1 #!/bin/bash
2 # SPDX-License-Identifier: GPL-2.0
3 #
4 # By Seth Schoen (c) 2021, for the IPv4 Unicast Extensions Project
5 # Thanks to David Ahern for help and advice on nettest modifications.
6 #
7 # Self-tests for IPv4 address extensions: the kernel's ability to accept
8 # certain traditionally unused or unallocated IPv4 addresses. For each kind
9 # of address, we test for interface assignment, ping, TCP, and forwarding.
10 # Must be run as root (to manipulate network namespaces and virtual
11 # interfaces).
12 #
13 # Things we test for here:
14 #
15 # * Currently the kernel accepts addresses in 0/8 and 240/4 as valid.
16 #
17 # * Notwithstanding that, 0.0.0.0 and 255.255.255.255 cannot be assigned.
18 #
19 # * Currently the kernel DOES NOT accept unicast use of the lowest
20 # address in an IPv4 subnet (e.g. 192.168.100.0/32 in 192.168.100.0/24).
21 # This is treated as a second broadcast address, for compatibility
22 # with 4.2BSD (!).
23 #
24 # * Currently the kernel DOES NOT accept unicast use of any of 127/8.
25 #
26 # * Currently the kernel DOES NOT accept unicast use of any of 224/4.
27 #
28 # These tests provide an easy way to flip the expected result of any
29 # of these behaviors for testing kernel patches that change them.
30
31 source lib.sh
32
33 check_gen_prog "nettest"
34
35 result=0
36
37 hide_output(){ exec 3>&1 4>&2 >/dev/null 2>/dev/null; }
38 show_output(){ exec >&3 2>&4; }
39
40 show_result(){
41 if [ $1 -eq 0 ]; then
42 printf "TEST: %-60s [ OK ]\n" "${2}"
43 else
44 printf "TEST: %-60s [FAIL]\n" "${2}"
45 result=1
46 fi
47 }
48
49 _do_segmenttest(){
50 # Perform a simple set of link tests between a pair of
51 # IP addresses on a shared (virtual) segment, using
52 # ping and nettest.
53 # foo --- bar
54 # Arguments: ip_a ip_b prefix_length test_description
55 #
56 # Caller must set up $foo_ns and $bar_ns namespaces
57 # containing linked veth devices foo and bar,
58 # respectively.
59
60 ip -n $foo_ns address add $1/$3 dev foo || return 1
61 ip -n $foo_ns link set foo up || return 1
62 ip -n $bar_ns address add $2/$3 dev bar || return 1
63 ip -n $bar_ns link set bar up || return 1
64
65 ip netns exec $foo_ns timeout 2 ping -c 1 $2 || return 1
66 ip netns exec $bar_ns timeout 2 ping -c 1 $1 || return 1
67
68 nettest -B -N $bar_ns -O $foo_ns -r $1 || return 1
69 nettest -B -N $foo_ns -O $bar_ns -r $2 || return 1
70
71 return 0
72 }
73
74 _do_route_test(){
75 # Perform a simple set of gateway tests.
76 #
77 # [foo] <---> [foo1]-[bar1] <---> [bar] /prefix
78 # host gateway host
79 #
80 # Arguments: foo_ip foo1_ip bar1_ip bar_ip prefix_len test_description
81 # Displays test result and returns success or failure.
82
83 # Caller must set up $foo_ns, $bar_ns, and $router_ns
84 # containing linked veth devices foo-foo1, bar1-bar
85 # (foo in $foo_ns, foo1 and bar1 in $router_ns, and
86 # bar in $bar_ns).
87
88 ip -n $foo_ns address add $1/$5 dev foo || return 1
89 ip -n $foo_ns link set foo up || return 1
90 ip -n $foo_ns route add default via $2 || return 1
91 ip -n $bar_ns address add $4/$5 dev bar || return 1
92 ip -n $bar_ns link set bar up || return 1
93 ip -n $bar_ns route add default via $3 || return 1
94 ip -n $router_ns address add $2/$5 dev foo1 || return 1
95 ip -n $router_ns link set foo1 up || return 1
96 ip -n $router_ns address add $3/$5 dev bar1 || return 1
97 ip -n $router_ns link set bar1 up || return 1
98
99 echo 1 | ip netns exec $router_ns tee /proc/sys/net/ipv4/ip_forward
100
101 ip netns exec $foo_ns timeout 2 ping -c 1 $2 || return 1
102 ip netns exec $foo_ns timeout 2 ping -c 1 $4 || return 1
103 ip netns exec $bar_ns timeout 2 ping -c 1 $3 || return 1
104 ip netns exec $bar_ns timeout 2 ping -c 1 $1 || return 1
105
106 nettest -B -N $bar_ns -O $foo_ns -r $1 || return 1
107 nettest -B -N $foo_ns -O $bar_ns -r $4 || return 1
108
109 return 0
110 }
111
112 segmenttest(){
113 # Sets up veth link and tries to connect over it.
