1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 // Copyright (c) 2023 Cloudflare
3 
4 /* Test IP_LOCAL_PORT_RANGE socket option: IPv4 + IPv6, TCP + UDP.
5  *
6  * Tests assume that net.ipv4.ip_local_port_range is [40000, 49999].
7  * Don't run these directly but with ip_local_port_range.sh script.
8  */
9 
10 #include <fcntl.h>
11 #include <netinet/ip.h>
12 
13 #include "../kselftest_harness.h"
14 
15 #ifndef IP_LOCAL_PORT_RANGE
16 #define IP_LOCAL_PORT_RANGE 51
17 #endif
18 
19 static __u32 pack_port_range(__u16 lo, __u16 hi)
20 {
21 	return (hi << 16) | (lo << 0);
22 }
23 
24 static void unpack_port_range(__u32 range, __u16 *lo, __u16 *hi)
25 {
26 	*lo = range & 0xffff;
27 	*hi = range >> 16;
28 }
29 
30 static int get_so_domain(int fd)
31 {
32 	int domain, err;
33 	socklen_t len;
34 
35 	len = sizeof(domain);
36 	err = getsockopt(fd, SOL_SOCKET, SO_DOMAIN, &domain, &len);
37 	if (err)
38 		return -1;
39 
40 	return domain;
41 }
42 
43 static int bind_to_loopback_any_port(int fd)
44 {
45 	union {
46 		struct sockaddr sa;
47 		struct sockaddr_in v4;
48 		struct sockaddr_in6 v6;
49 	} addr;
50 	socklen_t addr_len;
51 
52 	memset(&addr, 0, sizeof(addr));
53 	switch (get_so_domain(fd)) {
54 	case AF_INET:
55 		addr.v4.sin_family = AF_INET;
56 		addr.v4.sin_port = htons(0);
57 		addr.v4.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
58 		addr_len = sizeof(addr.v4);
59 		break;
60 	case AF_INET6:
61 		addr.v6.sin6_family = AF_INET6;
62 		addr.v6.sin6_port = htons(0);
63 		addr.v6.sin6_addr = in6addr_loopback;
64 		addr_len = sizeof(addr.v6);
65 		break;
66 	default:
67 		return -1;
68 	}
69 
70 	return bind(fd, &addr.sa, addr_len);
71 }
72 
73 static int get_sock_port(int fd)
74 {
75 	union {
76 		struct sockaddr sa;
77 		struct sockaddr_in v4;
78 		struct sockaddr_in6 v6;
79 	} addr;
80 	socklen_t addr_len;
81 	int err;
82 
83 	addr_len = sizeof(addr);
84 	memset(&addr, 0, sizeof(addr));
85 	err = getsockname(fd, &addr.sa, &addr_len);
86 	if (err)
87 		return -1;
88 
89 	switch (addr.sa.sa_family) {
90 	case AF_INET:
91 		return ntohs(addr.v4.sin_port);
92 	case AF_INET6:
93 		return ntohs(addr.v6.sin6_port);
94 	default:
95 		errno = EAFNOSUPPORT;
96 		return -1;
97 	}
98 }
99 
100 static int get_ip_local_port_range(int fd, __u32 *range)
101 {
102 	socklen_t len;
103 	__u32 val;
104 	int err;
105 
106 	len = sizeof(val);
107 	err = getsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &val, &len);
108 	if (err)
109 		return -1;
110 
111 	*range = val;
112 	return 0;
113 }
114 
115 FIXTURE(ip_local_port_range) {};
116 
117 FIXTURE_SETUP(ip_local_port_range)
118 {
119 }
120 
121 FIXTURE_TEARDOWN(ip_local_port_range)
122 {
123 }
124 
125 FIXTURE_VARIANT(ip_local_port_range) {
126 	int so_domain;
127 	int so_type;
128 	int so_protocol;
129 };
130 
131 FIXTURE_VARIANT_ADD(ip_local_port_range, ip4_tcp) {
132 	.so_domain	= AF_INET,
133 	.so_type	= SOCK_STREAM,
134 	.so_protocol	= 0,
135 };
136 
137 FIXTURE_VARIANT_ADD(ip_local_port_range, ip4_udp) {
138 	.so_domain	= AF_INET,
139 	.so_type	= SOCK_DGRAM,
140 	.so_protocol	= 0,
141 };
142 
143 FIXTURE_VARIANT_ADD(ip_local_port_range, ip4_stcp) {
144 	.so_domain	= AF_INET,
145 	.so_type	= SOCK_STREAM,
146 	.so_protocol	= IPPROTO_SCTP,
147 };
148 
149 FIXTURE_VARIANT_ADD(ip_local_port_range, ip6_tcp) {
150 	.so_domain	= AF_INET6,
