1 // SPDX-License-Identifier: GPL-2.0
2
3 #define _GNU_SOURCE
4
5 #include <arpa/inet.h>
6 #include <errno.h>
7 #include <error.h>
8 #include <fcntl.h>
9 #include <poll.h>
10 #include <stdio.h>
11 #include <stdlib.h>
12 #include <unistd.h>
13
14 #include <linux/tls.h>
15 #include <linux/tcp.h>
16 #include <linux/socket.h>
17
18 #include <sys/epoll.h>
19 #include <sys/types.h>
20 #include <sys/sendfile.h>
21 #include <sys/socket.h>
22 #include <sys/stat.h>
23
24 #include "kselftest_harness.h"
25
26 #define TLS_PAYLOAD_MAX_LEN 16384
27 #define SOL_TLS 282
28
29 static int fips_enabled;
30
31 struct tls_crypto_info_keys {
32 union {
33 struct tls_crypto_info crypto_info;
34 struct tls12_crypto_info_aes_gcm_128 aes128;
35 struct tls12_crypto_info_chacha20_poly1305 chacha20;
36 struct tls12_crypto_info_sm4_gcm sm4gcm;
37 struct tls12_crypto_info_sm4_ccm sm4ccm;
38 struct tls12_crypto_info_aes_ccm_128 aesccm128;
39 struct tls12_crypto_info_aes_gcm_256 aesgcm256;
40 struct tls12_crypto_info_aria_gcm_128 ariagcm128;
41 struct tls12_crypto_info_aria_gcm_256 ariagcm256;
42 };
43 size_t len;
44 };
45
tls_crypto_info_init(uint16_t tls_version,uint16_t cipher_type,struct tls_crypto_info_keys * tls12,char key_generation)46 static void tls_crypto_info_init(uint16_t tls_version, uint16_t cipher_type,
47 struct tls_crypto_info_keys *tls12,
48 char key_generation)
49 {
50 memset(tls12, key_generation, sizeof(*tls12));
51 memset(tls12, 0, sizeof(struct tls_crypto_info));
52
53 switch (cipher_type) {
54 case TLS_CIPHER_CHACHA20_POLY1305:
55 tls12->len = sizeof(struct tls12_crypto_info_chacha20_poly1305);
56 tls12->chacha20.info.version = tls_version;
57 tls12->chacha20.info.cipher_type = cipher_type;
58 break;
59 case TLS_CIPHER_AES_GCM_128:
60 tls12->len = sizeof(struct tls12_crypto_info_aes_gcm_128);
61 tls12->aes128.info.version = tls_version;
62 tls12->aes128.info.cipher_type = cipher_type;
63 break;
64 case TLS_CIPHER_SM4_GCM:
65 tls12->len = sizeof(struct tls12_crypto_info_sm4_gcm);
66 tls12->sm4gcm.info.version = tls_version;
67 tls12->sm4gcm.info.cipher_type = cipher_type;
68 break;
69 case TLS_CIPHER_SM4_CCM:
70 tls12->len = sizeof(struct tls12_crypto_info_sm4_ccm);
71 tls12->sm4ccm.info.version = tls_version;
72 tls12->sm4ccm.info.cipher_type = cipher_type;
73 break;
74 case TLS_CIPHER_AES_CCM_128:
75 tls12->len = sizeof(struct tls12_crypto_info_aes_ccm_128);
76 tls12->aesccm128.info.version = tls_version;
77 tls12->aesccm128.info.cipher_type = cipher_type;
78 break;
79 case TLS_CIPHER_AES_GCM_256:
80 tls12->len = sizeof(struct tls12_crypto_info_aes_gcm_256);
81 tls12->aesgcm256.info.version = tls_version;
82 tls12->aesgcm256.info.cipher_type = cipher_type;
83 break;
84 case TLS_CIPHER_ARIA_GCM_128:
85 tls12->len = sizeof(struct tls12_crypto_info_aria_gcm_128);
86 tls12->ariagcm128.info.version = tls_version;
87 tls12->ariagcm128.info.cipher_type = cipher_type;
88 break;
89 case TLS_CIPHER_ARIA_GCM_256:
90 tls12->len = sizeof(struct tls12_crypto_info_aria_gcm_256);
91 tls12->ariagcm256.info.version = tls_version;
92 tls12->ariagcm256.info.cipher_type = cipher_type;
93 break;
94 default:
95 break;
96 }
97 }
98
memrnd(void * s,size_t n)99 static void memrnd(void *s, size_t n)
100 {
101 int *dword = s;
102 char *byte;
103
104 for (; n >= 4; n -= 4)
105 *dword++ = rand();
106 byte = (void *)dword;
107 while (n--)
108 *byte++ = rand();
109 }
110
ulp_sock_pair(struct __test_metadata * _metadata,int * fd,int * cfd,bool * notls)111 static void ulp_sock_pair(struct __test_metadata *_metadata,
112 int *fd, int *cfd, bool *notls)
113 {
114 struct sockaddr_in addr;
115 socklen_t len;
116 int sfd, ret;
117
118 *notls = false;
119 len = sizeof(addr);
120
121 addr.sin_family = AF_INET;
122 addr.sin_addr.s_addr = htonl(INADDR_ANY);
123 addr.sin_port = 0;
124
125 *fd = socket(AF_INET, SOCK_STREAM, 0);
126 sfd = socket(AF_INET, SOCK_STREAM, 0);
127
128 ret = bind(sfd, &addr, sizeof(addr));
129 ASSERT_EQ(ret, 0);
130 ret = listen(sfd, 10);
131 ASSERT_EQ(ret, 0);
132
133 ret = getsockname(sfd, &addr, &len);
134 ASSERT_EQ(ret, 0);
135
136 ret = connect(*fd, &addr, sizeof(addr));
137 ASSERT_EQ(ret, 0);
138
139 *cfd = accept(sfd, &addr, &len);
140 ASSERT_GE(*cfd, 0);
141
142 close(sfd);
143
144 ret = setsockopt(*fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
145 if (ret != 0) {
146 ASSERT_EQ(errno, ENOENT);
147 *notls = true;
148 printf("Failure setting TCP_ULP, testing without tls\n");
149 return;
150 }
151
152 ret = setsockopt(*cfd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
153 ASSERT_EQ(ret, 0);
154 }
155
156 /* Produce a basic cmsg */
tls_send_cmsg(int fd,unsigned char record_type,void * data,size_t len,int flags)157 static int tls_send_cmsg(int fd, unsigned char record_type,
158 void *data, size_t len, int flags)
159 {
160 char cbuf[CMSG_SPACE(sizeof(char))];
161 int cmsg_len = sizeof(char);
162 struct cmsghdr *cmsg;
163 struct msghdr msg;
164 struct iovec vec;
165
166 vec.iov_base = data;
167 vec.iov_len = len;
168 memset(&msg, 0, sizeof(struct msghdr));
169 msg.msg_iov = &vec;
170 msg.msg_iovlen = 1;
171 msg.msg_control = cbuf;
172 msg.msg_controllen = sizeof(cbuf);
173 cmsg = CMSG_FIRSTHDR(&msg);
174 cmsg->cmsg_level = SOL_TLS;
175 /* test sending non-record types. */
176 cmsg->cmsg_type = TLS_SET_RECORD_TYPE;
177 cmsg->cmsg_len = CMSG_LEN(cmsg_len);
178 *CMSG_DATA(cmsg) = record_type;
179 msg.msg_controllen = cmsg->cmsg_len;
180
181 return sendmsg(fd, &msg, flags);
182 }
183
__tls_recv_cmsg(struct __test_metadata * _metadata,int fd,unsigned char * ctype,void * data,size_t len,int flags)184 static int __tls_recv_cmsg(struct __test_metadata *_metadata,
185 int fd, unsigned char *ctype,
186 void *data, size_t len, int flags)
187 {
188 char cbuf[CMSG_SPACE(sizeof(char))];
189 struct cmsghdr *cmsg;
190 struct msghdr msg;
191 struct iovec vec;
192 int n;
193
194 vec.iov_base = data;
195 vec.iov_len = len;
196 memset(&msg, 0, sizeof(struct msghdr));
197 msg.msg_iov = &vec;
198 msg.msg_iovlen = 1;
199 msg.msg_control = cbuf;
200 msg.msg_controllen = sizeof(cbuf);
201
202 n = recvmsg(fd, &msg, flags);
203
204 cmsg = CMSG_FIRSTHDR(&msg);
205 EXPECT_NE(cmsg, NULL);
206 EXPECT_EQ(cmsg->cmsg_level, SOL_TLS);
207 EXPECT_EQ(cmsg->cmsg_type, TLS_GET_RECORD_TYPE);
208 if (ctype)
209 *ctype = *((unsigned char *)CMSG_DATA(cmsg));
210
211 return n;
212 }
213
tls_recv_cmsg(struct __test_metadata * _metadata,int fd,unsigned char record_type,void * data,size_t len,int flags)214 static int tls_recv_cmsg(struct __test_metadata *_metadata,
215 int fd, unsigned char record_type,
216 void *data, size_t len, int flags)
217 {
218 unsigned char ctype;
219 int n;
220
221 n = __tls_recv_cmsg(_metadata, fd, &ctype, data, len, flags);
222 EXPECT_EQ(ctype, record_type);
223
224 return n;
225 }
226
FIXTURE(tls_basic)227 FIXTURE(tls_basic)
228 {
229 int fd, cfd;
230 bool notls;
231 };
232
FIXTURE_SETUP(tls_basic)233 FIXTURE_SETUP(tls_basic)
234 {
235 ulp_sock_pair(_metadata, &self->fd, &self->cfd, &self->notls);
236 }
237
FIXTURE_TEARDOWN(tls_basic)238 FIXTURE_TEARDOWN(tls_basic)
239 {
240 close(self->fd);
241 close(self->cfd);
242 }
243
244 /* Send some data through with ULP but no keys */
TEST_F(tls_basic,base_base)245 TEST_F(tls_basic, base_base)
246 {
247 char const *test_str = "test_read";
248 int send_len = 10;
249 char buf[10];
250
251 ASSERT_EQ(strlen(test_str) + 1, send_len);
252
253 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
254 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1);
255 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
256 };
257
TEST_F(tls_basic,bad_cipher)258 TEST_F(tls_basic, bad_cipher)
259 {
260 struct tls_crypto_info_keys tls12;
261
262 tls12.crypto_info.version = 200;
263 tls12.crypto_info.cipher_type = TLS_CIPHER_AES_GCM_128;
264 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, sizeof(struct tls12_crypto_info_aes_gcm_128)), -1);
265
266 tls12.crypto_info.version = TLS_1_2_VERSION;
267 tls12.crypto_info.cipher_type = 50;
268 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, sizeof(struct tls12_crypto_info_aes_gcm_128)), -1);
269
270 tls12.crypto_info.version = TLS_1_2_VERSION;
271 tls12.crypto_info.cipher_type = 59;
272 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, sizeof(struct tls12_crypto_info_aes_gcm_128)), -1);
273
274 tls12.crypto_info.version = TLS_1_2_VERSION;
275 tls12.crypto_info.cipher_type = 10;
276 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, sizeof(struct tls12_crypto_info_aes_gcm_128)), -1);
277
278 tls12.crypto_info.version = TLS_1_2_VERSION;
279 tls12.crypto_info.cipher_type = 70;
280 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, sizeof(struct tls12_crypto_info_aes_gcm_128)), -1);
281 }
282
TEST_F(tls_basic,recseq_wrap)283 TEST_F(tls_basic, recseq_wrap)
284 {
285 struct tls_crypto_info_keys tls12;
286 char const *test_str = "test_read";
287 int send_len = 10;
288
289 if (self->notls)
290 SKIP(return, "no TLS support");
291
292 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_GCM_128, &tls12, 0);
293 memset(&tls12.aes128.rec_seq, 0xff, sizeof(tls12.aes128.rec_seq));
294
295 ASSERT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
296 ASSERT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
297
298 EXPECT_EQ(send(self->fd, test_str, send_len, 0), -1);
299 EXPECT_EQ(errno, EBADMSG);
300 }
301
FIXTURE(tls)302 FIXTURE(tls)
303 {
304 int fd, cfd;
305 bool notls;
306 };
307
FIXTURE_VARIANT(tls)308 FIXTURE_VARIANT(tls)
309 {
310 uint16_t tls_version;
311 uint16_t cipher_type;
312 bool nopad, fips_non_compliant;
313 };
314
315 FIXTURE_VARIANT_ADD(tls, 12_aes_gcm)
316 {
317 .tls_version = TLS_1_2_VERSION,
318 .cipher_type = TLS_CIPHER_AES_GCM_128,
319 };
320
321 FIXTURE_VARIANT_ADD(tls, 13_aes_gcm)
322 {
323 .tls_version = TLS_1_3_VERSION,
324 .cipher_type = TLS_CIPHER_AES_GCM_128,
325 };
326
327 FIXTURE_VARIANT_ADD(tls, 12_chacha)
328 {
329 .tls_version = TLS_1_2_VERSION,
330 .cipher_type = TLS_CIPHER_CHACHA20_POLY1305,
331 .fips_non_compliant = true,
332 };
333
334 FIXTURE_VARIANT_ADD(tls, 13_chacha)
335 {
336 .tls_version = TLS_1_3_VERSION,
337 .cipher_type = TLS_CIPHER_CHACHA20_POLY1305,
338 .fips_non_compliant = true,
339 };
340
341 FIXTURE_VARIANT_ADD(tls, 13_sm4_gcm)
342 {
343 .tls_version = TLS_1_3_VERSION,
344 .cipher_type = TLS_CIPHER_SM4_GCM,
345 .fips_non_compliant = true,
346 };
347
348 FIXTURE_VARIANT_ADD(tls, 13_sm4_ccm)
349 {
350 .tls_version = TLS_1_3_VERSION,
351 .cipher_type = TLS_CIPHER_SM4_CCM,
352 .fips_non_compliant = true,
353 };
354
355 FIXTURE_VARIANT_ADD(tls, 12_aes_ccm)
356 {
357 .tls_version = TLS_1_2_VERSION,
358 .cipher_type = TLS_CIPHER_AES_CCM_128,
359 };
360
361 FIXTURE_VARIANT_ADD(tls, 13_aes_ccm)
362 {
363 .tls_version = TLS_1_3_VERSION,
364 .cipher_type = TLS_CIPHER_AES_CCM_128,
365 };
366
367 FIXTURE_VARIANT_ADD(tls, 12_aes_gcm_256)
368 {
369 .tls_version = TLS_1_2_VERSION,
370 .cipher_type = TLS_CIPHER_AES_GCM_256,
371 };
372
373 FIXTURE_VARIANT_ADD(tls, 13_aes_gcm_256)
374 {
375 .tls_version = TLS_1_3_VERSION,
376 .cipher_type = TLS_CIPHER_AES_GCM_256,
377 };
378
379 FIXTURE_VARIANT_ADD(tls, 13_nopad)
380 {
381 .tls_version = TLS_1_3_VERSION,
382 .cipher_type = TLS_CIPHER_AES_GCM_128,
383 .nopad = true,
384 };
385
386 FIXTURE_VARIANT_ADD(tls, 12_aria_gcm)
387 {
388 .tls_version = TLS_1_2_VERSION,
389 .cipher_type = TLS_CIPHER_ARIA_GCM_128,
390 };
391
392 FIXTURE_VARIANT_ADD(tls, 12_aria_gcm_256)
393 {
394 .tls_version = TLS_1_2_VERSION,
395 .cipher_type = TLS_CIPHER_ARIA_GCM_256,
396 };
397
FIXTURE_SETUP(tls)398 FIXTURE_SETUP(tls)
399 {
400 struct tls_crypto_info_keys tls12;
401 int one = 1;
402 int ret;
403
404 if (fips_enabled && variant->fips_non_compliant)
405 SKIP(return, "Unsupported cipher in FIPS mode");
406
407 tls_crypto_info_init(variant->tls_version, variant->cipher_type,
408 &tls12, 0);
409
410 ulp_sock_pair(_metadata, &self->fd, &self->cfd, &self->notls);
411
412 if (self->notls)
413 return;
414
415 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len);
416 ASSERT_EQ(ret, 0);
417
418 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len);
419 ASSERT_EQ(ret, 0);
420
421 if (variant->nopad) {
422 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD,
423 (void *)&one, sizeof(one));
424 ASSERT_EQ(ret, 0);
425 }
426 }
427
FIXTURE_TEARDOWN(tls)428 FIXTURE_TEARDOWN(tls)
429 {
430 close(self->fd);
431 close(self->cfd);
432 }
433
TEST_F(tls,sendfile)434 TEST_F(tls, sendfile)
435 {
436 int filefd = open("/proc/self/exe", O_RDONLY);
437 struct stat st;
438
439 EXPECT_GE(filefd, 0);
440 fstat(filefd, &st);
441 EXPECT_GE(sendfile(self->fd, filefd, 0, st.st_size), 0);
442
443 close(filefd);
444 }
445
TEST_F(tls,send_then_sendfile)446 TEST_F(tls, send_then_sendfile)
447 {
448 int filefd = open("/proc/self/exe", O_RDONLY);
449 char const *test_str = "test_send";
450 int to_send = strlen(test_str) + 1;
451 char recv_buf[10];
452 struct stat st;
453 char *buf;
454
455 EXPECT_GE(filefd, 0);
456 fstat(filefd, &st);
457 buf = (char *)malloc(st.st_size);
458
459 EXPECT_EQ(send(self->fd, test_str, to_send, 0), to_send);
460 EXPECT_EQ(recv(self->cfd, recv_buf, to_send, MSG_WAITALL), to_send);
461 EXPECT_EQ(memcmp(test_str, recv_buf, to_send), 0);
462
463 EXPECT_GE(sendfile(self->fd, filefd, 0, st.st_size), 0);
464 EXPECT_EQ(recv(self->cfd, buf, st.st_size, MSG_WAITALL), st.st_size);
465
466 free(buf);
467 close(filefd);
468 }
469
chunked_sendfile(struct __test_metadata * _metadata,struct _test_data_tls * self,uint16_t chunk_size,uint16_t extra_payload_size)470 static void chunked_sendfile(struct __test_metadata *_metadata,
471 struct _test_data_tls *self,
472 uint16_t chunk_size,
473 uint16_t extra_payload_size)
474 {
475 char buf[TLS_PAYLOAD_MAX_LEN];
476 uint16_t test_payload_size;
477 int size = 0;
478 int ret;
479 char filename[] = "/tmp/mytemp.XXXXXX";
480 int fd = mkstemp(filename);
481 off_t offset = 0;
482
483 unlink(filename);
484 ASSERT_GE(fd, 0);
485 EXPECT_GE(chunk_size, 1);
486 test_payload_size = chunk_size + extra_payload_size;
487 ASSERT_GE(TLS_PAYLOAD_MAX_LEN, test_payload_size);
488 memset(buf, 1, test_payload_size);
489 size = write(fd, buf, test_payload_size);
490 EXPECT_EQ(size, test_payload_size);
491 fsync(fd);
492
493 while (size > 0) {
494 ret = sendfile(self->fd, fd, &offset, chunk_size);
495 EXPECT_GE(ret, 0);
496 size -= ret;
497 }
498
499 EXPECT_EQ(recv(self->cfd, buf, test_payload_size, MSG_WAITALL),
500 test_payload_size);
501
502 close(fd);
