1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * The test checks that both active and passive reset have correct TCP-AO
4 * signature. An "active" reset (abort) here is procured from closing
5 * listen() socket with non-accepted connections in the queue:
6 * inet_csk_listen_stop() => inet_child_forget() =>
7 * => tcp_disconnect() => tcp_send_active_reset()
8 *
9 * The passive reset is quite hard to get on established TCP connections.
10 * It could be procured from non-established states, but the synchronization
11 * part from userspace in order to reliably get RST seems uneasy.
12 * So, instead it's procured by corrupting SEQ number on TIMED-WAIT state.
13 *
14 * It's important to test both passive and active RST as they go through
15 * different code-paths:
16 * - tcp_send_active_reset() makes no-data skb, sends it with tcp_transmit_skb()
17 * - tcp_v*_send_reset() create their reply skbs and send them with
18 * ip_send_unicast_reply()
19 *
20 * In both cases TCP-AO signatures have to be correct, which is verified by
21 * (1) checking that the TCP-AO connection was reset and (2) TCP-AO counters.
22 *
23 * Author: Dmitry Safonov <dima@arista.com>
24 */
25 #include <inttypes.h>
26 #include "../../../../include/linux/kernel.h"
27 #include "aolib.h"
28
29 const size_t quota = 1000;
30 const size_t packet_sz = 100;
31 /*
32 * Backlog == 0 means 1 connection in queue, see:
33 * commit 64a146513f8f ("[NET]: Revert incorrect accept queue...")
34 */
35 const unsigned int backlog;
36
netstats_check(struct netstat * before,struct netstat * after,char * msg)37 static void netstats_check(struct netstat *before, struct netstat *after,
38 char *msg)
39 {
40 uint64_t before_cnt, after_cnt;
41
42 before_cnt = netstat_get(before, "TCPAORequired", NULL);
43 after_cnt = netstat_get(after, "TCPAORequired", NULL);
44 if (after_cnt > before_cnt)
45 test_fail("Segments without AO sign (%s): %" PRIu64 " => %" PRIu64,
46 msg, before_cnt, after_cnt);
47 else
48 test_ok("No segments without AO sign (%s)", msg);
49
50 before_cnt = netstat_get(before, "TCPAOGood", NULL);
51 after_cnt = netstat_get(after, "TCPAOGood", NULL);
52 if (after_cnt <= before_cnt)
53 test_fail("Signed AO segments (%s): %" PRIu64 " => %" PRIu64,
54 msg, before_cnt, after_cnt);
55 else
56 test_ok("Signed AO segments (%s): %" PRIu64 " => %" PRIu64,
57 msg, before_cnt, after_cnt);
58
59 before_cnt = netstat_get(before, "TCPAOBad", NULL);
60 after_cnt = netstat_get(after, "TCPAOBad", NULL);
61 if (after_cnt > before_cnt)
62 test_fail("Segments with bad AO sign (%s): %" PRIu64 " => %" PRIu64,
63 msg, before_cnt, after_cnt);
64 else
65 test_ok("No segments with bad AO sign (%s)", msg);
66 }
67
68 /*
69 * Another way to send RST, but not through tcp_v{4,6}_send_reset()
70 * is tcp_send_active_reset(), that is not in reply to inbound segment,
71 * but rather active send. It uses tcp_transmit_skb(), so that should
72 * work, but as it also sends RST - nice that it can be covered as well.
