Commit 4c351048 authored by Peter Oskolkov's avatar Peter Oskolkov Committed by David S. Miller
Browse files

selftests: net: ip_defrag: cover new IPv6 defrag behavior 



This patch adds several changes to the ip_defrag selftest, to cover
new IPv6 defrag behavior:

- min IPv6 frag size is now 8 instead of 1280

- new test cases to cover IPv6 defragmentation in nf_conntrack_reasm.c

- new "permissive" mode in negative (overlap) tests: netfilter
sometimes drops invalid packets without passing them to IPv6
underneath, and thus defragmentation sometimes succeeds when
it is expected to fail; so the permissive mode does not fail the
test if the correct reassembled datagram is received instead of a
timeout.

Signed-off-by: default avatarPeter Oskolkov <posk@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 997dd964

tools/testing/selftests/net/ip_defrag.c

+35 −34
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ static bool cfg_do_ipv4; 
static bool		cfg_do_ipv6;

static bool		cfg_verbose;

static bool		cfg_overlap;

static bool		cfg_permissive;

static unsigned short	cfg_port = 9000;



const struct in_addr addr4 = { .s_addr = __constant_htonl(INADDR_LOOPBACK + 2) };
@@ -35,7 +36,7 @@ const struct in6_addr addr6 = IN6ADDR_LOOPBACK_INIT; 
static int payload_len;

static int max_frag_len;



#define MSG_LEN_MAX	60000	/* Max UDP payload length. */

#define MSG_LEN_MAX	10000	/* Max UDP payload length. */



#define IP4_MF		(1u << 13)  /* IPv4 MF flag. */

#define IP6_MF		(1)  /* IPv6 MF flag. */
@@ -59,13 +60,14 @@ static void recv_validate_udp(int fd_udp) 
	msg_counter++;



	if (cfg_overlap) {

		if (ret == -1 && (errno == ETIMEDOUT || errno == EAGAIN))

			return;  /* OK */

		if (!cfg_permissive) {

			if (ret != -1)

				error(1, 0, "recv: expected timeout; got %d",

					(int)ret);

		if (errno != ETIMEDOUT && errno != EAGAIN)

			error(1, errno, "recv: expected timeout: %d",

				 errno);

		return;  /* OK */

			error(1, errno, "recv: expected timeout: %d", errno);

		}

	}



	if (ret == -1)
@@ -203,7 +205,6 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr, 
{

	struct ip *iphdr = (struct ip *)ip_frame;

	struct ip6_hdr *ip6hdr = (struct ip6_hdr *)ip_frame;

	const bool ipv4 = !ipv6;

	int res;

	int offset;

	int frag_len;
@@ -251,7 +252,7 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr, 
	}



	/* Occasionally test IPv4 "runs" (see net/ipv4/ip_fragment.c) */

	if (ipv4 && !cfg_overlap && (rand() % 100 < 20) &&

	if (!cfg_overlap && (rand() % 100 < 20) &&

			(payload_len > 9 * max_frag_len)) {

		offset = 6 * max_frag_len;

		while (offset < (UDP_HLEN + payload_len)) {
@@ -276,41 +277,38 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr, 
	while (offset < (UDP_HLEN + payload_len)) {

		send_fragment(fd_raw, addr, alen, offset, ipv6);

		/* IPv4 ignores duplicates, so randomly send a duplicate. */

		if (ipv4 && (1 == rand() % 100))

		if (rand() % 100 == 1)

			send_fragment(fd_raw, addr, alen, offset, ipv6);

		offset += 2 * max_frag_len;

	}



	if (cfg_overlap) {

		/* Send an extra random fragment. */

		if (ipv6) {

			struct ip6_frag *fraghdr = (struct ip6_frag *)(ip_frame + IP6_HLEN);

			/* sendto() returns EINVAL if offset + frag_len is too small. */

			offset = rand() % (UDP_HLEN + payload_len - 1);

			frag_len = max_frag_len + rand() % 256;

			/* In IPv6 if !!(frag_len % 8), the fragment is dropped. */

			frag_len &= ~0x7;

			fraghdr->ip6f_offlg = htons(offset / 8 | IP6_MF);

			ip6hdr->ip6_plen = htons(frag_len);

			frag_len += IP6_HLEN;

		} else {

			/* In IPv4, duplicates and some fragments completely inside

		/* Send an extra random fragment.