503 }
504
TEST_F(tls,multi_chunk_sendfile)505 TEST_F(tls, multi_chunk_sendfile)
506 {
507 chunked_sendfile(_metadata, self, 4096, 4096);
508 chunked_sendfile(_metadata, self, 4096, 0);
509 chunked_sendfile(_metadata, self, 4096, 1);
510 chunked_sendfile(_metadata, self, 4096, 2048);
511 chunked_sendfile(_metadata, self, 8192, 2048);
512 chunked_sendfile(_metadata, self, 4096, 8192);
513 chunked_sendfile(_metadata, self, 8192, 4096);
514 chunked_sendfile(_metadata, self, 12288, 1024);
515 chunked_sendfile(_metadata, self, 12288, 2000);
516 chunked_sendfile(_metadata, self, 15360, 100);
517 chunked_sendfile(_metadata, self, 15360, 300);
518 chunked_sendfile(_metadata, self, 1, 4096);
519 chunked_sendfile(_metadata, self, 2048, 4096);
520 chunked_sendfile(_metadata, self, 2048, 8192);
521 chunked_sendfile(_metadata, self, 4096, 8192);
522 chunked_sendfile(_metadata, self, 1024, 12288);
523 chunked_sendfile(_metadata, self, 2000, 12288);
524 chunked_sendfile(_metadata, self, 100, 15360);
525 chunked_sendfile(_metadata, self, 300, 15360);
526 }
527
TEST_F(tls,recv_max)528 TEST_F(tls, recv_max)
529 {
530 unsigned int send_len = TLS_PAYLOAD_MAX_LEN;
531 char recv_mem[TLS_PAYLOAD_MAX_LEN];
532 char buf[TLS_PAYLOAD_MAX_LEN];
533
534 memrnd(buf, sizeof(buf));
535
536 EXPECT_GE(send(self->fd, buf, send_len, 0), 0);
537 EXPECT_NE(recv(self->cfd, recv_mem, send_len, 0), -1);
538 EXPECT_EQ(memcmp(buf, recv_mem, send_len), 0);
539 }
540
TEST_F(tls,recv_small)541 TEST_F(tls, recv_small)
542 {
543 char const *test_str = "test_read";
544 int send_len = 10;
545 char buf[10];
546
547 send_len = strlen(test_str) + 1;
548 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
549 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1);
550 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
551 }
552
TEST_F(tls,msg_more)553 TEST_F(tls, msg_more)
554 {
555 char const *test_str = "test_read";
556 int send_len = 10;
557 char buf[10 * 2];
558
559 EXPECT_EQ(send(self->fd, test_str, send_len, MSG_MORE), send_len);
560 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_DONTWAIT), -1);
561 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
562 EXPECT_EQ(recv(self->cfd, buf, send_len * 2, MSG_WAITALL),
563 send_len * 2);
564 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
565 }
566
TEST_F(tls,cmsg_msg_more)567 TEST_F(tls, cmsg_msg_more)
568 {
569 char *test_str = "test_read";
570 char record_type = 100;
571 int send_len = 10;
572
573 /* we don't allow MSG_MORE with non-DATA records */
574 EXPECT_EQ(tls_send_cmsg(self->fd, record_type, test_str, send_len,
575 MSG_MORE), -1);
576 EXPECT_EQ(errno, EINVAL);
577 }
578
TEST_F(tls,msg_more_then_cmsg)579 TEST_F(tls, msg_more_then_cmsg)
580 {
581 char *test_str = "test_read";
582 char record_type = 100;
583 int send_len = 10;
584 char buf[10 * 2];
585 int ret;
586
587 EXPECT_EQ(send(self->fd, test_str, send_len, MSG_MORE), send_len);
588 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_DONTWAIT), -1);
589
590 ret = tls_send_cmsg(self->fd, record_type, test_str, send_len, 0);
591 EXPECT_EQ(ret, send_len);
592
593 /* initial DATA record didn't get merged with the non-DATA record */
594 EXPECT_EQ(recv(self->cfd, buf, send_len * 2, 0), send_len);
595
596 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, record_type,
597 buf, sizeof(buf), MSG_WAITALL),
598 send_len);
599 }
600
TEST_F(tls,msg_more_unsent)601 TEST_F(tls, msg_more_unsent)
602 {
603 char const *test_str = "test_read";
604 int send_len = 10;
605 char buf[10];
606
607 EXPECT_EQ(send(self->fd, test_str, send_len, MSG_MORE), send_len);
608 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_DONTWAIT), -1);
609 }
610
TEST_F(tls,msg_eor)611 TEST_F(tls, msg_eor)
612 {
613 char const *test_str = "test_read";
614 int send_len = 10;
615 char buf[10];
616
617 EXPECT_EQ(send(self->fd, test_str, send_len, MSG_EOR), send_len);
618 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_WAITALL), send_len);
619 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
620 }
621
TEST_F(tls,sendmsg_single)622 TEST_F(tls, sendmsg_single)
623 {
624 struct msghdr msg;
625
626 char const *test_str = "test_sendmsg";
627 size_t send_len = 13;
628 struct iovec vec;
629 char buf[13];
630
631 vec.iov_base = (char *)test_str;
632 vec.iov_len = send_len;
633 memset(&msg, 0, sizeof(struct msghdr));
634 msg.msg_iov = &vec;
635 msg.msg_iovlen = 1;
636 EXPECT_EQ(sendmsg(self->fd, &msg, 0), send_len);
637 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_WAITALL), send_len);
638 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
639 }
640
641 #define MAX_FRAGS 64
642 #define SEND_LEN 13
TEST_F(tls,sendmsg_fragmented)643 TEST_F(tls, sendmsg_fragmented)
644 {
645 char const *test_str = "test_sendmsg";
646 char buf[SEND_LEN * MAX_FRAGS];
647 struct iovec vec[MAX_FRAGS];
648 struct msghdr msg;
649 int i, frags;
650
651 for (frags = 1; frags <= MAX_FRAGS; frags++) {
652 for (i = 0; i < frags; i++) {
653 vec[i].iov_base = (char *)test_str;
654 vec[i].iov_len = SEND_LEN;
655 }
656
657 memset(&msg, 0, sizeof(struct msghdr));
658 msg.msg_iov = vec;
659 msg.msg_iovlen = frags;
660
661 EXPECT_EQ(sendmsg(self->fd, &msg, 0), SEND_LEN * frags);
662 EXPECT_EQ(recv(self->cfd, buf, SEND_LEN * frags, MSG_WAITALL),
663 SEND_LEN * frags);
664
665 for (i = 0; i < frags; i++)
666 EXPECT_EQ(memcmp(buf + SEND_LEN * i,
667 test_str, SEND_LEN), 0);
668 }
669 }
670 #undef MAX_FRAGS
671 #undef SEND_LEN
672
TEST_F(tls,sendmsg_large)673 TEST_F(tls, sendmsg_large)
674 {
675 void *mem = malloc(16384);
676 size_t send_len = 16384;
677 size_t sends = 128;
678 struct msghdr msg;
679 size_t recvs = 0;
680 size_t sent = 0;
681
682 memset(&msg, 0, sizeof(struct msghdr));
683 while (sent++ < sends) {
684 struct iovec vec = { (void *)mem, send_len };
685
686 msg.msg_iov = &vec;
687 msg.msg_iovlen = 1;
688 EXPECT_EQ(sendmsg(self->fd, &msg, 0), send_len);
689 }
690
691 while (recvs++ < sends) {
692 EXPECT_NE(recv(self->cfd, mem, send_len, 0), -1);
693 }
694
695 free(mem);
696 }
697
TEST_F(tls,sendmsg_multiple)698 TEST_F(tls, sendmsg_multiple)
699 {
700 char const *test_str = "test_sendmsg_multiple";
701 struct iovec vec[5];
702 char *test_strs[5];
703 struct msghdr msg;
704 int total_len = 0;
705 int len_cmp = 0;
706 int iov_len = 5;
707 char *buf;
708 int i;
709
710 memset(&msg, 0, sizeof(struct msghdr));
711 for (i = 0; i < iov_len; i++) {
712 test_strs[i] = (char *)malloc(strlen(test_str) + 1);
713 snprintf(test_strs[i], strlen(test_str) + 1, "%s", test_str);
714 vec[i].iov_base = (void *)test_strs[i];
715 vec[i].iov_len = strlen(test_strs[i]) + 1;
716 total_len += vec[i].iov_len;
717 }
718 msg.msg_iov = vec;
719 msg.msg_iovlen = iov_len;
720
721 EXPECT_EQ(sendmsg(self->fd, &msg, 0), total_len);
722 buf = malloc(total_len);
723 EXPECT_NE(recv(self->cfd, buf, total_len, 0), -1);
724 for (i = 0; i < iov_len; i++) {
725 EXPECT_EQ(memcmp(test_strs[i], buf + len_cmp,
726 strlen(test_strs[i])),
727 0);
728 len_cmp += strlen(buf + len_cmp) + 1;
729 }
730 for (i = 0; i < iov_len; i++)
731 free(test_strs[i]);
732 free(buf);
733 }
734
TEST_F(tls,sendmsg_multiple_stress)735 TEST_F(tls, sendmsg_multiple_stress)
736 {
737 char const *test_str = "abcdefghijklmno";
738 struct iovec vec[1024];
739 char *test_strs[1024];
740 int iov_len = 1024;
741 int total_len = 0;
742 char buf[1 << 14];
743 struct msghdr msg;
744 int len_cmp = 0;
745 int i;
746
747 memset(&msg, 0, sizeof(struct msghdr));
748 for (i = 0; i < iov_len; i++) {
749 test_strs[i] = (char *)malloc(strlen(test_str) + 1);
750 snprintf(test_strs[i], strlen(test_str) + 1, "%s", test_str);
751 vec[i].iov_base = (void *)test_strs[i];
752 vec[i].iov_len = strlen(test_strs[i]) + 1;
753 total_len += vec[i].iov_len;
754 }
755 msg.msg_iov = vec;
756 msg.msg_iovlen = iov_len;
757
758 EXPECT_EQ(sendmsg(self->fd, &msg, 0), total_len);
759 EXPECT_NE(recv(self->cfd, buf, total_len, 0), -1);
760
761 for (i = 0; i < iov_len; i++)
762 len_cmp += strlen(buf + len_cmp) + 1;
763
764 for (i = 0; i < iov_len; i++)
765 free(test_strs[i]);
766 }
767
TEST_F(tls,splice_from_pipe)768 TEST_F(tls, splice_from_pipe)
769 {
770 int send_len = TLS_PAYLOAD_MAX_LEN;
771 char mem_send[TLS_PAYLOAD_MAX_LEN];
772 char mem_recv[TLS_PAYLOAD_MAX_LEN];
773 int p[2];
774
775 ASSERT_GE(pipe(p), 0);
776 EXPECT_GE(write(p[1], mem_send, send_len), 0);
777 EXPECT_GE(splice(p[0], NULL, self->fd, NULL, send_len, 0), 0);
778 EXPECT_EQ(recv(self->cfd, mem_recv, send_len, MSG_WAITALL), send_len);
779 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
780 }
781
TEST_F(tls,splice_more)782 TEST_F(tls, splice_more)
783 {
784 unsigned int f = SPLICE_F_NONBLOCK | SPLICE_F_MORE | SPLICE_F_GIFT;
785 int send_len = TLS_PAYLOAD_MAX_LEN;
786 char mem_send[TLS_PAYLOAD_MAX_LEN];
787 int i, send_pipe = 1;
788 int p[2];
789
790 ASSERT_GE(pipe(p), 0);
791 EXPECT_GE(write(p[1], mem_send, send_len), 0);
792 for (i = 0; i < 32; i++)
793 EXPECT_EQ(splice(p[0], NULL, self->fd, NULL, send_pipe, f), 1);
794 }
795
TEST_F(tls,splice_from_pipe2)796 TEST_F(tls, splice_from_pipe2)
797 {
798 int send_len = 16000;
799 char mem_send[16000];
800 char mem_recv[16000];
801 int p2[2];
802 int p[2];
803
804 memrnd(mem_send, sizeof(mem_send));
805
806 ASSERT_GE(pipe(p), 0);
807 ASSERT_GE(pipe(p2), 0);
808 EXPECT_EQ(write(p[1], mem_send, 8000), 8000);
809 EXPECT_EQ(splice(p[0], NULL, self->fd, NULL, 8000, 0), 8000);
810 EXPECT_EQ(write(p2[1], mem_send + 8000, 8000), 8000);
811 EXPECT_EQ(splice(p2[0], NULL, self->fd, NULL, 8000, 0), 8000);
812 EXPECT_EQ(recv(self->cfd, mem_recv, send_len, MSG_WAITALL), send_len);
813 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
814 }
815
TEST_F(tls,send_and_splice)816 TEST_F(tls, send_and_splice)
817 {
818 int send_len = TLS_PAYLOAD_MAX_LEN;
819 char mem_send[TLS_PAYLOAD_MAX_LEN];
820 char mem_recv[TLS_PAYLOAD_MAX_LEN];
821 char const *test_str = "test_read";
822 int send_len2 = 10;
823 char buf[10];
824 int p[2];
825
826 ASSERT_GE(pipe(p), 0);
827 EXPECT_EQ(send(self->fd, test_str, send_len2, 0), send_len2);
828 EXPECT_EQ(recv(self->cfd, buf, send_len2, MSG_WAITALL), send_len2);
829 EXPECT_EQ(memcmp(test_str, buf, send_len2), 0);
830
831 EXPECT_GE(write(p[1], mem_send, send_len), send_len);
832 EXPECT_GE(splice(p[0], NULL, self->fd, NULL, send_len, 0), send_len);
833
834 EXPECT_EQ(recv(self->cfd, mem_recv, send_len, MSG_WAITALL), send_len);
835 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
836 }
837
TEST_F(tls,splice_to_pipe)838 TEST_F(tls, splice_to_pipe)
839 {
840 int send_len = TLS_PAYLOAD_MAX_LEN;
841 char mem_send[TLS_PAYLOAD_MAX_LEN];
842 char mem_recv[TLS_PAYLOAD_MAX_LEN];
843 int p[2];
844
845 memrnd(mem_send, sizeof(mem_send));
846
847 ASSERT_GE(pipe(p), 0);
848 EXPECT_EQ(send(self->fd, mem_send, send_len, 0), send_len);
849 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, send_len, 0), send_len);
850 EXPECT_EQ(read(p[0], mem_recv, send_len), send_len);
851 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
852 }
853
TEST_F(tls,splice_cmsg_to_pipe)854 TEST_F(tls, splice_cmsg_to_pipe)
855 {
856 char *test_str = "test_read";
857 char record_type = 100;
858 int send_len = 10;
859 char buf[10];
860 int p[2];
861
862 if (self->notls)
863 SKIP(return, "no TLS support");
864
865 ASSERT_GE(pipe(p), 0);
866 EXPECT_EQ(tls_send_cmsg(self->fd, 100, test_str, send_len, 0), 10);
867 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, send_len, 0), -1);
868 EXPECT_EQ(errno, EINVAL);
869 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), -1);
870 EXPECT_EQ(errno, EIO);
871 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, record_type,
872 buf, sizeof(buf), MSG_WAITALL),
873 send_len);
874 EXPECT_EQ(memcmp(test_str, buf, send_len), 0);
875 }
876
TEST_F(tls,splice_dec_cmsg_to_pipe)877 TEST_F(tls, splice_dec_cmsg_to_pipe)
878 {
879 char *test_str = "test_read";
880 char record_type = 100;
881 int send_len = 10;
882 char buf[10];
883 int p[2];
884
885 if (self->notls)
886 SKIP(return, "no TLS support");
887
888 ASSERT_GE(pipe(p), 0);
889 EXPECT_EQ(tls_send_cmsg(self->fd, 100, test_str, send_len, 0), 10);
890 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), -1);
891 EXPECT_EQ(errno, EIO);
892 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, send_len, 0), -1);
893 EXPECT_EQ(errno, EINVAL);
894 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, record_type,
895 buf, sizeof(buf), MSG_WAITALL),
896 send_len);
897 EXPECT_EQ(memcmp(test_str, buf, send_len), 0);
898 }
899
TEST_F(tls,recv_and_splice)900 TEST_F(tls, recv_and_splice)
901 {
902 int send_len = TLS_PAYLOAD_MAX_LEN;
903 char mem_send[TLS_PAYLOAD_MAX_LEN];
904 char mem_recv[TLS_PAYLOAD_MAX_LEN];
905 int half = send_len / 2;
906 int p[2];
907
908 ASSERT_GE(pipe(p), 0);
909 EXPECT_EQ(send(self->fd, mem_send, send_len, 0), send_len);
910 /* Recv hald of the record, splice the other half */
911 EXPECT_EQ(recv(self->cfd, mem_recv, half, MSG_WAITALL), half);
912 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, half, SPLICE_F_NONBLOCK),
913 half);
914 EXPECT_EQ(read(p[0], &mem_recv[half], half), half);
915 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
916 }
917
TEST_F(tls,peek_and_splice)918 TEST_F(tls, peek_and_splice)
919 {
920 int send_len = TLS_PAYLOAD_MAX_LEN;
921 char mem_send[TLS_PAYLOAD_MAX_LEN];
922 char mem_recv[TLS_PAYLOAD_MAX_LEN];
923 int chunk = TLS_PAYLOAD_MAX_LEN / 4;
924 int n, i, p[2];
925
926 memrnd(mem_send, sizeof(mem_send));
927
928 ASSERT_GE(pipe(p), 0);
929 for (i = 0; i < 4; i++)
930 EXPECT_EQ(send(self->fd, &mem_send[chunk * i], chunk, 0),
931 chunk);
932
933 EXPECT_EQ(recv(self->cfd, mem_recv, chunk * 5 / 2,
934 MSG_WAITALL | MSG_PEEK),
935 chunk * 5 / 2);
936 EXPECT_EQ(memcmp(mem_send, mem_recv, chunk * 5 / 2), 0);
937
938 n = 0;
939 while (n < send_len) {
940 i = splice(self->cfd, NULL, p[1], NULL, send_len - n, 0);
941 EXPECT_GT(i, 0);
942 n += i;
943 }
944 EXPECT_EQ(n, send_len);
945 EXPECT_EQ(read(p[0], mem_recv, send_len), send_len);
946 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
947 }
948
TEST_F(tls,splice_to_pipe_small)949 TEST_F(tls, splice_to_pipe_small)
950 {
951 int send_len = TLS_PAYLOAD_MAX_LEN;
952 char mem_send[TLS_PAYLOAD_MAX_LEN];
953 char mem_recv[TLS_PAYLOAD_MAX_LEN];
954 size_t total = 0;
955 int p[2];
956
957 memrnd(mem_send, sizeof(mem_send));
958
959 ASSERT_GE(pipe(p), 0);
960
961 /* Shrink pipe to 1 page (typically 4096 bytes) to force multiple
962 * splice iterations for a 16384-byte TLS record.
