selftests: net: ip_defrag: cover new IPv6 defrag behavior
This patch adds several changes to the ip_defrag selftest, to cover new IPv6 defrag behavior: - min IPv6 frag size is now 8 instead of 1280 - new test cases to cover IPv6 defragmentation in nf_conntrack_reasm.c - new "permissive" mode in negative (overlap) tests: netfilter sometimes drops invalid packets without passing them to IPv6 underneath, and thus defragmentation sometimes succeeds when it is expected to fail; so the permissive mode does not fail the test if the correct reassembled datagram is received instead of a timeout. Signed-off-by: Peter Oskolkov <posk@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Peter Oskolkov
David S. Miller
parent
997dd96471
commit
4c3510483d
|
|
@ -20,6 +20,7 @@ static bool cfg_do_ipv4;
|
|||
static bool cfg_do_ipv6;
|
||||
static bool cfg_verbose;
|
||||
static bool cfg_overlap;
|
||||
static bool cfg_permissive;
|
||||
static unsigned short cfg_port = 9000;
|
||||
|
||||
const struct in_addr addr4 = { .s_addr = __constant_htonl(INADDR_LOOPBACK + 2) };
|
||||
|
|
@ -35,7 +36,7 @@ const struct in6_addr addr6 = IN6ADDR_LOOPBACK_INIT;
|
|||
static int payload_len;
|
||||
static int max_frag_len;
|
||||
|
||||
#define MSG_LEN_MAX 60000 /* Max UDP payload length. */
|
||||
#define MSG_LEN_MAX 10000 /* Max UDP payload length. */
|
||||
|
||||
#define IP4_MF (1u << 13) /* IPv4 MF flag. */
|
||||
#define IP6_MF (1) /* IPv6 MF flag. */
|
||||
|
|
@ -59,13 +60,14 @@ static void recv_validate_udp(int fd_udp)
|
|||
msg_counter++;
|
||||
|
||||
if (cfg_overlap) {
|
||||
if (ret != -1)
|
||||
error(1, 0, "recv: expected timeout; got %d",
|
||||
(int)ret);
|
||||
if (errno != ETIMEDOUT && errno != EAGAIN)
|
||||
error(1, errno, "recv: expected timeout: %d",
|
||||
errno);
|
||||
return; /* OK */
|
||||
if (ret == -1 && (errno == ETIMEDOUT || errno == EAGAIN))
|
||||
return; /* OK */
|
||||
if (!cfg_permissive) {
|
||||
if (ret != -1)
|
||||
error(1, 0, "recv: expected timeout; got %d",
|
||||
(int)ret);
|
||||
error(1, errno, "recv: expected timeout: %d", errno);
|
||||
}
|
||||
}
|
||||
|
||||
if (ret == -1)
|
||||
|
|
@ -203,7 +205,6 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
|
|||
{
|
||||
struct ip *iphdr = (struct ip *)ip_frame;
|
||||
struct ip6_hdr *ip6hdr = (struct ip6_hdr *)ip_frame;
|
||||
const bool ipv4 = !ipv6;
|
||||
int res;
|
||||
int offset;
|
||||
int frag_len;
|
||||
|
|
@ -251,7 +252,7 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
|
|||
}
|
||||
|
||||
/* Occasionally test IPv4 "runs" (see net/ipv4/ip_fragment.c) */
|
||||
if (ipv4 && !cfg_overlap && (rand() % 100 < 20) &&
|
||||
if (!cfg_overlap && (rand() % 100 < 20) &&
|
||||
(payload_len > 9 * max_frag_len)) {
|
||||
offset = 6 * max_frag_len;
|
||||
while (offset < (UDP_HLEN + payload_len)) {
|
||||
|
|
@ -276,41 +277,38 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
|
|||
while (offset < (UDP_HLEN + payload_len)) {
|
||||
send_fragment(fd_raw, addr, alen, offset, ipv6);
|
||||
/* IPv4 ignores duplicates, so randomly send a duplicate. */
|
||||
if (ipv4 && (1 == rand() % 100))
|
||||
if (rand() % 100 == 1)
|
||||
send_fragment(fd_raw, addr, alen, offset, ipv6);
|
||||
offset += 2 * max_frag_len;
|
||||
}
|
||||
|
||||
if (cfg_overlap) {
|
||||
/* Send an extra random fragment. */
|
||||
/* Send an extra random fragment.
|
||||
*
|
||||
* Duplicates and some fragments completely inside
|
||||
* previously sent fragments are dropped/ignored. So
|
||||
* random offset and frag_len can result in a dropped
|
||||
* fragment instead of a dropped queue/packet. Thus we
|
||||
* hard-code offset and frag_len.
