| <!-- |
| Documentation/_templates/layout.html |
| |
| Licensed to the Apache Software Foundation (ASF) under one or more |
| contributor license agreements. See the NOTICE file distributed with |
| this work for additional information regarding copyright ownership. The |
| ASF licenses this file to you under the Apache License, Version 2.0 (the |
| "License"); you may not use this file except in compliance with the |
| License. You may obtain a copy of the License at |
| |
| http://www.apache.org/licenses/LICENSE-2.0 |
| |
| Unless required by applicable law or agreed to in writing, software |
| distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the |
| License for the specific language governing permissions and limitations |
| under the License. |
| --> |
| |
| |
| |
| <!DOCTYPE html> |
| <html class="writer-html5" lang="en"> |
| <head> |
| <meta charset="utf-8" /><meta name="generator" content="Docutils 0.19: https://docutils.sourceforge.io/" /> |
| |
| <meta name="viewport" content="width=device-width, initial-scale=1.0" /> |
| <title>Testing TCP/IP Network Stacks — NuttX latest documentation</title> |
| <link rel="stylesheet" type="text/css" href="../_static/pygments.css" /> |
| <link rel="stylesheet" type="text/css" href="../_static/css/theme.css" /> |
| <link rel="stylesheet" type="text/css" href="../_static/copybutton.css" /> |
| <link rel="stylesheet" type="text/css" href="../_static/design-style.1e8bd061cd6da7fc9cf755528e8ffc24.min.css" /> |
| <link rel="stylesheet" type="text/css" href="../_static/custom.css" /> |
| |
| |
| <link rel="shortcut icon" href="../_static/favicon.ico"/> |
| <script src="../_static/jquery.js"></script> |
| <script src="../_static/_sphinx_javascript_frameworks_compat.js"></script> |
| <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script> |
| <script src="../_static/doctools.js"></script> |
| <script src="../_static/sphinx_highlight.js"></script> |
| <script src="../_static/clipboard.min.js"></script> |
| <script src="../_static/copybutton.js"></script> |
| <script src="../_static/design-tabs.js"></script> |
| <script src="../_static/js/theme.js"></script> |
| <link rel="index" title="Index" href="../genindex.html" /> |
| <link rel="search" title="Search" href="../search.html" /> |
| <link rel="next" title="Auto-Mounter" href="automounter.html" /> |
| <link rel="prev" title="Open Flash Loader" href="ofloader.html" /> |
| </head> |
| |
| <body class="wy-body-for-nav"> |
| <div class="wy-grid-for-nav"> |
| <nav data-toggle="wy-nav-shift" class="wy-nav-side"> |
| <div class="wy-side-scroll"> |
| <div class="wy-side-nav-search" > |
| |
| <a href="../index.html" class="icon icon-home"> NuttX |
| |
| |
| |
| </a> |
| |
| <!-- this version selector is quite ugly, should be probably replaced by something |
| more modern --> |
| |
| <div class="version-selector"> |
| <select onchange="javascript:location.href = this.value;"> |
| |
| <option value="../../latest" selected="selected">latest</option> |
| |
| <option value="../../10.0.0" >10.0.0</option> |
| |
| <option value="../../10.0.1" >10.0.1</option> |
| |
| <option value="../../10.1.0" >10.1.0</option> |
| |
| <option value="../../10.2.0" >10.2.0</option> |
| |
| <option value="../../10.3.0" >10.3.0</option> |
| |
| <option value="../../11.0.0" >11.0.0</option> |
| |
| <option value="../../12.0.0" >12.0.0</option> |
| |
| <option value="../../12.1.0" >12.1.0</option> |
| |
| <option value="../../12.2.0" >12.2.0</option> |
| |
| <option value="../../12.2.1" >12.2.1</option> |
| |
| <option value="../../12.3.0" >12.3.0</option> |
| |
| <option value="../../12.4.0" >12.4.0</option> |
| |
| <option value="../../12.5.0" >12.5.0</option> |
| |
| <option value="../../12.5.1" >12.5.1</option> |
| |
| <option value="../../12.6.0" >12.6.0</option> |
| |
| <option value="../../12.7.0" >12.7.0</option> |
| |
| <option value="../../12.8.0" >12.8.0</option> |
| |
| <option value="../../12.9.0" >12.9.0</option> |
| |
| <option value="../../12.10.0" >12.10.0</option> |
| |
| <option value="../../12.11.0" >12.11.0</option> |
| |
| </select> |
| </div> |
| |
| |
| <div role="search"> |
| <form id="rtd-search-form" class="wy-form" action="../search.html" method="get"> |
| <input type="text" name="q" placeholder="Search docs" aria-label="Search docs" /> |
| <input type="hidden" name="check_keywords" value="yes" /> |
| <input type="hidden" name="area" value="default" /> |
