tcp_port_share.c

  1// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
  2// Copyright (c) 2025 Cloudflare, Inc.
  3
  4/* Tests for TCP port sharing (bind bucket reuse). */
  5
  6#include <arpa/inet.h>
  7#include <net/if.h>
  8#include <sys/ioctl.h>
  9#include <fcntl.h>
 10#include <sched.h>
 11#include <stdlib.h>
 12
 13#include "kselftest_harness.h"
 14
 15#define DST_PORT 30000
 16#define SRC_PORT 40000
 17
 18struct sockaddr_inet {
 19	union {
 20		struct sockaddr_storage ss;
 21		struct sockaddr_in6 v6;
 22		struct sockaddr_in v4;
 23		struct sockaddr sa;
 24	};
 25	socklen_t len;
 26	char str[INET6_ADDRSTRLEN + __builtin_strlen("[]:65535") + 1];
 27};
 28
 29const int one = 1;
 30
 31static int disconnect(int fd)
 32{
 33	return connect(fd, &(struct sockaddr){ AF_UNSPEC }, sizeof(struct sockaddr));
 34}
 35
 36static int getsockname_port(int fd)
 37{
 38	struct sockaddr_inet addr = {};
 39	int err;
 40
 41	addr.len = sizeof(addr);
 42	err = getsockname(fd, &addr.sa, &addr.len);
 43	if (err)
 44		return -1;
 45
 46	switch (addr.sa.sa_family) {
 47	case AF_INET:
 48		return ntohs(addr.v4.sin_port);
 49	case AF_INET6:
 50		return ntohs(addr.v6.sin6_port);
 51	default:
 52		errno = EAFNOSUPPORT;
 53		return -1;
 54	}
 55}
 56
 57static void make_inet_addr(int af, const char *ip, __u16 port,
 58			   struct sockaddr_inet *addr)
 59{
 60	const char *fmt = "";
 61
 62	memset(addr, 0, sizeof(*addr));
 63
 64	switch (af) {
 65	case AF_INET:
 66		addr->len = sizeof(addr->v4);
 67		addr->v4.sin_family = af;
 68		addr->v4.sin_port = htons(port);
 69		inet_pton(af, ip, &addr->v4.sin_addr);
 70		fmt = "%s:%hu";
 71		break;
 72	case AF_INET6:
 73		addr->len = sizeof(addr->v6);
 74		addr->v6.sin6_family = af;
 75		addr->v6.sin6_port = htons(port);
 76		inet_pton(af, ip, &addr->v6.sin6_addr);
 77		fmt = "[%s]:%hu";
 78		break;
 79	}
 80
 81	snprintf(addr->str, sizeof(addr->str), fmt, ip, port);
 82}
 83
 84FIXTURE(tcp_port_share) {};
 85
 86FIXTURE_VARIANT(tcp_port_share) {
 87	int domain;
 88	/* IP to listen on and connect to */
 89	const char *dst_ip;
 90	/* Primary IP to connect from */
 91	const char *src1_ip;
 92	/* Secondary IP to connect from */
 93	const char *src2_ip;
 94	/* IP to bind to in order to block the source port */
 95	const char *bind_ip;
 96};
 97
 98FIXTURE_VARIANT_ADD(tcp_port_share, ipv4) {
 99	.domain = AF_INET,
100	.dst_ip = "127.0.0.1",
101	.src1_ip = "127.1.1.1",
102	.src2_ip = "127.2.2.2",
103	.bind_ip = "127.3.3.3",
104};
105
106FIXTURE_VARIANT_ADD(tcp_port_share, ipv6) {
107	.domain = AF_INET6,
108	.dst_ip = "::1",
109	.src1_ip = "2001:db8::1",
110	.src2_ip = "2001:db8::2",
111	.bind_ip = "2001:db8::3",
112};
113
114FIXTURE_SETUP(tcp_port_share)
115{
116	int sc;
117
118	ASSERT_EQ(unshare(CLONE_NEWNET), 0);
119	ASSERT_EQ(system("ip link set dev lo up"), 0);
120	ASSERT_EQ(system("ip addr add dev lo 2001:db8::1/32 nodad"), 0);
121	ASSERT_EQ(system("ip addr add dev lo 2001:db8::2/32 nodad"), 0);
122	ASSERT_EQ(system("ip addr add dev lo 2001:db8::3/32 nodad"), 0);
123
124	sc = open("/proc/sys/net/ipv4/ip_local_port_range", O_WRONLY);
125	ASSERT_GE(sc, 0);
126	ASSERT_GT(dprintf(sc, "%hu %hu\n", SRC_PORT, SRC_PORT), 0);
127	ASSERT_EQ(close(sc), 0);
128}
129
130FIXTURE_TEARDOWN(tcp_port_share) {}
131
132/* Verify that an ephemeral port becomes available again after the socket
133 * bound to it and blocking it from reuse is closed.
