The capsicum logic is pretty much the same that was used to capsicumize traceroute.
send_probe() changes the address in each iteration by incrementing the port number, which is not allowed in capability mode for UDP sockets.
Hence, the UDP socket was converted into a RAW socket, and its header was built in userspace. This way incrementing the port number didn't require any additional capability.
Also, these changes do not throw any extra warnings when WARNS?=3 is removed from the Makefile and hence this code can be built on D25603
- The unsandboxed code cannot run traceroute6 -T localhost, which is the same for the sandboxed code
- This code has only been tested for the localhost, since my service provider doesn't provide IPv6 connectivity