| </form> |
| </div> |
| |
| </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu"> |
| <p class="caption" role="heading"><span class="caption-text">Table of Contents</span></p> |
| <ul class="current"> |
| <li class="toctree-l1"><a class="reference internal" href="../index.html">Home</a></li> |
| <li class="toctree-l1"><a class="reference internal" href="../introduction/index.html">Introduction</a></li> |
| <li class="toctree-l1"><a class="reference internal" href="../quickstart/index.html">Getting Started</a></li> |
| <li class="toctree-l1"><a class="reference internal" href="../contributing/index.html">Contributing</a></li> |
| <li class="toctree-l1"><a class="reference internal" href="../introduction/inviolables.html">The Inviolable Principles of NuttX</a></li> |
| <li class="toctree-l1"><a class="reference internal" href="../platforms/index.html">Supported Platforms</a></li> |
| <li class="toctree-l1"><a class="reference internal" href="../components/index.html">OS Components</a></li> |
| <li class="toctree-l1"><a class="reference internal" href="../applications/index.html">Applications</a></li> |
| <li class="toctree-l1"><a class="reference internal" href="../implementation/index.html">Implementation Details</a></li> |
| <li class="toctree-l1"><a class="reference internal" href="../reference/index.html">API Reference</a></li> |
| <li class="toctree-l1"><a class="reference internal" href="../faq/index.html">FAQ</a></li> |
| <li class="toctree-l1"><a class="reference internal" href="../debugging/index.html">Debugging</a></li> |
| <li class="toctree-l1 current"><a class="reference internal" href="index.html">Guides</a><ul class="current"> |
| <li class="toctree-l2"><a class="reference internal" href="nfs.html">NFS Client How-To</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="usbtrace.html">USB Device Trace</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="simulator.html">Simulator</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="rndis.html">How to use RNDIS</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="drivers.html">Drivers</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="cpp_cmake.html">C++ Example using CMake</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="pysimcoder.html">pysimCoder integration with NuttX</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="customboards.html">Custom Boards How-To</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="customapps.html">Custom Apps How-to</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="citests.html">Running CI Test Locally</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="zerolatencyinterrupts.html">High Performance: Zero Latency Interrupts, Maskable Nested Interrupts</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="fortify.html">Fortify</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="nestedinterrupts.html">Nested Interrupts</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="ofloader.html">Open Flash Loader</a></li> |
| <li class="toctree-l2 current"><a class="current reference internal" href="#">Testing TCP/IP Network Stacks</a><ul> |
| <li class="toctree-l3"><a class="reference internal" href="#syn-flood-attack">SYN Flood Attack</a></li> |
| <li class="toctree-l3"><a class="reference internal" href="#building-packets-with-scapy">Building Packets with Scapy</a></li> |
| <li class="toctree-l3"><a class="reference internal" href="#simulating-packet-loss">Simulating Packet Loss</a></li> |
| <li class="toctree-l3"><a class="reference internal" href="#fuzz-testing">Fuzz-Testing</a></li> |
| </ul> |
| </li> |
| <li class="toctree-l2"><a class="reference internal" href="automounter.html">Auto-Mounter</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="stm32nullpointer.html">STM32 Null Pointer Detection</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="stm32ccm.html">STM32 CCM Allocator</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="etcromfs.html">etc romfs</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="thread_local_storage.html">Thread Local Storage</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="devicetree.html">Device Tree</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="changing_systemclockconfig.html">Changing the System Clock Configuration</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="usingkernelthreads.html">Using Kernel Threads</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="armv7m_runtimestackcheck.html">ARMv7-M Run Time Stack Checking</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="include_files_board_h.html">Including Files in board.h</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="specialstuff_in_nuttxheaderfiles.html">Why can’t I put my special stuff in NuttX header files?