1#!/bin/sh
2# SPDX-License-Identifier: GPL-2.0
3#
4# By Seth Schoen (c) 2021, for the IPv4 Unicast Extensions Project
5# Thanks to David Ahern for help and advice on nettest modifications.
6#
7# Self-tests for IPv4 address extensions: the kernel's ability to accept
8# certain traditionally unused or unallocated IPv4 addresses. For each kind
9# of address, we test for interface assignment, ping, TCP, and forwarding.
10# Must be run as root (to manipulate network namespaces and virtual
11# interfaces).
12#
13# Things we test for here:
14#
15# * Currently the kernel accepts addresses in 0/8 and 240/4 as valid.
16#
17# * Notwithstanding that, 0.0.0.0 and 255.255.255.255 cannot be assigned.
18#
19# * Currently the kernel DOES NOT accept unicast use of the lowest
20#   address in an IPv4 subnet (e.g. 192.168.100.0/32 in 192.168.100.0/24).
21#   This is treated as a second broadcast address, for compatibility
22#   with 4.2BSD (!).
23#
24# * Currently the kernel DOES NOT accept unicast use of any of 127/8.
25#
26# * Currently the kernel DOES NOT accept unicast use of any of 224/4.
27#
28# These tests provide an easy way to flip the expected result of any
29# of these behaviors for testing kernel patches that change them.
30
31# nettest can be run from PATH or from same directory as this selftest
32if ! which nettest >/dev/null; then
33	PATH=$PWD:$PATH
34	if ! which nettest >/dev/null; then
35		echo "'nettest' command not found; skipping tests"
36		exit 0
37	fi
38fi
39
40result=0
41
42hide_output(){ exec 3>&1 4>&2 >/dev/null 2>/dev/null; }
43show_output(){ exec >&3 2>&4; }
44
45show_result(){
46	if [ $1 -eq 0 ]; then
47		printf "TEST: %-60s  [ OK ]\n" "${2}"
48	else
49		printf "TEST: %-60s  [FAIL]\n" "${2}"
50		result=1
51	fi
52}
53
54_do_segmenttest(){
55	# Perform a simple set of link tests between a pair of
56	# IP addresses on a shared (virtual) segment, using
57	# ping and nettest.
58	# foo --- bar
59	# Arguments: ip_a ip_b prefix_length test_description
60	#
61	# Caller must set up foo-ns and bar-ns namespaces
62	# containing linked veth devices foo and bar,
63	# respectively.
64
65	ip -n foo-ns address add $1/$3 dev foo || return 1
66	ip -n foo-ns link set foo up || return 1
67	ip -n bar-ns address add $2/$3 dev bar || return 1
68	ip -n bar-ns link set bar up || return 1
69
70	ip netns exec foo-ns timeout 2 ping -c 1 $2 || return 1
71	ip netns exec bar-ns timeout 2 ping -c 1 $1 || return 1
72
73	nettest -B -N bar-ns -O foo-ns -r $1 || return 1
74	nettest -B -N foo-ns -O bar-ns -r $2 || return 1
75
76	return 0
77}
78
79_do_route_test(){
80	# Perform a simple set of gateway tests.
81	#
82	# [foo] <---> [foo1]-[bar1] <---> [bar]   /prefix
83	#  host          gateway          host
84	#
85	# Arguments: foo_ip foo1_ip bar1_ip bar_ip prefix_len test_description
86	# Displays test result and returns success or failure.
87
88	# Caller must set up foo-ns, bar-ns, and router-ns
89	# containing linked veth devices foo-foo1, bar1-bar
90	# (foo in foo-ns, foo1 and bar1 in router-ns, and
91	# bar in bar-ns).
92
93	ip -n foo-ns address add $1/$5 dev foo || return 1
94	ip -n foo-ns link set foo up || return 1
95	ip -n foo-ns route add default via $2 || return 1
96	ip -n bar-ns address add $4/$5 dev bar || return 1
97	ip -n bar-ns link set bar up || return 1
98	ip -n bar-ns route add default via $3 || return 1
99	ip -n router-ns address add $2/$5 dev foo1 || return 1
100	ip -n router-ns link set foo1 up || return 1
101	ip -n router-ns address add $3/$5 dev bar1 || return 1
102	ip -n router-ns link set bar1 up || return 1
103
104	echo 1 | ip netns exec router-ns tee /proc/sys/net/ipv4/ip_forward
105
106	ip netns exec foo-ns timeout 2 ping -c 1 $2 || return 1
107	ip netns exec foo-ns timeout 2 ping -c 1 $4 || return 1
108	ip netns exec bar-ns timeout 2 ping -c 1 $3 || return 1
109	ip netns exec bar-ns timeout 2 ping -c 1 $1 || return 1
110
111	nettest -B -N bar-ns -O foo-ns -r $1 || return 1
112	nettest -B -N foo-ns -O bar-ns -r $4 || return 1
113
114	return 0
115}
116
117segmenttest(){
118	# Sets up veth link and tries to connect over it.
