@@ -297,7 +297,17 @@ ip1 -4 rule add table main suppress_prefixlength 0
n1 ping -W 1 -c 100 -f 192.168.99.7
n1 ping -W 1 -c 100 -f abab::1111
+# Have ns2 NAT into wg0 packets from ns0, but return an icmp error along the right route.
+n2 iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -d 192.168.241.0/24 -j SNAT --to 192.168.241.2
+n0 iptables -t filter -A INPUT \! -s 10.0.0.0/24 -i vethrs -j DROP # Manual rpfilter just to be explicit.
+n2 bash -c 'printf 1 > /proc/sys/net/ipv4/ip_forward'
+ip0 -4 route add 192.168.241.1 via 10.0.0.100
+n2 wg set wg0 peer "$pub1" remove
+[[ $(! n0 ping -W 1 -c 1 192.168.241.1 || false) == *"From 10.0.0.100 icmp_seq=1 Destination Host Unreachable"* ]]
+
n0 iptables -t nat -F
+n0 iptables -t filter -F
+n2 iptables -t nat -F
ip0 link del vethrc
ip0 link del vethrs
ip1 link del wg0
This is a small test to ensure that icmp_ndo_send is actually doing the right with with regards to the source address. It measure this by ensuring that there are a sufficient number of non-errors returned in a row, which should be impossible with proper rate limiting. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> --- Here's a test for the WireGuard path of the series I submitted earlier today. This test correctly fails when using the old code, and succeeds when using the new code. If the "6/5" stupidity disrupts patchwork, no need to respond, and I'll just resubmit this later. tools/testing/selftests/wireguard/netns.sh | 10 ++++++++++ 1 file changed, 10 insertions(+)