1 // SPDX-License-Identifier: GPL-2.0 2 3 #define _GNU_SOURCE 4 5 #include <arpa/inet.h> 6 #include <errno.h> 7 #include <error.h> 8 #include <fcntl.h> 9 #include <poll.h> 10 #include <stdio.h> 11 #include <stdlib.h> 12 #include <unistd.h> 13 14 #include <linux/tls.h> 15 #include <linux/tcp.h> 16 #include <linux/socket.h> 17 18 #include <sys/epoll.h> 19 #include <sys/types.h> 20 #include <sys/sendfile.h> 21 #include <sys/socket.h> 22 #include <sys/stat.h> 23 24 #include "kselftest_harness.h" 25 26 #define TLS_PAYLOAD_MAX_LEN 16384 27 #define TLS_HDR_LEN 5 28 #define SOL_TLS 282 29 30 static int fips_enabled; 31 32 struct tls_crypto_info_keys { 33 union { 34 struct tls_crypto_info crypto_info; 35 struct tls12_crypto_info_aes_gcm_128 aes128; 36 struct tls12_crypto_info_chacha20_poly1305 chacha20; 37 struct tls12_crypto_info_sm4_gcm sm4gcm; 38 struct tls12_crypto_info_sm4_ccm sm4ccm; 39 struct tls12_crypto_info_aes_ccm_128 aesccm128; 40 struct tls12_crypto_info_aes_gcm_256 aesgcm256; 41 struct tls12_crypto_info_aria_gcm_128 ariagcm128; 42 struct tls12_crypto_info_aria_gcm_256 ariagcm256; 43 }; 44 size_t len; 45 }; 46 47 static void tls_crypto_info_init(uint16_t tls_version, uint16_t cipher_type, 48 struct tls_crypto_info_keys *tls12, 49 char key_generation) 50 { 51 memset(tls12, key_generation, sizeof(*tls12)); 52 memset(tls12, 0, sizeof(struct tls_crypto_info)); 53 54 switch (cipher_type) { 55 case TLS_CIPHER_CHACHA20_POLY1305: 56 tls12->len = sizeof(struct tls12_crypto_info_chacha20_poly1305); 57 tls12->chacha20.info.version = tls_version; 58 tls12->chacha20.info.cipher_type = cipher_type; 59 break; 60 case TLS_CIPHER_AES_GCM_128: 61 tls12->len = sizeof(struct tls12_crypto_info_aes_gcm_128); 62 tls12->aes128.info.version = tls_version; 63 tls12->aes128.info.cipher_type = cipher_type; 64 break; 65 case TLS_CIPHER_SM4_GCM: 66 tls12->len = sizeof(struct tls12_crypto_info_sm4_gcm); 67 tls12->sm4gcm.info.version = tls_version; 68 tls12->sm4gcm.info.cipher_type = cipher_type; 69 break; 70 case TLS_CIPHER_SM4_CCM: 71 tls12->len = sizeof(struct tls12_crypto_info_sm4_ccm); 72 tls12->sm4ccm.info.version = tls_version; 73 tls12->sm4ccm.info.cipher_type = cipher_type; 74 break; 75 case TLS_CIPHER_AES_CCM_128: 76 tls12->len = sizeof(struct tls12_crypto_info_aes_ccm_128); 77 tls12->aesccm128.info.version = tls_version; 78 tls12->aesccm128.info.cipher_type = cipher_type; 79 break; 80 case TLS_CIPHER_AES_GCM_256: 81 tls12->len = sizeof(struct tls12_crypto_info_aes_gcm_256); 82 tls12->aesgcm256.info.version = tls_version; 83 tls12->aesgcm256.info.cipher_type = cipher_type; 84 break; 85 case TLS_CIPHER_ARIA_GCM_128: 86 tls12->len = sizeof(struct tls12_crypto_info_aria_gcm_128); 87 tls12->ariagcm128.info.version = tls_version; 88 tls12->ariagcm128.info.cipher_type = cipher_type; 89 break; 90 case TLS_CIPHER_ARIA_GCM_256: 91 tls12->len = sizeof(struct tls12_crypto_info_aria_gcm_256); 92 tls12->ariagcm256.info.version = tls_version; 93 tls12->ariagcm256.info.cipher_type = cipher_type; 94 break; 95 default: 96 break; 97 } 98 } 99 100 static void memrnd(void *s, size_t n) 101 { 102 int *dword = s; 103 char *byte; 104 105 for (; n >= 4; n -= 4) 106 *dword++ = rand(); 107 byte = (void *)dword; 108 while (n--) 109 *byte++ = rand(); 110 } 111 112 static void ulp_sock_pair(struct __test_metadata *_metadata, 113 int *fd, int *cfd, bool *notls) 114 { 115 struct sockaddr_in addr; 116 socklen_t len; 117 int sfd, ret; 118 119 *notls = false; 120 len = sizeof(addr); 121 122 addr.sin_family = AF_INET; 123 addr.sin_addr.s_addr = htonl(INADDR_ANY); 124 addr.sin_port = 0; 125 126 *fd = socket(AF_INET, SOCK_STREAM, 0); 127 sfd = socket(AF_INET, SOCK_STREAM, 0); 128 129 ret = bind(sfd, &addr, sizeof(addr)); 130 ASSERT_EQ(ret, 0); 131 ret = listen(sfd, 10); 132 ASSERT_EQ(ret, 0); 133 134 ret = getsockname(sfd, &addr, &len); 135 ASSERT_EQ(ret, 0); 136 137 ret = connect(*fd, &addr, sizeof(addr)); 138 ASSERT_EQ(ret, 0); 139 140 *cfd = accept(sfd, &addr, &len); 141 ASSERT_GE(*cfd, 0); 142 143 close(sfd); 144 145 ret = setsockopt(*fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")); 146 if (ret != 0) { 147 ASSERT_EQ(errno, ENOENT); 148 *notls = true; 149 printf("Failure setting TCP_ULP, testing without tls\n"); 150 return; 151 } 152 153 ret = setsockopt(*cfd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")); 154 ASSERT_EQ(ret, 0); 155 } 156 157 /* Produce a basic cmsg */ 158 static int tls_send_cmsg(int fd, unsigned char record_type, 159 void *data, size_t len, int flags) 160 { 161 char cbuf[CMSG_SPACE(sizeof(char))]; 162 int cmsg_len = sizeof(char); 163 struct cmsghdr *cmsg; 164 struct msghdr msg; 165 struct iovec vec; 166 167 vec.iov_base = data; 168 vec.iov_len = len; 169 memset(&msg, 0, sizeof(struct msghdr)); 170 msg.msg_iov = &vec; 171 msg.msg_iovlen = 1; 172 msg.msg_control = cbuf; 173 msg.msg_controllen = sizeof(cbuf); 174 cmsg = CMSG_FIRSTHDR(&msg); 175 cmsg->cmsg_level = SOL_TLS; 176 /* test sending non-record types. */ 177 cmsg->cmsg_type = TLS_SET_RECORD_TYPE; 178 cmsg->cmsg_len = CMSG_LEN(cmsg_len); 179 *CMSG_DATA(cmsg) = record_type; 180 msg.msg_controllen = cmsg->cmsg_len; 181 182 return sendmsg(fd, &msg, flags); 183 } 184 185 static int __tls_recv_cmsg(struct __test_metadata *_metadata, 186 int fd, unsigned char *ctype, 187 void *data, size_t len, int flags) 188 { 189 char cbuf[CMSG_SPACE(sizeof(char))]; 190 struct cmsghdr *cmsg; 191 struct msghdr msg; 192 struct iovec vec; 193 int n; 194 195 vec.iov_base = data; 196 vec.iov_len = len; 197 memset(&msg, 0, sizeof(struct msghdr)); 198 msg.msg_iov = &vec; 199 msg.msg_iovlen = 1; 200 msg.msg_control = cbuf; 201 msg.msg_controllen = sizeof(cbuf); 202 203 n = recvmsg(fd, &msg, flags); 204 205 cmsg = CMSG_FIRSTHDR(&msg); 206 EXPECT_NE(cmsg, NULL); 207 EXPECT_EQ(cmsg->cmsg_level, SOL_TLS); 208 EXPECT_EQ(cmsg->cmsg_type, TLS_GET_RECORD_TYPE); 209 if (ctype) 210 *ctype = *((unsigned char *)CMSG_DATA(cmsg)); 211 212 return n; 213 } 214 215 static int tls_recv_cmsg(struct __test_metadata *_metadata, 216 int fd, unsigned char record_type, 217 void *data, size_t len, int flags) 218 { 219 unsigned char ctype; 220 int n; 221 222 n = __tls_recv_cmsg(_metadata, fd, &ctype, data, len, flags); 223 EXPECT_EQ(ctype, record_type); 224 225 return n; 226 } 227 228 FIXTURE(tls_basic) 229 { 230 int fd, cfd; 231 bool notls; 232 }; 233 234 FIXTURE_SETUP(tls_basic) 235 { 236 ulp_sock_pair(_metadata, &self->fd, &self->cfd, &self->notls); 237 } 238 239 FIXTURE_TEARDOWN(tls_basic) 240 { 241 close(self->fd); 242 close(self->cfd); 243 } 244 245 /* Send some data through with ULP but no keys */ 246 TEST_F(tls_basic, base_base) 247 { 248 char const *test_str = "test_read"; 249 int send_len = 10; 250 char buf[10]; 251 252 ASSERT_EQ(strlen(test_str) + 1, send_len); 253 254 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); 255 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1); 256 EXPECT_EQ(memcmp(buf, test_str, send_len), 0); 257 }; 258 259 TEST_F(tls_basic, bad_cipher) 260 { 261 struct tls_crypto_info_keys tls12; 262 263 tls12.crypto_info.version = 200; 264 tls12.crypto_info.cipher_type = TLS_CIPHER_AES_GCM_128; 265 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, sizeof(struct tls12_crypto_info_aes_gcm_128)), -1); 266 267 tls12.crypto_info.version = TLS_1_2_VERSION; 268 tls12.crypto_info.cipher_type = 50; 269 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, sizeof(struct tls12_crypto_info_aes_gcm_128)), -1); 270 271 tls12.crypto_info.version = TLS_1_2_VERSION; 272 tls12.crypto_info.cipher_type = 59; 273 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, sizeof(struct tls12_crypto_info_aes_gcm_128)), -1); 274 275 tls12.crypto_info.version = TLS_1_2_VERSION; 276 tls12.crypto_info.cipher_type = 10; 277 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, sizeof(struct tls12_crypto_info_aes_gcm_128)), -1); 278 279 tls12.crypto_info.version = TLS_1_2_VERSION; 280 tls12.crypto_info.cipher_type = 70; 281 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, sizeof(struct tls12_crypto_info_aes_gcm_128)), -1); 282 } 283 284 TEST_F(tls_basic, recseq_wrap) 285 { 286 struct tls_crypto_info_keys tls12; 287 char const *test_str = "test_read"; 288 int send_len = 10; 289 290 if (self->notls) 291 SKIP(return, "no TLS support"); 292 293 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_GCM_128, &tls12, 0); 294 memset(&tls12.aes128.rec_seq, 0xff, sizeof(tls12.aes128.rec_seq)); 295 296 ASSERT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0); 297 ASSERT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0); 298 299 EXPECT_EQ(send(self->fd, test_str, send_len, 0), -1); 300 EXPECT_EQ(errno, EBADMSG); 301 } 302 303 FIXTURE(tls) 304 { 305 int fd, cfd; 306 bool notls; 307 }; 308 309 FIXTURE_VARIANT(tls) 310 { 311 uint16_t tls_version; 312 uint16_t cipher_type; 313 bool nopad, fips_non_compliant; 314 }; 315 316 FIXTURE_VARIANT_ADD(tls, 12_aes_gcm) 317 { 318 .tls_version = TLS_1_2_VERSION, 319 .cipher_type = TLS_CIPHER_AES_GCM_128, 320 }; 321 322 FIXTURE_VARIANT_ADD(tls, 13_aes_gcm) 323 { 324 .tls_version = TLS_1_3_VERSION, 325 .cipher_type = TLS_CIPHER_AES_GCM_128, 326 }; 327 328 FIXTURE_VARIANT_ADD(tls, 12_chacha) 329 { 330 .tls_version = TLS_1_2_VERSION, 331 .cipher_type = TLS_CIPHER_CHACHA20_POLY1305, 332 .fips_non_compliant = true, 333 }; 334 335 FIXTURE_VARIANT_ADD(tls, 13_chacha) 336 { 337 .tls_version = TLS_1_3_VERSION, 338 .cipher_type = TLS_CIPHER_CHACHA20_POLY1305, 339 .fips_non_compliant = true, 340 }; 341 342 FIXTURE_VARIANT_ADD(tls, 13_sm4_gcm) 343 { 344 .tls_version = TLS_1_3_VERSION, 345 .cipher_type = TLS_CIPHER_SM4_GCM, 346 .fips_non_compliant = true, 347 }; 348 349 FIXTURE_VARIANT_ADD(tls, 13_sm4_ccm) 350 { 351 .tls_version = TLS_1_3_VERSION, 352 .cipher_type = TLS_CIPHER_SM4_CCM, 353 .fips_non_compliant = true, 354 }; 355 356 FIXTURE_VARIANT_ADD(tls, 12_aes_ccm) 357 { 358 .tls_version = TLS_1_2_VERSION, 359 .cipher_type = TLS_CIPHER_AES_CCM_128, 360 }; 361 362 FIXTURE_VARIANT_ADD(tls, 13_aes_ccm) 363 { 364 .tls_version = TLS_1_3_VERSION, 365 .cipher_type = TLS_CIPHER_AES_CCM_128, 366 }; 367 368 FIXTURE_VARIANT_ADD(tls, 12_aes_gcm_256) 369 { 370 .tls_version = TLS_1_2_VERSION, 371 .cipher_type = TLS_CIPHER_AES_GCM_256, 372 }; 373 374 FIXTURE_VARIANT_ADD(tls, 13_aes_gcm_256) 375 { 376 .tls_version = TLS_1_3_VERSION, 377 .cipher_type = TLS_CIPHER_AES_GCM_256, 378 }; 379 380 FIXTURE_VARIANT_ADD(tls, 13_nopad) 381 { 382 .tls_version = TLS_1_3_VERSION, 383 .cipher_type = TLS_CIPHER_AES_GCM_128, 384 .nopad = true, 385 }; 386 387 FIXTURE_VARIANT_ADD(tls, 12_aria_gcm) 388 { 389 .tls_version = TLS_1_2_VERSION, 390 .cipher_type = TLS_CIPHER_ARIA_GCM_128, 391 }; 392 393 FIXTURE_VARIANT_ADD(tls, 12_aria_gcm_256) 394 { 395 .tls_version = TLS_1_2_VERSION, 396 .cipher_type = TLS_CIPHER_ARIA_GCM_256, 397 }; 398 399 FIXTURE_SETUP(tls) 400 { 401 struct tls_crypto_info_keys tls12; 402 int one = 1; 403 int ret; 404 405 if (fips_enabled && variant->fips_non_compliant) 406 SKIP(return, "Unsupported cipher in FIPS mode"); 407 408 tls_crypto_info_init(variant->tls_version, variant->cipher_type, 409 &tls12, 0); 410 411 ulp_sock_pair(_metadata, &self->fd, &self->cfd, &self->notls); 412 413 if (self->notls) 414 return; 415 416 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len); 417 ASSERT_EQ(ret, 0); 418 419 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len); 420 ASSERT_EQ(ret, 0); 421 422 if (variant->nopad) { 423 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD, 424 (void *)&one, sizeof(one)); 425 ASSERT_EQ(ret, 0); 426 } 427 } 428 429 FIXTURE_TEARDOWN(tls) 430 { 431 close(self->fd); 432 close(self->cfd); 433 } 434 435 TEST_F(tls, sendfile) 436 { 437 int filefd = open("/proc/self/exe", O_RDONLY); 438 struct stat st; 439 440 EXPECT_GE(filefd, 0); 441 fstat(filefd, &st); 442 EXPECT_GE(sendfile(self->fd, filefd, 0, st.st_size), 0); 443 444 close(filefd); 445 } 446 447 TEST_F(tls, send_then_sendfile) 448 { 449 int filefd = open("/proc/self/exe", O_RDONLY); 450 char const *test_str = "test_send"; 451 int to_send = strlen(test_str) + 1; 452 char recv_buf[10]; 453 struct stat st; 454 char *buf; 455 456 EXPECT_GE(filefd, 0); 457 fstat(filefd, &st); 458 buf = (char *)malloc(st.st_size); 459 460 EXPECT_EQ(send(self->fd, test_str, to_send, 0), to_send); 461 EXPECT_EQ(recv(self->cfd, recv_buf, to_send, MSG_WAITALL), to_send); 462 EXPECT_EQ(memcmp(test_str, recv_buf, to_send), 0); 463 464 EXPECT_GE(sendfile(self->fd, filefd, 0, st.st_size), 0); 465 EXPECT_EQ(recv(self->cfd, buf, st.st_size, MSG_WAITALL), st.st_size); 466 467 free(buf); 468 close(filefd); 469 } 470 471 static void chunked_sendfile(struct __test_metadata *_metadata, 472 struct _test_data_tls *self, 473 uint16_t chunk_size, 474 uint16_t extra_payload_size) 475 { 476 char buf[TLS_PAYLOAD_MAX_LEN]; 477 uint16_t test_payload_size; 478 int size = 0; 479 int ret; 480 char filename[] = "/tmp/mytemp.XXXXXX"; 481 int fd = mkstemp(filename); 482 off_t offset = 0; 483 484 unlink(filename); 485 ASSERT_GE(fd, 0); 486 EXPECT_GE(chunk_size, 1); 487 test_payload_size = chunk_size + extra_payload_size; 488 ASSERT_GE(TLS_PAYLOAD_MAX_LEN, test_payload_size); 489 memset(buf, 1, test_payload_size); 490 size = write(fd, buf, test_payload_size); 491 EXPECT_EQ(size, test_payload_size); 492 fsync(fd); 493 494 while (size > 0) { 495 ret = sendfile(self->fd, fd, &offset, chunk_size); 496 EXPECT_GE(ret, 0); 497 size -= ret; 498 } 499 500 EXPECT_EQ(recv(self->cfd, buf, test_payload_size, MSG_WAITALL), 501 test_payload_size); 502 503 close(fd); 504 } 505 506 TEST_F(tls, multi_chunk_sendfile) 507 { 508 chunked_sendfile(_metadata, self, 4096, 4096); 509 chunked_sendfile(_metadata, self, 4096, 0); 510 chunked_sendfile(_metadata, self, 4096, 1); 511 chunked_sendfile(_metadata, self, 4096, 2048); 512 chunked_sendfile(_metadata, self, 8192, 2048); 513 chunked_sendfile(_metadata, self, 4096, 8192); 514 chunked_sendfile(_metadata, self, 8192, 4096); 515 chunked_sendfile(_metadata, self, 12288, 1024); 516 chunked_sendfile(_metadata, self, 12288, 2000); 517 chunked_sendfile(_metadata, self, 15360, 100); 518 chunked_sendfile(_metadata, self, 15360, 300); 519 chunked_sendfile(_metadata, self, 1, 4096); 520 chunked_sendfile(_metadata, self, 2048, 4096); 521 chunked_sendfile(_metadata, self, 2048, 8192); 522 chunked_sendfile(_metadata, self, 4096, 8192); 523 chunked_sendfile(_metadata, self, 1024, 12288); 524 chunked_sendfile(_metadata, self, 2000, 12288); 525 chunked_sendfile(_metadata, self, 100, 15360); 526 chunked_sendfile(_metadata, self, 300, 15360); 527 } 528 529 TEST_F(tls, recv_max) 530 { 531 unsigned int send_len = TLS_PAYLOAD_MAX_LEN; 532 char recv_mem[TLS_PAYLOAD_MAX_LEN]; 533 char buf[TLS_PAYLOAD_MAX_LEN]; 534 535 memrnd(buf, sizeof(buf)); 536 537 EXPECT_GE(send(self->fd, buf, send_len, 0), 0); 538 EXPECT_NE(recv(self->cfd, recv_mem, send_len, 0), -1); 539 EXPECT_EQ(memcmp(buf, recv_mem, send_len), 0); 540 } 541 542 TEST_F(tls, recv_small) 543 { 544 char const *test_str = "test_read"; 545 int send_len = 10; 546 char buf[10]; 547 548 send_len = strlen(test_str) + 1; 549 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); 550 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1); 551 EXPECT_EQ(memcmp(buf, test_str, send_len), 0); 552 } 553 554 TEST_F(tls, msg_more) 555 { 556 char const *test_str = "test_read"; 557 int send_len = 10; 558 char buf[10 * 2]; 559 560 EXPECT_EQ(send(self->fd, test_str, send_len, MSG_MORE), send_len); 561 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_DONTWAIT), -1); 562 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); 563 EXPECT_EQ(recv(self->cfd, buf, send_len * 2, MSG_WAITALL), 564 send_len * 2); 565 EXPECT_EQ(memcmp(buf, test_str, send_len), 0); 566 } 567 568 TEST_F(tls, cmsg_msg_more) 569 { 570 char *test_str = "test_read"; 571 char record_type = 100; 572 int send_len = 10; 573 574 /* we don't allow MSG_MORE with non-DATA records */ 575 EXPECT_EQ(tls_send_cmsg(self->fd, record_type, test_str, send_len, 576 MSG_MORE), -1); 577 EXPECT_EQ(errno, EINVAL); 578 } 579 580 TEST_F(tls, msg_more_then_cmsg) 581 { 582 char *test_str = "test_read"; 583 char record_type = 100; 584 int send_len = 10; 585 char buf[10 * 2]; 586 int ret; 587 588 EXPECT_EQ(send(self->fd, test_str, send_len, MSG_MORE), send_len); 589 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_DONTWAIT), -1); 590 591 ret = tls_send_cmsg(self->fd, record_type, test_str, send_len, 0); 592 EXPECT_EQ(ret, send_len); 593 594 /* initial DATA record didn't get merged with the non-DATA record */ 595 EXPECT_EQ(recv(self->cfd, buf, send_len * 2, 0), send_len); 596 597 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, record_type, 598 buf, sizeof(buf), MSG_WAITALL), 599 send_len); 600 } 601 602 TEST_F(tls, msg_more_unsent) 603 { 604 char const *test_str = "test_read"; 605 int send_len = 10; 606 char buf[10]; 607 608 EXPECT_EQ(send(self->fd, test_str, send_len, MSG_MORE), send_len); 609 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_DONTWAIT), -1); 610 } 611 612 TEST_F(tls, msg_eor) 613 { 614 char const *test_str = "test_read"; 615 int send_len = 10; 616 char buf[10]; 617 618 EXPECT_EQ(send(self->fd, test_str, send_len, MSG_EOR), send_len); 619 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_WAITALL), send_len); 620 EXPECT_EQ(memcmp(buf, test_str, send_len), 0); 621 } 622 623 TEST_F(tls, sendmsg_single) 624 { 625 struct msghdr msg; 626 627 char const *test_str = "test_sendmsg"; 628 size_t send_len = 13; 629 struct iovec vec; 630 char buf[13]; 631 632 vec.iov_base = (char *)test_str; 633 vec.iov_len = send_len; 634 memset(&msg, 0, sizeof(struct msghdr)); 635 msg.msg_iov = &vec; 636 msg.msg_iovlen = 1; 637 EXPECT_EQ(sendmsg(self->fd, &msg, 0), send_len); 638 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_WAITALL), send_len); 639 EXPECT_EQ(memcmp(buf, test_str, send_len), 0); 640 } 641 642 #define MAX_FRAGS 64 643 #define SEND_LEN 13 644 TEST_F(tls, sendmsg_fragmented) 645 { 646 char const *test_str = "test_sendmsg"; 647 char buf[SEND_LEN * MAX_FRAGS]; 648 struct iovec vec[MAX_FRAGS]; 649 struct msghdr msg; 650 int i, frags; 651 652 for (frags = 1; frags <= MAX_FRAGS; frags++) { 653 for (i = 0; i < frags; i++) { 654 vec[i].iov_base = (char *)test_str; 655 vec[i].iov_len = SEND_LEN; 656 } 657 658 memset(&msg, 0, sizeof(struct msghdr)); 659 msg.msg_iov = vec; 660 msg.msg_iovlen = frags; 661 662 EXPECT_EQ(sendmsg(self->fd, &msg, 0), SEND_LEN * frags); 663 EXPECT_EQ(recv(self->cfd, buf, SEND_LEN * frags, MSG_WAITALL), 664 SEND_LEN * frags); 665 666 for (i = 0; i < frags; i++) 667 EXPECT_EQ(memcmp(buf + SEND_LEN * i, 668 test_str, SEND_LEN), 0); 669 } 670 } 671 #undef MAX_FRAGS 672 #undef SEND_LEN 673 674 TEST_F(tls, sendmsg_large) 675 { 676 void *mem = malloc(16384); 677 size_t send_len = 16384; 678 size_t sends = 128; 679 struct msghdr msg; 680 size_t recvs = 0; 681 size_t sent = 0; 682 683 memset(&msg, 0, sizeof(struct msghdr)); 684 while (sent++ < sends) { 685 struct iovec vec = { (void *)mem, send_len }; 686 687 msg.msg_iov = &vec; 688 msg.msg_iovlen = 1; 689 EXPECT_EQ(sendmsg(self->fd, &msg, 0), send_len); 690 } 691 692 while (recvs++ < sends) { 693 EXPECT_NE(recv(self->cfd, mem, send_len, 0), -1); 694 } 695 696 free(mem); 697 } 698 699 TEST_F(tls, sendmsg_multiple) 700 { 701 char const *test_str = "test_sendmsg_multiple"; 702 struct iovec vec[5]; 703 char *test_strs[5]; 704 struct msghdr msg; 705 int total_len = 0; 706 int len_cmp = 0; 707 int iov_len = 5; 708 char *buf; 709 int i; 710 711 memset(&msg, 0, sizeof(struct