Date: Mon, 21 Oct 2019 09:33:46 +0000 (UTC) From: "Bjoern A. Zeeb" <bz@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r353794 - in head: etc/mtree tests/sys tests/sys/netinet6 tests/sys/netinet6/frag6 Message-ID: <201910210933.x9L9Xkig062769@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: bz Date: Mon Oct 21 09:33:45 2019 New Revision: 353794 URL: https://svnweb.freebsd.org/changeset/base/353794 Log: frag6: import a set of test cases In order to ensure that changing the frag6 code does not change behaviour or break code a set of test cases were implemented. Like some other test cases these use Scapy to generate packets and possibly wait for expected answers. In most cases we do check the global and per interface (netstat) statistics output using the libxo output and grep to validate fields and numbers. This is a bit hackish but we currently have no better way to match a selected number of stats only (we have to ignore some of the ND6 variables; otherwise we could use the entire list). Test cases include atomic fragments, single fragments, multi-fragments, and try to cover most error cases in the code currently. In addition vnet teardown is tested to not panic. A separate set (not in-tree currently) of probes were used in order to make sure that the test cases actually test what they should. The "sniffer" code was copied and adjusted from the netpfil version as we sometimes will not get packets or have longer timeouts to deal with. Sponsored by: Netflix Added: head/tests/sys/netinet6/ head/tests/sys/netinet6/Makefile (contents, props changed) head/tests/sys/netinet6/frag6/ head/tests/sys/netinet6/frag6/Makefile (contents, props changed) head/tests/sys/netinet6/frag6/frag6.subr (contents, props changed) head/tests/sys/netinet6/frag6/frag6_01.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_01.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_02.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_02.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_03.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_03.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_04.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_04.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_05.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_05.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_06.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_06.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_07.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_07.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_08.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_08.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_09.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_09.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_10.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_10.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_11.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_11.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_12.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_12.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_13.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_13.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_14.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_14.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_15.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_15.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_16.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_16.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_17.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_17.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_18.