diff --git a/tests/sys/netpfil/common/pft_ping.py b/tests/sys/netpfil/common/pft_ping.py index 5d347adf8796..d960426e4b42 100644 --- a/tests/sys/netpfil/common/pft_ping.py +++ b/tests/sys/netpfil/common/pft_ping.py @@ -1,161 +1,222 @@ #!/usr/bin/env python # # SPDX-License-Identifier: BSD-2-Clause # # Copyright (c) 2017 Kristof Provost # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions # are met: # 1. Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # 2. Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # import argparse import scapy.all as sp +import socket import sys from sniffer import Sniffer PAYLOAD_MAGIC = bytes.fromhex('42c0ffee') def check_ping_request(args, packet): if args.ip6: return check_ping6_request(args, packet) else: return check_ping4_request(args, packet) def check_ping4_request(args, packet): """ Verify that the packet matches what we'd have sent """ dst_ip = args.to[0] ip = packet.getlayer(sp.IP) if not ip: return False if ip.dst != dst_ip: return False icmp = packet.getlayer(sp.ICMP) if not icmp: return False if sp.icmptypes[icmp.type] != 'echo-request': return False raw = packet.getlayer(sp.Raw) if not raw: return False if raw.load != PAYLOAD_MAGIC: return False # Wait to check expectations until we've established this is the packet we # sent. if args.expect_tos: if ip.tos != int(args.expect_tos[0]): print("Unexpected ToS value %d, expected %d" \ % (ip.tos, int(args.expect_tos[0]))) return False return True def check_ping6_request(args, packet): """ Verify that the packet matches what we'd have sent """ dst_ip = args.to[0] ip = packet.getlayer(sp.IPv6) if not ip: return False if ip.dst != dst_ip: return False icmp = packet.getlayer(sp.ICMPv6EchoRequest) if not icmp: return False if icmp.data != PAYLOAD_MAGIC: return False return True def ping(send_if, dst_ip, args): ether = sp.Ether() ip = sp.IP(dst=dst_ip) icmp = sp.ICMP(type='echo-request') raw = sp.raw(PAYLOAD_MAGIC) if args.send_tos: ip.tos = int(args.send_tos[0]) req = ether / ip / icmp / raw sp.sendp(req, iface=send_if, verbose=False) def ping6(send_if, dst_ip, args): ether = sp.Ether() ip6 = sp.IPv6(dst=dst_ip) icmp = sp.ICMPv6EchoRequest(data=sp.raw(PAYLOAD_MAGIC)) req = ether / ip6 / icmp sp.sendp(req, iface=send_if, verbose=False) +def check_tcpsyn(args, packet): + dst_ip = args.to[0] + + ip = packet.getlayer(sp.IP) + if not ip: + return False + if ip.dst != dst_ip: + return False + + tcp = packet.getlayer(sp.TCP) + if not tcp: + return False + + # Verify IP checksum + chksum = ip.chksum + ip.chksum = None + new_chksum = sp.IP(sp.raw(ip)).chksum + if chksum != new_chksum: + print("Expected IP checksum %x but found %x\n" % (new_cshkum, chksum)) + return False + + # Verify TCP checksum + chksum = tcp.chksum + packet_raw = sp.raw(packet) + tcp.chksum = None + newpacket = sp.Ether(sp.raw(packet[sp.Ether])) + new_chksum = newpacket[sp.TCP].chksum + if chksum != new_chksum: + print("Expected TCP checksum %x but found %x\n" % (new_chksum, chksum)) + return False + + return True + +def tcpsyn(send_if, dst_ip, args): + opts=[('Timestamp', (1, 1)), ('MSS', 1280)] + + if args.tcpopt_unaligned: + opts = [('NOP', 0 )] + opts + + ether = sp.Ether() + ip = sp.IP(dst=dst_ip) + tcp = sp.TCP(dport=666, flags='S', options=opts) + + req = ether / ip / tcp + sp.sendp(req, iface=send_if, verbose=False) + + def main(): parser = argparse.ArgumentParser("pft_ping.py", description="Ping test tool") parser.add_argument('--sendif', nargs=1, required=True, help='The interface through which the packet(s) will be sent') parser.add_argument('--recvif', nargs=1, help='The interface on which to