From 7fc0d37d0d16cd02ee43b2cd5d7bcefde15941c5 Mon Sep 17 00:00:00 2001 From: Frantisek Hrdina Date: Wed, 23 Feb 2022 14:46:57 +0100 Subject: [PATCH] Adding ncat-protocol-sanity test --- Sanity/ncat-protocol-sanity-test/clt.exp | 13 ++ Sanity/ncat-protocol-sanity-test/main.fmf | 37 +++++ Sanity/ncat-protocol-sanity-test/runtest.sh | 174 ++++++++++++++++++++ Sanity/ncat-protocol-sanity-test/srv.exp | 22 +++ Sanity/ncat-protocol-sanity-test/tcpclt.exp | 13 ++ Sanity/ncat-protocol-sanity-test/tcpsrv.exp | 22 +++ Sanity/ncat-protocol-sanity-test/udpclt.exp | 14 ++ Sanity/ncat-protocol-sanity-test/udpsrv.exp | 13 ++ 8 files changed, 308 insertions(+) create mode 100755 Sanity/ncat-protocol-sanity-test/clt.exp create mode 100644 Sanity/ncat-protocol-sanity-test/main.fmf create mode 100755 Sanity/ncat-protocol-sanity-test/runtest.sh create mode 100755 Sanity/ncat-protocol-sanity-test/srv.exp create mode 100755 Sanity/ncat-protocol-sanity-test/tcpclt.exp create mode 100755 Sanity/ncat-protocol-sanity-test/tcpsrv.exp create mode 100755 Sanity/ncat-protocol-sanity-test/udpclt.exp create mode 100755 Sanity/ncat-protocol-sanity-test/udpsrv.exp diff --git a/Sanity/ncat-protocol-sanity-test/clt.exp b/Sanity/ncat-protocol-sanity-test/clt.exp new file mode 100755 index 0000000..d85714c --- /dev/null +++ b/Sanity/ncat-protocol-sanity-test/clt.exp @@ -0,0 +1,13 @@ +#!/usr/bin/expect + +set timeout 10 + +spawn ncat -4 --sctp localhost 6666 + +expect { + eof { exit 2 } + default { exit 1 } + "ServerSend\r" { sleep 1; send -- "ClientSend\r" } +} +sleep 1 +exit 0 diff --git a/Sanity/ncat-protocol-sanity-test/main.fmf b/Sanity/ncat-protocol-sanity-test/main.fmf new file mode 100644 index 0000000..bf0ed26 --- /dev/null +++ b/Sanity/ncat-protocol-sanity-test/main.fmf @@ -0,0 +1,37 @@ +summary: Test all supported protocols of ncat, like tcp, udp, ... +description: | + sanity test for nmap listening on TCP, SCTP, UDP +contact: fhrdina@redhat.com +component: +- nmap +test: ./runtest.sh +framework: beakerlib +recommend: +- nmap +- tcpdump +- expect +- kernel-modules-extra +- kernel-modules +- kmod +duration: 5m +enabled: true +tag: +- NoRHEL4 +- NoRHEL5 +- TIPpass +- TIPpass_Security +- Tier1 +- TipWaived7 +- rhel7broken +tier: '1' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1014681 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=905484 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1114137 +adjust: +- enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0172194 +extra-summary: /CoreOS/nmap/Sanity/ncat-protocol-sanity-test +extra-task: /CoreOS/nmap/Sanity/ncat-protocol-sanity-test diff --git a/Sanity/ncat-protocol-sanity-test/runtest.sh b/Sanity/ncat-protocol-sanity-test/runtest.sh new file mode 100755 index 0000000..ce5f124 --- /dev/null +++ b/Sanity/ncat-protocol-sanity-test/runtest.sh @@ -0,0 +1,174 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/nmap/Sanity/ncat-protocol-sanity-test +# Description: Test all supported protocols of ncat, like tcp, udp, ... +# Author: Patrik Kis +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="nmap" + +rlJournalStart + + ########## SETUP PHASE ########## + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlIsRHEL 4 5 && rlRun "chcon -t tmpfs_t $TmpDir" 0 \ + "Changing SELinux context to allow nmap to write to $TmpDir" + rlRun "cp *exp $TmpDir" 0 "Copying expect scripts to working directory" + rlRun "pushd $TmpDir" + rlPhaseEnd + + rlPhaseStartTest "Checking prereqs (SCTP)" + # kernel-modules shoud be same version as running version of kernel + # because