mirror of
https://github.com/google/nsjail.git
synced 2026-08-30 18:41:30 -07:00
b6bf68c4c1
- Migrate TCP/UDP flow management to std::unique_ptr and packet parsing to std::span - Add mandatory checksum validation for UDP (IPv4 optional, IPv6 per RFC 8200), closing parity with TCP/ICMP - Handle IPv6 Authentication Header (AH) in extension header parser to prevent firewall rule bypass - Add defense-in-depth MTU cap in tcp_process_data to prevent int32_t overflow in sequence arithmetic - Fix uint16_t port loop overflow in HOST_TO_GUEST listener setup (infinite loop when dport_end=65535) - Block SSRF via forged loopback/v4mapped destinations in both IPv4 and IPv6 TCP/UDP paths - Extract policy evaluation and proxy encapsulation into standalone policy.cc and encap.cc modules - Replace all raw inet_ntop+char[] patterns with ip4_to_string/ip6_to_string helpers