Packet Creation With Python

Date May 26, 2009 by Isaac

I work at a company that designs and builds network routers, so you can imagine that on occasion I need to create custom Ethernet packets for testing.  For hardcore traffic testing we've got some really expensive packet generator hardware that can send packets at full line rate.  For my tests I don't need raw data throughput, but I do need the ability to customize packets.

Just today I found a really great package for Python called Scapy.  With Scapy I can create arbitrary packets with arbitrary values and fire away.  It also supports packet capturing and has all kinds of features.  As I get more comfortable with Scapy I'll post some examples.  In the mean time, those of you who need to inject custom packets for testing into equipment go check it out.

Major Pharmacy Software Bug

Date May 24, 2009 by Isaac

The title sounds somewhat like those spam messages I get.  But, this is a real software bug.  One I would consider serious.

Sometimes the most interesting bugs are discovered by pure accident.  I was picking up a few items at one of the United States major pharmacy chains and discovered a flaw in their software.  But first, let me back up and explain something called IIAS.

Inventory Information Approval System (IIAS) is used (or supposed to be used) by all the grocery stores and drug stores through the USA.  When you go to make a purchase of eligible goods using your Flexible Spending Account (FSA) credit card the IIAS is consulted and the register gets a "yes" or "no" on the item.  If the item is eligible for FSA spending and a FSA card is presented for use then only those items given a thumbs up from IIAS are supposed to be charged to the card.  The remaining items are supposed to be paid for by some other means.

At the end of my little shopping trip to the pharmacy I had some items that I knew were eligible for FSA and some that weren't.  After the cashier scanned all the items I swiped my FSA card.  Here's where the accident happened.  The cashier, obviously unaware of FSA cards or the IIAS, was confused by the message her register was giving her.  So told me the card hadn't worked and asked me to swipe it again.  At this point I had no reason to doubt her, so I swiped my card again.  The sale completed and after a brief moment of confusion I realized what had happened.  IIAS and the FSA card authorization system had failed.

What happened was the first time I swiped my card it had actually worked and only the FSA eligible items had been charged to the card.  The cashier didn't know what happened or why the balance remaining was not zero.  So, she thought the card had failed and asked me to try again.  The second time the system should have recognized the card as FSA and that there were no more items eligible items and should have rejected the card.  It didn't.  It allowed the transaction to continue.

This really isn't a life or death bug, but it really is a nuisance.  I had them reverse the charges on the card and then check my items out again.  This time I swiped a different card the second time and everything was happy.  The irritation would come later if I hadn't had them credit the card back.  I would have been contacted and asked to pay back the card for the non eligible items.

This seems like a test case that should have been run but was missed.  Worse yet, it might have been run and a bug filed but never fixed.  I can only speculate why this behavior was allowed, so allow me to rant a bit about a common problem encountered while bug hunting.

By a show of hands how many testers have ever received the "no one will ever do that" response to a bug filed?  Why on earth would anyone swipe a FSA card twice or when no FSA items are pending payment?

A common push-back I've seen from developers is "our users are smarter than that."  OK, so I work on high technology products and our users should be smarter than that.  When it comes to software I don't think it makes a difference how smart your users are supposed to be.  If there is a flaw in the program sooner or later someone will do something they shouldn't have done and the flaw will show its ugly head.  There are certainly going to be higher priorities in many cases, but a wise tester will know when to push to get these "dumb" bugs fixed.

The Value of Testers

Date April 27, 2009 by Isaac

I am very fortunate indeed to work for a company that truly values test engineers. However, over the years I've seen some places that treat testers as second rate citizens. They are simply a check box on the software (or hardware) development cycle.

A couple years ago I had the privilege of listening to Lee Copeland speak.  I quite enjoyed his talk and in my subsequent study of some of his other material, such as his book A Practitioner's Guide to Software Test Design I have come to really respect and enjoy his knowledge.

One of the greatest resources of all time for a tester is Google Videos. There are so many great videos by professional testers that it is amazing. Anyway, enough of an intro. Here's the video from Lee Copeland.

Buy the book. It's a great resource.

Setting Gmail as the Default Email Application in Linux

Date April 26, 2009 by Isaac

Yesterday I was searching for a way to make GMail my default email provider, so that when I click on "mailto" links GMail opens.  In Windows this is pretty easy, but I couldn't figure it out for Linux.  So, bring on Google search.  I found this web page which explains it succinctly.  While I don't run Ubuntu, the same method worked for Arch Linux.

Essentially:

  1. Go to System->Preferences->Preferred Applications
  2. For "Mail Reader" choose "Custom" and enter this (we'll create the script later):
    /home/username/bin/open_mailto.sh "%s"
  3. The above script will be triggered anytime you click on an email link.  Now, let's create the actual script.  Note: This is a modified script from the above web site.  It is based on some of the comments posted about the artice and then refined a little.  This script will properly handle subject, cc, to, body, and most any proper email tag that you can throw at it.  One other difference is that it can handle parenthesis.
    #!/bin/sh
    uri=`echo "$1"| sed -e 's/subject=/su=/' \
         -e 's/^mailto:\([^&?]\+\)[?&]\?\(.*\)$/\1\&\2/' \
         -e 's/(/%28/g' -e 's/)/%29/g'`
    firefox -remote "openurl(https://mail.google.com/mail?\
    view=cm&tf=0&to=$uri,new-tab)"
  4. Finally, change the mode of the script so that it can execute:
    chmod 755 /home/username/bin/open_mailto.sh

Hopefully that will work for you without problems.  In my tests so far it has worked great.