Testing and Verification

Testing and Verification

This page covers testing procedures to verify your Soft Data Diode deployment is properly hardened. For basic setup, see the main README.

Testing Your Hardened Infrastructure

The hardening folder in this repository includes scripts to test the ability of your infrastructure to repel attempts to backpropagate into the secure network.

ddreflect.py - Basic Reflection Test

The ddreflect.py is the simplest test. Before you have any mitigations in place, you may find that you are able to use it to return traffic. As you implement mitigations, verify that you can see return traffic, and then put one mitigation in place. Verify that it blocks the return path before removing it and starting the process again for the next mitigation.

ddredirect.py - Advanced Reflection Test

The ddredirect.py allows you to also specify the return UDP port, and can test for the precense of more sophisticated scenarios where an attacker is able to redirect to another port to attempt to exploit other services on the sender than just ones that live on the sending port.

Verification Procedures

Testing iptables Rules

Once you have implemented iptables rules as described in Security Model and Hardening, you can verify they are working correctly:

1. Run the test script from the hardening folder
2. Watch iptables counters: iptables -v -n -L
3. The counters should increase on your blocking rules if return traffic is being caught
4. Use tcpdump or Wireshark to see if anything from the receiver is reaching the sender side

Important Note: tcpdump/libpcap sees packets before they hit the iptables firewall, so you may see traffic in tcpdump even if it's being dropped. Always verify using iptables counters.

Isolated Mitigation Testing

Test each mitigation in isolation:

1. Verify you can see return traffic without any mitigations
2. Implement one mitigation
3. Verify it blocks the return path
4. Remove the mitigation
5. Repeat for each mitigation
6. Once all mitigations are verified individually, implement them all for defense in depth

Defense in Depth Verification

Once you have verified each mitigation in isolation, implement all mitigations simultaneously. This provides defense in depth against backpropagation of traffic from the receiver to the sender.

Monitoring and Alerting

Set up monitoring for these security events:

• BACKPROPAGATION DROP: log entries from iptables
• Blocked UDP packets from cloud server IPs
• Unexpected ICMP responses to sender

These events represent clear attack attempts and should trigger security alerts.

• Return to the main README for basic usage