git: 2c5e87862c80 - stable/14 - pf tests: test that we validate sequence numbers on TCP RST
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sat, 09 Dec 2023 10:45:06 UTC
The branch stable/14 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=2c5e87862c8077ec88f6aaf19453daca5e3278a7 commit 2c5e87862c8077ec88f6aaf19453daca5e3278a7 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2023-11-29 12:51:39 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2023-12-09 10:43:11 +0000 pf tests: test that we validate sequence numbers on TCP RST MFC after: 3 days Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit 4c84c69ba308b7758d07dc8845b13922ed667e02) --- tests/sys/netpfil/common/Makefile | 2 + tests/sys/netpfil/common/pft_rst.py | 39 +++++++++++++ tests/sys/netpfil/pf/Makefile | 1 + tests/sys/netpfil/pf/tcp.sh | 109 ++++++++++++++++++++++++++++++++++++ 4 files changed, 151 insertions(+) diff --git a/tests/sys/netpfil/common/Makefile b/tests/sys/netpfil/common/Makefile index f51b89d5eab4..0003aac28779 100644 --- a/tests/sys/netpfil/common/Makefile +++ b/tests/sys/netpfil/common/Makefile @@ -21,11 +21,13 @@ ${PACKAGE}FILES+= \ runner.subr \ pft_icmp_check.py \ pft_ping.py \ + pft_rst.py \ pft_synflood.py \ sniffer.py ${PACKAGE}FILESMODE_pft_icmp_check.py= 0555 ${PACKAGE}FILESMODE_pft_ping.py= 0555 +${PACKAGE}FILESMODE_pft_rst.py= 0555 ${PACKAGE}FILESMODE_pft_synflood.py= 0555 .include <bsd.test.mk> diff --git a/tests/sys/netpfil/common/pft_rst.py b/tests/sys/netpfil/common/pft_rst.py new file mode 100644 index 000000000000..28d951e8a047 --- /dev/null +++ b/tests/sys/netpfil/common/pft_rst.py @@ -0,0 +1,39 @@ +#!/usr/bin/env python3 +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2023 Rubicon Communications, LLC (Netgate) +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# + +import logging +logging.getLogger("scapy").setLevel(logging.CRITICAL) +import math +import scapy.all as sp +import sys + +def send_rst(src_ip, src_port, dst_ip, dst_port): + sp.send(sp.IP(src=src_ip, dst=dst_ip) / + sp.TCP(sport=src_port, dport=dst_port, seq=1, flags="R")) + +send_rst(sys.argv[1], int(sys.argv[2]), sys.argv[3], int(sys.argv[4])) diff --git a/tests/sys/netpfil/pf/Makefile b/tests/sys/netpfil/pf/Makefile index c9adab5626d4..d3b187789685 100644 --- a/tests/sys/netpfil/pf/Makefile +++ b/tests/sys/netpfil/pf/Makefile @@ -39,6 +39,7 @@ ATF_TESTS_SH+= altq \ syncookie \ synproxy \ table \ + tcp \ tos ATF_TESTS_PYTEST+= frag6.py diff --git a/tests/sys/netpfil/pf/tcp.sh b/tests/sys/netpfil/pf/tcp.sh new file mode 100644 index 000000000000..84536480b44e --- /dev/null +++ b/tests/sys/netpfil/pf/tcp.sh @@ -0,0 +1,109 @@ +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2023 Rubicon Communications, LLC (Netgate) +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. + +. $(atf_get_srcdir)/utils.subr + +common_dir=$(atf_get_srcdir)/../common + +atf_test_case "rst" "cleanup" +rst_head() +{ + atf_set descr 'Check sequence number validation in RST packets' + atf_set require.user root + atf_set require.progs scapy +} + +rst_body() +{ + pft_init + + epair_srv=$(vnet_mkepair) + epair_cl=$(vnet_mkepair) + epair_attack=$(vnet_mkepair) + + br=$(vnet_mkbridge) + ifconfig ${br} addm ${epair_srv}a + ifconfig ${epair_srv}a up + ifconfig ${br} addm ${epair_cl}a + ifconfig ${epair_cl}a up + ifconfig ${br} addm ${epair_attack}a + ifconfig ${epair_attack}a up + ifconfig ${br} up + + vnet_mkjail srv ${epair_srv}b + jexec srv ifconfig ${epair_srv}b 192.0.2.1/24 up + jexec srv ifconfig lo0 inet 127.0.0.1/8 up + + vnet_mkjail cl ${epair_cl}b + jexec cl ifconfig ${epair_cl}b 192.0.2.2/24 up + jexec cl ifconfig lo0 inet 127.0.0.1/8 up + + jexec cl pfctl -e + pft_set_rules cl \ + "pass keep state" + + # Not required, but pf should log the bad RST packet with this set. + jexec cl pfctl -x loud + + vnet_mkjail attack ${epair_attack}b + jexec attack ifconfig ${epair_attack}b 192.0.2.3/24 up + + # Sanity check + atf_check -s exit:0 -o ignore \ + jexec cl ping -c 1 192.0.2.1 + + echo "bar" | jexec srv nc -l 1234 & + # Allow server time to start + sleep 1 + + echo "foo" | jexec cl nc -p 4321 192.0.2.1 1234 & + # Allow connection time to set up + sleep 1 + + # Connection should be established now + atf_check -s exit:0 -e ignore \ + -o match:"ESTABLISHED:ESTABLISHED" \ + jexec cl pfctl -ss -v + + # Now insert a fake RST + atf_check -s exit:0 -o ignore \ + jexec attack ${common_dir}/pft_rst.py 192.0.2.1 1234 192.0.2.2 4321 + + # Connection should remain established + atf_check -s exit:0 -e ignore \ + -o match:"ESTABLISHED:ESTABLISHED" \ + jexec cl pfctl -ss -v +} + +rst_cleanup() +{ + pft_cleanup +} + +atf_init_test_cases() +{ + atf_add_test_case "rst" +}