Appearance
Protocol Validation (NET-PROTO)
Validate that specific protocols are restricted to prevent evasion, tunneling, and unauthorized channels.
Objectives
- Block UDP-based channels (QUIC, WebRTC, STUN/TURN).
- Prevent IPv6 leakage and transition tunnel abuse.
- Detect and block protocol smuggling (e.g., SSH over HTTPS/WebSocket).
Controls Under Test
- UDP disablement
- IPv6 control (
ipv6: "disabled") - Protocol allowlists (TCP/HTTPS only)
Test Scenarios
| ID | Threat / Scenario | Universal Procedure | Expected Outcome & Audit |
|---|---|---|---|
| NET-PROTO-01 | UDP & QUIC Blocking | UDP leakage via QUIC, WebRTC, STUN/TURN. 1. Configure network logging. 2. Initiate traffic using QUIC/HTTP3 (e.g., curl --http3) or WebRTC. | Pass: No UDP flows; logs show TCP/TLS fallback. Audit: protocol: udp denied. |
| NET-PROTO-02 | IPv6 Control | IPv6 Leakage or Shadow Networks. Force application to use IPv6 (e.g., curl -6) or Link-Local addresses. | Pass: Connection blocked or timed out. Audit: family: ipv6 deny. |
| NET-PROTO-03 | Multicast/Broadcast Leakage | Local peer discovery via mDNS/SSDP. Attempt to send multicast packets (e.g., 224.0.0.251 or 239.255.255.250). | Pass: Traffic blocked; no peer discovery. Audit: action: deny, protocol: udp |
| NET-PROTO-04 | Legacy Protocol Egress | Outbound access via FTP/SMTP. Attempt to connect to external FTP (21) or SMTP (25) services. | Pass: Connection timeout/refused. Audit: action: deny, protocol: tcp |
| NET-PROTO-05 | Protocol Restrictions | Protocol Smuggling (ICMP, SMTP, SSH over HTTPS). Attempt to tunnel non-HTTP protocols (SSH) or use disallowed protocols (ICMP/SMTP). | Pass: Denied. Audit: protocol mismatch or deny. |
| NET-PROTO-06 | IPv6 Tunneling | IPv6 transition tunnel bypass (Teredo/6to4). Force a connection via Teredo interface (UDP 3544). | Pass: Blocked. Audit: protocol: udp or ipv6 deny. |
| NET-PROTO-07 | WebSocket Smuggling | Tunneling non-HTTP protocols via WSS. Establish wss:// connection and tunnel SSH/non-HTTP traffic. | Pass: Connection terminated or blocked. Audit: protocol mismatch. |
Evidence Requirements
- Audit category:
network - Required fields:
protocol,alpn,reason