1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 // Copyright (c) 2023 Cloudflare
3 
4 /* Test IP_LOCAL_PORT_RANGE socket option: IPv4 + IPv6, TCP + UDP.
5  *
6  * Tests assume that net.ipv4.ip_local_port_range is [40000, 49999].
7  * Don't run these directly but with ip_local_port_range.sh script.
8  */
9 
10 #include <fcntl.h>
11 #include <netinet/ip.h>
12 
13 #include "../kselftest_harness.h"
14 
15 #ifndef IP_LOCAL_PORT_RANGE
16 #define IP_LOCAL_PORT_RANGE 51
17 #endif
18 
19 #ifndef IPPROTO_MPTCP
20 #define IPPROTO_MPTCP 262
21 #endif
22 
23 static __u32 pack_port_range(__u16 lo, __u16 hi)
24 {
25 	return (hi << 16) | (lo << 0);
26 }
27 
28 static void unpack_port_range(__u32 range, __u16 *lo, __u16 *hi)
29 {
30 	*lo = range & 0xffff;
31 	*hi = range >> 16;
32 }
33 
34 static int get_so_domain(int fd)
35 {
36 	int domain, err;
37 	socklen_t len;
38 
39 	len = sizeof(domain);
40 	err = getsockopt(fd, SOL_SOCKET, SO_DOMAIN, &domain, &len);
41 	if (err)
42 		return -1;
43 
44 	return domain;
45 }
46 
47 static int bind_to_loopback_any_port(int fd)
48 {
49 	union {
50 		struct sockaddr sa;
51 		struct sockaddr_in v4;
52 		struct sockaddr_in6 v6;
53 	} addr;
54 	socklen_t addr_len;
55 
56 	memset(&addr, 0, sizeof(addr));
57 	switch (get_so_domain(fd)) {
58 	case AF_INET:
59 		addr.v4.sin_family = AF_INET;
60 		addr.v4.sin_port = htons(0);
61 		addr.v4.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
62 		addr_len = sizeof(addr.v4);
63 		break;
64 	case AF_INET6:
65 		addr.v6.sin6_family = AF_INET6;
66 		addr.v6.sin6_port = htons(0);
67 		addr.v6.sin6_addr = in6addr_loopback;
68 		addr_len = sizeof(addr.v6);
69 		break;
70 	default:
71 		return -1;
72 	}
73 
74 	return bind(fd, &addr.sa, addr_len);
75 }
76 
77 static int get_sock_port(int fd)
78 {
79 	union {
80 		struct sockaddr sa;
81 		struct sockaddr_in v4;
82 		struct sockaddr_in6 v6;
83 	} addr;
84 	socklen_t addr_len;
85 	int err;
86 
87 	addr_len = sizeof(addr);
88 	memset(&addr, 0, sizeof(addr));
89 	err = getsockname(fd, &addr.sa, &addr_len);
90 	if (err)
91 		return -1;
92 
93 	switch (addr.sa.sa_family) {
94 	case AF_INET:
95 		return ntohs(addr.v4.sin_port);
96 	case AF_INET6:
97 		return ntohs(addr.v6.sin6_port);
98 	default:
99 		errno = EAFNOSUPPORT;
100 		return -1;
101 	}
102 }
103 
104 static int get_ip_local_port_range(int fd, __u32 *range)
105 {
106 	socklen_t len;
107 	__u32 val;
108 	int err;
109 
110 	len = sizeof(val);
111 	err = getsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &val, &len);
112 	if (err)
113 		return -1;
114 
115 	*range = val;
116 	return 0;
117 }
118 
119 FIXTURE(ip_local_port_range) {};
120 
121 FIXTURE_SETUP(ip_local_port_range)
122 {
123 }
124 
125 FIXTURE_TEARDOWN(ip_local_port_range)
126 {
127 }
128 
129 FIXTURE_VARIANT(ip_local_port_range) {
130 	int so_domain;
131 	int so_type;
132 	int so_protocol;
133 };
134 
135 FIXTURE_VARIANT_ADD(ip_local_port_range, ip4_tcp) {