msghdr)); 712 for (i = 0; i < iov_len; i++) { 713 test_strs[i] = (char *)malloc(strlen(test_str) + 1); 714 snprintf(test_strs[i], strlen(test_str) + 1, "%s", test_str); 715 vec[i].iov_base = (void *)test_strs[i]; 716 vec[i].iov_len = strlen(test_strs[i]) + 1; 717 total_len += vec[i].iov_len; 718 } 719 msg.msg_iov = vec; 720 msg.msg_iovlen = iov_len; 721 722 EXPECT_EQ(sendmsg(self->fd, &msg, 0), total_len); 723 buf = malloc(total_len); 724 EXPECT_NE(recv(self->cfd, buf, total_len, 0), -1); 725 for (i = 0; i < iov_len; i++) { 726 EXPECT_EQ(memcmp(test_strs[i], buf + len_cmp, 727 strlen(test_strs[i])), 728 0); 729 len_cmp += strlen(buf + len_cmp) + 1; 730 } 731 for (i = 0; i < iov_len; i++) 732 free(test_strs[i]); 733 free(buf); 734 } 735 736 TEST_F(tls, sendmsg_multiple_stress) 737 { 738 char const *test_str = "abcdefghijklmno"; 739 struct iovec vec[1024]; 740 char *test_strs[1024]; 741 int iov_len = 1024; 742 int total_len = 0; 743 char buf[1 << 14]; 744 struct msghdr msg; 745 int len_cmp = 0; 746 int i; 747 748 memset(&msg, 0, sizeof(struct msghdr)); 749 for (i = 0; i < iov_len; i++) { 750 test_strs[i] = (char *)malloc(strlen(test_str) + 1); 751 snprintf(test_strs[i], strlen(test_str) + 1, "%s", test_str); 752 vec[i].iov_base = (void *)test_strs[i]; 753 vec[i].iov_len = strlen(test_strs[i]) + 1; 754 total_len += vec[i].iov_len; 755 } 756 msg.msg_iov = vec; 757 msg.msg_iovlen = iov_len; 758 759 EXPECT_EQ(sendmsg(self->fd, &msg, 0), total_len); 760 EXPECT_NE(recv(self->cfd, buf, total_len, 0), -1); 761 762 for (i = 0; i < iov_len; i++) 763 len_cmp += strlen(buf + len_cmp) + 1; 764 765 for (i = 0; i < iov_len; i++) 766 free(test_strs[i]); 767 } 768 769 TEST_F(tls, splice_from_pipe) 770 { 771 int send_len = TLS_PAYLOAD_MAX_LEN; 772 char mem_send[TLS_PAYLOAD_MAX_LEN]; 773 char mem_recv[TLS_PAYLOAD_MAX_LEN]; 774 int p[2]; 775 776 ASSERT_GE(pipe(p), 0); 777 EXPECT_GE(write(p[1], mem_send, send_len), 0); 778 EXPECT_GE(splice(p[0], NULL, self->fd, NULL, send_len, 0), 0); 779 EXPECT_EQ(recv(self->cfd, mem_recv, send_len, MSG_WAITALL), send_len); 780 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0); 781 } 782 783 TEST_F(tls, splice_more) 784 { 785 unsigned int f = SPLICE_F_NONBLOCK | SPLICE_F_MORE | SPLICE_F_GIFT; 786 int send_len = TLS_PAYLOAD_MAX_LEN; 787 char mem_send[TLS_PAYLOAD_MAX_LEN]; 788 int i, send_pipe = 1; 789 int p[2]; 790 791 ASSERT_GE(pipe(p), 0); 792 EXPECT_GE(write(p[1], mem_send, send_len), 0); 793 for (i = 0; i < 32; i++) 794 EXPECT_EQ(splice(p[0], NULL, self->fd, NULL, send_pipe, f), 1); 795 } 796 797 TEST_F(tls, splice_from_pipe2) 798 { 799 int send_len = 16000; 800 char mem_send[16000]; 801 char mem_recv[16000]; 802 int p2[2]; 803 int p[2]; 804 805 memrnd(mem_send, sizeof(mem_send)); 806 807 ASSERT_GE(pipe(p), 0); 808 ASSERT_GE(pipe(p2), 0); 809 EXPECT_EQ(write(p[1], mem_send, 8000), 8000); 810 EXPECT_EQ(splice(p[0], NULL, self->fd, NULL, 8000, 0), 8000); 811 EXPECT_EQ(write(p2[1], mem_send + 8000, 8000), 8000); 812 EXPECT_EQ(splice(p2[0], NULL, self->fd, NULL, 8000, 0), 8000); 813 EXPECT_EQ(recv(self->cfd, mem_recv, send_len, MSG_WAITALL), send_len); 814 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0); 815 } 816 817 TEST_F(tls, send_and_splice) 818 { 819 int send_len = TLS_PAYLOAD_MAX_LEN; 820 char mem_send[TLS_PAYLOAD_MAX_LEN]; 821 char mem_recv[TLS_PAYLOAD_MAX_LEN]; 822 char const *test_str = "test_read"; 823 int send_len2 = 10; 824 char buf[10]; 825 int p[2]; 826 827 ASSERT_GE(pipe(p), 0); 828 EXPECT_EQ(send(self->fd, test_str, send_len2, 0), send_len2); 829 EXPECT_EQ(recv(self->cfd, buf, send_len2, MSG_WAITALL), send_len2); 830 EXPECT_EQ(memcmp(test_str, buf, send_len2), 0); 831 832 EXPECT_GE(write(p[1], mem_send, send_len), send_len); 833 EXPECT_GE(splice(p[0], NULL, self->fd, NULL, send_len, 0), send_len); 834 835 EXPECT_EQ(recv(self->cfd, mem_recv, send_len, MSG_WAITALL), send_len); 836 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0); 837 } 838 839 TEST_F(tls, splice_onto_full_record) 840 { 841 char mem_send[4608]; 842 char mem_recv[4608]; 843 int frag_len = 100; 844 int nfrags, i, off; 845 int p[2]; 846 847 memrnd(mem_send, sizeof(mem_send)); 848 ASSERT_GE(pipe(p), 0); 849 850 for (nfrags = 16; nfrags <= 44; nfrags++) { 851 for (i = 0, off = 0; i < nfrags; i++, off += frag_len) { 852 EXPECT_EQ(write(p[1], mem_send + off, frag_len), frag_len); 853 EXPECT_EQ(splice(p[0], NULL, self->fd, NULL, frag_len, 854 SPLICE_F_MORE), frag_len); 855 } 856 857 EXPECT_EQ(send(self->fd, mem_send + off, 1, MSG_MORE), 1); 858 off++; 859 860 EXPECT_EQ(write(p[1], mem_send + off, frag_len), frag_len); 861 EXPECT_EQ(splice(p[0], NULL, self->fd, NULL, frag_len, 862 SPLICE_F_MORE), frag_len); 863 off += frag_len; 864 865 EXPECT_EQ(send(self->fd, mem_send + off, 1, 0), 1); 866 off++; 867 868 EXPECT_EQ(recv(self->cfd, mem_recv, off, MSG_WAITALL), off); 869 EXPECT_EQ(memcmp(mem_send, mem_recv, off), 0); 870 } 871 872 close(p[0]); 873 close(p[1]); 874 } 875 876 TEST_F(tls, splice_to_pipe) 877 { 878 int send_len = TLS_PAYLOAD_MAX_LEN; 879 char mem_send[TLS_PAYLOAD_MAX_LEN]; 880 char mem_recv[TLS_PAYLOAD_MAX_LEN]; 881 int p[2]; 882 883 memrnd(mem_send, sizeof(mem_send)); 884 885 ASSERT_GE(pipe(p), 0); 886 EXPECT_EQ(send(self->fd, mem_send, send_len, 0), send_len); 887 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, send_len, 0), send_len); 888 EXPECT_EQ(read(p[0], mem_recv, send_len), send_len); 889 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0); 890 } 891 892 TEST_F(tls, splice_cmsg_to_pipe) 893 { 894 char *test_str = "test_read"; 895 char record_type = 100; 896 int send_len = 10; 897 char buf[10]; 898 int p[2]; 899 900 if (self->notls) 901 SKIP(return, "no TLS support"); 902 903 ASSERT_GE(pipe(p), 0); 904 EXPECT_EQ(tls_send_cmsg(self->fd, 100, test_str, send_len, 0), 10); 905 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, send_len, 0), -1); 906 EXPECT_EQ(errno, EINVAL); 907 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), -1); 908 EXPECT_EQ(errno, EIO); 909 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, record_type, 910 buf, sizeof(buf), MSG_WAITALL), 911 send_len); 912 EXPECT_EQ(memcmp(test_str, buf, send_len), 0); 913 } 914 915 TEST_F(tls, splice_dec_cmsg_to_pipe) 916 { 917 char *test_str = "test_read"; 918 char record_type = 100; 919 int send_len = 10; 920 char buf[10]; 921 int p[2]; 922 923 if (self->notls) 924 SKIP(return, "no TLS support"); 925 926 ASSERT_GE(pipe(p), 0); 927 EXPECT_EQ(tls_send_cmsg(self->fd, 100, test_str, send_len, 0), 10); 928 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), -1); 929 EXPECT_EQ(errno, EIO); 930 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, send_len, 0), -1); 931 EXPECT_EQ(errno, EINVAL); 932 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, record_type, 933 buf, sizeof(buf), MSG_WAITALL), 934 send_len); 935 EXPECT_EQ(memcmp(test_str, buf, send_len), 0); 936 } 937 938 TEST_F(tls, recv_and_splice) 939 { 940 int send_len = TLS_PAYLOAD_MAX_LEN; 941 char mem_send[TLS_PAYLOAD_MAX_LEN]; 942 char mem_recv[TLS_PAYLOAD_MAX_LEN]; 943 int half = send_len / 2; 944 int p[2]; 945 946 ASSERT_GE(pipe(p), 0); 947 EXPECT_EQ(send(self->fd, mem_send, send_len, 0), send_len); 948 /* Recv hald of the record, splice the other half */ 949 EXPECT_EQ(recv(self->cfd, mem_recv, half, MSG_WAITALL), half); 950 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, half, SPLICE_F_NONBLOCK), 951 half); 952 EXPECT_EQ(read(p[0], &mem_recv[half], half), half); 953 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0); 954 } 955 956 TEST_F(tls, peek_and_splice) 957 { 958 int send_len = TLS_PAYLOAD_MAX_LEN; 959 char mem_send[TLS_PAYLOAD_MAX_LEN]; 960 char mem_recv[TLS_PAYLOAD_MAX_LEN]; 961 int chunk = TLS_PAYLOAD_MAX_LEN / 4; 962 int n, i, p[2]; 963 964 memrnd(mem_send, sizeof(mem_send)); 965 966 ASSERT_GE(pipe(p), 0); 967 for (i = 0; i < 4; i++) 968 EXPECT_EQ(send(self->fd, &mem_send[chunk * i], chunk, 0), 969 chunk); 970 971 EXPECT_EQ(recv(self->cfd, mem_recv, chunk * 5 / 2, 972 MSG_WAITALL | MSG_PEEK), 973 chunk * 5 / 2); 974 EXPECT_EQ(memcmp(mem_send, mem_recv, chunk * 5 / 2), 0); 975 976 n = 0; 977 while (n < send_len) { 978 i = splice(self->cfd, NULL, p[1], NULL, send_len - n, 0); 979 EXPECT_GT(i, 0); 980 n += i; 981 } 982 EXPECT_EQ(n, send_len); 983 EXPECT_EQ(read(p[0], mem_recv, send_len), send_len); 984 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0); 985 } 986 987 TEST_F(tls, splice_to_pipe_small) 988 { 989 int send_len = TLS_PAYLOAD_MAX_LEN; 990 char mem_send[TLS_PAYLOAD_MAX_LEN]; 991 char mem_recv[TLS_PAYLOAD_MAX_LEN]; 992 size_t total = 0; 993 int p[2]; 994 995 memrnd(mem_send, sizeof(mem_send)); 996 997 ASSERT_GE(pipe(p), 0); 998 999 /* Shrink pipe to 1 page (typically 4096 bytes) to force multiple 1000 * splice iterations for a 16384-byte TLS record. 