1#!/bin/bash 2# SPDX-License-Identifier: GPL-2.0 3# 4# Test NAT source port clash resolution 5# 6 7source lib.sh 8ret=0 9socatpid=0 10 11cleanup() 12{ 13 [ "$socatpid" -gt 0 ] && kill "$socatpid" 14 15 cleanup_all_ns 16} 17 18checktool "socat -h" "run test without socat" 19checktool "iptables --version" "run test without iptables" 20 21trap cleanup EXIT 22 23setup_ns ns1 ns2 24 25# Connect the namespaces using a veth pair 26ip link add name veth2 type veth peer name veth1 27ip link set netns "$ns1" dev veth1 28ip link set netns "$ns2" dev veth2 29 30ip netns exec "$ns1" ip link set up dev lo 31ip netns exec "$ns1" ip link set up dev veth1 32ip netns exec "$ns1" ip addr add 192.168.1.1/24 dev veth1 33 34ip netns exec "$ns2" ip link set up dev lo 35ip netns exec "$ns2" ip link set up dev veth2 36ip netns exec "$ns2" ip addr add 192.168.1.2/24 dev veth2 37 38# Create a server in one namespace 39ip netns exec "$ns1" socat -u TCP-LISTEN:5201,fork OPEN:/dev/null,wronly=1 & 40socatpid=$! 41 42# Restrict source port to just one so we don't have to exhaust 43# all others. 44ip netns exec "$ns2" sysctl -q net.ipv4.ip_local_port_range="10000 10000" 45 46# add a virtual IP using DNAT 47ip netns exec "$ns2" iptables -t nat -A OUTPUT -d 10.96.0.1/32 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.1:5201 48 49# ... and route it to the other namespace 50ip netns exec "$ns2" ip route add 10.96.0.1 via 192.168.1.1 51 52# add a persistent connection from the other namespace 53ip netns exec "$ns2" socat -t 10 - TCP:192.168.1.1:5201 > /dev/null & 54 55sleep 1 56 57# ip daddr:dport will be rewritten to 192.168.1.1 5201 58# NAT must reallocate source port 10000 because 59# 192.168.1.2:10000 -> 192.168.1.1:5201 is already in use 60echo test | ip netns exec "$ns2" socat -t 3 -u STDIN TCP:10.96.0.1:443,connect-timeout=3 >/dev/null 61ret=$? 62 63# Check socat can connect to 10.96.0.1:443 (aka 192.168.1.1:5201). 64if [ $ret -eq 0 ]; then 65 echo "PASS: socat can connect via NAT'd address" 66else 67 echo "FAIL: socat cannot connect via NAT'd address" 68fi 69 70# check sport clashres. 71ip netns exec "$ns1" iptables -t nat -A PREROUTING -p tcp --dport 5202 -j REDIRECT --to-ports 5201 72ip netns exec "$ns1" iptables -t nat -A PREROUTING -p tcp --dport 5203 -j REDIRECT --to-ports 5201 73 74sleep 5 | ip netns exec "$ns2" socat -t 5 -u STDIN TCP:192.168.1.1:5202,connect-timeout=5 >/dev/null & 75 76# if connect succeeds, client closes instantly due to EOF on stdin. 77# if connect hangs, it will time out after 5s. 78echo | ip netns exec "$ns2" socat -t 3 -u STDIN TCP:192.168.1.1:5203,connect-timeout=5 >/dev/null & 79cpid2=$! 80 81time_then=$(date +%s) 82wait $cpid2 83rv=$? 84time_now=$(date +%s) 85 86# Check how much time has elapsed, expectation is for 87# 'cpid2' to connect and then exit (and no connect delay). 88delta=$((time_now - time_then)) 89 90if [ $delta -lt 2 ] && [ $rv -eq 0 ]; then 91 echo "PASS: could connect to service via redirected ports" 92else 93 echo "FAIL: socat cannot connect to service via redirect ($delta seconds elapsed, returned $rv)" 94 ret=1 95fi 96 97exit $ret 98