1# 2# SPDX-License-Identifier: BSD-2-Clause 3# 4# Copyright (c) 2017 Kristof Provost <kp@FreeBSD.org> 5# 6# Redistribution and use in source and binary forms, with or without 7# modification, are permitted provided that the following conditions 8# are met: 9# 1. Redistributions of source code must retain the above copyright 10# notice, this list of conditions and the following disclaimer. 11# 2. Redistributions in binary form must reproduce the above copyright 12# notice, this list of conditions and the following disclaimer in the 13# documentation and/or other materials provided with the distribution. 14# 15# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25# SUCH DAMAGE. 26 27. $(atf_get_srcdir)/utils.subr 28 29atf_test_case "too_many_fragments" "cleanup" 30 31too_many_fragments_head() 32{ 33 atf_set descr 'IPv4 fragment limitation test' 34 atf_set require.user root 35} 36 37too_many_fragments_body() 38{ 39 pft_init 40 41 epair=$(vnet_mkepair) 42 vnet_mkjail alcatraz ${epair}a 43 44 ifconfig ${epair}b inet 192.0.2.1/24 up 45 jexec alcatraz ifconfig ${epair}a 192.0.2.2/24 up 46 47 ifconfig ${epair}b mtu 200 48 jexec alcatraz ifconfig ${epair}a mtu 200 49 50 jexec alcatraz pfctl -e 51 pft_set_rules alcatraz \ 52 "scrub all fragment reassemble" 53 54 # So we know pf is limiting things 55 jexec alcatraz sysctl net.inet.ip.maxfragsperpacket=1024 56 57 # Sanity check 58 atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2 59 60 # We can ping with < 64 fragments 61 atf_check -s exit:0 -o ignore ping -c 1 -s 800 192.0.2.2 62 63 # Too many fragments should fail 64 atf_check -s exit:2 -o ignore ping -c 1 -s 20000 192.0.2.2 65} 66 67too_many_fragments_cleanup() 68{ 69 pft_cleanup 70} 71 72atf_test_case "v6" "cleanup" 73v6_head() 74{ 75 atf_set descr 'IPv6 fragmentation test' 76 atf_set require.user root 77 atf_set require.progs scapy 78} 79 80v6_body() 81{ 82 pft_init 83 84 epair_send=$(vnet_mkepair) 85 epair_link=$(vnet_mkepair) 86 87 vnet_mkjail alcatraz ${epair_send}b ${epair_link}a 88 vnet_mkjail singsing ${epair_link}b 89 90 ifconfig ${epair_send}a inet6 2001:db8:42::1/64 no_dad up 91 92 jexec alcatraz ifconfig ${epair_send}b inet6 2001:db8:42::2/64 no_dad up 93 jexec alcatraz ifconfig ${epair_link}a inet6 2001:db8:43::2/64 no_dad up 94 jexec alcatraz sysctl net.inet6.ip6.forwarding=1 95 96 jexec singsing ifconfig ${epair_link}b inet6 2001:db8:43::3/64 no_dad up 97 jexec singsing route add -6 2001:db8:42::/64 2001:db8:43::2 98 route add -6 2001:db8:43::/64 2001:db8:42::2 99 100 jexec alcatraz ifconfig ${epair_send}b inet6 -ifdisabled 101 jexec alcatraz ifconfig ${epair_link}a inet6 -ifdisabled 102 jexec singsing ifconfig ${epair_link}b inet6 -ifdisabled 103 ifconfig ${epair_send}a inet6 -ifdisabled 104 105 ifconfig ${epair_send}a 106 jexec alcatraz ifconfig ${epair_send}b 107 lladdr=$(jexec alcatraz ifconfig ${epair_send}b | awk '/ scopeid / { print($2); }' | cut -f 1 -d %) 108 109 jexec alcatraz pfctl -e 110 pft_set_rules alcatraz \ 111 "scrub fragment reassemble" \ 112 "block in" \ 113 "pass in inet6 proto icmp6 icmp6-type { neighbrsol, neighbradv }" \ 114 "pass in inet6 proto icmp6 icmp6-type { echoreq, echorep }" \ 115 "set skip on lo" 116 117 # Host test 118 atf_check -s