1001 */ 1002 EXPECT_GE(fcntl(p[1], F_SETPIPE_SZ, 4096), 4096); 1003 1004 EXPECT_EQ(send(self->fd, mem_send, send_len, 0), send_len); 1005 1006 while (total < (size_t)send_len) { 1007 ssize_t spliced, drained; 1008 1009 spliced = splice(self->cfd, NULL, p[1], NULL, 1010 send_len - total, 0); 1011 EXPECT_GT(spliced, 0); 1012 if (spliced <= 0) 1013 break; 1014 1015 drained = read(p[0], mem_recv + total, spliced); 1016 EXPECT_EQ(drained, spliced); 1017 if (drained <= 0) 1018 break; 1019 1020 total += drained; 1021 } 1022 1023 EXPECT_EQ(total, (size_t)send_len); 1024 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0); 1025 1026 close(p[0]); 1027 close(p[1]); 1028 } 1029 1030 #define MAX_FRAGS 48 1031 TEST_F(tls, splice_short) 1032 { 1033 struct iovec sendchar_iov; 1034 char read_buf[0x10000]; 1035 char sendbuf[0x100]; 1036 char sendchar = 'S'; 1037 int pipefds[2]; 1038 int pipe_sz; 1039 int ret; 1040 int i; 1041 1042 sendchar_iov.iov_base = &sendchar; 1043 sendchar_iov.iov_len = 1; 1044 1045 memset(sendbuf, 's', sizeof(sendbuf)); 1046 1047 ASSERT_GE(pipe2(pipefds, O_NONBLOCK), 0); 1048 pipe_sz = (MAX_FRAGS + 1) * getpagesize(); 1049 ret = fcntl(pipefds[0], F_SETPIPE_SZ, pipe_sz); 1050 if (ret < 0 && errno == EPERM) 1051 SKIP(return, "insufficient pipe capacity"); 1052 ASSERT_GE(ret, pipe_sz); 1053 1054 for (i = 0; i < MAX_FRAGS; i++) 1055 ASSERT_GE(vmsplice(pipefds[1], &sendchar_iov, 1, 0), 0); 1056 1057 ASSERT_EQ(write(pipefds[1], sendbuf, sizeof(sendbuf)), sizeof(sendbuf)); 1058 1059 EXPECT_EQ(splice(pipefds[0], NULL, self->fd, NULL, MAX_FRAGS + 0x1000, 0), 1060 MAX_FRAGS + sizeof(sendbuf)); 1061 EXPECT_EQ(recv(self->cfd, read_buf, sizeof(read_buf), 0), MAX_FRAGS + sizeof(sendbuf)); 1062 EXPECT_EQ(recv(self->cfd, read_buf, sizeof(read_buf), MSG_DONTWAIT), -1); 1063 EXPECT_EQ(errno, EAGAIN); 1064 } 1065 #undef MAX_FRAGS 1066 1067 TEST_F(tls, recvmsg_single) 1068 { 1069 char const *test_str = "test_recvmsg_single"; 1070 int send_len = strlen(test_str) + 1; 1071 char buf[20]; 1072 struct msghdr hdr; 1073 struct iovec vec; 1074 1075 memset(&hdr, 0, sizeof(hdr)); 1076 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); 1077 vec.iov_base = (char *)buf; 1078 vec.iov_len = send_len; 1079 hdr.msg_iovlen = 1; 1080 hdr.msg_iov = &vec; 1081 EXPECT_NE(recvmsg(self->cfd, &hdr, 0), -1); 1082 EXPECT_EQ(memcmp(test_str, buf, send_len), 0); 1083 } 1084 1085 TEST_F(tls, recvmsg_single_max) 1086 { 1087 int send_len = TLS_PAYLOAD_MAX_LEN; 1088 char send_mem[TLS_PAYLOAD_MAX_LEN]; 1089 char recv_mem[TLS_PAYLOAD_MAX_LEN]; 1090 struct iovec vec; 1091 struct msghdr hdr; 1092 1093 memrnd(send_mem, sizeof(send_mem)); 1094 1095 EXPECT_EQ(send(self->fd, send_mem, send_len, 0), send_len); 1096 vec.iov_base = (char *)recv_mem; 1097 vec.iov_len = TLS_PAYLOAD_MAX_LEN; 1098 1099 hdr.msg_iovlen = 1; 1100 hdr.msg_iov = &vec; 1101 EXPECT_NE(recvmsg(self->cfd, &hdr, 0), -1); 1102 EXPECT_EQ(memcmp(send_mem, recv_mem, send_len), 0); 1103 } 1104 1105 TEST_F(tls, recvmsg_multiple) 1106 { 1107 unsigned int msg_iovlen = 1024; 1108 struct iovec vec[1024]; 1109 char *iov_base[1024]; 1110 unsigned int iov_len = 16; 1111 int send_len = 1 << 14; 1112 char buf[1 << 14]; 1113 struct msghdr hdr; 1114 int i; 1115 1116 memrnd(buf, sizeof(buf)); 1117 1118 EXPECT_EQ(send(self->fd, buf, send_len, 0), send_len); 1119 for (i = 0; i < msg_iovlen; i++) { 1120 iov_base[i] = (char *)malloc(iov_len); 1121 vec[i].iov_base = iov_base[i]; 1122 vec[i].iov_len = iov_len; 1123 } 1124 1125 hdr.msg_iovlen = msg_iovlen; 1126 hdr.msg_iov = vec; 1127 EXPECT_NE(recvmsg(self->cfd, &hdr, 0), -1); 1128 1129 for (i = 0; i < msg_iovlen; i++) 1130 free(iov_base[i]); 1131 } 1132 1133 TEST_F(tls, single_send_multiple_recv) 1134 { 1135 unsigned int total_len = TLS_PAYLOAD_MAX_LEN * 2; 1136 unsigned int send_len = TLS_PAYLOAD_MAX_LEN; 1137 char send_mem[TLS_PAYLOAD_MAX_LEN * 2]; 1138 char recv_mem[TLS_PAYLOAD_MAX_LEN * 2]; 1139 1140 memrnd(send_mem, sizeof(send_mem)); 1141 1142 EXPECT_GE(send(self->fd, send_mem, total_len, 0), 0); 1143 memset(recv_mem, 0, total_len); 1144 1145 EXPECT_NE(recv(self->cfd, recv_mem, send_len, 0), -1); 1146 EXPECT_NE(recv(self->cfd, recv_mem + send_len, send_len, 0), -1); 1147 EXPECT_EQ(memcmp(send_mem, recv_mem, total_len), 0); 1148 } 1149 1150 TEST_F(tls, multiple_send_single_recv) 1151 { 1152 unsigned int total_len = 2 * 10; 1153 unsigned int send_len = 10; 1154 char recv_mem[2 * 10]; 1155 char send_mem[10]; 1156 1157 memrnd(send_mem, sizeof(send_mem)); 1158 1159 EXPECT_GE(send(self->fd, send_mem, send_len, 0), 0); 1160 EXPECT_GE(send(self->fd, send_mem, send_len, 0), 0); 1161 memset(recv_mem, 0, total_len); 1162 EXPECT_EQ(recv(self->cfd, recv_mem, total_len, MSG_WAITALL), total_len); 1163 1164 EXPECT_EQ(memcmp(send_mem, recv_mem, send_len), 0); 1165 EXPECT_EQ(memcmp(send_mem, recv_mem + send_len, send_len), 0); 1166 } 1167 1168 TEST_F(tls, single_send_multiple_recv_non_align) 1169 { 1170 const unsigned int total_len = 15; 1171 const unsigned int recv_len = 10; 1172 char recv_mem[recv_len * 2]; 1173 char send_mem[total_len]; 1174 1175 memrnd(send_mem, sizeof(send_mem)); 1176 1177 EXPECT_GE(send(self->fd, send_mem, total_len, 0), 0); 1178 memset(recv_mem, 0, total_len); 1179 1180 EXPECT_EQ(recv(self->cfd, recv_mem, recv_len, 0), recv_len); 1181 EXPECT_EQ(recv(self->cfd, recv_mem + recv_len, recv_len, 0), 5); 1182 EXPECT_EQ(memcmp(send_mem, recv_mem, total_len), 0); 1183 } 1184 1185 TEST_F(tls, recv_partial) 1186 { 1187 char const *test_str = "test_read_partial"; 1188 char const *test_str_first = "test_read"; 1189 char const *test_str_second = "_partial"; 1190 int send_len = strlen(test_str) + 1; 1191 char recv_mem[18]; 1192 1193 memset(recv_mem, 0, sizeof(recv_mem)); 1194 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); 1195 EXPECT_EQ(recv(self->cfd, recv_mem, strlen(test_str_first), 1196 MSG_WAITALL), strlen(test_str_first)); 1197 EXPECT_EQ(memcmp(test_str_first, recv_mem, strlen(test_str_first)), 0); 1198 memset(recv_mem, 0, sizeof(recv_mem)); 1199 EXPECT_EQ(recv(self->cfd, recv_mem, strlen(test_str_second), 1200 MSG_WAITALL), strlen(test_str_second)); 1201 EXPECT_EQ(memcmp(test_str_second, recv_mem, strlen(test_str_second)), 1202 0); 1203 } 1204 1205 TEST_F(tls, recv_nonblock) 1206 { 1207 char buf[4096]; 1208 bool err; 1209 1210 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_DONTWAIT), -1); 1211 err = (errno == EAGAIN || errno == EWOULDBLOCK); 1212 EXPECT_EQ(err, true); 1213 } 1214 1215 TEST_F(tls, recv_peek) 1216 { 1217 char const *test_str = "test_read_peek"; 1218 int send_len = strlen(test_str) + 1; 1219 char buf[15]; 1220 1221 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); 1222 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_PEEK), send_len); 1223 EXPECT_EQ(memcmp(test_str, buf, send_len), 0); 1224 memset(buf, 0, sizeof(buf)); 1225 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len); 1226 EXPECT_EQ(memcmp(test_str, buf, send_len), 0); 1227 } 1228 1229 TEST_F(tls, recv_peek_multiple) 1230 { 1231 char const *test_str = "test_read_peek"; 1232 int send_len = strlen(test_str) + 1; 1233 unsigned int num_peeks = 100; 1234 char buf[15]; 1235 int i; 1236 1237 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); 1238 for (i = 0; i < num_peeks; i++) { 1239 EXPECT_NE(recv(self->cfd, buf, send_len, MSG_PEEK), -1); 1240 EXPECT_EQ(memcmp(test_str, buf, send_len), 0); 1241 memset(buf, 0, sizeof(buf)); 1242 } 1243 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1); 1244 EXPECT_EQ(memcmp(test_str, buf, send_len), 0); 1245 } 1246 1247 TEST_F(tls, recv_peek_multiple_records) 1248 { 1249 char const *test_str = "test_read_peek_mult_recs"; 1250 char const *test_str_first = "test_read_peek"; 1251 char const *test_str_second = "_mult_recs"; 1252 int len; 1253 char buf[64]; 1254 1255 len = strlen(test_str_first); 1256 EXPECT_EQ(send(self->fd, test_str_first, len, 0), len); 1257 1258 len = strlen(test_str_second) + 1; 1259 EXPECT_EQ(send(self->fd, test_str_second, len, 0), len); 1260 1261 len = strlen(test_str_first); 1262 memset(buf, 0, len); 1263 EXPECT_EQ(recv(self->cfd, buf, len, MSG_PEEK | MSG_WAITALL), len); 1264 1265 /* MSG_PEEK can only peek into the current record. */ 1266 len = strlen(test_str_first); 1267 EXPECT_EQ(memcmp(test_str_first, buf, len), 0); 1268 1269 len = strlen(test_str) + 1; 1270 memset(buf, 0, len); 1271 EXPECT_EQ(recv(self->cfd, buf, len, MSG_WAITALL), len); 1272 1273 /* Non-MSG_PEEK will advance strparser (and therefore record) 1274 * however. 1275 */ 1276 len = strlen(test_str) + 1; 1277 EXPECT_EQ(memcmp(test_str, buf, len), 0); 1278 1279 /* MSG_MORE will hold current record open, so later MSG_PEEK 1280 * will see everything. 1281 */ 1282 len = strlen(test_str_first); 1283 EXPECT_EQ(send(self->fd, test_str_first, len, MSG_MORE), len); 1284 1285 len = strlen(test_str_second) + 1; 1286 EXPECT_EQ(send(self->fd, test_str_second, len, 0), len); 1287 1288 len = strlen(test_str) + 1; 1289 memset(buf, 0, len); 1290 EXPECT_EQ(recv(self->cfd, buf, len, MSG_PEEK | MSG_WAITALL), len); 1291 1292 len = strlen(test_str) + 1; 1293 EXPECT_EQ(memcmp(test_str, buf, len), 0); 1294 } 1295 1296 TEST_F(tls, recv_peek_large_buf_mult_recs) 1297 { 1298 char const *test_str = "test_read_peek_mult_recs"; 1299 char const *test_str_first = "test_read_peek"; 1300 char const *test_str_second = "_mult_recs"; 1301 int len; 1302 char buf[64]; 1303 1304 len = strlen(test_str_first); 1305 EXPECT_EQ(send(self->fd, test_str_first, len, 0), len); 1306 1307 len = strlen(test_str_second) + 1; 1308 EXPECT_EQ(send(self->fd, test_str_second, len, 0), len); 1309 1310 len = strlen(test_str) + 1; 1311 memset(buf, 0, len); 1312 EXPECT_NE((len = recv(self->cfd, buf, len, 1313 MSG_PEEK | MSG_WAITALL)), -1); 1314 len = strlen(test_str) + 1; 1315 EXPECT_EQ(memcmp(test_str, buf, len), 0); 1316 } 1317 1318 TEST_F(tls, recv_lowat) 1319 { 1320 char send_mem[10] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 }; 1321 char recv_mem[20]; 1322 int lowat = 8; 1323 1324 EXPECT_EQ(send(self->fd, send_mem, 10, 0), 10); 1325 EXPECT_EQ(send(self->fd, send_mem, 5, 0), 5); 1326 1327 memset(recv_mem, 0, 20); 1328 EXPECT_EQ(setsockopt(self->cfd, SOL_SOCKET, SO_RCVLOWAT, 1329 &lowat, sizeof(lowat)), 0); 1330 EXPECT_EQ(recv(self->cfd, recv_mem, 1, MSG_WAITALL), 1); 1331 EXPECT_EQ(recv(self->cfd, recv_mem + 1, 6, MSG_WAITALL), 6); 1332 EXPECT_EQ(recv(self->cfd, recv_mem + 7, 10, 0), 8); 1333 1334 EXPECT_EQ(memcmp(send_mem, recv_mem, 10), 0); 1335 EXPECT_EQ(memcmp(send_mem, recv_mem + 10, 5), 0); 1336 } 1337 1338 TEST_F(tls, bidir) 1339 { 1340 char const *test_str = "test_read"; 1341 int send_len = 10; 1342 char buf[10]; 1343 int ret; 1344 1345 if (!self->notls) { 1346 struct tls_crypto_info_keys