963 */
964 EXPECT_GE(fcntl(p[1], F_SETPIPE_SZ, 4096), 4096);
965
966 EXPECT_EQ(send(self->fd, mem_send, send_len, 0), send_len);
967
968 while (total < (size_t)send_len) {
969 ssize_t spliced, drained;
970
971 spliced = splice(self->cfd, NULL, p[1], NULL,
972 send_len - total, 0);
973 EXPECT_GT(spliced, 0);
974 if (spliced <= 0)
975 break;
976
977 drained = read(p[0], mem_recv + total, spliced);
978 EXPECT_EQ(drained, spliced);
979 if (drained <= 0)
980 break;
981
982 total += drained;
983 }
984
985 EXPECT_EQ(total, (size_t)send_len);
986 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
987
988 close(p[0]);
989 close(p[1]);
990 }
991
992 #define MAX_FRAGS 48
TEST_F(tls,splice_short)993 TEST_F(tls, splice_short)
994 {
995 struct iovec sendchar_iov;
996 char read_buf[0x10000];
997 char sendbuf[0x100];
998 char sendchar = 'S';
999 int pipefds[2];
1000 int pipe_sz;
1001 int ret;
1002 int i;
1003
1004 sendchar_iov.iov_base = &sendchar;
1005 sendchar_iov.iov_len = 1;
1006
1007 memset(sendbuf, 's', sizeof(sendbuf));
1008
1009 ASSERT_GE(pipe2(pipefds, O_NONBLOCK), 0);
1010 pipe_sz = (MAX_FRAGS + 1) * getpagesize();
1011 ret = fcntl(pipefds[0], F_SETPIPE_SZ, pipe_sz);
1012 if (ret < 0 && errno == EPERM)
1013 SKIP(return, "insufficient pipe capacity");
1014 ASSERT_GE(ret, pipe_sz);
1015
1016 for (i = 0; i < MAX_FRAGS; i++)
1017 ASSERT_GE(vmsplice(pipefds[1], &sendchar_iov, 1, 0), 0);
1018
1019 ASSERT_EQ(write(pipefds[1], sendbuf, sizeof(sendbuf)), sizeof(sendbuf));
1020
1021 EXPECT_EQ(splice(pipefds[0], NULL, self->fd, NULL, MAX_FRAGS + 0x1000, 0),
1022 MAX_FRAGS + sizeof(sendbuf));
1023 EXPECT_EQ(recv(self->cfd, read_buf, sizeof(read_buf), 0), MAX_FRAGS + sizeof(sendbuf));
1024 EXPECT_EQ(recv(self->cfd, read_buf, sizeof(read_buf), MSG_DONTWAIT), -1);
1025 EXPECT_EQ(errno, EAGAIN);
1026 }
1027 #undef MAX_FRAGS
1028
TEST_F(tls,recvmsg_single)1029 TEST_F(tls, recvmsg_single)
1030 {
1031 char const *test_str = "test_recvmsg_single";
1032 int send_len = strlen(test_str) + 1;
1033 char buf[20];
1034 struct msghdr hdr;
1035 struct iovec vec;
1036
1037 memset(&hdr, 0, sizeof(hdr));
1038 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1039 vec.iov_base = (char *)buf;
1040 vec.iov_len = send_len;
1041 hdr.msg_iovlen = 1;
1042 hdr.msg_iov = &vec;
1043 EXPECT_NE(recvmsg(self->cfd, &hdr, 0), -1);
1044 EXPECT_EQ(memcmp(test_str, buf, send_len), 0);
1045 }
1046
TEST_F(tls,recvmsg_single_max)1047 TEST_F(tls, recvmsg_single_max)
1048 {
1049 int send_len = TLS_PAYLOAD_MAX_LEN;
1050 char send_mem[TLS_PAYLOAD_MAX_LEN];
1051 char recv_mem[TLS_PAYLOAD_MAX_LEN];
1052 struct iovec vec;
1053 struct msghdr hdr;
1054
1055 memrnd(send_mem, sizeof(send_mem));
1056
1057 EXPECT_EQ(send(self->fd, send_mem, send_len, 0), send_len);
1058 vec.iov_base = (char *)recv_mem;
1059 vec.iov_len = TLS_PAYLOAD_MAX_LEN;
1060
1061 hdr.msg_iovlen = 1;
1062 hdr.msg_iov = &vec;
1063 EXPECT_NE(recvmsg(self->cfd, &hdr, 0), -1);
1064 EXPECT_EQ(memcmp(send_mem, recv_mem, send_len), 0);
1065 }
1066
TEST_F(tls,recvmsg_multiple)1067 TEST_F(tls, recvmsg_multiple)
1068 {
1069 unsigned int msg_iovlen = 1024;
1070 struct iovec vec[1024];
1071 char *iov_base[1024];
1072 unsigned int iov_len = 16;
1073 int send_len = 1 << 14;
1074 char buf[1 << 14];
1075 struct msghdr hdr;
1076 int i;
1077
1078 memrnd(buf, sizeof(buf));
1079
1080 EXPECT_EQ(send(self->fd, buf, send_len, 0), send_len);
1081 for (i = 0; i < msg_iovlen; i++) {
1082 iov_base[i] = (char *)malloc(iov_len);
1083 vec[i].iov_base = iov_base[i];
1084 vec[i].iov_len = iov_len;
1085 }
1086
1087 hdr.msg_iovlen = msg_iovlen;
1088 hdr.msg_iov = vec;
1089 EXPECT_NE(recvmsg(self->cfd, &hdr, 0), -1);
1090
1091 for (i = 0; i < msg_iovlen; i++)
1092 free(iov_base[i]);
1093 }
1094
TEST_F(tls,single_send_multiple_recv)1095 TEST_F(tls, single_send_multiple_recv)
1096 {
1097 unsigned int total_len = TLS_PAYLOAD_MAX_LEN * 2;
1098 unsigned int send_len = TLS_PAYLOAD_MAX_LEN;
1099 char send_mem[TLS_PAYLOAD_MAX_LEN * 2];
1100 char recv_mem[TLS_PAYLOAD_MAX_LEN * 2];
1101
1102 memrnd(send_mem, sizeof(send_mem));
1103
1104 EXPECT_GE(send(self->fd, send_mem, total_len, 0), 0);
1105 memset(recv_mem, 0, total_len);
1106
1107 EXPECT_NE(recv(self->cfd, recv_mem, send_len, 0), -1);
1108 EXPECT_NE(recv(self->cfd, recv_mem + send_len, send_len, 0), -1);
1109 EXPECT_EQ(memcmp(send_mem, recv_mem, total_len), 0);
1110 }
1111
TEST_F(tls,multiple_send_single_recv)1112 TEST_F(tls, multiple_send_single_recv)
1113 {
1114 unsigned int total_len = 2 * 10;
1115 unsigned int send_len = 10;
1116 char recv_mem[2 * 10];
1117 char send_mem[10];
1118
1119 memrnd(send_mem, sizeof(send_mem));
1120
1121 EXPECT_GE(send(self->fd, send_mem, send_len, 0), 0);
1122 EXPECT_GE(send(self->fd, send_mem, send_len, 0), 0);
1123 memset(recv_mem, 0, total_len);
1124 EXPECT_EQ(recv(self->cfd, recv_mem, total_len, MSG_WAITALL), total_len);
1125
1126 EXPECT_EQ(memcmp(send_mem, recv_mem, send_len), 0);
1127 EXPECT_EQ(memcmp(send_mem, recv_mem + send_len, send_len), 0);
1128 }
1129
TEST_F(tls,single_send_multiple_recv_non_align)1130 TEST_F(tls, single_send_multiple_recv_non_align)
1131 {
1132 const unsigned int total_len = 15;
1133 const unsigned int recv_len = 10;
1134 char recv_mem[recv_len * 2];
1135 char send_mem[total_len];
1136
1137 memrnd(send_mem, sizeof(send_mem));
1138
1139 EXPECT_GE(send(self->fd, send_mem, total_len, 0), 0);
1140 memset(recv_mem, 0, total_len);
1141
1142 EXPECT_EQ(recv(self->cfd, recv_mem, recv_len, 0), recv_len);
1143 EXPECT_EQ(recv(self->cfd, recv_mem + recv_len, recv_len, 0), 5);
1144 EXPECT_EQ(memcmp(send_mem, recv_mem, total_len), 0);
1145 }
1146
TEST_F(tls,recv_partial)1147 TEST_F(tls, recv_partial)
1148 {
1149 char const *test_str = "test_read_partial";
1150 char const *test_str_first = "test_read";
1151 char const *test_str_second = "_partial";
1152 int send_len = strlen(test_str) + 1;
1153 char recv_mem[18];
1154
1155 memset(recv_mem, 0, sizeof(recv_mem));
1156 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1157 EXPECT_EQ(recv(self->cfd, recv_mem, strlen(test_str_first),
1158 MSG_WAITALL), strlen(test_str_first));
1159 EXPECT_EQ(memcmp(test_str_first, recv_mem, strlen(test_str_first)), 0);
1160 memset(recv_mem, 0, sizeof(recv_mem));
1161 EXPECT_EQ(recv(self->cfd, recv_mem, strlen(test_str_second),
1162 MSG_WAITALL), strlen(test_str_second));
1163 EXPECT_EQ(memcmp(test_str_second, recv_mem, strlen(test_str_second)),
1164 0);
1165 }
1166
TEST_F(tls,recv_nonblock)1167 TEST_F(tls, recv_nonblock)
1168 {
1169 char buf[4096];
1170 bool err;
1171
1172 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_DONTWAIT), -1);
1173 err = (errno == EAGAIN || errno == EWOULDBLOCK);
1174 EXPECT_EQ(err, true);
1175 }
1176
TEST_F(tls,recv_peek)1177 TEST_F(tls, recv_peek)
1178 {
1179 char const *test_str = "test_read_peek";
1180 int send_len = strlen(test_str) + 1;
1181 char buf[15];
1182
1183 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1184 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_PEEK), send_len);
1185 EXPECT_EQ(memcmp(test_str, buf, send_len), 0);
1186 memset(buf, 0, sizeof(buf));
1187 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len);
1188 EXPECT_EQ(memcmp(test_str, buf, send_len), 0);
1189 }
1190
TEST_F(tls,recv_peek_multiple)1191 TEST_F(tls, recv_peek_multiple)
1192 {
1193 char const *test_str = "test_read_peek";
1194 int send_len = strlen(test_str) + 1;
1195 unsigned int num_peeks = 100;
1196 char buf[15];
1197 int i;
1198
1199 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1200 for (i = 0; i < num_peeks; i++) {
1201 EXPECT_NE(recv(self->cfd, buf, send_len, MSG_PEEK), -1);
1202 EXPECT_EQ(memcmp(test_str, buf, send_len), 0);
1203 memset(buf, 0, sizeof(buf));
1204 }
1205 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1);
1206 EXPECT_EQ(memcmp(test_str, buf, send_len), 0);
1207 }
1208
TEST_F(tls,recv_peek_multiple_records)1209 TEST_F(tls, recv_peek_multiple_records)
1210 {
1211 char const *test_str = "test_read_peek_mult_recs";
1212 char const *test_str_first = "test_read_peek";
1213 char const *test_str_second = "_mult_recs";
1214 int len;
1215 char buf[64];
1216
1217 len = strlen(test_str_first);
1218 EXPECT_EQ(send(self->fd, test_str_first, len, 0), len);
1219
1220 len = strlen(test_str_second) + 1;
1221 EXPECT_EQ(send(self->fd, test_str_second, len, 0), len);
1222
1223 len = strlen(test_str_first);
1224 memset(buf, 0, len);
1225 EXPECT_EQ(recv(self->cfd, buf, len, MSG_PEEK | MSG_WAITALL), len);
1226
1227 /* MSG_PEEK can only peek into the current record. */
1228 len = strlen(test_str_first);
1229 EXPECT_EQ(memcmp(test_str_first, buf, len), 0);
1230
1231 len = strlen(test_str) + 1;
1232 memset(buf, 0, len);
1233 EXPECT_EQ(recv(self->cfd, buf, len, MSG_WAITALL), len);
1234
1235 /* Non-MSG_PEEK will advance strparser (and therefore record)
1236 * however.
