1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 // Copyright (c) 2025 Cloudflare, Inc.
3
4 /* Tests for TCP port sharing (bind bucket reuse). */
5
6 #include <arpa/inet.h>
7 #include <net/if.h>
8 #include <sys/ioctl.h>
9 #include <fcntl.h>
10 #include <sched.h>
11 #include <stdlib.h>
12
13 #include "kselftest_harness.h"
14
15 #define DST_PORT 30000
16 #define SRC_PORT 40000
17
18 struct sockaddr_inet {
19 union {
20 struct sockaddr_storage ss;
21 struct sockaddr_in6 v6;
22 struct sockaddr_in v4;
23 struct sockaddr sa;
24 };
25 socklen_t len;
26 char str[INET6_ADDRSTRLEN + __builtin_strlen("[]:65535") + 1];
27 };
28
29 const int one = 1;
30
disconnect(int fd)31 static int disconnect(int fd)
32 {
33 return connect(fd, &(struct sockaddr){ AF_UNSPEC }, sizeof(struct sockaddr));
34 }
35
getsockname_port(int fd)36 static int getsockname_port(int fd)
37 {
38 struct sockaddr_inet addr = {};
39 int err;
40
41 addr.len = sizeof(addr);
42 err = getsockname(fd, &addr.sa, &addr.len);
43 if (err)
44 return -1;
45
46 switch (addr.sa.sa_family) {
47 case AF_INET:
48 return ntohs(addr.v4.sin_port);
49 case AF_INET6:
50 return ntohs(addr.v6.sin6_port);
51 default:
52 errno = EAFNOSUPPORT;
53 return -1;
54 }
55 }
56
make_inet_addr(int af,const char * ip,__u16 port,struct sockaddr_inet * addr)57 static void make_inet_addr(int af, const char *ip, __u16 port,
58 struct sockaddr_inet *addr)
59 {
60 const char *fmt = "";
61
62 memset(addr, 0, sizeof(*addr));
63
64 switch (af) {
65 case AF_INET:
66 addr->len = sizeof(addr->v4);
67 addr->v4.sin_family = af;
68 addr->v4.sin_port = htons(port);
69 inet_pton(af, ip, &addr->v4.sin_addr);
70 fmt = "%s:%hu";
71 break;
72 case AF_INET6:
73 addr->len = sizeof(addr->v6);
74 addr->v6.sin6_family = af;
75 addr->v6.sin6_port = htons(port);
76 inet_pton(af, ip, &addr->v6.sin6_addr);
77 fmt = "[%s]:%hu";
78 break;
79 }
80
81 snprintf(addr->str, sizeof(addr->str), fmt, ip, port);
82 }
83
FIXTURE(tcp_port_share)84 FIXTURE(tcp_port_share) {};
85
FIXTURE_VARIANT(tcp_port_share)86 FIXTURE_VARIANT(tcp_port_share) {
87 int domain;
88 /* IP to listen on and connect to */
89 const char *dst_ip;
90 /* Primary IP to connect from */
91 const char *src1_ip;
92 /* Secondary IP to connect from */
93 const char *src2_ip;
94 /* IP to bind to in order to block the source port */
95 const char *bind_ip;
96 };
97
FIXTURE_VARIANT_ADD(tcp_port_share,ipv4)98 FIXTURE_VARIANT_ADD(tcp_port_share, ipv4) {
99 .domain = AF_INET,
100 .dst_ip = "127.0.0.1",
101 .src1_ip = "127.1.1.1",
102 .src2_ip = "127.2.2.2",
103 .bind_ip = "127.3.3.3",
104 };
105
FIXTURE_VARIANT_ADD(tcp_port_share,ipv6)106 FIXTURE_VARIANT_ADD(tcp_port_share, ipv6) {
107 .domain = AF_INET6,
108 .dst_ip = "::1",
109 .src1_ip = "2001:db8::1",
110 .src2_ip = "2001:db8::2",
111 .bind_ip = "2001:db8::3",
112 };
113
FIXTURE_SETUP(tcp_port_share)114 FIXTURE_SETUP(tcp_port_share)
115 {
116 int sc;
117
118 ASSERT_EQ(unshare(CLONE_NEWNET), 0);
119 ASSERT_EQ(system("ip link set dev lo up"), 0);
120 ASSERT_EQ(system("ip addr add dev lo 2001:db8::1/32 nodad"), 0);
121 ASSERT_EQ(system("ip addr add dev lo 2001:db8::2/32 nodad"), 0);
122 ASSERT_EQ(system("ip addr add dev lo 2001:db8::3/32 nodad"), 0);
