1 // SPDX-License-Identifier: GPL-2.0
2
3 #define _GNU_SOURCE
4
5 #include <arpa/inet.h>
6 #include <errno.h>
7 #include <error.h>
8 #include <linux/in.h>
9 #include <netinet/ip.h>
10 #include <netinet/ip6.h>
11 #include <netinet/udp.h>
12 #include <stdbool.h>
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string.h>
16 #include <time.h>
17 #include <unistd.h>
18
19 static bool cfg_do_ipv4;
20 static bool cfg_do_ipv6;
21 static bool cfg_verbose;
22 static bool cfg_overlap;
23 static unsigned short cfg_port = 9000;
24
25 const struct in_addr addr4 = { .s_addr = __constant_htonl(INADDR_LOOPBACK + 2) };
26 const struct in6_addr addr6 = IN6ADDR_LOOPBACK_INIT;
27
28 #define IP4_HLEN (sizeof(struct iphdr))
29 #define IP6_HLEN (sizeof(struct ip6_hdr))
30 #define UDP_HLEN (sizeof(struct udphdr))
31
32 /* IPv6 fragment header lenth. */
33 #define FRAG_HLEN 8
34
35 static int payload_len;
36 static int max_frag_len;
37
38 #define MSG_LEN_MAX 60000 /* Max UDP payload length. */
39
40 #define IP4_MF (1u << 13) /* IPv4 MF flag. */
41 #define IP6_MF (1) /* IPv6 MF flag. */
42
43 #define CSUM_MANGLED_0 (0xffff)
44
45 static uint8_t udp_payload[MSG_LEN_MAX];
46 static uint8_t ip_frame[IP_MAXPACKET];
47 static uint32_t ip_id = 0xabcd;
48 static int msg_counter;
49 static int frag_counter;
50 static unsigned int seed;
51
52 /* Receive a UDP packet. Validate it matches udp_payload. */
recv_validate_udp(int fd_udp)53 static void recv_validate_udp(int fd_udp)
54 {
55 ssize_t ret;
56 static uint8_t recv_buff[MSG_LEN_MAX];
57
58 ret = recv(fd_udp, recv_buff, payload_len, 0);
59 msg_counter++;
60
61 if (cfg_overlap) {
62 if (ret != -1)
63 error(1, 0, "recv: expected timeout; got %d",
64 (int)ret);
65 if (errno != ETIMEDOUT && errno != EAGAIN)
66 error(1, errno, "recv: expected timeout: %d",
67 errno);
68 return; /* OK */
69 }
70
71 if (ret == -1)
72 error(1, errno, "recv: payload_len = %d max_frag_len = %d",
73 payload_len, max_frag_len);
74 if (ret != payload_len)
75 error(1, 0, "recv: wrong size: %d vs %d", (int)ret, payload_len);
76 if (memcmp(udp_payload, recv_buff, payload_len))
77 error(1, 0, "recv: wrong data");
78 }
79
raw_checksum(uint8_t * buf,int len,uint32_t sum)80 static uint32_t raw_checksum(uint8_t *buf, int len, uint32_t sum)
81 {
82 int i;
83
84 for (i = 0; i < (len & ~1U); i += 2) {
85 sum += (u_int16_t)ntohs(*((u_int16_t *)(buf + i)));
86 if (sum > 0xffff)
87 sum -= 0xffff;
88 }
89
90 if (i < len) {
91 sum += buf[i] << 8;
92 if (sum > 0xffff)
93 sum -= 0xffff;
94 }
95
96 return sum;
97 }
98
udp_checksum(struct ip * iphdr,struct udphdr * udphdr)99 static uint16_t udp_checksum(struct ip *iphdr, struct udphdr *udphdr)
100 {
101 uint32_t sum = 0;
102 uint16_t res;
103
104 sum = raw_checksum((uint8_t *)&iphdr->ip_src, 2 * sizeof(iphdr->ip_src),
105 IPPROTO_UDP + (uint32_t)(UDP_HLEN + payload_len));
106 sum = raw_checksum((uint8_t *)udphdr, UDP_HLEN, sum);
107 sum = raw_checksum((uint8_t *)udp_payload, payload_len, sum);
108 res = 0xffff & ~sum;
109 if (res)
110 return htons(res);
111 else
112 return CSUM_MANGLED_0;
113 }
114
udp6_checksum(struct ip6_hdr * iphdr,struct udphdr * udphdr)115 static uint16_t udp6_checksum(struct ip6_hdr *iphdr, struct udphdr *udphdr)
116 {
117 uint32_t sum = 0;
118 uint16_t res;
119
