fix(NET)+docs: lftpd 对端地址修复、E6 裁决收口、陷阱编号迁移重排 TRAP-NET-01~21
- lftpd：net_inet_ntoa 段序改 MSB 首 + 新增 net_getpeername，FTP 日志打印 真实对端地址（真机实证 192.168.1.2:55524，登记 TRAP-NET-21） - E6：NET_U15_PROBE 命中=0（含压测）→ 阶段 3 项 4 不立项，U15 登记观察项； 插桩留仓（宏=0 零成本），soak 驱动 test/host/e6_soak.py 入库 - 编号：全库 Trap NN → TRAP-NET-<nn> 迁移并重排连续 01~21（单调映射， 沿革见 CH395F_Trap_Records.md 头注）；死号 12/13/19/21 引用全部清除； GD5F 域引用补正为 TRAP-GD5F-NN - 陷阱文档全新化：索引 21 行行行真陷阱；删误判存档/发现时间/git 考古/ FTP 附录；台架纪律教训沉淀第六章方法论 - RAM：Code 211348→211456（+108 lftpd 修复），RW+ZI 净增 +4B； 优化方案/台账受管区/tsv 同笔同步 - ftp_abort_probe.py 挪 test/host/；引用关系图重生成 - 回归：@build 0/0；@test PASS；ftp_abort 10/10；relisten :7003 20/20； ci_local L0+L0.5 全绿；E6 窗口零复位，7 条 WD stall 登记压测假象备查
This commit is contained in:
+13
-1
@@ -22,6 +22,15 @@
|
||||
| `ftp_speed_test.py` | FTP 传输速度测试 |
|
||||
| `ftp_capture.py` | FTP 流量抓取 |
|
||||
| `ftp_regression.py` | FTP 回归套件 |
|
||||
| `ftp_abort_probe.py` | FTP 中止场景探针（TRAP-NET-18；RST→450 / FIN→226，`--check-abort`；2026-10-13 自 `MDK-ARM/` 迁入） |
|
||||
| `ftp_integrity_test.py` | FTP 上传 SHA-256 完整性多轮回归 |
|
||||
| `n30_repro.py` | 背靠背 STOR 复现器（TRAP-NET-20 常备回归腿） |
|
||||
| `relisten_stress.py` | 监听快速复连压力（TRAP-NET-17 / N34 E1：`--port --n --gap-ms [--hold-ms]`） |
|
||||
| `e11_keepalive_probe.py` | keepalive 黑洞判死探针（N34 E11） |
|
||||
| `e6_soak.py` | E6 24h 挂机驱动（常态 + 每小时/每 4h E1 压测注入；判据读串口 `U15 probe` 计数） |
|
||||
| `pasv_probe.py` | PASV 数据通道时序探针 |
|
||||
| `ch395f_reuse_host.py` | Socket 复用/中止形态 PC 对端（bench 配套） |
|
||||
| `ftp_auth_bench.py` | FTP 鉴权/锁定台架腿（N-19） |
|
||||
| `iec104_master.py` | **IEC 60870-5-104 主站客户端（B6/B7）**：连设备 :2404 跑 STARTDT → 总召（actcon/四组背景扫描/actterm）→ 经 C_SE 两段写临时压低 OC1 定值确定性触发 YX16 变位（COT=3）→ 恢复 → YK11 两段式 → C_RD 读回；**B7 持久化模式 `--b7-pre/--b7-post/--b7-mark/--b7-check`**（中间 ST-LINK 复位）：YK12 两段投退→保护退出/联动、定值与压板态跨复位保持（含非默认 7.5 往返）；纯标准库，输出纯 ASCII 可直接重定向归档为台架证据（判据 exit 0/1/2） |
|
||||
|
||||
### 时间 / 时延
|
||||
@@ -106,7 +115,10 @@
|
||||
- **PYTHONPATH/路径敏感**：脚本按仓库根相对路径读写，**从仓库根执行**
|
||||
- 本目录**被 pre-commit 门禁的 cppcheck / 代码规范排除**（`test/` 豁免）；
|
||||
但各模块的 `run_unit_test.py` 自身**作为独立钩子**参与门禁（见上，共 7 个）
|
||||
- 台架探针族（TCP 复连 / FTP 中止等）在 `MDK-ARM/*.py`，与本目录分工不同
|
||||
- 台架探针族分工（2026-10-13 起）：**N34/Trap 常备回归腿在本目录**（`relisten_stress` /
|
||||
