1#!/bin/bash 2# SPDX-License-Identifier: GPL-2.0 3# 4# By Seth Schoen (c) 2021, for the IPv4 Unicast Extensions Project 5# Thanks to David Ahern for help and advice on nettest modifications. 6# 7# Self-tests for IPv4 address extensions: the kernel's ability to accept 8# certain traditionally unused or unallocated IPv4 addresses. For each kind 9# of address, we test for interface assignment, ping, TCP, and forwarding. 10# Must be run as root (to manipulate network namespaces and virtual 11# interfaces). 12# 13# Things we test for here: 14# 15# * Currently the kernel accepts addresses in 0/8 and 240/4 as valid. 16# 17# * Notwithstanding that, 0.0.0.0 and 255.255.255.255 cannot be assigned. 18# 19# * Currently the kernel DOES NOT accept unicast use of the lowest 20# address in an IPv4 subnet (e.g. 192.168.100.0/32 in 192.168.100.0/24). 21# This is treated as a second broadcast address, for compatibility 22# with 4.2BSD (!). 23# 24# * Currently the kernel DOES NOT accept unicast use of any of 127/8. 25# 26# * Currently the kernel DOES NOT accept unicast use of any of 224/4. 27# 28# These tests provide an easy way to flip the expected result of any 29# of these behaviors for testing kernel patches that change them. 30 31source lib.sh 32 33check_gen_prog "nettest" 34 35result=0 36 37hide_output(){ exec 3>&1 4>&2 >/dev/null 2>/dev/null; } 38show_output(){ exec >&3 2>&4; } 39 40show_result(){ 41 if [ $1 -eq 0 ]; then 42 printf "TEST: %-60s [ OK ]\n" "${2}" 43 else 44 printf "TEST: %-60s [FAIL]\n" "${2}" 45 result=1 46 fi 47} 48 49_do_segmenttest(){ 50 # Perform a simple set of link tests between a pair of 51 # IP addresses on a shared (virtual) segment, using 52 # ping and nettest. 53 # foo --- bar 54 # Arguments: ip_a ip_b prefix_length test_description 55 # 56 # Caller must set up $foo_ns and $bar_ns namespaces 57 # containing linked veth devices foo and bar, 58 # respectively. 59 60 ip -n $foo_ns address add $1/$3 dev foo || return 1 61 ip -n $foo_ns link set foo up || return 1 62 ip -n $bar_ns address add $2/$3 dev bar || return 1 63 ip -n $bar_ns link set bar up || return 1 64 65 ip netns exec $foo_ns timeout 2 ping -c 1 $2 || return 1 66 ip netns exec $bar_ns timeout 2 ping -c 1 $1 || return 1 67 68 nettest -B -N $bar_ns -O $foo_ns -r $1 || return 1 69 nettest -B -N $foo_ns -O $bar_ns -r $2 || return 1 70 71 return 0 72} 73 74_do_route_test(){ 75 # Perform a simple set of gateway tests. 76 # 77 # [foo] <---> [foo1]-[bar1] <---> [bar] /prefix 78 # host gateway host 79 # 80 # Arguments: foo_ip foo1_ip bar1_ip bar_ip prefix_len test_description 81 # Displays test result and returns success or failure. 82 83 # Caller must set up $foo_ns, $bar_ns, and $router_ns 84 # containing linked veth devices foo-foo1, bar1-bar 85 # (foo in $foo_ns, foo1 and bar1 in $router_ns, and 86 # bar in $bar_ns). 87 88 ip -n $foo_ns address add $1/$5 dev foo || return 1 89 ip -n $foo_ns link set foo up || return 1 90 ip -n $foo_ns route add default via $2 || return 1 91 ip -n $bar_ns address add $4/$5 dev bar || return 1 92 ip -n $bar_ns link set bar up || return 1 93 ip -n $bar_ns route add default via $3 || return 1 94 ip -n $router_ns address add $2/$5 dev foo1 || return 1 95 ip -n $router_ns link set foo1 up || return 1 96 ip -n $router_ns address add $3/$5 dev bar1 || return 1 97 ip -n $router_ns link set bar1 up || return 1 98 99 echo 1 | ip netns exec $router_ns tee /proc/sys/net/ipv4/ip_forward 100 101 ip netns exec $foo_ns timeout 2 ping -c 1 $2 || return 1 102 ip netns exec $foo_ns timeout 2 ping -c 1 $4 || return 1 103 ip netns exec $bar_ns timeout 2 ping -c 1 $3 || return 1 104 ip netns exec $bar_ns timeout 2 ping -c 1 $1 || return 1 105 106 nettest -B -N $bar_ns -O $foo_ns -r $1 || return 1 107 nettest -B -N $foo_ns -O $bar_ns -r $4 || return 1 108 109 return 0 110} 111 112segmenttest(){ 113 # Sets up veth link and tries to connect over it. 114 # Arguments: ip_a ip_b prefix_len test_description 115 hide_output 116 setup_ns foo_ns bar_ns 117 ip link add foo netns $foo_ns type veth peer name bar netns $bar_ns 118 119 test_result=0 120 _do_segmenttest "$@" || test_result=1 121 122 ip netns pids $foo_ns | xargs -r kill -9 123 ip netns pids $bar_ns | xargs -r kill -9 124 cleanup_ns $foo_ns $bar_ns 125 show_output 126 127 # inverted tests will expect failure instead of success 128 [ -n "$expect_failure" ] && test_result=`expr 1 - $test_result` 129 130 show_result $test_result "$4" 131} 132 133route_test(){ 134 # Sets up a simple gateway and tries to connect through it. 135 # [foo] <---> [foo1]-[bar1] <---> [bar] /prefix 136 # Arguments: foo_ip foo1_ip bar1_ip bar_ip prefix_len test_description 137 # Returns success or failure. 