1#!/bin/bash
2# SPDX-License-Identifier: GPL-2.0
3#
4# Test NAT source port clash resolution
5#
6
7source lib.sh
8ret=0
9socatpid=0
10
11cleanup()
12{
13	[ "$socatpid" -gt 0 ] && kill "$socatpid"
14
15	cleanup_all_ns
16}
17
18checktool "socat -h" "run test without socat"
19checktool "iptables --version" "run test without iptables"
20
21trap cleanup EXIT
22
23setup_ns ns1 ns2
24
25# Connect the namespaces using a veth pair
26ip link add name veth2 type veth peer name veth1
27ip link set netns "$ns1" dev veth1
28ip link set netns "$ns2" dev veth2
29
30ip netns exec "$ns1" ip link set up dev lo
31ip netns exec "$ns1" ip link set up dev veth1
32ip netns exec "$ns1" ip addr add 192.168.1.1/24 dev veth1
33
34ip netns exec "$ns2" ip link set up dev lo
35ip netns exec "$ns2" ip link set up dev veth2
36ip netns exec "$ns2" ip addr add 192.168.1.2/24 dev veth2
37
38# Create a server in one namespace
39ip netns exec "$ns1" socat -u TCP-LISTEN:5201,fork OPEN:/dev/null,wronly=1 &
40socatpid=$!
41
42# Restrict source port to just one so we don't have to exhaust
43# all others.
44ip netns exec "$ns2" sysctl -q net.ipv4.ip_local_port_range="10000 10000"
45
46# add a virtual IP using DNAT
47ip netns exec "$ns2" iptables -t nat -A OUTPUT -d 10.96.0.1/32 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.1:5201
48
49# ... and route it to the other namespace
50ip netns exec "$ns2" ip route add 10.96.0.1 via 192.168.1.1
51
52# add a persistent connection from the other namespace
53ip netns exec "$ns2" socat -t 10 - TCP:192.168.1.1:5201 > /dev/null &
54
55sleep 1
56
57# ip daddr:dport will be rewritten to 192.168.1.1 5201
58# NAT must reallocate source port 10000 because
59# 192.168.1.2:10000 -> 192.168.1.1:5201 is already in use
60echo test | ip netns exec "$ns2" socat -t 3 -u STDIN TCP:10.96.0.1:443,connect-timeout=3 >/dev/null
61ret=$?
62
63# Check socat can connect to 10.96.0.1:443 (aka 192.168.1.1:5201).
64if [ $ret -eq 0 ]; then
65	echo "PASS: socat can connect via NAT'd address"
66else
67	echo "FAIL: socat cannot connect via NAT'd address"
68fi
69
70# check sport clashres.
71ip netns exec "$ns1" iptables -t nat -A PREROUTING -p tcp --dport 5202 -j REDIRECT --to-ports 5201
72ip netns exec "$ns1" iptables -t nat -A PREROUTING -p tcp --dport 5203 -j REDIRECT --to-ports 5201
73
74sleep 5 | ip netns exec "$ns2" socat -t 5 -u STDIN TCP:192.168.1.1:5202,connect-timeout=5 >/dev/null &
75
76# if connect succeeds, client closes instantly due to EOF on stdin.
77# if connect hangs, it will time out after 5s.
78echo | ip netns exec "$ns2" socat -t 3 -u STDIN TCP:192.168.1.1:5203,connect-timeout=5 >/dev/null &
79cpid2=$!
80
81time_then=$(date +%s)
82wait $cpid2
83rv=$?
84time_now=$(date +%s)
85
86# Check how much time has elapsed, expectation is for
87# 'cpid2' to connect and then exit (and no connect delay).
88delta=$((time_now - time_then))
89
90if [ $delta -lt 2 ] && [ $rv -eq 0 ]; then
91	echo "PASS: could connect to service via redirected ports"
92else
93	echo "FAIL: socat cannot connect to service via redirect ($delta seconds elapsed, returned $rv)"
94	ret=1
95fi
96
97exit $ret
98