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_18.sh (contents, props changed) head/tests/sys/netinet6/frag6/frag6_19.py (contents, props changed) head/tests/sys/netinet6/frag6/frag6_19.sh (contents, props changed) head/tests/sys/netinet6/frag6/sniffer.py (contents, props changed) Modified: head/etc/mtree/BSD.tests.dist head/tests/sys/Makefile Modified: head/etc/mtree/BSD.tests.dist ============================================================================== --- head/etc/mtree/BSD.tests.dist Mon Oct 21 08:48:47 2019 (r353793) +++ head/etc/mtree/BSD.tests.dist Mon Oct 21 09:33:45 2019 (r353794) @@ -792,6 +792,10 @@ .. netinet .. + netinet6 + frag6 + .. + .. netipsec tunnel .. Modified: head/tests/sys/Makefile ============================================================================== --- head/tests/sys/Makefile Mon Oct 21 08:48:47 2019 (r353793) +++ head/tests/sys/Makefile Mon Oct 21 09:33:45 2019 (r353794) @@ -20,6 +20,7 @@ TESTS_SUBDIRS+= kqueue TESTS_SUBDIRS+= mac TESTS_SUBDIRS+= mqueue TESTS_SUBDIRS+= netinet +TESTS_SUBDIRS+= netinet6 TESTS_SUBDIRS+= netipsec TESTS_SUBDIRS+= netmap TESTS_SUBDIRS+= netpfil Added: head/tests/sys/netinet6/Makefile ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/tests/sys/netinet6/Makefile Mon Oct 21 09:33:45 2019 (r353794) @@ -0,0 +1,7 @@ +# $FreeBSD$ + +TESTSDIR= ${TESTSBASE}/sys/netinet6 + +TESTS_SUBDIRS+= frag6 + +.include <bsd.test.mk> Added: head/tests/sys/netinet6/frag6/Makefile ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/tests/sys/netinet6/frag6/Makefile Mon Oct 21 09:33:45 2019 (r353794) @@ -0,0 +1,76 @@ +# $FreeBSD$ + +PACKAGE= tests + +TESTSDIR= ${TESTSBASE}/sys/netinet6/frag6 +FILESDIR= ${TESTSDIR} + +# We split these up so they can run in parallel. +# Seems kyua is not running the test cases from one file in parallel. +# Otherwise we could cat the files together into one shell file. +ATF_TESTS_SH= \ + frag6_01 \ + frag6_02 \ + frag6_03 \ + frag6_04 \ + frag6_05 \ + frag6_06 \ + frag6_07 \ + frag6_08 \ + frag6_09 \ + frag6_10 \ + frag6_11 \ + frag6_12 \ + frag6_13 \ + frag6_14 \ + frag6_15 \ + frag6_16 \ + frag6_17 \ + frag6_18 \ + frag6_19 + +${PACKAGE}FILES+= frag6.subr +${PACKAGE}FILES+= sniffer.py +${PACKAGE}FILES+= frag6_01.py +${PACKAGE}FILES+= frag6_02.py +${PACKAGE}FILES+= frag6_03.py +${PACKAGE}FILES+= frag6_04.py +${PACKAGE}FILES+= frag6_05.py +${PACKAGE}FILES+= frag6_06.py +${PACKAGE}FILES+= frag6_07.py +${PACKAGE}FILES+= frag6_08.py +${PACKAGE}FILES+= frag6_09.py +${PACKAGE}FILES+= frag6_10.py +${PACKAGE}FILES+= frag6_11.py +${PACKAGE}FILES+= frag6_12.py +${PACKAGE}FILES+= frag6_13.py +${PACKAGE}FILES+= frag6_14.py +${PACKAGE}FILES+= frag6_15.py +${PACKAGE}FILES+= frag6_16.py +${PACKAGE}FILES+= frag6_17.py +${PACKAGE}FILES+= frag6_18.py +${PACKAGE}FILES+= frag6_19.py + +${PACKAGE}FILESMODE_frag6.subr= 0444 +${PACKAGE}FILESMODE_sniffer.py= 0555 +${PACKAGE}FILESMODE_frag6_01.py= 0555 +${PACKAGE}FILESMODE_frag6_02.py= 0555 +${PACKAGE}FILESMODE_frag6_03.py= 0555 +${PACKAGE}FILESMODE_frag6_04.py= 0555 +${PACKAGE}FILESMODE_frag6_05.py= 0555 +${PACKAGE}FILESMODE_frag6_06.py= 0555 +${PACKAGE}FILESMODE_frag6_07.py= 0555 +${PACKAGE}FILESMODE_frag6_08.py= 0555 +${PACKAGE}FILESMODE_frag6_09.py= 0555 +${PACKAGE}FILESMODE_frag6_10.py= 0555 +${PACKAGE}FILESMODE_frag6_11.py= 0555 +${PACKAGE}FILESMODE_frag6_12.py= 0555 +${PACKAGE}FILESMODE_frag6_13.py= 0555 +${PACKAGE}FILESMODE_frag6_14.py= 0555 +${PACKAGE}FILESMODE_frag6_15.py= 0555 +${PACKAGE}FILESMODE_frag6_16.py= 0555 +${PACKAGE}FILESMODE_frag6_17.py= 0555 +${PACKAGE}FILESMODE_frag6_18.py= 0555 +${PACKAGE}FILESMODE_frag6_19.py= 0555 + +.include <bsd.test.mk> Added: head/tests/sys/netinet6/frag6/frag6.subr ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/tests/sys/netinet6/frag6/frag6.subr Mon Oct 21 09:33:45 2019 (r353794) @@ -0,0 +1,122 @@ +# $FreeBSD$ +#- +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2019 Netflix, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# + +. $(atf_get_srcdir)/../../common/vnet.subr + +frag6_head() +{ + atf_set descr 'Test IPv6 fragmentation code' + atf_set