Changeset 11130 in ntrip for trunk/BNC/tests

Timestamp:

Oct 28, 2026, 9:32:30 AM (10 days ago)

Author:

stuerze

Message:

Some fixes from security point of view

Location:

trunk/BNC/tests

Files:

• README.md (modified) (4 diffs)
• cases/decoder_limits/expected/BrdcCorr.log.gz (modified) ( previous)
• data/crafted_limits.raw (modified) ( previous)
• tools/bncraw.py (modified) (3 diffs)
• tools/fakecaster.py (modified) (8 diffs)
• tools/mkcrafted.py (modified) (6 diffs)
• tools/ssr_harness.cpp (modified) (4 diffs)

trunk/BNC/tests/README.md

@@ -31 +31 @@
 | `tools/ssr_harness.sh` | builds `tools/ssr_harness.cpp` with the SSR decoders under ASan/UBSan and runs it |
 | `tools/ssl_check.py` | TLS checks of the Ntrip 2s client and upload (not part of `run_tests.py`) |
+| `tools/net_check.py` | UDP/RTP sender filter and upload status checks on loopback (not part of `run_tests.py`) |
 | `work/` | scratch output, not versioned |
 
@@ -100 +101 @@
   coefficients are C(d,o) = (100*d+o)/200 TECU and S = -C, both `.ssr` files
   are identical apart from the station ID. These frames overflowed the
-  coefficient and name arrays; the 4-layer VTEC crashed BNC.
+  coefficient and name arrays; the 4-layer VTEC crashed BNC. Also two RTCM
+  1033: a complete one and one whose receiver descriptor length runs beyond
+  the message (rejected; before, stale buffer content was logged).
+
+* `rawfile_hostile`: raw file with hostile chunk headers from
+  `tools/mkcrafted.py --rawfile`: the station ID `../ESCAPE0` must give
+  `Output/.._ESCAPE0_*.ssr` (no file outside the output directory), a chunk
+  header announcing 2000000000 bytes is rejected with a log message.
 
 ## Sanitizer check of the SSR decoders
@@ -115 +123 @@
 also covers the new RTCM-SSR metadata (message 60 in
 `crafted_limits.raw`: 7 entries with additional parameters of 40 and 0 bits,
-and 31 entries, which must be rejected), which `RTCM3Decoder.cpp` does not
-dispatch at present. Every decoded VTEC and metadata message is encoded
-again with the `Make*` function of the same class and decoded once more; the
-result must be identical. Exit code 0 only without sanitizer errors and
+and 31 entries, which must be rejected) and satellite antenna messages
+(BDS with mask bits in all four 16-bit quarters, GPS with shared blocks),
+which `RTCM3Decoder.cpp` does not dispatch at present. Every decoded VTEC, metadata and antenna message is
+encoded again with the `Make*` function of the same class and decoded once
+more; the result must be identical, for the antenna messages also the bytes. Exit code 0 only without sanitizer errors and
 differences.
 
@@ -135 +144 @@
 certificate for another host name (rejected) and a client certificate
 required by the caster, with and without `sslIgnoreErrors`. Takes about 3 min.
+
+## Network check
+
+```
+tests/tools/net_check.py [--bnc PATH]
+```
+
+Runs BNC live against fake servers on loopback addresses (no root needed).
+A second sender on another address sends spoofed datagrams to BNC's port: in
+the modes 'U' (Ntrip 2 UDP) and 'R' (RTSP/RTP) and in 'UN' with a sender
+address in the URL, BNC's raw output must contain only the server's data;
+'UN' with 127.0.0.1 accepts any sender, as before. An Ntrip 1 caster sending an endless
+response header is cut off, a normal Ntrip 1 stream still works. An upload
+answered with `HTTP/1.1 401` and a header containing `200` must be reported
+as broken. Takes about 2 min.
 
