Viktor Liu
5ea39dfe8a
Adjust limits for iOS
2025-01-06 23:53:12 +01:00
Viktor Liu
4a189a87ce
Use MTU for udp max size
2025-01-06 23:47:03 +01:00
Viktor Liu
fe7a2aa263
Fix test
2025-01-05 22:44:04 +01:00
Viktor Liu
290e6992a8
Demote close error levels
2025-01-05 14:50:17 +01:00
Viktor Liu
474fb33305
Remove established field from udp and icmp (unused)
2025-01-04 23:46:32 +01:00
Viktor Liu
766e0cccc9
Add packet tracer
2025-01-03 21:09:40 +01:00
Viktor Liu
7dfe7e426e
Always use userspace routing in netstack mode
2025-01-03 18:38:57 +01:00
Viktor Liu
eaadb75144
Add env var to force userspace routing if native routing is available
2025-01-03 18:02:35 +01:00
Viktor Liu
0b116b3941
Use native firewall for nat/firewall operations if available
2025-01-03 17:52:36 +01:00
Viktor Liu
f69dd6fb62
Make extra IPs from interfaces optional
2025-01-03 16:54:46 +01:00
Viktor Liu
62a20f5f1a
Add local IPs test
2025-01-03 16:50:00 +01:00
Viktor Liu
a6ad4dcf22
Close endpoint when stopping udp forwarder
2025-01-03 16:40:51 +01:00
Viktor Liu
f26b418e83
Allow to set firewall log level
2025-01-03 16:04:00 +01:00
Viktor Liu
979fe6bb6a
Reduce complexity and fix linter issues
2025-01-03 15:43:28 +01:00
Viktor Liu
c68be6b61b
Remove fractions of seconds
2025-01-03 15:18:36 +01:00
Viktor Liu
fc799effda
Set log level from logrus
2025-01-03 15:16:30 +01:00
Viktor Liu
955b2b98e1
Complete route ACLs and add tests
2025-01-03 15:16:23 +01:00
Viktor Liu
9490e9095b
Reduce complexity
2025-01-03 11:50:51 +01:00
Viktor Liu
d711172f67
Fix benchmarks
2025-01-03 11:30:55 +01:00
Viktor Liu
0c2fa38e26
Exclude benchmark from CI
2025-01-03 11:27:52 +01:00
Viktor Liu
0b9854b2b1
Fix tests
2025-01-03 00:01:40 +01:00
Viktor Liu
f772a21f37
Fix log level handling
2025-01-02 19:02:40 +01:00
Viktor Liu
e912f2d7c0
Fix double close in logger
2025-01-02 19:02:40 +01:00
Viktor Liu
568d064089
Drop certain forwarded icmp packets
2025-01-02 19:02:40 +01:00
Viktor Liu
911f86ded8
Support local IPs in netstack mode
2025-01-02 19:02:40 +01:00
Viktor Liu
2b8092dfad
Close endpoints
2025-01-02 16:41:54 +01:00
Viktor Liu
fa27369b59
Fix linter issues
2025-01-02 16:21:03 +01:00
Viktor Liu
657413b8a6
Move icmp acceptance logic
2025-01-02 15:59:53 +01:00
Viktor Liu
d85e57e819
Handle other icmp types in forwarder
2025-01-02 15:59:53 +01:00
Viktor Liu
7667886794
Add more tcp logging
2025-01-02 15:17:53 +01:00
Viktor Liu
a12a9ac290
Handle all local IPs
2025-01-02 14:59:41 +01:00
Viktor Liu
ed22d79f04
Add more control with env vars, also allow to pass traffic to native firewall
2025-01-02 13:40:36 +01:00
Viktor Liu
509b4e2132
Lower udp timeout and add teardown messages
2024-12-31 16:06:17 +01:00
Viktor Liu
fb1a10755a
Fix lint and test issues
2024-12-31 14:38:59 +01:00
Viktor Liu
9feaa8d767
Add icmp forwarder
2024-12-31 12:23:16 +01:00
Viktor Liu
6a97d44d5d
Improve udp implementation
2024-12-31 00:34:05 +01:00
Viktor Liu
d2616544fe
Add logger
2024-12-31 00:34:05 +01:00
Viktor Liu
fad82ee65c
Add stop methods and improve udp implementation
2024-12-30 14:30:53 +01:00
Viktor Liu
4199da4a45
Add userspace routing
2024-12-30 01:38:28 +01:00
Viktor Liu
b3c87cb5d1
[client] Fix inbound tracking in userspace firewall ( #3111 )
...
* Don't create state for inbound SYN
* Allow final ack in some cases
* Relax state machine test a little
2024-12-26 00:51:27 +01:00
Viktor Liu
ad9f044aad
[client] Add stateful userspace firewall and remove egress filters ( #3093 )
...
- Add stateful firewall functionality for UDP/TCP/ICMP in userspace firewalll
- Removes all egress drop rules/filters, still needs refactoring so we don't add output rules to any chains/filters.
- on Linux, if the OUTPUT policy is DROP then we don't do anything about it (no extra allow rules). This is up to the user, if they don't want anything leaving their machine they'll have to manage these rules explicitly.
2024-12-23 18:22:17 +01:00
Viktor Liu
940d0c48c6
[client] Don't return error in userspace mode without firewall ( #2924 )
2024-11-25 15:11:31 +01:00
Viktor Liu
940f8b4547
[client] Remove legacy forwarding rules in userspace mode ( #2782 )
2024-10-28 12:29:29 +01:00
Viktor Liu
8016710d24
[client] Cleanup firewall state on startup ( #2768 )
2024-10-24 14:46:24 +02:00
Zoltan Papp
fd67892cb4
[client] Refactor/iface pkg ( #2646 )
...
Refactor the flat code structure
2024-10-02 18:24:22 +02:00
Bethuel Mmbaga
ff7863785f
[management, client] Add access control support to network routes ( #2100 )
2024-10-02 13:41:00 +02:00
Maycon Santos
926e11b086
Remove default allow for UDP on unmatched packet ( #2300 )
...
This fixes an issue where UDP rules were ineffective for userspace clients (Windows/macOS)
2024-07-22 15:35:17 +02:00
Bethuel Mmbaga
263abe4862
Fix windows route exec path ( #1946 )
...
* Enable release workflow on PR and upload binaries
add GetSystem32Command to validate if a command is in the path
it will fall back to the full system32, assuming the OS driver is C
---------
Co-authored-by: Maycon Santos <mlsmaycon@gmail.com >
2024-05-09 13:48:15 +02:00
Zoltan Papp
006ba32086
Fix/acl for forward ( #1305 )
...
Fix ACL on routed traffic and code refactor
2023-12-08 10:48:21 +01:00
Yury Gargay
e37a337164
Add gosec linter ( #1342 )
...
This PR adds `gosec` linter with the following checks disabled:
- G102: Bind to all interfaces
- G107: Url provided to HTTP request as taint input
- G112: Potential slowloris attack
- G114: Use of net/http serve function that has no support for setting timeouts
- G204: Audit use of command execution
- G401: Detect the usage of DES, RC4, MD5 or SHA1
- G402: Look for bad TLS connection settings
- G404: Insecure random number source (rand)
- G501: Import blocklist: crypto/md5
- G505: Import blocklist: crypto/sha1
We have complaints related to the checks above. They have to be addressed separately.
2023-12-04 13:34:06 +01:00