120 sum = raw_checksum((uint8_t *)&iphdr->ip6_src, 2 * sizeof(iphdr->ip6_src),
121 IPPROTO_UDP);
122 sum = raw_checksum((uint8_t *)&udphdr->len, sizeof(udphdr->len), sum);
123 sum = raw_checksum((uint8_t *)udphdr, UDP_HLEN, sum);
124 sum = raw_checksum((uint8_t *)udp_payload, payload_len, sum);
125 res = 0xffff & ~sum;
126 if (res)
127 return htons(res);
128 else
129 return CSUM_MANGLED_0;
130 }
131
send_fragment(int fd_raw,struct sockaddr * addr,socklen_t alen,int offset,bool ipv6)132 static void send_fragment(int fd_raw, struct sockaddr *addr, socklen_t alen,
133 int offset, bool ipv6)
134 {
135 int frag_len;
136 int res;
137 int payload_offset = offset > 0 ? offset - UDP_HLEN : 0;
138 uint8_t *frag_start = ipv6 ? ip_frame + IP6_HLEN + FRAG_HLEN :
139 ip_frame + IP4_HLEN;
140
141 if (offset == 0) {
142 struct udphdr udphdr;
143 udphdr.source = htons(cfg_port + 1);
144 udphdr.dest = htons(cfg_port);
145 udphdr.len = htons(UDP_HLEN + payload_len);
146 udphdr.check = 0;
147 if (ipv6)
148 udphdr.check = udp6_checksum((struct ip6_hdr *)ip_frame, &udphdr);
149 else
150 udphdr.check = udp_checksum((struct ip *)ip_frame, &udphdr);
151 memcpy(frag_start, &udphdr, UDP_HLEN);
152 }
153
154 if (ipv6) {
155 struct ip6_hdr *ip6hdr = (struct ip6_hdr *)ip_frame;
156 struct ip6_frag *fraghdr = (struct ip6_frag *)(ip_frame + IP6_HLEN);
157 if (payload_len - payload_offset <= max_frag_len && offset > 0) {
158 /* This is the last fragment. */
159 frag_len = FRAG_HLEN + payload_len - payload_offset;
160 fraghdr->ip6f_offlg = htons(offset);
161 } else {
162 frag_len = FRAG_HLEN + max_frag_len;
163 fraghdr->ip6f_offlg = htons(offset | IP6_MF);
164 }
165 ip6hdr->ip6_plen = htons(frag_len);
166 if (offset == 0)
167 memcpy(frag_start + UDP_HLEN, udp_payload,
168 frag_len - FRAG_HLEN - UDP_HLEN);
169 else
170 memcpy(frag_start, udp_payload + payload_offset,
171 frag_len - FRAG_HLEN);
172 frag_len += IP6_HLEN;
173 } else {
174 struct ip *iphdr = (struct ip *)ip_frame;
175 if (payload_len - payload_offset <= max_frag_len && offset > 0) {
176 /* This is the last fragment. */
177 frag_len = IP4_HLEN + payload_len - payload_offset;
178 iphdr->ip_off = htons(offset / 8);
179 } else {
180 frag_len = IP4_HLEN + max_frag_len;
181 iphdr->ip_off = htons(offset / 8 | IP4_MF);
182 }
183 iphdr->ip_len = htons(frag_len);
184 if (offset == 0)
185 memcpy(frag_start + UDP_HLEN, udp_payload,
186 frag_len - IP4_HLEN - UDP_HLEN);
187 else
188 memcpy(frag_start, udp_payload + payload_offset,
189 frag_len - IP4_HLEN);
190 }
191
192 res = sendto(fd_raw, ip_frame, frag_len, 0, addr, alen);
193 if (res < 0)
194 error(1, errno, "send_fragment");
195 if (res != frag_len)
196 error(1, 0, "send_fragment: %d vs %d", res, frag_len);
197
198 frag_counter++;
199 }
200
send_udp_frags(int fd_raw,struct sockaddr * addr,socklen_t alen,bool ipv6)201 static void send_udp_frags(int fd_raw, struct sockaddr *addr,
202 socklen_t alen, bool ipv6)
203 {
204 struct ip *iphdr = (struct ip *)ip_frame;
205 struct ip6_hdr *ip6hdr = (struct ip6_hdr *)ip_frame;
206 int res;
207 int offset;
208 int frag_len;
209
210 /* Send the UDP datagram using raw IP fragments: the 0th fragment
211 * has the UDP header; other fragments are pieces of udp_payload
212 * split in chunks of frag_len size.
