From nobody Sat Dec 09 10:45:06 2023 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4SnPm23QBYz53nDB; Sat, 9 Dec 2023 10:45:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4SnPm22sjhz4Zd3; Sat, 9 Dec 2023 10:45:06 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1702118706; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iK9a0tMp8gG2Vs+udjPOWTT0Hz0Y377UvRQtjUvrVas=; b=jroVcxaufTzg4ATKjg1cU+FmOIdz3WUgHOFxjCp69sz/NsYz2Y25jWWLBiAV1Od8Ps3Ce0 nTyDLFjyEp9Zr0QTvaMWx8c4fly2SAK1RHCmZoU9N4WRGWkzCcuHHaIf2pqQXeFeQ56IZ9 uKPd71PPm1EUyp0xFN+O3MNbRqcrCZ2pXqtMh/uwMmcHt2Dh1jg+n9T1wYALwYw6dPP4Bx RteCopTrbj/MpzA036cLw5Ivb8ME4cN6F8qHqDv9GTn10qvysp7FYQtw3vTGyWpMh5R5x0 UNdHiNCuawvUP0V/NCAx9LDahNTz0TY5lFFmHjJ/2/SXG2aCpXV0qxqSaqLlQQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1702118706; a=rsa-sha256; cv=none; b=o1eY3FUFNHX+OouLtLnr3G8PnaxK0sxRg1I8hExns3MZwnEXEL4EFZ5qH9d3mcsQd+f8NA olpsxvC7oNcKlYfIeH3AROvKhHATO91IRwkGE+yL3LYRojeSrXRtb4eve29Zc6hxSvM/Ft 7upCgME3Qgi1/of4i/WCEF8DimmPsG3yleiYxoMtL6v0dXpXqqmwdLSuv3JpiAxrRi5zvu GiQ3NT1OxBq8fgl+X3Huqnj9pVwlCMr7UJscH1Sgk1cw8KMPvtfbXGqbY91LqlgB57r2FN wZg6zShH1Mkr7otSsocjikR9XUxkRzGlTMhp2zXjEENb3MFLOvq5M6bJ9yoPVg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1702118706; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iK9a0tMp8gG2Vs+udjPOWTT0Hz0Y377UvRQtjUvrVas=; b=aL265NBWVB73mXG8tF/xVhtoVKuSOiqlp6fCi4MlQZwWC1Z+AEAl3GaICUR5sp82JuaICs rrjVSZ4ZXwTuzCWvfruWk/BzKzqiznpPnhnczVKpnBqYe9d0N3zDuFBFE6Gip2+YmJ+DxP 7QM+vvJrxw3IXQ++8/HGAZMC1ekQFxKIPp4YmlyCeUjPFyJ0O93Et185hgmdkE+JqqU8WC WC7lLpoZqLYed5J9htNlEtn0hzFtDTNqWscq45XQe20NLtPohYc9ZmVNVVh8ZrM4/0Adjm 0152wRuzCc28baSyk3WAfv7Img+cQ10inXmYXsy2Swp5ntzg8cF3ahSdSigT0g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4SnPm21yZ9z11d9; Sat, 9 Dec 2023 10:45:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 3B9Aj6r6095345; Sat, 9 Dec 2023 10:45:06 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 3B9Aj63I095342; Sat, 9 Dec 2023 10:45:06 GMT (envelope-from git) Date: Sat, 9 Dec 2023 10:45:06 GMT Message-Id: <202312091045.3B9Aj63I095342@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kristof Provost Subject: git: 349407acaf52 - stable/13 - pf tests: test that we validate sequence numbers on TCP RST List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 349407acaf52f0e2481da03cfa9b477e2c7ade30 Auto-Submitted: auto-generated The branch stable/13 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=349407acaf52f0e2481da03cfa9b477e2c7ade30 commit 349407acaf52f0e2481da03cfa9b477e2c7ade30 Author: Kristof Provost AuthorDate: 2023-11-29 12:51:39 +0000 Commit: Kristof Provost CommitDate: 2023-12-09 10:43:07 +0000 pf tests: test that we validate sequence numbers on TCP RST MFC after: 3 days Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit 4c84c69ba308b7758d07dc8845b13922ed667e02) --- tests/sys/netpfil/common/Makefile | 2 + tests/sys/netpfil/common/pft_rst.py | 39 +++++++++++++ tests/sys/netpfil/pf/Makefile | 1 + tests/sys/netpfil/pf/tcp.sh | 109 ++++++++++++++++++++++++++++++++++++ 4 files changed, 151 insertions(+) diff --git a/tests/sys/netpfil/common/Makefile b/tests/sys/netpfil/common/Makefile index f51b89d5eab4..0003aac28779 100644 --- a/tests/sys/netpfil/common/Makefile +++ b/tests/sys/netpfil/common/Makefile @@ -21,11 +21,13 @@ ${PACKAGE}FILES+= \ runner.subr \ pft_icmp_check.py \ pft_ping.py \ + pft_rst.py \ pft_synflood.py \ sniffer.py ${PACKAGE}FILESMODE_pft_icmp_check.py= 0555 ${PACKAGE}FILESMODE_pft_ping.py= 0555 +${PACKAGE}FILESMODE_pft_rst.py= 0555 ${PACKAGE}FILESMODE_pft_synflood.py= 0555 .include diff --git a/tests/sys/netpfil/common/pft_rst.py b/tests/sys/netpfil/common/pft_rst.py new file mode 100644 index 000000000000..28d951e8a047 --- /dev/null +++ b/tests/sys/netpfil/common/pft_rst.py @@ -0,0 +1,39 @@ +#!