2 # SPDX-License-Identifier: GPL-2.0
4 # Test NAT source port clash resolution
7 # Kselftest framework requirement - SKIP code is 4.
11 sfx=$(mktemp -u "XXXXXXXX")
21 iperf3 -v > /dev/null 2>&1
23 echo "SKIP: Could not run test without iperf3"
27 iptables --version > /dev/null 2>&1
29 echo "SKIP: Could not run test without iptables"
33 ip -Version > /dev/null 2>&1
35 echo "SKIP: Could not run test without ip tool"
41 echo "SKIP: Could not create net namespace $ns1"
49 # Connect the namespaces using a veth pair
50 ip link add name veth2 type veth peer name veth1
51 ip link set netns $ns1 dev veth1
52 ip link set netns $ns2 dev veth2
54 ip netns exec $ns1 ip link set up dev lo
55 ip netns exec $ns1 ip link set up dev veth1
56 ip netns exec $ns1 ip addr add 192.168.1.1/24 dev veth1
58 ip netns exec $ns2 ip link set up dev lo
59 ip netns exec $ns2 ip link set up dev veth2
60 ip netns exec $ns2 ip addr add 192.168.1.2/24 dev veth2
62 # Create a server in one namespace
63 ip netns exec $ns1 iperf3 -s > /dev/null 2>&1 &
66 # Restrict source port to just one so we don't have to exhaust
68 ip netns exec $ns2 sysctl -q net.ipv4.ip_local_port_range="10000 10000"
70 # add a virtual IP using DNAT
71 ip netns exec $ns2 iptables -t nat -A OUTPUT -d 10.96.0.1/32 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.1:5201
73 # ... and route it to the other namespace
74 ip netns exec $ns2 ip route add 10.96.0.1 via 192.168.1.1
78 # add a persistent connection from the other namespace
79 ip netns exec $ns2 nc -q 10 -w 10 192.168.1.1 5201 > /dev/null &
83 # ip daddr:dport will be rewritten to 192.168.1.1 5201
84 # NAT must reallocate source port 10000 because
85 # 192.168.1.2:10000 -> 192.168.1.1:5201 is already in use
86 echo test | ip netns exec $ns2 nc -w 3 -q 3 10.96.0.1 443 >/dev/null
91 # Check nc can connect to 10.96.0.1:443 (aka 192.168.1.1:5201).
92 if [ $ret -eq 0 ]; then
93 echo "PASS: nc can connect via NAT'd address"
95 echo "FAIL: nc cannot connect via NAT'd address"