1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * The test checks that both active and passive reset have correct TCP-AO 4 * signature. An "active" reset (abort) here is procured from closing 5 * listen() socket with non-accepted connections in the queue: 6 * inet_csk_listen_stop() => inet_child_forget() => 7 * => tcp_disconnect() => tcp_send_active_reset() 8 * 9 * The passive reset is quite hard to get on established TCP connections. 10 * It could be procured from non-established states, but the synchronization 11 * part from userspace in order to reliably get RST seems uneasy. 12 * So, instead it's procured by corrupting SEQ number on TIMED-WAIT state. 13 * 14 * It's important to test both passive and active RST as they go through 15 * different code-paths: 16 * - tcp_send_active_reset() makes no-data skb, sends it with tcp_transmit_skb() 17 * - tcp_v*_send_reset() create their reply skbs and send them with 18 * ip_send_unicast_reply() 19 * 20 * In both cases TCP-AO signatures have to be correct, which is verified by 21 * (1) checking that the TCP-AO connection was reset and (2) TCP-AO counters. 22 * 23 * Author: Dmitry Safonov <dima@arista.com> 24 */ 25 #include <inttypes.h> 26 #include "../../../../include/linux/kernel.h" 27 #include "aolib.h" 28 29 const size_t quota = 1000; 30 const size_t packet_sz = 100; 31 /* 32 * Backlog == 0 means 1 connection in queue, see: 33 * commit 64a146513f8f ("[NET]: Revert incorrect accept queue...") 34 */ 35 const unsigned int backlog; 36 37 static void netstats_check(struct netstat *before, struct netstat *after, 38 char *msg) 39 { 40 uint64_t before_cnt, after_cnt; 41 42 before_cnt = netstat_get(before, "TCPAORequired", NULL); 43 after_cnt = netstat_get(after, "TCPAORequired", NULL); 44 if (after_cnt > before_cnt) 45 test_fail("Segments without AO sign (%s): %" PRIu64 " => %" PRIu64, 46 msg, before_cnt, after_cnt); 47 else 48 test_ok("No segments without AO sign (%s)", msg); 49 50 before_cnt = netstat_get(before, "TCPAOGood", NULL); 51 after_cnt = netstat_get(after, "TCPAOGood", NULL); 52 if (after_cnt <= before_cnt) 53 test_fail("Signed AO segments (%s): %" PRIu64 " => %" PRIu64, 54 msg, before_cnt, after_cnt); 55 else 56 test_ok("Signed AO segments (%s): %" PRIu64 " => %" PRIu64, 57 msg, before_cnt, after_cnt); 58 59 before_cnt = netstat_get(before, "TCPAOBad", NULL); 60 after_cnt = netstat_get(after, "TCPAOBad", NULL); 61 if (after_cnt > before_cnt) 62 test_fail("Segments with bad AO sign (%s): %" PRIu64 " => %" PRIu64, 63 msg, before_cnt, after_cnt); 64 else 65 test_ok("No segments with bad AO sign (%s)", msg); 66 } 67 68 /* 69 * Another way to send RST, but not through tcp_v{4,6}_send_reset() 70 * is tcp_send_active_reset(), that is not in reply to inbound segment, 71 * but rather active send. It uses tcp_transmit_skb(), so that should 72 * work, but as it also sends RST - nice that it can be covered as well. 73 */ 74 static void close_forced(int sk) 75 { 76 struct linger sl; 77 78 sl.l_onoff = 1; 79 sl.l_linger = 0; 80 