`ftp_abort_probe` / `n30_repro` / `e02_probe` / `e6_soak` 等）；`MDK-ARM/*.py` 只余
|
||||
历史一次性探针（`ftp_freeze_probe` / `tcp_reconnect_probe` / `ftp_retr_abort_probe` /
|
||||
`bench_verdict`）
|
||||
- 全部主机侧单测（`watchdog/`、`sys_clock/`、`cfg_file/`、`phasor/`、`adc_input/`、
|
||||
`vol_lock/`、`time_sync/`）都需要本机装有 MSVC（VS2019/2022/2026 的 C++ 工具链）；
|
||||
无则脚本报环境错误（退出码 2）
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
# 用法: python ch395f_reuse_host.py [--host IP] [--cycles N] [--mode legacy|e4]
|
||||
# legacy: 按 idx 轮转连接 5000+idx 端口，记录收发结果与时刻。
|
||||
# e4: N34 E4 sock_reset A/B/C 矩阵配套（2026-10-13）：每轮两次连接——
|
||||
# ①污染：连上发 3000B 后 RST（SO_LINGER 0，Trap 23 中止形态）；
|
||||
# ①污染：连上发 3000B 后 RST（SO_LINGER 0，TRAP-NET-18 中止形态）；
|
||||
# ②载荷：立即重连发 4096B 图案（pat[i]=(seed+i)&0xFF, seed=(rg*97+13)&0xFF）后 FIN。
|
||||
# 端口 5100+rg，rg=0..(3*rounds-1)，变体顺序 A/B/C（与固件 bench 表一致）。
|
||||
import argparse
|
||||
@@ -103,7 +103,7 @@ def e4_round(host, rg, rounds_per_variant, first_budget):
|
||||
s.setsockopt(socket.SOL_SOCKET, socket.SO_LINGER, struct.pack("ii", 1, 0))
|
||||
except OSError:
|
||||
pass
|
||||
s.close() # RST: abort mid-session like ftp_abort_probe (Trap 23 form)
|
||||
s.close() # RST: abort mid-session like ftp_abort_probe (TRAP-NET-18 form)
|
||||
time.sleep(0.05)
|
||||
|
||||
s = connect_retry(host, port, 20)
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
:8888 应能再接受新连接（3s 重试窗内）；新连接发完整 8 字节 TIME 包 →
|
||||
设备应落 "wall clock updated"。
|
||||
|
||||
⚠ 定案口径（Trap 07 定案更正 2026-10-11 + 实验方案 E13 §5）：CH395F close
|
||||
⚠ 定案口径（TRAP-NET-07 定案更正 2026-10-11 + 实验方案 E13 §5）：CH395F close
|
||||
**无 RST 语义**。若对端内核存活（app 挂起但 socket 不关，内核自动 ACK FIN），
|
||||
芯片停在 FIN_WAIT_2、监听恢复受限于对端 close——探针第 3 步的 close 正是
|
||||
模拟"对端配合"这一可恢复边界；不配合场景的兜底是芯片 TIMEOUT/keepalive
|
||||
@@ -67,7 +67,7 @@ def main():
|
||||
time.sleep(remain)
|
||||
|
||||
# 3b. 模拟守规矩对端：设备已发 FIN（drop_conn），本端 close 配合拆链。
|
||||
# CH395F close 无 RST 语义（Trap 07 定案更正）：不配合的内核存活对端
|
||||
# CH395F close 无 RST 语义（TRAP-NET-07 定案更正）：不配合的内核存活对端
|
||||
# 会把芯片停在 FIN_WAIT_2，监听恢复受限于对端 close——不在本探针判据内。
|
||||
try:
|
||||
ts.close()
|
||||
|
||||
@@ -0,0 +1,64 @@
|
||||
#!/usr/bin/env python3
|
||||
# -*- coding: utf-8 -*-
|
||||
"""E6 24h soak driver (U15 mismatch frequency, N34 experiment plan E6).