73 */
close_forced(int sk)74 static void close_forced(int sk)
75 {
76 struct linger sl;
77
78 sl.l_onoff = 1;
79 sl.l_linger = 0;
80 if (setsockopt(sk, SOL_SOCKET, SO_LINGER, &sl, sizeof(sl)))
81 test_error("setsockopt(SO_LINGER)");
82 close(sk);
83 }
84
test_server_active_rst(unsigned int port)85 static void test_server_active_rst(unsigned int port)
86 {
87 struct tcp_ao_counters cnt1, cnt2;
88 ssize_t bytes;
89 int sk, lsk;
90
91 lsk = test_listen_socket(this_ip_addr, port, backlog);
92 if (test_add_key(lsk, DEFAULT_TEST_PASSWORD, this_ip_dest, -1, 100, 100))
93 test_error("setsockopt(TCP_AO_ADD_KEY)");
94 if (test_get_tcp_ao_counters(lsk, &cnt1))
95 test_error("test_get_tcp_ao_counters()");
96
97 synchronize_threads(); /* 1: MKT added */
98 if (test_wait_fd(lsk, TEST_TIMEOUT_SEC, 0))
99 test_error("test_wait_fd()");
100
101 sk = accept(lsk, NULL, NULL);
102 if (sk < 0)
103 test_error("accept()");
104
105 synchronize_threads(); /* 2: connection accept()ed, another queued */
106 if (test_get_tcp_ao_counters(lsk, &cnt2))
107 test_error("test_get_tcp_ao_counters()");
108
109 synchronize_threads(); /* 3: close listen socket */
110 close(lsk);
111 bytes = test_server_run(sk, quota, 0);
112 if (bytes != quota)
113 test_error("servered only %zd bytes", bytes);
114 else
115 test_ok("servered %zd bytes", bytes);
116
117 synchronize_threads(); /* 4: finishing up */
118 close_forced(sk);
119
120 synchronize_threads(); /* 5: closed active sk */
121
122 synchronize_threads(); /* 6: counters checks */
123 if (test_tcp_ao_counters_cmp("active RST server", &cnt1, &cnt2, TEST_CNT_GOOD))
124 test_fail("MKT counters (server) have not only good packets");
125 else
126 test_ok("MKT counters are good on server");
127 }
128
test_server_passive_rst(unsigned int port)129 static void test_server_passive_rst(unsigned int port)
130 {
131 struct tcp_ao_counters ao1, ao2;
132 int sk, lsk;
133 ssize_t bytes;
134
135 lsk = test_listen_socket(this_ip_addr, port, 1);
136
137 if (test_add_key(lsk, DEFAULT_TEST_PASSWORD, this_ip_dest, -1, 100, 100))
138 test_error("setsockopt(TCP_AO_ADD_KEY)");
139
140 synchronize_threads(); /* 1: MKT added => connect() */
141 if (test_wait_fd(lsk, TEST_TIMEOUT_SEC, 0))
142 test_error("test_wait_fd()");
143
144 sk = accept(lsk, NULL, NULL);
145 if (sk < 0)
146 test_error("accept()");
147
148 synchronize_threads(); /* 2: accepted => send data */
149 close(lsk);
150 if (test_get_tcp_ao_counters(sk, &ao1))
151 test_error("test_get_tcp_ao_counters()");
152
153 bytes = test_server_run(sk, quota, TEST_TIMEOUT_SEC);
154 if (bytes != quota) {
155 if (bytes > 0)
156 test_fail("server served: %zd", bytes);
157 else
158 test_fail("server returned %zd", bytes);
159 }
160
161 synchronize_threads(); /* 3: checkpoint the client */
162 synchronize_threads(); /* 4: close the server, creating twsk */
163 if (test_get_tcp_ao_counters(sk, &ao2))
164 test_error("test_get_tcp_ao_counters()");
165 close(sk);
166
167 synchronize_threads(); /* 5: restore the socket, send more data */
168 test_tcp_ao_counters_cmp("passive RST server", &ao1, &ao2, TEST_CNT_GOOD);
169
170 synchronize_threads(); /* 6: server exits */
171 }
172
server_fn(void * arg)173 static void *server_fn(void *arg)
174 {
175 struct netstat *ns_before, *ns_after;
176 unsigned int port = test_server_port;
177
178 ns_before = netstat_read();
179
180 test_server_active_rst(port++);
