selftests: net: ip_defrag: cover new IPv6 defrag behavior

This patch adds several changes to the ip_defrag selftest, to cover
new IPv6 defrag behavior:

- min IPv6 frag size is now 8 instead of 1280

- new test cases to cover IPv6 defragmentation in nf_conntrack_reasm.c

- new "permissive" mode in negative (overlap) tests: netfilter
sometimes drops invalid packets without passing them to IPv6
underneath, and thus defragmentation sometimes succeeds when
it is expected to fail; so the permissive mode does not fail the
test if the correct reassembled datagram is received instead of a
timeout.

Signed-off-by: Peter Oskolkov <posk@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/tools/testing/selftests/net/ip_defrag.c b/tools/testing/selftests/net/ip_defrag.c
index 5d56cc0..c0c9ecb 100644 (file)
--- a/tools/testing/selftests/net/ip_defrag.c
+++ b/tools/testing/selftests/net/ip_defrag.c
@@ -20,6 +20,7 @@ static bool           cfg_do_ipv4;
 static bool            cfg_do_ipv6;
 static bool            cfg_verbose;
 static bool            cfg_overlap;
+static bool            cfg_permissive;
 static unsigned short  cfg_port = 9000;
 
 const struct in_addr addr4 = { .s_addr = __constant_htonl(INADDR_LOOPBACK + 2) };
@@ -35,7 +36,7 @@ const struct in6_addr addr6 = IN6ADDR_LOOPBACK_INIT;
 static int payload_len;
 static int max_frag_len;
 
-#define MSG_LEN_MAX    60000   /* Max UDP payload length. */
+#define MSG_LEN_MAX    10000   /* Max UDP payload length. */
 
 #define IP4_MF         (1u << 13)  /* IPv4 MF flag. */
 #define IP6_MF         (1)  /* IPv6 MF flag. */
@@ -59,13 +60,14 @@ static void recv_validate_udp(int fd_udp)
        msg_counter++;
 
        if (cfg_overlap) {
-               if (ret != -1)
-                       error(1, 0, "recv: expected timeout; got %d",
-                               (int)ret);
-               if (errno != ETIMEDOUT && errno != EAGAIN)
-                       error(1, errno, "recv: expected timeout: %d",
-                                errno);
-               return;  /* OK */
+               if (ret == -1 && (errno == ETIMEDOUT || errno == EAGAIN))
+                       return;  /* OK */
+               if (!cfg_permissive) {
+                       if (ret != -1)
+                               error(1, 0, "recv: expected timeout; got %d",
+                                       (int)ret);
+                       error(1, errno, "recv: expected timeout: %d", errno);
+               }
        }
 
        if (ret == -1)
@@ -203,7 +205,6 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
 {
        struct ip *iphdr = (struct ip *)ip_frame;
        struct ip6_hdr *ip6hdr = (struct ip6_hdr *)ip_frame;
-       const bool ipv4 = !ipv6;
        int res;
        int offset;
        int frag_len;
@@ -251,7 +252,7 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
        }
 
        /* Occasionally test IPv4 "runs" (see net/ipv4/ip_fragment.c) */
-       if (ipv4 && !cfg_overlap && (rand() % 100 < 20) &&
+       if (!cfg_overlap && (rand() % 100 < 20) &&
                        (payload_len > 9 * max_frag_len)) {
                offset = 6 * max_frag_len;
                while (offset < (UDP_HLEN + payload_len)) {
@@ -276,41 +277,38 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
        while (offset < (UDP_HLEN + payload_len)) {
                send_fragment(fd_raw, addr, alen, offset, ipv6);
                /* IPv4 ignores duplicates, so randomly send a duplicate. */
-               if (ipv4 && (1 == rand() % 100))
+               if (rand() % 100 == 1)
                        send_fragment(fd_raw, addr, alen, offset, ipv6);
                offset += 2 * max_frag_len;
        }
 