if (setsockopt(sk, SOL_SOCKET, SO_LINGER, &sl, sizeof(sl))) 81 test_error("setsockopt(SO_LINGER)"); 82 close(sk); 83 } 84 85 static void test_server_active_rst(unsigned int port) 86 { 87 struct tcp_ao_counters cnt1, cnt2; 88 ssize_t bytes; 89 int sk, lsk; 90 91 lsk = test_listen_socket(this_ip_addr, port, backlog); 92 if (test_add_key(lsk, DEFAULT_TEST_PASSWORD, this_ip_dest, -1, 100, 100)) 93 test_error("setsockopt(TCP_AO_ADD_KEY)"); 94 if (test_get_tcp_ao_counters(lsk, &cnt1)) 95 test_error("test_get_tcp_ao_counters()"); 96 97 synchronize_threads(); /* 1: MKT added */ 98 if (test_wait_fd(lsk, TEST_TIMEOUT_SEC, 0)) 99 test_error("test_wait_fd()"); 100 101 sk = accept(lsk, NULL, NULL); 102 if (sk < 0) 103 test_error("accept()"); 104 105 synchronize_threads(); /* 2: connection accept()ed, another queued */ 106 if (test_get_tcp_ao_counters(lsk, &cnt2)) 107 test_error("test_get_tcp_ao_counters()"); 108 109 synchronize_threads(); /* 3: close listen socket */ 110 close(lsk); 111 bytes = test_server_run(sk, quota, 0); 112 if (bytes != quota) 113 test_error("servered only %zd bytes", bytes); 114 else 115 test_ok("servered %zd bytes", bytes); 116 117 synchronize_threads(); /* 4: finishing up */ 118 close_forced(sk); 119 120 synchronize_threads(); /* 5: closed active sk */ 121 122 synchronize_threads(); /* 6: counters checks */ 123 if (test_tcp_ao_counters_cmp("active RST server", &cnt1, &cnt2, TEST_CNT_GOOD)) 124 test_fail("MKT counters (server) have not only good packets"); 125 else 126 test_ok("MKT counters are good on server"); 127 } 128 129 static void test_server_passive_rst(unsigned int port) 130 { 131 struct tcp_ao_counters ao1, ao2; 132 int sk, lsk; 133 ssize_t bytes; 134 135 lsk = test_listen_socket(this_ip_addr, port, 1); 136 137 if (test_add_key(lsk, DEFAULT_TEST_PASSWORD, this_ip_dest, -1, 100, 100)) 138 test_error("setsockopt(TCP_AO_ADD_KEY)"); 139 140 synchronize_threads(); /* 1: MKT added => connect() */ 141 if (test_wait_fd(lsk, TEST_TIMEOUT_SEC, 0)) 142 test_error("test_wait_fd()"); 143 144 sk = accept(lsk, NULL, NULL); 145 if (sk < 0) 146 test_error("accept()"); 147 148 synchronize_threads(); /* 2: accepted => send data */ 149 close(lsk); 150 if (test_get_tcp_ao_counters(sk, &ao1)) 151 test_error("test_get_tcp_ao_counters()"); 152 153 bytes = test_server_run(sk, quota, TEST_TIMEOUT_SEC); 154 if (bytes != quota) { 155 if (bytes > 0) 156 test_fail("server served: %zd", bytes); 157 else 158 test_fail("server returned %zd", bytes); 159 } 160 161 synchronize_threads(); /* 3: checkpoint the client */ 162 synchronize_threads(); /* 4: close the server, creating twsk */ 163 if (test_get_tcp_ao_counters(sk, &ao2)) 164 test_error("test_get_tcp_ao_counters()"); 165 close(sk); 166 167 synchronize_threads(); /* 5: restore the socket, send more data */ 168 test_tcp_ao_counters_cmp("passive RST server", &ao1, &ao2, TEST_CNT_GOOD); 169 170 synchronize_threads(); /* 6: server exits */ 171 } 172 173 static void *server_fn(void *arg) 174 { 175 struct netstat *ns_before, *ns_after; 