213 *
214 * Odd fragments (1st, 3rd, 5th, etc.) are sent out first, then
215 * even fragments (0th, 2nd, etc.) are sent out.
216 */
217 if (ipv6) {
218 struct ip6_frag *fraghdr = (struct ip6_frag *)(ip_frame + IP6_HLEN);
219 ((struct sockaddr_in6 *)addr)->sin6_port = 0;
220 memset(ip6hdr, 0, sizeof(*ip6hdr));
221 ip6hdr->ip6_flow = htonl(6<<28); /* Version. */
222 ip6hdr->ip6_nxt = IPPROTO_FRAGMENT;
223 ip6hdr->ip6_hops = 255;
224 ip6hdr->ip6_src = addr6;
225 ip6hdr->ip6_dst = addr6;
226 fraghdr->ip6f_nxt = IPPROTO_UDP;
227 fraghdr->ip6f_reserved = 0;
228 fraghdr->ip6f_ident = htonl(ip_id++);
229 } else {
230 memset(iphdr, 0, sizeof(*iphdr));
231 iphdr->ip_hl = 5;
232 iphdr->ip_v = 4;
233 iphdr->ip_tos = 0;
234 iphdr->ip_id = htons(ip_id++);
235 iphdr->ip_ttl = 0x40;
236 iphdr->ip_p = IPPROTO_UDP;
237 iphdr->ip_src.s_addr = htonl(INADDR_LOOPBACK);
238 iphdr->ip_dst = addr4;
239 iphdr->ip_sum = 0;
240 }
241
242 /* Odd fragments. */
243 offset = max_frag_len;
244 while (offset < (UDP_HLEN + payload_len)) {
245 send_fragment(fd_raw, addr, alen, offset, ipv6);
246 offset += 2 * max_frag_len;
247 }
248
249 if (cfg_overlap) {
250 /* Send an extra random fragment. */
251 offset = rand() % (UDP_HLEN + payload_len - 1);
252 /* sendto() returns EINVAL if offset + frag_len is too small. */
253 if (ipv6) {
254 struct ip6_frag *fraghdr = (struct ip6_frag *)(ip_frame + IP6_HLEN);
255 frag_len = max_frag_len + rand() % 256;
256 /* In IPv6 if !!(frag_len % 8), the fragment is dropped. */
257 frag_len &= ~0x7;
258 fraghdr->ip6f_offlg = htons(offset / 8 | IP6_MF);
259 ip6hdr->ip6_plen = htons(frag_len);
260 frag_len += IP6_HLEN;
261 } else {
262 frag_len = IP4_HLEN + UDP_HLEN + rand() % 256;
263 iphdr->ip_off = htons(offset / 8 | IP4_MF);
264 iphdr->ip_len = htons(frag_len);
265 }
266 res = sendto(fd_raw, ip_frame, frag_len, 0, addr, alen);
267 if (res < 0)
268 error(1, errno, "sendto overlap");
269 if (res != frag_len)
270 error(1, 0, "sendto overlap: %d vs %d", (int)res, frag_len);
271 frag_counter++;
272 }
273
274 /* Event fragments. */
275 offset = 0;
276 while (offset < (UDP_HLEN + payload_len)) {
277 send_fragment(fd_raw, addr, alen, offset, ipv6);
278 offset += 2 * max_frag_len;
279 }
280 }
281
run_test(struct sockaddr * addr,socklen_t alen,bool ipv6)282 static void run_test(struct sockaddr *addr, socklen_t alen, bool ipv6)
283 {
284 int fd_tx_raw, fd_rx_udp;
285 struct timeval tv = { .tv_sec = 0, .tv_usec = 10 * 1000 };
286 int idx;
287 int min_frag_len = ipv6 ? 1280 : 8;
288
289 /* Initialize the payload. */
290 for (idx = 0; idx < MSG_LEN_MAX; ++idx)
