1#!/usr/bin/env python3 2# 3# SPDX-License-Identifier: BSD-2-Clause 4# 5# Copyright (c) 2021 Kristof Provost <kp@FreeBSD.org> 6# 7# Redistribution and use in source and binary forms, with or without 8# modification, are permitted provided that the following conditions 9# are met: 10# 1. Redistributions of source code must retain the above copyright 11# notice, this list of conditions and the following disclaimer. 12# 2. Redistributions in binary form must reproduce the above copyright 13# notice, this list of conditions and the following disclaimer in the 14# documentation and/or other materials provided with the distribution. 15# 16# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26# SUCH DAMAGE. 27# 28 29import argparse 30import scapy.all as sp 31import sys 32import os 33curdir = os.path.dirname(os.path.realpath(__file__)) 34netpfil_common = curdir + "/../netpfil/common" 35sys.path.append(netpfil_common) 36from sniffer import Sniffer 37 38def check_stp(args, packet): 39 stp = packet.getlayer(sp.STP) 40 if stp is None: 41 return False 42 43 if stp.rootmac != "00:0c:29:01:01:01": 44 return False 45 46 # Ensure we don't get confused by valid STP packets generated by if_bridge 47 if (stp.maxage >= 6 and stp.maxage <= 40) and \ 48 (stp.hellotime >= 1 and stp.hellotime <= 2) and \ 49 (stp.fwddelay >= 4 and stp.fwddelay <= 30): 50 return False 51 52 print("This packet should have been dropped") 53 print(packet.show()) 54 return True 55 56def invalid_stp(send_if): 57 llc = sp.Ether(src="00:0c:29:0b:91:0a", dst="01:80:C2:00:00:00") \ 58 / sp.LLC() 59 60 # Bad maxage 61 stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ 62 bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ 63 portid=0x8007, maxage=41, hellotime=2, fwddelay=30) 64 sp.sendp(stp, iface=send_if, verbose=False) 65 stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ 66 bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ 67 portid=0x8007, maxage=5, hellotime=2, fwddelay=30) 68 sp.sendp(stp, iface=send_if, verbose=False) 69 70 # Bad hellotime 71 stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ 72 bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ 73 portid=0x8007, maxage=40, hellotime=3, fwddelay=30) 74 sp.sendp(stp, iface=send_if, verbose=False) 75 stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ 76 bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ 77 portid=0x8007, maxage=40, hellotime=1, fwddelay=30) 78 sp.sendp(stp, iface=send_if, verbose=False) 79 80 # Bad fwddelay 81 stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ 82 bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ 83 portid=0x8007, maxage=40, hellotime=2, fwddelay=31) 84 sp.sendp(stp, iface=send_if, verbose=False) 85 stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \ 86 bridgeid=32768, bridgemac="00:0c:29:01:01:01", \ 87 portid=0x8007, maxage=40, hellotime=2, fwddelay=3) 88 sp.sendp(stp, iface=send_if, verbose=False) 89 90def main(): 91 parser = argparse.ArgumentParser("stp.py", 92 description="STP test tool") 93 parser.add_argument('--sendif', nargs=1, 94 required=True, 95 help='The interface through which the packet(s) will be sent') 96 parser.add_argument('--recvif', nargs=1, 97 help='The interface on which to expect the ICMP echo request') 98 99 args = parser.parse_args() 100 101 sniffer = Sniffer(args, check_stp) 102 103 invalid_stp(args.sendif[0]) 104 105 sniffer.join() 106 107 # The 'correct' packet is a corrupt STP packet, so it shouldn't turn up. 108 if sniffer.foundCorrectPacket: 109 sys.exit(1) 110 111if __name__ == '__main__': 112 main() 113