        if (cfg_overlap) {
-               /* Send an extra random fragment. */
+               /* Send an extra random fragment.
+                *
+                * Duplicates and some fragments completely inside
+                * previously sent fragments are dropped/ignored. So
+                * random offset and frag_len can result in a dropped
+                * fragment instead of a dropped queue/packet. Thus we
+                * hard-code offset and frag_len.
+                */
+               if (max_frag_len * 4 < payload_len || max_frag_len < 16) {
+                       /* not enough payload for random offset and frag_len. */
+                       offset = 8;
+                       frag_len = UDP_HLEN + max_frag_len;
+               } else {
+                       offset = rand() % (payload_len / 2);
+                       frag_len = 2 * max_frag_len + 1 + rand() % 256;
+               }
                if (ipv6) {
                        struct ip6_frag *fraghdr = (struct ip6_frag *)(ip_frame + IP6_HLEN);
                        /* sendto() returns EINVAL if offset + frag_len is too small. */
-                       offset = rand() % (UDP_HLEN + payload_len - 1);
-                       frag_len = max_frag_len + rand() % 256;
                        /* In IPv6 if !!(frag_len % 8), the fragment is dropped. */
                        frag_len &= ~0x7;
                        fraghdr->ip6f_offlg = htons(offset / 8 | IP6_MF);
                        ip6hdr->ip6_plen = htons(frag_len);
                        frag_len += IP6_HLEN;
                } else {
-                       /* In IPv4, duplicates and some fragments completely inside
-                        * previously sent fragments are dropped/ignored. So
-                        * random offset and frag_len can result in a dropped
-                        * fragment instead of a dropped queue/packet. So we
-                        * hard-code offset and frag_len.
-                        *
-                        * See ade446403bfb ("net: ipv4: do not handle duplicate
-                        * fragments as overlapping").
-                        */
-                       if (max_frag_len * 4 < payload_len || max_frag_len < 16) {
-                               /* not enough payload to play with random offset and frag_len. */
-                               offset = 8;
-                               frag_len = IP4_HLEN + UDP_HLEN + max_frag_len;
-                       } else {
-                               offset = rand() % (payload_len / 2);
-                               frag_len = 2 * max_frag_len + 1 + rand() % 256;
-                       }
+                       frag_len += IP4_HLEN;
                        iphdr->ip_off = htons(offset / 8 | IP4_MF);
                        iphdr->ip_len = htons(frag_len);
                }
@@ -327,7 +325,7 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
        while (offset < (UDP_HLEN + payload_len)) {
                send_fragment(fd_raw, addr, alen, offset, ipv6);
                /* IPv4 ignores duplicates, so randomly send a duplicate. */
-               if (ipv4 && (1 == rand() % 100))
+               if (rand() % 100 == 1)
                        send_fragment(fd_raw, addr, alen, offset, ipv6);
                offset += 2 * max_frag_len;
        }
@@ -342,7 +340,7 @@ static void run_test(struct sockaddr *addr, socklen_t alen, bool ipv6)
         */
        struct timeval tv = { .tv_sec = 1, .tv_usec = 10 };
        int idx;
-       int min_frag_len = ipv6 ? 1280 : 8;
+       int min_frag_len = 8;
 
        /* Initialize the payload. */
        for (idx = 0; idx < MSG_LEN_MAX; ++idx)
@@ -434,7 +432,7 @@ static void parse_opts(int argc, char **argv)
 {
        int c;
 
-       while ((c = getopt(argc, argv, "46ov")) != -1) {
+       while ((c = getopt(argc, argv, "46opv")) != -1) {
                switch (c) {
                case '4':
                        cfg_do_ipv4 = true;
@@ -445,6 +443,9 @@ static void parse_opts(int argc, char **argv)
                case 'o':
                        cfg_overlap = true;
                        break;
+               case 'p':
+                       cfg_permissive = true;
+                       break;
                case 'v':
                        cfg_verbose = true;
                        break;

diff --git a/tools/testing/selftests/net/ip_defrag.sh b/tools/testing/selftests/net/ip_defrag.sh
index 7dd79a9..15d3489 100755 (executable)
--- a/tools/testing/selftests/net/ip_defrag.sh
+++ b/tools/testing/selftests/net/ip_defrag.sh
@@ -20,6 +20,10 @@ setup() {
        ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_low_thresh=7000000 >/dev/null 2>&1
        ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_time=1 >/dev/null 2>&1
 
+       ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_high_thresh=9000000 >/dev/null 2>&1
+       ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_low_thresh=7000000  >/dev/null 2>&1
+       ip netns exec "${NETNS}" sysctl -w net.netfilter.nf_conntrack_frag6_timeout=1 >/dev/null 2>&1
+
        # DST cache can get full with a lot of frags, with GC not keeping up with the test.
        ip netns exec "${NETNS}" sysctl -w net.ipv6.route.max_size=65536 >/dev/null 2>&1
 }
@@ -43,4 +47,16 @@ ip netns exec "${NETNS}" ./ip_defrag -6
 echo "ipv6 defrag with overlaps"
 ip netns exec "${NETNS}" ./ip_defrag -6o
 
+# insert an nf_conntrack rule so that the codepath in nf_conntrack_reasm.c taken
+ip netns exec "${NETNS}" ip6tables -A INPUT  -m conntrack --ctstate INVALID -j ACCEPT
+
+echo "ipv6 nf_conntrack defrag"
+ip netns exec "${NETNS}" ./ip_defrag -6
+
+echo "ipv6 nf_conntrack defrag with overlaps"
+# netfilter will drop some invalid packets, so we run the test in
+# permissive mode: i.e. pass the test if the packet is correctly assembled
+# even if we sent an overlap
+ip netns exec "${NETNS}" ./ip_defrag -6op
+
 echo "all tests done"