123
124 sc = open("/proc/sys/net/ipv4/ip_local_port_range", O_WRONLY);
125 ASSERT_GE(sc, 0);
126 ASSERT_GT(dprintf(sc, "%hu %hu\n", SRC_PORT, SRC_PORT), 0);
127 ASSERT_EQ(close(sc), 0);
128 }
129
FIXTURE_TEARDOWN(tcp_port_share)130 FIXTURE_TEARDOWN(tcp_port_share) {}
131
132 /* Verify that an ephemeral port becomes available again after the socket
133 * bound to it and blocking it from reuse is closed.
134 */
TEST_F(tcp_port_share,can_reuse_port_after_bind_and_close)135 TEST_F(tcp_port_share, can_reuse_port_after_bind_and_close)
136 {
137 const typeof(variant) v = variant;
138 struct sockaddr_inet addr;
139 int c1, c2, ln, pb;
140
141 /* Listen on <dst_ip>:<DST_PORT> */
142 ln = socket(v->domain, SOCK_STREAM, 0);
143 ASSERT_GE(ln, 0) TH_LOG("socket(): %m");
144 ASSERT_EQ(setsockopt(ln, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)), 0);
145
146 make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr);
147 ASSERT_EQ(bind(ln, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
148 ASSERT_EQ(listen(ln, 2), 0);
149
150 /* Connect from <src1_ip>:<SRC_PORT> */
151 c1 = socket(v->domain, SOCK_STREAM, 0);
152 ASSERT_GE(c1, 0) TH_LOG("socket(): %m");
153 ASSERT_EQ(setsockopt(c1, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &one, sizeof(one)), 0);
154
155 make_inet_addr(v->domain, v->src1_ip, 0, &addr);
156 ASSERT_EQ(bind(c1, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
157
158 make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr);
159 ASSERT_EQ(connect(c1, &addr.sa, addr.len), 0) TH_LOG("connect(%s): %m", addr.str);
160 ASSERT_EQ(getsockname_port(c1), SRC_PORT);
161
162 /* Bind to <bind_ip>:<SRC_PORT>. Block the port from reuse. */
163 pb = socket(v->domain, SOCK_STREAM, 0);
164 ASSERT_GE(pb, 0) TH_LOG("socket(): %m");
165 ASSERT_EQ(setsockopt(pb, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)), 0);
166
167 make_inet_addr(v->domain, v->bind_ip, SRC_PORT, &addr);
168 ASSERT_EQ(bind(pb, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
169
170 /* Try to connect from <src2_ip>:<SRC_PORT>. Expect failure. */
171 c2 = socket(v->domain, SOCK_STREAM, 0);
172 ASSERT_GE(c2, 0) TH_LOG("socket");
173 ASSERT_EQ(setsockopt(c2, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &one, sizeof(one)), 0);
174
175 make_inet_addr(v->domain, v->src2_ip, 0, &addr);
176 ASSERT_EQ(bind(c2, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
177
178 make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr);
179 ASSERT_EQ(connect(c2, &addr.sa, addr.len), -1) TH_LOG("connect(%s)", addr.str);
180 ASSERT_EQ(errno, EADDRNOTAVAIL) TH_LOG("%m");
181
182 /* Unbind from <bind_ip>:<SRC_PORT>. Unblock the port for reuse. */
183 ASSERT_EQ(close(pb), 0);
184
185 /* Connect again from <src2_ip>:<SRC_PORT> */
186 EXPECT_EQ(connect(c2, &addr.sa, addr.len), 0) TH_LOG("connect(%s): %m", addr.str);
187 EXPECT_EQ(getsockname_port(c2), SRC_PORT);
188
189 ASSERT_EQ(close(c2), 0);
190 ASSERT_EQ(close(c1), 0);
191 ASSERT_EQ(close(ln), 0);
192 }
193
194 /* Verify that a socket auto-bound during connect() blocks port reuse after
195 * disconnect (connect(AF_UNSPEC)) followed by an explicit port bind().
