1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause 2 // Copyright (c) 2025 Cloudflare, Inc. 3 4 /* Tests for TCP port sharing (bind bucket reuse). */ 5 6 #include <arpa/inet.h> 7 #include <net/if.h> 8 #include <sys/ioctl.h> 9 #include <fcntl.h> 10 #include <sched.h> 11 #include <stdlib.h> 12 13 #include "../kselftest_harness.h" 14 15 #define DST_PORT 30000 16 #define SRC_PORT 40000 17 18 struct sockaddr_inet { 19 union { 20 struct sockaddr_storage ss; 21 struct sockaddr_in6 v6; 22 struct sockaddr_in v4; 23 struct sockaddr sa; 24 }; 25 socklen_t len; 26 char str[INET6_ADDRSTRLEN + __builtin_strlen("[]:65535") + 1]; 27 }; 28 29 const int one = 1; 30 31 static int disconnect(int fd) 32 { 33 return connect(fd, &(struct sockaddr){ AF_UNSPEC }, sizeof(struct sockaddr)); 34 } 35 36 static int getsockname_port(int fd) 37 { 38 struct sockaddr_inet addr = {}; 39 int err; 40 41 addr.len = sizeof(addr); 42 err = getsockname(fd, &addr.sa, &addr.len); 43 if (err) 44 return -1; 45 46 switch (addr.sa.sa_family) { 47 case AF_INET: 48 return ntohs(addr.v4.sin_port); 49 case AF_INET6: 50 return ntohs(addr.v6.sin6_port); 51 default: 52 errno = EAFNOSUPPORT; 53 return -1; 54 } 55 } 56 57 static void make_inet_addr(int af, const char *ip, __u16 port, 58 struct sockaddr_inet *addr) 59 { 60 const char *fmt = ""; 61 62 memset(addr, 0, sizeof(*addr)); 63 64 switch (af) { 65 case AF_INET: 66 addr->len = sizeof(addr->v4); 67 addr->v4.sin_family = af; 68 addr->v4.sin_port = htons(port); 69 inet_pton(af, ip, &addr->v4.sin_addr); 70 fmt = "%s:%hu"; 71 break; 72 case AF_INET6: 73 addr->len = sizeof(addr->v6); 74 addr->v6.sin6_family = af; 75 addr->v6.sin6_port = htons(port); 76 inet_pton(af, ip, &addr->v6.sin6_addr); 77 fmt = "[%s]:%hu"; 78 break; 79 } 80 81 snprintf(addr->str, sizeof(addr->str), fmt, ip, port); 82 } 83 84 FIXTURE(tcp_port_share) {}; 85 86 FIXTURE_VARIANT(tcp_port_share) { 87 int domain; 88 /* IP to listen on and connect to */ 89 const char *dst_ip; 90 /* Primary IP to connect from */ 91 const char *src1_ip; 92 /* Secondary IP to connect from */ 93 const char *src2_ip; 94 /* IP to bind to in order to block the source port */ 95 const char *bind_ip; 96 }; 97 98 FIXTURE_VARIANT_ADD(tcp_port_share, ipv4) { 99 .domain = AF_INET, 100 .dst_ip = "127.0.0.1", 101 .src1_ip = "127.1.1.1", 102 .src2_ip = "127.2.2.2", 103 .bind_ip = "127.3.3.3", 104 }; 105 106 FIXTURE_VARIANT_ADD(tcp_port_share, ipv6) { 107 .domain = AF_INET6, 108 .dst_ip = "::1", 109 .src1_ip = "2001:db8::1", 110 .src2_ip = "2001:db8::2", 111 .bind_ip = "2001:db8::3", 112 }; 113 114 FIXTURE_SETUP(tcp_port_share) 115 { 116 int sc; 117 118 ASSERT_EQ(unshare(CLONE_NEWNET), 0); 119 ASSERT_EQ(system("ip link set dev lo up"), 0); 120 ASSERT_EQ(system("ip addr add dev lo 2001:db8::1/32 nodad"), 0); 121 ASSERT_EQ(system("ip addr add dev lo 2001:db8::2/32 nodad"), 0); 122 ASSERT_EQ(system("ip addr add dev lo 2001:db8::3/32 nodad"), 0); 123 124 sc = open("/proc/sys/net/ipv4/ip_local_port_range", O_WRONLY); 125 ASSERT_GE(sc, 0); 126 ASSERT_GT(dprintf(sc, "%hu %hu\n", SRC_PORT, SRC_PORT), 0); 127 ASSERT_EQ(close(sc), 0); 128 } 129 130 FIXTURE_TEARDOWN(tcp_port_share) {} 131 132 /* Verify that an ephemeral port becomes available again after the socket 133 * bound to it and blocking it from reuse is closed. 134 */ 135 TEST_F(tcp_port_share, can_reuse_port_after_bind_and_close) 136 { 137 const typeof(variant) v = variant; 138 struct sockaddr_inet addr; 139 int c1, c2, ln, pb; 140 141 /* Listen on <dst_ip>:<DST_PORT> */ 142 ln = socket(v->domain, SOCK_STREAM, 0); 143 ASSERT_GE(ln, 0) TH_LOG("socket(): %m"); 144 ASSERT_EQ(setsockopt(ln, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)), 0); 145 146 make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr); 147 ASSERT_EQ(bind(ln, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str); 148 ASSERT_EQ(listen(ln, 2), 0); 149 150 /* Connect from <src1_ip>:<SRC_PORT> */ 151 c1 = socket(v->domain, SOCK_STREAM, 0); 152 ASSERT_GE(c1, 0) TH_LOG("socket(): %m"); 153 ASSERT_EQ(setsockopt(c1, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &one, sizeof(one)), 0); 154 155 make_inet_addr(v->domain, v->src1_ip, 0, &addr); 156 ASSERT_EQ(bind(c1, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str); 157 158 make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr); 159 