1237 */
1238 len = strlen(test_str) + 1;
1239 EXPECT_EQ(memcmp(test_str, buf, len), 0);
1240
1241 /* MSG_MORE will hold current record open, so later MSG_PEEK
1242 * will see everything.
1243 */
1244 len = strlen(test_str_first);
1245 EXPECT_EQ(send(self->fd, test_str_first, len, MSG_MORE), len);
1246
1247 len = strlen(test_str_second) + 1;
1248 EXPECT_EQ(send(self->fd, test_str_second, len, 0), len);
1249
1250 len = strlen(test_str) + 1;
1251 memset(buf, 0, len);
1252 EXPECT_EQ(recv(self->cfd, buf, len, MSG_PEEK | MSG_WAITALL), len);
1253
1254 len = strlen(test_str) + 1;
1255 EXPECT_EQ(memcmp(test_str, buf, len), 0);
1256 }
1257
TEST_F(tls,recv_peek_large_buf_mult_recs)1258 TEST_F(tls, recv_peek_large_buf_mult_recs)
1259 {
1260 char const *test_str = "test_read_peek_mult_recs";
1261 char const *test_str_first = "test_read_peek";
1262 char const *test_str_second = "_mult_recs";
1263 int len;
1264 char buf[64];
1265
1266 len = strlen(test_str_first);
1267 EXPECT_EQ(send(self->fd, test_str_first, len, 0), len);
1268
1269 len = strlen(test_str_second) + 1;
1270 EXPECT_EQ(send(self->fd, test_str_second, len, 0), len);
1271
1272 len = strlen(test_str) + 1;
1273 memset(buf, 0, len);
1274 EXPECT_NE((len = recv(self->cfd, buf, len,
1275 MSG_PEEK | MSG_WAITALL)), -1);
1276 len = strlen(test_str) + 1;
1277 EXPECT_EQ(memcmp(test_str, buf, len), 0);
1278 }
1279
TEST_F(tls,recv_lowat)1280 TEST_F(tls, recv_lowat)
1281 {
1282 char send_mem[10] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 };
1283 char recv_mem[20];
1284 int lowat = 8;
1285
1286 EXPECT_EQ(send(self->fd, send_mem, 10, 0), 10);
1287 EXPECT_EQ(send(self->fd, send_mem, 5, 0), 5);
1288
1289 memset(recv_mem, 0, 20);
1290 EXPECT_EQ(setsockopt(self->cfd, SOL_SOCKET, SO_RCVLOWAT,
1291 &lowat, sizeof(lowat)), 0);
1292 EXPECT_EQ(recv(self->cfd, recv_mem, 1, MSG_WAITALL), 1);
1293 EXPECT_EQ(recv(self->cfd, recv_mem + 1, 6, MSG_WAITALL), 6);
1294 EXPECT_EQ(recv(self->cfd, recv_mem + 7, 10, 0), 8);
1295
1296 EXPECT_EQ(memcmp(send_mem, recv_mem, 10), 0);
1297 EXPECT_EQ(memcmp(send_mem, recv_mem + 10, 5), 0);
1298 }
1299
TEST_F(tls,bidir)1300 TEST_F(tls, bidir)
1301 {
1302 char const *test_str = "test_read";
1303 int send_len = 10;
1304 char buf[10];
1305 int ret;
1306
1307 if (!self->notls) {
1308 struct tls_crypto_info_keys tls12;
1309
1310 tls_crypto_info_init(variant->tls_version, variant->cipher_type,
1311 &tls12, 0);
1312
1313 ret = setsockopt(self->fd, SOL_TLS, TLS_RX, &tls12,
1314 tls12.len);
1315 ASSERT_EQ(ret, 0);
1316
1317 ret = setsockopt(self->cfd, SOL_TLS, TLS_TX, &tls12,
1318 tls12.len);
1319 ASSERT_EQ(ret, 0);
1320 }
1321
1322 ASSERT_EQ(strlen(test_str) + 1, send_len);
1323
1324 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1325 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1);
1326 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
1327
1328 memset(buf, 0, sizeof(buf));
1329
1330 EXPECT_EQ(send(self->cfd, test_str, send_len, 0), send_len);
1331 EXPECT_NE(recv(self->fd, buf, send_len, 0), -1);
1332 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
1333 };
1334
TEST_F(tls,pollin)1335 TEST_F(tls, pollin)
1336 {
1337 char const *test_str = "test_poll";
1338 struct pollfd fd = { 0, 0, 0 };
1339 char buf[10];
1340 int send_len = 10;
1341
1342 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1343 fd.fd = self->cfd;
1344 fd.events = POLLIN;
1345
1346 EXPECT_EQ(poll(&fd, 1, 20), 1);
1347 EXPECT_EQ(fd.revents & POLLIN, 1);
1348 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_WAITALL), send_len);
1349 /* Test timing out */
1350 EXPECT_EQ(poll(&fd, 1, 20), 0);
1351 }
1352
TEST_F(tls,poll_wait)1353 TEST_F(tls, poll_wait)
1354 {
1355 char const *test_str = "test_poll_wait";
1356 int send_len = strlen(test_str) + 1;
1357 struct pollfd fd = { 0, 0, 0 };
1358 char recv_mem[15];
1359
1360 fd.fd = self->cfd;
1361 fd.events = POLLIN;
1362 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1363 /* Set timeout to inf. secs */
1364 EXPECT_EQ(poll(&fd, 1, -1), 1);
1365 EXPECT_EQ(fd.revents & POLLIN, 1);
1366 EXPECT_EQ(recv(self->cfd, recv_mem, send_len, MSG_WAITALL), send_len);
1367 }
1368
TEST_F(tls,poll_wait_split)1369 TEST_F(tls, poll_wait_split)
1370 {
1371 struct pollfd fd = { 0, 0, 0 };
1372 char send_mem[20] = {};
1373 char recv_mem[15];
1374
1375 fd.fd = self->cfd;
1376 fd.events = POLLIN;
1377 /* Send 20 bytes */
1378 EXPECT_EQ(send(self->fd, send_mem, sizeof(send_mem), 0),
1379 sizeof(send_mem));
1380 /* Poll with inf. timeout */
1381 EXPECT_EQ(poll(&fd, 1, -1), 1);
1382 EXPECT_EQ(fd.revents & POLLIN, 1);
1383 EXPECT_EQ(recv(self->cfd, recv_mem, sizeof(recv_mem), MSG_WAITALL),
1384 sizeof(recv_mem));
1385
1386 /* Now the remaining 5 bytes of record data are in TLS ULP */
1387 fd.fd = self->cfd;
1388 fd.events = POLLIN;
1389 EXPECT_EQ(poll(&fd, 1, -1), 1);
1390 EXPECT_EQ(fd.revents & POLLIN, 1);
1391 EXPECT_EQ(recv(self->cfd, recv_mem, sizeof(recv_mem), 0),
1392 sizeof(send_mem) - sizeof(recv_mem));
1393 }
1394
TEST_F(tls,blocking)1395 TEST_F(tls, blocking)
1396 {
1397 size_t data = 100000;
1398 int res = fork();
1399
1400 EXPECT_NE(res, -1);
1401
1402 if (res) {
1403 /* parent */
1404 size_t left = data;
1405 char buf[16384];
1406 int status;
1407 int pid2;
1408
1409 while (left) {
1410 int res = send(self->fd, buf,
1411 left > 16384 ? 16384 : left, 0);
1412
1413 EXPECT_GE(res, 0);
1414 left -= res;
1415 }
1416
1417 pid2 = wait(&status);
1418 EXPECT_EQ(status, 0);
1419 EXPECT_EQ(res, pid2);
1420 } else {
1421 /* child */
1422 size_t left = data;
1423 char buf[16384];
1424
1425 while (left) {
1426 int res = recv(self->cfd, buf,
1427 left > 16384 ? 16384 : left, 0);
1428
1429 EXPECT_GE(res, 0);
1430 left -= res;
1431 }
1432 }
1433 }
1434
TEST_F(tls,nonblocking)1435 TEST_F(tls, nonblocking)
1436 {
1437 size_t data = 100000;
1438 int sendbuf = 100;
1439 int flags;
1440 int res;
1441
1442 flags = fcntl(self->fd, F_GETFL, 0);
1443 fcntl(self->fd, F_SETFL, flags | O_NONBLOCK);
1444 fcntl(self->cfd, F_SETFL, flags | O_NONBLOCK);
1445
1446 /* Ensure nonblocking behavior by imposing a small send
1447 * buffer.
1448 */
1449 EXPECT_EQ(setsockopt(self->fd, SOL_SOCKET, SO_SNDBUF,
1450 &sendbuf, sizeof(sendbuf)), 0);
1451
1452 res = fork();
1453 EXPECT_NE(res, -1);
1454
1455 if (res) {
1456 /* parent */
1457 bool eagain = false;
1458 size_t left = data;
1459 char buf[16384];
1460 int status;
1461 int pid2;
1462
1463 while (left) {
1464 int res = send(self->fd, buf,
1465 left > 16384 ? 16384 : left, 0);
1466
1467 if (res == -1 && errno == EAGAIN) {
1468 eagain = true;
1469 usleep(10000);
1470 continue;
1471 }
1472 EXPECT_GE(res, 0);
1473 left -= res;
1474 }
1475
1476 EXPECT_TRUE(eagain);
1477 pid2 = wait(&status);
1478
1479 EXPECT_EQ(status, 0);
1480 EXPECT_EQ(res, pid2);
1481 } else {
1482 /* child */
1483 bool eagain = false;
1484 size_t left = data;
1485 char buf[16384];
1486
1487 while (left) {
1488 int res = recv(self->cfd, buf,
1489 left > 16384 ? 16384 : left, 0);
1490
1491 if (res == -1 && errno == EAGAIN) {
1492 eagain = true;
1493 usleep(10000);
1494 continue;
1495 }
1496 EXPECT_GE(res, 0);
1497 left -= res;
1498 }
1499 EXPECT_TRUE(eagain);
1500 }
1501 }
1502
1503 static void
test_mutliproc(struct __test_metadata * _metadata,struct _test_data_tls * self,bool sendpg,unsigned int n_readers,unsigned int n_writers)1504 test_mutliproc(struct __test_metadata *_metadata, struct _test_data_tls *self,
1505 bool sendpg, unsigned int n_readers, unsigned int n_writers)
1506 {
1507 const unsigned int n_children = n_readers + n_writers;
1508 const size_t data = 6 * 1000 * 1000;
1509 const size_t file_sz = data / 100;
1510 size_t read_bias, write_bias;
1511 int i, fd, child_id;
1512 char buf[file_sz];
1513 pid_t pid;
1514
1515 /* Only allow multiples for simplicity */
1516 ASSERT_EQ(!(n_readers % n_writers) || !(n_writers % n_readers), true);
1517 read_bias = n_writers / n_readers ?: 1;
1518 write_bias = n_readers / n_writers ?: 1;
1519
1520 /* prep a file to send */
1521 fd = open("/tmp/", O_TMPFILE | O_RDWR, 0600);
1522 ASSERT_GE(fd, 0);
1523
1524 memset(buf, 0xac, file_sz);
1525 ASSERT_EQ(write(fd, buf, file_sz), file_sz);
1526
1527 /* spawn children */
1528 for (child_id = 0; child_id < n_children; child_id++) {
1529 pid = fork();
1530 ASSERT_NE(pid, -1);
1531 if (!pid)
1532 break;
1533 }
1534
1535 /* parent waits for all children */
1536 if (pid) {
1537 for (i = 0; i < n_children; i++) {
1538 int status;
1539
1540 wait(&status);
1541 EXPECT_EQ(status, 0);
1542 }
1543
1544 return;
1545 }
1546
1547 /* Split threads for reading and writing */
1548 if (child_id < n_readers) {
1549 size_t left = data * read_bias;
1550 char rb[8001];
1551
1552 while (left) {
1553 int res;
1554
1555 res = recv(self->cfd, rb,
1556 left > sizeof(rb) ? sizeof(rb) : left, 0);
1557
1558 ASSERT_GE(res, 0);
1559 left -= res;
1560 }
1561 } else {
1562 size_t left = data * write_bias;
1563
1564 while (left) {
1565 int res;
1566
1567 ASSERT_EQ(lseek(fd, 0, SEEK_SET), 0);
1568 if (sendpg)
1569 res = sendfile(self->fd, fd, NULL,
1570 left > file_sz ? file_sz : left);
1571 else
1572 res = send(self->fd, buf,
1573 left > file_sz ? file_sz : left, 0);
1574
1575 ASSERT_GE(res, 0);
1576 left -= res;
1577 }
1578 }
1579 }
1580
TEST_F(tls,mutliproc_even)1581 TEST_F(tls, mutliproc_even)
1582 {
1583 test_mutliproc(_metadata, self, false, 6, 6);
1584 }
1585
TEST_F(tls,mutliproc_readers)1586 TEST_F(tls, mutliproc_readers)
1587 {
1588 test_mutliproc(_metadata, self, false, 4, 12);
1589 }
1590
TEST_F(tls,mutliproc_writers)1591 TEST_F(tls, mutliproc_writers)
1592 {
1593 test_mutliproc(_metadata, self, false, 10, 2);
1594 }
1595
TEST_F(tls,mutliproc_sendpage_even)1596 TEST_F(tls, mutliproc_sendpage_even)
1597 {
1598 test_mutliproc(_metadata, self, true, 6, 6);
1599 }
1600
TEST_F(tls,mutliproc_sendpage_readers)1601 TEST_F(tls, mutliproc_sendpage_readers)
1602 {
1603 test_mutliproc(_metadata, self, true, 4, 12);
1604 }
1605
TEST_F(tls,mutliproc_sendpage_writers)1606 TEST_F(tls, mutliproc_sendpage_writers)
1607 {
1608 test_mutliproc(_metadata, self, true, 10, 2);
1609 }
1610
TEST_F(tls,control_msg)1611 TEST_F(tls, control_msg)
1612 {
1613 char *test_str = "test_read";
1614 char record_type = 100;
1615 int send_len = 10;
1616 char buf[10];
1617
1618 if (self->notls)
1619 SKIP(return, "no TLS support");
1620
1621 EXPECT_EQ(tls_send_cmsg(self->fd, record_type, test_str, send_len, 0),
1622 send_len);
1623 /* Should fail because we didn't provide a control message */
1624 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), -1);
1625
1626 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, record_type,
1627 buf, sizeof(buf), MSG_WAITALL | MSG_PEEK),
1628 send_len);
1629 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
1630
1631 /* Recv the message again without MSG_PEEK */
1632 memset(buf, 0, sizeof(buf));
1633
1634 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, record_type,
1635 buf, sizeof(buf), MSG_WAITALL),
1636 send_len);
1637 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
1638 }
1639
TEST_F(tls,control_msg_nomerge)1640 TEST_F(tls, control_msg_nomerge)
1641 {
1642 char *rec1 = "1111";
1643 char *rec2 = "2222";
1644 int send_len = 5;
1645 char buf[15];
1646
1647 if (self->notls)
1648 SKIP(return, "no TLS support");
1649
1650 EXPECT_EQ(tls_send_cmsg(self->fd, 100, rec1, send_len, 0), send_len);
1651 EXPECT_EQ(tls_send_cmsg(self->fd, 100, rec2, send_len, 0), send_len);
1652
1653 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, 100, buf, sizeof(buf), MSG_PEEK), send_len);
1654 EXPECT_EQ(memcmp(buf, rec1, send_len), 0);
1655
1656 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, 100, buf, sizeof(buf), MSG_PEEK), send_len);
1657 EXPECT_EQ(memcmp(buf, rec1, send_len), 0);
1658
1659 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, 100, buf, sizeof(buf), 0), send_len);
1660 EXPECT_EQ(memcmp(buf, rec1, send_len), 0);
1661
1662 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, 100, buf, sizeof(buf), 0), send_len);
1663 EXPECT_EQ(memcmp(buf, rec2, send_len), 0);
1664 }
1665
TEST_F(tls,data_control_data)1666 TEST_F(tls, data_control_data)
1667 {
1668 char *rec1 = "1111";
1669 char *rec2 = "2222";
1670 char *rec3 = "3333";
1671 int send_len = 5;
1672 char buf[15];
1673
1674 if (self->notls)
1675 SKIP(return, "no TLS support");
1676
1677 EXPECT_EQ(send(self->fd, rec1, send_len, 0), send_len);
1678 EXPECT_EQ(tls_send_cmsg(self->fd, 100, rec2, send_len, 0), send_len);
1679 EXPECT_EQ(send(self->fd, rec3, send_len, 0), send_len);
1680
1681 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_PEEK), send_len);
1682 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_PEEK), send_len);
1683 }
1684
TEST_F(tls,shutdown)1685 TEST_F(tls, shutdown)
1686 {
1687 char const *test_str = "test_read";