 ## Adding a replay case

trunk/BNC/tests/tools/bncraw.py

@@ -197 +197 @@
 
 
+def frame(payload):
+    """RTCM3 frame (preamble, length, payload, CRC24Q) of a payload."""
+    head = bytes([0xD3, (len(payload) >> 8) & 0x03, len(payload) & 0xFF])
+    return head + payload + crc24q(head + payload).to_bytes(3, "big")
+
+
 def cmd_slice(args):
     stations = set(args.stations.split(",")) if args.stations else None
+    types = args.types.split(",") if args.types else None
+    parsers = {}
 
     def selected():
@@ -208 +216 @@
             if args.end and t >= args.end:
                 continue
+            if types:
+                # keep only the RTCM3 messages of the given types (or type prefixes)
+                frames = parsers.setdefault(sta, Rtcm3Framer()).feed(data)
+                kept = b"".join(frame(pl) for pl in frames
+                                if any(msg_type(pl).startswith(tt) for tt in types))
+                if not kept:
+                    continue
+                data = kept
             yield t, sta, fmt, data
 
@@ -245 +261 @@
     p.add_argument("--end", help="ISO time, exclusive")
     p.add_argument("--stations", help="comma separated staIDs to keep")
+    p.add_argument("--types", help="comma separated RTCM3 message types or prefixes to keep, "
+                                   "e.g. 1019,4076_02 (GPS ephemerides and IGS-SSR GPS messages)")
     p.set_defaults(func=cmd_slice)
 

trunk/BNC/tests/tools/fakecaster.py

@@ -15 +15 @@
 additionally requires a client certificate signed by that CA. With --serve
 a GET request (BNC as Ntrip client) is answered with the RTCM bytes of the
-given raw file. Failed TLS handshakes are reported on stdout.
+given raw file. With --reply an upload is answered with this text instead
+of the 200 status (e.g. a rejection), and the connection is closed. Failed
+TLS handshakes are reported on stdout.
 """
 
@@ -55 +57 @@
         self.total = 0
         self.handshakes = 0
+        self.rejected = 0
         self.served = 0
 
@@ -67 +70 @@
 
 
-def serve(conn, store, timeout, tls=None, served=None):
+def serve(conn, store, timeout, tls=None, served=None, reply=None):
     conn.settimeout(timeout)
     buf = b""
@@ -89 +92 @@
                          b"Content-Type: gnss/data\r\nConnection: close\r\n\r\n" + served)
             store.served += len(served)
+            return
+        if reply is not None:
+            conn.sendall(reply)
+            store.rejected += 1
             return
         if header.startswith(b"SOURCE"):
@@ -127 +134 @@
     ap.add_argument("--tls-client-ca", help="require a client certificate of this CA")
     ap.add_argument("--serve", help="raw file whose RTCM bytes are sent on GET")
+    ap.add_argument("--reply", help="answer to uploads instead of 200 ('\\r\\n' escapes allowed)")
     args = ap.parse_args()
 
@@ -136 +144 @@
             tls.verify_mode = ssl.CERT_REQUIRED
             tls.load_verify_locations(args.tls_client_ca)
+    reply = None
+    if args.reply is not None:
+        reply = args.reply.encode("latin-1").decode("unicode_escape").encode("latin-1")
     served = None
     if args.serve:
@@ -155 +166 @@
         except socket.timeout:
             break
-        t = threading.Thread(target=serve, args=(conn, store, args.timeout, tls, served),
+        t = threading.Thread(target=serve, args=(conn, store, args.timeout, tls, served, reply),
                              daemon=True)
         t.start()
@@ -166 +177 @@
     if served is not None:
         print("served %d bytes" % store.served, flush=True)
+    if reply is not None:
+        print("%d upload(s) answered with --reply" % store.rejected, flush=True)
     return 0
 

trunk/BNC/tests/tools/mkcrafted.py

@@ -6 +6 @@
   CRAFT0IGS0  IGS-SSR VTEC (4076/201), decoded by SsrCorrIgs, followed by
               RTCM 1300/1301/1302 with 31-character names (BNC's RTCM scan
-              lists them only for streams that also decode successfully)
+              lists them only for streams that also decode successfully);
+              in the first epoch also two RTCM 1033 (antenna and receiver
+              descriptors): a complete one and one whose receiver descriptor
+              length (200) runs beyond the end of the message
   CRAFT0RTC0  RTCM-SSR VTEC (1264), decoded by SsrCorrRtcm
   CRAFT0NEW0  new RTCM-SSR metadata (60), not dispatched by BNC at present;
@@ -12 +15 @@
                 - 7 entries (maximum), additional parameter of 40 and 0 bits
                 - 31 entries (5-bit count, more than META_MAXNUMENTRIES=7)
+              and satellite antenna messages (DF+010-DF+021):
+                - BDS (83): C01, C17, C33, C49, C64 (mask bits in all four
+                  16-bit quarters of DF394), individual blocks
+                - GPS (80): G01, G02, G32 sharing one block and one frequency
+                  block; nadir angle corrections incl. the invalid value
 