138 139 hide_output 140 setup_ns foo_ns bar_ns router_ns 141 ip link add foo netns $foo_ns type veth peer name foo1 netns $router_ns 142 ip link add bar netns $bar_ns type veth peer name bar1 netns $router_ns 143 144 test_result=0 145 _do_route_test "$@" || test_result=1 146 147 ip netns pids $foo_ns | xargs -r kill -9 148 ip netns pids $bar_ns | xargs -r kill -9 149 ip netns pids $router_ns | xargs -r kill -9 150 cleanup_ns $foo_ns $bar_ns $router_ns 151 152 show_output 153 154 # inverted tests will expect failure instead of success 155 [ -n "$expect_failure" ] && test_result=`expr 1 - $test_result` 156 show_result $test_result "$6" 157} 158 159echo "###########################################################################" 160echo "Unicast address extensions tests (behavior of reserved IPv4 addresses)" 161echo "###########################################################################" 162# 163# Test support for 240/4 164segmenttest 240.1.2.1 240.1.2.4 24 "assign and ping within 240/4 (1 of 2) (is allowed)" 165segmenttest 250.100.2.1 250.100.30.4 16 "assign and ping within 240/4 (2 of 2) (is allowed)" 166# 167# Test support for 0/8 168segmenttest 0.1.2.17 0.1.2.23 24 "assign and ping within 0/8 (1 of 2) (is allowed)" 169segmenttest 0.77.240.17 0.77.2.23 16 "assign and ping within 0/8 (2 of 2) (is allowed)" 170# 171# Even 255.255/16 is OK! 172segmenttest 255.255.3.1 255.255.50.77 16 "assign and ping inside 255.255/16 (is allowed)" 173# 174# Or 255.255.255/24 175segmenttest 255.255.255.1 255.255.255.254 24 "assign and ping inside 255.255.255/24 (is allowed)" 176# 177# Routing between different networks 178route_test 240.5.6.7 240.5.6.1 255.1.2.1 255.1.2.3 24 "route between 240.5.6/24 and 255.1.2/24 (is allowed)" 179route_test 0.200.6.7 0.200.38.1 245.99.101.1 245.99.200.111 16 "route between 0.200/16 and 245.99/16 (is allowed)" 180# 181# Test support for lowest address ending in .0 182segmenttest 5.10.15.20 5.10.15.0 24 "assign and ping lowest address (/24)" 183# 184# Test support for lowest address not ending in .0 185segmenttest 192.168.101.192 192.168.101.193 26 "assign and ping lowest address (/26)" 186# 187# Routing using lowest address as a gateway/endpoint 188route_test 192.168.42.1 192.168.42.0 9.8.7.6 9.8.7.0 24 "routing using lowest address" 189# 190# ============================================== 191# ==== TESTS THAT CURRENTLY EXPECT FAILURE ===== 192# ============================================== 193expect_failure=true 194# It should still not be possible to use 0.0.0.0 or 255.255.255.255 195# as a unicast address. Thus, these tests expect failure. 196segmenttest 0.0.1.5 0.0.0.0 16 "assigning 0.0.0.0 (is forbidden)" 197segmenttest 255.255.255.1 255.255.255.255 16 "assigning 255.255.255.255 (is forbidden)" 198# 199# Test support for not having all of 127 be loopback 200# Currently Linux does not allow this, so this should fail too 201segmenttest 127.99.4.5 127.99.4.6 16 "assign and ping inside 127/8 (is forbidden)" 202# 203# Test support for unicast use of class D 204# Currently Linux does not allow this, so this should fail too 205segmenttest 225.1.2.3 225.1.2.200 24 "assign and ping class D address (is forbidden)" 206# 207# Routing using class D as a gateway 208route_test 225.1.42.1 225.1.42.2 9.8.7.6 9.8.7.1 24 "routing using class D (is forbidden)" 209# 210# Routing using 127/8 211# Currently Linux does not allow this, so this should fail too 212route_test 127.99.2.3 127.99.2.4 200.1.2.3 200.1.2.4 24 "routing using 127/8 (is forbidden)" 213# 214unset expect_failure 215# ===================================================== 216# ==== END OF TESTS THAT CURRENTLY EXPECT FAILURE ===== 217# ===================================================== 218exit ${result} 219