tls12; 1347 1348 tls_crypto_info_init(variant->tls_version, variant->cipher_type, 1349 &tls12, 0); 1350 1351 ret = setsockopt(self->fd, SOL_TLS, TLS_RX, &tls12, 1352 tls12.len); 1353 ASSERT_EQ(ret, 0); 1354 1355 ret = setsockopt(self->cfd, SOL_TLS, TLS_TX, &tls12, 1356 tls12.len); 1357 ASSERT_EQ(ret, 0); 1358 } 1359 1360 ASSERT_EQ(strlen(test_str) + 1, send_len); 1361 1362 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); 1363 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1); 1364 EXPECT_EQ(memcmp(buf, test_str, send_len), 0); 1365 1366 memset(buf, 0, sizeof(buf)); 1367 1368 EXPECT_EQ(send(self->cfd, test_str, send_len, 0), send_len); 1369 EXPECT_NE(recv(self->fd, buf, send_len, 0), -1); 1370 EXPECT_EQ(memcmp(buf, test_str, send_len), 0); 1371 }; 1372 1373 TEST_F(tls, pollin) 1374 { 1375 char const *test_str = "test_poll"; 1376 struct pollfd fd = { 0, 0, 0 }; 1377 char buf[10]; 1378 int send_len = 10; 1379 1380 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); 1381 fd.fd = self->cfd; 1382 fd.events = POLLIN; 1383 1384 EXPECT_EQ(poll(&fd, 1, 20), 1); 1385 EXPECT_EQ(fd.revents & POLLIN, 1); 1386 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_WAITALL), send_len); 1387 /* Test timing out */ 1388 EXPECT_EQ(poll(&fd, 1, 20), 0); 1389 } 1390 1391 TEST_F(tls, poll_wait) 1392 { 1393 char const *test_str = "test_poll_wait"; 1394 int send_len = strlen(test_str) + 1; 1395 struct pollfd fd = { 0, 0, 0 }; 1396 char recv_mem[15]; 1397 1398 fd.fd = self->cfd; 1399 fd.events = POLLIN; 1400 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); 1401 /* Set timeout to inf. secs */ 1402 EXPECT_EQ(poll(&fd, 1, -1), 1); 1403 EXPECT_EQ(fd.revents & POLLIN, 1); 1404 EXPECT_EQ(recv(self->cfd, recv_mem, send_len, MSG_WAITALL), send_len); 1405 } 1406 1407 TEST_F(tls, poll_wait_split) 1408 { 1409 struct pollfd fd = { 0, 0, 0 }; 1410 char send_mem[20] = {}; 1411 char recv_mem[15]; 1412 1413 fd.fd = self->cfd; 1414 fd.events = POLLIN; 1415 /* Send 20 bytes */ 1416 EXPECT_EQ(send(self->fd, send_mem, sizeof(send_mem), 0), 1417 sizeof(send_mem)); 1418 /* Poll with inf. timeout */ 1419 EXPECT_EQ(poll(&fd, 1, -1), 1); 1420 EXPECT_EQ(fd.revents & POLLIN, 1); 1421 EXPECT_EQ(recv(self->cfd, recv_mem, sizeof(recv_mem), MSG_WAITALL), 1422 sizeof(recv_mem)); 1423 1424 /* Now the remaining 5 bytes of record data are in TLS ULP */ 1425 fd.fd = self->cfd; 1426 fd.events = POLLIN; 1427 EXPECT_EQ(poll(&fd, 1, -1), 1); 1428 EXPECT_EQ(fd.revents & POLLIN, 1); 1429 EXPECT_EQ(recv(self->cfd, recv_mem, sizeof(recv_mem), 0), 1430 sizeof(send_mem) - sizeof(recv_mem)); 1431 } 1432 1433 TEST_F(tls, blocking) 1434 { 1435 size_t data = 100000; 1436 int res = fork(); 1437 1438 EXPECT_NE(res, -1); 1439 1440 if (res) { 1441 /* parent */ 1442 size_t left = data; 1443 char buf[16384]; 1444 int status; 1445 int pid2; 1446 1447 while (left) { 1448 int res = send(self->fd, buf, 1449 left > 16384 ? 16384 : left, 0); 1450 1451 EXPECT_GE(res, 0); 1452 left -= res; 1453 } 1454 1455 pid2 = wait(&status); 1456 EXPECT_EQ(status, 0); 1457 EXPECT_EQ(res, pid2); 1458 } else { 1459 /* child */ 1460 size_t left = data; 1461 char buf[16384]; 1462 1463 while (left) { 1464 int res = recv(self->cfd, buf, 1465 left > 16384 ? 16384 : left, 0); 1466 1467 EXPECT_GE(res, 0); 1468 left -= res; 1469 } 1470 } 1471 } 1472 1473 TEST_F(tls, nonblocking) 1474 { 1475 size_t data = 100000; 1476 int sendbuf = 100; 1477 int flags; 1478 int res; 1479 1480 flags = fcntl(self->fd, F_GETFL, 0); 1481 fcntl(self->fd, F_SETFL, flags | O_NONBLOCK); 1482 fcntl(self->cfd, F_SETFL, flags | O_NONBLOCK); 1483 1484 /* Ensure nonblocking behavior by imposing a small send 1485 * buffer. 1486 */ 1487 EXPECT_EQ(setsockopt(self->fd, SOL_SOCKET, SO_SNDBUF, 1488 &sendbuf, sizeof(sendbuf)), 0); 1489 1490 res = fork(); 1491 EXPECT_NE(res, -1); 1492 1493 if (res) { 1494 /* parent */ 1495 bool eagain = false; 1496 size_t left = data; 1497 char buf[16384]; 1498 int status; 1499 int pid2; 1500 1501 while (left) { 1502 int res = send(self->fd, buf, 1503 left > 16384 ? 16384 : left, 0); 1504 1505 if (res == -1 && errno == EAGAIN) { 1506 eagain = true; 1507 usleep(10000); 1508 continue; 1509 } 1510 EXPECT_GE(res, 0); 1511 left -= res; 1512 } 1513 1514 EXPECT_TRUE(eagain); 1515 pid2 = wait(&status); 1516 1517 EXPECT_EQ(status, 0); 1518 EXPECT_EQ(res, pid2); 1519 } else { 1520 /* child */ 1521 bool eagain = false; 1522 size_t left = data; 1523 char buf[16384]; 1524 1525 while (left) { 1526 int res = recv(self->cfd, buf, 1527 left > 16384 ? 16384 : left, 0); 1528 1529 if (res == -1 && errno == EAGAIN) { 1530 eagain = true; 1531 usleep(10000); 1532 continue; 1533 } 1534 EXPECT_GE(res, 0); 1535 left -= res; 1536 } 1537 EXPECT_TRUE(eagain); 1538 } 1539 } 1540 1541 static void 1542 test_mutliproc(struct __test_metadata *_metadata, struct _test_data_tls *self, 1543 bool sendpg, unsigned int n_readers, unsigned int n_writers) 1544 { 1545 const unsigned int n_children = n_readers + n_writers; 1546 const size_t data = 6 * 1000 * 1000; 1547 const size_t file_sz = data / 100; 1548 size_t read_bias, write_bias; 1549 int i, fd, child_id; 1550 char buf[file_sz]; 1551 pid_t pid; 1552 1553 /* Only allow multiples for simplicity */ 1554 ASSERT_EQ(!(n_readers % n_writers) || !(n_writers % n_readers), true); 1555 read_bias = n_writers / n_readers ?: 1; 1556 write_bias = n_readers / n_writers ?: 1; 1557 1558 /* prep a file to send */ 1559 fd = open("/tmp/", O_TMPFILE | O_RDWR, 0600); 1560 ASSERT_GE(fd, 0); 1561 1562 memset(buf, 0xac, file_sz); 1563 ASSERT_EQ(write(fd, buf, file_sz), file_sz); 1564 1565 /* spawn children */ 1566 for (child_id = 0; child_id < n_children; child_id++) { 1567 pid = fork(); 1568 ASSERT_NE(pid, -1); 1569 if (!pid) 1570 break; 1571 } 1572 1573 /* parent waits for all children */ 1574 if (pid) { 1575 for (i = 0; i < n_children; i++) { 1576 int status; 1577 1578 wait(&status); 1579 EXPECT_EQ(status, 0); 1580 } 1581 1582 return; 1583 } 1584 1585 /* Split threads for reading and writing */ 1586 if (child_id < n_readers) { 1587 size_t left = data * read_bias; 1588 char rb[8001]; 1589 1590 while (left) { 1591 int res; 1592 1593 res = recv(self->cfd, rb, 1594 left > sizeof(rb) ? sizeof(rb) : left, 0); 1595 1596 ASSERT_GE(res, 0); 1597 left -= res; 1598 } 1599 } else { 1600 size_t left = data * write_bias; 1601 1602 while (left) { 1603 int res; 1604 1605 ASSERT_EQ(lseek(fd, 0, SEEK_SET), 0); 1606 if (sendpg) 1607 res = sendfile(self->fd, fd, NULL, 1608 left > file_sz ? file_sz : left); 1609 else 1610 res = send(self->fd, buf, 1611 left > file_sz ? file_sz : left, 0); 1612 1613 ASSERT_GE(res, 0); 1614 left -= res; 1615 } 1616 } 1617 } 1618 1619 TEST_F(tls, mutliproc_even) 1620 { 1621 test_mutliproc(_metadata, self, false, 6, 6); 1622 } 1623 1624 TEST_F(tls, mutliproc_readers) 1625 { 1626 test_mutliproc(_metadata, self, false, 4, 12); 1627 } 1628 1629 TEST_F(tls, mutliproc_writers) 1630 { 1631 test_mutliproc(_metadata, self, false, 10, 2); 1632 } 1633 1634 TEST_F(tls, mutliproc_sendpage_even) 1635 { 1636 test_mutliproc(_metadata, self, true, 6, 6); 1637 } 1638 1639 TEST_F(tls, mutliproc_sendpage_readers) 1640 { 1641 test_mutliproc(_metadata, self, true, 4, 12); 1642 } 1643 1644 TEST_F(tls, mutliproc_sendpage_writers) 1645 { 1646 test_mutliproc(_metadata, self, true, 10, 2); 1647 } 1648 1649 TEST_F(tls, control_msg) 1650 { 1651 char *test_str = "test_read"; 1652 char record_type = 100; 1653 int send_len = 10; 1654 char buf[10]; 1655 1656 if (self->notls) 1657 SKIP(return, "no TLS support"); 1658 1659 EXPECT_EQ(tls_send_cmsg(self->fd, record_type, test_str, send_len, 0), 1660 send_len); 1661 /* Should fail because we didn't provide a control message */ 1662 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), -1); 1663 1664 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, record_type, 1665 buf, sizeof(buf), MSG_WAITALL | MSG_PEEK), 1666 send_len); 1667 EXPECT_EQ(memcmp(buf, test_str, send_len), 0); 1668 1669 /* Recv the message again without MSG_PEEK */ 1670 memset(buf, 0, sizeof(buf)); 1671 1672 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, record_type, 1673 buf, sizeof(buf), MSG_WAITALL), 1674 send_len); 1675 EXPECT_EQ(memcmp(buf, test_str, send_len), 0); 1676 } 1677 1678 TEST_F(tls, control_msg_nomerge) 1679 { 1680 char *rec1 = "1111"; 1681 char *rec2 = "2222"; 1682 int send_len = 5; 1683 char buf[15]; 1684 1685 if (self->notls) 1686 SKIP(return, "no TLS support"); 1687 1688 EXPECT_EQ(tls_send_cmsg(self->fd, 100, rec1, send_len, 0), send_len); 1689 EXPECT_EQ(tls_send_cmsg(self->fd, 100, rec2, send_len, 0), send_len); 1690 1691 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, 100, buf, sizeof(buf), MSG_PEEK), send_len); 1692 EXPECT_EQ(memcmp(buf, rec1, send_len), 0); 1693 1694 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, 100, buf, sizeof(buf), MSG_PEEK), send_len); 1695 EXPECT_EQ(memcmp(buf, rec1, send_len), 0); 1696 1697 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, 100, buf, sizeof(buf), 0), send_len); 1698 EXPECT_EQ(memcmp(buf, rec1, send_len), 0); 1699 1700 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, 100, buf, sizeof(buf), 0), send_len); 1701 EXPECT_EQ(memcmp(buf, rec2, send_len), 0); 1702 } 1703 1704 TEST_F(tls, data_control_data) 1705 { 1706 char *rec1 = "1111"; 1707 char *rec2 = "2222"; 1708 char *rec3 = "3333"; 1709 int send_len = 5; 1710 char buf[15]; 1711 1712 if (self->notls) 1713 SKIP(return, "no TLS support"); 1714 1715 EXPECT_EQ(send(self->fd, rec1, send_len, 0), send_len); 1716 EXPECT_EQ(tls_send_cmsg(self->fd, 100, rec2, send_len, 0), send_len); 1717 EXPECT_EQ(send(self->fd, rec3, send_len, 0), send_len); 1718 1719 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_PEEK), send_len); 1720 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_PEEK), send_len); 