expect the ICMP echo response') parser.add_argument('--ip6', action='store_true', help='Use IPv6') parser.add_argument('--to', nargs=1, required=True, help='The destination IP address for the ICMP echo request') + # TCP options + parser.add_argument('--tcpsyn', action='store_true', + help='Send a TCP SYN packet') + parser.add_argument('--tcpopt_unaligned', action='store_true', + help='Include unaligned TCP options') + # Packet settings parser.add_argument('--send-tos', nargs=1, help='Set the ToS value for the transmitted packet') # Expectations parser.add_argument('--expect-tos', nargs=1, help='The expected ToS value in the received packet') args = parser.parse_args() # We may not have a default route. Tell scapy where to start looking for routes sp.conf.iface6 = args.sendif[0] sniffer = None if not args.recvif is None: - sniffer = Sniffer(args, check_ping_request) + checkfn=check_ping_request + if args.tcpsyn: + checkfn=check_tcpsyn - if args.ip6: - ping6(args.sendif[0], args.to[0], args) + sniffer = Sniffer(args, checkfn) + + if args.tcpsyn: + tcpsyn(args.sendif[0], args.to[0], args) else: - ping(args.sendif[0], args.to[0], args) + if args.ip6: + ping6(args.sendif[0], args.to[0], args) + else: + ping(args.sendif[0], args.to[0], args) if sniffer: sniffer.join() if sniffer.foundCorrectPacket: sys.exit(0) else: sys.exit(1) if __name__ == '__main__': main() diff --git a/tests/sys/netpfil/pf/Makefile b/tests/sys/netpfil/pf/Makefile index 73c85320c013..68f54c801297 100644 --- a/tests/sys/netpfil/pf/Makefile +++ b/tests/sys/netpfil/pf/Makefile @@ -1,32 +1,33 @@ # $FreeBSD$ PACKAGE= tests TESTSDIR= ${TESTSBASE}/sys/netpfil/pf TESTS_SUBDIRS+= ioctl ATF_TESTS_SH+= anchor \ + checksum \ forward \ fragmentation \ icmp \ names \ nat \ pass_block \ pfsync \ rdr \ route_to \ set_skip \ set_tos \ src_track \ synproxy \ table ${PACKAGE}FILES+= CVE-2019-5597.py \ CVE-2019-5598.py \ echo_inetd.conf \ utils.subr ${PACKAGE}FILESMODE_CVE-2019-5597.py= 0555 ${PACKAGE}FILESMODE_CVE-2019-5598.py= 0555 .include diff --git a/tests/sys/netpfil/pf/checksum.sh b/tests/sys/netpfil/pf/checksum.sh new file mode 100644 index 000000000000..778ae1cd6e9f --- /dev/null +++ b/tests/sys/netpfil/pf/checksum.sh @@ -0,0 +1,85 @@ +# SPDX-License-Identifier: BSD-2-Clause-FreeBSD +# +# Copyright (c) 2020 Kristof Provost +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. + +. $(atf_get_srcdir)/utils.subr + +common_dir=$(atf_get_srcdir)/../common + +atf_test_case "unaligned" "cleanup" +unaligned_head() +{ + atf_set descr 'Test unaligned checksum updates' + atf_set require.user root +} + +unaligned_body() +{ + pft_init + + epair_in=$(vnet_mkepair) + epair_out=$(vnet_mkepair) + + vnet_mkjail alcatraz ${epair_in}b ${epair_out}a + + ifconfig ${epair_in}a 192.0.2.2/24 up + route add -net 198.51.100.0/24 192.0.2.1 + + jexec alcatraz ifconfig ${epair_in}b 192.0.2.1/24 up + jexec alcatraz sysctl net.inet.ip.forwarding=1 + + jexec alcatraz ifconfig ${epair_out}a 198.51.100.1/24 up + jexec alcatraz arp -s 198.51.100.2 00:01:02:03:04:05 + + ifconfig ${epair_out}b up + + jexec alcatraz pfctl -e + pft_set_rules alcatraz \ + "scrub on ${epair_in}b reassemble tcp max-mss 1200" + + # Check aligned + atf_check -s exit:0 ${common_dir}/pft_ping.py \ + --sendif ${epair_in}a \ + --to 198.51.100.2 \ + --recvif ${epair_out}b \ + --tcpsyn + + # And unaligned + atf_check -s exit:0 ${common_dir}/pft_ping.py \ + --sendif ${epair_in}a \ + --to 198.51.100.2 \ + --recvif ${epair_out}b \ + --tcpsyn \ + --tcpopt_unaligned +} + +unaligned_cleanup() +{ + pft_cleanup +} + +atf_init_test_cases() +{ + atf_add_test_case "unaligned" +}