|
||||
|
||||
Protocol (docs/网络/N34-自愈审计/实验方案.md §E6):
|
||||
24h normal operation + periodic E1 stress injection:
|
||||
- every hour : relisten_stress :7003 n=10 gap=100 (UI-like churn)
|
||||
- every 4th hour : full E1 (:7003 n=50 gap=0 + :21 n=50 gap=100)
|
||||
Device-side confirmed hits are counted by the NET_U15_PROBE firmware and
|
||||
appear in the serial log as "U15 probe: sockN rx=... hits=N" (first hit
|
||||
immediately, then <=1/hour). Read the verdict from serial.log afterwards.
|
||||
|
||||
Usage: python e6_soak.py [--hours 24]
|
||||
Exit: 0 = soak completed; nonzero = driver error (device untouched).
|
||||
"""
|
||||
import argparse
|
||||
import os
|
||||
import subprocess
|
||||
import sys
|
||||
import time
|
||||
|
||||
ROOT = os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
|
||||
STRESS = os.path.join(ROOT, "test", "host", "relisten_stress.py")
|
||||
|
||||
|
||||
def log(msg):
|
||||
print("[%s] %s" % (time.strftime("%m-%d %H:%M:%S"), msg), flush=True)
|
||||
|
||||
|
||||
def burst(args_list, tag):
|
||||
t0 = time.time()
|
||||
try:
|
||||
r = subprocess.run([sys.executable, STRESS] + args_list,
|
||||
capture_output=True, text=True, timeout=900)
|
||||
out = (r.stdout or "") + (r.stderr or "")
|
||||
tail = [ln for ln in out.splitlines() if "ok=" in ln or "latency" in ln]
|
||||
dt = time.time() - t0
|
||||
log("%s rc=%d %.0fs %s" % (tag, r.returncode, dt, " | ".join(tail[-2:])))
|
||||
except Exception as e: # driver hiccup must not abort the soak
|
||||
log("%s ERROR %r" % (tag, e))
|
||||
|
||||
|
||||
def main():
|
||||
ap = argparse.ArgumentParser()
|
||||
ap.add_argument("--hours", type=int, default=24)
|
||||
a = ap.parse_args()
|
||||
|
||||
log("E6 soak start: %d h, hourly :7003x10, every-4h E1 full" % a.hours)
|
||||
t_start = time.time()
|
||||
for h in range(1, a.hours + 1):
|
||||
# sleep first: hour boundary cadence
|
||||
remain = t_start + h * 3600.0 - time.time()
|
||||
if remain > 0:
|
||||
time.sleep(remain)
|
||||
burst(["--port", "7003", "--n", "10", "--gap-ms", "100"], "hour%02d :7003x10" % h)
|
||||
if h % 4 == 0:
|
||||
burst(["--port", "7003", "--n", "50", "--gap-ms", "0"], "hour%02d E1 :7003x50g0" % h)
|
||||
burst(["--port", "21", "--n", "50", "--gap-ms", "100"], "hour%02d E1 :21x50g100" % h)
|
||||
log("E6 soak done: %.1f h elapsed" % ((time.time() - t_start) / 3600.0))
