summaryrefslogtreecommitdiffstats
path: root/net/ipv6/netfilter/ip6t_rt.c
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2021-09-23 15:12:42 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2021-10-12 01:42:39 +0200
commit465f15a6d1a8f51f7e09fba12678b39031f63ca9 (patch)
treeb7acae2182ce1f3f29a6b203f8d6e4033bdffe3a /net/ipv6/netfilter/ip6t_rt.c
parent68a3765c659f809dcaac20030853a054646eb739 (diff)
downloadlinux-465f15a6d1a8f51f7e09fba12678b39031f63ca9.tar.bz2
selftests: nft_nat: add udp hole punch test case
Add a test case that demonstrates port shadowing via UDP. ns2 sends packet to ns1, from source port used by a udp service on the router, ns0. Then, ns1 sends packet to ns0:service, but that ends up getting forwarded to ns2. Also add three test cases that demonstrate mitigations: 1. disable use of $port as source from 'unstrusted' origin 2. make the service untracked. This prevents masquerade entries from having any effects. 3. add forced PAT via 'random' mode to translate the "wrong" sport into an acceptable range. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv6/netfilter/ip6t_rt.c')
0 files changed, 0 insertions, 0 deletions