1721 } 1722 1723 TEST_F(tls, shutdown) 1724 { 1725 char const *test_str = "test_read"; 1726 int send_len = 10; 1727 char buf[10]; 1728 1729 ASSERT_EQ(strlen(test_str) + 1, send_len); 1730 1731 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); 1732 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1); 1733 EXPECT_EQ(memcmp(buf, test_str, send_len), 0); 1734 1735 shutdown(self->fd, SHUT_RDWR); 1736 shutdown(self->cfd, SHUT_RDWR); 1737 } 1738 1739 TEST_F(tls, shutdown_unsent) 1740 { 1741 char const *test_str = "test_read"; 1742 int send_len = 10; 1743 1744 EXPECT_EQ(send(self->fd, test_str, send_len, MSG_MORE), send_len); 1745 1746 shutdown(self->fd, SHUT_RDWR); 1747 shutdown(self->cfd, SHUT_RDWR); 1748 } 1749 1750 TEST_F(tls, shutdown_reuse) 1751 { 1752 struct sockaddr_in addr; 1753 int ret; 1754 1755 shutdown(self->fd, SHUT_RDWR); 1756 shutdown(self->cfd, SHUT_RDWR); 1757 close(self->cfd); 1758 1759 addr.sin_family = AF_INET; 1760 addr.sin_addr.s_addr = htonl(INADDR_ANY); 1761 addr.sin_port = 0; 1762 1763 ret = bind(self->fd, &addr, sizeof(addr)); 1764 EXPECT_EQ(ret, 0); 1765 ret = listen(self->fd, 10); 1766 EXPECT_EQ(ret, -1); 1767 EXPECT_EQ(errno, EINVAL); 1768 1769 ret = connect(self->fd, &addr, sizeof(addr)); 1770 EXPECT_EQ(ret, -1); 1771 EXPECT_EQ(errno, EISCONN); 1772 } 1773 1774 TEST_F(tls, getsockopt) 1775 { 1776 struct tls_crypto_info_keys expect, get; 1777 socklen_t len; 1778 1779 /* get only the version/cipher */ 1780 len = sizeof(struct tls_crypto_info); 1781 memrnd(&get, sizeof(get)); 1782 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &get, &len), 0); 1783 EXPECT_EQ(len, sizeof(struct tls_crypto_info)); 1784 EXPECT_EQ(get.crypto_info.version, variant->tls_version); 1785 EXPECT_EQ(get.crypto_info.cipher_type, variant->cipher_type); 1786 1787 /* get the full crypto_info */ 1788 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &expect, 0); 1789 len = expect.len; 1790 memrnd(&get, sizeof(get)); 1791 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &get, &len), 0); 1792 EXPECT_EQ(len, expect.len); 1793 EXPECT_EQ(get.crypto_info.version, variant->tls_version); 1794 EXPECT_EQ(get.crypto_info.cipher_type, variant->cipher_type); 1795 EXPECT_EQ(memcmp(&get, &expect, expect.len), 0); 1796 1797 /* short get should fail */ 1798 len = sizeof(struct tls_crypto_info) - 1; 1799 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &get, &len), -1); 1800 EXPECT_EQ(errno, EINVAL); 1801 1802 /* partial get of the cipher data should fail */ 1803 len = expect.len - 1; 1804 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &get, &len), -1); 1805 EXPECT_EQ(errno, EINVAL); 1806 } 1807 1808 TEST_F(tls, recv_efault) 1809 { 1810 char *rec1 = "1111111111"; 1811 char *rec2 = "2222222222"; 1812 struct msghdr hdr = {}; 1813 struct iovec iov[2]; 1814 char recv_mem[12]; 1815 int ret; 1816 1817 if (self->notls) 1818 SKIP(return, "no TLS support"); 1819 1820 EXPECT_EQ(send(self->fd, rec1, 10, 0), 10); 1821 EXPECT_EQ(send(self->fd, rec2, 10, 0), 10); 1822 1823 iov[0].iov_base = recv_mem; 1824 iov[0].iov_len = sizeof(recv_mem); 1825 iov[1].iov_base = NULL; /* broken iov to make process_rx_list fail */ 1826 iov[1].iov_len = 1; 1827 1828 hdr.msg_iovlen = 2; 1829 hdr.msg_iov = iov; 1830 1831 EXPECT_EQ(recv(self->cfd, recv_mem, 1, 0), 1); 1832 EXPECT_EQ(recv_mem[0], rec1[0]); 1833 1834 ret = recvmsg(self->cfd, &hdr, 0); 1835 EXPECT_LE(ret, sizeof(recv_mem)); 1836 EXPECT_GE(ret, 9); 1837 EXPECT_EQ(memcmp(rec1, recv_mem, 9), 0); 1838 if (ret > 9) 1839 EXPECT_EQ(memcmp(rec2, recv_mem + 9, ret - 9), 0); 1840 } 1841 1842 #define TLS_RECORD_TYPE_HANDSHAKE 0x16 1843 1844 TEST_F(tls_basic, recvmsg_nopad_retry_iov) 1845 { 1846 char payload[32]; 1847 char first_iov[sizeof(payload)]; 1848 char later_iov[sizeof(payload) * 2]; 1849 char expected_later_iov[sizeof(later_iov)]; 1850 char cbuf[CMSG_SPACE(sizeof(char))]; 1851 struct tls_crypto_info_keys tls13; 1852 struct iovec iov[] = { 1853 { .iov_base = first_iov, .iov_len = sizeof(first_iov) }, 1854 { .iov_base = later_iov, .iov_len = sizeof(later_iov) }, 1855 }; 1856 struct msghdr msg = { 1857 .msg_iov = iov, 1858 .msg_iovlen = ARRAY_SIZE(iov), 1859 .msg_control = cbuf, 1860 .msg_controllen = sizeof(cbuf), 1861 }; 1862 int one = 1; 1863 int ret; 1864 int i; 1865 1866 if (self->notls) 1867 SKIP(return, "no TLS support"); 1868 1869 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128, 1870 &tls13, 0); 1871 1872 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls13, tls13.len); 1873 ASSERT_EQ(ret, 0); 1874 1875 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls13, tls13.len); 1876 ASSERT_EQ(ret, 0); 1877 1878 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD, 1879 &one, sizeof(one)); 1880 ASSERT_EQ(ret, 0); 1881 1882 for (i = 0; i < sizeof(payload); i++) 1883 payload[i] = 0x40 + i; 1884 memset(first_iov, 0xa5, sizeof(first_iov)); 1885 memset(later_iov, 0x5a, sizeof(later_iov)); 1886 memset(expected_later_iov, 0x5a, sizeof(expected_later_iov)); 1887 1888 /* A control record forces optimistic TLS 1.3 RX to retry. */ 1889 ret = tls_send_cmsg(self->fd, TLS_RECORD_TYPE_HANDSHAKE, 1890 payload, sizeof(payload), 0); 1891 ASSERT_EQ(ret, sizeof(payload)); 1892 1893 ret = recvmsg(self->cfd, &msg, 0); 1894 ASSERT_EQ(ret, sizeof(payload)); 1895 EXPECT_EQ(memcmp(first_iov, payload, sizeof(payload)), 0); 1896 EXPECT_EQ(memcmp(later_iov, expected_later_iov, 1897 sizeof(later_iov)), 0); 1898 } 1899 1900 /* key_update, length 1, update_not_requested */ 1901 static const char key_update_msg[] = "\x18\x00\x00\x01\x00"; 1902 static void tls_send_keyupdate(struct __test_metadata *_metadata, int fd) 1903 { 1904 size_t len = sizeof(key_update_msg); 1905 1906 EXPECT_EQ(tls_send_cmsg(fd, TLS_RECORD_TYPE_HANDSHAKE, 1907 (char *)key_update_msg, len, 0), 1908 len); 1909 } 1910 1911 static void tls_recv_keyupdate(struct __test_metadata *_metadata, int fd, int flags) 1912 { 1913 char buf[100]; 1914 1915 EXPECT_EQ(tls_recv_cmsg(_metadata, fd, TLS_RECORD_TYPE_HANDSHAKE, buf, sizeof(buf), flags), 1916 sizeof(key_update_msg)); 1917 EXPECT_EQ(memcmp(buf, key_update_msg, sizeof(key_update_msg)), 0); 1918 } 1919 1920 /* set the key to 0 then 1 for RX, immediately to 1 for TX */ 1921 TEST_F(tls_basic, rekey_rx) 1922 { 1923 struct tls_crypto_info_keys tls12_0, tls12_1; 1924 char const *test_str = "test_message"; 1925 int send_len = strlen(test_str) + 1; 1926 char buf[20]; 1927 int ret; 1928 1929 if (self->notls) 1930 return; 1931 1932 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128, 1933 &tls12_0, 0); 1934 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128, 1935 &tls12_1, 1); 1936 1937 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12_1, tls12_1.len); 1938 ASSERT_EQ(ret, 0); 1939 1940 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12_0, tls12_0.len); 1941 ASSERT_EQ(ret, 0); 1942 1943 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12_1, tls12_1.len); 1944 EXPECT_EQ(ret, 0); 1945 1946 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); 1947 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len); 1948 EXPECT_EQ(memcmp(buf, test_str, send_len), 0); 1949 } 1950 1951 /* set the key to 0 then 1 for TX, immediately to 1 for RX */ 1952 TEST_F(tls_basic, rekey_tx) 1953 { 1954 struct tls_crypto_info_keys tls12_0, tls12_1; 1955 char const *test_str = "test_message"; 1956 int send_len = strlen(test_str) + 1; 1957 char buf[20]; 1958 int ret; 1959 1960 if (self->notls) 1961 return; 1962 1963 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128, 1964 &tls12_0, 0); 1965 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128, 1966 &tls12_1, 1); 1967 1968 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12_0, tls12_0.len); 1969 ASSERT_EQ(ret, 0); 1970 1971 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12_1, tls12_1.len); 1972 ASSERT_EQ(ret, 0); 1973 1974 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12_1, tls12_1.len); 1975 EXPECT_EQ(ret, 0); 1976 1977 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); 1978 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len); 1979 EXPECT_EQ(memcmp(buf, test_str, send_len), 0); 1980 } 1981 1982 TEST_F(tls_basic, disconnect) 1983 { 1984 char const *test_str = "test_message"; 1985 int send_len = strlen(test_str) + 1; 1986 struct tls_crypto_info_keys key; 1987 struct sockaddr_in addr; 1988 char buf[20]; 1989 int ret; 1990 1991 if (self->notls) 1992 return; 1993 1994 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128, 1995 &key, 0); 1996 1997 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &key, key.len); 1998 ASSERT_EQ(ret, 0); 1999 2000 /* Pre-queue the data so that setsockopt parses it but doesn't 2001 * dequeue it from the TCP socket. recvmsg would dequeue. 