# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Cherry Blossom

# Proxy Unit Test Notes

- 1
- 2

To confirm CT clear (using 192.168.1.126 as a test PC and 128.18.30.65 as test PC's normal DNS:
on FT: run mm with -l 1 (at a minimum)
Basic test setup:
on client: nslookup www.google.com
cat /proc/net/ip_conntrack | grep "^udp.*src=192.168.1.126"
#a conntrack should be printed
perform clear conntrack test
To confirm ct clear results (invert expected grep response if confirming ct NOT cleared):
cat /proc/net/ip_conntrack | grep "^udp.*src=192.168.1.126"
# the conntrack should now be gone
#if looking for a target conntrack
cat /proc/kmsg | grep "cbrt: found a udp conntrack to kill: matches target IP 192.168.1.126"
#else
#if looking for a (proxy) all conntrack clear
cat /proc/kmsg | grep "cbrt: found a udp conntrack to kill: matches target all"
VPNLink state change with proxyAction, test udp ct clear coverage testing:
VPNLink Down to Up:
− vpnProxy target: stop CT, alert with vpnProxy action, start CT, confirm ct conntrack clear on FT's
kmsg output.
− VpnProxy All: give mission, confirm ct conntrack clear on FT's kmsg output.
Stop CT...
VPNLink Up to Down
− start vpnProxy all/targetIP action, before timeout stop CT, confirm pa exit and that it called notify
gf, confirm udp_conntrack_clear all/targetIP respectively
Proxy Start and Timeout, udp ct clear coverage testing:
 vpnLink up: (confirm ct clear in all scenarios except where stated, must occur immediately)
vpnProxy aquisition (new MAC target)
vpnProxy aquisition (new Email target) DONE
vpnProxy aquisition (inheirited action target, no prev vpnAction)
vpnProxy aquisition (inheirited action target, prev vpnAction timed out)
vpnProxy aquisition (inheirited action target, prev vpnAction not yet timed out) – confirm no ct
clear
vpnProxy All timeout, confirm ct clear
vpnProxy target timeout, confirm ct clear DONE
 vpnLink down: (confirm ct clear in all scenarios, must occur after pa notifies vpnLink up)
vpnProxy aquisition (new MAC target)
vpnProxy aquisition (new Email target) DONE
vpnProxy aquisition (inheirited action target) DONE

- 1
- 2