ASSERT_EQ(connect(c1, &addr.sa, addr.len), 0) TH_LOG("connect(%s): %m", addr.str); 160 ASSERT_EQ(getsockname_port(c1), SRC_PORT); 161 162 /* Bind to <bind_ip>:<SRC_PORT>. Block the port from reuse. */ 163 pb = socket(v->domain, SOCK_STREAM, 0); 164 ASSERT_GE(pb, 0) TH_LOG("socket(): %m"); 165 ASSERT_EQ(setsockopt(pb, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)), 0); 166 167 make_inet_addr(v->domain, v->bind_ip, SRC_PORT, &addr); 168 ASSERT_EQ(bind(pb, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str); 169 170 /* Try to connect from <src2_ip>:<SRC_PORT>. Expect failure. */ 171 c2 = socket(v->domain, SOCK_STREAM, 0); 172 ASSERT_GE(c2, 0) TH_LOG("socket"); 173 ASSERT_EQ(setsockopt(c2, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &one, sizeof(one)), 0); 174 175 make_inet_addr(v->domain, v->src2_ip, 0, &addr); 176 ASSERT_EQ(bind(c2, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str); 177 178 make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr); 179 ASSERT_EQ(connect(c2, &addr.sa, addr.len), -1) TH_LOG("connect(%s)", addr.str); 180 ASSERT_EQ(errno, EADDRNOTAVAIL) TH_LOG("%m"); 181 182 /* Unbind from <bind_ip>:<SRC_PORT>. Unblock the port for reuse. */ 183 ASSERT_EQ(close(pb), 0); 184 185 /* Connect again from <src2_ip>:<SRC_PORT> */ 186 EXPECT_EQ(connect(c2, &addr.sa, addr.len), 0) TH_LOG("connect(%s): %m", addr.str); 187 EXPECT_EQ(getsockname_port(c2), SRC_PORT); 188 189 ASSERT_EQ(close(c2), 0); 190 ASSERT_EQ(close(c1), 0); 191 ASSERT_EQ(close(ln), 0); 192 } 193 194 /* Verify that a socket auto-bound during connect() blocks port reuse after 195 * disconnect (connect(AF_UNSPEC)) followed by an explicit port bind(). 196 */ 197 TEST_F(tcp_port_share, port_block_after_disconnect) 198 { 199 const typeof(variant) v = variant; 200 struct sockaddr_inet addr; 201 int c1, c2, ln, pb; 202 203 /* Listen on <dst_ip>:<DST_PORT> */ 204 ln = socket(v->domain, SOCK_STREAM, 0); 205 ASSERT_GE(ln, 0) TH_LOG("socket(): %m"); 206 ASSERT_EQ(setsockopt(ln, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)), 0); 207 208 make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr); 209 ASSERT_EQ(bind(ln, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str); 210 ASSERT_EQ(listen(ln, 2), 0); 211 212 /* Connect from <src1_ip>:<SRC_PORT> */ 213 c1 = socket(v->domain, SOCK_STREAM, 0); 214 ASSERT_GE(c1, 0) TH_LOG("socket(): %m"); 215 ASSERT_EQ(setsockopt(c1, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &one, sizeof(one)), 0); 216 217 make_inet_addr(v->domain, v->src1_ip, 0, &addr); 218 ASSERT_EQ(bind(c1, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str); 219 220 make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr); 221 ASSERT_EQ(connect(c1, &addr.sa, addr.len), 0) TH_LOG("connect(%s): %m", addr.str); 222 ASSERT_EQ(getsockname_port(c1), SRC_PORT); 223 224 /* Disconnect the socket and bind it to <bind_ip>:<SRC_PORT> to block the port */ 225 ASSERT_EQ(disconnect(c1), 0) TH_LOG("disconnect: %m"); 226 ASSERT_EQ(setsockopt(c1, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)), 0); 227 228 make_inet_addr(v->domain, v->bind_ip, SRC_PORT, &addr); 229 ASSERT_EQ(bind(c1, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str); 230 231 /* Trigger port-addr bucket state update with another bind() and close() */ 232 pb = socket(v->domain, SOCK_STREAM, 0); 233 ASSERT_GE(pb, 0) TH_LOG("socket(): %m"); 234 ASSERT_EQ(setsockopt(pb, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)), 0); 235 236 make_inet_addr(v->domain, v->bind_ip, SRC_PORT, &addr); 237 ASSERT_EQ(bind(pb, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str); 238 239 ASSERT_EQ(close(pb), 0); 240 241 /* Connect from <src2_ip>:<SRC_PORT>. Expect failure. */ 242 c2 = socket(v->domain, SOCK_STREAM, 0); 243 ASSERT_GE(c2, 0) TH_LOG("socket: %m"); 244 ASSERT_EQ(setsockopt(c2, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &one, sizeof(one)), 0); 245 246 make_inet_addr(v->domain, v->src2_ip, 0, &addr); 247 ASSERT_EQ(bind(c2, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str); 248 249 make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr); 250 EXPECT_EQ(connect(c2, &addr.sa, addr.len), -1) TH_LOG("connect(%s)", addr.str); 251 EXPECT_EQ(errno, EADDRNOTAVAIL) TH_LOG("%m"); 252 253 ASSERT_EQ(close(c2), 0); 254 ASSERT_EQ(close(c1), 0); 255 ASSERT_EQ(close(ln), 0); 256 } 257 258 TEST_HARNESS_MAIN 259