unicast_extensions.sh

  1#!/bin/bash
  2# SPDX-License-Identifier: GPL-2.0
  3#
  4# By Seth Schoen (c) 2021, for the IPv4 Unicast Extensions Project
  5# Thanks to David Ahern for help and advice on nettest modifications.
  6#
  7# Self-tests for IPv4 address extensions: the kernel's ability to accept
  8# certain traditionally unused or unallocated IPv4 addresses. For each kind
  9# of address, we test for interface assignment, ping, TCP, and forwarding.
 10# Must be run as root (to manipulate network namespaces and virtual
 11# interfaces).
 12#
 13# Things we test for here:
 14#
 15# * Currently the kernel accepts addresses in 0/8 and 240/4 as valid.
 16#
 17# * Notwithstanding that, 0.0.0.0 and 255.255.255.255 cannot be assigned.
 18#
 19# * Currently the kernel DOES NOT accept unicast use of the lowest
 20#   address in an IPv4 subnet (e.g. 192.168.100.0/32 in 192.168.100.0/24).
 21#   This is treated as a second broadcast address, for compatibility
 22#   with 4.2BSD (!).
 23#
 24# * Currently the kernel DOES NOT accept unicast use of any of 127/8.
 25#
 26# * Currently the kernel DOES NOT accept unicast use of any of 224/4.
 27#
 28# These tests provide an easy way to flip the expected result of any
 29# of these behaviors for testing kernel patches that change them.
 30
 31source lib.sh
 32
 33check_gen_prog "nettest"
 34
 35result=0
 36
 37hide_output(){ exec 3>&1 4>&2 >/dev/null 2>/dev/null; }
 38show_output(){ exec >&3 2>&4; }
 39
 40show_result(){
 41	if [ $1 -eq 0 ]; then
 42		printf "TEST: %-60s  [ OK ]\n" "${2}"
 43	else
 44		printf "TEST: %-60s  [FAIL]\n" "${2}"
 45		result=1
 46	fi
 47}
 48
 49_do_segmenttest(){
 50	# Perform a simple set of link tests between a pair of
 51	# IP addresses on a shared (virtual) segment, using
 52	# ping and nettest.
 53	# foo --- bar
 54	# Arguments: ip_a ip_b prefix_length test_description
 55	#
 56	# Caller must set up $foo_ns and $bar_ns namespaces
 57	# containing linked veth devices foo and bar,
 58	# respectively.
 59
 60	ip -n $foo_ns address add $1/$3 dev foo || return 1
 61	ip -n $foo_ns link set foo up || return 1
 62	ip -n $bar_ns address add $2/$3 dev bar || return 1
 63	ip -n $bar_ns link set bar up || return 1
 64
 65	ip netns exec $foo_ns timeout 2 ping -c 1 $2 || return 1
 66	ip netns exec $bar_ns timeout 2 ping -c 1 $1 || return 1
 67
 68	nettest -B -N $bar_ns -O $foo_ns -r $1 || return 1
 69	nettest -B -N $foo_ns -O $bar_ns -r $2 || return 1
 70
 71	return 0
 72}
 73
 74_do_route_test(){
 75	# Perform a simple set of gateway tests.
 76	#
 77	# [foo] <---> [foo1]-[bar1] <---> [bar]   /prefix
 78	#  host          gateway          host
 79	#
 80	# Arguments: foo_ip foo1_ip bar1_ip bar_ip prefix_len test_description
 81	# Displays test result and returns success or failure.
 82
 83	# Caller must set up $foo_ns, $bar_ns, and $router_ns
 84	# containing linked veth devices foo-foo1, bar1-bar
 85	# (foo in $foo_ns, foo1 and bar1 in $router_ns, and
 86	# bar in $bar_ns).
 87
 88	ip -n $foo_ns address add $1/$5 dev foo || return 1
 89	ip -n $foo_ns link set foo up || return 1
 90	ip -n $foo_ns route add default via $2 || return 1
 91	ip -n $bar_ns address add $4/$5 dev bar || return 1
 92	ip -n $bar_ns link set bar up || return 1
 93	ip -n $bar_ns route add default via $3 || return 1
 94	ip -n $router_ns address add $2/$5 dev foo1 || return 1
 95	ip -n $router_ns link set foo1 up || return 1
 96	ip -n $router_ns address add $3/$5 dev bar1 || return 1
 97	ip -n $router_ns link set bar1 up || return 1
 98
 99	echo 1 | ip netns exec $router_ns tee /proc/sys/net/ipv4/ip_forward
100
101	ip netns exec $foo_ns timeout 2 ping -c 1 $2 || return 1
102	ip netns exec $foo_ns timeout 2 ping -c 1 $4 || return 1
103	ip netns exec $bar_ns timeout 2 ping -c 1 $3 || return 1
104	ip netns exec $bar_ns timeout 2 ping -c 1 $1 || return 1
105
106	nettest -B -N $bar_ns -O $foo_ns -r $1 || return 1
107	nettest -B -N $foo_ns -O $bar_ns -r $4 || return 1
108
109	return 0
110}
111
112segmenttest(){
113	# Sets up veth link and tries to connect over it.