</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="kernel_threads_with_custom_stacks.html">Kernel Threads with Custom Stacks</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="versioning_and_task_names.html">Versioning and Task Names</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="logging_rambuffer.html">Logging to a RAM Buffer</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="ipv6.html">IPv6</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="integrate_newlib.html">Integrating with Newlib</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="protected_build.html">NuttX Protected Build</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="platform_directories.html">Platform Directories</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="port_drivers_to_stm32f7.html">Porting Drivers to the STM32 F7</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="semihosting.html">Semihosting</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="renode.html">Run NuttX on Renode</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="signal_events_interrupt_handlers.html">Signaling Events from Interrupt Handlers</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="signaling_sem_priority_inheritance.html">Signaling Semaphores and Priority Inheritance</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="smaller_vector_tables.html">Smaller Vector Tables</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="port.html">How to port</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="updating_release_system_elf.html">Updating a Release System with ELF Programs</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="partially_linked_elf.html">ELF Programs – With Symbol Tables</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="fully_linked_elf.html">ELF Programs – No Symbol Tables</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="building_nuttx_with_app_out_of_src_tree.html">Building NuttX with Applications Outside the Source Tree</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="building_uclibcpp.html">Building uClibc++</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="custom_app_directories.html">Custom Application Directories</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="multiple_nsh_sessions.html">Multiple NSH Sessions</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="nsh_network_link_management.html">NSH Network Link Management</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="ram_rom_disks.html">RAM Disks and ROM Disks</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="reading_can_msgs.html">Reading CAN Messages</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="remove_device_drivers_nsh.html">Removing Device Drivers with NSH</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="rust.html">Rust in NuttX</a></li> |
| <li class="toctree-l2"><a class="reference internal" href="optee.html">Interfacing with OP-TEE</a></li> |
| </ul> |
| </li> |
| <li class="toctree-l1"><a class="reference internal" href="../glossary.html">Glossary</a></li> |
| <li class="toctree-l1"><a class="reference internal" href="../logos/index.html">NuttX Logos</a></li> |
| <li class="toctree-l1"><a class="reference internal" href="../_tags/tagsindex.html">Tags</a></li> |
| </ul> |
| |
| </div> |
| </div> |
| </nav> |
| |
| <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" > |
| <i data-toggle="wy-nav-top" class="fa fa-bars"></i> |
| <a href="../index.html">NuttX</a> |
| </nav> |
| |
| <div class="wy-nav-content"> |
| <div class="rst-content"> |
| <div role="navigation" aria-label="Page navigation"> |
| <ul class="wy-breadcrumbs"> |
| <li><a href="../index.html" class="icon icon-home" aria-label="Home"></a></li> |
| <li class="breadcrumb-item"><a href="index.html">Guides</a></li> |
| <li class="breadcrumb-item active">Testing TCP/IP Network Stacks</li> |
| <li class="wy-breadcrumbs-aside"> |
| <a href="https://github.com/apache/nuttx/blob/master/Documentation/guides/testingtcpip.rst" class="fa fa-github"> Edit on GitHub</a> |
