]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
selftests: netfilter: check icmp pkttoobig errors are set as related
authorFlorian Westphal <fw@strlen.de>
Mon, 25 Mar 2019 22:11:53 +0000 (23:11 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Sat, 13 Apr 2019 12:52:57 +0000 (14:52 +0200)
commitbecf2319f320cae43e20cf179cc51a355a0deb5f
tree2dac4dba100aebdea4c177729b1de364b6195d17
parented0de45a1008991fdaa27a0152befcb74d126a8b
selftests: netfilter: check icmp pkttoobig errors are set as related

When an icmp error such as pkttoobig is received, conntrack checks
if the "inner" header (header of packet that did not fit link mtu)
is matches an existing connection, and, if so, sets that packet as
being related to the conntrack entry it found.

It was recently reported that this "related" setting also works
if the inner header is from another, different connection (i.e.,
artificial/forged icmp error).

Add a test, followup patch will add additional "inner dst matches
outer dst in reverse direction" check before setting related state.

Link: https://www.synacktiv.com/posts/systems/icmp-reachable.html
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
tools/testing/selftests/netfilter/Makefile
tools/testing/selftests/netfilter/conntrack_icmp_related.sh [new file with mode: 0755]