v0.17.0

domcyrus/rustnetv0.17.0Dec 7, 2025by github-actions[bot]

AI Summary

Security-focused release introducing Landlock sandbox for Linux with filesystem and network restrictions, plus eBPF thread name resolution to map thread names to main process names. Adds AUR package automation for Arch Linux.

Key Highlights

Landlock Sandbox for Linux with /proc restriction and network sandboxing
eBPF Thread Name Resolution mapping 'Socket Thread' to 'firefox'
AUR Package Automation for Arch Linux
Platform Code Reorganization into per-platform directories
Drops CAP_NET_RAW capability after pcap handle is opened

New Features

Landlock Sandbox for Linux with --no-sandbox and --sandbox-strict options
eBPF Thread Name Resolution with procfs PID cache
AUR Package Automation

Full Release Notes

### Added
- **Landlock Sandbox for Linux**: Filesystem and network sandboxing for enhanced security
  - Restricts filesystem access to `/proc` only after initialization
  - Network sandbox blocks TCP bind/connect on kernel 6.4+
  - Drops `CAP_NET_RAW` capability after pcap handle is opened
  - New CLI options: `--no-sandbox` and `--sandbox-strict`
  - Comprehensive security documentation in SECURITY.md
- **eBPF Thread Name Resolution**: Resolve eBPF thread names (e.g., 'Socket Thread') to main process names (e.g., 'firefox')
  - Uses periodic procfs PID cache for resolution
  - Falls back to eBPF name for short-lived processes
- **AUR Package Automation**: Automated Arch Linux AUR package publishing workflow

### Changed
- **Platform Code Reorganization**: Restructured platform-specific code into cleaner module hierarchy
  - `src/network/platform/linux/` - Linux-specific code with eBPF and sandbox subdirectories
  - `src/network/platform/macos/` - macOS-specific code
  - `src/network/platform/freebsd/` - FreeBSD-specific code
  - `src/network/platform/windows/` - Windows-specific code
- **QUIC DPI Simplification**: Unified SNI extraction helpers and simplified QUIC protocol handling

### Fixed
- **Test Determinism**: Made RateTracker tests deterministic with injectable timestamps

## What's Changed
* feat: reorganize platform code into per-platform directories by @domcyrus in https://github.com/domcyrus/rustnet/pull/81
* chore(deps): bump vmactions/freebsd-vm from 1.2.7 to 1.2.8 in the actions group by @dependabot[bot] in https://github.com/domcyrus/rustnet/pull/82
* chore(deps): bump pcap from 2.3.0 to 2.4.0 in the rust-dependencies group by @dependabot[bot] in https://github.com/domcyrus/rustnet/pull/83
* refactor: simplify QUIC DPI and reorganize platform code by @domcyrus in https://github.com/domcyrus/rustnet/pull/84
* fix: make RateTracker tests deterministic with injectable timestamps by @domcyrus in https://github.com/domcyrus/rustnet/pull/85
* feat: add Landlock sandbox and capability dropping for Linux by @domcyrus in https://github.com/domcyrus/rustnet/pull/86
* fix(linux): resolve eBPF thread names to main process names by @domcyrus in https://github.com/domcyrus/rustnet/pull/87


**Full Changelog**: https://github.com/domcyrus/rustnet/compare/v0.16.1...v0.17.0