| </li> |
| </ul> |
| <hr/> |
| </div> |
| <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article"> |
| <div itemprop="articleBody"> |
| |
| <section id="testing-tcp-ip-network-stacks"> |
| <h1>Testing TCP/IP Network Stacks<a class="headerlink" href="#testing-tcp-ip-network-stacks" title="Permalink to this heading"></a></h1> |
| <p>When working on the network stack there is a need to test and verify the changes |
| made. While problems may be discovered by chance, it is hard to reproduce such |
| situations. The following sections show some methods to stress the target or |
| generate some specific traffic.</p> |
| <p>In the examples the target has the IP address 192.168.2.135</p> |
| <section id="syn-flood-attack"> |
| <h2>SYN Flood Attack<a class="headerlink" href="#syn-flood-attack" title="Permalink to this heading"></a></h2> |
| <p>Flood the target with SYN packets to exhaust its resources. |
| It’s a good way to test the network driver’s buffer management.</p> |
| <div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>sudo<span class="w"> </span>hping3<span class="w"> </span>--flood<span class="w"> </span>-S<span class="w"> </span>-p<span class="w"> </span><span class="m">80</span><span class="w"> </span><span class="m">192</span>.168.2.135 |
| </pre></div> |
| </div> |
| </section> |
| <section id="building-packets-with-scapy"> |
| <h2>Building Packets with Scapy<a class="headerlink" href="#building-packets-with-scapy" title="Permalink to this heading"></a></h2> |
| <p>A wonderful network testing tool is the Scapy lib. |
| It enables you to build pretty much any packet constellation you need for testing.</p> |
| <p>You have to add an iptables rule to prevent outgoing RST packets from the OS’s |
| networking stack which does nothing know about our test connection.</p> |
| <p>To disable outgoing RST packets:</p> |
| <div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>sudo<span class="w"> </span>iptables<span class="w"> </span>-A<span class="w"> </span>OUTPUT<span class="w"> </span>-p<span class="w"> </span>tcp<span class="w"> </span>--tcp-flags<span class="w"> </span>RST<span class="w"> </span>RST<span class="w"> </span>-d<span class="w"> </span><span class="m">192</span>.168.2.135<span class="w"> </span>-j<span class="w"> </span>DROP |
| </pre></div> |
| </div> |
| <p>For removing the rule:</p> |
| <div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>sudo<span class="w"> </span>iptables<span class="w"> </span>-D<span class="w"> </span>OUTPUT<span class="w"> </span>-p<span class="w"> </span>tcp<span class="w"> </span>--tcp-flags<span class="w"> </span>RST<span class="w"> </span>RST<span class="w"> </span>-d<span class="w"> </span><span class="m">192</span>.168.2.135<span class="w"> </span>-j<span class="w"> </span>DROP |
| </pre></div> |
| </div> |
| <p><strong>Testing Re-transmission behavior</strong></p> |
| <p>When sending a 3-way handshake only, the target should time out and reset the |
| connection.</p> |
| <p>The following Python Scapy script starts a HTTP request without further responding. |
| The stack should start re-transmit the packets and finally time out.</p> |
| <div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="ch">#!/usr/bin/env python</span> |
| |
| <span class="kn">import</span><span class="w"> </span><span class="nn">logging</span> |
| <span class="n">logging</span><span class="o">.</span><span class="n">getLogger</span><span class="p">(</span><span class="s2">"scapy.runtime"</span><span class="p">)</span><span class="o">.</span><span class="n">setLevel</span><span class="p">(</span><span class="n">logging</span><span class="o">.</span><span class="n">ERROR</span><span class="p">)</span> |
| <span class="kn">from</span><span class="w"> </span><span class="nn">scapy.all</span><span class="w"> </span><span class="kn">import</span> <span class="o">*</span> |
| |
| <span class="n">get</span> <span class="o">=</span> <span class="s1">'GET / HTTP/1.1</span><span class="se">\r\n\r\n</span><span class="s1">'</span> |
| |
| <span class="n">ip</span> <span class="o">=</span> <span class="n">IP</span><span class="p">(</span><span class="n">dst</span><span class="o">=</span><span class="s2">"192.168.2.135"</span><span class="p">)</span> |
| <span class="n">port</span> <span class="o">=</span> <span class="n">RandNum</span><span class="p">(</span><span class="mi">1024</span><span class="p">,</span> <span class="mi">65535</span><span class="p">)</span> |