136 	.so_domain	= AF_INET,
137 	.so_type	= SOCK_STREAM,
138 	.so_protocol	= 0,
139 };
140 
141 FIXTURE_VARIANT_ADD(ip_local_port_range, ip4_udp) {
142 	.so_domain	= AF_INET,
143 	.so_type	= SOCK_DGRAM,
144 	.so_protocol	= 0,
145 };
146 
147 FIXTURE_VARIANT_ADD(ip_local_port_range, ip4_stcp) {
148 	.so_domain	= AF_INET,
149 	.so_type	= SOCK_STREAM,
150 	.so_protocol	= IPPROTO_SCTP,
151 };
152 
153 FIXTURE_VARIANT_ADD(ip_local_port_range, ip4_mptcp) {
154 	.so_domain	= AF_INET,
155 	.so_type	= SOCK_STREAM,
156 	.so_protocol	= IPPROTO_MPTCP,
157 };
158 
159 FIXTURE_VARIANT_ADD(ip_local_port_range, ip6_tcp) {
160 	.so_domain	= AF_INET6,
161 	.so_type	= SOCK_STREAM,
162 	.so_protocol	= 0,
163 };
164 
165 FIXTURE_VARIANT_ADD(ip_local_port_range, ip6_udp) {
166 	.so_domain	= AF_INET6,
167 	.so_type	= SOCK_DGRAM,
168 	.so_protocol	= 0,
169 };
170 
171 FIXTURE_VARIANT_ADD(ip_local_port_range, ip6_stcp) {
172 	.so_domain	= AF_INET6,
173 	.so_type	= SOCK_STREAM,
174 	.so_protocol	= IPPROTO_SCTP,
175 };
176 
177 FIXTURE_VARIANT_ADD(ip_local_port_range, ip6_mptcp) {
178 	.so_domain	= AF_INET6,
179 	.so_type	= SOCK_STREAM,
180 	.so_protocol	= IPPROTO_MPTCP,
181 };
182 
183 TEST_F(ip_local_port_range, invalid_option_value)
184 {
185 	__u16 val16;
186 	__u32 val32;
187 	__u64 val64;
188 	int fd, err;
189 
190 	fd = socket(variant->so_domain, variant->so_type, variant->so_protocol);
191 	ASSERT_GE(fd, 0) TH_LOG("socket failed");
192 
193 	/* Too few bytes */
194 	val16 = 40000;
195 	err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &val16, sizeof(val16));
196 	EXPECT_TRUE(err) TH_LOG("expected setsockopt(IP_LOCAL_PORT_RANGE) to fail");
197 	EXPECT_EQ(errno, EINVAL);
198 
199 	/* Empty range: low port > high port */
200 	val32 = pack_port_range(40222, 40111);
201 	err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &val32, sizeof(val32));
202 	EXPECT_TRUE(err) TH_LOG("expected setsockopt(IP_LOCAL_PORT_RANGE) to fail");
203 	EXPECT_EQ(errno, EINVAL);
204 
205 	/* Too many bytes */
206 	val64 = pack_port_range(40333, 40444);
207 	err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &val64, sizeof(val64));
208 	EXPECT_TRUE(err) TH_LOG("expected setsockopt(IP_LOCAL_PORT_RANGE) to fail");
209 	EXPECT_EQ(errno, EINVAL);
210 
211 	err = close(fd);
212 	ASSERT_TRUE(!err) TH_LOG("close failed");
213 }
214 
215 TEST_F(ip_local_port_range, port_range_out_of_netns_range)
216 {
217 	const struct test {
218 		__u16 range_lo;
219 		__u16 range_hi;
220 	} tests[] = {
221 		{ 30000, 39999 }, /* socket range below netns range */
222 		{ 50000, 59999 }, /* socket range above netns range */
223 	};
224 	const struct test *t;
225 
226 	for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
227 		/* Bind a couple of sockets, not just one, to check
228 		 * that the range wasn't clamped to a single port from
229 		 * the netns range. That is [40000, 40000] or [49999,
230 		 * 49999], respectively for each test case.
