]> git.baikalelectronics.ru Git - kernel.git/commit
selftests: netfilter: check icmp pkttoobig errors are set as related
authorFlorian Westphal <fw@strlen.de>
Mon, 25 Mar 2019 22:11:53 +0000 (23:11 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Sat, 13 Apr 2019 12:52:57 +0000 (14:52 +0200)
commit96f60ec8ea46081e33a00abb83f894d00d6c006f
tree2dac4dba100aebdea4c177729b1de364b6195d17
parent3dbd19f3ed3863e6927fa24f98ba68e71ab6030a
selftests: netfilter: check icmp pkttoobig errors are set as related

When an icmp error such as pkttoobig is received, conntrack checks
if the "inner" header (header of packet that did not fit link mtu)
is matches an existing connection, and, if so, sets that packet as
being related to the conntrack entry it found.

It was recently reported that this "related" setting also works
if the inner header is from another, different connection (i.e.,
artificial/forged icmp error).

Add a test, followup patch will add additional "inner dst matches
outer dst in reverse direction" check before setting related state.

Link: https://www.synacktiv.com/posts/systems/icmp-reachable.html
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
tools/testing/selftests/netfilter/Makefile
tools/testing/selftests/netfilter/conntrack_icmp_related.sh [new file with mode: 0755]