netdev - [PATCH v2 net 6/5] wireguard: selftests: ensure that icmp src address is correct with NAT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200210193000.453727-1-Jason@zx2c4.com>
Date:   Mon, 10 Feb 2020 20:30:00 +0100
From:   "Jason A. Donenfeld" <Jason@...c4.com>
To:     davem@...emloft.net, netdev@...r.kernel.org
Cc:     "Jason A. Donenfeld" <Jason@...c4.com>
Subject: [PATCH v2 net 6/5] wireguard: selftests: ensure that icmp src address is correct with NAT

This is a small test to ensure that icmp_ndo_send is actually doing the
right with with regards to the source address. It measure this by
ensuring that there are a sufficient number of non-errors returned in a
row, which should be impossible with proper rate limiting.

Signed-off-by: Jason A. Donenfeld <Jason@...c4.com>
---
Here's a test for the WireGuard path of the series I submitted earlier
today. This test correctly fails when using the old code, and succeeds
when using the new code. If the "6/5" stupidity disrupts patchwork, no
need to respond, and I'll just resubmit this later.

 tools/testing/selftests/wireguard/netns.sh | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tools/testing/selftests/wireguard/netns.sh b/tools/testing/selftests/wireguard/netns.sh
index f5ab1cda8bb5..4e31d5b1bf7f 100755
--- a/tools/testing/selftests/wireguard/netns.sh
+++ b/tools/testing/selftests/wireguard/netns.sh
@@ -297,7 +297,17 @@ ip1 -4 rule add table main suppress_prefixlength 0
 n1 ping -W 1 -c 100 -f 192.168.99.7
 n1 ping -W 1 -c 100 -f abab::1111
 
+# Have ns2 NAT into wg0 packets from ns0, but return an icmp error along the right route.
+n2 iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -d 192.168.241.0/24 -j SNAT --to 192.168.241.2
+n0 iptables -t filter -A INPUT \! -s 10.0.0.0/24 -i vethrs -j DROP # Manual rpfilter just to be explicit.
+n2 bash -c 'printf 1 > /proc/sys/net/ipv4/ip_forward'
+ip0 -4 route add 192.168.241.1 via 10.0.0.100
+n2 wg set wg0 peer "$pub1" remove
+[[ $(! n0 ping -W 1 -c 1 192.168.241.1 || false) == *"From 10.0.0.100 icmp_seq=1 Destination Host Unreachable"* ]]
+
 n0 iptables -t nat -F
+n0 iptables -t filter -F
+n2 iptables -t nat -F
 ip0 link del vethrc
 ip0 link del vethrs
 ip1 link del wg0
-- 
2.25.0