require.user root + atf_set require.progs scapy +} + +frag6_body() +{ + ids=${1:="65533"} + shift + id=`printf "%x" ${ids}` + if [ $$ -gt 65535 ]; then + xl=`printf "%x" $(($$ - 65535))` + yl="1" + else + xl=`printf "%x" $$` + yl="" + fi + + vnet_init + + ip6a="2001:db8:6666:6666:${yl}:${id}:1:${xl}" + ip6b="2001:db8:6666:6666:${yl}:${id}:2:${xl}" + + epair=$(vnet_mkepair) + ifconfig ${epair}a mtu 131071 up + ifconfig ${epair}a inet6 ${ip6a}/64 + + jname="v6t-${id}-${yl}-${xl}" + vnet_mkjail ${jname} ${epair}b + jexec ${jname} ifconfig ${epair}b mtu 131071 up + jexec ${jname} ifconfig ${epair}b inet6 ${ip6b}/64 + + # Let IPv6 ND do its thing. + #ping6 -q -c 1 ff02::1%${epair}a + #ping6 -q -c 1 ${ip6b} + sleep 3 + + # We need to try to make sure all expiry happened, otherwise there might + # be global fragments queued. (This still does not rule out that there + # are no other fragments queued anywhere else in the system). + i=0 + while test $i -lt 60; do + nf=`sysctl -n net.inet6.ip6.frag6_nfrags` + case ${nf} in + 0) break ;; + esac + sleep 1 + i=$((i + 1)) + done + case ${nf} in + 0) ;; + *) atf_fail "Global frag6_nfrags count is not zero but ${nf}" ;; + esac + + pretestf=$2 + case "${pretestf}" in + "") ;; + [A-Za-z0-9_]*) + eval ${pretestf} "${jname}" "${epair}b" + ;; + esac + + # Clear statistics. + jexec ${jname} netstat -z -s > /dev/null + + # Run fragment tests. + pyname=$(atf_get ident) + pyname=${pyname%*_[0-9]} + atf_check -s exit:0 $(atf_get_srcdir)/${pyname}.py \ + --sendif ${epair}a \ + --recvif ${epair}a \ + --src ${ip6a} \ + --to ${ip6b} + + checkf=$1 + case "${checkf}" in + "") ;; + [A-Za-z0-9_]*) + eval ${checkf} "${jname}" "${epair}b" + ;; + esac +} + +frag6_cleanup() +{ + + vnet_cleanup +} + +# end Added: head/tests/sys/netinet6/frag6/frag6_01.py ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/tests/sys/netinet6/frag6/frag6_01.py Mon Oct 21 09:33:45 2019 (r353794) @@ -0,0 +1,115 @@ +#!/usr/bin/env python +#- +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2019 Netflix, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# +# $FreeBSD$ +# + +import argparse +import scapy.all as sp +import socket +import sys +from sniffer import Sniffer +from time import sleep + +def check_icmp6_error(args, packet): + ip6 = packet.getlayer(sp.IPv6) + if not ip6: + return False + oip6 = sp.IPv6(src=args.src[0], dst=args.to[0]) + if ip6.dst != oip6.src: + return False + icmp6 = packet.getlayer(sp.ICMPv6ParamProblem) + if not icmp6: + return False + # ICMP6_PARAMPROB_HEADER 0 + if icmp6.code != 0: + return False + # Should we check the payload as well? + # We are running in a very isolated environment and nothing else + # should trigger an ICMPv6 Param Prob so leave it. + #icmp6.display() + return True + +def main(): + parser = argparse.ArgumentParser("frag6.py", + description="IPv6 fragementation test tool") + parser.add_argument('--sendif', nargs=1, + required=True, + help='The interface through which the packet will be sent') + parser.add_argument('--recvif', nargs=1, + required=True, + help='The interface on which to check for the packet') + parser.add_argument('--src', nargs=1, + required=True, + help='The source IP address') + parser.add_argument('--to', nargs=1, + required=True, + help='The destination IP address') + parser.add_argument('--debug', + required=False, action='store_true', + help='Enable test debugging') + + args = parser.parse_args() + + + # Start sniffing on recvif + sniffer = Sniffer(args, check_icmp6_error) + + + ######################################################################## + # + # A single start fragment with zero length IPv6 header (jumbo). + # Make sure we do hit the Fragment case, which is tricky as the + # jumbogram needs to be > 64k. + # + # A: Jumbo-Fragment not allowed. + # R: ICMPv6 param problem. + # + #data = "6" * (65536 - 2 - 6 - 8 - 8) + data = "6" * 65512 + ip6f01 = sp.Ether() / \ + sp.IPv6(src=args.src[0], dst=args.to[0], plen=0) / \ + sp.IPv6ExtHdrHopByHop(options=sp.Jumbo(jumboplen=65536)) / \ + sp.IPv6ExtHdrFragment(offset=0, m=1, id=6) / \ + sp.UDP(dport=3456, sport=6543) / \ + data + if args.debug : + ip6f01.display() + sp.sendp(ip6f01, iface=args.sendif[0], verbose=False) + + # We should only need to sleep 0.10 but it seems scapy + # takes time for this one. + sleep(75) + sniffer.setEnd() + sniffer.join() + if not sniffer.foundCorrectPacket: + sys.exit(1) + + sys.exit(0) + +if __name__ == '__main__': + main() Added: head/tests/sys/netinet6/frag6/frag6_01.sh ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/tests/sys/netinet6/frag6/frag6_01.sh Mon Oct 21 09:33:45 2019 (r353794) @@ -0,0 +1,223 @@ +# $FreeBSD$ +#- +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2019 Netflix, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# + +. $(atf_get_srcdir)/frag6.subr + +atf_test_case "frag6_01" "cleanup" +frag6_01_head() { + frag6_head 1 +} + +frag6_01_check_stats() { + + local jname ifname + jname=$1 + ifname=$2 + + case "${jname}" in + "") echo "ERROR: jname is empty"; return ;; + esac + case "${ifname}" in + "") echo "ERROR: ifname is empty"; return ;; + esac + + # Defaults are: IPV6_FRAGTTL 120 slowtimo ticks. + # pfslowtimo() is run at hz/2. So this takes 60s. + # This is awefully long for a test case. + # The Python script has to wait for this already to get the ICMPv6 + # hence we do not sleep here anymore. + + + # + # Check selection of global UDP stats. + # + cat <<EOF > ${HOME}/filter-${jname}.txt + <received-datagrams>0</received-datagrams> + <dropped-incomplete-headers>0</dropped-incomplete-headers> + <dropped-bad-data-length>0</dropped-bad-data-length> + <dropped-bad-checksum>0</dropped-bad-checksum> + <dropped-no-checksum>0</dropped-no-checksum> + <dropped-no-socket>0</dropped-no-socket> + <dropped-broadcast-multicast>0</dropped-broadcast-multicast> + <dropped-full-socket-buffer>0</dropped-full-socket-buffer> + <not-for-hashed-pcb>0</not-for-hashed-pcb> +EOF + count=`jexec ${jname} netstat -s -p udp --libxo xml,pretty | grep -E -x -c -f ${HOME}/filter-${jname}.txt` + rm -f ${HOME}/filter-${jname}.txt + case ${count} in + 9) ;; + *) jexec ${jname} netstat -s -p udp --libxo xml,pretty + atf_fail "Global UDP statistics do not match: ${count} != 9" ;; + esac + + # + # Check selection of global IPv6 stats. + # + cat <<EOF > ${HOME}/filter-${jname}.txt + <dropped-below-minimum-size>0</dropped-below-minimum-size> + <dropped-short-packets>0</dropped-short-packets> + <dropped-bad-options>1</dropped-bad-options> + <dropped-bad-version>0</dropped-bad-version> + <received-fragments>0</received-fragments> + <dropped-fragment>0</dropped-fragment> + <dropped-fragment-after-timeout>0</dropped-fragment-after-timeout> + <dropped-fragments-overflow>0</dropped-fragments-overflow> + <atomic-fragments>0</atomic-fragments> + <reassembled-packets>0</reassembled-packets> + <forwarded-packets>0</forwarded-packets> + <packets-not-forwardable>0</packets-not-forwardable> + <sent-redirects>0</sent-redirects> + <send-packets-fabricated-header>0</send-packets-fabricated-header> + <discard-no-mbufs>0</discard-no-mbufs> + <discard-no-route>0</discard-no-route> + <sent-fragments>0</sent-fragments> + <fragments-created>0</fragments-created> + <discard-cannot-fragment>0</discard-cannot-fragment> + <discard-scope-violations>0</discard-scope-violations> +EOF + count=`jexec ${jname} netstat -s -p ip6 --libxo xml,pretty | grep -E -x -c -f ${HOME}/filter-${jname}.txt` + rm -f ${HOME}/filter-${jname}.txt + case ${count} in + 20) ;; + *) jexec ${jname} netstat -s -p ip6 --libxo xml,pretty + atf_fail "Global IPv6 statistics do not match: ${count} != 20" ;; + esac + + # + # Check selection of global ICMPv6 stats. + # + cat <<EOF > ${HOME}/filter-${jname}.txt + <icmp6-calls>1</icmp6-calls> + <no-route>0</no-route> + <admin-prohibited>0</admin-prohibited> + <beyond-scope>0</beyond-scope> + <address-unreachable>0</address-unreachable> + <port-unreachable>0</port-unreachable> + <packet-too-big>0</packet-too-big> + <time-exceed-transmit>0</time-exceed-transmit> + <time-exceed-reassembly>0</time-exceed-reassembly> + <bad-header>1</bad-header> + <bad-next-header>0</bad-next-header> + <bad-option>0</bad-option> + <redirects>0</redirects> + <unknown>0</unknown> + <reflect>0</reflect> + <too-many-nd-options>0</too-many-nd-options> + <bad-nd-options>0</bad-nd-options> + <bad-neighbor-solicitation>0</bad-neighbor-solicitation> + <bad-neighbor-advertisement>0</bad-neighbor-advertisement> + <bad-router-solicitation>0</bad-router-solicitation> + <bad-router-advertisement>0</bad-router-advertisement> + <bad-redirect>0</bad-redirect> +EOF + count=`jexec ${jname} netstat -s -p icmp6 --libxo xml,pretty | grep -E -x -c -f ${HOME}/filter-${jname}.txt` + rm -f ${HOME}/filter-${jname}.txt + case ${count} in + 22) ;; + *) jexec ${jname} netstat -s -p icmp6 --libxo xml,pretty + atf_fail "Global ICMPv6 statistics do not match: ${count} != 22" ;; + esac + + # + # Check selection of interface IPv6 stats. + # XXX-BZ TODO FIXME reassembly-failed should be 1? + # + cat <<EOF > ${HOME}/filter-${jname}.txt + <dropped-invalid-header>0</dropped-invalid-header> + <dropped-mtu-exceeded>0</dropped-mtu-exceeded> + <dropped-no-route>0</dropped-no-route> + <dropped-invalid-destination>0</dropped-invalid-destination> + <dropped-unknown-protocol>0</dropped-unknown-protocol> + <dropped-truncated>0</dropped-truncated> + <sent-forwarded>0</sent-forwarded> + <discard-packets>0</discard-packets> + <discard-fragments>0</discard-fragments> + <fragments-failed>0</fragments-failed> + <fragments-created>0</fragments-created> + <reassembly-required>0</reassembly-required> + <reassembled-packets>0</reassembled-packets> + <reassembly-failed>0</reassembly-failed> +EOF + count=`jexec ${jname} netstat -s -p ip6 -I ${ifname} --libxo xml,pretty | grep -E -x -c -f ${HOME}/filter-${jname}.txt` + rm -f ${HOME}/filter-${jname}.txt + case ${count} in + 14) ;; + *) jexec ${jname} netstat -s -p ip6 -I ${ifname} --libxo xml,pretty + atf_fail "Interface IPv6 statistics do not match: ${count} != 14" ;; + esac + + # + # Check selection of interface ICMPv6 stats. + # + cat <<EOF > ${HOME}/filter-${jname}.txt + <received-errors>0</received-errors> + <received-destination-unreachable>0</received-destination-unreachable> + <received-admin-prohibited>0</received-admin-prohibited> + <received-time-exceeded>0</received-time-exceeded> + <received-bad-parameter>0</received-bad-parameter> + <received-packet-too-big>0</received-packet-too-big> + <received-echo-requests>0</received-echo-requests> + <received-echo-replies>0</received-echo-replies> + <received-router-solicitation>0</received-router-solicitation> + <received-router-advertisement>0</received-router-advertisement> + <sent-errors>1</sent-errors> + <sent-destination-unreachable>0</sent-destination-unreachable> + <sent-admin-prohibited>0</sent-admin-prohibited> + <sent-time-exceeded>0</sent-time-exceeded> + <sent-bad-parameter>1</sent-bad-parameter> + <sent-packet-too-big>0</sent-packet-too-big> + <sent-echo-requests>0</sent-echo-requests> + <sent-echo-replies>0</sent-echo-replies> + <sent-router-solicitation>0</sent-router-solicitation> + <sent-router-advertisement>0</sent-router-advertisement> + <sent-redirects>0</sent-redirects> +EOF + count=`jexec ${jname} netstat -s -p icmp6 -I ${ifname} --libxo xml,pretty | grep -E -x -c -f ${HOME}/filter-${jname}.txt` + rm -f ${HOME}/filter-${jname}.txt + case ${count} in + 21) ;; + *) jexec ${jname} netstat -s -p icmp6 -I ${ifname} --libxo xml,pretty + atf_fail "Interface ICMPv6 statistics do not match: ${count} != 21" ;; + esac +} + +frag6_01_body() { + + atf_skip "Sending IPv6 Jumbograms needs 1 kernel changes and BPF fixes" + + frag6_body 1 frag6_01_check_stats +} + +frag6_01_cleanup() { + frag6_cleanup 1 +} + +atf_init_test_cases() +{ + atf_add_test_case "frag6_01" +} Added: head/tests/sys/netinet6/frag6/frag6_02.py ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/tests/sys/netinet6/frag6/frag6_02.py Mon Oct 21 09:33:45 2019 (r353794) @@ -0,0 +1,108 @@ +#!