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
@@ -0,0 +1,137 @@
|
||||
# -*- coding: utf-8 -*-
|
||||
# Trustworthy abort/robustness probe for the production FTP path (no firmware probes).
|
||||
#
|
||||
# Scenario: client starts a STOR upload, sends part of the data, then ABORTS by
|
||||
# resetting the data connection (SO_LINGER 0 -> RST), which is the common real-world
|
||||
# pattern (user cancels an upload, client crashes, link drops). Then it checks:
|
||||
# 1. the control channel still answers (NOOP on a fresh connection),
|
||||
# 2. a FOLLOW-UP normal upload+download still passes the SHA-256 check,
|
||||
# 3. the device's relisten actually happened (observable via a successful follow-up).
|
||||
#
|
||||
# Usage: ftp_abort_probe.py [--ip ..] [--port 21] [--rounds 10] [--send 8192] [--gap 2]
|
||||
# [--graceful] [--check-abort]
|
||||
# Output: TS <epoch> / ABORT <n> sent=<b> ctrl=<reply> alive=<yes|no> followup=<OK|FAIL:x>
|
||||
# abort5xx=<OK|FAIL|-> (only with --check-abort: RST expects 4xx/5xx on the
|
||||
# aborted STOR = no false 226 (TRAP-NET-18 hardening); graceful FIN expects 2xx
|
||||
# = protocol boundary, still reported as success)
|
||||
# SUMMARY rounds=<n> pass=<n> fail=<n>
|
||||
# Exit 0 all rounds pass, 1 otherwise.
|
||||
import argparse, hashlib, io, random, re, socket, struct, sys, time
|
||||
from ftplib import FTP, all_errors
|
||||
|
||||
def log(m):
|
||||
sys.stdout.write(m + "\n"); sys.stdout.flush()
|
||||
|
||||
def rd(sock):
|
||||
try:
|
||||
return sock.recv(4096).decode("latin1").strip()
|
||||
except Exception:
|
||||
return ""
|
||||
|
||||
def raw_login(ip, port, timeout=10.0):
|
||||
s = socket.create_connection((ip, port), timeout=timeout)
|
||||
rd(s) # 220 banner
|
||||
# N-19: anonymous login is rejected (530) -> use the factory default account
|
||||
s.sendall(b"USER admin\r\n"); rd(s)
|
||||
s.sendall(b"PASS admin\r\n"); rd(s)
|
||||
s.sendall(b"TYPE I\r\n"); rd(s)
|
||||
return s
|
||||
|
||||
def pasv_data_socket(ctl):
|
||||
ctl.sendall(b"PASV\r\n")
|
||||
r = rd(ctl)
|
||||
m = re.search(r"\((\d+),(\d+),(\d+),(\d+),(\d+),(\d+)\)", r)
|
||||
if not m:
|
||||
raise RuntimeError("PASV failed: " + r)
|
||||
host = ".".join(m.group(i) for i in (1, 2, 3, 4))
|
||||
port = (int(m.group(5)) << 8) | int(m.group(6))
|
||||
return socket.create_connection((host, port), timeout=10.0)
|
||||
|
||||
def followup_ok(ip, port, size=4096):
|
||||
"""normal upload + download + sha256 -> True/False"""
|
||||
data = bytes(random.getrandbits(8) for _ in range(size))
|
||||
want = hashlib.sha256(data).hexdigest()
|
||||
try:
|
||||
f = FTP(); f.connect(ip, port, timeout=15.0); f.login("admin", "admin")
|
||||
f.storbinary("STOR /ab_ok.bin", io.BytesIO(data))
|
||||
buf = bytearray(); f.retrbinary("RETR /ab_ok.bin", buf.extend)
|
||||
try:
|
||||
f.delete("/ab_ok.bin")
|
||||
except all_errors:
|
||||
pass
|
||||
f.quit()
|
||||
return hashlib.sha256(bytes(buf)).hexdigest() == want
|
||||
except all_errors:
