mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 07:37:36 +00:00
Johnathan Corgan
4efabd11df
The gateway routes its whole pool to itself, so a connection to a pool address with no mapping, one that expired or one written into a configuration by hand, reached whatever listened on the gateway host, such as its SSH server, from the LAN and from the gateway host itself. A stale DNS answer was enough to log into the router instead of the intended node. The gateway's table now has an input chain that rejects, with an ICMPv6 port unreachable, IPv6 traffic still addressed to the pool when it reaches the input hook. A mapping's DNAT rewrites the destination before that hook (LAN traffic in prerouting, the gateway host's own in output, a flow to the gateway's own node to its mesh address), so only traffic no mapping translated is rejected, and a connection to an unmapped address now fails at once. One message is exempt: a neighbour solicitation addressed to a pool address. A LAN client that reached a virtual IP by proxy NDP checks the neighbour with a unicast solicitation to the virtual IP itself, and connection tracking leaves neighbour discovery untracked, so no DNAT rewrites it and proxy NDP must still answer it. An accept for it sits ahead of the reject. The comment on the pool drop's loopback exemption, and the design and configuration documents, no longer describe unmapped traffic reaching the gateway as a known gap. The gateway suite checks that a connection to an unmapped pool address from the gateway host and from a LAN client is refused rather than answered by a listener on the gateway, that the reject counted both, that a LAN client still reaches a mapped virtual IP, and that a unicast neighbour solicitation for a proxied virtual IP is answered.