196 */
TEST_F(tcp_port_share,port_block_after_disconnect)197 TEST_F(tcp_port_share, port_block_after_disconnect)
198 {
199 const typeof(variant) v = variant;
200 struct sockaddr_inet addr;
201 int c1, c2, ln, pb;
202
203 /* Listen on <dst_ip>:<DST_PORT> */
204 ln = socket(v->domain, SOCK_STREAM, 0);
205 ASSERT_GE(ln, 0) TH_LOG("socket(): %m");
206 ASSERT_EQ(setsockopt(ln, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)), 0);
207
208 make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr);
209 ASSERT_EQ(bind(ln, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
210 ASSERT_EQ(listen(ln, 2), 0);
211
212 /* Connect from <src1_ip>:<SRC_PORT> */
213 c1 = socket(v->domain, SOCK_STREAM, 0);
214 ASSERT_GE(c1, 0) TH_LOG("socket(): %m");
215 ASSERT_EQ(setsockopt(c1, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &one, sizeof(one)), 0);
216
217 make_inet_addr(v->domain, v->src1_ip, 0, &addr);
218 ASSERT_EQ(bind(c1, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
219
220 make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr);
221 ASSERT_EQ(connect(c1, &addr.sa, addr.len), 0) TH_LOG("connect(%s): %m", addr.str);
222 ASSERT_EQ(getsockname_port(c1), SRC_PORT);
223
224 /* Disconnect the socket and bind it to <bind_ip>:<SRC_PORT> to block the port */
225 ASSERT_EQ(disconnect(c1), 0) TH_LOG("disconnect: %m");
226 ASSERT_EQ(setsockopt(c1, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)), 0);
227
228 make_inet_addr(v->domain, v->bind_ip, SRC_PORT, &addr);
229 ASSERT_EQ(bind(c1, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
230
231 /* Trigger port-addr bucket state update with another bind() and close() */
232 pb = socket(v->domain, SOCK_STREAM, 0);
233 ASSERT_GE(pb, 0) TH_LOG("socket(): %m");
234 ASSERT_EQ(setsockopt(pb, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)), 0);
235
236 make_inet_addr(v->domain, v->bind_ip, SRC_PORT, &addr);
237 ASSERT_EQ(bind(pb, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
238
239 ASSERT_EQ(close(pb), 0);
240
241 /* Connect from <src2_ip>:<SRC_PORT>. Expect failure. */
242 c2 = socket(v->domain, SOCK_STREAM, 0);
243 ASSERT_GE(c2, 0) TH_LOG("socket: %m");
244 ASSERT_EQ(setsockopt(c2, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &one, sizeof(one)), 0);
245
246 make_inet_addr(v->domain, v->src2_ip, 0, &addr);
247 ASSERT_EQ(bind(c2, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
248
249 make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr);
250 EXPECT_EQ(connect(c2, &addr.sa, addr.len), -1) TH_LOG("connect(%s)", addr.str);
251 EXPECT_EQ(errno, EADDRNOTAVAIL) TH_LOG("%m");
252
253 ASSERT_EQ(close(c2), 0);
254 ASSERT_EQ(close(c1), 0);
255 ASSERT_EQ(close(ln), 0);
256 }
257
258 TEST_HARNESS_MAIN
259