modprobe is looking for kernel-modules according to running kernel version + # different versions were causing Fedora CI failure on Fedora-Rawhide image + if rlIsRHEL '>=8' || rlIsFedora; then + rlRun "dnf install kernel-modules-$(uname -r) -y" + fi + rlRun "depmod" 0 "Updating modules dependencies" + rlRun "cat /sys/module/ipv6/parameters/disable | grep 0" 0 "Checking if ipv6 is enabled" + rlPhaseEnd + + + ##################### TEST PHASE - TCP #################### + rlPhaseStartTest "ncat acts as tcp server (Listen mode)" + rlRun "tcpdump -pnnli lo port 6666 > tcpdump-tcp.out &" 0 "Run tcpdump" + + TCPDUMPPID=$!; echo TCPDUMPPID=$TCPDUMPPID; sleep 3 + rlRun "./tcpsrv.exp > ncat-SERVER-tcp.out &" + + NCATPID=$!; echo NCATPID=$NCATPID; sleep 3 + rlRun "rlWaitForSocket -p $NCATPID 6666 -d 0.5" + rlRun "./tcpclt.exp > ncat-CLIENT-tcp.out"; sleep 3 + + rlRun "kill -9 $NCATPID" 0,1 "Making sure the ncat is dead" + rlRun "kill -9 $TCPDUMPPID" 0,1 "Making sure the tcpdump is dead" + + cat tcpdump-tcp.out + rlAssertGrep "127.0.0.1.6666.*\[S" tcpdump-tcp.out + rlAssertGrep "127.0.0.1.6666.*\[P" tcpdump-tcp.out + rlAssertGrep "127.0.0.1.6666.*\[F" tcpdump-tcp.out + rlAssertEquals "Vefify that there were two PUSH packet sent" \ + 2 `grep "127.0.0.1.6666.*\[P" tcpdump-tcp.out |wc -l` + + cat ncat-SERVER-tcp.out; rlAssertGrep "ClientSend" ncat-SERVER-tcp.out + cat ncat-CLIENT-tcp.out; rlAssertGrep "ServerSend" ncat-CLIENT-tcp.out + rlPhaseEnd + + + ##################### TEST PHASE - UDP #################### + rlPhaseStartTest "ncat acts as UDP server (Listen mode)" + rlRun "tcpdump -pnnli lo port 6666 > tcpdump-udp.out &" 0 "Run tcpdump" + + TCPDUMPPID=$!; echo TCPDUMPPID=$TCPDUMPPID; sleep 3 + rlRun "./udpsrv.exp >ncat-SERVER-udp.out &" + + NCATPID=$!; echo NCATPID=$NCATPID; sleep 3 + rlRun "./udpclt.exp >ncat-CLIENT-udp.out &" + + NCATCLNTPID=$!; echo NCATPID=$NCATCLNTPID; sleep 3 + rlRun "kill -9 $NCATPID $NCATCLNTPID" 0,1 "Making sure the ncat is dead" + rlRun "kill -9 $TCPDUMPPID" 0,1 "Making sure the tcpdump is dead" + + cat tcpdump-udp.out + rlAssertGrep "127.0.0.1.*>.*127.0.0.1.6666.*UDP" tcpdump-udp.out + rlAssertGrep "127.0.0.1.6666.*>.*127.0.0.1..*UDP" tcpdump-udp.out + rlAssertEquals "Vefify that there were two UDP packet sent" \ + 2 `wc -l tcpdump-udp.out` + + cat ncat-SERVER-udp.out; rlAssertGrep "ClientSend" ncat-SERVER-udp.out + cat ncat-CLIENT-udp.out; rlAssertGrep "ServerSend" ncat-CLIENT-udp.out + rlPhaseEnd + + + ##################### TEST PHASE - SCTP #################### + rlPhaseStartTest "ncat acts as SCTP server (Listen mode)" { + rlIsRHEL ">=8" || rlIsFedora && { + rlAssertRpm "kmod" + rlAssertRpm "kernel-modules-extra" + rlRun "modinfo sctp" + + #load 'sctp' module if not already loaded + lsmod | grep ^sctp || { + rlRun "modprobe sctp " + rlRun "lsmod|grep ^sctp" + } + lsmod | grep ^sctp_diag || { + rlRun "modprobe sctp_diag" + rlRun "lsmod|grep ^sctp_diag" + } + } + + # SCTP doesn't support half-open connections so it has to be tested with expect + # otherwise the parties initiated connection closes immediately after all input read + rlRun "tcpdump -pnnli lo port 6666 > tcpdump-sctp.out &" 0 "Run tcpdump" + + TCPDUMPPID=$!; echo TCPDUMPPID=$TCPDUMPPID; sleep 3 + rlRun "./srv.exp > ncat-SERVER-sctp.out &" + NCATPID=$!; echo NCATPID=$NCATPID + # TODO: fix beakerlib + # rlWaitForSocket() doesn't support sctp, the internally executed ss command: + # ss -nl -tu | tail -n+2 | awk '{print $5}' | grep -E \:6666$ >/dev/null + # doesn't include '-S' option so it doesn't print the