176 unsigned int port = test_server_port; 177 178 ns_before = netstat_read(); 179 180 test_server_active_rst(port++); 181 test_server_passive_rst(port++); 182 183 ns_after = netstat_read(); 184 netstats_check(ns_before, ns_after, "server"); 185 netstat_free(ns_after); 186 netstat_free(ns_before); 187 synchronize_threads(); /* exit */ 188 189 synchronize_threads(); /* don't race to exit() - client exits */ 190 return NULL; 191 } 192 193 static int test_wait_fds(int sk[], size_t nr, bool is_writable[], 194 ssize_t wait_for, time_t sec) 195 { 196 struct timeval tv = { .tv_sec = sec }; 197 struct timeval *ptv = NULL; 198 fd_set left; 199 size_t i; 200 int ret; 201 202 FD_ZERO(&left); 203 for (i = 0; i < nr; i++) { 204 FD_SET(sk[i], &left); 205 if (is_writable) 206 is_writable[i] = false; 207 } 208 209 if (sec) 210 ptv = &tv; 211 212 do { 213 bool is_empty = true; 214 fd_set fds, efds; 215 int nfd = 0; 216 217 FD_ZERO(&fds); 218 FD_ZERO(&efds); 219 for (i = 0; i < nr; i++) { 220 if (!FD_ISSET(sk[i], &left)) 221 continue; 222 223 if (sk[i] > nfd) 224 nfd = sk[i]; 225 226 FD_SET(sk[i], &fds); 227 FD_SET(sk[i], &efds); 228 is_empty = false; 229 } 230 if (is_empty) 231 return -ENOENT; 232 233 errno = 0; 234 ret = select(nfd + 1, NULL, &fds, &efds, ptv); 235 if (ret < 0) 236 return -errno; 237 if (!ret) 238 return -ETIMEDOUT; 239 for (i = 0; i < nr; i++) { 240 if (FD_ISSET(sk[i], &fds)) { 241 if (is_writable) 242 is_writable[i] = true; 243 FD_CLR(sk[i], &left); 244 wait_for--; 245 continue; 246 } 247 if (FD_ISSET(sk[i], &efds)) { 248 FD_CLR(sk[i], &left); 249 wait_for--; 250 } 251 } 252 } while (wait_for > 0); 253 254 return 0; 255 } 256 257 static void test_client_active_rst(unsigned int port) 258 { 259 int i, sk[3], err; 260 bool is_writable[ARRAY_SIZE(sk)] = {false}; 261 unsigned int last = ARRAY_SIZE(sk) - 1; 262 263 for (i = 0; i < ARRAY_SIZE(sk); i++) { 264 sk[i] = socket(test_family, SOCK_STREAM, IPPROTO_TCP); 265 if (sk[i] < 0) 266 test_error("socket()"); 267 if (test_add_key(sk[i], DEFAULT_TEST_PASSWORD, 268 this_ip_dest, -1, 100, 100)) 269 test_error("setsockopt(TCP_AO_ADD_KEY)"); 270 } 271 272 synchronize_threads(); /* 1: MKT added */ 273 for (i = 0; i < last; i++) { 274 err = _test_connect_socket(sk[i], this_ip_dest, port, 275 (i == 0) ? TEST_TIMEOUT_SEC : -1); 276 if (err < 0) 277 test_error("failed to connect()"); 278 } 279 280 synchronize_threads(); /* 2: two connections: one accept()ed, another queued */ 281 err = test_wait_fds(sk, last, is_writable, last, TEST_TIMEOUT_SEC); 282 if (err < 0) 283 test_error("test_wait_fds(): %d", err); 284 285 /* async connect() with third sk to get into request_sock_queue */ 286 err = _test_connect_socket(sk[last], this_ip_dest, port, -1); 287 if (err < 0) 288 test_error("failed to connect()"); 289 290 synchronize_threads(); /* 3: close listen socket */ 291 if (test_client_verify(sk[0], packet_sz, quota / packet_sz, TEST_TIMEOUT_SEC)) 292 test_fail("Failed to send data on connected socket"); 293 else 294 test_ok("Verified established tcp connection"); 295 296 synchronize_threads(); /* 4: finishing up */ 297 298 synchronize_threads(); /* 5: closed active sk */ 299 /* 300 * Wait for 2 connections: one accepted, another in the accept queue, 301 * the one in request_sock_queue won't get fully established, so 302 * doesn't receive an active RST, see inet_csk_listen_stop(). 