exit:0 -o ignore \ 119 ping -6 -c 1 2001:db8:42::2 120 121 atf_check -s exit:0 -o ignore \ 122 ping -6 -c 1 -s 4500 2001:db8:42::2 123 124 atf_check -s exit:0 -o ignore\ 125 ping -6 -c 1 -b 70000 -s 65000 2001:db8:42::2 126 127 # Force an NDP lookup 128 ping -6 -c 1 ${lladdr}%${epair_send}a 129 130 atf_check -s exit:0 -o ignore\ 131 ping -6 -c 1 -b 70000 -s 65000 ${lladdr}%${epair_send}a 132 133 # Forwarding test 134 atf_check -s exit:0 -o ignore \ 135 ping -6 -c 1 2001:db8:43::3 136 137 atf_check -s exit:0 -o ignore \ 138 ping -6 -c 1 -s 4500 2001:db8:43::3 139 140 atf_check -s exit:0 -o ignore\ 141 ping -6 -c 1 -b 70000 -s 65000 2001:db8:43::3 142 143 $(atf_get_srcdir)/CVE-2019-5597.py \ 144 ${epair_send}a \ 145 2001:db8:42::1 \ 146 2001:db8:43::3 147} 148 149v6_cleanup() 150{ 151 pft_cleanup 152} 153 154atf_test_case "mtu_diff" "cleanup" 155mtu_diff_head() 156{ 157 atf_set descr 'Test reassembly across different MTUs, PR #255432' 158 atf_set require.user root 159} 160 161mtu_diff_body() 162{ 163 pft_init 164 165 epair_small=$(vnet_mkepair) 166 epair_large=$(vnet_mkepair) 167 168 vnet_mkjail first ${epair_small}b ${epair_large}a 169 vnet_mkjail second ${epair_large}b 170 171 ifconfig ${epair_small}a 192.0.2.1/25 up 172 jexec first ifconfig ${epair_small}b 192.0.2.2/25 up 173 174 jexec first sysctl net.inet.ip.forwarding=1 175 jexec first ifconfig ${epair_large}a 192.0.2.130/25 up 176 jexec first ifconfig ${epair_large}a mtu 9000 177 jexec second ifconfig ${epair_large}b 192.0.2.131/25 up 178 jexec second ifconfig ${epair_large}b mtu 9000 179 jexec second route add default 192.0.2.130 180 181 route add 192.0.2.128/25 192.0.2.2 182 183 jexec first pfctl -e 184 pft_set_rules first \ 185 "scrub all fragment reassemble" 186 187 # Sanity checks 188 atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2 189 atf_check -s exit:0 -o ignore ping -c 1 192.0.2.130 190 atf_check -s exit:0 -o ignore ping -c 1 192.0.2.131 191 192 # Large packet that'll get reassembled and sent out in one on the large 193 # epair 194 atf_check -s exit:0 -o ignore ping -c 1 -s 8000 192.0.2.131 195} 196 197mtu_diff_cleanup() 198{ 199 pft_cleanup 200} 201 202frag_common() 203{ 204 name=$1 205 206 pft_init 207 208 epair=$(vnet_mkepair) 209 vnet_mkjail alcatraz ${epair}a 210 211 ifconfig ${epair}b inet 192.0.2.1/24 up 212 jexec alcatraz ifconfig ${epair}a 192.0.2.2/24 up 213 214 jexec alcatraz pfctl -e 215 pft_set_rules alcatraz \ 216 "scrub all fragment reassemble" 217 218 # Sanity check 219 atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2 220 221 atf_check -s exit:0 -o ignore $(atf_get_srcdir)/frag-${1}.py \ 222 --to 192.0.2.2 \ 223 --fromaddr 192.0.2.1 \ 224 --sendif ${epair}b \ 225 --recvif ${epair}b 226} 227 228atf_test_case "overreplace" "cleanup" 229overreplace_head() 230{ 231 atf_set descr 'ping fragment that overlaps fragment at index boundary and replace it' 232 atf_set require.user root 233 atf_set require.progs scapy 234} 235 236overreplace_body() 237{ 238 frag_common overreplace 239} 240 241overreplace_cleanup() 242{ 243 pft_cleanup 244} 245 246atf_test_case "overindex" "cleanup" 247overindex_head() 248{ 249 atf_set descr 'ping fragment that overlaps the first fragment at index boundary' 250 