151 	.so_type	= SOCK_STREAM,
152 	.so_protocol	= 0,
153 };
154 
155 FIXTURE_VARIANT_ADD(ip_local_port_range, ip6_udp) {
156 	.so_domain	= AF_INET6,
157 	.so_type	= SOCK_DGRAM,
158 	.so_protocol	= 0,
159 };
160 
161 FIXTURE_VARIANT_ADD(ip_local_port_range, ip6_stcp) {
162 	.so_domain	= AF_INET6,
163 	.so_type	= SOCK_STREAM,
164 	.so_protocol	= IPPROTO_SCTP,
165 };
166 
167 TEST_F(ip_local_port_range, invalid_option_value)
168 {
169 	__u16 val16;
170 	__u32 val32;
171 	__u64 val64;
172 	int fd, err;
173 
174 	fd = socket(variant->so_domain, variant->so_type, variant->so_protocol);
175 	ASSERT_GE(fd, 0) TH_LOG("socket failed");
176 
177 	/* Too few bytes */
178 	val16 = 40000;
179 	err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &val16, sizeof(val16));
180 	EXPECT_TRUE(err) TH_LOG("expected setsockopt(IP_LOCAL_PORT_RANGE) to fail");
181 	EXPECT_EQ(errno, EINVAL);
182 
183 	/* Empty range: low port > high port */
184 	val32 = pack_port_range(40222, 40111);
185 	err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &val32, sizeof(val32));
186 	EXPECT_TRUE(err) TH_LOG("expected setsockopt(IP_LOCAL_PORT_RANGE) to fail");
187 	EXPECT_EQ(errno, EINVAL);
188 
189 	/* Too many bytes */
190 	val64 = pack_port_range(40333, 40444);
191 	err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &val64, sizeof(val64));
192 	EXPECT_TRUE(err) TH_LOG("expected setsockopt(IP_LOCAL_PORT_RANGE) to fail");
193 	EXPECT_EQ(errno, EINVAL);
194 
195 	err = close(fd);
196 	ASSERT_TRUE(!err) TH_LOG("close failed");
197 }
198 
199 TEST_F(ip_local_port_range, port_range_out_of_netns_range)
200 {
201 	const struct test {
202 		__u16 range_lo;
203 		__u16 range_hi;
204 	} tests[] = {
205 		{ 30000, 39999 }, /* socket range below netns range */
206 		{ 50000, 59999 }, /* socket range above netns range */
207 	};
208 	const struct test *t;
209 
210 	for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
211 		/* Bind a couple of sockets, not just one, to check
212 		 * that the range wasn't clamped to a single port from
213 		 * the netns range. That is [40000, 40000] or [49999,
214 		 * 49999], respectively for each test case.
215 		 */
216 		int fds[2], i;
217 
218 		TH_LOG("lo %5hu, hi %5hu", t->range_lo, t->range_hi);
219 
220 		for (i = 0; i < ARRAY_SIZE(fds); i++) {
221 			int fd, err, port;
222 			__u32 range;
223 
224 			fd = socket(variant->so_domain, variant->so_type, variant->so_protocol);
225 			ASSERT_GE(fd, 0) TH_LOG("#%d: socket failed", i);
226 
227 			range = pack_port_range(t->range_lo, t->range_hi);
228 			err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &range, sizeof(range));
229 			ASSERT_TRUE(!err) TH_LOG("#%d: setsockopt(IP_LOCAL_PORT_RANGE) failed", i);
230 
231 			err = bind_to_loopback_any_port(fd);
232 			ASSERT_TRUE(!err) TH_LOG("#%d: bind failed", i);
233 
234 			/* Check that socket port range outside of ephemeral range is ignored */
235 			port = get_sock_port(fd);
236 			ASSERT_GE(port, 40000) TH_LOG("#%d: expected port within netns range", i);
237 			ASSERT_LE(port, 49999) TH_LOG("#%d: expected port within netns range", i);
238 
239 			fds[i] = fd;
240 		}
241 
242 		for (i = 0; i < ARRAY_SIZE(fds); i++)
243 			ASSERT_TRUE(close(fds[i]) == 0) TH_LOG("#%d: close failed", i);
244 	}
245 }
246 
247 TEST_F(ip_local_port_range, single_port_range)
248 {
249 	const struct test {
250 		__u16 range_lo;
