pangolin_mirror/newt
1
0
Fork 0
mirror of https://github.com/fosrl/newt.git synced 2026-03-26 12:36:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'dev' into msg-opt

Browse Source
This commit is contained in:
Owen
2026-03-03 16:54:23 -08:00
parent 6371e980d2 beaf386615
commit 7d6825132b
5 changed files with 89 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
netstack2/subnet_lookup.go
View File

@@ -167,10 +167,13 @@ func (sl *SubnetLookup) Match(srcIP, dstIP netip.Addr, port uint16, proto tcpip.
// Step 3: Check each rule for ICMP and port restrictions
for _, rule := range rules {
// Check if ICMP is disabled for this rule
if rule.DisableIcmp && (proto == header.ICMPv4ProtocolNumber || proto == header.ICMPv6ProtocolNumber) {
// ICMP is disabled for this subnet
return nil
// Handle ICMP before port range check — ICMP has no ports
if proto == header.ICMPv4ProtocolNumber || proto == header.ICMPv6ProtocolNumber {
if rule.DisableIcmp {
return nil
}
// ICMP is allowed; port ranges don't apply to ICMP
return rule
}
// Check port restrictions