/usr/bin/env python +#- +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2019 Netflix, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# +# $FreeBSD$ +# + +import argparse +import scapy.all as sp +import socket +import sys +from sniffer import Sniffer +from time import sleep + +def check_icmp6_error(args, packet): + ip6 = packet.getlayer(sp.IPv6) + if not ip6: + return False + oip6 = sp.IPv6(src=args.src[0], dst=args.to[0]) + if ip6.dst != oip6.src: + return False + icmp6 = packet.getlayer(sp.ICMPv6ParamProblem) + if not icmp6: + return False + # ICMP6_PARAMPROB_HEADER 0 + if icmp6.code != 0: + return False + # Should we check the payload as well? + # We are running in a very isolated environment and nothing else + # should trigger an ICMPv6 Param Prob so leave it. + #icmp6.display() + return True + +def main(): + parser = argparse.ArgumentParser("frag6.py", + description="IPv6 fragementation test tool") + parser.add_argument('--sendif', nargs=1, + required=True, + help='The interface through which the packet will be sent') + parser.add_argument('--recvif', nargs=1, + required=True, + help='The interface on which to check for the packet') + parser.add_argument('--src', nargs=1, + required=True, + help='The source IP address') + parser.add_argument('--to', nargs=1, + required=True, + help='The destination IP address') + parser.add_argument('--debug', + required=False, action='store_true', + help='Enable test debugging') + + args = parser.parse_args() + + + # Start sniffing on recvif + sniffer = Sniffer(args, check_icmp6_error) + + + ######################################################################## + # + # A single start fragment with payload length not % 8. + # + # A: Error handling in code. + # R: ICMPv6 param problem. + # + data = "6" * 1287 + ip6f01 = sp.Ether() / \ + sp.IPv6(src=args.src[0], dst=args.to[0]) / \ + sp.IPv6ExtHdrFragment(offset=0, m=1, id=5) / \ + sp.UDP(dport=3456, sport=6543) / \ + data + if args.debug : + ip6f01.display() + sp.sendp(ip6f01, iface=args.sendif[0], verbose=False) + + sleep(0.10) + sniffer.join() + if not sniffer.foundCorrectPacket: + sys.exit(1) + + sys.exit(0) + +if __name__ == '__main__': + main() Added: head/tests/sys/netinet6/frag6/frag6_02.sh ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/tests/sys/netinet6/frag6/frag6_02.sh Mon Oct 21 09:33:45 2019 (r353794) @@ -0,0 +1,220 @@ +# $FreeBSD$ +#- +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2019 Netflix, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# + +. $(atf_get_srcdir)/frag6.subr + +atf_test_case "frag6_02" "cleanup" +frag6_02_head() { + frag6_head 2 +} + +frag6_02_check_stats() { + + local jname ifname + jname=$1 + ifname=$2 + + case "${jname}" in + "") echo "ERROR: jname is empty"; return ;; + esac + case "${ifname}" in + "") echo "ERROR: ifname is empty"; return ;; + esac + + # Defaults are: IPV6_FRAGTTL 120 slowtimo ticks. + # pfslowtimo() is run at hz/2. So this takes 60s. + # This is awefully long for a test case. + # The Python script has to wait for this already to get the ICMPv6 + # hence we do not sleep here anymore. + + + # + # Check selection of global UDP stats. + # + cat <<EOF > ${HOME}/filter-${jname}.txt + <received-datagrams>0</received-datagrams> + <dropped-incomplete-headers>0</dropped-incomplete-headers> + <dropped-bad-data-length>0</dropped-bad-data-length> + <dropped-bad-checksum>0</dropped-bad-checksum> + <dropped-no-checksum>0</dropped-no-checksum> + <dropped-no-socket>0</dropped-no-socket> + <dropped-broadcast-multicast>0</dropped-broadcast-multicast> + <dropped-full-socket-buffer>0</dropped-full-socket-buffer> + <not-for-hashed-pcb>0</not-for-hashed-pcb> +EOF + count=`jexec ${jname} netstat -s -p udp --libxo xml,pretty | grep -E -x -c -f ${HOME}/filter-${jname}.txt` + rm -f ${HOME}/filter-${jname}.txt + case ${count} in + 9) ;; + *) jexec ${jname} netstat -s -p udp --libxo xml,pretty + atf_fail "Global UDP statistics do not match: ${count} != 9" ;; + esac + + # + # Check selection of global IPv6 stats. + # XXX-TODO no global stats for this case? + # + cat <<EOF > ${HOME}/filter-${jname}.txt + <dropped-below-minimum-size>0</dropped-below-minimum-size> + <dropped-short-packets>0</dropped-short-packets> + <dropped-bad-options>0</dropped-bad-options> + <dropped-bad-version>0</dropped-bad-version> + <received-fragments>0</received-fragments> + <dropped-fragment>0</dropped-fragment> + <dropped-fragment-after-timeout>0</dropped-fragment-after-timeout> + <dropped-fragments-overflow>0</dropped-fragments-overflow> + <atomic-fragments>0</atomic-fragments> + <reassembled-packets>0</reassembled-packets> + <forwarded-packets>0</forwarded-packets> + <packets-not-forwardable>0</packets-not-forwardable> + <sent-redirects>0</sent-redirects> + <send-packets-fabricated-header>0</send-packets-fabricated-header> + <discard-no-mbufs>0</discard-no-mbufs> + <discard-no-route>0</discard-no-route> + <sent-fragments>0</sent-fragments> + <fragments-created>0</fragments-created> + <discard-cannot-fragment>0</discard-cannot-fragment> + <discard-scope-violations>0</discard-scope-violations> +EOF + count=`jexec ${jname} netstat -s -p ip6 --libxo xml,pretty | grep -E -x -c -f ${HOME}/filter-${jname}.txt` + rm -f ${HOME}/filter-${jname}.txt + case ${count} in + 20) ;; + *) jexec ${jname} netstat -s -p ip6 --libxo xml,pretty + atf_fail "Global IPv6 statistics do not match: ${count} != 20" ;; + esac + + # + # Check selection of global ICMPv6 stats. + # + cat <<EOF > ${HOME}/filter-${jname}.txt + <icmp6-calls>1</icmp6-calls> + <no-route>0</no-route> + <admin-prohibited>0</admin-prohibited> + <beyond-scope>0</beyond-scope> + <address-unreachable>0</address-unreachable> + <port-unreachable>0</port-unreachable> + <packet-too-big>0</packet-too-big> + <time-exceed-transmit>0</time-exceed-transmit> + <time-exceed-reassembly>0</time-exceed-reassembly> + <bad-header>1</bad-header> + <bad-next-header>0</bad-next-header> + <bad-option>0</bad-option> + <redirects>0</redirects> + <unknown>0</unknown> + <reflect>0</reflect> + <too-many-nd-options>0</too-many-nd-options> + <bad-nd-options>0</bad-nd-options> + <bad-neighbor-solicitation>0</bad-neighbor-solicitation> + <bad-neighbor-advertisement>0</bad-neighbor-advertisement> + <bad-router-solicitation>0</bad-router-solicitation> + <bad-router-advertisement>0</bad-router-advertisement> + <bad-redirect>0</bad-redirect> +EOF + count=`jexec ${jname} netstat -s -p icmp6 --libxo xml,pretty | grep -E -x -c -f ${HOME}/filter-${jname}.txt` + rm -f ${HOME}/filter-${jname}.txt + case ${count} in + 22) ;; + *) jexec ${jname} netstat -s -p icmp6 --libxo xml,pretty + atf_fail "Global ICMPv6 statistics do not match: ${count} != 22" ;; + esac + + # + # Check selection of interface IPv6 stats. + # + cat <<EOF > ${HOME}/filter-${jname}.txt + <dropped-invalid-header>0</dropped-invalid-header> + <dropped-mtu-exceeded>0</dropped-mtu-exceeded> + <dropped-no-route>0</dropped-no-route> + <dropped-invalid-destination>0</dropped-invalid-destination> + <dropped-unknown-protocol>0</dropped-unknown-protocol> + <dropped-truncated>0</dropped-truncated> + <sent-forwarded>0</sent-forwarded> + <discard-packets>0</discard-packets> + <discard-fragments>0</discard-fragments> + <fragments-failed>0</fragments-failed> + <fragments-created>0</fragments-created> + <reassembly-required>0</reassembly-required> + <reassembled-packets>0</reassembled-packets> + <reassembly-failed>1</reassembly-failed> +EOF + count=`jexec ${jname} netstat -s -p