Skip to content

Commit

Permalink
[cli] add cli toggle (for test harness) to accept tmf udp messages fr…
Browse files Browse the repository at this point in the history
…om unknown origins

Reference devices that are part of the Thread test harness construct CoAP packets sent on TMF port 61631 for certain tests, for example in the 5.9.x series where they have to force address errors (a/ae) for duplicate DUA or re-registration tests. These tests started to fail when reference device firmware was updated recently to a newer OpenThread stack that included the change in openthread#9437.

Example:
```
udp send fd00:db9:0:0:0:ff:fe00:5000 61631 -x 4102d63697b16e02646eff0401010010fd007d037d037d0389c3a350cdcf36e0'
Ip6-----------: Dropping TMF message from untrusted origin
```

For certification purposes, we are adding a cli toggle (for reference devices) to disable the filter that drops TMF messages from unknown origins.
  • Loading branch information
suveshpratapa committed Apr 18, 2024
1 parent be7d36e commit 5cb642c
Show file tree
Hide file tree
Showing 7 changed files with 137 additions and 3 deletions.
2 changes: 1 addition & 1 deletion include/openthread/instance.h
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ extern "C" {
* @note This number versions both OpenThread platform and user APIs.
*
*/
#define OPENTHREAD_API_VERSION (404)
#define OPENTHREAD_API_VERSION (405)

/**
* @addtogroup api-instance
Expand Down
29 changes: 29 additions & 0 deletions include/openthread/thread_ftd.h
Original file line number Diff line number Diff line change
Expand Up @@ -851,6 +851,35 @@ void otThreadSetCcmEnabled(otInstance *aInstance, bool aEnabled);
*/
void otThreadSetThreadVersionCheckEnabled(otInstance *aInstance, bool aEnabled);

/**
* Sets whether the filter to drop TMF UDP messages from untrusted origin is enabled.
*
* TMF messages are only trusted when they originate from a trusted source, such as the Thread interface. In
* special cases, such as when a device uses platform UDP socket to send TMF messages, they will be dropped due
* to untrusted origin. This filter is enabled by default.
*
* When this filter is disabled, UDP messages sent to the TMF port that originate from untrusted origin (such as
* host, CLI or an external IPv6 node) will be allowed.
*
* @note This API requires `OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE` and is only used by Thread Test Harness
* to test network behavior by sending special TMF messages from the CLI on a POSIX host.
*
* @param[in] aInstance A pointer to an OpenThread instance.
* @param[in] aEnabled TRUE to enable filter, FALSE otherwise.
*
*/
void otThreadSetTmfOriginFilterEnabled(otInstance *aInstance, bool aEnabled);

/**
* Indicates whether the filter that drops TMF UDP messages from untrusted origin is enabled or not.
*
* This is intended for testing only and available when `OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE` config is enabled.
*
* @returns TRUE if the filter is enabled, FALSE otherwise.
*
*/
bool otThreadIsTmfOriginFilterEnabled(otInstance *aInstance);