atf_set require.user root 251 atf_set require.progs scapy 252} 253 254overindex_body() 255{ 256 frag_common overindex 257} 258 259overindex_cleanup() 260{ 261 pft_cleanup 262} 263 264atf_test_case "overlimit" "cleanup" 265overlimit_head() 266{ 267 atf_set descr 'ping fragment at index boundary that cannot be requeued' 268 atf_set require.user root 269 atf_set require.progs scapy 270} 271 272overlimit_body() 273{ 274 frag_common overlimit 275} 276 277overlimit_cleanup() 278{ 279 pft_cleanup 280} 281 282atf_test_case "reassemble" "cleanup" 283reassemble_head() 284{ 285 atf_set descr 'Test reassembly' 286 atf_set require.user root 287} 288 289reassemble_body() 290{ 291 pft_init 292 293 epair=$(vnet_mkepair) 294 vnet_mkjail alcatraz ${epair}a 295 296 ifconfig ${epair}b inet 192.0.2.1/24 up 297 jexec alcatraz ifconfig ${epair}a 192.0.2.2/24 up 298 299 # Sanity check 300 atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2 301 302 jexec alcatraz pfctl -e 303 pft_set_rules alcatraz \ 304 "scrub in" \ 305 "pass out" \ 306 "block in" \ 307 "pass in inet proto icmp all icmp-type echoreq" 308 309 # Both single packet & fragmented pass when we scrub 310 atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2 311 atf_check -s exit:0 -o ignore ping -c 1 -s 2000 192.0.2.2 312 313 pft_set_rules alcatraz \ 314 "scrub in fragment no reassemble" \ 315 "pass out" \ 316 "block in" \ 317 "pass in inet proto icmp all icmp-type echoreq" 318 319 # And the fragmented ping doesn't pass if we do not reassemble 320 atf_check -s exit:0 -o ignore ping -c 1 192.0.2.2 321 atf_check -s exit:2 -o ignore ping -c 1 -s 2000 192.0.2.2 322} 323 324reassemble_cleanup() 325{ 326 pft_cleanup 327} 328 329atf_test_case "no_df" "cleanup" 330no_df_head() 331{ 332 atf_set descr 'Test removing of DF flag' 333 atf_set require.user root 334} 335 336no_df_body() 337{ 338 setup_router_server_ipv4 339 340 ifconfig ${epair_tester}a mtu 9000 341 jexec router ifconfig ${epair_tester}b mtu 9000 342 jexec router ifconfig ${epair_server}a mtu 1500 343 jexec server ifconfig ${epair_server}b mtu 1500 344 345 # Sanity check. 346 ping_server_check_reply exit:0 --ping-type=icmp 347 348 pft_set_rules router \ 349 "scrub fragment reassemble" \ 350 "pass out" \ 351 "block in" \ 352 "pass in inet proto icmp all icmp-type echoreq" 353 354 # Ping with normal, fragmentable packets. 355 ping_server_check_reply exit:0 --ping-type=icmp --send-length=2000 356 357 # Ping with non-fragmentable packets, this will fail. 358 ping_server_check_reply exit:1 --ping-type=icmp --send-length=2000 --send-flags DF 359 360 pft_set_rules router \ 361 "scrub any reassemble" \ 362 "pass out" \ 363 "block in" \ 364 "pass in inet proto icmp all icmp-type echoreq" 365 366 # Ping with non-fragmentable packets again. 367 # This time pf will strip the DF flag. 368 ping_server_check_reply exit:0 --ping-type=icmp --send-length=2000 --send-flags DF 369} 370 371no_df_cleanup() 372{ 373 pft_cleanup 374} 375 376atf_init_test_cases() 377{ 378 atf_add_test_case "too_many_fragments" 379 atf_add_test_case "v6" 380 atf_add_test_case "mtu_diff" 381 atf_add_test_case "overreplace" 382 atf_add_test_case "overindex" 383 atf_add_test_case "overlimit" 384 atf_add_test_case "reassemble" 385} 386