122 lines
4.8 KiB
Python
122 lines
4.8 KiB
Python
# -*- coding: utf-8 -*-
|
|
# Trustworthy abort/robustness probe for the production FTP path (no firmware probes).
|
|
#
|
|
# Scenario: client starts a STOR upload, sends part of the data, then ABORTS by
|
|
# resetting the data connection (SO_LINGER 0 -> RST), which is the common real-world
|
|
# pattern (user cancels an upload, client crashes, link drops). Then it checks:
|
|
# 1. the control channel still answers (NOOP on a fresh connection),
|
|
# 2. a FOLLOW-UP normal upload+download still passes the SHA-256 check,
|
|
# 3. the device's relisten actually happened (observable via a successful follow-up).
|
|
#
|
|
# Usage: ftp_abort_probe.py [--ip ..] [--port 21] [--rounds 10] [--send 8192] [--gap 2]
|
|
# Output: TS <epoch> / ABORT <n> sent=<b> ctrl=<reply> alive=<yes|no> followup=<OK|FAIL:x>
|
|
# SUMMARY rounds=<n> pass=<n> fail=<n>
|
|
# Exit 0 all follow-ups pass, 1 otherwise.
|
|
import argparse, hashlib, io, random, re, socket, struct, sys, time
|
|
from ftplib import FTP, all_errors
|
|
|
|
def log(m):
|
|
sys.stdout.write(m + "\n"); sys.stdout.flush()
|
|
|
|
def rd(sock):
|
|
try:
|
|
return sock.recv(4096).decode("latin1").strip()
|
|
except Exception:
|
|
return ""
|
|
|
|
def raw_login(ip, port, timeout=10.0):
|
|
s = socket.create_connection((ip, port), timeout=timeout)
|
|
rd(s) # 220 banner
|
|
s.sendall(b"USER anonymous\r\n"); rd(s)
|
|
s.sendall(b"TYPE I\r\n"); rd(s)
|
|
return s
|
|
|
|
def pasv_data_socket(ctl):
|
|
ctl.sendall(b"PASV\r\n")
|
|
r = rd(ctl)
|
|
m = re.search(r"\((\d+),(\d+),(\d+),(\d+),(\d+),(\d+)\)", r)
|
|
if not m:
|
|
raise RuntimeError("PASV failed: " + r)
|
|
host = ".".join(m.group(i) for i in (1, 2, 3, 4))
|
|
port = (int(m.group(5)) << 8) | int(m.group(6))
|
|
return socket.create_connection((host, port), timeout=10.0)
|
|
|
|
def followup_ok(ip, port, size=4096):
|
|
"""normal upload + download + sha256 -> True/False"""
|
|
data = bytes(random.getrandbits(8) for _ in range(size))
|
|
want = hashlib.sha256(data).hexdigest()
|
|
try:
|
|
f = FTP(); f.connect(ip, port, timeout=15.0); f.login("anonymous", "x")
|
|
f.storbinary("STOR /ab_ok.bin", io.BytesIO(data))
|
|
buf = bytearray(); f.retrbinary("RETR /ab_ok.bin", buf.extend)
|
|
try:
|
|
f.delete("/ab_ok.bin")
|
|
except all_errors:
|
|
pass
|
|
f.quit()
|
|
return hashlib.sha256(bytes(buf)).hexdigest() == want
|
|
except all_errors:
|
|
return False
|
|
|
|
def main():
|
|
ap = argparse.ArgumentParser()
|
|
ap.add_argument("--ip", default="192.168.1.100")
|
|
ap.add_argument("--port", type=int, default=21)
|
|
ap.add_argument("--rounds", type=int, default=10)
|
|
ap.add_argument("--send", type=int, default=8192, help="bytes sent before the RST")
|
|
ap.add_argument("--gap", type=float, default=2.0)
|
|
ap.add_argument("--graceful", action="store_true",
|
|
help="close the data connection with FIN instead of RST")
|
|
a = ap.parse_args()
|
|
|
|
npass = nfail = 0
|
|
for n in range(1, a.rounds + 1):
|
|
log("TS %d" % int(time.time()))
|
|
ctl_reply = "NA"
|
|
alive = "no"
|
|
try:
|
|
ctl = raw_login(a.ip, a.port)
|
|
ds = pasv_data_socket(ctl)
|
|
ctl.sendall(("STOR /ab%04d.bin\r\n" % n).encode())
|
|
ctl_reply = rd(ctl) # 150
|
|
chunk = bytes(random.getrandbits(8) for _ in range(a.send))
|
|
ds.sendall(chunk)
|
|
if a.graceful:
|
|
ds.shutdown(socket.SHUT_RDWR) # graceful FIN (client cancel)
|
|
else:
|
|
# abort: RST the data connection (linger 0)
|
|
ds.setsockopt(socket.SOL_SOCKET, socket.SO_LINGER, struct.pack("ii", 1, 0))
|
|
ds.close()
|
|
time.sleep(0.5)
|
|
ctl_reply = rd(ctl) # 426/550/226
|
|
try:
|
|
ctl.sendall(b"QUIT\r\n"); rd(ctl)
|
|
except Exception:
|
|
pass
|
|
try:
|
|
ctl.close()
|
|
except Exception:
|
|
pass
|
|
except Exception as e:
|
|
ctl_reply = "EXC:%s" % type(e).__name__
|
|
# control-channel liveness on a fresh connection
|
|
try:
|
|
c2 = raw_login(a.ip, a.port)
|
|
c2.sendall(b"NOOP\r\n")
|
|
alive = "yes" if rd(c2).startswith("2") else "no"
|
|
c2.sendall(b"QUIT\r\n"); c2.close()
|
|
except Exception:
|
|
alive = "no"
|
|
fu = followup_ok(a.ip, a.port)
|
|
ok = (alive == "yes" and fu)
|
|
npass += 1 if ok else 0
|
|
nfail += 0 if ok else 1
|
|
log("ABORT %d sent=%d ctrl=%s alive=%s followup=%s" %
|
|
(n, a.send, ctl_reply.replace("\r\n", "|")[:40], alive, "OK" if fu else "FAIL"))
|
|
if a.gap > 0 and n < a.rounds:
|
|
time.sleep(a.gap)
|
|
log("SUMMARY rounds=%d pass=%d fail=%d" % (a.rounds, npass, nfail))
|
|
return 0 if nfail == 0 else 1
|
|
|
|
sys.exit(main())
|