|
||||
return False
|
||||
|
||||
def main():
|
||||
ap = argparse.ArgumentParser()
|
||||
ap.add_argument("--ip", default="192.168.1.100")
|
||||
ap.add_argument("--port", type=int, default=21)
|
||||
ap.add_argument("--rounds", type=int, default=10)
|
||||
ap.add_argument("--send", type=int, default=8192, help="bytes sent before the RST")
|
||||
ap.add_argument("--gap", type=float, default=2.0)
|
||||
ap.add_argument("--graceful", action="store_true",
|
||||
help="close the data connection with FIN instead of RST")
|
||||
ap.add_argument("--check-abort", action="store_true",
|
||||
help="also assert the aborted STOR's control reply: RST -> 4xx/5xx "
|
||||
"(no false 226, TRAP-NET-18 hardening); graceful FIN -> 2xx (boundary)")
|
||||
a = ap.parse_args()
|
||||
|
||||
npass = nfail = 0
|
||||
for n in range(1, a.rounds + 1):
|
||||
log("TS %d" % int(time.time()))
|
||||
ctl_reply = "NA"
|
||||
alive = "no"
|
||||
try:
|
||||
ctl = raw_login(a.ip, a.port)
|
||||
ds = pasv_data_socket(ctl)
|
||||
ctl.sendall(("STOR /ab%04d.bin\r\n" % n).encode())
|
||||
ctl_reply = rd(ctl) # 150
|
||||
chunk = bytes(random.getrandbits(8) for _ in range(a.send))
|
||||
ds.sendall(chunk)
|
||||
if a.graceful:
|
||||
ds.shutdown(socket.SHUT_RDWR) # graceful FIN (client cancel)
|
||||
else:
|
||||
# abort: RST the data connection (linger 0)
|
||||
ds.setsockopt(socket.SOL_SOCKET, socket.SO_LINGER, struct.pack("ii", 1, 0))
|
||||
ds.close()
|
||||
time.sleep(0.5)
|
||||
ctl_reply = rd(ctl) # 426/550/226
|
||||
try:
|
||||
ctl.sendall(b"QUIT\r\n"); rd(ctl)
|
||||
except Exception:
|
||||
pass
|
||||
try:
|
||||
ctl.close()
|
||||
except Exception:
|
||||
pass
|
||||
except Exception as e:
|
||||
ctl_reply = "EXC:%s" % type(e).__name__
|
||||
# control-channel liveness on a fresh connection
|
||||
try:
|
||||
c2 = raw_login(a.ip, a.port)
|
||||
c2.sendall(b"NOOP\r\n")
|
||||
alive = "yes" if rd(c2).startswith("2") else "no"
|
||||
c2.sendall(b"QUIT\r\n"); c2.close()
|
||||
except Exception:
|
||||
alive = "no"
|
||||
fu = followup_ok(a.ip, a.port)
|
||||
abort_ok = True
|
||||
if a.check_abort:
|
||||
code = ctl_reply[0] if (ctl_reply and ctl_reply[0].isdigit()) else "?"
|
||||
# RST: device must report 4xx/5xx on the aborted STOR (450); graceful
|
||||
# FIN still gets 226 (STOR has no length declaration - protocol boundary)
|
||||
abort_ok = (code == "2") if a.graceful else (code in ("4", "5"))
|
||||
ok = (alive == "yes" and fu and abort_ok)
|
||||
npass += 1 if ok else 0
|
||||
nfail += 0 if ok else 1
|
||||
log("ABORT %d sent=%d ctrl=%s alive=%s followup=%s abort5xx=%s" %
|
||||
(n, a.send, ctl_reply.replace("\r\n", "|")[:40], alive,
|
||||
"OK" if fu else "FAIL", "OK" if abort_ok else "FAIL" if a.check_abort else "-"))
|
||||
if a.gap > 0 and n < a.rounds:
|
||||
time.sleep(a.gap)
|
||||
log("SUMMARY rounds=%d pass=%d fail=%d" % (a.rounds, npass, nfail))
|
||||
return 0 if nfail == 0 else 1
|
||||
|
||||
sys.exit(main())
|
||||
Reference in New Issue
Block a user