| |
| <span class="c1"># Create SYN packet</span> |
| <span class="n">SYN</span> <span class="o">=</span> <span class="n">ip</span><span class="o">/</span><span class="n">TCP</span><span class="p">(</span><span class="n">sport</span><span class="o">=</span><span class="n">port</span><span class="p">,</span> <span class="n">dport</span><span class="o">=</span><span class="mi">80</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="s2">"S"</span><span class="p">,</span> <span class="n">seq</span><span class="o">=</span><span class="mi">42</span><span class="p">)</span> |
| |
| <span class="c1"># Send SYN and receive SYN,ACK</span> |
| <span class="n">SYNACK</span> <span class="o">=</span> <span class="n">sr1</span><span class="p">(</span><span class="n">SYN</span><span class="p">)</span> |
| |
| <span class="c1"># Create ACK with GET request</span> |
| <span class="n">ACK</span> <span class="o">=</span> <span class="n">ip</span><span class="o">/</span><span class="n">TCP</span><span class="p">(</span><span class="n">sport</span><span class="o">=</span><span class="n">SYNACK</span><span class="o">.</span><span class="n">dport</span><span class="p">,</span> <span class="n">dport</span><span class="o">=</span><span class="mi">80</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="s2">"A"</span><span class="p">,</span> <span class="n">seq</span><span class="o">=</span><span class="n">SYNACK</span><span class="o">.</span><span class="n">ack</span><span class="p">,</span> <span class="n">ack</span><span class="o">=</span><span class="n">SYNACK</span><span class="o">.</span><span class="n">seq</span> <span class="o">+</span> <span class="mi">1</span><span class="p">)</span> |
| |
| <span class="c1"># SEND our ACK</span> |
| <span class="n">send</span><span class="p">(</span><span class="n">ACK</span><span class="p">)</span> |
| |
| <span class="n">reply</span><span class="p">,</span> <span class="n">err</span> <span class="o">=</span> <span class="n">sr</span><span class="p">(</span><span class="n">ip</span><span class="o">/</span><span class="n">TCP</span><span class="p">(</span><span class="n">sport</span><span class="o">=</span><span class="n">SYNACK</span><span class="o">.</span><span class="n">dport</span><span class="p">,</span> <span class="n">dport</span><span class="o">=</span><span class="mi">80</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="s2">"A"</span><span class="p">,</span> <span class="n">seq</span><span class="o">=</span><span class="n">SYNACK</span><span class="o">.</span><span class="n">ack</span><span class="p">,</span> <span class="n">ack</span><span class="o">=</span><span class="n">SYNACK</span><span class="o">.</span><span class="n">seq</span> <span class="o">+</span> <span class="mi">1</span><span class="p">)</span> <span class="o">/</span> <span class="n">get</span><span class="p">)</span> |
| </pre></div> |
| </div> |
| </section> |
| <section id="simulating-packet-loss"> |
| <h2>Simulating Packet Loss<a class="headerlink" href="#simulating-packet-loss" title="Permalink to this heading"></a></h2> |
| <p>With simulating packet loss one can test the re-transmission behavior of the |
| target stack.</p> |
| <p>To start packet loss:</p> |
| <div class="highlight-bash notranslate"><div class="highlight"><pre><span></span><span class="c1"># for randomly dropping 10% of incoming packets:</span> |
| sudo<span class="w"> </span>iptables<span class="w"> </span>-A<span class="w"> </span>INPUT<span class="w"> </span>-m<span class="w"> </span>statistic<span class="w"> </span>--mode<span class="w"> </span>random<span class="w"> </span>--probability<span class="w"> </span><span class="m">0</span>.1<span class="w"> </span>-j<span class="w"> </span>DROP |
| |
| <span class="c1"># and for dropping 10% of outgoing packets:</span> |
| sudo<span class="w"> </span>iptables<span class="w"> </span>-A<span class="w"> </span>OUTPUT<span class="w"> </span>-m<span class="w"> </span>statistic<span class="w"> </span>--mode<span class="w"> </span>random<span class="w"> </span>--probability<span class="w"> </span><span class="m">0</span>.1<span class="w"> </span>-j<span class="w"> </span>DROP |
| </pre></div> |
| </div> |
| <p>To remove the rules:</p> |
| <div class="highlight-bash notranslate"><div class="highlight"><pre><span></span><span class="c1"># for the incoming packets:</span> |
