Various hardening fixes - #148

Open

gasbytes wants to merge 13 commits into

wolfSSL:masterfrom

gasbytes:various-hardening-fixes

Commits on Aug 4, 2026

do not forward datagrams received as link-layer broadcast or multicast
gasbytes
committed
6749cf6

Commits on Aug 5, 2026

verify the DNS response question section against the outstanding query
gasbytes
committed
93b91f3
Add bytes offset tracking in parse_http_request when parsing header lines
gasbytes
committed
eded7c3
connect the dns query socket to the configured resolver so the UDP demux
gasbytes
committed
03037d2
re-notify the ethernet-layer filter after the 802.1Q tag is tripped so L2 policy keyed on the vlan sub-interface index or the inner ethertype can match, instead of only ever seeing the parent inter…
gasbytes
committed
5fed382
release the DHCP-learned DNS server along with the address, mask and gateway when a lease is lost
gasbytes
committed
90df38b
drop packets whose ipv4 option list contains an option with a length below the two-bytes minimum
gasbytes
committed
a43d0fb
release the tcp socket slot when closing a socket that never left TCP_CLOSED
gasbytes
committed
3db744f
drop non-rst segments that arrive without a timestamp option on a conenction where timestamps were negotiated
gasbytes
committed
0801e6a
join accumuluated header lines with CRLF instead of CRCR
gasbytes
committed
5201f2c

Commits on Aug 6, 2026