 VTEC epochs (every 5 s):
@@ -22 +30 @@
 by eye; the heights are 100 km * layer number.
 
+With --rawfile, a raw file with hostile chunk headers is written instead
+(test of the raw file reader, data/crafted_rawfile.raw):
+  ../ESCAPE0  station ID with a path: RTCM-SSR VTEC whose .ssr file must be
+              written inside the output directory
+  CRAFT0RTC0  RTCM-SSR VTEC, 5 s later
+  then a chunk header announcing 2000000000 bytes, which must be rejected
+
 Usage: mkcrafted.py <out.raw>
+       mkcrafted.py --rawfile <out.raw>
 """
 
@@ -140 +156 @@
 
 
+def descriptors(strings, truncate=False):
+    """RTCM 1033: antenna, setup ID, serial, receiver, firmware, serial."""
+    w = BitWriter()
+    w.u(1033, 12)
+    w.u(0, 12)               # reference station ID
+    ant, antser, rec, firm, recser = strings
+    w.text(ant, 8)
+    w.u(0, 8)                # antenna setup ID
+    w.text(antser, 8)
+    if truncate:
+        w.u(200, 8)          # receiver descriptor length beyond the message
+        for c in rec.encode("ascii"):
+            w.u(c, 8)
+    else:
+        w.text(rec, 8)
+        w.text(firm, 8)
+        w.text(recser, 8)
+    return frame(w.payload())
+
+
 def metadata(entries):
     """entries: list of None (default model) or number of additional bits."""
@@ -163 +199 @@
 
 
+def antenna(msg, sats, shared, nadir):
+    """Satellite antenna message; sats: PRNs (1..64) of the mask."""
+    w = BitWriter()
+    w.u(msg, 12)
+    w.u(4711, 16)            # provider ID
+    w.u(5, 6)                # satellite antenna IOD
+    w.u(1, 1)                # phase center information
+    w.u(0, 1)                # group delay information
+    w.u(1, 1)                # nadir angle dependent corrections follow
+    w.u(3, 5)                # maximum off-nadir angle: corrections 0..3 deg
+    w.u(1, 4)                # range extension: 3 + 1 = 4 bits
+    w.u(shared, 1)           # satellite set indicator
+    mask = 0
+    for prn in sats:
+        mask |= 1 << (64 - prn)
+    w.u(mask, 64)
+    for n in range(1 if shared else len(sats)):
+        w.u(shared, 1)       # frequency set indicator
+        w.u(0b101000, 6)     # frequencies 0 and 2
+        for f in range(1 if shared else 2):
+            w.u(1, 1)        # nadir correction follows
+            w.s(100 * n + 10 * f + 1, 12)    # mm
+            for deg in range(4):
+                w.s(nadir[(n + f + deg) % len(nadir)], 4)   # mm, -8: invalid
+    return frame(w.payload())
+
+
+def rawfile(path):
+    chunks = []
+    for i, sta in enumerate(["../ESCAPE0", "CRAFT0RTC0"]):
+        t = T0 + datetime.timedelta(seconds=5 * i)
+        chunks.append((t.isoformat(), sta, "RTCM_3", vtec_rtcm(t, [(2, 2)])))
+    write_chunks(path, chunks)
+    t = T0 + datetime.timedelta(seconds=10)
+    with open(path, "ab") as o:
+        o.write(("%s CRAFT0RTC0 RTCM_3 2000000000\n" % t.isoformat()).encode())
+        o.write(vtec_rtcm(t, [(2, 2)]) + b"\n")
+
+
 def main():
+    if len(sys.argv) == 3 and sys.argv[1] == "--rawfile":
+        rawfile(sys.argv[2])
+        return
     if len(sys.argv) != 2:
         sys.exit(__doc__)
@@ -175 +253 @@
         t = T0 + datetime.timedelta(seconds=5 * i)
         stamp = t.isoformat()
-        chunks.append((stamp, "CRAFT0IGS0", "RTCM_3", vtec_igs(t, layers)
-                       + service_crs() + helmert() + rtcm_crs()))
+        data = vtec_igs(t, layers) + service_crs() + helmert() + rtcm_crs()
+        if i == 0:
+            data += descriptors(["LEIAR25.R4      LEIT", "12345", "SEPT POLARX5",
+                                 "5.5.0", "3001234"])
+            data += descriptors(["TRUNCATED ANTENNA", "9", "RECEIVER", "", ""],
+                                truncate=True)
+        chunks.append((stamp, "CRAFT0IGS0", "RTCM_3", data))
         chunks.append((stamp, "CRAFT0RTC0", "RTCM_3", vtec_rtcm(t, layers)))
     stamp = (T0 + datetime.timedelta(seconds=15)).isoformat()
     chunks.append((stamp, "CRAFT0NEW0", "RTCM_3",
-                   metadata([40, 0] + [None] * 5) + metadata([None] * 31)))
+                   metadata([40, 0] + [None] * 5) + metadata([None] * 31)
+                   + antenna(83, [1, 17, 33, 49, 64], 0, [-7, 0, 7, 3])
+                   + antenna(80, [1, 2, 32], 1, [5, -8, -1, 2])))
     write_chunks(sys.argv[1], chunks)
 

