LLT-7321: backport block packets with wrong src ip from entering tunnel - #1795
Draft
mathiaspeters wants to merge 3 commits into
Draft
LLT-7321: backport block packets with wrong src ip from entering tunnel#1795mathiaspeters wants to merge 3 commits into
mathiaspeters wants to merge 3 commits into
Conversation
Contributor
|
+1 |
When a VPN exit node is active, outbound packets whose source IP is not one of the known tunnel addresses must be rejected. Pre-VPN sockets bound to a stale local IP would otherwise leak through the tunnel and poison the exit node's NAT table, causing return traffic to be misrouted.
mathiaspeters
force-pushed
the
LLT-7321_backport_block_wrong_src_ip
branch
from
June 3, 2026 13:27
39486d4 to
c3a6bcb
Compare
mathiaspeters
marked this pull request as draft
June 4, 2026 13:51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Fix was merged to main, but we need to backport it to v7.0 releases
Solution
Do backport, but skip some unimportant commits to keep hotfix small. All skipped commits relate to natlab tests and are non-critical. Additionally, had to slightly adjust natlab tests to use standard
setup_mesh_nodesandsetup_connectionsinstead of using the newly introduced factories, as well as creating the exit stack in the test instead of providing it as a fixture.Skipped commits:
☑️ Definition of Done checklist