181 test_server_passive_rst(port++);
182
183 ns_after = netstat_read();
184 netstats_check(ns_before, ns_after, "server");
185 netstat_free(ns_after);
186 netstat_free(ns_before);
187 synchronize_threads(); /* exit */
188
189 synchronize_threads(); /* don't race to exit() - client exits */
190 return NULL;
191 }
192
test_wait_fds(int sk[],size_t nr,bool is_writable[],ssize_t wait_for,time_t sec)193 static int test_wait_fds(int sk[], size_t nr, bool is_writable[],
194 ssize_t wait_for, time_t sec)
195 {
196 struct timeval tv = { .tv_sec = sec };
197 struct timeval *ptv = NULL;
198 fd_set left;
199 size_t i;
200 int ret;
201
202 FD_ZERO(&left);
203 for (i = 0; i < nr; i++) {
204 FD_SET(sk[i], &left);
205 if (is_writable)
206 is_writable[i] = false;
207 }
208
209 if (sec)
210 ptv = &tv;
211
212 do {
213 bool is_empty = true;
214 fd_set fds, efds;
215 int nfd = 0;
216
217 FD_ZERO(&fds);
218 FD_ZERO(&efds);
219 for (i = 0; i < nr; i++) {
220 if (!FD_ISSET(sk[i], &left))
221 continue;
222
223 if (sk[i] > nfd)
224 nfd = sk[i];
225
226 FD_SET(sk[i], &fds);
227 FD_SET(sk[i], &efds);
228 is_empty = false;
229 }
230 if (is_empty)
231 return -ENOENT;
232
233 errno = 0;
234 ret = select(nfd + 1, NULL, &fds, &efds, ptv);
235 if (ret < 0)
236 return -errno;
237 if (!ret)
238 return -ETIMEDOUT;
239 for (i = 0; i < nr; i++) {
240 if (FD_ISSET(sk[i], &fds)) {
241 if (is_writable)
242 is_writable[i] = true;
243 FD_CLR(sk[i], &left);
244 wait_for--;
245 continue;
246 }
247 if (FD_ISSET(sk[i], &efds)) {
248 FD_CLR(sk[i], &left);
249 wait_for--;
250 }
251 }
252 } while (wait_for > 0);
253
254 return 0;
255 }
256
test_client_active_rst(unsigned int port)257 static void test_client_active_rst(unsigned int port)
258 {
259 int i, sk[3], err;
260 bool is_writable[ARRAY_SIZE(sk)] = {false};
261 unsigned int last = ARRAY_SIZE(sk) - 1;
262
263 for (i = 0; i < ARRAY_SIZE(sk); i++) {
264 sk[i] = socket(test_family, SOCK_STREAM, IPPROTO_TCP);
265 if (sk[i] < 0)
266 test_error("socket()");
267 if (test_add_key(sk[i], DEFAULT_TEST_PASSWORD,
268 this_ip_dest, -1, 100, 100))
269 test_error("setsockopt(TCP_AO_ADD_KEY)");
270 }
271
272 synchronize_threads(); /* 1: MKT added */
273 for (i = 0; i < last; i++) {
274 err = _test_connect_socket(sk[i], this_ip_dest, port,
275 (i == 0) ? TEST_TIMEOUT_SEC : -1);
276 if (err < 0)
277 test_error("failed to connect()");
278 }
279
280 synchronize_threads(); /* 2: two connections: one accept()ed, another queued */
281 err = test_wait_fds(sk, last, is_writable, last, TEST_TIMEOUT_SEC);
282 if (err < 0)
283 test_error("test_wait_fds(): %d", err);
284
285 /* async connect() with third sk to get into request_sock_queue */
286 err = _test_connect_socket(sk[last], this_ip_dest, port, -1);
287 if (err < 0)
288 test_error("failed to connect()");
289
290 synchronize_threads(); /* 3: close listen socket */
291 if (test_client_verify(sk[0], packet_sz, quota / packet_sz, TEST_TIMEOUT_SEC))
292 test_fail("Failed to send data on connected socket");
293 else
294 test_ok("Verified established tcp connection");
295
296 synchronize_threads(); /* 4: finishing up */
297
298 synchronize_threads(); /* 5: closed active sk */
299 /*
300 * Wait for 2 connections: one accepted, another in the accept queue,
301 * the one in request_sock_queue won't get fully established, so
302 * doesn't receive an active RST, see inet_csk_listen_stop().