291 udp_payload[idx] = idx % 256;
292
293 /* Open sockets. */
294 fd_tx_raw = socket(addr->sa_family, SOCK_RAW, IPPROTO_RAW);
295 if (fd_tx_raw == -1)
296 error(1, errno, "socket tx_raw");
297
298 fd_rx_udp = socket(addr->sa_family, SOCK_DGRAM, 0);
299 if (fd_rx_udp == -1)
300 error(1, errno, "socket rx_udp");
301 if (bind(fd_rx_udp, addr, alen))
302 error(1, errno, "bind");
303 /* Fail fast. */
304 if (setsockopt(fd_rx_udp, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)))
305 error(1, errno, "setsockopt rcv timeout");
306
307 for (payload_len = min_frag_len; payload_len < MSG_LEN_MAX;
308 payload_len += (rand() % 4096)) {
309 if (cfg_verbose)
310 printf("payload_len: %d\n", payload_len);
311 max_frag_len = min_frag_len;
312 do {
313 send_udp_frags(fd_tx_raw, addr, alen, ipv6);
314 recv_validate_udp(fd_rx_udp);
315 max_frag_len += 8 * (rand() % 8);
316 } while (max_frag_len < (1500 - FRAG_HLEN) && max_frag_len <= payload_len);
317 }
318
319 /* Cleanup. */
320 if (close(fd_tx_raw))
321 error(1, errno, "close tx_raw");
322 if (close(fd_rx_udp))
323 error(1, errno, "close rx_udp");
324
325 if (cfg_verbose)
326 printf("processed %d messages, %d fragments\n",
327 msg_counter, frag_counter);
328
329 fprintf(stderr, "PASS\n");
330 }
331
332
run_test_v4(void)333 static void run_test_v4(void)
334 {
335 struct sockaddr_in addr = {0};
336
337 addr.sin_family = AF_INET;
338 addr.sin_port = htons(cfg_port);
339 addr.sin_addr = addr4;
340
341 run_test((void *)&addr, sizeof(addr), false /* !ipv6 */);
342 }
343
run_test_v6(void)344 static void run_test_v6(void)
345 {
346 struct sockaddr_in6 addr = {0};
347
348 addr.sin6_family = AF_INET6;
349 addr.sin6_port = htons(cfg_port);
350 addr.sin6_addr = addr6;
351
352 run_test((void *)&addr, sizeof(addr), true /* ipv6 */);
353 }
354
parse_opts(int argc,char ** argv)355 static void parse_opts(int argc, char **argv)
356 {
357 int c;
358
359 while ((c = getopt(argc, argv, "46ov")) != -1) {
360 switch (c) {
361 case '4':
362 cfg_do_ipv4 = true;
363 break;
364 case '6':
365 cfg_do_ipv6 = true;
366 break;
367 case 'o':
368 cfg_overlap = true;
369 break;
370 case 'v':
371 cfg_verbose = true;
372 break;
373 default:
374 error(1, 0, "%s: parse error", argv[0]);
375 }
376 }
377 }
378
main(int argc,char ** argv)379 int main(int argc, char **argv)
380 {
381 parse_opts(argc, argv);
382 seed = time(NULL);
383 srand(seed);
384 /* Print the seed to track/reproduce potential failures. */
385 printf("seed = %d\n", seed);
386
387 if (cfg_do_ipv4)
388 run_test_v4();
389 if (cfg_do_ipv6)
390 run_test_v6();
391
392 return 0;
393 }
394