|
||||
*/
|
||||
if (max_frag_len * 4 < payload_len || max_frag_len < 16) {
|
||||
/* not enough payload for random offset and frag_len. */
|
||||
offset = 8;
|
||||
frag_len = UDP_HLEN + max_frag_len;
|
||||
} else {
|
||||
offset = rand() % (payload_len / 2);
|
||||
frag_len = 2 * max_frag_len + 1 + rand() % 256;
|
||||
}
|
||||
if (ipv6) {
|
||||
struct ip6_frag *fraghdr = (struct ip6_frag *)(ip_frame + IP6_HLEN);
|
||||
/* sendto() returns EINVAL if offset + frag_len is too small. */
|
||||
offset = rand() % (UDP_HLEN + payload_len - 1);
|
||||
frag_len = max_frag_len + rand() % 256;
|
||||
/* In IPv6 if !!(frag_len % 8), the fragment is dropped. */
|
||||
frag_len &= ~0x7;
|
||||
fraghdr->ip6f_offlg = htons(offset / 8 | IP6_MF);
|
||||
ip6hdr->ip6_plen = htons(frag_len);
|
||||
frag_len += IP6_HLEN;
|
||||
} else {
|
||||
/* In IPv4, duplicates and some fragments completely inside
|
||||
* previously sent fragments are dropped/ignored. So
|
||||
* random offset and frag_len can result in a dropped
|
||||
* fragment instead of a dropped queue/packet. So we
|
||||
* hard-code offset and frag_len.
|
||||
*
|
||||
* See ade446403bfb ("net: ipv4: do not handle duplicate
|
||||
* fragments as overlapping").
|
||||
*/
|
||||
if (max_frag_len * 4 < payload_len || max_frag_len < 16) {
|
||||
/* not enough payload to play with random offset and frag_len. */
|
||||
offset = 8;
|
||||
frag_len = IP4_HLEN + UDP_HLEN + max_frag_len;
|
||||
} else {
|
||||
offset = rand() % (payload_len / 2);
|
||||
frag_len = 2 * max_frag_len + 1 + rand() % 256;
|
||||
}
|
||||
frag_len += IP4_HLEN;
|
||||
iphdr->ip_off = htons(offset / 8 | IP4_MF);
|
||||
iphdr->ip_len = htons(frag_len);
|
||||
}
|
||||
|
|
@ -327,7 +325,7 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
|
|||
while (offset < (UDP_HLEN + payload_len)) {
|
||||
send_fragment(fd_raw, addr, alen, offset, ipv6);
|
||||
/* IPv4 ignores duplicates, so randomly send a duplicate. */
|
||||
if (ipv4 && (1 == rand() % 100))
|
||||
if (rand() % 100 == 1)
|
||||
send_fragment(fd_raw, addr, alen, offset, ipv6);
|
||||
offset += 2 * max_frag_len;
|
||||
}
|
||||
|
|
@ -342,7 +340,7 @@ static void run_test(struct sockaddr *addr, socklen_t alen, bool ipv6)
|
|||
*/
|
||||
struct timeval tv = { .tv_sec = 1, .tv_usec = 10 };
|
||||
int idx;
|
||||
int min_frag_len = ipv6 ? 1280 : 8;
|
||||
int min_frag_len = 8;
|
||||
|
||||
/* Initialize the payload. */
|
||||
for (idx = 0; idx < MSG_LEN_MAX; ++idx)
|
||||
|
|
@ -434,7 +432,7 @@ static void parse_opts(int argc, char **argv)
|
|||
{
|
||||
int c;
|
||||
|
||||
while ((c = getopt(argc, argv, "46ov")) != -1) {
|
||||
while ((c = getopt(argc, argv, "46opv")) != -1) {
|
||||
switch (c) {
|
||||
case '4':
|
||||
cfg_do_ipv4 = true;
|
||||
|
|
@ -445,6 +443,9 @@ static void parse_opts(int argc, char **argv)
|
|||
case 'o':
|
||||
cfg_overlap = true;
|
||||
break;
|
||||
case 'p':
|
||||
cfg_permissive = true;
|
||||
break;
|
||||
case 'v':
|
||||
cfg_verbose = true;
|
||||
break;
|
||||
|
|
|
|||
|
|
@ -20,6 +20,10 @@ setup() {
|
|||
ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_low_thresh=7000000 >/dev/null 2>&1
|
||||
ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_time=1 >/dev/null 2>&1
|
||||
|
||||
ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_high_thresh=9000000 >/dev/null 2>&1
|
||||
ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_low_thresh=7000000 >/dev/null 2>&1
|
||||
ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_timeout=1 >/dev/null 2>&1
|
||||
|
||||
# DST cache can get full with a lot of frags, with GC not keeping up with the test.
|
||||
ip netns exec "${NETNS}" sysctl -w net.ipv6.route.max_size=65536 >/dev/null 2>&1
|
||||
}
|
||||
|
|
@ -43,4 +47,16 @@ ip netns exec "${NETNS}" ./ip_defrag -6
|
|||
echo "ipv6 defrag with overlaps"
|
||||
ip netns exec "${NETNS}" ./ip_defrag -6o
|
||||
|
||||
# insert an nf_conntrack rule so that the codepath in nf_conntrack_reasm.c taken
|
||||
ip netns exec "${NETNS}" ip6tables -A INPUT -m conntrack --ctstate INVALID -j ACCEPT
|
||||
|
||||
echo "ipv6 nf_conntrack defrag"
|
||||
ip netns exec "${NETNS}" ./ip_defrag -6
|
||||
|
||||
echo "ipv6 nf_conntrack defrag with overlaps"
|
||||
# netfilter will drop some invalid packets, so we run the test in
|
||||
# permissive mode: i.e. pass the test if the packet is correctly assembled
|
||||
# even if we sent an overlap
|
||||
ip netns exec "${NETNS}" ./ip_defrag -6op
|
||||
|
||||
echo "all tests done"
|
||||
|
|
|
|||
Loading…
Reference in New Issue