134 */
135TEST_F(tcp_port_share, can_reuse_port_after_bind_and_close)
136{
137	const typeof(variant) v = variant;
138	struct sockaddr_inet addr;
139	int c1, c2, ln, pb;
140
141	/* Listen on <dst_ip>:<DST_PORT> */
142	ln = socket(v->domain, SOCK_STREAM, 0);
143	ASSERT_GE(ln, 0) TH_LOG("socket(): %m");
144	ASSERT_EQ(setsockopt(ln, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)), 0);
145
146	make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr);
147	ASSERT_EQ(bind(ln, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
148	ASSERT_EQ(listen(ln, 2), 0);
149
150	/* Connect from <src1_ip>:<SRC_PORT> */
151	c1 = socket(v->domain, SOCK_STREAM, 0);
152	ASSERT_GE(c1, 0) TH_LOG("socket(): %m");
153	ASSERT_EQ(setsockopt(c1, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &one, sizeof(one)), 0);
154
155	make_inet_addr(v->domain, v->src1_ip, 0, &addr);
156	ASSERT_EQ(bind(c1, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
157
158	make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr);
159	ASSERT_EQ(connect(c1, &addr.sa, addr.len), 0) TH_LOG("connect(%s): %m", addr.str);
160	ASSERT_EQ(getsockname_port(c1), SRC_PORT);
161
162	/* Bind to <bind_ip>:<SRC_PORT>. Block the port from reuse. */
163	pb = socket(v->domain, SOCK_STREAM, 0);
164	ASSERT_GE(pb, 0) TH_LOG("socket(): %m");
165	ASSERT_EQ(setsockopt(pb, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)), 0);
166
167	make_inet_addr(v->domain, v->bind_ip, SRC_PORT, &addr);
168	ASSERT_EQ(bind(pb, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
169
170	/* Try to connect from <src2_ip>:<SRC_PORT>. Expect failure. */
171	c2 = socket(v->domain, SOCK_STREAM, 0);
172	ASSERT_GE(c2, 0) TH_LOG("socket");
173	ASSERT_EQ(setsockopt(c2, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &one, sizeof(one)), 0);
174
175	make_inet_addr(v->domain, v->src2_ip, 0, &addr);
176	ASSERT_EQ(bind(c2, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
177
178	make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr);
179	ASSERT_EQ(connect(c2, &addr.sa, addr.len), -1) TH_LOG("connect(%s)", addr.str);
180	ASSERT_EQ(errno, EADDRNOTAVAIL) TH_LOG("%m");
181
182	/* Unbind from <bind_ip>:<SRC_PORT>. Unblock the port for reuse. */
183	ASSERT_EQ(close(pb), 0);
184
185	/* Connect again from <src2_ip>:<SRC_PORT> */
186	EXPECT_EQ(connect(c2, &addr.sa, addr.len), 0) TH_LOG("connect(%s): %m", addr.str);
187	EXPECT_EQ(getsockname_port(c2), SRC_PORT);
188
189	ASSERT_EQ(close(c2), 0);
190	ASSERT_EQ(close(c1), 0);
191	ASSERT_EQ(close(ln), 0);
192}
193
194/* Verify that a socket auto-bound during connect() blocks port reuse after
195 * disconnect (connect(AF_UNSPEC)) followed by an explicit port bind().
196 */
197TEST_F(tcp_port_share, port_block_after_disconnect)
198{
199	const typeof(variant) v = variant;
200	struct sockaddr_inet addr;
201	int c1, c2, ln, pb;
202
203	/* Listen on <dst_ip>:<DST_PORT> */
204	ln = socket(v->domain, SOCK_STREAM, 0);
205	ASSERT_GE(ln, 0) TH_LOG("socket(): %m");
206	ASSERT_EQ(setsockopt(ln, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)), 0);
207
208	make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr);
209	ASSERT_EQ(bind(ln, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
210	ASSERT_EQ(listen(ln, 2), 0);
211
212	/* Connect from <src1_ip>:<SRC_PORT> */
213	c1 = socket(v->domain, SOCK_STREAM, 0);
214	ASSERT_GE(c1, 0) TH_LOG("socket(): %m");
215	ASSERT_EQ(setsockopt(c1, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &one, sizeof(one)), 0);
216
217	make_inet_addr(v->domain, v->src1_ip, 0, &addr);
218	ASSERT_EQ(bind(c1, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
219
220	make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr);
221	ASSERT_EQ(connect(c1, &addr.sa, addr.len), 0) TH_LOG("connect(%s): %m", addr.str);
222	ASSERT_EQ(getsockname_port(c1), SRC_PORT);
223
224	/* Disconnect the socket and bind it to <bind_ip>:<SRC_PORT> to block the port */
225	ASSERT_EQ(disconnect(c1), 0) TH_LOG("disconnect: %m");
226	ASSERT_EQ(setsockopt(c1, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)), 0);
227
228	make_inet_addr(v->domain, v->bind_ip, SRC_PORT, &addr);
229	ASSERT_EQ(bind(c1, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
230
231	/* Trigger port-addr bucket state update with another bind() and close() */
232	pb = socket(v->domain, SOCK_STREAM, 0);
233	ASSERT_GE(pb, 0) TH_LOG("socket(): %m");
234	ASSERT_EQ(setsockopt(pb, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)), 0);
235
236	make_inet_addr(v->domain, v->bind_ip, SRC_PORT, &addr);
237	ASSERT_EQ(bind(pb, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
238
239	ASSERT_EQ(close(pb), 0);
240
241	/* Connect from <src2_ip>:<SRC_PORT>. Expect failure. */
242	c2 = socket(v->domain, SOCK_STREAM, 0);
243	ASSERT_GE(c2, 0) TH_LOG("socket: %m");
244	ASSERT_EQ(setsockopt(c2, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &one, sizeof(one)), 0);
245
246	make_inet_addr(v->domain, v->src2_ip, 0, &addr);
247	ASSERT_EQ(bind(c2, &addr.sa, addr.len), 0) TH_LOG("bind(%s): %m", addr.str);
248
249	make_inet_addr(v->domain, v->dst_ip, DST_PORT, &addr);
250	EXPECT_EQ(connect(c2, &addr.sa, addr.len), -1) TH_LOG("connect(%s)", addr.str);
251	EXPECT_EQ(errno, EADDRNOTAVAIL) TH_LOG("%m");
252
253	ASSERT_EQ(close(c2), 0);
254	ASSERT_EQ(close(c1), 0);
255	ASSERT_EQ(close(ln), 0);
256}
257
258TEST_HARNESS_MAIN