linux-kernel - Re: [PATCH 03/12] selftests/net: Add TCP-AO ICMPs accept test

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZYALKQGYuRrpOo_A@Laptop-X1>
Date: Mon, 18 Dec 2023 17:04:41 +0800
From: Hangbin Liu <liuhangbin@...il.com>
To: Dmitry Safonov <dima@...sta.com>
Cc: Shuah Khan <shuah@...nel.org>, David Ahern <dsahern@...nel.org>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Salam Noureddine <noureddine@...sta.com>,
	Bob Gilligan <gilligan@...sta.com>, linux-kernel@...r.kernel.org,
	linux-kselftest@...r.kernel.org, netdev@...r.kernel.org,
	Dmitry Safonov <0x7f454c46@...il.com>
Subject: Re: [PATCH 03/12] selftests/net: Add TCP-AO ICMPs accept test

On Fri, Dec 15, 2023 at 02:36:17AM +0000, Dmitry Safonov wrote:
> Reverse to icmps-discard test: the server accepts ICMPs, using
> TCP_AO_CMDF_ACCEPT_ICMP and it is expected to fail under ICMP
> flood from client. Test that the default pre-TCP-AO behaviour functions
> when TCP_AO_CMDF_ACCEPT_ICMP is set.
> 
> Expected output for ipv4 version (in case it receives ICMP_PROT_UNREACH):
> > # ./icmps-accept_ipv4
> > 1..3
> > # 3209[lib/setup.c:166] rand seed 1642623870
> > TAP version 13
> > # 3209[lib/proc.c:207]    Snmp6             Ip6InReceives: 0 => 1
> > # 3209[lib/proc.c:207]    Snmp6             Ip6InNoRoutes: 0 => 1
> > # 3209[lib/proc.c:207]    Snmp6               Ip6InOctets: 0 => 76
> > # 3209[lib/proc.c:207]    Snmp6            Ip6InNoECTPkts: 0 => 1
> > # 3209[lib/proc.c:207]      Tcp                    InSegs: 3 => 23
> > # 3209[lib/proc.c:207]      Tcp                   OutSegs: 2 => 22
> > # 3209[lib/proc.c:207]  IcmpMsg                   InType3: 0 => 4
> > # 3209[lib/proc.c:207]     Icmp                    InMsgs: 0 => 4
> > # 3209[lib/proc.c:207]     Icmp            InDestUnreachs: 0 => 4
> > # 3209[lib/proc.c:207]       Ip                InReceives: 3 => 27
> > # 3209[lib/proc.c:207]       Ip                InDelivers: 3 => 27
> > # 3209[lib/proc.c:207]       Ip               OutRequests: 2 => 22
> > # 3209[lib/proc.c:207]    IpExt                  InOctets: 288 => 3420
> > # 3209[lib/proc.c:207]    IpExt                 OutOctets: 124 => 3244
> > # 3209[lib/proc.c:207]    IpExt               InNoECTPkts: 3 => 25
> > # 3209[lib/proc.c:207]   TcpExt               TCPPureAcks: 1 => 2
> > # 3209[lib/proc.c:207]   TcpExt           TCPOrigDataSent: 0 => 20
> > # 3209[lib/proc.c:207]   TcpExt              TCPDelivered: 0 => 19
> > # 3209[lib/proc.c:207]   TcpExt                 TCPAOGood: 3 => 23
> > ok 1 InDestUnreachs delivered 4
> > ok 2 server failed with -92: Protocol not available
> > ok 3 TCPAODroppedIcmps counter didn't change: 0 >= 0
> > # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0
> 
> Expected output for ipv6 version (in case it receives ADM_PROHIBITED):
> > # ./icmps-accept_ipv6
> > 1..3
> > # 3277[lib/setup.c:166] rand seed 1642624035
> > TAP version 13
> > # 3277[lib/proc.c:207]    Snmp6             Ip6InReceives: 6 => 31
> > # 3277[lib/proc.c:207]    Snmp6             Ip6InDelivers: 4 => 29
> > # 3277[lib/proc.c:207]    Snmp6            Ip6OutRequests: 4 => 24
> > # 3277[lib/proc.c:207]    Snmp6               Ip6InOctets: 592 => 4492
> > # 3277[lib/proc.c:207]    Snmp6              Ip6OutOctets: 332 => 3852
> > # 3277[lib/proc.c:207]    Snmp6            Ip6InNoECTPkts: 6 => 31
> > # 3277[lib/proc.c:207]    Snmp6               Icmp6InMsgs: 1 => 6
> > # 3277[lib/proc.c:207]    Snmp6       Icmp6InDestUnreachs: 0 => 5
> > # 3277[lib/proc.c:207]    Snmp6              Icmp6InType1: 0 => 5
> > # 3277[lib/proc.c:207]      Tcp                    InSegs: 3 => 23
> > # 3277[lib/proc.c:207]      Tcp                   OutSegs: 2 => 22
> > # 3277[lib/proc.c:207]   TcpExt               TCPPureAcks: 1 => 2
> > # 3277[lib/proc.c:207]   TcpExt           TCPOrigDataSent: 0 => 20
> > # 3277[lib/proc.c:207]   TcpExt              TCPDelivered: 0 => 19
> > # 3277[lib/proc.c:207]   TcpExt                 TCPAOGood: 3 => 23
> > ok 1 Icmp6InDestUnreachs delivered 5
> > ok 2 server failed with -13: Permission denied
> > ok 3 TCPAODroppedIcmps counter didn't change: 0 >= 0
> > # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0
> 
> With some luck the server may fail with ECONNREFUSED (depending on what
> icmp packet was delivered firstly).
> For the kernel error handlers see: tab_unreach[] and icmp_err_convert[].
> 
> Signed-off-by: Dmitry Safonov <dima@...sta.com>

Tested-by: Hangbin Liu <liuhangbin@...il.com>