2002 */ 2003 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); 2004 2005 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &key, key.len); 2006 ASSERT_EQ(ret, 0); 2007 2008 addr.sin_family = AF_UNSPEC; 2009 addr.sin_addr.s_addr = htonl(INADDR_ANY); 2010 addr.sin_port = 0; 2011 ret = connect(self->cfd, &addr, sizeof(addr)); 2012 EXPECT_EQ(ret, -1); 2013 EXPECT_EQ(errno, EOPNOTSUPP); 2014 2015 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len); 2016 } 2017 2018 TEST_F(tls, rekey) 2019 { 2020 char const *test_str_1 = "test_message_before_rekey"; 2021 char const *test_str_2 = "test_message_after_rekey"; 2022 struct tls_crypto_info_keys tls12; 2023 int send_len; 2024 char buf[100]; 2025 2026 if (variant->tls_version != TLS_1_3_VERSION) 2027 return; 2028 2029 /* initial send/recv */ 2030 send_len = strlen(test_str_1) + 1; 2031 EXPECT_EQ(send(self->fd, test_str_1, send_len, 0), send_len); 2032 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len); 2033 EXPECT_EQ(memcmp(buf, test_str_1, send_len), 0); 2034 2035 /* update TX key */ 2036 tls_send_keyupdate(_metadata, self->fd); 2037 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1); 2038 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0); 2039 2040 /* send after rekey */ 2041 send_len = strlen(test_str_2) + 1; 2042 EXPECT_EQ(send(self->fd, test_str_2, send_len, 0), send_len); 2043 2044 /* can't receive the KeyUpdate without a control message */ 2045 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), -1); 2046 2047 /* get KeyUpdate */ 2048 tls_recv_keyupdate(_metadata, self->cfd, 0); 2049 2050 /* recv blocking -> -EKEYEXPIRED */ 2051 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), 0), -1); 2052 EXPECT_EQ(errno, EKEYEXPIRED); 2053 2054 /* recv non-blocking -> -EKEYEXPIRED */ 2055 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_DONTWAIT), -1); 2056 EXPECT_EQ(errno, EKEYEXPIRED); 2057 2058 /* update RX key */ 2059 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0); 2060 2061 /* recv after rekey */ 2062 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1); 2063 EXPECT_EQ(memcmp(buf, test_str_2, send_len), 0); 2064 } 2065 2066 TEST_F(tls, rekey_fail) 2067 { 2068 char const *test_str_1 = "test_message_before_rekey"; 2069 char const *test_str_2 = "test_message_after_rekey"; 2070 struct tls_crypto_info_keys tls12; 2071 int send_len; 2072 char buf[100]; 2073 2074 /* initial send/recv */ 2075 send_len = strlen(test_str_1) + 1; 2076 EXPECT_EQ(send(self->fd, test_str_1, send_len, 0), send_len); 2077 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len); 2078 EXPECT_EQ(memcmp(buf, test_str_1, send_len), 0); 2079 2080 /* update TX key */ 2081 tls_send_keyupdate(_metadata, self->fd); 2082 2083 if (variant->tls_version != TLS_1_3_VERSION) { 2084 /* just check that rekey is not supported and return */ 2085 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1); 2086 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), -1); 2087 EXPECT_EQ(errno, EBUSY); 2088 return; 2089 } 2090 2091 /* successful update */ 2092 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1); 2093 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0); 2094 2095 /* invalid update: change of version */ 2096 tls_crypto_info_init(TLS_1_2_VERSION, variant->cipher_type, &tls12, 1); 2097 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), -1); 2098 EXPECT_EQ(errno, EINVAL); 2099 2100 /* invalid update (RX socket): change of version */ 2101 tls_crypto_info_init(TLS_1_2_VERSION, variant->cipher_type, &tls12, 1); 2102 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), -1); 2103 EXPECT_EQ(errno, EINVAL); 2104 2105 /* invalid update: change of cipher */ 2106 if (variant->cipher_type == TLS_CIPHER_AES_GCM_256) 2107 tls_crypto_info_init(variant->tls_version, TLS_CIPHER_CHACHA20_POLY1305, &tls12, 1); 2108 else 2109 tls_crypto_info_init(variant->tls_version, TLS_CIPHER_AES_GCM_256, &tls12, 1); 2110 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), -1); 2111 EXPECT_EQ(errno, EINVAL); 2112 2113 /* send after rekey, the invalid updates shouldn't have an effect */ 2114 send_len = strlen(test_str_2) + 1; 2115 EXPECT_EQ(send(self->fd, test_str_2, send_len, 0), send_len); 2116 2117 /* can't receive the KeyUpdate without a control message */ 2118 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), -1); 2119 2120 /* get KeyUpdate */ 2121 tls_recv_keyupdate(_metadata, self->cfd, 0); 2122 2123 /* recv blocking -> -EKEYEXPIRED */ 2124 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), 0), -1); 2125 EXPECT_EQ(errno, EKEYEXPIRED); 2126 2127 /* recv non-blocking -> -EKEYEXPIRED */ 2128 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_DONTWAIT), -1); 2129 EXPECT_EQ(errno, EKEYEXPIRED); 2130 2131 /* update RX key */ 2132 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1); 2133 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0); 2134 2135 /* recv after rekey */ 2136 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1); 2137 EXPECT_EQ(memcmp(buf, test_str_2, send_len), 0); 2138 } 2139 2140 TEST_F(tls, rekey_peek) 2141 { 2142 char const *test_str_1 = "test_message_before_rekey"; 2143 struct tls_crypto_info_keys tls12; 2144 int send_len; 2145 char buf[100]; 2146 2147 if (variant->tls_version != TLS_1_3_VERSION) 2148 return; 2149 2150 send_len = strlen(test_str_1) + 1; 2151 EXPECT_EQ(send(self->fd, test_str_1, send_len, 0), send_len); 2152 2153 /* update TX key */ 2154 tls_send_keyupdate(_metadata, self->fd); 2155 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1); 2156 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0); 2157 2158 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_PEEK), send_len); 2159 EXPECT_EQ(memcmp(buf, test_str_1, send_len), 0); 2160 2161 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len); 2162 EXPECT_EQ(memcmp(buf, test_str_1, send_len), 0); 2163 2164 /* can't receive the KeyUpdate without a control message */ 2165 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_PEEK), -1); 2166 2167 /* peek KeyUpdate */ 2168 tls_recv_keyupdate(_metadata, self->cfd, MSG_PEEK); 2169 2170 /* get KeyUpdate */ 2171 tls_recv_keyupdate(_metadata, self->cfd, 0); 2172 2173 /* update RX key */ 2174 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0); 2175 } 2176 2177 TEST_F(tls, splice_rekey) 2178 { 2179 int send_len = TLS_PAYLOAD_MAX_LEN / 2; 2180 char mem_send[TLS_PAYLOAD_MAX_LEN]; 2181 char mem_recv[TLS_PAYLOAD_MAX_LEN]; 2182 struct tls_crypto_info_keys tls12; 2183 int p[2]; 2184 2185 if (variant->tls_version != TLS_1_3_VERSION) 2186 return; 2187 2188 memrnd(mem_send, sizeof(mem_send)); 2189 2190 ASSERT_GE(pipe(p), 0); 2191 EXPECT_EQ(send(self->fd, mem_send, send_len, 0), send_len); 2192 2193 /* update TX key */ 2194 tls_send_keyupdate(_metadata, self->fd); 2195 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1); 2196 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0); 2197 2198 EXPECT_EQ(send(self->fd, mem_send, send_len, 0), send_len); 2199 2200 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, TLS_PAYLOAD_MAX_LEN, 0), send_len); 2201 EXPECT_EQ(read(p[0], mem_recv, send_len), send_len); 2202 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0); 2203 2204 /* can't splice the KeyUpdate */ 2205 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, TLS_PAYLOAD_MAX_LEN, 0), -1); 2206 EXPECT_EQ(errno, EINVAL); 2207 2208 /* peek KeyUpdate */ 2209 tls_recv_keyupdate(_metadata, self->cfd, MSG_PEEK); 2210 2211 /* get KeyUpdate */ 2212 tls_recv_keyupdate(_metadata, self->cfd, 0); 2213 2214 /* can't splice before updating the key */ 2215 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, TLS_PAYLOAD_MAX_LEN, 0), -1); 2216 EXPECT_EQ(errno, EKEYEXPIRED); 2217 2218 /* update RX key */ 2219 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0); 2220 2221 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, TLS_PAYLOAD_MAX_LEN, 0), send_len); 2222 EXPECT_EQ(read(p[0], mem_recv, send_len), send_len); 2223 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0); 2224 } 2225 2226 TEST_F(tls, rekey_peek_splice) 2227 { 2228 char const *test_str_1 = "test_message_before_rekey"; 2229 struct tls_crypto_info_keys tls12; 2230 int send_len; 2231 char buf[100]; 2232 char mem_recv[TLS_PAYLOAD_MAX_LEN]; 2233 int p[2]; 2234 2235 if (variant->tls_version != TLS_1_3_VERSION) 2236 return; 2237 2238 ASSERT_GE(pipe(p), 0); 2239 2240 send_len = strlen(test_str_1) + 1; 2241 EXPECT_EQ(send(self->fd, test_str_1, send_len, 0), send_len); 2242 2243 /* update TX key */ 2244 tls_send_keyupdate(_metadata, self->fd); 2245 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1); 2246 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0); 2247 2248 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_PEEK), send_len); 2249 EXPECT_EQ(memcmp(buf, test_str_1, send_len), 0); 2250 2251 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, TLS_PAYLOAD_MAX_LEN, 0), send_len); 2252 EXPECT_EQ(read(p[0], mem_recv, send_len), send_len); 2253 EXPECT_EQ(memcmp(mem_recv, test_str_1, send_len), 0); 2254 } 2255 2256 TEST_F(tls, rekey_getsockopt) 2257 { 2258 struct tls_crypto_info_keys tls12; 2259 struct tls_crypto_info_keys tls12_get; 2260 socklen_t len; 2261 2262 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 0); 2263 2264 len = tls12.len; 2265 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &tls12_get, &len), 0); 2266 EXPECT_EQ(len, tls12.len); 2267 EXPECT_EQ(memcmp(&tls12_get, &tls12, tls12.len), 0); 2268 2269 len = tls12.len; 2270 EXPECT_EQ(getsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12_get, &len), 0); 2271 EXPECT_EQ(len, tls12.len); 2272 EXPECT_EQ(memcmp(&tls12_get, &tls12, tls12.len), 0); 2273 2274 if (variant->tls_version != TLS_1_3_VERSION) 2275 return; 2276 2277 tls_send_keyupdate(_metadata, self->fd); 2278 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1); 2279 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0); 2280 2281 tls_recv_keyupdate(_metadata, self->cfd, 0); 2282 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0); 2283 2284 len = tls12.len; 2285 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &tls12_get, &len), 0); 2286 EXPECT_EQ(len, tls12.len); 2287 EXPECT_EQ(memcmp(&tls12_get, &tls12, tls12.len), 0); 2288 2289 len = tls12.len; 2290 EXPECT_EQ(getsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12_get, &len), 0); 2291 EXPECT_EQ(len, tls12.len); 2292 EXPECT_EQ(memcmp(&tls12_get, &tls12, tls12.len), 0); 2293 } 2294 2295 TEST_F(tls, rekey_poll_pending) 2296 { 2297 char const *test_str = "test_message_after_rekey"; 2298 struct tls_crypto_info_keys tls12; 2299 struct pollfd pfd = { }; 2300 int send_len; 2301 int ret; 2302 2303 if (variant->tls_version != TLS_1_3_VERSION) 2304 return; 2305 2306 /* update TX key */ 2307 tls_send_keyupdate(_metadata, self->fd); 2308 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1); 2309 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0); 2310 2311 /* get KeyUpdate */ 2312 tls_recv_keyupdate(_metadata, self->cfd, 0); 2313 2314 /* send immediately after rekey */ 2315 send_len = strlen(test_str) + 1; 2316 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); 2317 2318 /* key hasn't been updated, expect cfd to be non-readable */ 2319 pfd.fd = self->cfd; 2320 pfd.events = POLLIN; 2321 EXPECT_EQ(poll(&pfd, 1, 0), 0); 2322 2323 ret = fork(); 2324 ASSERT_GE(ret, 0); 2325 2326 if (ret) { 2327 int pid2, status; 2328 2329 /* wait before installing the new key */ 2330 sleep(1); 2331 2332 /* update RX key while poll() is sleeping */ 2333 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0); 2334 2335 pid2 = wait(&status); 2336 EXPECT_EQ(pid2, ret); 2337 EXPECT_EQ(status, 0); 2338 } else { 2339 pfd.fd = self->cfd; 2340 pfd.events = POLLIN; 2341 EXPECT_EQ(poll(&pfd, 1, 5000), 1); 2342 2343 exit(!