49 +02:00
• ffb63d34c0 nstun: improve socket teardown logic and socks5 stability Robert Swiecki 2026-04-13 21:43:53 +02:00
• 7205b841a6 Apply nodiscard to critical core bounds validation and setup primitives Robert Swiecki 2026-04-13 21:29:26 +02:00
• ca4e1654a6 nstun: implement kernel checksum offloading for TUN traffic Robert Swiecki 2026-04-12 17:35:24 +02:00
• 078ab1c24c nstun: replace scalar 32-bit checksum loop with unrolled 64-bit accumulation (8 x uint32 per iteration) to reduce CPU overhead on high-throughput receive paths Robert Swiecki 2026-04-12 16:30:07 +02:00
• 5b5901693d nstun: increase buffer size(s) for INET connections Robert Swiecki 2026-04-12 16:11:12 +02:00
• 9c0e1d6371 make indent Robert Swiecki 2026-04-12 13:21:23 +02:00
• 35c87dc027 unotify: use defer{} Robert Swiecki 2026-04-12 13:21:10 +02:00
• 6e35465e20 unotify: C-style comments Robert Swiecki 2026-04-12 13:17:49 +02:00
• 4466c247e8 unotify: refactor the unotify syscall decoding engine into modular helper functions Robert Swiecki 2026-04-12 13:16:09 +02:00
• f4c91c7a17 make indent Robert Swiecki 2026-04-12 12:01:36 +02:00
• 253f90d9e9 sockproxy: refactor the sockproxy to better support TCP half-close semantics Robert Swiecki 2026-04-12 11:59:36 +02:00
• a765c5a3c0 sandbox: stylistic changes, NULL->nullptr, and settling on util::syscall(__NR_seccomp) Robert Swiecki 2026-04-12 11:52:17 +02:00
• e7e45fa53a pid: stylistic changes to dbg messgaes, and NULL->nullptr Robert Swiecki 2026-04-12 11:46:45 +02:00
• 6546162aec Makefile: fix -Ml test Robert Swiecki 2026-04-12 11:44:05 +02:00
• 02cd0de73b nstun: Refactor UDP flow initialization to use native structs and improve SOCKS5 proxy state tracing Robert Swiecki 2026-04-12 11:35:14 +02:00
• 84d8d7c241 make depend Robert Swiecki 2026-04-12 11:06:40 +02:00
• 8dd5332eee nstun: refactor TCP proxy handlers Robert Swiecki 2026-04-12 11:04:20 +02:00
• 9cdd389732 nstun: TUN interface reads with batched reads and refactor address parsing Robert Swiecki 2026-04-12 10:48:31 +02:00
• dd106c6e1b nstun: Fix ARM64 compilation by explicitly including <cstddef> for std::max_align_t Robert Swiecki 2026-04-12 10:38:35 +02:00
• 73a85ccf65 nstun/icmp: ICMP flow zero-initialization and clean up policy action switch blocks Robert Swiecki 2026-04-12 10:36:46 +02:00
• 8137def843 nstun: align the receive buffer to the largerst alignment for mmx/sse/avx Robert Swiecki 2026-04-12 10:26:05 +02:00
• f7f1470c7f nsjail: stylistic changes (NULL->nullptr) and some optional error checks Robert Swiecki 2026-04-12 10:18:29 +02:00
• 0bebe002d1 net: stylistic changes related to TrafficRule Robert Swiecki 2026-04-12 10:12:31 +02:00
• 12b182c3f3 log: use ANSI color constants instead of magical escape strings Robert Swiecki 2026-04-12 09:56:35 +02:00
• cac6a0df38 cap: Future-proofig - drop unknown-to-us capabilities Robert Swiecki 2026-04-12 09:43:21 +02:00
• 869513d15a Makefile: compiling with a few protections Robert Swiecki 2026-04-12 09:29:57 +02:00
• f94421b8a9 monitor: replace STL containers with fixed arrays, harden child setup, set default values for ProxyPipes Robert Swiecki 2026-04-12 01:07:29 +02:00
• 302fef8b64 nstun/tcp: heap-allocate TCP flow buffers to fix throughput regression Robert Swiecki 2026-04-12 00:55:43 +02:00
• 5495e26e89 unotify: refactor sockaddr parsing, reduce allocations, move per-call heap allocations to thread_local globals to avoid repeated alloc/free in the hot path Robert Swiecki 2026-04-12 00:36:35 +02:00
• df88a33b9a sockproxy: refactor proxyPumpCb and fix client disconnect detection Robert Swiecki 2026-04-12 00:12:42 +02:00
• ef7697fe1e sockproxy/sockproxy: kill the jail is the client connection goes down Robert Swiecki 2026-04-11 22:30:36 +02:00