231 		 */
232 		int fds[2], i;
233 
234 		TH_LOG("lo %5hu, hi %5hu", t->range_lo, t->range_hi);
235 
236 		for (i = 0; i < ARRAY_SIZE(fds); i++) {
237 			int fd, err, port;
238 			__u32 range;
239 
240 			fd = socket(variant->so_domain, variant->so_type, variant->so_protocol);
241 			ASSERT_GE(fd, 0) TH_LOG("#%d: socket failed", i);
242 
243 			range = pack_port_range(t->range_lo, t->range_hi);
244 			err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &range, sizeof(range));
245 			ASSERT_TRUE(!err) TH_LOG("#%d: setsockopt(IP_LOCAL_PORT_RANGE) failed", i);
246 
247 			err = bind_to_loopback_any_port(fd);
248 			ASSERT_TRUE(!err) TH_LOG("#%d: bind failed", i);
249 
250 			/* Check that socket port range outside of ephemeral range is ignored */
251 			port = get_sock_port(fd);
252 			ASSERT_GE(port, 40000) TH_LOG("#%d: expected port within netns range", i);
253 			ASSERT_LE(port, 49999) TH_LOG("#%d: expected port within netns range", i);
254 
255 			fds[i] = fd;
256 		}
257 
258 		for (i = 0; i < ARRAY_SIZE(fds); i++)
259 			ASSERT_TRUE(close(fds[i]) == 0) TH_LOG("#%d: close failed", i);
260 	}
261 }
262 
263 TEST_F(ip_local_port_range, single_port_range)
264 {
265 	const struct test {
266 		__u16 range_lo;
267 		__u16 range_hi;
268 		__u16 expected;
269 	} tests[] = {
270 		/* single port range within ephemeral range */
271 		{ 45000, 45000, 45000 },
272 		/* first port in the ephemeral range (clamp from above) */
273 		{ 0, 40000, 40000 },
274 		/* last port in the ephemeral range (clamp from below)  */
275 		{ 49999, 0, 49999 },
276 	};
277 	const struct test *t;
278 
279 	for (t = tests; t < tests + ARRAY_SIZE(tests); t++) {
280 		int fd, err, port;
281 		__u32 range;
282 
283 		TH_LOG("lo %5hu, hi %5hu, expected %5hu",
284 		       t->range_lo, t->range_hi, t->expected);
285 
286 		fd = socket(variant->so_domain, variant->so_type, variant->so_protocol);
287 		ASSERT_GE(fd, 0) TH_LOG("socket failed");
288 
289 		range = pack_port_range(t->range_lo, t->range_hi);
290 		err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &range, sizeof(range));
291 		ASSERT_TRUE(!err) TH_LOG("setsockopt(IP_LOCAL_PORT_RANGE) failed");
292 
293 		err = bind_to_loopback_any_port(fd);
294 		ASSERT_TRUE(!err) TH_LOG("bind failed");
295 
296 		port = get_sock_port(fd);
297 		ASSERT_EQ(port, t->expected) TH_LOG("unexpected local port");
298 
299 		err = close(fd);
300 		ASSERT_TRUE(!err) TH_LOG("close failed");
301 	}
302 }
303 
304 TEST_F(ip_local_port_range, exhaust_8_port_range)
305 {
306 	__u8 port_set = 0;
307 	int i, fd, err;
308 	__u32 range;
309 	__u16 port;
310 	int fds[8];
311 
312 	for (i = 0; i < ARRAY_SIZE(fds); i++) {
313 		fd = socket(variant->so_domain, variant->so_type, variant->so_protocol);
314 		ASSERT_GE(fd, 0) TH_LOG("socket failed");
315 
316 		range = pack_port_range(40000, 40007);
317 		err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &range, sizeof(range));
318 		ASSERT_TRUE(!err) TH_LOG("setsockopt(IP_LOCAL_PORT_RANGE) failed");
319 
320 		err = bind_to_loopback_any_port(fd);
321 		ASSERT_TRUE(!err) TH_LOG("bind failed");
322 
323 		port = get_sock_port(fd);
324 		ASSERT_GE(port, 40000) TH_LOG("expected port within sockopt range");
325 		ASSERT_LE(port, 40007) TH_LOG("expected port within sockopt range");
326 
327 		port_set |= 1 << (port - 40000);
328 		fds[i] = fd;
329 	}
330 
331 	/* Check that all every port from the test range is in use */
332 	ASSERT_EQ(port_set, 0xff) TH_LOG("expected all ports to be busy");
333 
334 	/* Check that bind() fails because the whole range is busy */
335 	fd = socket(variant->so_domain, variant->so_type, variant->so_protocol);
336 	ASSERT_GE(fd, 0) TH_LOG("socket failed");
337 
338 	range = pack_port_range(40000, 40007);
339 	err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &range, sizeof(range));
340 	ASSERT_TRUE(!err) TH_LOG("setsockopt(IP_LOCAL_PORT_RANGE) failed");
341 
342 	err = bind_to_loopback_any_port(fd);