1688 int send_len = 10;
1689 char buf[10];
1690
1691 ASSERT_EQ(strlen(test_str) + 1, send_len);
1692
1693 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1694 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1);
1695 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
1696
1697 shutdown(self->fd, SHUT_RDWR);
1698 shutdown(self->cfd, SHUT_RDWR);
1699 }
1700
TEST_F(tls,shutdown_unsent)1701 TEST_F(tls, shutdown_unsent)
1702 {
1703 char const *test_str = "test_read";
1704 int send_len = 10;
1705
1706 EXPECT_EQ(send(self->fd, test_str, send_len, MSG_MORE), send_len);
1707
1708 shutdown(self->fd, SHUT_RDWR);
1709 shutdown(self->cfd, SHUT_RDWR);
1710 }
1711
TEST_F(tls,shutdown_reuse)1712 TEST_F(tls, shutdown_reuse)
1713 {
1714 struct sockaddr_in addr;
1715 int ret;
1716
1717 shutdown(self->fd, SHUT_RDWR);
1718 shutdown(self->cfd, SHUT_RDWR);
1719 close(self->cfd);
1720
1721 addr.sin_family = AF_INET;
1722 addr.sin_addr.s_addr = htonl(INADDR_ANY);
1723 addr.sin_port = 0;
1724
1725 ret = bind(self->fd, &addr, sizeof(addr));
1726 EXPECT_EQ(ret, 0);
1727 ret = listen(self->fd, 10);
1728 EXPECT_EQ(ret, -1);
1729 EXPECT_EQ(errno, EINVAL);
1730
1731 ret = connect(self->fd, &addr, sizeof(addr));
1732 EXPECT_EQ(ret, -1);
1733 EXPECT_EQ(errno, EISCONN);
1734 }
1735
TEST_F(tls,getsockopt)1736 TEST_F(tls, getsockopt)
1737 {
1738 struct tls_crypto_info_keys expect, get;
1739 socklen_t len;
1740
1741 /* get only the version/cipher */
1742 len = sizeof(struct tls_crypto_info);
1743 memrnd(&get, sizeof(get));
1744 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &get, &len), 0);
1745 EXPECT_EQ(len, sizeof(struct tls_crypto_info));
1746 EXPECT_EQ(get.crypto_info.version, variant->tls_version);
1747 EXPECT_EQ(get.crypto_info.cipher_type, variant->cipher_type);
1748
1749 /* get the full crypto_info */
1750 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &expect, 0);
1751 len = expect.len;
1752 memrnd(&get, sizeof(get));
1753 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &get, &len), 0);
1754 EXPECT_EQ(len, expect.len);
1755 EXPECT_EQ(get.crypto_info.version, variant->tls_version);
1756 EXPECT_EQ(get.crypto_info.cipher_type, variant->cipher_type);
1757 EXPECT_EQ(memcmp(&get, &expect, expect.len), 0);
1758
1759 /* short get should fail */
1760 len = sizeof(struct tls_crypto_info) - 1;
1761 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &get, &len), -1);
1762 EXPECT_EQ(errno, EINVAL);
1763
1764 /* partial get of the cipher data should fail */
1765 len = expect.len - 1;
1766 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &get, &len), -1);
1767 EXPECT_EQ(errno, EINVAL);
1768 }
1769
TEST_F(tls,recv_efault)1770 TEST_F(tls, recv_efault)
1771 {
1772 char *rec1 = "1111111111";
1773 char *rec2 = "2222222222";
1774 struct msghdr hdr = {};
1775 struct iovec iov[2];
1776 char recv_mem[12];
1777 int ret;
1778
1779 if (self->notls)
1780 SKIP(return, "no TLS support");
1781
1782 EXPECT_EQ(send(self->fd, rec1, 10, 0), 10);
1783 EXPECT_EQ(send(self->fd, rec2, 10, 0), 10);
1784
1785 iov[0].iov_base = recv_mem;
1786 iov[0].iov_len = sizeof(recv_mem);
1787 iov[1].iov_base = NULL; /* broken iov to make process_rx_list fail */
1788 iov[1].iov_len = 1;
1789
1790 hdr.msg_iovlen = 2;
1791 hdr.msg_iov = iov;
1792
1793 EXPECT_EQ(recv(self->cfd, recv_mem, 1, 0), 1);
1794 EXPECT_EQ(recv_mem[0], rec1[0]);
1795
1796 ret = recvmsg(self->cfd, &hdr, 0);
1797 EXPECT_LE(ret, sizeof(recv_mem));
1798 EXPECT_GE(ret, 9);
1799 EXPECT_EQ(memcmp(rec1, recv_mem, 9), 0);
1800 if (ret > 9)
1801 EXPECT_EQ(memcmp(rec2, recv_mem + 9, ret - 9), 0);
1802 }
1803
1804 #define TLS_RECORD_TYPE_HANDSHAKE 0x16
1805 /* key_update, length 1, update_not_requested */
1806 static const char key_update_msg[] = "\x18\x00\x00\x01\x00";
tls_send_keyupdate(struct __test_metadata * _metadata,int fd)1807 static void tls_send_keyupdate(struct __test_metadata *_metadata, int fd)
1808 {
1809 size_t len = sizeof(key_update_msg);
1810
1811 EXPECT_EQ(tls_send_cmsg(fd, TLS_RECORD_TYPE_HANDSHAKE,
1812 (char *)key_update_msg, len, 0),
1813 len);
1814 }
1815
tls_recv_keyupdate(struct __test_metadata * _metadata,int fd,int flags)1816 static void tls_recv_keyupdate(struct __test_metadata *_metadata, int fd, int flags)
1817 {
1818 char buf[100];
1819
1820 EXPECT_EQ(tls_recv_cmsg(_metadata, fd, TLS_RECORD_TYPE_HANDSHAKE, buf, sizeof(buf), flags),
1821 sizeof(key_update_msg));
1822 EXPECT_EQ(memcmp(buf, key_update_msg, sizeof(key_update_msg)), 0);
1823 }
1824
1825 /* set the key to 0 then 1 for RX, immediately to 1 for TX */
TEST_F(tls_basic,rekey_rx)1826 TEST_F(tls_basic, rekey_rx)
1827 {
1828 struct tls_crypto_info_keys tls12_0, tls12_1;
1829 char const *test_str = "test_message";
1830 int send_len = strlen(test_str) + 1;
1831 char buf[20];
1832 int ret;
1833
1834 if (self->notls)
1835 return;
1836
1837 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128,
1838 &tls12_0, 0);
1839 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128,
1840 &tls12_1, 1);
1841
1842 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12_1, tls12_1.len);
1843 ASSERT_EQ(ret, 0);
1844
1845 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12_0, tls12_0.len);
1846 ASSERT_EQ(ret, 0);
1847
1848 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12_1, tls12_1.len);
1849 EXPECT_EQ(ret, 0);
1850
1851 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1852 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len);
1853 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
1854 }
1855
1856 /* set the key to 0 then 1 for TX, immediately to 1 for RX */
TEST_F(tls_basic,rekey_tx)1857 TEST_F(tls_basic, rekey_tx)
1858 {
1859 struct tls_crypto_info_keys tls12_0, tls12_1;
1860 char const *test_str = "test_message";
1861 int send_len = strlen(test_str) + 1;
1862 char buf[20];
1863 int ret;
1864
1865 if (self->notls)
1866 return;
1867
1868 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128,
1869 &tls12_0, 0);
1870 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128,
1871 &tls12_1, 1);
1872
1873 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12_0, tls12_0.len);
1874 ASSERT_EQ(ret, 0);
1875
1876 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12_1, tls12_1.len);
1877 ASSERT_EQ(ret, 0);
1878
1879 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12_1, tls12_1.len);
1880 EXPECT_EQ(ret, 0);
1881
1882 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1883 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len);
1884 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
1885 }
1886
TEST_F(tls_basic,disconnect)1887 TEST_F(tls_basic, disconnect)
1888 {
1889 char const *test_str = "test_message";
1890 int send_len = strlen(test_str) + 1;
1891 struct tls_crypto_info_keys key;
1892 struct sockaddr_in addr;
1893 char buf[20];
1894 int ret;
1895
1896 if (self->notls)
1897 return;
1898
1899 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128,
1900 &key, 0);
1901
1902 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &key, key.len);
1903 ASSERT_EQ(ret, 0);
1904
1905 /* Pre-queue the data so that setsockopt parses it but doesn't
1906 * dequeue it from the TCP socket. recvmsg would dequeue.
1907 */
1908 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1909
1910 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &key, key.len);
1911 ASSERT_EQ(ret, 0);
1912
1913 addr.sin_family = AF_UNSPEC;
1914 addr.sin_addr.s_addr = htonl(INADDR_ANY);
1915 addr.sin_port = 0;
1916 ret = connect(self->cfd, &addr, sizeof(addr));
1917 EXPECT_EQ(ret, -1);
1918 EXPECT_EQ(errno, EOPNOTSUPP);
1919
1920 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len);
1921 }
1922
TEST_F(tls,rekey)1923 TEST_F(tls, rekey)
1924 {
1925 char const *test_str_1 = "test_message_before_rekey";
1926 char const *test_str_2 = "test_message_after_rekey";
1927 struct tls_crypto_info_keys tls12;
1928 int send_len;
1929 char buf[100];
1930
1931 if (variant->tls_version != TLS_1_3_VERSION)
1932 return;
1933
1934 /* initial send/recv */
1935 send_len = strlen(test_str_1) + 1;
1936 EXPECT_EQ(send(self->fd, test_str_1, send_len, 0), send_len);
1937 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len);
1938 EXPECT_EQ(memcmp(buf, test_str_1, send_len), 0);
1939
1940 /* update TX key */
1941 tls_send_keyupdate(_metadata, self->fd);
1942 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
1943 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
1944
1945 /* send after rekey */
1946 send_len = strlen(test_str_2) + 1;
1947 EXPECT_EQ(send(self->fd, test_str_2, send_len, 0), send_len);
1948
1949 /* can't receive the KeyUpdate without a control message */
1950 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), -1);
1951
1952 /* get KeyUpdate */
1953 tls_recv_keyupdate(_metadata, self->cfd, 0);
1954
1955 /* recv blocking -> -EKEYEXPIRED */
1956 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), 0), -1);
1957 EXPECT_EQ(errno, EKEYEXPIRED);
1958
1959 /* recv non-blocking -> -EKEYEXPIRED */
1960 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_DONTWAIT), -1);
1961 EXPECT_EQ(errno, EKEYEXPIRED);
1962
1963 /* update RX key */
1964 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
1965
1966 /* recv after rekey */
1967 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1);
1968 EXPECT_EQ(memcmp(buf, test_str_2, send_len), 0);
1969 }
1970
TEST_F(tls,rekey_fail)1971 TEST_F(tls, rekey_fail)
1972 {
1973 char const *test_str_1 = "test_message_before_rekey";
1974 char const *test_str_2 = "test_message_after_rekey";
1975 struct tls_crypto_info_keys tls12;
1976 int send_len;
1977 char buf[100];
1978
1979 /* initial send/recv */
1980 send_len = strlen(test_str_1) + 1;
1981 EXPECT_EQ(send(self->fd, test_str_1, send_len, 0), send_len);
1982 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len);
1983 EXPECT_EQ(memcmp(buf, test_str_1, send_len), 0);
1984
1985 /* update TX key */
1986 tls_send_keyupdate(_metadata, self->fd);
1987
1988 if (variant->tls_version != TLS_1_3_VERSION) {
1989 /* just check that rekey is not supported and return */
1990 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
1991 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), -1);
1992 EXPECT_EQ(errno, EBUSY);
1993 return;
1994 }
1995
1996 /* successful update */
1997 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
1998 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
1999
2000 /* invalid update: change of version */
2001 tls_crypto_info_init(TLS_1_2_VERSION, variant->cipher_type, &tls12, 1);
2002 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), -1);
2003 EXPECT_EQ(errno, EINVAL);
2004
2005 /* invalid update (RX socket): change of version */
2006 tls_crypto_info_init(TLS_1_2_VERSION, variant->cipher_type, &tls12, 1);
2007 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), -1);
2008 EXPECT_EQ(errno, EINVAL);
2009
2010 /* invalid update: change of cipher */
2011 if (variant->cipher_type == TLS_CIPHER_AES_GCM_256)
2012 tls_crypto_info_init(variant->tls_version, TLS_CIPHER_CHACHA20_POLY1305, &tls12, 1);
2013 else
2014 tls_crypto_info_init(variant->tls_version, TLS_CIPHER_AES_GCM_256, &tls12, 1);
2015 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), -1);
2016 EXPECT_EQ(errno, EINVAL);
2017
2018 /* send after rekey, the invalid updates shouldn't have an effect */
2019 send_len = strlen(test_str_2) + 1;
2020 EXPECT_EQ(send(self->fd, test_str_2, send_len, 0), send_len);
2021
2022 /* can't receive the KeyUpdate without a control message */
2023 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), -1);
2024
2025 /* get KeyUpdate */
2026 tls_recv_keyupdate(_metadata, self->cfd, 0);
2027
2028 /* recv blocking -> -EKEYEXPIRED */
2029 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), 0), -1);
2030 EXPECT_EQ(errno, EKEYEXPIRED);
2031
2032 /* recv non-blocking -> -EKEYEXPIRED */
2033 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_DONTWAIT), -1);
2034 EXPECT_EQ(errno, EKEYEXPIRED);
2035
2036 /* update RX key */
2037 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2038 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
2039
2040 /* recv after rekey */
2041 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1);
2042 EXPECT_EQ(memcmp(buf, test_str_2, send_len), 0);
2043 }
2044
TEST_F(tls,rekey_peek)2045 TEST_F(tls, rekey_peek)
2046 {
2047 char const *test_str_1 = "test_message_before_rekey";
2048 struct tls_crypto_info_keys tls12;
2049 int send_len;
2050 char buf[100];
2051
2052 if (variant->tls_version != TLS_1_3_VERSION)
2053 return;
2054
2055 send_len = strlen(test_str_1) + 1;
2056 EXPECT_EQ(send(self->fd, test_str_1, send_len, 0), send_len);
2057
2058 /* update TX key */
2059 tls_send_keyupdate(_metadata, self->fd);
2060 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2061 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
2062