303 */ 304 err = test_wait_fds(sk, last, NULL, last, TEST_TIMEOUT_SEC); 305 if (err < 0) 306 test_error("select(): %d", err); 307 308 for (i = 0; i < ARRAY_SIZE(sk); i++) { 309 socklen_t slen = sizeof(err); 310 311 if (getsockopt(sk[i], SOL_SOCKET, SO_ERROR, &err, &slen)) 312 test_error("getsockopt()"); 313 if (is_writable[i] && err != ECONNRESET) { 314 test_fail("sk[%d] = %d, err = %d, connection wasn't reset", 315 i, sk[i], err); 316 } else { 317 test_ok("sk[%d] = %d%s", i, sk[i], 318 is_writable[i] ? ", connection was reset" : ""); 319 } 320 } 321 synchronize_threads(); /* 6: counters checks */ 322 } 323 324 static void test_client_passive_rst(unsigned int port) 325 { 326 struct tcp_ao_counters ao1, ao2; 327 struct tcp_ao_repair ao_img; 328 struct tcp_sock_state img; 329 sockaddr_af saddr; 330 int sk, err; 331 332 sk = socket(test_family, SOCK_STREAM, IPPROTO_TCP); 333 if (sk < 0) 334 test_error("socket()"); 335 336 if (test_add_key(sk, DEFAULT_TEST_PASSWORD, this_ip_dest, -1, 100, 100)) 337 test_error("setsockopt(TCP_AO_ADD_KEY)"); 338 339 synchronize_threads(); /* 1: MKT added => connect() */ 340 if (test_connect_socket(sk, this_ip_dest, port) <= 0) 341 test_error("failed to connect()"); 342 343 synchronize_threads(); /* 2: accepted => send data */ 344 if (test_client_verify(sk, packet_sz, quota / packet_sz, TEST_TIMEOUT_SEC)) 345 test_fail("Failed to send data on connected socket"); 346 else 347 test_ok("Verified established tcp connection"); 348 349 synchronize_threads(); /* 3: checkpoint the client */ 350 test_enable_repair(sk); 351 test_sock_checkpoint(sk, &img, &saddr); 352 test_ao_checkpoint(sk, &ao_img); 353 test_disable_repair(sk); 354 355 synchronize_threads(); /* 4: close the server, creating twsk */ 356 357 /* 358 * The "corruption" in SEQ has to be small enough to fit into TCP 359 * window, see tcp_timewait_state_process() for out-of-window 360 * segments. 361 */ 362 img.out.seq += 5; /* 5 is more noticeable in tcpdump than 1 */ 363 364 /* 365 * FIXME: This is kind-of ugly and dirty, but it works. 366 * 367 * At this moment, the server has close'ed(sk). 368 * The passive RST that is being targeted here is new data after 369 * half-duplex close, see tcp_timewait_state_process() => TCP_TW_RST 370 * 371 * What is needed here is: 372 * (1) wait for FIN from the server 373 * (2) make sure that the ACK from the client went out 374 * (3) make sure that the ACK was received and processed by the server 375 * 376 * Otherwise, the data that will be sent from "repaired" socket 377 * post SEQ corruption may get to the server before it's in 378 * TCP_FIN_WAIT2. 