/**
* Gets the range of router IDs that are allowed to assign to nodes within the thread network.
*
Expand Down
35 changes: 34 additions & 1 deletion src/cli/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -123,6 +123,7 @@ Done
- [tcp](README_TCP.md)
- [thread](#thread-start)
- [timeinqueue](#timeinqueue)
- [tmforiginfilter](#tmforiginfilter-enabledisable)
- [trel](#trel)
- [tvcheck](#tvcheck-enable)
- [txpower](#txpower)
Expand Down Expand Up @@ -3728,6 +3729,38 @@ Reset the TX queue time-in-queue statistics.
Done
```
### tmforiginfilter \[enable|disable\]
Enable/disable filter that drops UDP messages sent to the TMF port from untrusted origin. Also get the current state of the filter if no argument is specified.
Note: This filter is enabled by default.
This is intended for testing only. `OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE` is required.
Get the current state of the filter.
```
> tmforiginfilter
Enabled
```
Enable or disable the filter.
```
> tmforiginfilter enable
Done
>
> tmforiginfilter
Enabled
>
> tmforiginfilter disable
Done
>
> tmforiginfilter
Disabled
>
```
### trel
Indicate whether TREL radio operation is enabled or not.
Expand Down Expand Up @@ -3821,7 +3854,7 @@ Done
### tvcheck disable
Enable thread version check when upgrading to router or leader.
Disable thread version check when upgrading to router or leader.
Note: Thread version check is enabled by default.
Expand Down
31 changes: 31 additions & 0 deletions src/cli/cli.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -1251,6 +1251,34 @@ template <> otError Interpreter::Process<Cmd("ccm")>(Arg aArgs[])
return ProcessEnableDisable(aArgs, otThreadSetCcmEnabled);
}

/**
* @cli tmforiginfilter
* @code
* tmforiginfilter
* Enabled
* @endcode
* @par
* @code
* tmforiginfilter enable
* Done
* @endcode
* @code
* tmforiginfilter disable
* Done
* @endcode
* @par
* @cparam tmforiginfilter [@ca{enable|disable}]
* By default the filter that drops TMF UDP messages from untrusted origin
* is enabled. When disabled, UDP messages sent to the TMF port that originate
* from untrusted origin (such as host, CLI or an external IPv6 node) will be
* allowed.
* @note `OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE` is required.
*/
template <> otError Interpreter::Process<Cmd("tmforiginfilter")>(Arg aArgs[])
{
return ProcessEnableDisable(aArgs, otThreadIsTmfOriginFilterEnabled, otThreadSetTmfOriginFilterEnabled);
}

/**
* @cli tvcheck (enable,disable)
* @code
Expand Down Expand Up @@ -8702,6 +8730,9 @@ otError Interpreter::ProcessCommand(Arg aArgs[])
#if OPENTHREAD_CONFIG_TX_QUEUE_STATISTICS_ENABLE
CmdEntry("timeinqueue"),
#endif
#if OPENTHREAD_FTD && OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE
CmdEntry("tmforiginfilter"),
#endif
#if OPENTHREAD_CONFIG_RADIO_LINK_TREL_ENABLE
CmdEntry("trel"),
#endif
Expand Down
10 changes: 10 additions & 0 deletions src/core/api/thread_ftd_api.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -388,6 +388,16 @@ void otThreadSetThreadVersionCheckEnabled(otInstance *aInstance, bool aEnabled)
AsCoreType(aInstance).Get<Mle::MleRouter>().SetThreadVersionCheckEnabled(aEnabled);
}

void otThreadSetTmfOriginFilterEnabled(otInstance *aInstance, bool aEnabled)
{
AsCoreType(aInstance).Get<Ip6::Ip6>().SetTmfOriginFilterEnabled(aEnabled);
}

bool otThreadIsTmfOriginFilterEnabled(otInstance *aInstance)
{
return AsCoreType(aInstance).Get<Ip6::Ip6>().IsTmfOriginFilterEnabled();
}

void otThreadGetRouterIdRange(otInstance *aInstance, uint8_t *aMinRouterId, uint8_t *aMaxRouterId)
{
AssertPointerIsNotNull(aMinRouterId);
Expand Down
9 changes: 8 additions & 1 deletion src/core/net/ip6.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,9 @@ RegisterLogModule("Ip6");
Ip6::Ip6(Instance &aInstance)
: InstanceLocator(aInstance)
, mIsReceiveIp6FilterEnabled(false)
#if OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE
, mTmfOriginFilterEnabled(true)
#endif
, mSendQueueTask(aInstance)
, mIcmp(aInstance)
, mUdp(aInstance)
Expand Down Expand Up @@ -1239,7 +1242,11 @@ Error Ip6::HandleDatagram(OwnedPtr<Message> aMessagePtr, bool aIsReassembled)
error = aMessagePtr->Read(aMessagePtr->GetOffset() + Udp::Header::kDestPortFieldOffset, destPort));
destPort = BigEndian::HostSwap16(destPort);

if (destPort == Tmf::kUdpPort)
if (destPort == Tmf::kUdpPort
#if OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE
&& mTmfOriginFilterEnabled
#endif
)
{
LogNote("Dropping TMF message from untrusted origin");
ExitNow(error = kErrorDrop);
Expand Down
24 changes: 24 additions & 0 deletions src/core/net/ip6.hpp
Original file line number Diff line number Diff line change
Expand Up @@ -350,6 +350,26 @@ class Ip6 : public InstanceLocator, private NonCopyable
void ResetBorderRoutingCounters(void) { ClearAllBytes(mBorderRoutingCounters); }
#endif

#if OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE

/**
* Enables or disables the filter that drops TMF UDP messages from untrusted origin.
*
* @param[in] aEnabled TRUE to enable filter, FALSE otherwise.
*
*/
void SetTmfOriginFilterEnabled(bool aEnabled) { mTmfOriginFilterEnabled = aEnabled; }

/**
* Indicates whether the filter that drops TMF UDP messages from untrusted origin is enabled or not.
*
* @returns TRUE if the filter is enabled, FALSE otherwise.
*
*/
bool IsTmfOriginFilterEnabled(void) { return mTmfOriginFilterEnabled; }

#endif // OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE

private:
static constexpr uint8_t kDefaultHopLimit = OPENTHREAD_CONFIG_IP6_HOP_LIMIT_DEFAULT;
static constexpr uint8_t kIp6ReassemblyTimeout = OPENTHREAD_CONFIG_IP6_REASSEMBLY_TIMEOUT;
Expand Down Expand Up @@ -402,6 +422,10 @@ class Ip6 : public InstanceLocator, private NonCopyable

bool mIsReceiveIp6FilterEnabled;

#if OPENTHREAD_CONFIG_REFERENCE_DEVICE_ENABLE
bool mTmfOriginFilterEnabled : 1;
#endif

Callback<otIp6ReceiveCallback> mReceiveIp6DatagramCallback;

#if OPENTHREAD_CONFIG_NAT64_TRANSLATOR_ENABLE
Expand Down

0 comments on commit 5cb642c

Please sign in to comment.