fwdmachine: drop a packet when its callback raises

scapy/fwdmachine.py

@@ -518,7 +518,7 @@ def cb_sni(sock, server_name, _):
                         thissock.send(ex.data)
                         self.vprint(self.ANSWER, ctx, cs, data, ex.data)
                     except Exception as ex:
-                        # Processing failed. forward to not break anything
+                        # Processing failed. Drop the packet.
                         self.vprint(
                             self.ERROR,
                             ctx,
@@ -527,8 +527,7 @@ def cb_sni(sock, server_name, _):
                             None,
                         )
                         traceback.print_exception(ex)
-                        othersock.send(data)
-                        self.vprint(self.FORWARD, ctx, cs, data, None)
+                        self.vprint(self.DROP, ctx, cs, data, None)
         except RuntimeError:
             print(self.ct.red("%s DISCONNECTED !" % repr(addr)))
             self.delconn(ctx)

test/scapy/layers/http.uts

@@ -239,6 +239,53 @@ raw_pkt = raw(pkt)
 raw_pkt
 assert raw_pkt == b'\x00P\x00P\x00\x00\x00\x00\x00\x00\x00\x00P\x02 \x00\x00\x00\x00\x00GET /download HTTP/1.1\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-US,en;q=0.5\r\nCache-Control: max-age=0\r\nConnection: keep-alive\r\nContent-Length: 0\r\nHost: scapy.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0\r\n\r\n'
 
+= ForwardMachine drops a packet when its policy callback fails
+~ http
+
+from unittest.mock import patch
+from scapy.fwdmachine import ForwardMachine
+from scapy.layers.http import HTTP
+from scapy.themes import DefaultTheme
+
+class _ForwardSocket:
+    def __init__(self, packet=None):
+        self.packet = packet
+        self.sent = []
+        self.streamsession = {}
+    def recv(self, size):
+        return self.packet
+    def send(self, packet):
+        self.sent.append(packet)
+    def close(self):
+        pass
+
+class _FailingPolicy(ForwardMachine):
+    def __init__(self, peer):
+        self.peer = peer
+        self.tls = False
+        self.sockcls = lambda sock, cls: sock
+        self.cls = HTTP
+        self.MTU = 65535
+        self.ct = DefaultTheme()
+    def _getpeersock(self, dest, ctx, server_hostname=None):
+        return self.peer
+    def xfrmcs(self, pkt, ctx):
+        raise ValueError("policy rejected malformed input")
+    def vprint(self, *args):
+        pass
+
+packet = HTTP(b"PATCH /blocked HTTP/1.1\r\nHost: example\r\n\r\n")
+client = _ForwardSocket(packet)
+peer = _ForwardSocket()
+machine = _FailingPolicy(peer)
+with patch(
+    "scapy.fwdmachine.select.select",
+    side_effect=[([client], [], []), RuntimeError()],
+), patch("scapy.fwdmachine.traceback.print_exception"):
+    machine.handler(client, ("127.0.0.1", 1), ("127.0.0.1", 2))
+
+assert peer.sent == []
+
 = HTTP 1.1 -> HTTP 2.0 Upgrade (h2c)
 ~ Test h2c