From owner-dev-commits-src-all@freebsd.org Tue May 18 12:18:44 2021 Return-Path: Delivered-To: dev-commits-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 10DA664B68A; Tue, 18 May 2021 12:18:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Fkw5b6CKbz3Ppp; Tue, 18 May 2021 12:18:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 8EE621F03B; Tue, 18 May 2021 12:18:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 14ICIh5k051729; Tue, 18 May 2021 12:18:43 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 14ICIhkY051728; Tue, 18 May 2021 12:18:43 GMT (envelope-from git) Date: Tue, 18 May 2021 12:18:43 GMT Message-Id: <202105181218.14ICIhkY051728@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kristof Provost Subject: git: e8889c723a81 - stable/12 - bridge tests: Test STP config BPDU validation MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/stable/12 X-Git-Reftype: branch X-Git-Commit: e8889c723a816c1407c5de7cc812dcd5fce42c34 Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-all@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for all branches of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 May 2021 12:18:44 -0000 The branch stable/12 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=e8889c723a816c1407c5de7cc812dcd5fce42c34 commit e8889c723a816c1407c5de7cc812dcd5fce42c34 Author: Kristof Provost AuthorDate: 2021-04-15 12:55:00 +0000 Commit: Kristof Provost CommitDate: 2021-05-18 12:17:47 +0000 bridge tests: Test STP config BPDU validation PR: 254924 Reviewed by: donner Differential Revision: https://reviews.freebsd.org/D29783 (cherry picked from commit 4ae3a97e127cea14277b904af31483af7e6e2891) --- tests/sys/net/Makefile | 7 ++- tests/sys/net/if_bridge_test.sh | 45 ++++++++++++++++ tests/sys/net/stp.py | 112 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 163 insertions(+), 1 deletion(-) diff --git a/tests/sys/net/Makefile b/tests/sys/net/Makefile index bbb1d1337b2f..77c3c833a186 100644 --- a/tests/sys/net/Makefile +++ b/tests/sys/net/Makefile @@ -1,6 +1,6 @@ # $FreeBSD$ -.include +PACKAGE= tests TESTSDIR= ${TESTSBASE}/sys/net BINDIR= ${TESTSDIR} @@ -16,6 +16,11 @@ ATF_TESTS_SH+= if_tun_test # locked. TEST_METADATA+= is_exclusive=true +${PACKAGE}FILES+= \ + stp.py + +${PACKAGE}FILESMODE_stp.py= 0555 + MAN= PROGS+= randsleep diff --git a/tests/sys/net/if_bridge_test.sh b/tests/sys/net/if_bridge_test.sh index 1f10fe325a2c..4703efed46b8 100755 --- a/tests/sys/net/if_bridge_test.sh +++ b/tests/sys/net/if_bridge_test.sh @@ -408,6 +408,50 @@ inherit_mac_cleanup() vnet_cleanup } +atf_test_case "stp_validation" "cleanup" +stp_validation_head() +{ + atf_set descr 'Check STP validation' + atf_set require.user root + atf_set require.progs scapy +} + +stp_validation_body() +{ + vnet_init + + epair_one=$(vnet_mkepair) + epair_two=$(vnet_mkepair) + bridge=$(vnet_mkbridge) + + ifconfig ${bridge} up + ifconfig ${bridge} addm ${epair_one}a addm ${epair_two}a + ifconfig ${bridge} stp ${epair_one}a stp ${epair_two}a + + ifconfig ${epair_one}a up + ifconfig ${epair_one}b up + ifconfig ${epair_two}a up + ifconfig ${epair_two}b up + + # Wait until the interfaces are no longer discarding + while ifconfig ${bridge} | grep 'state discarding' >/dev/null + do + sleep 1 + done + + # Now inject invalid STP BPDUs on epair_one and see if they're repeated + # on epair_two + atf_check -s exit:0 \ + $(atf_get_srcdir)/stp.py \ + --sendif ${epair_one}b \ + --recvif ${epair_two}b +} + +stp_validation_cleanup() +{ + vnet_cleanup +} + atf_init_test_cases() { atf_add_test_case "bridge_transmit_ipv4_unicast" @@ -418,4 +462,5 @@ atf_init_test_cases() atf_add_test_case "inherit_mac" atf_add_test_case "delete_with_members" atf_add_test_case "mac_conflict" + atf_add_test_case "stp_validation" } diff --git a/tests/sys/net/stp.py b/tests/sys/net/stp.py new file mode 100644 index 000000000000..4c4c0af4c728 --- /dev/null +++ b/tests/sys/net/stp.py @@ -0,0 +1,112 @@ +#!/usr/bin/env python3 +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2021 Kristof Provost +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# + +import argparse +import scapy.all as sp +import sys +import os +curdir = os.path.dirname(os.path.realpath(__file__)) +netpfil_common = curdir + "/../netpfil/common" +sys.path.append(netpfil_common) +from sniffer import Sniffer + +def check_stp(args, packet): + stp = packet.getlayer(sp.STP) + if stp is None: + return False + + if stp.rootmac != "00:0c:29:01:01:01": + return False + + # Ensure we don't get confused by valid STP packets generated by if_bridge + if (stp.maxage >= 6 and stp.maxage <= 40) and \ + (stp.hellotime >= 1 and stp.hellotime <= 2) and \ + (stp.fwddelay >= 4 and stp.fwddelay <= 30): + return False + + print("This packet should have been dropped") + print(packet.show()) + return True + +def invalid_stp(send_if): + llc = sp.Ether(src="00:0c:29:0b:91:0a", dst="01:80:C2:00:00:00") \ + / sp.LLC() + + # Bad maxage + stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ + bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ + portid=0x8007, maxage=41, hellotime=2, fwddelay=30) + sp.sendp(stp, iface=send_if, verbose=False) + stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ + bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ + portid=0x8007, maxage=5, hellotime=2, fwddelay=30) + sp.sendp(stp, iface=send_if, verbose=False) + + # Bad hellotime + stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ + bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ + portid=0x8007, maxage=40, hellotime=3, fwddelay=30) + sp.sendp(stp, iface=send_if, verbose=False) + stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ + bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ + portid=0x8007, maxage=40, hellotime=1, fwddelay=30) + sp.sendp(stp, iface=send_if, verbose=False) + + # Bad fwddelay + stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ + bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ + portid=0x8007, maxage=40, hellotime=2, fwddelay=31) + sp.sendp(stp, iface=send_if, verbose=False) + stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ + bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ + portid=0x8007, maxage=40, hellotime=2, fwddelay=3) + sp.sendp(stp, iface=send_if, verbose=False) + +def main(): + parser = argparse.ArgumentParser("stp.py", + description="STP test tool") + parser.add_argument('--sendif', nargs=1, + required=True, + help='The interface through which the packet(s) will be sent') + parser.add_argument('--recvif', nargs=1, + help='The interface on which to expect the ICMP echo request') + + args = parser.parse_args() + + sniffer = Sniffer(args, check_stp) + + invalid_stp(args.sendif[0]) + + sniffer.join() + + # The 'correct' packet is a corrupt STP packet, so it shouldn't turn up. + if sniffer.foundCorrectPacket: + sys.exit(1) + +if __name__ == '__main__': + main()