ip6 -I ${ifname} --libxo xml,pretty | grep -E -x -c -f ${HOME}/filter-${jname}.txt` + rm -f ${HOME}/filter-${jname}.txt + case ${count} in + 14) ;; + *) jexec ${jname} netstat -s -p ip6 -I ${ifname} --libxo xml,pretty + atf_fail "Interface IPv6 statistics do not match: ${count} != 14" ;; + esac + + # + # Check selection of interface ICMPv6 stats. + # + cat <<EOF > ${HOME}/filter-${jname}.txt + <received-errors>0</received-errors> + <received-destination-unreachable>0</received-destination-unreachable> + <received-admin-prohibited>0</received-admin-prohibited> + <received-time-exceeded>0</received-time-exceeded> + <received-bad-parameter>0</received-bad-parameter> + <received-packet-too-big>0</received-packet-too-big> + <received-echo-requests>0</received-echo-requests> + <received-echo-replies>0</received-echo-replies> + <received-router-solicitation>0</received-router-solicitation> + <received-router-advertisement>0</received-router-advertisement> + <sent-errors>1</sent-errors> + <sent-destination-unreachable>0</sent-destination-unreachable> + <sent-admin-prohibited>0</sent-admin-prohibited> + <sent-time-exceeded>0</sent-time-exceeded> + <sent-bad-parameter>1</sent-bad-parameter> + <sent-packet-too-big>0</sent-packet-too-big> + <sent-echo-requests>0</sent-echo-requests> + <sent-echo-replies>0</sent-echo-replies> + <sent-router-solicitation>0</sent-router-solicitation> + <sent-router-advertisement>0</sent-router-advertisement> + <sent-redirects>0</sent-redirects> +EOF + count=`jexec ${jname} netstat -s -p icmp6 -I ${ifname} --libxo xml,pretty | grep -E -x -c -f ${HOME}/filter-${jname}.txt` + rm -f ${HOME}/filter-${jname}.txt + case ${count} in + 21) ;; + *) jexec ${jname} netstat -s -p icmp6 -I ${ifname} --libxo xml,pretty + atf_fail "Interface ICMPv6 statistics do not match: ${count} != 21" ;; + esac +} + +frag6_02_body() { + frag6_body 2 frag6_02_check_stats +} + +frag6_02_cleanup() { + frag6_cleanup 2 +} + +atf_init_test_cases() +{ + atf_add_test_case "frag6_02" +} Added: head/tests/sys/netinet6/frag6/frag6_03.py ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/tests/sys/netinet6/frag6/frag6_03.py Mon Oct 21 09:33:45 2019 (r353794) @@ -0,0 +1,106 @@ +#!/usr/bin/env python +#- +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2019 Netflix, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# +# $FreeBSD$ +# + +import argparse +import scapy.all as sp +import socket +import sys +from sniffer import Sniffer +from time import sleep + +def check_icmp6_error(args, packet): + ip6 = packet.getlayer(sp.IPv6) + if not ip6: + return False + oip6 = sp.IPv6(src=args.src[0], dst=args.to[0]) + if ip6.dst != oip6.src: + return False + icmp6 = packet.getlayer(sp.ICMPv6DestUnreach) + if not icmp6: + return False + # ICMP6_DST_UNREACH_NOPORT 4 + if icmp6.code != 4: + return False + # Should we check the payload as well? + # We are running in a very isolated environment and nothing else + # should trigger an ICMPv6 Dest Unreach / Port Unreach so leave it. + #icmp6.display() + return True + +def main(): + parser = argparse.ArgumentParser("frag6.py", + description="IPv6 fragementation test tool") + parser.add_argument('--sendif', nargs=1, + required=True, + help='The interface through which the packet will be sent') + parser.add_argument('--recvif', nargs=1, + required=True, + help='The interface on which to check for the packet') + parser.add_argument('--src', nargs=1, + required=True, + help='The source IP address') + parser.add_argument('--to', nargs=1, + required=True, + help='The destination IP address') + parser.add_argument('--debug', + required=False, action='store_true', + help='Enable test debugging') + + args = parser.parse_args() + + + # Start sniffing on recvif + sniffer = Sniffer(args, check_icmp6_error) + + *** DIFF OUTPUT TRUNCATED AT 1000 LINES ***
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201910210933.x9L9Xkig062769>