⬢ DragonFlyBSD Kernel Audit
DF-0633 / df0633_test.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
#!/bin/sh
# DF-0633 stress test: concurrent state mutation + ipfw3 state show to
# amplify the chance of hitting the cross-CPU RB-traversal race.
#
# REQUIRES: ipfw3.ko + ipfw3_basic.ko (loadable; root for firewall config)
# RUN: sh df0633_test.sh [iterations] [traffic_gens]
set +e
OUT=/tmp/df0633_result.txt
ITERS=${1:-500}
GENS=${2:-12}
{
echo "=== DF-0633 ipfw3 cross-CPU RB-traversal race test ==="
date

kldload ipfw3 2>/dev/null
kldload ipfw3_basic 2>/dev/null

# Allow SSH, keep-state for icmp/udp so traffic generators create states
/sbin/ipfw3 -f flush 2>/dev/null
/sbin/ipfw3 add 100 allow tcp from any to any
/sbin/ipfw3 add 200 allow icmp from any to any keep-state
/sbin/ipfw3 add 300 allow udp from any to any keep-state

sysctl -w net.inet.ip.fw3.enable=1
sysctl -w net.inet.ip.fw3_basic.state_max_icmp_in=4096
sysctl -w net.inet.ip.fw3_basic.state_max_icmp_out=4096
sysctl -w net.inet.ip.fw3_basic.state_max_udp_in=4096
sysctl -w net.inet.ip.fw3_basic.state_max_udp_out=4096
sysctl -w net.inet.ip.fw3_basic.icmp_timeout=2
sysctl -w net.inet.ip.fw3_basic.udp_timeout=2
sysctl -w net.inet.ip.fw3_basic.cleanup_interval=1

# Spawn traffic generators
TRAF_PIDS=""
for i in $(seq 1 "$GENS"); do
    (
        while true; do
            for j in 1 2 3 4 5 6 7 8 9 10; do
                ping -c 1 -t 1 -W 1 10.0.2.$((i*20 + j)) >/dev/null 2>&1
            done
        done
    ) &
    TRAF_PIDS="$TRAF_PIDS $!"
done

sleep 2

# Hammer ipfw3 state show under load
echo "--- Running $ITERS iterations of ipfw3 state show under churn ---"
ok=0
for k in $(seq 1 "$ITERS"); do
    if /sbin/ipfw3 state show >/dev/null 2>&1; then
        ok=$((ok+1))
    fi
    if [ $((k % 50)) -eq 0 ]; then echo -n "$k.."; fi
done
echo
echo "completed: $ok / $ITERS"

# Kill traffic
for p in $TRAF_PIDS; do kill "$p" 2>/dev/null; done
pkill -9 ping 2>/dev/null
sleep 1

echo "--- dmesg tail (look for panic / lock-order / slab signatures) ---"
dmesg | tail -30

sysctl -w net.inet.ip.fw3.enable=0
date
echo "=== Done ==="
} > "$OUT" 2>&1
echo "Result written to $OUT"