2063 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_PEEK), send_len);
2064 EXPECT_EQ(memcmp(buf, test_str_1, send_len), 0);
2065
2066 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len);
2067 EXPECT_EQ(memcmp(buf, test_str_1, send_len), 0);
2068
2069 /* can't receive the KeyUpdate without a control message */
2070 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_PEEK), -1);
2071
2072 /* peek KeyUpdate */
2073 tls_recv_keyupdate(_metadata, self->cfd, MSG_PEEK);
2074
2075 /* get KeyUpdate */
2076 tls_recv_keyupdate(_metadata, self->cfd, 0);
2077
2078 /* update RX key */
2079 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
2080 }
2081
TEST_F(tls,splice_rekey)2082 TEST_F(tls, splice_rekey)
2083 {
2084 int send_len = TLS_PAYLOAD_MAX_LEN / 2;
2085 char mem_send[TLS_PAYLOAD_MAX_LEN];
2086 char mem_recv[TLS_PAYLOAD_MAX_LEN];
2087 struct tls_crypto_info_keys tls12;
2088 int p[2];
2089
2090 if (variant->tls_version != TLS_1_3_VERSION)
2091 return;
2092
2093 memrnd(mem_send, sizeof(mem_send));
2094
2095 ASSERT_GE(pipe(p), 0);
2096 EXPECT_EQ(send(self->fd, mem_send, send_len, 0), send_len);
2097
2098 /* update TX key */
2099 tls_send_keyupdate(_metadata, self->fd);
2100 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2101 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
2102
2103 EXPECT_EQ(send(self->fd, mem_send, send_len, 0), send_len);
2104
2105 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, TLS_PAYLOAD_MAX_LEN, 0), send_len);
2106 EXPECT_EQ(read(p[0], mem_recv, send_len), send_len);
2107 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
2108
2109 /* can't splice the KeyUpdate */
2110 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, TLS_PAYLOAD_MAX_LEN, 0), -1);
2111 EXPECT_EQ(errno, EINVAL);
2112
2113 /* peek KeyUpdate */
2114 tls_recv_keyupdate(_metadata, self->cfd, MSG_PEEK);
2115
2116 /* get KeyUpdate */
2117 tls_recv_keyupdate(_metadata, self->cfd, 0);
2118
2119 /* can't splice before updating the key */
2120 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, TLS_PAYLOAD_MAX_LEN, 0), -1);
2121 EXPECT_EQ(errno, EKEYEXPIRED);
2122
2123 /* update RX key */
2124 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
2125
2126 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, TLS_PAYLOAD_MAX_LEN, 0), send_len);
2127 EXPECT_EQ(read(p[0], mem_recv, send_len), send_len);
2128 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
2129 }
2130
TEST_F(tls,rekey_peek_splice)2131 TEST_F(tls, rekey_peek_splice)
2132 {
2133 char const *test_str_1 = "test_message_before_rekey";
2134 struct tls_crypto_info_keys tls12;
2135 int send_len;
2136 char buf[100];
2137 char mem_recv[TLS_PAYLOAD_MAX_LEN];
2138 int p[2];
2139
2140 if (variant->tls_version != TLS_1_3_VERSION)
2141 return;
2142
2143 ASSERT_GE(pipe(p), 0);
2144
2145 send_len = strlen(test_str_1) + 1;
2146 EXPECT_EQ(send(self->fd, test_str_1, send_len, 0), send_len);
2147
2148 /* update TX key */
2149 tls_send_keyupdate(_metadata, self->fd);
2150 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2151 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
2152
2153 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_PEEK), send_len);
2154 EXPECT_EQ(memcmp(buf, test_str_1, send_len), 0);
2155
2156 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, TLS_PAYLOAD_MAX_LEN, 0), send_len);
2157 EXPECT_EQ(read(p[0], mem_recv, send_len), send_len);
2158 EXPECT_EQ(memcmp(mem_recv, test_str_1, send_len), 0);
2159 }
2160
TEST_F(tls,rekey_getsockopt)2161 TEST_F(tls, rekey_getsockopt)
2162 {
2163 struct tls_crypto_info_keys tls12;
2164 struct tls_crypto_info_keys tls12_get;
2165 socklen_t len;
2166
2167 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 0);
2168
2169 len = tls12.len;
2170 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &tls12_get, &len), 0);
2171 EXPECT_EQ(len, tls12.len);
2172 EXPECT_EQ(memcmp(&tls12_get, &tls12, tls12.len), 0);
2173
2174 len = tls12.len;
2175 EXPECT_EQ(getsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12_get, &len), 0);
2176 EXPECT_EQ(len, tls12.len);
2177 EXPECT_EQ(memcmp(&tls12_get, &tls12, tls12.len), 0);
2178
2179 if (variant->tls_version != TLS_1_3_VERSION)
2180 return;
2181
2182 tls_send_keyupdate(_metadata, self->fd);
2183 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2184 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
2185
2186 tls_recv_keyupdate(_metadata, self->cfd, 0);
2187 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
2188
2189 len = tls12.len;
2190 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &tls12_get, &len), 0);
2191 EXPECT_EQ(len, tls12.len);
2192 EXPECT_EQ(memcmp(&tls12_get, &tls12, tls12.len), 0);
2193
2194 len = tls12.len;
2195 EXPECT_EQ(getsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12_get, &len), 0);
2196 EXPECT_EQ(len, tls12.len);
2197 EXPECT_EQ(memcmp(&tls12_get, &tls12, tls12.len), 0);
2198 }
2199
TEST_F(tls,rekey_poll_pending)2200 TEST_F(tls, rekey_poll_pending)
2201 {
2202 char const *test_str = "test_message_after_rekey";
2203 struct tls_crypto_info_keys tls12;
2204 struct pollfd pfd = { };
2205 int send_len;
2206 int ret;
2207
2208 if (variant->tls_version != TLS_1_3_VERSION)
2209 return;
2210
2211 /* update TX key */
2212 tls_send_keyupdate(_metadata, self->fd);
2213 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2214 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
2215
2216 /* get KeyUpdate */
2217 tls_recv_keyupdate(_metadata, self->cfd, 0);
2218
2219 /* send immediately after rekey */
2220 send_len = strlen(test_str) + 1;
2221 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
2222
2223 /* key hasn't been updated, expect cfd to be non-readable */
2224 pfd.fd = self->cfd;
2225 pfd.events = POLLIN;
2226 EXPECT_EQ(poll(&pfd, 1, 0), 0);
2227
2228 ret = fork();
2229 ASSERT_GE(ret, 0);
2230
2231 if (ret) {
2232 int pid2, status;
2233
2234 /* wait before installing the new key */
2235 sleep(1);
2236
2237 /* update RX key while poll() is sleeping */
2238 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
2239
2240 pid2 = wait(&status);
2241 EXPECT_EQ(pid2, ret);
2242 EXPECT_EQ(status, 0);
2243 } else {
2244 pfd.fd = self->cfd;
2245 pfd.events = POLLIN;
2246 EXPECT_EQ(poll(&pfd, 1, 5000), 1);
2247
2248 exit(!__test_passed(_metadata));
2249 }
2250 }
2251
TEST_F(tls,rekey_poll_delay)2252 TEST_F(tls, rekey_poll_delay)
2253 {
2254 char const *test_str = "test_message_after_rekey";
2255 struct tls_crypto_info_keys tls12;
2256 struct pollfd pfd = { };
2257 int send_len;
2258 int ret;
2259
2260 if (variant->tls_version != TLS_1_3_VERSION)
2261 return;
2262
2263 /* update TX key */
2264 tls_send_keyupdate(_metadata, self->fd);
2265 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2266 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
2267
2268 /* get KeyUpdate */
2269 tls_recv_keyupdate(_metadata, self->cfd, 0);
2270
2271 ret = fork();
2272 ASSERT_GE(ret, 0);
2273
2274 if (ret) {
2275 int pid2, status;
2276
2277 /* wait before installing the new key */
2278 sleep(1);
2279
2280 /* update RX key while poll() is sleeping */
2281 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
2282
2283 sleep(1);
2284 send_len = strlen(test_str) + 1;
2285 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
2286
2287 pid2 = wait(&status);
2288 EXPECT_EQ(pid2, ret);
2289 EXPECT_EQ(status, 0);
2290 } else {
2291 pfd.fd = self->cfd;
2292 pfd.events = POLLIN;
2293 EXPECT_EQ(poll(&pfd, 1, 5000), 1);
2294 exit(!__test_passed(_metadata));
2295 }
2296 }
2297
2298 struct raw_rec {
2299 unsigned int plain_len;
2300 unsigned char plain_data[100];
2301 unsigned int cipher_len;
2302 unsigned char cipher_data[128];
2303 };
2304
2305 /* TLS 1.2, AES_CCM, data, seqno:0, plaintext: 'Hello world' */
2306 static const struct raw_rec id0_data_l11 = {
2307 .plain_len = 11,
2308 .plain_data = {
2309 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f,
2310 0x72, 0x6c, 0x64,
2311 },
2312 .cipher_len = 40,
2313 .cipher_data = {
2314 0x17, 0x03, 0x03, 0x00, 0x23, 0x00, 0x00, 0x00,
2315 0x00, 0x00, 0x00, 0x00, 0x00, 0x26, 0xa2, 0x33,
2316 0xde, 0x8d, 0x94, 0xf0, 0x29, 0x6c, 0xb1, 0xaf,
2317 0x6a, 0x75, 0xb2, 0x93, 0xad, 0x45, 0xd5, 0xfd,
2318 0x03, 0x51, 0x57, 0x8f, 0xf9, 0xcc, 0x3b, 0x42,
2319 },
2320 };
2321
2322 /* TLS 1.2, AES_CCM, ctrl, seqno:0, plaintext: '' */
2323 static const struct raw_rec id0_ctrl_l0 = {
2324 .plain_len = 0,
2325 .plain_data = {
2326 },
2327 .cipher_len = 29,
2328 .cipher_data = {
2329 0x16, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00,
2330 0x00, 0x00, 0x00, 0x00, 0x00, 0x13, 0x38, 0x7b,
2331 0xa6, 0x1c, 0xdd, 0xa7, 0x19, 0x33, 0xab, 0xae,
2332 0x88, 0xe1, 0xd2, 0x08, 0x4f,
2333 },
2334 };
2335
2336 /* TLS 1.2, AES_CCM, data, seqno:0, plaintext: '' */
2337 static const struct raw_rec id0_data_l0 = {
2338 .plain_len = 0,
2339 .plain_data = {
2340 },
2341 .cipher_len = 29,
2342 .cipher_data = {
2343 0x17, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00,
2344 0x00, 0x00, 0x00, 0x00, 0x00, 0xc5, 0x37, 0x90,
2345 0x70, 0x45, 0x89, 0xfb, 0x5c, 0xc7, 0x89, 0x03,
2346 0x68, 0x80, 0xd3, 0xd8, 0xcc,
2347 },
2348 };
2349
2350 /* TLS 1.2, AES_CCM, data, seqno:1, plaintext: 'Hello world' */
2351 static const struct raw_rec id1_data_l11 = {
2352 .plain_len = 11,
2353 .plain_data = {
2354 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f,
2355 0x72, 0x6c, 0x64,
2356 },
2357 .cipher_len = 40,
2358 .cipher_data = {
2359 0x17, 0x03, 0x03, 0x00, 0x23, 0x00, 0x00, 0x00,
2360 0x00, 0x00, 0x00, 0x00, 0x01, 0x3a, 0x1a, 0x9c,
2361 0xd0, 0xa8, 0x9a, 0xd6, 0x69, 0xd6, 0x1a, 0xe3,
2362 0xb5, 0x1f, 0x0d, 0x2c, 0xe2, 0x97, 0x46, 0xff,
2363 0x2b, 0xcc, 0x5a, 0xc4, 0xa3, 0xb9, 0xef, 0xba,
2364 },
2365 };
2366
2367 /* TLS 1.2, AES_CCM, ctrl, seqno:1, plaintext: '' */
2368 static const struct raw_rec id1_ctrl_l0 = {
2369 .plain_len = 0,
2370 .plain_data = {
2371 },
2372 .cipher_len = 29,
2373 .cipher_data = {
2374 0x16, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00,
2375 0x00, 0x00, 0x00, 0x00, 0x01, 0x3e, 0xf0, 0xfe,
2376 0xee, 0xd9, 0xe2, 0x5d, 0xc7, 0x11, 0x4c, 0xe6,
2377 0xb4, 0x7e, 0xef, 0x40, 0x2b,
2378 },
2379 };
2380
2381 /* TLS 1.2, AES_CCM, data, seqno:1, plaintext: '' */
2382 static const struct raw_rec id1_data_l0 = {
2383 .plain_len = 0,
2384 .plain_data = {
2385 },
2386 .cipher_len = 29,
2387 .cipher_data = {
2388 0x17, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00,
2389 0x00, 0x00, 0x00, 0x00, 0x01, 0xce, 0xfc, 0x86,
2390 0xc8, 0xf0, 0x55, 0xf9, 0x47, 0x3f, 0x74, 0xdc,
2391 0xc9, 0xbf, 0xfe, 0x5b, 0xb1,
2392 },
2393 };
2394
2395 /* TLS 1.2, AES_CCM, ctrl, seqno:2, plaintext: 'Hello world' */
2396 static const struct raw_rec id2_ctrl_l11 = {
2397 .plain_len = 11,
2398 .plain_data = {
2399 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f,
2400 0x72, 0x6c, 0x64,
2401 },
2402 .cipher_len = 40,
2403 .cipher_data = {
2404 0x16, 0x03, 0x03, 0x00, 0x23, 0x00, 0x00, 0x00,
2405 0x00, 0x00, 0x00, 0x00, 0x02, 0xe5, 0x3d, 0x19,
2406 0x3d, 0xca, 0xb8, 0x16, 0xb6, 0xff, 0x79, 0x87,
2407 0x2a, 0x04, 0x11, 0x3d, 0xf8, 0x64, 0x5f, 0x36,
2408 0x8b, 0xa8, 0xee, 0x4c, 0x6d, 0x62, 0xa5, 0x00,
2409 },
2410 };
2411
2412 /* TLS 1.2, AES_CCM, data, seqno:2, plaintext: 'Hello world' */
2413 static const struct raw_rec id2_data_l11 = {
2414 .plain_len = 11,
2415 .plain_data = {
2416 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f,
2417 0x72, 0x6c, 0x64,
2418 },
2419 .cipher_len = 40,
2420 .cipher_data = {
2421 0x17, 0x03, 0x03, 0x00, 0x23, 0x00, 0x00, 0x00,
2422 0x00, 0x00, 0x00, 0x00, 0x02, 0xe5, 0x3d, 0x19,
2423 0x3d, 0xca, 0xb8, 0x16, 0xb6, 0xff, 0x79, 0x87,
2424 0x8e, 0xa1, 0xd0, 0xcd, 0x33, 0xb5, 0x86, 0x2b,
2425 0x17, 0xf1, 0x52, 0x2a, 0x55, 0x62, 0x65, 0x11,
2426 },
2427 };
2428
2429 /* TLS 1.2, AES_CCM, ctrl, seqno:2, plaintext: '' */
2430 static const struct raw_rec id2_ctrl_l0 = {
2431 .plain_len = 0,
2432 .plain_data = {
2433 },
2434 .cipher_len = 29,
2435 .cipher_data = {
2436 0x16, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00,
2437 0x00, 0x00, 0x00, 0x00, 0x02, 0xdc, 0x5c, 0x0e,
2438 0x41, 0xdd, 0xba, 0xd3, 0xcc, 0xcf, 0x6d, 0xd9,
2439 0x06, 0xdb, 0x79, 0xe5, 0x5d,
2440 },
2441 };
2442
2443 /* TLS 1.2, AES_CCM, data, seqno:2, plaintext: '' */
2444 static const struct raw_rec id2_data_l0 = {
2445 .plain_len = 0,
2446 .plain_data = {
2447 },
2448 .cipher_len = 29,
2449 .cipher_data = {
2450 0x17, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00,
2451 0x00, 0x00, 0x00, 0x00, 0x02, 0xc3, 0xca, 0x26,
2452 0x22, 0xe4, 0x25, 0xfb, 0x5f, 0x6d, 0xbf, 0x83,
2453 0x30, 0x48, 0x69, 0x1a, 0x47,
2454 },
2455 };
2456
FIXTURE(zero_len)2457 FIXTURE(zero_len)
2458 {
2459 int fd, cfd;
2460 bool notls;
2461 };
2462
FIXTURE_VARIANT(zero_len)2463 FIXTURE_VARIANT(zero_len)
2464 {
2465 const struct raw_rec *recs[4];
2466 ssize_t recv_ret[4];