379 * 380 * (1) is easy with select()/poll() 381 * (2) is possible by polling tcpi_state from TCP_INFO 382 * (3) is quite complex: as server's socket was already closed, 383 * probably the way to do it would be tcp-diag. 384 */ 385 sleep(TEST_RETRANSMIT_SEC); 386 387 synchronize_threads(); /* 5: restore the socket, send more data */ 388 test_kill_sk(sk); 389 390 sk = socket(test_family, SOCK_STREAM, IPPROTO_TCP); 391 if (sk < 0) 392 test_error("socket()"); 393 394 test_enable_repair(sk); 395 test_sock_restore(sk, &img, &saddr, this_ip_dest, port); 396 if (test_add_repaired_key(sk, DEFAULT_TEST_PASSWORD, 0, this_ip_dest, -1, 100, 100)) 397 test_error("setsockopt(TCP_AO_ADD_KEY)"); 398 test_ao_restore(sk, &ao_img); 399 400 if (test_get_tcp_ao_counters(sk, &ao1)) 401 test_error("test_get_tcp_ao_counters()"); 402 403 test_disable_repair(sk); 404 test_sock_state_free(&img); 405 406 /* 407 * This is how "passive reset" is acquired in this test from TCP_TW_RST: 408 * 409 * IP 10.0.254.1.7011 > 10.0.1.1.59772: Flags [P.], seq 901:1001, ack 1001, win 249, 410 * options [tcp-ao keyid 100 rnextkeyid 100 mac 0x10217d6c36a22379086ef3b1], length 100 411 * IP 10.0.254.1.7011 > 10.0.1.1.59772: Flags [F.], seq 1001, ack 1001, win 249, 412 * options [tcp-ao keyid 100 rnextkeyid 100 mac 0x104ffc99b98c10a5298cc268], length 0 413 * IP 10.0.1.1.59772 > 10.0.254.1.7011: Flags [.], ack 1002, win 251, 414 * options [tcp-ao keyid 100 rnextkeyid 100 mac 0xe496dd4f7f5a8a66873c6f93,nop,nop,sack 1 {1001:1002}], length 0 415 * IP 10.0.1.1.59772 > 10.0.254.1.7011: Flags [P.], seq 1006:1106, ack 1001, win 251, 416 * options [tcp-ao keyid 100 rnextkeyid 100 mac 0x1b5f3330fb23fbcd0c77d0ca], length 100 417 * IP 10.0.254.1.7011 > 10.0.1.1.59772: Flags [R], seq 3215596252, win 0, 418 * options [tcp-ao keyid 100 rnextkeyid 100 mac 0x0bcfbbf497bce844312304b2], length 0 419 */ 420 err = test_client_verify(sk, packet_sz, quota / packet_sz, 2 * TEST_TIMEOUT_SEC); 421 /* Make sure that the connection was reset, not timeouted */ 422 if (err && err == -ECONNRESET) 423 test_ok("client sock was passively reset post-seq-adjust"); 424 else if (err) 425 test_fail("client sock was not reset post-seq-adjust: %d", err); 426 else 427 test_fail("client sock is yet connected post-seq-adjust"); 428 429 if (test_get_tcp_ao_counters(sk, &ao2)) 430 test_error("test_get_tcp_ao_counters()"); 431 432 synchronize_threads(); /* 6: server exits */ 433 close(sk); 434 test_tcp_ao_counters_cmp("client passive RST", &ao1, &ao2, TEST_CNT_GOOD); 435 } 436 437 static void *client_fn(void *arg) 438 { 439 struct netstat *ns_before, *ns_after; 440 unsigned int port = test_server_port; 441 442 ns_before = netstat_read(); 443 444 test_client_active_rst(port++); 445 test_client_passive_rst(port++); 446 447 ns_after = netstat_read(); 448 netstats_check(ns_before, ns_after, "client"); 449 netstat_free(ns_after); 450 netstat_free(ns_before); 451 452 synchronize_threads(); /* exit */ 453 return NULL; 454 } 455 456 int main(int argc, char *argv[]) 457 { 458 test_init(14, server_fn, client_fn); 459 return 0; 460 } 461