|
| 1 | +# Garnet Accept Loop — Scapy TCP Attack Tests |
| 2 | + |
| 3 | +Standalone Python test suite that uses [scapy](https://scapy.net/) to craft raw TCP packets |
| 4 | +simulating malicious handshake disruptions against a running Garnet server. |
| 5 | + |
| 6 | +These tests exercise accept error handling code paths that **cannot be reached** via standard |
| 7 | +socket APIs on Windows (which blocks raw TCP sockets since XP SP2). |
| 8 | + |
| 9 | +## Prerequisites |
| 10 | + |
| 11 | +- Python 3.8+ |
| 12 | +- [Npcap](https://npcap.com/) (Windows) or root access (Linux) |
| 13 | +- **Run as Administrator** (Windows) or root (Linux) for raw socket access |
| 14 | + |
| 15 | +## Install |
| 16 | + |
| 17 | +```bash |
| 18 | +pip install scapy |
| 19 | +``` |
| 20 | + |
| 21 | +## Usage |
| 22 | + |
| 23 | +Start a Garnet server first, then run the attacks against it: |
| 24 | + |
| 25 | +```bash |
| 26 | +# Run all tests against local Garnet server (default port 33278) |
| 27 | +python test_accept_loop_attacks.py |
| 28 | + |
| 29 | +# Specify host/port |
| 30 | +python test_accept_loop_attacks.py --host 127.0.0.1 --port 6379 |
| 31 | + |
| 32 | +# Run a specific test |
| 33 | +python test_accept_loop_attacks.py --test rst_before_ack |
| 34 | + |
| 35 | +# More iterations |
| 36 | +python test_accept_loop_attacks.py --count 200 |
| 37 | + |
| 38 | +# List available tests |
| 39 | +python test_accept_loop_attacks.py --list |
| 40 | +``` |
| 41 | + |
| 42 | +## Tests |
| 43 | + |
| 44 | +| Test | Attack | Expected SocketError | |
| 45 | +|------|--------|---------------------| |
| 46 | +| `rst_before_ack` | SYN → SYN-ACK → **RST** (instead of ACK) | `ConnectionReset` | |
| 47 | +| `rst_after_ack` | SYN → SYN-ACK → ACK → **RST** (immediately) | `ConnectionReset` | |
| 48 | +| `fin_before_ack` | SYN → SYN-ACK → **FIN** (instead of ACK) | `ConnectionAborted` | |
| 49 | +| `syn_then_silence` | SYN → SYN-ACK → *(silence)* | `TimedOut` | |
| 50 | +| `malformed_syn_options` | SYN with zero window, tiny MSS | Various | |
| 51 | + |
| 52 | +Each test sends the attack packets, then verifies the server still accepts |
| 53 | +new connections and responds to PING. If the accept loop is broken, the |
| 54 | +post-test PING will fail. |
| 55 | + |
| 56 | +## What this tests |
| 57 | + |
| 58 | +The tiered error handling in `GarnetServerTcp.HandleAcceptError`: |
| 59 | + |
| 60 | +- **Tier 3 (transient):** `ConnectionReset`, `ConnectionAborted`, `TimedOut` — log and continue |
| 61 | +- **Tier 2 (resource pressure):** `TooManyOpenSockets`, etc. — backoff and retry |
| 62 | +- **Tier 1 (fatal):** `OperationAborted` (shutdown) — stop loop; `NotSocket` etc. — crash process |
0 commit comments