2467 };
2468
FIXTURE_VARIANT_ADD(zero_len,data_data_data)2469 FIXTURE_VARIANT_ADD(zero_len, data_data_data)
2470 {
2471 .recs = { &id0_data_l11, &id1_data_l11, &id2_data_l11, },
2472 .recv_ret = { 33, -EAGAIN, },
2473 };
2474
FIXTURE_VARIANT_ADD(zero_len,data_0ctrl_data)2475 FIXTURE_VARIANT_ADD(zero_len, data_0ctrl_data)
2476 {
2477 .recs = { &id0_data_l11, &id1_ctrl_l0, &id2_data_l11, },
2478 .recv_ret = { 11, 0, 11, -EAGAIN, },
2479 };
2480
2481 FIXTURE_VARIANT_ADD(zero_len, 0data_0data_0data)
2482 {
2483 .recs = { &id0_data_l0, &id1_data_l0, &id2_data_l0, },
2484 .recv_ret = { -EAGAIN, },
2485 };
2486
2487 FIXTURE_VARIANT_ADD(zero_len, 0data_0data_ctrl)
2488 {
2489 .recs = { &id0_data_l0, &id1_data_l0, &id2_ctrl_l11, },
2490 .recv_ret = { 0, 11, -EAGAIN, },
2491 };
2492
2493 FIXTURE_VARIANT_ADD(zero_len, 0data_0data_0ctrl)
2494 {
2495 .recs = { &id0_data_l0, &id1_data_l0, &id2_ctrl_l0, },
2496 .recv_ret = { 0, 0, -EAGAIN, },
2497 };
2498
2499 FIXTURE_VARIANT_ADD(zero_len, 0ctrl_0ctrl_0ctrl)
2500 {
2501 .recs = { &id0_ctrl_l0, &id1_ctrl_l0, &id2_ctrl_l0, },
2502 .recv_ret = { 0, 0, 0, -EAGAIN, },
2503 };
2504
2505 FIXTURE_VARIANT_ADD(zero_len, 0data_0data_data)
2506 {
2507 .recs = { &id0_data_l0, &id1_data_l0, &id2_data_l11, },
2508 .recv_ret = { 11, -EAGAIN, },
2509 };
2510
FIXTURE_VARIANT_ADD(zero_len,data_0data_0data)2511 FIXTURE_VARIANT_ADD(zero_len, data_0data_0data)
2512 {
2513 .recs = { &id0_data_l11, &id1_data_l0, &id2_data_l0, },
2514 .recv_ret = { 11, -EAGAIN, },
2515 };
2516
FIXTURE_SETUP(zero_len)2517 FIXTURE_SETUP(zero_len)
2518 {
2519 struct tls_crypto_info_keys tls12;
2520 int ret;
2521
2522 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_CCM_128,
2523 &tls12, 0);
2524
2525 ulp_sock_pair(_metadata, &self->fd, &self->cfd, &self->notls);
2526 if (self->notls)
2527 return;
2528
2529 /* Don't install keys on fd, we'll send raw records */
2530 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len);
2531 ASSERT_EQ(ret, 0);
2532 }
2533
FIXTURE_TEARDOWN(zero_len)2534 FIXTURE_TEARDOWN(zero_len)
2535 {
2536 close(self->fd);
2537 close(self->cfd);
2538 }
2539
TEST_F(zero_len,test)2540 TEST_F(zero_len, test)
2541 {
2542 const struct raw_rec *const *rec;
2543 unsigned char buf[128];
2544 int rec_off;
2545 int i;
2546
2547 for (i = 0; i < 4 && variant->recs[i]; i++)
2548 EXPECT_EQ(send(self->fd, variant->recs[i]->cipher_data,
2549 variant->recs[i]->cipher_len, 0),
2550 variant->recs[i]->cipher_len);
2551
2552 rec = &variant->recs[0];
2553 rec_off = 0;
2554 for (i = 0; i < 4; i++) {
2555 int j, ret;
2556
2557 ret = variant->recv_ret[i] >= 0 ? variant->recv_ret[i] : -1;
2558 EXPECT_EQ(__tls_recv_cmsg(_metadata, self->cfd, NULL,
2559 buf, sizeof(buf), MSG_DONTWAIT), ret);
2560 if (ret == -1)
2561 EXPECT_EQ(errno, -variant->recv_ret[i]);
2562 if (variant->recv_ret[i] == -EAGAIN)
2563 break;
2564
2565 for (j = 0; j < ret; j++) {
2566 while (rec_off == (*rec)->plain_len) {
2567 rec++;
2568 rec_off = 0;
2569 }
2570 EXPECT_EQ(buf[j], (*rec)->plain_data[rec_off]);
2571 rec_off++;
2572 }
2573 }
2574 };
2575
FIXTURE(tls_err)2576 FIXTURE(tls_err)
2577 {
2578 int fd, cfd;
2579 int fd2, cfd2;
2580 bool notls;
2581 };
2582
FIXTURE_VARIANT(tls_err)2583 FIXTURE_VARIANT(tls_err)
2584 {
2585 uint16_t tls_version;
2586 };
2587
2588 FIXTURE_VARIANT_ADD(tls_err, 12_aes_gcm)
2589 {
2590 .tls_version = TLS_1_2_VERSION,
2591 };
2592
2593 FIXTURE_VARIANT_ADD(tls_err, 13_aes_gcm)
2594 {
2595 .tls_version = TLS_1_3_VERSION,
2596 };
2597
FIXTURE_SETUP(tls_err)2598 FIXTURE_SETUP(tls_err)
2599 {
2600 struct tls_crypto_info_keys tls12;
2601 int ret;
2602
2603 tls_crypto_info_init(variant->tls_version, TLS_CIPHER_AES_GCM_128,
2604 &tls12, 0);
2605
2606 ulp_sock_pair(_metadata, &self->fd, &self->cfd, &self->notls);
2607 ulp_sock_pair(_metadata, &self->fd2, &self->cfd2, &self->notls);
2608 if (self->notls)
2609 return;
2610
2611 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len);
2612 ASSERT_EQ(ret, 0);
2613
2614 ret = setsockopt(self->cfd2, SOL_TLS, TLS_RX, &tls12, tls12.len);
2615 ASSERT_EQ(ret, 0);
2616 }
2617
FIXTURE_TEARDOWN(tls_err)2618 FIXTURE_TEARDOWN(tls_err)
2619 {
2620 close(self->fd);
2621 close(self->cfd);
2622 close(self->fd2);
2623 close(self->cfd2);
2624 }
2625
TEST_F(tls_err,bad_rec)2626 TEST_F(tls_err, bad_rec)
2627 {
2628 char buf[64];
2629
2630 if (self->notls)
2631 SKIP(return, "no TLS support");
2632
2633 memset(buf, 0x55, sizeof(buf));
2634 EXPECT_EQ(send(self->fd2, buf, sizeof(buf), 0), sizeof(buf));
2635 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2636 EXPECT_EQ(errno, EMSGSIZE);
2637 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), MSG_DONTWAIT), -1);
2638 EXPECT_EQ(errno, EAGAIN);
2639 }
2640
TEST_F(tls_err,bad_auth)2641 TEST_F(tls_err, bad_auth)
2642 {
2643 char buf[128];
2644 int n;
2645
2646 if (self->notls)
2647 SKIP(return, "no TLS support");
2648
2649 memrnd(buf, sizeof(buf) / 2);
2650 EXPECT_EQ(send(self->fd, buf, sizeof(buf) / 2, 0), sizeof(buf) / 2);
2651 n = recv(self->cfd, buf, sizeof(buf), 0);
2652 EXPECT_GT(n, sizeof(buf) / 2);
2653
2654 buf[n - 1]++;
2655
2656 EXPECT_EQ(send(self->fd2, buf, n, 0), n);
2657 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2658 EXPECT_EQ(errno, EBADMSG);
2659 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2660 EXPECT_EQ(errno, EBADMSG);
2661 }
2662
TEST_F(tls_err,bad_in_large_read)2663 TEST_F(tls_err, bad_in_large_read)
2664 {
2665 char txt[3][64];
2666 char cip[3][128];
2667 char buf[3 * 128];
2668 int i, n;
2669
2670 if (self->notls)
2671 SKIP(return, "no TLS support");
2672
2673 /* Put 3 records in the sockets */
2674 for (i = 0; i < 3; i++) {
2675 memrnd(txt[i], sizeof(txt[i]));
2676 EXPECT_EQ(send(self->fd, txt[i], sizeof(txt[i]), 0),
2677 sizeof(txt[i]));
2678 n = recv(self->cfd, cip[i], sizeof(cip[i]), 0);
2679 EXPECT_GT(n, sizeof(txt[i]));
2680 /* Break the third message */
2681 if (i == 2)
2682 cip[2][n - 1]++;
2683 EXPECT_EQ(send(self->fd2, cip[i], n, 0), n);
2684 }
2685
2686 /* We should be able to receive the first two messages */
2687 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), sizeof(txt[0]) * 2);
2688 EXPECT_EQ(memcmp(buf, txt[0], sizeof(txt[0])), 0);
2689 EXPECT_EQ(memcmp(buf + sizeof(txt[0]), txt[1], sizeof(txt[1])), 0);
2690 /* Third mesasge is bad */
2691 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2692 EXPECT_EQ(errno, EBADMSG);
2693 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2694 EXPECT_EQ(errno, EBADMSG);
2695 }
2696
TEST_F(tls_err,bad_cmsg)2697 TEST_F(tls_err, bad_cmsg)
2698 {
2699 char *test_str = "test_read";
2700 int send_len = 10;
2701 char cip[128];
2702 char buf[128];
2703 char txt[64];
2704 int n;
2705
2706 if (self->notls)
2707 SKIP(return, "no TLS support");
2708
2709 /* Queue up one data record */
2710 memrnd(txt, sizeof(txt));
2711 EXPECT_EQ(send(self->fd, txt, sizeof(txt), 0), sizeof(txt));
2712 n = recv(self->cfd, cip, sizeof(cip), 0);
2713 EXPECT_GT(n, sizeof(txt));
2714 EXPECT_EQ(send(self->fd2, cip, n, 0), n);
2715
2716 EXPECT_EQ(tls_send_cmsg(self->fd, 100, test_str, send_len, 0), 10);
2717 n = recv(self->cfd, cip, sizeof(cip), 0);
2718 cip[n - 1]++; /* Break it */
2719 EXPECT_GT(n, send_len);
2720 EXPECT_EQ(send(self->fd2, cip, n, 0), n);
2721
2722 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), sizeof(txt));
2723 EXPECT_EQ(memcmp(buf, txt, sizeof(txt)), 0);
2724 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2725 EXPECT_EQ(errno, EBADMSG);
2726 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2727 EXPECT_EQ(errno, EBADMSG);
2728 }
2729
TEST_F(tls_err,timeo)2730 TEST_F(tls_err, timeo)
2731 {
2732 struct timeval tv = { .tv_usec = 10000, };
2733 char buf[128];
2734 int ret;
2735
2736 if (self->notls)
2737 SKIP(return, "no TLS support");
2738
2739 ret = setsockopt(self->cfd2, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
2740 ASSERT_EQ(ret, 0);
2741
2742 ret = fork();
2743 ASSERT_GE(ret, 0);
2744
2745 if (ret) {
2746 usleep(1000); /* Give child a head start */
2747
2748 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2749 EXPECT_EQ(errno, EAGAIN);
2750
2751 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2752 EXPECT_EQ(errno, EAGAIN);
2753
2754 wait(&ret);
2755 } else {
2756 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2757 EXPECT_EQ(errno, EAGAIN);
2758 exit(0);
2759 }
2760 }
2761
TEST_F(tls_err,poll_partial_rec)2762 TEST_F(tls_err, poll_partial_rec)
2763 {
2764 struct pollfd pfd = { };
2765 ssize_t rec_len;
2766 char rec[256];
2767 char buf[128];
2768
2769 if (self->notls)
2770 SKIP(return, "no TLS support");
2771
2772 pfd.fd = self->cfd2;
2773 pfd.events = POLLIN;
2774 EXPECT_EQ(poll(&pfd, 1, 1), 0);
2775
2776 memrnd(buf, sizeof(buf));
2777 EXPECT_EQ(send(self->fd, buf, sizeof(buf), 0), sizeof(buf));
2778 rec_len = recv(self->cfd, rec, sizeof(rec), 0);
2779 EXPECT_GT(rec_len, sizeof(buf));
2780
2781 /* Write 100B, not the full record ... */
2782 EXPECT_EQ(send(self->fd2, rec, 100, 0), 100);
2783 /* ... no full record should mean no POLLIN */
2784 pfd.fd = self->cfd2;
2785 pfd.events = POLLIN;
2786 EXPECT_EQ(poll(&pfd, 1, 1), 0);
2787 /* Now write the rest, and it should all pop out of the other end. */
2788 EXPECT_EQ(send(self->fd2, rec + 100, rec_len - 100, 0), rec_len - 100);
2789 pfd.fd = self->cfd2;
2790 pfd.events = POLLIN;
2791 EXPECT_EQ(poll(&pfd, 1, 1), 1);
2792 EXPECT_EQ(recv(self->cfd2, rec, sizeof(rec), 0), sizeof(buf));
2793 EXPECT_EQ(memcmp(buf, rec, sizeof(buf)), 0);
2794 }
2795
TEST_F(tls_err,epoll_partial_rec)2796 TEST_F(tls_err, epoll_partial_rec)
2797 {
2798 struct epoll_event ev, events[10];
2799 ssize_t rec_len;
2800 char rec[256];
2801 char buf[128];
2802 int epollfd;
2803
2804 if (self->notls)
2805 SKIP(return, "no TLS support");
2806
2807 epollfd = epoll_create1(0);
2808 ASSERT_GE(epollfd, 0);
2809
2810 memset(&ev, 0, sizeof(ev));
2811 ev.events = EPOLLIN;
2812 ev.data.fd = self->cfd2;
2813 ASSERT_GE(epoll_ctl(epollfd, EPOLL_CTL_ADD, self->cfd2, &ev), 0);
2814
2815 EXPECT_EQ(epoll_wait(epollfd, events, 10, 0), 0);
2816
2817 memrnd(buf, sizeof(buf));
2818 EXPECT_EQ(send(self->fd, buf, sizeof(buf), 0), sizeof(buf));
2819 rec_len = recv(self->cfd, rec, sizeof(rec), 0);
2820 EXPECT_GT(rec_len, sizeof(buf));
2821
2822 /* Write 100B, not the full record ... */
2823 EXPECT_EQ(send(self->fd2, rec, 100, 0), 100);
2824 /* ... no full record should mean no POLLIN */
2825 EXPECT_EQ(epoll_wait(epollfd, events, 10, 0), 0);
2826 /* Now write the rest, and it should all pop out of the other end. */
2827 EXPECT_EQ(send(self->fd2, rec + 100, rec_len - 100, 0), rec_len - 100);
2828 EXPECT_EQ(epoll_wait(epollfd, events, 10, 0), 1);
2829 EXPECT_EQ(recv(self->cfd2, rec, sizeof(rec), 0), sizeof(buf));
2830 EXPECT_EQ(memcmp(buf, rec, sizeof(buf)), 0);
2831
2832 close(epollfd);
2833 }
2834
TEST_F(tls_err,poll_partial_rec_async)2835 TEST_F(tls_err, poll_partial_rec_async)
2836 {
2837 struct pollfd pfd = { };
2838 char token = '\0';
2839 ssize_t rec_len;
2840 char rec[256];
2841 char buf[128];
2842 int p[2];
2843 int ret;
2844
2845 if (self->notls)
2846 SKIP(return, "no TLS support");
2847
2848 ASSERT_GE(pipe(p), 0);
2849
2850 memrnd(buf, sizeof(buf));
2851 EXPECT_EQ(send(self->fd, buf, sizeof(buf), 0), sizeof(buf));
2852 rec_len = recv(self->cfd, rec, sizeof(rec), 0);
2853 EXPECT_GT(rec_len, sizeof(buf));
2854
2855 ret = fork();
2856 ASSERT_GE(ret, 0);
2857
2858 if (ret) {
2859 int status, pid2;
2860
2861 close(p[1]);
2862 usleep(1000); /* Give child a head start */
2863
2864 EXPECT_EQ(send(self->fd2, rec, 100, 0), 100);
2865
2866 EXPECT_EQ(read(p[0], &token, 1), 1); /* Barrier #1 */
2867
2868 EXPECT_EQ(send(self->fd2, rec + 100, rec_len - 100, 0),
2869 rec_len - 100);
2870
2871 pid2 = wait(&status);
2872 EXPECT_EQ(pid2, ret);
2873 EXPECT_EQ(status, 0);
2874 } else {
2875 close(p[0]);
2876
2877 /* Child should sleep in poll(), never get a wake */
2878 pfd.fd = self->cfd2;
2879 pfd.events = POLLIN;
2880 EXPECT_EQ(poll(&pfd, 1, 20), 0);
2881
2882 EXPECT_EQ(write(p[1], &token, 1), 1); /* Barrier #1 */
2883
2884 pfd.fd = self->cfd2;
2885 pfd.events = POLLIN;
2886 EXPECT_EQ(poll(&pfd, 1, 20), 1);
2887
2888 exit(!__test_passed(_metadata));
2889 }
2890 }
2891
2892 /* Use OOB+large send to trigger copy mode due to memory pressure.
2893 * OOB causes a short read.
2894 */
TEST_F(tls_err,oob_pressure)2895 TEST_F(tls_err, oob_pressure)
2896 {
2897 char buf[1<<16];
2898 int i;
2899
2900 memrnd(buf, sizeof(buf));
2901
2902 EXPECT_EQ(send(self->fd2, buf, 5, MSG_OOB), 5);
2903 EXPECT_EQ(send(self->fd2, buf, sizeof(buf), 0), sizeof(buf));
2904 for (i = 0; i < 64; i++)
2905 EXPECT_EQ(send(self->fd2, buf, 5, MSG_OOB), 5);
2906 }
2907
2908 /*
2909 * Parse a stream of TLS records and ensure that each record respects
2910 * the specified @max_payload_len.