119	# Arguments: ip_a ip_b prefix_len test_description
120	hide_output
121	ip netns add foo-ns
122	ip netns add bar-ns
123	ip link add foo netns foo-ns type veth peer name bar netns bar-ns
124
125	test_result=0
126	_do_segmenttest "$@" || test_result=1
127
128	ip netns pids foo-ns | xargs -r kill -9
129	ip netns pids bar-ns | xargs -r kill -9
130	ip netns del foo-ns
131	ip netns del bar-ns
132	show_output
133
134	# inverted tests will expect failure instead of success
135	[ -n "$expect_failure" ] && test_result=`expr 1 - $test_result`
136
137	show_result $test_result "$4"
138}
139
140route_test(){
141	# Sets up a simple gateway and tries to connect through it.
142	# [foo] <---> [foo1]-[bar1] <---> [bar]   /prefix
143	# Arguments: foo_ip foo1_ip bar1_ip bar_ip prefix_len test_description
144	# Returns success or failure.
145
146	hide_output
147	ip netns add foo-ns
148	ip netns add bar-ns
149	ip netns add router-ns
150	ip link add foo netns foo-ns type veth peer name foo1 netns router-ns
151	ip link add bar netns bar-ns type veth peer name bar1 netns router-ns
152
153	test_result=0
154	_do_route_test "$@" || test_result=1
155
156	ip netns pids foo-ns | xargs -r kill -9
157	ip netns pids bar-ns | xargs -r kill -9
158	ip netns pids router-ns | xargs -r kill -9
159	ip netns del foo-ns
160	ip netns del bar-ns
161	ip netns del router-ns
162
163	show_output
164
165	# inverted tests will expect failure instead of success
166	[ -n "$expect_failure" ] && test_result=`expr 1 - $test_result`
167	show_result $test_result "$6"
168}
169
170echo "###########################################################################"
171echo "Unicast address extensions tests (behavior of reserved IPv4 addresses)"
172echo "###########################################################################"
173#
174# Test support for 240/4
175segmenttest 240.1.2.1   240.1.2.4    24 "assign and ping within 240/4 (1 of 2) (is allowed)"
176segmenttest 250.100.2.1 250.100.30.4 16 "assign and ping within 240/4 (2 of 2) (is allowed)"
177#
178# Test support for 0/8
179segmenttest 0.1.2.17    0.1.2.23  24 "assign and ping within 0/8 (1 of 2) (is allowed)"
180segmenttest 0.77.240.17 0.77.2.23 16 "assign and ping within 0/8 (2 of 2) (is allowed)"
181#
182# Even 255.255/16 is OK!
183segmenttest 255.255.3.1 255.255.50.77 16 "assign and ping inside 255.255/16 (is allowed)"
184#
185# Or 255.255.255/24
186segmenttest 255.255.255.1 255.255.255.254 24 "assign and ping inside 255.255.255/24 (is allowed)"
187#
188# Routing between different networks
189route_test 240.5.6.7 240.5.6.1  255.1.2.1    255.1.2.3      24 "route between 240.5.6/24 and 255.1.2/24 (is allowed)"
190route_test 0.200.6.7 0.200.38.1 245.99.101.1 245.99.200.111 16 "route between 0.200/16 and 245.99/16 (is allowed)"
191#
192# Test support for lowest address ending in .0
193segmenttest 5.10.15.20 5.10.15.0 24 "assign and ping lowest address (/24)"
194#
195# Test support for lowest address not ending in .0
196segmenttest 192.168.101.192 192.168.101.193 26 "assign and ping lowest address (/26)"
197#
198# Routing using lowest address as a gateway/endpoint
199route_test 192.168.42.1 192.168.42.0 9.8.7.6 9.8.7.0 24 "routing using lowest address"
200#
201# ==============================================
202# ==== TESTS THAT CURRENTLY EXPECT FAILURE =====
203# ==============================================
204expect_failure=true
205# It should still not be possible to use 0.0.0.0 or 255.255.255.255
206# as a unicast address.  Thus, these tests expect failure.
207segmenttest 0.0.1.5       0.0.0.0         16 "assigning 0.0.0.0 (is forbidden)"
208segmenttest 255.255.255.1 255.255.255.255 16 "assigning 255.255.255.255 (is forbidden)"
209#
210# Test support for not having all of 127 be loopback
211# Currently Linux does not allow this, so this should fail too
212segmenttest 127.99.4.5 127.99.4.6 16 "assign and ping inside 127/8 (is forbidden)"
213#
214# Test support for unicast use of class D
215# Currently Linux does not allow this, so this should fail too
216segmenttest 225.1.2.3 225.1.2.200 24 "assign and ping class D address (is forbidden)"
217#
218# Routing using class D as a gateway
219route_test 225.1.42.1 225.1.42.2 9.8.7.6 9.8.7.1 24 "routing using class D (is forbidden)"
220#
221# Routing using 127/8
222# Currently Linux does not allow this, so this should fail too
223route_test 127.99.2.3 127.99.2.4 200.1.2.3 200.1.2.4 24 "routing using 127/8 (is forbidden)"
224#
225unset expect_failure
226# =====================================================
227# ==== END OF TESTS THAT CURRENTLY EXPECT FAILURE =====
228# =====================================================
229exit ${result}
230