nebula

mirror of https://github.com/slackhq/nebula.git synced 2026-09-30 10:26:39 +02:00

Author	SHA1	Message	Date
Wade Simmons	7d3166a19d	cleanup ipv6 iputil helpers / skip reject for ICMP error packets and fragments (#1768 ) smoke-extra / freebsd-amd64 (push) Failing after 23s Details smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s Details smoke-extra / netbsd-amd64 (push) Failing after 14s Details smoke-extra / openbsd-amd64 (push) Failing after 15s Details smoke-extra / linux-386 (push) Failing after 17s Details smoke / Run multi node smoke test (push) Failing after 1m27s Details Build and test / Static checks (push) Successful in 53s Details Build and test / Test linux (push) Failing after 1m16s Details Build and test / Test linux-boringcrypto (push) Failing after 3m9s Details Build and test / Test linux-pkcs11 (push) Failing after 2m21s Details Build and test / Cross-build linux-arm (push) Successful in 3m5s Details Build and test / Cross-build linux-mips (push) Successful in 3m57s Details Build and test / Cross-build linux-other (push) Successful in 3m8s Details Build and test / Cross-build windows (push) Successful in 1m2s Details Build and test / Cross-build freebsd (push) Successful in 1m34s Details Build and test / Cross-build netbsd (push) Successful in 1m34s Details Build and test / Cross-build openbsd (push) Successful in 1m35s Details Build and test / Cross-build mobile (push) Successful in 3m19s Details smoke-extra / Run windows smoke test (push) Has been cancelled Details Build and test / Test macos (push) Has been cancelled Details Build and test / Test windows (push) Has been cancelled Details Build and test / CI status (push) Has been cancelled Details * cleanup ipv6 iputil helpers With my refactoring in this PR I accidentally had some duplicate logic, this PR cleans it up: - https://github.com/slackhq/nebula/pull/1766 * skip ICMP reject for ICMP error packets and fragments Per RFC 1122, ICMP error messages must not be generated in response to other ICMP error messages to prevent infinite error loops. This applies to both IPv4 (types 3, 4, 5, 11, 12) and IPv6 (types 1-4). Do not generate reject packets for IPv4 or IPv6 fragments. For IPv4, check MF flag and fragment offset. For IPv6, add isFragment return to ipv6FindUpperProtocol so a single traversal handles both protocol lookup and fragment detection. * do send rejects for the initial fragment RFC says "non-initial fragment"s * fix fragment checks	2026-06-16 16:51:14 -04:00
Wade Simmons	fe1c5682f0	add IPv6 support to CreateICMPEchoResponse (#1767 ) smoke-extra / freebsd-amd64 (push) Failing after 16s Details smoke-extra / linux-amd64-ipv6disable (push) Failing after 17s Details smoke-extra / netbsd-amd64 (push) Failing after 14s Details smoke-extra / openbsd-amd64 (push) Failing after 14s Details smoke-extra / linux-386 (push) Failing after 15s Details smoke / Run multi node smoke test (push) Failing after 1m28s Details Build and test / Static checks (push) Successful in 42s Details Build and test / Test linux (push) Failing after 1m29s Details Build and test / Test linux-boringcrypto (push) Failing after 2m51s Details Build and test / Test linux-pkcs11 (push) Failing after 2m51s Details Build and test / Cross-build linux-arm (push) Successful in 3m9s Details Build and test / Cross-build linux-mips (push) Successful in 3m51s Details Build and test / Cross-build linux-other (push) Successful in 3m16s Details Build and test / Cross-build windows (push) Successful in 1m3s Details Build and test / Cross-build freebsd (push) Successful in 1m38s Details Build and test / Cross-build netbsd (push) Successful in 1m36s Details Build and test / Cross-build openbsd (push) Successful in 1m36s Details Build and test / Cross-build mobile (push) Successful in 3m20s Details smoke-extra / Run windows smoke test (push) Has been cancelled Details Build and test / Test macos (push) Has been cancelled Details Build and test / Test windows (push) Has been cancelled Details Build and test / CI status (push) Has been cancelled Details The function previously only handled IPv4 ICMP Echo Request packets. This adds handling for IPv6 ICMPv6 Echo Request (type 128) by generating a proper Echo Reply (type 129) with correct pseudo-header checksum.	2026-06-16 13:16:47 -04:00
Wade Simmons	e4cc80aaca	add IPv6 reject packet generation (#1766 ) * add IPv6 reject packet generation (ICMPv6 Destination Unreachable and TCP RST) * use ICMPv6 code 1 (administratively prohibited) and cap body at 1000 bytes * cleanup, use ICMP error code 13 for ipv4 * better docs * cleanup	2026-06-16 13:04:21 -04:00
Wade Simmons	fe16ea566d	firewall reject packets: cleanup error cases (#957 )	2023-11-13 12:43:51 -06:00