VN packet injection tests #2535
Description
Describe the bug
In order to exercise cases where an attacker is on-path, or when the peer misconfigures version negotiation, there needs to be a way to inject version negotiation packets or alter them in transit.
This could be accomplished using the datapath test hooks to intercept a version negotiation packet and modify it, or to inject extra version negotiation packets.
Test cases specifically to be tested by this would be (not an exhaustive list):
- Ensure client doesn't respond to more than 1 VN packet (testing downgrade protection)
- Inject a VN packet when the server didn't send one (also testing downgrade protection)
- Putting a version in the VN packet the server didn't send.
Affected OS
- All