From nobody Wed Dec 06 09:56:29 2023 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4SlXqK66XJz539fx; Wed, 6 Dec 2023 09:56:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4SlXqK5TVLz3M8F; Wed, 6 Dec 2023 09:56:29 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1701856589; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+Oqg04izip/pmQJHyXzOyWjuqH/8PaasuESAIY38lB4=; b=tPVHyAo79otFSiO7eWjl4/oFSqyGizfksKqMpAqqhR3uqdPGnlrAYGnBbxXJMVKT25iw2q 9wd5tj4IQV7EE50TEEO0hCvpLMm40MSBF8clpgfsv1yAIMT5kZB58Am/a0+83BwCh1oXlP /m8EyT4TJXNh8X+IL//byu6LRO/L8cGT4G6D6b/3Nuz/nM34rVPMzwOR6L8Hn5UGqoekut Ov/gXgCo93i2MeHK3fZLbrsfJI0LvzBkJJT1BAFRQl7r4JlXHV7IYXqsG5yx1a6HSJubac 53d+ESNYG37o6sQ2DAEUPZ8EjnczbSnwkT0H7CCA7UbX0avJBw/oFIlLh3Cchg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1701856589; a=rsa-sha256; cv=none; b=FRNZElyru5/k5NMCt3JyS7KGIRNflANaMl6+QzkYCWRIb1ROkja4eqtho4qx48YuFkohiw XMc9y7CBxhRW/wXe5O1MU9yA+1y7SXSdwuN0Xl3hWgHoJS2YOqCxBfN9PC7//xIfA+lqrg ME0HKhIk6bJ59na+4nu+yqQ0su4GR/BsU3AEZ+vIN9+LOxdScuTiYzQ9DVnxnf4FnBmC5s AbzCtnmWQLDRIvzhpkdkIygPNIT1EThW4RIcC2G+s5DWKzQBymWDNt8HZ29Co4wO9Fxk4H VsJADesUXgwIvpXcYIHh3DpMxbR/zE3DEKStInYeUDcMkD8dKoW65sJo8ITYow== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1701856589; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+Oqg04izip/pmQJHyXzOyWjuqH/8PaasuESAIY38lB4=; b=jfZaKZJ7gjWNg9yZBFQFsk2WhfgtS0Jf7gvicA1+yRaboV1vuBMvTRpYAFoIrnbRZAo4AL PTebPn23a7myVD6hPlDzqLQkorc+XA2S115PiIotEYA7A6V6QJDNHuk9DfLRMDqILzXuel 4nF5gbZXaAqHBfGRKwPyJy0NG8CHI1tmulf7bOyvN0WK8FxgXwIAPu0RQ7szR9H1mbPhAc pcHYyvz71lYl117Jnm1giQoGJOURrd2t+dSkHFxuFYTfgAs2hIYNTTOOzmuZ41rAHyUUoB zEI6cPHA1QeIT52n22lFo0XVwo4Sj2gsYzzTg6kJSjq5iYaWFTBbVnF9RVUiHw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4SlXqK4Sy5zpYh; Wed, 6 Dec 2023 09:56:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 3B69uTvO065192; Wed, 6 Dec 2023 09:56:29 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 3B69uT6l065189; Wed, 6 Dec 2023 09:56:29 GMT (envelope-from git) Date: Wed, 6 Dec 2023 09:56:29 GMT Message-Id: <202312060956.3B69uT6l065189@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 4c84c69ba308 - main - pf tests: test that we validate sequence numbers on TCP RST List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 4c84c69ba308b7758d07dc8845b13922ed667e02 Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=4c84c69ba308b7758d07dc8845b13922ed667e02 commit 4c84c69ba308b7758d07dc8845b13922ed667e02 Author: Kristof Provost AuthorDate: 2023-11-29 12:51:39 +0000 Commit: Kristof Provost CommitDate: 2023-12-05 20:03:49 +0000 pf tests: test that we validate sequence numbers on TCP RST MFC after: 3 days Sponsored by: Rubicon Communications, LLC ("Netgate") --- tests/sys/netpfil/common/Makefile | 2 + tests/sys/netpfil/common/pft_rst.py | 39 +++++++++++++ tests/sys/netpfil/pf/Makefile | 1 + tests/sys/netpfil/pf/tcp.sh | 109 ++++++++++++++++++++++++++++++++++++ 4 files changed, 151 insertions(+) diff --git a/tests/sys/netpfil/common/Makefile b/tests/sys/netpfil/common/Makefile index f51b89d5eab4..0003aac28779 100644 --- a/tests/sys/netpfil/common/Makefile +++ b/tests/sys/netpfil/common/Makefile @@ -21,11 +21,13 @@ ${PACKAGE}FILES+= \ runner.subr \ pft_icmp_check.py \ pft_ping.py \ + pft_rst.py \ pft_synflood.py \ sniffer.py ${PACKAGE}FILESMODE_pft_icmp_check.py= 0555 ${PACKAGE}FILESMODE_pft_ping.py= 0555 +${PACKAGE}FILESMODE_pft_rst.py= 0555 ${PACKAGE}FILESMODE_pft_synflood.py= 0555 .include diff --git a/tests/sys/netpfil/common/pft_rst.py b/tests/sys/netpfil/common/pft_rst.py new file mode 100644 index 000000000000..28d951e8a047 --- /dev/null +++ b/tests/sys/netpfil/common/pft_rst.py @@ -0,0 +1,39 @@ +#!