303 */
304 err = test_wait_fds(sk, last, NULL, last, TEST_TIMEOUT_SEC);
305 if (err < 0)
306 test_error("select(): %d", err);
307
308 for (i = 0; i < ARRAY_SIZE(sk); i++) {
309 socklen_t slen = sizeof(err);
310
311 if (getsockopt(sk[i], SOL_SOCKET, SO_ERROR, &err, &slen))
312 test_error("getsockopt()");
313 if (is_writable[i] && err != ECONNRESET) {
314 test_fail("sk[%d] = %d, err = %d, connection wasn't reset",
315 i, sk[i], err);
316 } else {
317 test_ok("sk[%d] = %d%s", i, sk[i],
318 is_writable[i] ? ", connection was reset" : "");
319 }
320 }
321 synchronize_threads(); /* 6: counters checks */
322 }
323
test_client_passive_rst(unsigned int port)324 static void test_client_passive_rst(unsigned int port)
325 {
326 struct tcp_ao_counters ao1, ao2;
327 struct tcp_ao_repair ao_img;
328 struct tcp_sock_state img;
329 sockaddr_af saddr;
330 int sk, err;
331
332 sk = socket(test_family, SOCK_STREAM, IPPROTO_TCP);
333 if (sk < 0)
334 test_error("socket()");
335
336 if (test_add_key(sk, DEFAULT_TEST_PASSWORD, this_ip_dest, -1, 100, 100))
337 test_error("setsockopt(TCP_AO_ADD_KEY)");
338
339 synchronize_threads(); /* 1: MKT added => connect() */
340 if (test_connect_socket(sk, this_ip_dest, port) <= 0)
341 test_error("failed to connect()");
342
343 synchronize_threads(); /* 2: accepted => send data */
344 if (test_client_verify(sk, packet_sz, quota / packet_sz, TEST_TIMEOUT_SEC))
345 test_fail("Failed to send data on connected socket");
346 else
347 test_ok("Verified established tcp connection");
348
349 synchronize_threads(); /* 3: checkpoint the client */
350 test_enable_repair(sk);
351 test_sock_checkpoint(sk, &img, &saddr);
352 test_ao_checkpoint(sk, &ao_img);
353 test_disable_repair(sk);
354
355 synchronize_threads(); /* 4: close the server, creating twsk */
356
357 /*
358 * The "corruption" in SEQ has to be small enough to fit into TCP
359 * window, see tcp_timewait_state_process() for out-of-window
360 * segments.
361 */
362 img.out.seq += 5; /* 5 is more noticeable in tcpdump than 1 */
363
364 /*
365 * FIXME: This is kind-of ugly and dirty, but it works.
366 *
367 * At this moment, the server has close'ed(sk).
368 * The passive RST that is being targeted here is new data after
369 * half-duplex close, see tcp_timewait_state_process() => TCP_TW_RST
370 *
371 * What is needed here is:
372 * (1) wait for FIN from the server
373 * (2) make sure that the ACK from the client went out
374 * (3) make sure that the ACK was received and processed by the server
375 *
376 * Otherwise, the data that will be sent from "repaired" socket
377 * post SEQ corruption may get to the server before it's in
378 * TCP_FIN_WAIT2.
379 *
380 * (1) is easy with select()/poll()
381 * (2) is possible by polling tcpi_state from TCP_INFO
382 * (3) is quite complex: as server's socket was already closed,
383 * probably the way to do it would be tcp-diag.