2911 */
parse_tls_records(struct __test_metadata * _metadata,const __u8 * rx_buf,int rx_len,int overhead,__u16 max_payload_len)2912 static size_t parse_tls_records(struct __test_metadata *_metadata,
2913 const __u8 *rx_buf, int rx_len, int overhead,
2914 __u16 max_payload_len)
2915 {
2916 const __u8 *rec = rx_buf;
2917 size_t total_plaintext_rx = 0;
2918 const __u8 rec_header_len = 5;
2919
2920 while (rec < rx_buf + rx_len) {
2921 __u16 record_payload_len;
2922 __u16 plaintext_len;
2923
2924 /* Sanity check that it's a TLS header for application data */
2925 ASSERT_EQ(rec[0], 23);
2926 ASSERT_EQ(rec[1], 0x3);
2927 ASSERT_EQ(rec[2], 0x3);
2928
2929 memcpy(&record_payload_len, rec + 3, 2);
2930 record_payload_len = ntohs(record_payload_len);
2931 ASSERT_GE(record_payload_len, overhead);
2932
2933 plaintext_len = record_payload_len - overhead;
2934 total_plaintext_rx += plaintext_len;
2935
2936 /* Plaintext must not exceed the specified limit */
2937 ASSERT_LE(plaintext_len, max_payload_len);
2938 rec += rec_header_len + record_payload_len;
2939 }
2940
2941 return total_plaintext_rx;
2942 }
2943
TEST(tls_12_tx_max_payload_len)2944 TEST(tls_12_tx_max_payload_len)
2945 {
2946 struct tls_crypto_info_keys tls12;
2947 int cfd, ret, fd, overhead;
2948 size_t total_plaintext_rx = 0;
2949 __u8 tx[1024], rx[2000];
2950 __u16 limit = 128;
2951 __u16 opt = 0;
2952 unsigned int optlen = sizeof(opt);
2953 bool notls;
2954
2955 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_CCM_128,
2956 &tls12, 0);
2957
2958 ulp_sock_pair(_metadata, &fd, &cfd, ¬ls);
2959
2960 if (notls)
2961 exit(KSFT_SKIP);
2962
2963 /* Don't install keys on fd, we'll parse raw records */
2964 ret = setsockopt(cfd, SOL_TLS, TLS_TX, &tls12, tls12.len);
2965 ASSERT_EQ(ret, 0);
2966
2967 ret = setsockopt(cfd, SOL_TLS, TLS_TX_MAX_PAYLOAD_LEN, &limit,
2968 sizeof(limit));
2969 ASSERT_EQ(ret, 0);
2970
2971 ret = getsockopt(cfd, SOL_TLS, TLS_TX_MAX_PAYLOAD_LEN, &opt, &optlen);
2972 EXPECT_EQ(ret, 0);
2973 EXPECT_EQ(limit, opt);
2974 EXPECT_EQ(optlen, sizeof(limit));
2975
2976 memset(tx, 0, sizeof(tx));
2977 ASSERT_EQ(send(cfd, tx, sizeof(tx), 0), sizeof(tx));
2978 close(cfd);
2979
2980 ret = recv(fd, rx, sizeof(rx), 0);
2981
2982 /*
2983 * 16B tag + 8B IV -- record header (5B) is not counted but we'll
2984 * need it to walk the record stream
2985 */
2986 overhead = 16 + 8;
2987 total_plaintext_rx = parse_tls_records(_metadata, rx, ret, overhead,
2988 limit);
2989
2990 ASSERT_EQ(total_plaintext_rx, sizeof(tx));
2991 close(fd);
2992 }
2993
TEST(tls_12_tx_max_payload_len_open_rec)2994 TEST(tls_12_tx_max_payload_len_open_rec)
2995 {
2996 struct tls_crypto_info_keys tls12;
2997 int cfd, ret, fd, overhead;
2998 size_t total_plaintext_rx = 0;
2999 __u8 tx[1024], rx[2000];
3000 __u16 tx_partial = 256;
3001 __u16 og_limit = 512, limit = 128;
3002 bool notls;
3003
3004 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_CCM_128,
3005 &tls12, 0);
3006
3007 ulp_sock_pair(_metadata, &fd, &cfd, ¬ls);
3008
3009 if (notls)
3010 exit(KSFT_SKIP);
3011
3012 /* Don't install keys on fd, we'll parse raw records */
3013 ret = setsockopt(cfd, SOL_TLS, TLS_TX, &tls12, tls12.len);
3014 ASSERT_EQ(ret, 0);
3015
3016 ret = setsockopt(cfd, SOL_TLS, TLS_TX_MAX_PAYLOAD_LEN, &og_limit,
3017 sizeof(og_limit));
3018 ASSERT_EQ(ret, 0);
3019
3020 memset(tx, 0, sizeof(tx));
3021 ASSERT_EQ(send(cfd, tx, tx_partial, MSG_MORE), tx_partial);
3022
3023 /*
3024 * Changing the payload limit with a pending open record should
3025 * not be allowed.
3026 */
3027 ret = setsockopt(cfd, SOL_TLS, TLS_TX_MAX_PAYLOAD_LEN, &limit,
3028 sizeof(limit));
3029 ASSERT_EQ(ret, -1);
3030 ASSERT_EQ(errno, EBUSY);
3031
3032 ASSERT_EQ(send(cfd, tx + tx_partial, sizeof(tx) - tx_partial, MSG_EOR),
3033 sizeof(tx) - tx_partial);
3034 close(cfd);
3035
3036 ret = recv(fd, rx, sizeof(rx), 0);
3037
3038 /*
3039 * 16B tag + 8B IV -- record header (5B) is not counted but we'll
3040 * need it to walk the record stream
3041 */
3042 overhead = 16 + 8;
3043 total_plaintext_rx = parse_tls_records(_metadata, rx, ret, overhead,
3044 og_limit);
3045 ASSERT_EQ(total_plaintext_rx, sizeof(tx));
3046 close(fd);
3047 }
3048
TEST(non_established)3049 TEST(non_established) {
3050 struct tls12_crypto_info_aes_gcm_256 tls12;
3051 struct sockaddr_in addr;
3052 int sfd, ret, fd;
3053 socklen_t len;
3054
3055 len = sizeof(addr);
3056
3057 memset(&tls12, 0, sizeof(tls12));
3058 tls12.info.version = TLS_1_2_VERSION;
3059 tls12.info.cipher_type = TLS_CIPHER_AES_GCM_256;
3060
3061 addr.sin_family = AF_INET;
3062 addr.sin_addr.s_addr = htonl(INADDR_ANY);
3063 addr.sin_port = 0;
3064
3065 fd = socket(AF_INET, SOCK_STREAM, 0);
3066 sfd = socket(AF_INET, SOCK_STREAM, 0);
3067
3068 ret = bind(sfd, &addr, sizeof(addr));
3069 ASSERT_EQ(ret, 0);
3070 ret = listen(sfd, 10);
3071 ASSERT_EQ(ret, 0);
3072
3073 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
3074 EXPECT_EQ(ret, -1);
3075 /* TLS ULP not supported */
3076 if (errno == ENOENT)
3077 return;
3078 EXPECT_EQ(errno, ENOTCONN);
3079
3080 ret = setsockopt(sfd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
3081 EXPECT_EQ(ret, -1);
3082 EXPECT_EQ(errno, ENOTCONN);
3083
3084 ret = getsockname(sfd, &addr, &len);
3085 ASSERT_EQ(ret, 0);
3086
3087 ret = connect(fd, &addr, sizeof(addr));
3088 ASSERT_EQ(ret, 0);
3089
3090 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
3091 ASSERT_EQ(ret, 0);
3092
3093 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
3094 EXPECT_EQ(ret, -1);
3095 EXPECT_EQ(errno, EEXIST);
3096
3097 close(fd);
3098 close(sfd);
3099 }
3100
TEST(keysizes)3101 TEST(keysizes) {
3102 struct tls12_crypto_info_aes_gcm_256 tls12;
3103 int ret, fd, cfd;
3104 bool notls;
3105
3106 memset(&tls12, 0, sizeof(tls12));
3107 tls12.info.version = TLS_1_2_VERSION;
3108 tls12.info.cipher_type = TLS_CIPHER_AES_GCM_256;
3109
3110 ulp_sock_pair(_metadata, &fd, &cfd, ¬ls);
3111
3112 if (!notls) {
3113 ret = setsockopt(fd, SOL_TLS, TLS_TX, &tls12,
3114 sizeof(tls12));
3115 EXPECT_EQ(ret, 0);
3116
3117 ret = setsockopt(cfd, SOL_TLS, TLS_RX, &tls12,
3118 sizeof(tls12));
3119 EXPECT_EQ(ret, 0);
3120 }
3121
3122 close(fd);
3123 close(cfd);
3124 }
3125
TEST(no_pad)3126 TEST(no_pad) {
3127 struct tls12_crypto_info_aes_gcm_256 tls12;
3128 int ret, fd, cfd, val;
3129 socklen_t len;
3130 bool notls;
3131
3132 memset(&tls12, 0, sizeof(tls12));
3133 tls12.info.version = TLS_1_3_VERSION;
3134 tls12.info.cipher_type = TLS_CIPHER_AES_GCM_256;
3135
3136 ulp_sock_pair(_metadata, &fd, &cfd, ¬ls);
3137
3138 if (notls)
3139 exit(KSFT_SKIP);
3140
3141 ret = setsockopt(fd, SOL_TLS, TLS_TX, &tls12, sizeof(tls12));
3142 EXPECT_EQ(ret, 0);
3143
3144 ret = setsockopt(cfd, SOL_TLS, TLS_RX, &tls12, sizeof(tls12));
3145 EXPECT_EQ(ret, 0);
3146
3147 val = 1;
3148 ret = setsockopt(cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD,
3149 (void *)&val, sizeof(val));
3150 EXPECT_EQ(ret, 0);
3151
3152 len = sizeof(val);
3153 val = 2;
3154 ret = getsockopt(cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD,
3155 (void *)&val, &len);
3156 EXPECT_EQ(ret, 0);
3157 EXPECT_EQ(val, 1);
3158 EXPECT_EQ(len, 4);
3159
3160 val = 0;
3161 ret = setsockopt(cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD,
3162 (void *)&val, sizeof(val));
3163 EXPECT_EQ(ret, 0);
3164
3165 len = sizeof(val);
3166 val = 2;
3167 ret = getsockopt(cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD,
3168 (void *)&val, &len);
3169 EXPECT_EQ(ret, 0);
3170 EXPECT_EQ(val, 0);
3171 EXPECT_EQ(len, 4);
3172
3173 close(fd);
3174 close(cfd);
3175 }
3176
TEST(tls_v6ops)3177 TEST(tls_v6ops) {
3178 struct tls_crypto_info_keys tls12;
3179 struct sockaddr_in6 addr, addr2;
3180 int sfd, ret, fd;
3181 socklen_t len, len2;
3182
3183 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_GCM_128, &tls12, 0);
3184
3185 addr.sin6_family = AF_INET6;
3186 addr.sin6_addr = in6addr_any;
3187 addr.sin6_port = 0;
3188
3189 fd = socket(AF_INET6, SOCK_STREAM, 0);
3190 sfd = socket(AF_INET6, SOCK_STREAM, 0);
3191
3192 ret = bind(sfd, &addr, sizeof(addr));
3193 ASSERT_EQ(ret, 0);
3194 ret = listen(sfd, 10);
3195 ASSERT_EQ(ret, 0);
3196
3197 len = sizeof(addr);
3198 ret = getsockname(sfd, &addr, &len);
3199 ASSERT_EQ(ret, 0);
3200
3201 ret = connect(fd, &addr, sizeof(addr));
3202 ASSERT_EQ(ret, 0);
3203
3204 len = sizeof(addr);
3205 ret = getsockname(fd, &addr, &len);
3206 ASSERT_EQ(ret, 0);
3207
3208 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
3209 if (ret) {
3210 ASSERT_EQ(errno, ENOENT);
3211 SKIP(return, "no TLS support");
3212 }
3213 ASSERT_EQ(ret, 0);
3214
3215 ret = setsockopt(fd, SOL_TLS, TLS_TX, &tls12, tls12.len);
3216 ASSERT_EQ(ret, 0);
3217
3218 ret = setsockopt(fd, SOL_TLS, TLS_RX, &tls12, tls12.len);
3219 ASSERT_EQ(ret, 0);
3220
3221 len2 = sizeof(addr2);
3222 ret = getsockname(fd, &addr2, &len2);
3223 ASSERT_EQ(ret, 0);
3224
3225 EXPECT_EQ(len2, len);
3226 EXPECT_EQ(memcmp(&addr, &addr2, len), 0);
3227
3228 close(fd);
3229 close(sfd);
3230 }
3231
TEST(prequeue)3232 TEST(prequeue) {
3233 struct tls_crypto_info_keys tls12;
3234 char buf[20000], buf2[20000];
3235 struct sockaddr_in addr;
3236 int sfd, cfd, ret, fd;
3237 socklen_t len;
3238
3239 len = sizeof(addr);
3240 memrnd(buf, sizeof(buf));
3241
3242 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_GCM_256, &tls12, 0);
3243
3244 addr.sin_family = AF_INET;
3245 addr.sin_addr.s_addr = htonl(INADDR_ANY);
3246 addr.sin_port = 0;
3247
3248 fd = socket(AF_INET, SOCK_STREAM, 0);
3249 sfd = socket(AF_INET, SOCK_STREAM, 0);
3250
3251 ASSERT_EQ(bind(sfd, &addr, sizeof(addr)), 0);
3252 ASSERT_EQ(listen(sfd, 10), 0);
3253 ASSERT_EQ(getsockname(sfd, &addr, &len), 0);
3254 ASSERT_EQ(connect(fd, &addr, sizeof(addr)), 0);
3255 ASSERT_GE(cfd = accept(sfd, &addr, &len), 0);
3256 close(sfd);
3257
3258 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
3259 if (ret) {
3260 ASSERT_EQ(errno, ENOENT);
3261 SKIP(return, "no TLS support");
3262 }
3263
3264 ASSERT_EQ(setsockopt(fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
3265 EXPECT_EQ(send(fd, buf, sizeof(buf), MSG_DONTWAIT), sizeof(buf));
3266
3267 ASSERT_EQ(setsockopt(cfd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")), 0);
3268 ASSERT_EQ(setsockopt(cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
3269 EXPECT_EQ(recv(cfd, buf2, sizeof(buf2), MSG_WAITALL), sizeof(buf2));
3270
3271 EXPECT_EQ(memcmp(buf, buf2, sizeof(buf)), 0);
3272
3273 close(fd);
3274 close(cfd);
3275 }
3276
TEST(data_steal)3277 TEST(data_steal) {
3278 struct tls_crypto_info_keys tls;
3279 char buf[20000], buf2[20000];
3280 struct sockaddr_in addr;
3281 int sfd, cfd, ret, fd;
3282 int pid, status;
3283 socklen_t len;
3284
3285 len = sizeof(addr);
3286 memrnd(buf, sizeof(buf));
3287
3288 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_GCM_256, &tls, 0);
3289
3290 addr.sin_family = AF_INET;
3291 addr.sin_addr.s_addr = htonl(INADDR_ANY);
3292 addr.sin_port = 0;
3293
3294 fd = socket(AF_INET, SOCK_STREAM, 0);
3295 sfd = socket(AF_INET, SOCK_STREAM, 0);
3296
3297 ASSERT_EQ(bind(sfd, &addr, sizeof(addr)), 0);
3298 ASSERT_EQ(listen(sfd, 10), 0);
3299 ASSERT_EQ(getsockname(sfd, &addr, &len), 0);
3300 ASSERT_EQ(connect(fd, &addr, sizeof(addr)), 0);
3301 ASSERT_GE(cfd = accept(sfd, &addr, &len), 0);
3302 close(sfd);
3303
3304 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
3305 if (ret) {
3306 ASSERT_EQ(errno, ENOENT);
3307 SKIP(return, "no TLS support");
3308 }
3309 ASSERT_EQ(setsockopt(cfd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")), 0);
3310
3311 /* Spawn a child and get it into the read wait path of the underlying
3312 * TCP socket (before kernel .recvmsg is replaced with the TLS one).
3313 */
3314 pid = fork();
3315 ASSERT_GE(pid, 0);
3316 if (!pid) {
3317 EXPECT_EQ(recv(cfd, buf, sizeof(buf) / 2 + 1, MSG_WAITALL),
3318 sizeof(buf) / 2 + 1);
3319 exit(!__test_passed(_metadata));
3320 }
3321
3322 /* Send a sync byte and poll until it's consumed to ensure
3323 * the child is in recv() before we proceed to install TLS.
3324 */
3325 ASSERT_EQ(send(fd, buf, 1, 0), 1);
3326 do {
3327 usleep(500);
3328 } while (recv(cfd, buf, 1, MSG_PEEK | MSG_DONTWAIT) == 1);
3329 EXPECT_EQ(errno, EAGAIN);
3330
3331 ASSERT_EQ(setsockopt(fd, SOL_TLS, TLS_TX, &tls, tls.len), 0);
3332 ASSERT_EQ(setsockopt(cfd, SOL_TLS, TLS_RX, &tls, tls.len), 0);
3333
3334 EXPECT_EQ(send(fd, buf, sizeof(buf), 0), sizeof(buf));
3335 EXPECT_EQ(wait(&status), pid);
3336 EXPECT_EQ(status, 0);
3337 EXPECT_EQ(recv(cfd, buf2, sizeof(buf2), MSG_DONTWAIT), -1);
3338 /* Don't check errno, the error will be different depending
3339 * on what random bytes TLS interpreted as the record length.
3340 */
3341
3342 close(fd);
3343 close(cfd);
3344 }
3345
fips_check(void)3346 static void __attribute__((constructor)) fips_check(void) {
3347 int res;
3348 FILE *f;
3349
3350 f = fopen("/proc/sys/crypto/fips_enabled", "r");
3351 if (f) {
3352 res = fscanf(f, "%d", &fips_enabled);
3353 if (res != 1)
3354 ksft_print_msg("ERROR: Couldn't read /proc/sys/crypto/fips_enabled\n");
3355 fclose(f);
3356 }
3357 }
3358
3359 TEST_HARNESS_MAIN
3360