Date: Tue, 18 May 2021 12:18:43 GMT From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: e8889c723a81 - stable/12 - bridge tests: Test STP config BPDU validation Message-ID: <202105181218.14ICIhkY051728@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/12 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=e8889c723a816c1407c5de7cc812dcd5fce42c34 commit e8889c723a816c1407c5de7cc812dcd5fce42c34 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2021-04-15 12:55:00 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2021-05-18 12:17:47 +0000 bridge tests: Test STP config BPDU validation PR: 254924 Reviewed by: donner Differential Revision: https://reviews.freebsd.org/D29783 (cherry picked from commit 4ae3a97e127cea14277b904af31483af7e6e2891) --- tests/sys/net/Makefile | 7 ++- tests/sys/net/if_bridge_test.sh | 45 ++++++++++++++++ tests/sys/net/stp.py | 112 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 163 insertions(+), 1 deletion(-) diff --git a/tests/sys/net/Makefile b/tests/sys/net/Makefile index bbb1d1337b2f..77c3c833a186 100644 --- a/tests/sys/net/Makefile +++ b/tests/sys/net/Makefile @@ -1,6 +1,6 @@ # $FreeBSD$ -.include <bsd.own.mk> +PACKAGE= tests TESTSDIR= ${TESTSBASE}/sys/net BINDIR= ${TESTSDIR} @@ -16,6 +16,11 @@ ATF_TESTS_SH+= if_tun_test # locked. TEST_METADATA+= is_exclusive=true +${PACKAGE}FILES+= \ + stp.py + +${PACKAGE}FILESMODE_stp.py= 0555 + MAN= PROGS+= randsleep diff --git a/tests/sys/net/if_bridge_test.sh b/tests/sys/net/if_bridge_test.sh index 1f10fe325a2c..4703efed46b8 100755 --- a/tests/sys/net/if_bridge_test.sh +++ b/tests/sys/net/if_bridge_test.sh @@ -408,6 +408,50 @@ inherit_mac_cleanup() vnet_cleanup } +atf_test_case "stp_validation" "cleanup" +stp_validation_head() +{ + atf_set descr 'Check STP validation' + atf_set require.user root + atf_set require.progs scapy +} + +stp_validation_body() +{ + vnet_init + + epair_one=$(vnet_mkepair) + epair_two=$(vnet_mkepair) + bridge=$(vnet_mkbridge) + + ifconfig ${bridge} up + ifconfig ${bridge} addm ${epair_one}a addm ${epair_two}a + ifconfig ${bridge} stp ${epair_one}a stp ${epair_two}a + + ifconfig ${epair_one}a up + ifconfig ${epair_one}b up + ifconfig ${epair_two}a up + ifconfig ${epair_two}b up + + # Wait until the interfaces are no longer discarding + while ifconfig ${bridge} | grep 'state discarding' >/dev/null + do + sleep 1 + done + + # Now inject invalid STP BPDUs on epair_one and see if they're repeated + # on epair_two + atf_check -s exit:0 \ + $(atf_get_srcdir)/stp.py \ + --sendif ${epair_one}b \ + --recvif ${epair_two}b +} + +stp_validation_cleanup() +{ + vnet_cleanup +} + atf_init_test_cases() { atf_add_test_case "bridge_transmit_ipv4_unicast" @@ -418,4 +462,5 @@ atf_init_test_cases() atf_add_test_case "inherit_mac" atf_add_test_case "delete_with_members" atf_add_test_case "mac_conflict" + atf_add_test_case "stp_validation" } diff --git a/tests/sys/net/stp.py b/tests/sys/net/stp.py new file mode 100644 index 000000000000..4c4c0af4c728 --- /dev/null +++ b/tests/sys/net/stp.py @@ -0,0 +1,112 @@ +#!/usr/bin/env python3 +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2021 Kristof Provost <kp@FreeBSD.org> +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# + +import argparse +import scapy.all as sp +import sys +import os +curdir = os.path.dirname(os.path.realpath(__file__)) +netpfil_common = curdir + "/../netpfil/common" +sys.path.append(netpfil_common) +from sniffer import Sniffer + +def check_stp(args, packet): + stp = packet.getlayer(sp.STP) + if stp is None: + return False + + if stp.rootmac != "00:0c:29:01:01:01": + return False + + # Ensure we don't get confused by valid STP packets generated by if_bridge + if (stp.maxage >= 6 and stp.maxage <= 40) and \ + (stp.hellotime >= 1 and stp.hellotime <= 2) and \ + (stp.fwddelay >= 4 and stp.fwddelay <= 30): + return False + + print("This packet should have been dropped") + print(packet.show()) + return True + +def invalid_stp(send_if): + llc = sp.Ether(src="00:0c:29:0b:91:0a", dst="01:80:C2:00:00:00") \ + / sp.LLC() + + # Bad maxage + stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ + bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ + portid=0x8007, maxage=41, hellotime=2, fwddelay=30) + sp.sendp(stp, iface=send_if, verbose=False) + stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ + bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ + portid=0x8007, maxage=5, hellotime=2, fwddelay=30) + sp.sendp(stp, iface=send_if, verbose=False) + + # Bad hellotime + stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ + bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ + portid=0x8007, maxage=40, hellotime=3, fwddelay=30) + sp.sendp(stp, iface=send_if, verbose=False) + stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ + bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ + portid=0x8007, maxage=40, hellotime=1, fwddelay=30) + sp.sendp(stp, iface=send_if, verbose=False) + + # Bad fwddelay + stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ + bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ + portid=0x8007, maxage=40, hellotime=2, fwddelay=31) + sp.sendp(stp, iface=send_if, verbose=False) + stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ + bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ + portid=0x8007, maxage=40, hellotime=2, fwddelay=3) + sp.sendp(stp, iface=send_if, verbose=False) + +def main(): + parser = argparse.ArgumentParser("stp.py", + description="STP test tool") + parser.add_argument('--sendif', nargs=1, + required=True, + help='The interface through which the packet(s) will be sent') + parser.add_argument('--recvif', nargs=1, + help='The interface on which to expect the ICMP echo request') + + args = parser.parse_args() + + sniffer = Sniffer(args, check_stp) + + invalid_stp(args.sendif[0]) + + sniffer.join() + + # The 'correct' packet is a corrupt STP packet, so it shouldn't turn up. + if sniffer.foundCorrectPacket: + sys.exit(1) + +if __name__ == '__main__': + main()
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202105181218.14ICIhkY051728>