/usr/bin/env python3 +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2023 Rubicon Communications, LLC (Netgate) +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# + +import logging +logging.getLogger("scapy").setLevel(logging.CRITICAL) +import math +import scapy.all as sp +import sys + +def send_rst(src_ip, src_port, dst_ip, dst_port): + sp.send(sp.IP(src=src_ip, dst=dst_ip) / + sp.TCP(sport=src_port, dport=dst_port, seq=1, flags="R")) + +send_rst(sys.argv[1], int(sys.argv[2]), sys.argv[3], int(sys.argv[4])) diff --git a/tests/sys/netpfil/pf/Makefile b/tests/sys/netpfil/pf/Makefile index 6b61155ec40a..ea0d5cb151a2 100644 --- a/tests/sys/netpfil/pf/Makefile +++ b/tests/sys/netpfil/pf/Makefile @@ -30,6 +30,7 @@ ATF_TESTS_SH+= altq \ syncookie \ synproxy \ table \ + tcp \ tos ATF_TESTS_PYTEST+= frag6.py diff --git a/tests/sys/netpfil/pf/tcp.sh b/tests/sys/netpfil/pf/tcp.sh new file mode 100644 index 000000000000..84536480b44e --- /dev/null +++ b/tests/sys/netpfil/pf/tcp.sh @@ -0,0 +1,109 @@ +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2023 Rubicon Communications, LLC (Netgate) +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. + +. $(atf_get_srcdir)/utils.subr + +common_dir=$(atf_get_srcdir)/../common + +atf_test_case "rst" "cleanup" +rst_head() +{ + atf_set descr 'Check sequence number validation in RST packets' + atf_set require.user root + atf_set require.progs scapy +} + +rst_body() +{ + pft_init + + epair_srv=$(vnet_mkepair) + epair_cl=$(vnet_mkepair) + epair_attack=$(vnet_mkepair) + + br=$(vnet_mkbridge) + ifconfig ${br} addm ${epair_srv}a + ifconfig ${epair_srv}a up + ifconfig ${br} addm ${epair_cl}a + ifconfig ${epair_cl}a up + ifconfig ${br} addm ${epair_attack}a + ifconfig ${epair_attack}a up + ifconfig ${br} up + + vnet_mkjail srv ${epair_srv}b + jexec srv ifconfig ${epair_srv}b 192.0.2.1/24 up + jexec srv ifconfig lo0 inet 127.0.0.1/8 up + + vnet_mkjail cl ${epair_cl}b + jexec cl ifconfig ${epair_cl}b 192.0.2.2/24 up + jexec cl ifconfig lo0 inet 127.0.0.1/8 up + + jexec cl pfctl -e + pft_set_rules cl \ + "pass keep state" + + # Not required, but pf should log the bad RST packet with this set. + jexec cl pfctl -x loud + + vnet_mkjail attack ${epair_attack}b + jexec attack ifconfig ${epair_attack}b 192.0.2.3/24 up + + # Sanity check + atf_check -s exit:0 -o ignore \ + jexec cl ping -c 1 192.0.2.1 + + echo "bar" | jexec srv nc -l 1234 & + # Allow server time to start + sleep 1 + + echo "foo" | jexec cl nc -p 4321 192.0.2.1 1234 & + # Allow connection time to set up + sleep 1 + + # Connection should be established now + atf_check -s exit:0 -e ignore \ + -o match:"ESTABLISHED:ESTABLISHED" \ + jexec cl pfctl -ss -v + + # Now insert a fake RST + atf_check -s exit:0 -o ignore \ + jexec attack ${common_dir}/pft_rst.py 192.0.2.1 1234 192.0.2.2 4321 + + # Connection should remain established + atf_check -s exit:0 -e ignore \ + -o match:"ESTABLISHED:ESTABLISHED" \ + jexec cl pfctl -ss -v +} + +rst_cleanup() +{ + pft_cleanup +} + +atf_init_test_cases() +{ + atf_add_test_case "rst" +}