343 	ASSERT_TRUE(err) TH_LOG("expected bind to fail");
344 	ASSERT_EQ(errno, EADDRINUSE);
345 
346 	err = close(fd);
347 	ASSERT_TRUE(!err) TH_LOG("close failed");
348 
349 	for (i = 0; i < ARRAY_SIZE(fds); i++) {
350 		err = close(fds[i]);
351 		ASSERT_TRUE(!err) TH_LOG("close failed");
352 	}
353 }
354 
355 TEST_F(ip_local_port_range, late_bind)
356 {
357 	union {
358 		struct sockaddr sa;
359 		struct sockaddr_in v4;
360 		struct sockaddr_in6 v6;
361 	} addr;
362 	socklen_t addr_len;
363 	const int one = 1;
364 	int fd, err;
365 	__u32 range;
366 	__u16 port;
367 
368 	fd = socket(variant->so_domain, variant->so_type, 0);
369 	ASSERT_GE(fd, 0) TH_LOG("socket failed");
370 
371 	range = pack_port_range(40100, 40199);
372 	err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &range, sizeof(range));
373 	ASSERT_TRUE(!err) TH_LOG("setsockopt(IP_LOCAL_PORT_RANGE) failed");
374 
375 	err = setsockopt(fd, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &one, sizeof(one));
376 	ASSERT_TRUE(!err) TH_LOG("setsockopt(IP_BIND_ADDRESS_NO_PORT) failed");
377 
378 	err = bind_to_loopback_any_port(fd);
379 	ASSERT_TRUE(!err) TH_LOG("bind failed");
380 
381 	port = get_sock_port(fd);
382 	ASSERT_EQ(port, 0) TH_LOG("getsockname failed");
383 
384 	/* Invalid destination */
385 	memset(&addr, 0, sizeof(addr));
386 	switch (variant->so_domain) {
387 	case AF_INET:
388 		addr.v4.sin_family = AF_INET;
389 		addr.v4.sin_port = htons(0);
390 		addr.v4.sin_addr.s_addr = htonl(INADDR_ANY);
391 		addr_len = sizeof(addr.v4);
392 		break;
393 	case AF_INET6:
394 		addr.v6.sin6_family = AF_INET6;
395 		addr.v6.sin6_port = htons(0);
396 		addr.v6.sin6_addr = in6addr_any;
397 		addr_len = sizeof(addr.v6);
398 		break;
399 	default:
400 		ASSERT_TRUE(false) TH_LOG("unsupported socket domain");
401 	}
402 
403 	/* connect() doesn't need to succeed for late bind to happen */
404 	connect(fd, &addr.sa, addr_len);
405 
406 	port = get_sock_port(fd);
407 	ASSERT_GE(port, 40100);
408 	ASSERT_LE(port, 40199);
409 
410 	err = close(fd);
411 	ASSERT_TRUE(!err) TH_LOG("close failed");
412 }
413 
414 XFAIL_ADD(ip_local_port_range, ip4_stcp, late_bind);
415 XFAIL_ADD(ip_local_port_range, ip6_stcp, late_bind);
416 
417 TEST_F(ip_local_port_range, get_port_range)
418 {
419 	__u16 lo, hi;
420 	__u32 range;
421 	int fd, err;
422 
423 	fd = socket(variant->so_domain, variant->so_type, variant->so_protocol);
424 	ASSERT_GE(fd, 0) TH_LOG("socket failed");
425 
426 	/* Get range before it will be set */
427 	err = get_ip_local_port_range(fd, &range);
428 	ASSERT_TRUE(!err) TH_LOG("getsockopt(IP_LOCAL_PORT_RANGE) failed");
429 
430 	unpack_port_range(range, &lo, &hi);
431 	ASSERT_EQ(lo, 0) TH_LOG("unexpected low port");
432 	ASSERT_EQ(hi, 0) TH_LOG("unexpected high port");
433 
434 	range = pack_port_range(12345, 54321);
435 	err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &range, sizeof(range));
436 	ASSERT_TRUE(!err) TH_LOG("setsockopt(IP_LOCAL_PORT_RANGE) failed");
437 
438 	/* Get range after it has been set */
439 	err = get_ip_local_port_range(fd, &range);
440 	ASSERT_TRUE(!err) TH_LOG("getsockopt(IP_LOCAL_PORT_RANGE) failed");
441 
442 	unpack_port_range(range, &lo, &hi);
443 	ASSERT_EQ(lo, 12345) TH_LOG("unexpected low port");
444 	ASSERT_EQ(hi, 54321) TH_LOG("unexpected high port");
445 
446 	/* Unset the port range  */
447 	range = pack_port_range(0, 0);
448 	err = setsockopt(fd, SOL_IP, IP_LOCAL_PORT_RANGE, &range, sizeof(range));
449 	ASSERT_TRUE(!err) TH_LOG("setsockopt(IP_LOCAL_PORT_RANGE) failed");
450 
451 	/* Get range after it has been unset */
452 	err = get_ip_local_port_range(fd, &range);
453 	ASSERT_TRUE(!err) TH_LOG("getsockopt(IP_LOCAL_PORT_RANGE) failed");
454 
455 	unpack_port_range(range, &lo, &hi);
456 	ASSERT_EQ(lo, 0) TH_LOG("unexpected low port");
457 	ASSERT_EQ(hi, 0) TH_LOG("unexpected high port");
458 
459 	err = close(fd);
460 	ASSERT_TRUE(!err) TH_LOG("close failed");
461 }
462 
463 TEST_HARNESS_MAIN
464