/usr/bin/env python3 +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2023 Rubicon Communications, LLC (Netgate) +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# + +import logging +logging.getLogger("scapy").setLevel(logging.CRITICAL) +import math +import scapy.all as sp +import sys + +def send_rst(src_ip, src_port, dst_ip, dst_port): + sp.send(sp.IP(src=src_ip, dst=dst_ip) / + sp.TCP(sport=src_port, dport=dst_port, seq=1, flags="R")) + +send_rst(sys.argv[1], int(sys.argv[2]), sys.argv[3], int(sys.argv[4])) diff --git a/tests/sys/netpfil/pf/Makefile b/tests/sys/netpfil/pf/Makefile index 9337b95baf4e..1083f89a5502 100644 --- a/tests/sys/netpfil/pf/Makefile +++ b/tests/sys/netpfil/pf/Makefile @@ -40,6 +40,7 @@ ATF_TESTS_SH+= altq \ syncookie \ synproxy \ table \ + tcp \ tos ATF_TESTS_PYTEST+= frag6.py diff --git a/tests/sys/netpfil/pf/tcp.sh b/tests/sys/netpfil/pf/tcp.sh new file mode 100644 index 000000000000..84536480b44e --- /dev/null +++ b/tests/sys/netpfil/pf/tcp.sh @@ -0,0 +1,109 @@ +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2023 Rubicon Communications, LLC (Netgate) +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. + +. $(atf_get_srcdir)/utils.subr + +common_dir=$(atf_get_srcdir)/../common + +atf_test_case "rst" "cleanup" +rst_head() +{ + atf_set descr 'Check sequence number validation in RST packets' + atf_set require.user root + atf_set require.progs scapy +} + +rst_body() +{ + pft_init + + epair_srv=$(vnet_mkepair) + epair_cl=$(vnet_mkepair) + epair_attack=$(vnet_mkepair) + + br=$(vnet_mkbridge) + ifconfig ${br} addm ${epair_srv}a + ifconfig ${epair_srv}a up + ifconfig ${br} addm ${epair_cl}a + ifconfig ${epair_cl}a up + ifconfig ${br} addm ${epair_attack}a + ifconfig ${epair_attack}a up + ifconfig ${br} up + + vnet_mkjail srv ${epair_srv}b + jexec srv ifconfig ${epair_srv}b 192.0.2.1/24 up + jexec srv ifconfig lo0 inet 127.0.0.1/8 up + + vnet_mkjail cl ${epair_cl}b + jexec cl ifconfig ${epair_cl}b 192.0.2.2/24 up + jexec cl ifconfig lo0 inet 127.0.0.1/8 up + + jexec cl pfctl -e + pft_set_rules cl \ + "pass keep state" + + # Not required, but pf should log the bad RST packet with this set. + jexec cl pfctl -x loud + + vnet_mkjail attack ${epair_attack}b + jexec attack ifconfig ${epair_attack}b 192.0.2.3/24 up + + # Sanity check + atf_check -s exit:0 -o ignore \ + jexec cl ping -c 1 192.0.2.1 + + echo "bar" | jexec srv nc -l 1234 & + # Allow server time to start + sleep 1 + + echo "foo" | jexec cl nc -p 4321 192.0.2.1 1234 & + # Allow connection time to set up + sleep 1 + + # Connection should be established now + atf_check -s exit:0 -e ignore \ + -o match:"ESTABLISHED:ESTABLISHED" \ + jexec cl pfctl -ss -v + + # Now insert a fake RST + atf_check -s exit:0 -o ignore \ + jexec attack ${common_dir}/pft_rst.py 192.0.2.1 1234 192.0.2.2 4321 + + # Connection should remain established + atf_check -s exit:0 -e ignore \ + -o match:"ESTABLISHED:ESTABLISHED" \ + jexec cl pfctl -ss -v +} + +rst_cleanup() +{ + pft_cleanup +} + +atf_init_test_cases() +{ + atf_add_test_case "rst" +}