384 */
385 sleep(TEST_RETRANSMIT_SEC);
386
387 synchronize_threads(); /* 5: restore the socket, send more data */
388 test_kill_sk(sk);
389
390 sk = socket(test_family, SOCK_STREAM, IPPROTO_TCP);
391 if (sk < 0)
392 test_error("socket()");
393
394 test_enable_repair(sk);
395 test_sock_restore(sk, &img, &saddr, this_ip_dest, port);
396 if (test_add_repaired_key(sk, DEFAULT_TEST_PASSWORD, 0, this_ip_dest, -1, 100, 100))
397 test_error("setsockopt(TCP_AO_ADD_KEY)");
398 test_ao_restore(sk, &ao_img);
399
400 if (test_get_tcp_ao_counters(sk, &ao1))
401 test_error("test_get_tcp_ao_counters()");
402
403 test_disable_repair(sk);
404 test_sock_state_free(&img);
405
406 /*
407 * This is how "passive reset" is acquired in this test from TCP_TW_RST:
408 *
409 * IP 10.0.254.1.7011 > 10.0.1.1.59772: Flags [P.], seq 901:1001, ack 1001, win 249,
410 * options [tcp-ao keyid 100 rnextkeyid 100 mac 0x10217d6c36a22379086ef3b1], length 100
411 * IP 10.0.254.1.7011 > 10.0.1.1.59772: Flags [F.], seq 1001, ack 1001, win 249,
412 * options [tcp-ao keyid 100 rnextkeyid 100 mac 0x104ffc99b98c10a5298cc268], length 0
413 * IP 10.0.1.1.59772 > 10.0.254.1.7011: Flags [.], ack 1002, win 251,
414 * options [tcp-ao keyid 100 rnextkeyid 100 mac 0xe496dd4f7f5a8a66873c6f93,nop,nop,sack 1 {1001:1002}], length 0
415 * IP 10.0.1.1.59772 > 10.0.254.1.7011: Flags [P.], seq 1006:1106, ack 1001, win 251,
416 * options [tcp-ao keyid 100 rnextkeyid 100 mac 0x1b5f3330fb23fbcd0c77d0ca], length 100
417 * IP 10.0.254.1.7011 > 10.0.1.1.59772: Flags [R], seq 3215596252, win 0,
418 * options [tcp-ao keyid 100 rnextkeyid 100 mac 0x0bcfbbf497bce844312304b2], length 0
419 */
420 err = test_client_verify(sk, packet_sz, quota / packet_sz, 2 * TEST_TIMEOUT_SEC);
421 /* Make sure that the connection was reset, not timeouted */
422 if (err && err == -ECONNRESET)
423 test_ok("client sock was passively reset post-seq-adjust");
424 else if (err)
425 test_fail("client sock was not reset post-seq-adjust: %d", err);
426 else
427 test_fail("client sock is yet connected post-seq-adjust");
428
429 if (test_get_tcp_ao_counters(sk, &ao2))
430 test_error("test_get_tcp_ao_counters()");
431
432 synchronize_threads(); /* 6: server exits */
433 close(sk);
434 test_tcp_ao_counters_cmp("client passive RST", &ao1, &ao2, TEST_CNT_GOOD);
435 }
436
client_fn(void * arg)437 static void *client_fn(void *arg)
438 {
439 struct netstat *ns_before, *ns_after;
440 unsigned int port = test_server_port;
441
442 ns_before = netstat_read();
443
444 test_client_active_rst(port++);
445 test_client_passive_rst(port++);
446
447 ns_after = netstat_read();
448 netstats_check(ns_before, ns_after, "client");
449 netstat_free(ns_after);
450 netstat_free(ns_before);
451
452 synchronize_threads(); /* exit */
453 return NULL;
454 }
455
main(int argc,char * argv[])456 int main(int argc, char *argv[])
457 {
458 test_init(15, server_fn, client_fn);
459 return 0;
460 }
461