domcyrus/rustnet

Goal Publish RustNet on conda-forge for Conda and pixi users. We are looking for someone willing to create and maintain the feedstock, including future version updates. Scope Submit a recipe for a tagged release to conda-forge/staged-recipes. Start with Linux x86_64/aarch64 and macOS x86_64/arm64. Build from source with RustNet's default features, including eBPF on Linux. Declare libpcap and other required build/runtime dependencies, and account for conda-forge's network-isolated builds. Verify installation, rustnet --version, and a real packet capture on supported platforms. Document the required capture permissions. Once published, add installation instructions to the supported documentation languages. Windows can be handled separately. Its build currently downloads the Npcap SDK, and users need the Npcap runtime. Related packaging tracker: #276.

Background Repology currently lists rustnet on (as of issue creation): Arch family: arch/extra, aur (rustnet-git), manjaro_* (stable, testing, unstable), parabola NixOS: nix_unstable (NixOS/nixpkgs#445289) Fedora-derived: terra_rawhide Void Linux: void_x86_64 Russian distros: altsisyphus, rosa_13 Windows: chocolatey Plus, not tracked by repology but live in INSTALL.md: Ubuntu PPA (25.10 / 26.04), Fedora COPR (42+), .deb / .rpm tarballs from releases, Homebrew, FreeBSD (separate repo), Android (Termux). There are still notable gaps we'd like community help with: openSUSE (Tumbleweed / Leap — likely via OBS) Alpine Linux (aports, musl-static build already exists) Gentoo (ebuild — app-network/rustnet or similar) Slackware (SlackBuilds.org) Pop!_OS — Ubuntu-derived. The Ubuntu PPA might work as-is for Pop! users; if so, INSTALL.md just needs to say so. If not, document the workaround Linux Mint — same situation as Pop!_OS; verify whether the Ubuntu PPA covers it and document eit

Background Today's mouse handling in src/main.rs (lines 695-789) only consumes MouseButton::Left, ScrollUp, and ScrollDown. Crossterm already emits MouseButton::X1 and MouseButton::X2 events on supported terminals — we just don't process them. A common workflow is: double-click a connection (jumps to Details), then mouse-back to return to Overview. Today that requires Esc or Shift+Tab. We also have no view-history stack — selected_tab in UIState is a bare usize updated by direct assignment. Scope Two parts: 1. History stack Add tab_history: VecDeque<usize> (bounded ~16) and optionally forward_stack: VecDeque<usize> to UIState in src/ui.rs (around line 495) Push the previous tab on every tab change initiated by the user (Tab, click, Enter→Details, i/h/Esc, and any future view-switch hotkeys from #273) Provide helpers go_back() / go_forward() that pop/push appropriately 2. Mouse plumbing In the mouse handler at src/main.rs lines 695-789, match MouseEventKind::Down(MouseButton::X

Background Sibling to #271 (SELinux on Fedora): rustnet has runtime Landlock confinement on Linux 5.13+ but lacks an out-of-the-box MAC profile on Ubuntu/Debian. AppArmor is the right vehicle there — Ubuntu enforces it by default, and a profile installed by the .deb would tighten what rustnet can do even before Landlock applies. Why we need this on top of Landlock: Landlock's network-restriction primitive only covers TCP — UDP and raw sockets pass straight through. So even with our existing sandbox, a compromised rustnet could exfiltrate over UDP (DNS, QUIC, anything). AppArmor's network inet dgram rules give us real UDP egress control, which Landlock cannot provide today. Scope Add debian/apparmor/usr.bin.rustnet (or debian/rustnet.apparmor consumed by dh_apparmor) and wire it into the Debian package so the profile is installed to /etc/apparmor.d/usr.bin.rustnet and loaded on install. The profile should: Capabilities: capability net_raw, capability bpf, capability perfmon (and ca

Background rustnet runs with file capabilities (cap_net_raw,cap_bpf,cap_perfmon on kernels ≥5.8) and does passive packet capture only. At runtime it already drops capabilities after libpcap initializes and applies a Landlock sandbox (see SECURITY.md and src/network/platform/linux/sandbox/landlock.rs) for filesystem confinement. Landlock has a critical gap on the network side: its network-restriction primitive only covers TCP bind/connect — UDP and raw sockets pass straight through. That means even with our existing sandbox in place, a compromised rustnet could exfiltrate over DNS, QUIC, or any other UDP-based channel. We need a MAC profile (SELinux on Fedora, AppArmor on Ubuntu in a sibling issue) to actually deny non-DNS UDP egress and exec of other binaries — things Landlock cannot enforce. This narrows the blast radius of any RCE/parser bug in a tool that handles untrusted packet data. Scope Add a selinux/ directory containing a .te/.fc/.if policy module (or a single .cil file