trunk/BNC/tests/tools/ssr_harness.cpp

@@ -7 +7 @@
 // reported by AddressSanitizer instead of silently corrupting the next member.
 //
-// Every decoded VTEC (all formats) and metadata message (new RTCM-SSR) is
-// encoded again with the Make* function of the same class and decoded once
-// more; the result must be identical (exit code 1 otherwise).
+// Every decoded VTEC (all formats), metadata and satellite antenna message
+// (new RTCM-SSR) is encoded again with the Make* function of the same class
+// and decoded once more; the result must be identical, for the antenna
+// messages also the bytes of the frame (exit code 1 otherwise).
 //
 // Usage: ssr_harness <file>   (BNC raw file or plain RTCM3 byte stream)
@@ -96 +97 @@
   int irc = t1.decode(ssr, frame, size);
   printf("  %-8s irc %3d", name, irc);
+  SsrCorrRtcmNew* rtcmNew = dynamic_cast<SsrCorrRtcmNew*>(ssr);
   if (irc >= 0 && t1.v->NumLayers) {
     double sum = 0.0;
@@ -125 +127 @@
       }
     }
-    SsrCorrRtcmNew* rtcmNew = dynamic_cast<SsrCorrRtcmNew*>(ssr);
     if (rtcmNew) {
       char buffer[CLOCKORBIT_BUFFERSIZE];
@@ -134 +135 @@
       nFailed += !ok;
     }
+  }
+  for (unsigned s = 0; rtcmNew && irc >= 0 && s < CLOCKORBIT_SATNUM; s++) {
+    if (!t1.a->SatelliteMask[s]) {
+      continue;
+    }
+    printf("  ANT type %u mask %016llx", t1.a->messageType[s],
+           (unsigned long long)t1.a->SatelliteMask[s]);
+    char buffer[CLOCKORBIT_BUFFERSIZE];
+    size_t len = rtcmNew->MakeAntenna(t1.a, t1.a->messageType[s], buffer, sizeof(buffer));
+    t_target t2;
+    bool sameBytes = len == size && memcmp(buffer, frame, size) == 0;
+    bool ok = len > 0 && t2.decode(ssr, (const unsigned char*)buffer, len) >= 0 &&
+              memcmp(t1.a, t2.a, sizeof(*t1.a)) == 0;
+    printf("  re-encoded: %s, %s", ok ? "identical" : "DIFFERENT",
+           sameBytes ? "same bytes" : "OTHER BYTES");
+    nFailed += !ok || !sameBytes;
   }
   printf("\n");