251 		__u16 range_hi;
252 		__u16 expected;
253 	} tests[] = {
254 		/* single port range within ephemeral range */
255 		{ 45000, 45000, 45000 },
256 		/* first port in the ephemeral range (clamp from above) */
257 		{ 0, 40000, 40000 },
258 		/* last port in the ephemeral range (clamp from below)  */
259 		{ 49999, 0, 49999 },
260 	};
261 	const struct test *t;
262 
263 	for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
264 		int fd, err, port;
265 		__u32 range;
266 
267 		TH_LOG("lo %5hu, hi %5hu, expected %5hu",
268 		       t->range_lo, t->range_hi, t->expected);
269 
270 		fd = socket(variant->so_domain, variant->so_type, variant->so_protocol);
271 		ASSERT_GE(fd, 0) TH_LOG("socket failed");
272 
273 		range = pack_port_range(t->range_lo, t->range_hi);
274 		err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &range, sizeof(range));
275 		ASSERT_TRUE(!err) TH_LOG("setsockopt(IP_LOCAL_PORT_RANGE) failed");
276 
277 		err = bind_to_loopback_any_port(fd);
278 		ASSERT_TRUE(!err) TH_LOG("bind failed");
279 
280 		port = get_sock_port(fd);
281 		ASSERT_EQ(port, t->expected) TH_LOG("unexpected local port");
282 
283 		err = close(fd);
284 		ASSERT_TRUE(!err) TH_LOG("close failed");
285 	}
286 }
287 
288 TEST_F(ip_local_port_range, exhaust_8_port_range)
289 {
290 	__u8 port_set = 0;
291 	int i, fd, err;
292 	__u32 range;
293 	__u16 port;
294 	int fds[8];
295 
296 	for (i = 0; i < ARRAY_SIZE(fds); i++) {
297 		fd = socket(variant->so_domain, variant->so_type, variant->so_protocol);
298 		ASSERT_GE(fd, 0) TH_LOG("socket failed");
299 
300 		range = pack_port_range(40000, 40007);
301 		err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &range, sizeof(range));
302 		ASSERT_TRUE(!err) TH_LOG("setsockopt(IP_LOCAL_PORT_RANGE) failed");
303 
304 		err = bind_to_loopback_any_port(fd);
305 		ASSERT_TRUE(!err) TH_LOG("bind failed");
306 
307 		port = get_sock_port(fd);
308 		ASSERT_GE(port, 40000) TH_LOG("expected port within sockopt range");
309 		ASSERT_LE(port, 40007) TH_LOG("expected port within sockopt range");
310 
311 		port_set |= 1 << (port - 40000);
312 		fds[i] = fd;
313 	}
314 
315 	/* Check that all every port from the test range is in use */
316 	ASSERT_EQ(port_set, 0xff) TH_LOG("expected all ports to be busy");
317 
318 	/* Check that bind() fails because the whole range is busy */
319 	fd = socket(variant->so_domain, variant->so_type, variant->so_protocol);
320 	ASSERT_GE(fd, 0) TH_LOG("socket failed");
321 
322 	range = pack_port_range(40000, 40007);
323 	err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &range, sizeof(range));
324 	ASSERT_TRUE(!err) TH_LOG("setsockopt(IP_LOCAL_PORT_RANGE) failed");
325 
326 	err = bind_to_loopback_any_port(fd);
327 	ASSERT_TRUE(err) TH_LOG("expected bind to fail");
328 	ASSERT_EQ(errno, EADDRINUSE);
329 
330 	err = close(fd);
331 	ASSERT_TRUE(!err) TH_LOG("close failed");
332 
333 	for (i = 0; i < ARRAY_SIZE(fds); i++) {
334 		err = close(fds[i]);
335 		ASSERT_TRUE(!err) TH_LOG("close failed");
336 	}
337 }
338 
339 TEST_F(ip_local_port_range, late_bind)
340 {
341 	union {
342 		struct sockaddr sa;
343 		struct sockaddr_in v4;
344 		struct sockaddr_in6 v6;
345 	} addr;
346 	socklen_t addr_len = 0;
347 	const int one = 1;
348 	int fd, err;
349 	__u32 range;
350 	__u16 port;
351 
352 	if (variant->so_protocol == IPPROTO_SCTP)