| sudo<span class="w"> </span>iptables<span class="w"> </span>-D<span class="w"> </span>INPUT<span class="w"> </span>-m<span class="w"> </span>statistic<span class="w"> </span>--mode<span class="w"> </span>random<span class="w"> </span>--probability<span class="w"> </span><span class="m">0</span>.1<span class="w"> </span>-j<span class="w"> </span>DROP |
| |
| <span class="c1"># and for the outgoing packets</span> |
| sudo<span class="w"> </span>iptables<span class="w"> </span>-D<span class="w"> </span>OUTPUT<span class="w"> </span>-m<span class="w"> </span>statistic<span class="w"> </span>--mode<span class="w"> </span>random<span class="w"> </span>--probability<span class="w"> </span><span class="m">0</span>.1<span class="w"> </span>-j<span class="w"> </span>DROP |
| </pre></div> |
| </div> |
| </section> |
| <section id="fuzz-testing"> |
| <h2>Fuzz-Testing<a class="headerlink" href="#fuzz-testing" title="Permalink to this heading"></a></h2> |
| <p>For fuzz testing network applications the excellent |
| <a class="reference external" href="https://www.immunitysec.com/resources-freesoftware.shtml">SPIKE</a> tool can be |
| used. To make it compile under Ubuntu 14.04 LTS you have to add |
| <code class="docutils literal notranslate"><span class="pre">-fno-stack-protector</span></code> to CFLAGS.</p> |
| <p>SPIKE complained about missing SSL libs. I simply linked the existing to the needed |
| filenames:</p> |
| <div class="highlight-none notranslate"><div class="highlight"><pre><span></span>/lib/i386-linux-gnu$ sudo ln -s ./libssl.so.1.0.0 ./libssl.so.0 |
| /lib/i386-linux-gnu$ sudo ln -s ./libcrypto.so.1.0.0 ./libcrypto.so.0 |
| </pre></div> |
| </div> |
| <p>Maybe those lib versions aren’t the expected by SPIKE but if you don’t use SSL |
| it works fine.</p> |
| <p>SPIKE provides a proxy server to record requests to your web application. Based |
| on these requests a application specific fuzz test can be generated.</p> |
| <div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>~/SPIKE/src$<span class="w"> </span>mkdir<span class="w"> </span>requests<span class="w"> </span><span class="o">&&</span><span class="w"> </span><span class="nb">cd</span><span class="w"> </span>requests |
| <span class="c1"># Record requests to the target at 192.168.2.135 on port 80</span> |
| ~/SPIKE/src/requests$<span class="w"> </span>../webmitm<span class="w"> </span>-t<span class="w"> </span><span class="m">192</span>.168.2.135<span class="w"> </span>-p<span class="w"> </span><span class="m">80</span> |
| </pre></div> |
| </div> |
| <p>Now use your web application through localhost to record some requests. Then you |
| can generate your application-specific fuzz test from the recorded requests.</p> |
| <div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>~/SPIKE/src$<span class="w"> </span>./makewebfuzz.pl<span class="w"> </span>./requests/http_request-1.0<span class="w"> </span>><span class="w"> </span>myfuzz.c |
| ~/SPIKE/src$<span class="w"> </span>gcc<span class="w"> </span>./myfuzz.c<span class="w"> </span>-I../include<span class="w"> </span>-o<span class="w"> </span>myfuzz<span class="w"> </span>-L.<span class="w"> </span>-ldlrpc<span class="w"> </span>-ldl |
| </pre></div> |
| </div> |
| <p>Now you can fuzz your target:</p> |
| <div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>~/SPIKE/src$<span class="w"> </span><span class="nv">LD_LIBRARY_PATH</span><span class="o">=</span>.<span class="w"> </span>./myfuzz<span class="w"> </span><span class="m">192</span>.168.2.135<span class="w"> </span><span class="m">80</span> |
| </pre></div> |
| </div> |
| </section> |
| </section> |
| |
| |
| </div> |
| </div> |
| <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer"> |
| <a href="ofloader.html" class="btn btn-neutral float-left" title="Open Flash Loader" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a> |
| <a href="automounter.html" class="btn btn-neutral float-right" title="Auto-Mounter" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a> |
| </div> |
| |
| <hr/> |
| |
| <div role="contentinfo"> |
| <p>© Copyright 2023, The Apache Software Foundation.</p> |
| </div> |
| |
| |
| |
| </footer> |
| </div> |
| </div> |
| </section> |
| </div> |
| <script> |
| jQuery(function () { |
| SphinxRtdTheme.Navigation.enable(true); |
| }); |
| </script> |
| |
| </body> |
| </html> |