114	# Arguments: ip_a ip_b prefix_len test_description
115	hide_output
116	setup_ns foo_ns bar_ns
117	ip link add foo netns $foo_ns type veth peer name bar netns $bar_ns
118
119	test_result=0
120	_do_segmenttest "$@" || test_result=1
121
122	ip netns pids $foo_ns | xargs -r kill -9
123	ip netns pids $bar_ns | xargs -r kill -9
124	cleanup_ns $foo_ns $bar_ns
125	show_output
126
127	# inverted tests will expect failure instead of success
128	[ -n "$expect_failure" ] && test_result=`expr 1 - $test_result`
129
130	show_result $test_result "$4"
131}
132
133route_test(){
134	# Sets up a simple gateway and tries to connect through it.
135	# [foo] <---> [foo1]-[bar1] <---> [bar]   /prefix
136	# Arguments: foo_ip foo1_ip bar1_ip bar_ip prefix_len test_description
137	# Returns success or failure.
138
139	hide_output
140	setup_ns foo_ns bar_ns router_ns
141	ip link add foo netns $foo_ns type veth peer name foo1 netns $router_ns
142	ip link add bar netns $bar_ns type veth peer name bar1 netns $router_ns
143
144	test_result=0
145	_do_route_test "$@" || test_result=1
146
147	ip netns pids $foo_ns | xargs -r kill -9
148	ip netns pids $bar_ns | xargs -r kill -9
149	ip netns pids $router_ns | xargs -r kill -9
150	cleanup_ns $foo_ns $bar_ns $router_ns
151
152	show_output
153
154	# inverted tests will expect failure instead of success
155	[ -n "$expect_failure" ] && test_result=`expr 1 - $test_result`
156	show_result $test_result "$6"
157}
158
159echo "###########################################################################"
160echo "Unicast address extensions tests (behavior of reserved IPv4 addresses)"
161echo "###########################################################################"
162#
163# Test support for 240/4
164segmenttest 240.1.2.1   240.1.2.4    24 "assign and ping within 240/4 (1 of 2) (is allowed)"
165segmenttest 250.100.2.1 250.100.30.4 16 "assign and ping within 240/4 (2 of 2) (is allowed)"
166#
167# Test support for 0/8
168segmenttest 0.1.2.17    0.1.2.23  24 "assign and ping within 0/8 (1 of 2) (is allowed)"
169segmenttest 0.77.240.17 0.77.2.23 16 "assign and ping within 0/8 (2 of 2) (is allowed)"
170#
171# Even 255.255/16 is OK!
172segmenttest 255.255.3.1 255.255.50.77 16 "assign and ping inside 255.255/16 (is allowed)"
173#
174# Or 255.255.255/24
175segmenttest 255.255.255.1 255.255.255.254 24 "assign and ping inside 255.255.255/24 (is allowed)"
176#
177# Routing between different networks
178route_test 240.5.6.7 240.5.6.1  255.1.2.1    255.1.2.3      24 "route between 240.5.6/24 and 255.1.2/24 (is allowed)"
179route_test 0.200.6.7 0.200.38.1 245.99.101.1 245.99.200.111 16 "route between 0.200/16 and 245.99/16 (is allowed)"
180#
181# Test support for lowest address ending in .0
182segmenttest 5.10.15.20 5.10.15.0 24 "assign and ping lowest address (/24)"
183#
184# Test support for lowest address not ending in .0
185segmenttest 192.168.101.192 192.168.101.193 26 "assign and ping lowest address (/26)"
186#
187# Routing using lowest address as a gateway/endpoint
188route_test 192.168.42.1 192.168.42.0 9.8.7.6 9.8.7.0 24 "routing using lowest address"
189#
190# ==============================================
191# ==== TESTS THAT CURRENTLY EXPECT FAILURE =====
192# ==============================================
193expect_failure=true
194# It should still not be possible to use 0.0.0.0 or 255.255.255.255
195# as a unicast address.  Thus, these tests expect failure.
196segmenttest 0.0.1.5       0.0.0.0         16 "assigning 0.0.0.0 (is forbidden)"
197segmenttest 255.255.255.1 255.255.255.255 16 "assigning 255.255.255.255 (is forbidden)"
198#
199# Test support for not having all of 127 be loopback
200# Currently Linux does not allow this, so this should fail too
201segmenttest 127.99.4.5 127.99.4.6 16 "assign and ping inside 127/8 (is forbidden)"
202#
203# Test support for unicast use of class D
204# Currently Linux does not allow this, so this should fail too
205segmenttest 225.1.2.3 225.1.2.200 24 "assign and ping class D address (is forbidden)"
206#
207# Routing using class D as a gateway
208route_test 225.1.42.1 225.1.42.2 9.8.7.6 9.8.7.1 24 "routing using class D (is forbidden)"
209#
210# Routing using 127/8
211# Currently Linux does not allow this, so this should fail too
212route_test 127.99.2.3 127.99.2.4 200.1.2.3 200.1.2.4 24 "routing using 127/8 (is forbidden)"
213#
214unset expect_failure
215# =====================================================
216# ==== END OF TESTS THAT CURRENTLY EXPECT FAILURE =====
217# =====================================================
218exit ${result}