353 		SKIP(return, "SCTP doesn't support IP_BIND_ADDRESS_NO_PORT");
354 
355 	fd = socket(variant->so_domain, variant->so_type, 0);
356 	ASSERT_GE(fd, 0) TH_LOG("socket failed");
357 
358 	range = pack_port_range(40100, 40199);
359 	err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &range, sizeof(range));
360 	ASSERT_TRUE(!err) TH_LOG("setsockopt(IP_LOCAL_PORT_RANGE) failed");
361 
362 	err = setsockopt(fd, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &one, sizeof(one));
363 	ASSERT_TRUE(!err) TH_LOG("setsockopt(IP_BIND_ADDRESS_NO_PORT) failed");
364 
365 	err = bind_to_loopback_any_port(fd);
366 	ASSERT_TRUE(!err) TH_LOG("bind failed");
367 
368 	port = get_sock_port(fd);
369 	ASSERT_EQ(port, 0) TH_LOG("getsockname failed");
370 
371 	/* Invalid destination */
372 	memset(&addr, 0, sizeof(addr));
373 	switch (variant->so_domain) {
374 	case AF_INET:
375 		addr.v4.sin_family = AF_INET;
376 		addr.v4.sin_port = htons(0);
377 		addr.v4.sin_addr.s_addr = htonl(INADDR_ANY);
378 		addr_len = sizeof(addr.v4);
379 		break;
380 	case AF_INET6:
381 		addr.v6.sin6_family = AF_INET6;
382 		addr.v6.sin6_port = htons(0);
383 		addr.v6.sin6_addr = in6addr_any;
384 		addr_len = sizeof(addr.v6);
385 		break;
386 	default:
387 		ASSERT_TRUE(false) TH_LOG("unsupported socket domain");
388 	}
389 
390 	/* connect() doesn't need to succeed for late bind to happen */
391 	connect(fd, &addr.sa, addr_len);
392 
393 	port = get_sock_port(fd);
394 	ASSERT_GE(port, 40100);
395 	ASSERT_LE(port, 40199);
396 
397 	err = close(fd);
398 	ASSERT_TRUE(!err) TH_LOG("close failed");
399 }
400 
401 TEST_F(ip_local_port_range, get_port_range)
402 {
403 	__u16 lo, hi;
404 	__u32 range;
405 	int fd, err;
406 
407 	fd = socket(variant->so_domain, variant->so_type, variant->so_protocol);
408 	ASSERT_GE(fd, 0) TH_LOG("socket failed");
409 
410 	/* Get range before it will be set */
411 	err = get_ip_local_port_range(fd, &range);
412 	ASSERT_TRUE(!err) TH_LOG("getsockopt(IP_LOCAL_PORT_RANGE) failed");
413 
414 	unpack_port_range(range, &lo, &hi);
415 	ASSERT_EQ(lo, 0) TH_LOG("unexpected low port");
416 	ASSERT_EQ(hi, 0) TH_LOG("unexpected high port");
417 
418 	range = pack_port_range(12345, 54321);
419 	err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &range, sizeof(range));
420 	ASSERT_TRUE(!err) TH_LOG("setsockopt(IP_LOCAL_PORT_RANGE) failed");
421 
422 	/* Get range after it has been set */
423 	err = get_ip_local_port_range(fd, &range);
424 	ASSERT_TRUE(!err) TH_LOG("getsockopt(IP_LOCAL_PORT_RANGE) failed");
425 
426 	unpack_port_range(range, &lo, &hi);
427 	ASSERT_EQ(lo, 12345) TH_LOG("unexpected low port");
428 	ASSERT_EQ(hi, 54321) TH_LOG("unexpected high port");
429 
430 	/* Unset the port range  */
431 	range = pack_port_range(0, 0);
432 	err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &range, sizeof(range));
433 	ASSERT_TRUE(!err) TH_LOG("setsockopt(IP_LOCAL_PORT_RANGE) failed");
434 
435 	/* Get range after it has been unset */
436 	err = get_ip_local_port_range(fd, &range);
437 	ASSERT_TRUE(!err) TH_LOG("getsockopt(IP_LOCAL_PORT_RANGE) failed");
438 
439 	unpack_port_range(range, &lo, &hi);
440 	ASSERT_EQ(lo, 0) TH_LOG("unexpected low port");
441 	ASSERT_EQ(hi, 0) TH_LOG("unexpected high port");
442 
443 	err = close(fd);
444 	ASSERT_TRUE(!err) TH_LOG("close failed");
445 }
446 
447 TEST_HARNESS_MAIN
448