genode/repos/os/run/nic_router_flood.run
Martin Stein 14357b0b44 nic_router_flood.run: test DoS against router
Currently has three clients that continuously create new UDP/TCP/ICMP
connections through the NIC router with NAT to the outer world and they
get never closed.  A fourth client does normal ping through the same
domain to the outer world that must succeed even after the RAM quota of
the other session at the router is exhausted. The test is restricted to
Qemu to not being at risk to flood real networks.

Issue #2857
2018-06-29 10:40:13 +02:00

198 lines
4.8 KiB
Plaintext

#
# Build
#
if {![have_include power_on/qemu] ||
[have_spec foc] || [have_spec odroid_xu] ||
[expr [have_spec imx53] && [have_spec trustzone]]} {
puts "Run script is not supported on this platform."
exit 0
}
set build_components {
core
init
drivers/timer
drivers/nic
server/nic_router
test/net_flood
app/ping
}
proc gpio_drv { } { if {[have_spec rpi] && [have_spec hw]} { return hw_gpio_drv }
if {[have_spec rpi] && [have_spec foc]} { return foc_gpio_drv }
return gpio_drv }
proc good_dst_ip { } { return "10.0.2.2" }
proc bad_dst_ip { } { return "10.0.0.123" }
lappend_if [have_spec gpio] build_components drivers/gpio
source ${genode_dir}/repos/base/run/platform_drv.inc
append_platform_drv_build_components
build $build_components
create_boot_directory
#
# Generate config
#
append config {
<config>
<parent-provides>
<service name="ROM"/>
<service name="IRQ"/>
<service name="IO_MEM"/>
<service name="IO_PORT"/>
<service name="PD"/>
<service name="RM"/>
<service name="CPU"/>
<service name="LOG"/>
</parent-provides>
<default-route>
<any-service> <parent/> <any-child/> </any-service>
</default-route>
<default caps="100"/>}
append_platform_drv_config
append_if [have_spec gpio] config "
<start name=\"[gpio_drv]\" caps=\"150\">
<resource name=\"RAM\" quantum=\"4M\"/>
<provides><service name=\"Gpio\"/></provides>
<config/>
</start>"
append config {
<start name="timer">
<resource name="RAM" quantum="1M"/>
<provides><service name="Timer"/></provides>
</start>
<start name="nic_drv" caps="150">
<binary name="} [nic_drv_binary] {"/>
<resource name="RAM" quantum="20M"/>
<provides><service name="Nic"/></provides>
} [nic_drv_config] {
</start>
<start name="nic_router" caps="200">
<resource name="RAM" quantum="10M"/>
<provides><service name="Nic"/></provides>
<config verbose="no"
verbose_packets="no"
verbose_domain_state="yes"
dhcp_discover_timeout_sec="1"
tcp_idle_timeout_sec="3600"
udp_idle_timeout_sec="3600"
icmp_idle_timeout_sec="3600">
<policy label_prefix="flood_links" domain="flood_links"/>
<policy label_prefix="ping" domain="flood_links"/>
<domain name="uplink" verbose_packets="no">
<nat domain="flood_links" udp-ports="16384"
tcp-ports="16384"
icmp-ids="16384"/>
</domain>
<domain name="flood_links" interface="10.0.1.1/24">
<dhcp-server ip_first="10.0.1.100"
ip_last="10.0.1.200"/>
<icmp dst="0.0.0.0/0" domain="uplink"/>
<udp dst="0.0.0.0/0"><permit-any domain="uplink"/></udp>
<tcp dst="0.0.0.0/0"><permit-any domain="uplink"/></tcp>
</domain>
</config>
<route>
<service name="Nic"> <child name="nic_drv"/> </service>
<any-service> <parent/> <any-child/> </any-service>
</route>
</start>
<start name="flood_links_tcp">
<binary name="test-net_flood"/>
<resource name="RAM" quantum="8M"/>
<config dst_ip="} [bad_dst_ip] {"
protocol="tcp"
verbose="no"/>
<route>
<service name="Nic"> <child name="nic_router"/> </service>
<any-service> <parent/> <any-child/> </any-service>
</route>
</start>
<start name="flood_links_udp">
<binary name="test-net_flood"/>
<resource name="RAM" quantum="8M"/>
<config dst_ip="} [bad_dst_ip] {"
protocol="udp"
verbose="no"/>
<route>
<service name="Nic"> <child name="nic_router"/> </service>
<any-service> <parent/> <any-child/> </any-service>
</route>
</start>
<start name="flood_links_icmp">
<binary name="test-net_flood"/>
<resource name="RAM" quantum="8M"/>
<config dst_ip="} [bad_dst_ip] {"
protocol="icmp"
verbose="no"/>
<route>
<service name="Nic"> <child name="nic_router"/> </service>
<any-service> <parent/> <any-child/> </any-service>
</route>
</start>
<start name="ping">
<resource name="RAM" quantum="8M"/>
<config dst_ip="} [good_dst_ip] {"
period_sec="2"
count="20"/>
<route>
<service name="Nic"> <child name="nic_router"/> </service>
<any-service> <parent/> <any-child/> </any-service>
</route>
</start>
</config>}
install_config $config
#
# Boot modules
#
# generic modules
append boot_modules {
core init
timer
} [nic_drv_binary] {
test-net_flood
ld.lib.so
nic_router
ping
}
# platform-specific modules
lappend_if [have_spec linux] boot_modules fb_sdl
lappend_if [have_spec gpio] boot_modules [gpio_drv]
append_platform_drv_boot_modules
build_boot_image $boot_modules
append_if [have_spec x86] qemu_args " -net nic,model=e1000 "
append_if [have_spec lan9118] qemu_args " -net nic,model=lan9118 "
append qemu_args " -net user -nographic "
run_genode_until ".*\"ping\" exited with exit value 0.*\n" 60