14 Commits

Include renames

Author	SHA1	Message	Date
Jack Doan	dd8f660c0a	save about 10MB of RAM by not importing gopacket except for tests (#1864) ... * save about 10MB of RAM by not importing gopacket except for tests * big ol find-replace	2026-08-28 14:00:09 -05:00
Caleb Jasik	ec3304e3a9	Recompute the transport checksum on self-forwarded packets (#1862)	2026-08-27 16:10:32 -05:00
Jack Doan	edc3c5e018	the definitive tun offloads branch (#1704)	2026-08-21 11:57:38 -05:00
Nate Brown	49e35d1283	parseV6: only walk real ipv6 extension headers, fail closed on unknown protocols (#1840)	2026-08-20 13:21:08 -05:00
Nate Brown	abfeb502a8	iputil: fix infinite loop in ipv6FindUpperProtocol from uint8 extension-header length overflow (#1784)	2026-07-07 13:28:52 -05:00
Wade Simmons	7d3166a19d	cleanup ipv6 iputil helpers / skip reject for ICMP error packets and fragments (#1768) ... * cleanup ipv6 iputil helpers With my refactoring in this PR I accidentally had some duplicate logic, this PR cleans it up: - https://github.com/slackhq/nebula/pull/1766 * skip ICMP reject for ICMP error packets and fragments Per RFC 1122, ICMP error messages must not be generated in response to other ICMP error messages to prevent infinite error loops. This applies to both IPv4 (types 3, 4, 5, 11, 12) and IPv6 (types 1-4). Do not generate reject packets for IPv4 or IPv6 fragments. For IPv4, check MF flag and fragment offset. For IPv6, add isFragment return to ipv6FindUpperProtocol so a single traversal handles both protocol lookup and fragment detection. * do send rejects for the initial fragment RFC says "non-initial fragment"s * fix fragment checks	2026-06-16 16:51:14 -04:00
Wade Simmons	fe1c5682f0	add IPv6 support to CreateICMPEchoResponse (#1767) ... The function previously only handled IPv4 ICMP Echo Request packets. This adds handling for IPv6 ICMPv6 Echo Request (type 128) by generating a proper Echo Reply (type 129) with correct pseudo-header checksum.	2026-06-16 13:16:47 -04:00
Wade Simmons	e4cc80aaca	add IPv6 reject packet generation (#1766) ... * add IPv6 reject packet generation (ICMPv6 Destination Unreachable and TCP RST) * use ICMPv6 code 1 (administratively prohibited) and cap body at 1000 bytes * cleanup, use ICMP error code 13 for ipv4 * better docs * cleanup	2026-06-16 13:04:21 -04:00
4 people	d97ed57a19	V2 certificate format (#1216) ... Co-authored-by: Nate Brown <nbrown.us@gmail.com> Co-authored-by: Jack Doan <jackdoan@rivian.com> Co-authored-by: brad-defined <77982333+brad-defined@users.noreply.github.com> Co-authored-by: Jack Doan <me@jackdoan.com>	2025-03-06 11:28:26 -06:00
Nate Brown	e264a0ff88	Switch most everything to netip in prep for ipv6 in the overlay (#1173)	2024-07-31 10:18:56 -05:00
Wade Simmons	fe16ea566d	firewall reject packets: cleanup error cases (#957)	2023-11-13 12:43:51 -06:00
Wade Simmons	6e0ae4f9a3	firewall: add option to send REJECT replies (#738) ... * firewall: add option to send REJECT replies This change allows you to configure the firewall to send REJECT packets when a packet is denied. firewall: # Action to take when a packet is not allowed by the firewall rules. # Can be one of: # `drop` (default): silently drop the packet. # `reject`: send a reject reply. # - For TCP, this will be a RST "Connection Reset" packet. # - For other protocols, this will be an ICMP port unreachable packet. outbound_action: drop inbound_action: drop These packets are only sent to established tunnels, and only on the overlay network (currently IPv4 only). $ ping -c1 192.168.100.3 PING 192.168.100.3 (192.168.100.3) 56(84) bytes of data. From 192.168.100.3 icmp_seq=2 Destination Port Unreachable --- 192.168.100.3 ping statistics --- 2 packets transmitted, 0 received, +1 errors, 100% packet loss, time 31ms $ nc -nzv 192.168.100.3 22 (UNKNOWN) [192.168.100.3] 22 (?) : Connection refused This change also modifies the smoke test to capture tcpdump pcaps from both the inside and outside to inspect what is going on over the wire. It also now does TCP and UDP packet tests using the Nmap version of ncat. * calculate seq and ack the same was as the kernel The logic a bit confusing, so we copy it straight from how the kernel does iptables `--reject-with tcp-reset`: - https://github.com/torvalds/linux/blob/v5.19/net/ipv4/netfilter/nf_reject_ipv4.c#L193-L221 * cleanup	2023-03-13 15:08:40 -04:00
Wade Simmons	45d1d2b6c6	Update dependencies - 2022-04 (#664) ... Updated github.com/kardianos/service https://github.com/kardianos/service/compare/v1.2.0...v1.2.1 Updated github.com/miekg/dns https://github.com/miekg/dns/compare/v1.1.43...v1.1.48 Updated github.com/prometheus/client_golang https://github.com/prometheus/client_golang/compare/v1.11.0...v1.12.1 Updated github.com/prometheus/common https://github.com/prometheus/common/compare/v0.32.1...v0.33.0 Updated github.com/stretchr/testify https://github.com/stretchr/testify/compare/v1.7.0...v1.7.1 Updated golang.org/x/crypto https://github.com/golang/crypto/compare/5770296d904e...ae2d96664a29 Updated golang.org/x/net https://github.com/golang/net/compare/69e39bad7dc2...749bd193bc2b Updated golang.org/x/sys https://github.com/golang/sys/compare/7861aae1554b...289d7a0edf71 Updated golang.zx2c4.com/wireguard/windows v0.5.1...v0.5.3 Updated google.golang.org/protobuf v1.27.1...v1.28.0	2022-04-18 12:12:25 -04:00
Nate Brown	bcabcfdaca	Rework some things into packages (#489)	2021-11-03 20:54:04 -05:00