		 *

		 * Duplicates and some fragments completely inside

		 * previously sent fragments are dropped/ignored. So

		 * random offset and frag_len can result in a dropped

			 * fragment instead of a dropped queue/packet. So we

		 * fragment instead of a dropped queue/packet. Thus we

		 * hard-code offset and frag_len.

			 *

			 * See ade446403bfb ("net: ipv4: do not handle duplicate

			 * fragments as overlapping").

		 */

		if (max_frag_len * 4 < payload_len || max_frag_len < 16) {

				/* not enough payload to play with random offset and frag_len. */

			/* not enough payload for random offset and frag_len. */

			offset = 8;

				frag_len = IP4_HLEN + UDP_HLEN + max_frag_len;

			frag_len = UDP_HLEN + max_frag_len;

		} else {

			offset = rand() % (payload_len / 2);

			frag_len = 2 * max_frag_len + 1 + rand() % 256;

		}

		if (ipv6) {

			struct ip6_frag *fraghdr = (struct ip6_frag *)(ip_frame + IP6_HLEN);

			/* sendto() returns EINVAL if offset + frag_len is too small. */

			/* In IPv6 if !!(frag_len % 8), the fragment is dropped. */

			frag_len &= ~0x7;

			fraghdr->ip6f_offlg = htons(offset / 8 | IP6_MF);

			ip6hdr->ip6_plen = htons(frag_len);

			frag_len += IP6_HLEN;

		} else {

			frag_len += IP4_HLEN;

			iphdr->ip_off = htons(offset / 8 | IP4_MF);

			iphdr->ip_len = htons(frag_len);

		}
@@ -327,7 +325,7 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr, 
	while (offset < (UDP_HLEN + payload_len)) {

		send_fragment(fd_raw, addr, alen, offset, ipv6);

		/* IPv4 ignores duplicates, so randomly send a duplicate. */

		if (ipv4 && (1 == rand() % 100))

		if (rand() % 100 == 1)

			send_fragment(fd_raw, addr, alen, offset, ipv6);

		offset += 2 * max_frag_len;

	}
@@ -342,7 +340,7 @@ static void run_test(struct sockaddr *addr, socklen_t alen, bool ipv6) 
	 */

	struct timeval tv = { .tv_sec = 1, .tv_usec = 10 };

	int idx;

	int min_frag_len = ipv6 ? 1280 : 8;

	int min_frag_len = 8;



	/* Initialize the payload. */

	for (idx = 0; idx < MSG_LEN_MAX; ++idx)
@@ -434,7 +432,7 @@ static void parse_opts(int argc, char **argv) 
{

	int c;



	while ((c = getopt(argc, argv, "46ov")) != -1) {

	while ((c = getopt(argc, argv, "46opv")) != -1) {

		switch (c) {

		case '4':

			cfg_do_ipv4 = true;
@@ -445,6 +443,9 @@ static void parse_opts(int argc, char **argv) 
		case 'o':

			cfg_overlap = true;

			break;

		case 'p':

			cfg_permissive = true;

			break;

		case 'v':

			cfg_verbose = true;

			break;

tools/testing/selftests/net/ip_defrag.sh

+16 −0
Original line number Diff line number Diff line
@@ -20,6 +20,10 @@ setup() { 
	ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_low_thresh=7000000 >/dev/null 2>&1

	ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_time=1 >/dev/null 2>&1



	ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_high_thresh=9000000 >/dev/null 2>&1

	ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_low_thresh=7000000  >/dev/null 2>&1

	ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_timeout=1 >/dev/null 2>&1



	# DST cache can get full with a lot of frags, with GC not keeping up with the test.

	ip netns exec "${NETNS}" sysctl -w net.ipv6.route.max_size=65536 >/dev/null 2>&1

}
@@ -43,4 +47,16 @@ ip netns exec "${NETNS}" ./ip_defrag -6 
echo "ipv6 defrag with overlaps"

ip netns exec "${NETNS}" ./ip_defrag -6o



# insert an nf_conntrack rule so that the codepath in nf_conntrack_reasm.c taken

ip netns exec "${NETNS}" ip6tables -A INPUT  -m conntrack --ctstate INVALID -j ACCEPT



echo "ipv6 nf_conntrack defrag"

ip netns exec "${NETNS}" ./ip_defrag -6



echo "ipv6 nf_conntrack defrag with overlaps"

# netfilter will drop some invalid packets, so we run the test in

# permissive mode: i.e. pass the test if the packet is correctly assembled

# even if we sent an overlap

ip netns exec "${NETNS}" ./ip_defrag -6op



echo "all tests done"

CRA Git | Maintained and supported by SUSTech CRA and CCSE