114 # Arguments: ip_a ip_b prefix_len test_description
115 hide_output
116 setup_ns foo_ns bar_ns
117 ip link add foo netns $foo_ns type veth peer name bar netns $bar_ns
118
119 test_result=0
120 _do_segmenttest "$@" || test_result=1
121
122 ip netns pids $foo_ns | xargs -r kill -9
123 ip netns pids $bar_ns | xargs -r kill -9
124 cleanup_ns $foo_ns $bar_ns
125 show_output
126
127 # inverted tests will expect failure instead of success
128 [ -n "$expect_failure" ] && test_result=`expr 1 - $test_result`
129
130 show_result $test_result "$4"
131 }
132
133 route_test(){
134 # Sets up a simple gateway and tries to connect through it.
135 # [foo] <---> [foo1]-[bar1] <---> [bar] /prefix
136 # Arguments: foo_ip foo1_ip bar1_ip bar_ip prefix_len test_description
137 # Returns success or failure.
138
139 hide_output
140 setup_ns foo_ns bar_ns router_ns
141 ip link add foo netns $foo_ns type veth peer name foo1 netns $router_ns
142 ip link add bar netns $bar_ns type veth peer name bar1 netns $router_ns
143
144 test_result=0
145 _do_route_test "$@" || test_result=1
146
147 ip netns pids $foo_ns | xargs -r kill -9
148 ip netns pids $bar_ns | xargs -r kill -9
149 ip netns pids $router_ns | xargs -r kill -9
150 cleanup_ns $foo_ns $bar_ns $router_ns
151
152 show_output
153
154 # inverted tests will expect failure instead of success
155 [ -n "$expect_failure" ] && test_result=`expr 1 - $test_result`
156 show_result $test_result "$6"
157 }
158
159 echo "###########################################################################"
160 echo "Unicast address extensions tests (behavior of reserved IPv4 addresses)"
161 echo "###########################################################################"
162 #
163 # Test support for 240/4
164 segmenttest 240.1.2.1 240.1.2.4 24 "assign and ping within 240/4 (1 of 2) (is allowed)"
165 segmenttest 250.100.2.1 250.100.30.4 16 "assign and ping within 240/4 (2 of 2) (is allowed)"
166 #
167 # Test support for 0/8
168 segmenttest 0.1.2.17 0.1.2.23 24 "assign and ping within 0/8 (1 of 2) (is allowed)"
169 segmenttest 0.77.240.17 0.77.2.23 16 "assign and ping within 0/8 (2 of 2) (is allowed)"
170 #
171 # Even 255.255/16 is OK!
172 segmenttest 255.255.3.1 255.255.50.77 16 "assign and ping inside 255.255/16 (is allowed)"
173 #
174 # Or 255.255.255/24
175 segmenttest 255.255.255.1 255.255.255.254 24 "assign and ping inside 255.255.255/24 (is allowed)"
176 #
177 # Routing between different networks
178 route_test 240.5.6.7 240.5.6.1 255.1.2.1 255.1.2.3 24 "route between 240.5.6/24 and 255.1.2/24 (is allowed)"
179 route_test 0.200.6.7 0.200.38.1 245.99.101.1 245.99.200.111 16 "route between 0.200/16 and 245.99/16 (is allowed)"
180 #
181 # Test support for lowest address ending in .0
182 segmenttest 5.10.15.20 5.10.15.0 24 "assign and ping lowest address (/24)"
183 #
184 # Test support for lowest address not ending in .0
185 segmenttest 192.168.101.192 192.168.101.193 26 "assign and ping lowest address (/26)"
186 #
187 # Routing using lowest address as a gateway/endpoint
188 route_test 192.168.42.1 192.168.42.0 9.8.7.6 9.8.7.0 24 "routing using lowest address"
189 #
190 # ==============================================
191 # ==== TESTS THAT CURRENTLY EXPECT FAILURE =====
192 # ==============================================
193 expect_failure=true
194 # It should still not be possible to use 0.0.0.0 or 255.255.255.255
195 # as a unicast address. Thus, these tests expect failure.
196 segmenttest 0.0.1.5 0.0.0.0 16 "assigning 0.0.0.0 (is forbidden)"
197 segmenttest 255.255.255.1 255.255.255.255 16 "assigning 255.255.255.255 (is forbidden)"
198 #
199 # Test support for not having all of 127 be loopback
200 # Currently Linux does not allow this, so this should fail too
201 segmenttest 127.99.4.5 127.99.4.6 16 "assign and ping inside 127/8 (is forbidden)"
202 #
203 # Test support for unicast use of class D
204 # Currently Linux does not allow this, so this should fail too
205 segmenttest 225.1.2.3 225.1.2.200 24 "assign and ping class D address (is forbidden)"
206 #
207 # Routing using class D as a gateway
208 route_test 225.1.42.1 225.1.42.2 9.8.7.6 9.8.7.1 24 "routing using class D (is forbidden)"
209 #
210 # Routing using 127/8
211 # Currently Linux does not allow this, so this should fail too
212 route_test 127.99.2.3 127.99.2.4 200.1.2.3 200.1.2.4 24 "routing using 127/8 (is forbidden)"
213 #
214 unset expect_failure
215 # =====================================================
216 # ==== END OF TESTS THAT CURRENTLY EXPECT FAILURE =====
217 # =====================================================
218 exit ${result}
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.