Bullfrog’s DNS over TCP bypasses domain filtering · CVE-2025-47775 · GitHub Advisory Database · GitHub

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

name: test
on:
  push:
    branches:
      - "*"

jobs:
  testBullFrog:
    runs-on: ubuntu-22.04
    steps:
      - name: 使用谷歌DNS
        run: |
          sudo resolvectl dns eth0 1.1.1.1
          resolvectl status
      - name: 设置Bullfrog以阻止所有流量
        uses: bullfrogsec/bullfrog@1472c28724ef13ea0adc54d0a42c2853d42786b1 # v0.8.2
        with:
           egress-policy: block
           allowed-domains: |
             *.github.com
      - name: 测试连通性
        run: |
          echo 测试允许的UDP连接..
          dig api.github.com @1.1.1.1 || :
          echo 测试允许的TCP连接..
          dig api.github.com @1.1.1.1 +tcp || :

          echo 测试不允许的UDP连接
          dig api.google.com @1.1.1.1 || :
          echo 测试不允许的TCP连接
          dig api.google.com @1.1.1.1 +tcp || :