listening sctp port 6666 + # man ss (this option is missing on RHEL6): + # -S, --sctp + # Display SCTP sockets. + # # ss -nl -S | grep 6666 + # LISTEN 0 10 0.0.0.0:6666 0.0.0.0:* + # LISTEN 0 10 [::]:6666 [::]:* + # # + # SCTP is not supported by netstat and ss in RHEL-6 + #rlIsRHEL '<7.0' && sleep 2 || rlRun "rlWaitForSocket -p $NCATPID 6666 -d 0.5" + sleep 2 + if rlIsRHEL '>6' || rlIsFedora; then + rlRun "ss -nl -S | grep 6666 >/dev/null" + fi + + rlRun "./clt.exp > ncat-CLIENT-sctp.out"; sleep 3 + rlRun "kill -9 $NCATPID" 0,1 "Making sure the ncat is dead" + rlRun "kill -9 $TCPDUMPPID" 0,1 "Making sure the tcpdump is dead" + + cat tcpdump-sctp.out + rlAssertGrep "127.0.0.1.6666.*sctp.*\[INIT" tcpdump-sctp.out + rlAssertGrep "127.0.0.1.6666.*sctp.*\[COOKIE" tcpdump-sctp.out + rlAssertGrep "127.0.0.1.6666.*sctp.*\[SHUTDOWN" tcpdump-sctp.out + rlAssertEquals "Vefify that there were two DATA sctp packet sent" \ + 2 `grep "127.0.0.1.6666.*sctp.*\[DATA\]" tcpdump-sctp.out |wc -l` + + cat ncat-SERVER-sctp.out; rlAssertGrep "ClientSend" ncat-SERVER-sctp.out + cat ncat-CLIENT-sctp.out; rlAssertGrep "ServerSend" ncat-CLIENT-sctp.out + rlPhaseEnd + + + ########## CLEANUP PHASE ########## + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Sanity/ncat-protocol-sanity-test/srv.exp b/Sanity/ncat-protocol-sanity-test/srv.exp new file mode 100755 index 0000000..086ed36 --- /dev/null +++ b/Sanity/ncat-protocol-sanity-test/srv.exp @@ -0,0 +1,22 @@ +#!/usr/bin/expect + +set timeout 10 + +spawn ncat -vl --sctp 6666 + +expect { + eof { exit 2 } + default { exit 1 } + "Ncat: Connection from 127.0.0.1" { sleep 1; send -- "ServerSend\r" } +} +expect { + eof { exit 2 } + default { exit 1 } + "ClientSend\r" +} +expect { + eof { exit 0 } + default { exit 1 } +} +exit 3 + diff --git a/Sanity/ncat-protocol-sanity-test/tcpclt.exp b/Sanity/ncat-protocol-sanity-test/tcpclt.exp new file mode 100755 index 0000000..3396eac --- /dev/null +++ b/Sanity/ncat-protocol-sanity-test/tcpclt.exp @@ -0,0 +1,13 @@ +#!/usr/bin/expect + +set timeout 10 + +spawn ncat -4 localhost 6666 + +expect { + eof { exit 2 } + default { exit 1 } + "ServerSend\r" { sleep 1; send -- "ClientSend\r" } +} +sleep 1 +exit 0 diff --git a/Sanity/ncat-protocol-sanity-test/tcpsrv.exp b/Sanity/ncat-protocol-sanity-test/tcpsrv.exp new file mode 100755 index 0000000..ac1c803 --- /dev/null +++ b/Sanity/ncat-protocol-sanity-test/tcpsrv.exp @@ -0,0 +1,22 @@ +#!/usr/bin/expect + +set timeout 10 + +spawn ncat -vl 6666 + +expect { + eof { exit 2 } + default { exit 1 } + "Ncat: Connection from 127.0.0.1" { sleep 1; send -- "ServerSend\r" } +} +expect { + eof { exit 2 } + default { exit 1 } + "ClientSend\r" +} +expect { + eof { exit 0 } + default { exit 1 } +} +exit 3 + diff --git a/Sanity/ncat-protocol-sanity-test/udpclt.exp b/Sanity/ncat-protocol-sanity-test/udpclt.exp new file mode 100755 index 0000000..dbbb0ef --- /dev/null +++ b/Sanity/ncat-protocol-sanity-test/udpclt.exp @@ -0,0 +1,14 @@ +#!/usr/bin/expect + +set timeout 10 + +spawn ncat -4 --udp localhost 6666 + +send -- "ClientSend\r" +expect { + eof { exit 2 } + default { exit 1 } + "ServerSend\r" +} +sleep 1 +exit 0 diff --git a/Sanity/ncat-protocol-sanity-test/udpsrv.exp b/Sanity/ncat-protocol-sanity-test/udpsrv.exp new file mode 100755 index 0000000..3aa72fe --- /dev/null +++ b/Sanity/ncat-protocol-sanity-test/udpsrv.exp @@ -0,0 +1,13 @@ +#!/usr/bin/expect + +set timeout 10 + +spawn ncat -vl --udp 6666 + +expect { + eof { exit 2 } + default { exit 1 } + "ClientSend\r" { send -- "ServerSend\r" } +} +sleep 1 +exit 0