__test_passed(_metadata)); 2344 } 2345 } 2346 2347 TEST_F(tls, rekey_poll_delay) 2348 { 2349 char const *test_str = "test_message_after_rekey"; 2350 struct tls_crypto_info_keys tls12; 2351 struct pollfd pfd = { }; 2352 int send_len; 2353 int ret; 2354 2355 if (variant->tls_version != TLS_1_3_VERSION) 2356 return; 2357 2358 /* update TX key */ 2359 tls_send_keyupdate(_metadata, self->fd); 2360 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1); 2361 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0); 2362 2363 /* get KeyUpdate */ 2364 tls_recv_keyupdate(_metadata, self->cfd, 0); 2365 2366 ret = fork(); 2367 ASSERT_GE(ret, 0); 2368 2369 if (ret) { 2370 int pid2, status; 2371 2372 /* wait before installing the new key */ 2373 sleep(1); 2374 2375 /* update RX key while poll() is sleeping */ 2376 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0); 2377 2378 sleep(1); 2379 send_len = strlen(test_str) + 1; 2380 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); 2381 2382 pid2 = wait(&status); 2383 EXPECT_EQ(pid2, ret); 2384 EXPECT_EQ(status, 0); 2385 } else { 2386 pfd.fd = self->cfd; 2387 pfd.events = POLLIN; 2388 EXPECT_EQ(poll(&pfd, 1, 5000), 1); 2389 exit(!__test_passed(_metadata)); 2390 } 2391 } 2392 2393 struct raw_rec { 2394 unsigned int plain_len; 2395 unsigned char plain_data[100]; 2396 unsigned int cipher_len; 2397 unsigned char cipher_data[128]; 2398 }; 2399 2400 /* TLS 1.2, AES_CCM, data, seqno:0, plaintext: 'Hello world' */ 2401 static const struct raw_rec id0_data_l11 = { 2402 .plain_len = 11, 2403 .plain_data = { 2404 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f, 2405 0x72, 0x6c, 0x64, 2406 }, 2407 .cipher_len = 40, 2408 .cipher_data = { 2409 0x17, 0x03, 0x03, 0x00, 0x23, 0x00, 0x00, 0x00, 2410 0x00, 0x00, 0x00, 0x00, 0x00, 0x26, 0xa2, 0x33, 2411 0xde, 0x8d, 0x94, 0xf0, 0x29, 0x6c, 0xb1, 0xaf, 2412 0x6a, 0x75, 0xb2, 0x93, 0xad, 0x45, 0xd5, 0xfd, 2413 0x03, 0x51, 0x57, 0x8f, 0xf9, 0xcc, 0x3b, 0x42, 2414 }, 2415 }; 2416 2417 /* TLS 1.2, AES_CCM, ctrl, seqno:0, plaintext: '' */ 2418 static const struct raw_rec id0_ctrl_l0 = { 2419 .plain_len = 0, 2420 .plain_data = { 2421 }, 2422 .cipher_len = 29, 2423 .cipher_data = { 2424 0x16, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00, 2425 0x00, 0x00, 0x00, 0x00, 0x00, 0x13, 0x38, 0x7b, 2426 0xa6, 0x1c, 0xdd, 0xa7, 0x19, 0x33, 0xab, 0xae, 2427 0x88, 0xe1, 0xd2, 0x08, 0x4f, 2428 }, 2429 }; 2430 2431 /* TLS 1.2, AES_CCM, data, seqno:0, plaintext: '' */ 2432 static const struct raw_rec id0_data_l0 = { 2433 .plain_len = 0, 2434 .plain_data = { 2435 }, 2436 .cipher_len = 29, 2437 .cipher_data = { 2438 0x17, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00, 2439 0x00, 0x00, 0x00, 0x00, 0x00, 0xc5, 0x37, 0x90, 2440 0x70, 0x45, 0x89, 0xfb, 0x5c, 0xc7, 0x89, 0x03, 2441 0x68, 0x80, 0xd3, 0xd8, 0xcc, 2442 }, 2443 }; 2444 2445 /* TLS 1.2, AES_CCM, data, seqno:1, plaintext: 'Hello world' */ 2446 static const struct raw_rec id1_data_l11 = { 2447 .plain_len = 11, 2448 .plain_data = { 2449 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f, 2450 0x72, 0x6c, 0x64, 2451 }, 2452 .cipher_len = 40, 2453 .cipher_data = { 2454 0x17, 0x03, 0x03, 0x00, 0x23, 0x00, 0x00, 0x00, 2455 0x00, 0x00, 0x00, 0x00, 0x01, 0x3a, 0x1a, 0x9c, 2456 0xd0, 0xa8, 0x9a, 0xd6, 0x69, 0xd6, 0x1a, 0xe3, 2457 0xb5, 0x1f, 0x0d, 0x2c, 0xe2, 0x97, 0x46, 0xff, 2458 0x2b, 0xcc, 0x5a, 0xc4, 0xa3, 0xb9, 0xef, 0xba, 2459 }, 2460 }; 2461 2462 /* TLS 1.2, AES_CCM, ctrl, seqno:1, plaintext: '' */ 2463 static const struct raw_rec id1_ctrl_l0 = { 2464 .plain_len = 0, 2465 .plain_data = { 2466 }, 2467 .cipher_len = 29, 2468 .cipher_data = { 2469 0x16, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00, 2470 0x00, 0x00, 0x00, 0x00, 0x01, 0x3e, 0xf0, 0xfe, 2471 0xee, 0xd9, 0xe2, 0x5d, 0xc7, 0x11, 0x4c, 0xe6, 2472 0xb4, 0x7e, 0xef, 0x40, 0x2b, 2473 }, 2474 }; 2475 2476 /* TLS 1.2, AES_CCM, data, seqno:1, plaintext: '' */ 2477 static const struct raw_rec id1_data_l0 = { 2478 .plain_len = 0, 2479 .plain_data = { 2480 }, 2481 .cipher_len = 29, 2482 .cipher_data = { 2483 0x17, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00, 2484 0x00, 0x00, 0x00, 0x00, 0x01, 0xce, 0xfc, 0x86, 2485 0xc8, 0xf0, 0x55, 0xf9, 0x47, 0x3f, 0x74, 0xdc, 2486 0xc9, 0xbf, 0xfe, 0x5b, 0xb1, 2487 }, 2488 }; 2489 2490 /* TLS 1.2, AES_CCM, ctrl, seqno:2, plaintext: 'Hello world' */ 2491 static const struct raw_rec id2_ctrl_l11 = { 2492 .plain_len = 11, 2493 .plain_data = { 2494 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f, 2495 0x72, 0x6c, 0x64, 2496 }, 2497 .cipher_len = 40, 2498 .cipher_data = { 2499 0x16, 0x03, 0x03, 0x00, 0x23, 0x00, 0x00, 0x00, 2500 0x00, 0x00, 0x00, 0x00, 0x02, 0xe5, 0x3d, 0x19, 2501 0x3d, 0xca, 0xb8, 0x16, 0xb6, 0xff, 0x79, 0x87, 2502 0x2a, 0x04, 0x11, 0x3d, 0xf8, 0x64, 0x5f, 0x36, 2503 0x8b, 0xa8, 0xee, 0x4c, 0x6d, 0x62, 0xa5, 0x00, 2504 }, 2505 }; 2506 2507 /* TLS 1.2, AES_CCM, data, seqno:2, plaintext: 'Hello world' */ 2508 static const struct raw_rec id2_data_l11 = { 2509 .plain_len = 11, 2510 .plain_data = { 2511 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f, 2512 0x72, 0x6c, 0x64, 2513 }, 2514 .cipher_len = 40, 2515 .cipher_data = { 2516 0x17, 0x03, 0x03, 0x00, 0x23, 0x00, 0x00, 0x00, 2517 0x00, 0x00, 0x00, 0x00, 0x02, 0xe5, 0x3d, 0x19, 2518 0x3d, 0xca, 0xb8, 0x16, 0xb6, 0xff, 0x79, 0x87, 2519 0x8e, 0xa1, 0xd0, 0xcd, 0x33, 0xb5, 0x86, 0x2b, 2520 0x17, 0xf1, 0x52, 0x2a, 0x55, 0x62, 0x65, 0x11, 2521 }, 2522 }; 2523 2524 /* TLS 1.2, AES_CCM, ctrl, seqno:2, plaintext: '' */ 2525 static const struct raw_rec id2_ctrl_l0 = { 2526 .plain_len = 0, 2527 .plain_data = { 2528 }, 2529 .cipher_len = 29, 2530 .cipher_data = { 2531 0x16, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00, 2532 0x00, 0x00, 0x00, 0x00, 0x02, 0xdc, 0x5c, 0x0e, 2533 0x41, 0xdd, 0xba, 0xd3, 0xcc, 0xcf, 0x6d, 0xd9, 2534 0x06, 0xdb, 0x79, 0xe5, 0x5d, 2535 }, 2536 }; 2537 2538 /* TLS 1.2, AES_CCM, data, seqno:2, plaintext: '' */ 2539 static const struct raw_rec id2_data_l0 = { 2540 .plain_len = 0, 2541 .plain_data = { 2542 }, 2543 .cipher_len = 29, 2544 .cipher_data = { 2545 0x17, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00, 2546 0x00, 0x00, 0x00, 0x00, 0x02, 0xc3, 0xca, 0x26, 2547 0x22, 0xe4, 0x25, 0xfb, 0x5f, 0x6d, 0xbf, 0x83, 2548 0x30, 0x48, 0x69, 0x1a, 0x47, 2549 }, 2550 }; 2551 2552 FIXTURE(zero_len) 2553 { 2554 int fd, cfd; 2555 bool notls; 2556 }; 2557 2558 FIXTURE_VARIANT(zero_len) 2559 { 2560 const struct raw_rec *recs[4]; 2561 ssize_t recv_ret[4]; 2562 }; 2563 2564 FIXTURE_VARIANT_ADD(zero_len, data_data_data) 2565 { 2566 .recs = { &id0_data_l11, &id1_data_l11, &id2_data_l11, }, 2567 .recv_ret = { 33, -EAGAIN, }, 2568 }; 2569 2570 FIXTURE_VARIANT_ADD(zero_len, data_0ctrl_data) 2571 { 2572 .recs = { &id0_data_l11, &id1_ctrl_l0, &id2_data_l11, }, 2573 .recv_ret = { 11, 0, 11, -EAGAIN, }, 2574 }; 2575 2576 FIXTURE_VARIANT_ADD(zero_len, 0data_0data_0data) 2577 { 2578 .recs = { &id0_data_l0, &id1_data_l0, &id2_data_l0, }, 2579 .recv_ret = { -EAGAIN, }, 2580 }; 2581 2582 FIXTURE_VARIANT_ADD(zero_len, 0data_0data_ctrl) 2583 { 2584 .recs = { &id0_data_l0, &id1_data_l0, &id2_ctrl_l11, }, 2585 .recv_ret = { 0, 11, -EAGAIN, }, 2586 }; 2587 2588 FIXTURE_VARIANT_ADD(zero_len, 0data_0data_0ctrl) 2589 { 2590 .recs = { &id0_data_l0, &id1_data_l0, &id2_ctrl_l0, }, 2591 .recv_ret = { 0, 0, -EAGAIN, }, 2592 }; 2593 2594 FIXTURE_VARIANT_ADD(zero_len, 0ctrl_0ctrl_0ctrl) 2595 { 2596 .recs = { &id0_ctrl_l0, &id1_ctrl_l0, &id2_ctrl_l0, }, 2597 .recv_ret = { 0, 0, 0, -EAGAIN, }, 2598 }; 2599 2600 FIXTURE_VARIANT_ADD(zero_len, 0data_0data_data) 2601 { 2602 .recs = { &id0_data_l0, &id1_data_l0, &id2_data_l11, }, 2603 .recv_ret = { 11, -EAGAIN, }, 2604 }; 2605 2606 FIXTURE_VARIANT_ADD(zero_len, data_0data_0data) 2607 { 2608 .recs = { &id0_data_l11, &id1_data_l0, &id2_data_l0, }, 2609 .recv_ret = { 11, -EAGAIN, }, 2610 }; 2611 2612 FIXTURE_SETUP(zero_len) 2613 { 2614 struct tls_crypto_info_keys tls12; 2615 int ret; 2616 2617 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_CCM_128, 2618 &tls12, 0); 2619 2620 ulp_sock_pair(_metadata, &self->fd, &self->cfd, &self->notls); 2621 if (self->notls) 2622 return; 2623 2624 /* Don't install keys on fd, we'll send raw records */ 2625 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len); 2626 ASSERT_EQ(ret, 0); 2627 } 2628 2629 FIXTURE_TEARDOWN(zero_len) 2630 { 2631 close(self->fd); 2632 close(self->cfd); 2633 } 2634 2635 TEST_F(zero_len, test) 2636 { 2637 const struct raw_rec *const *rec; 2638 unsigned char buf[128]; 2639 int rec_off; 2640 int i; 2641 2642 for (i = 0; i < 4 && variant->recs[i]; i++) 2643 EXPECT_EQ(send(self->fd, variant->recs[i]->cipher_data, 2644 variant->recs[i]->cipher_len, 0), 2645 variant->recs[i]->cipher_len); 2646 2647 rec = &variant->recs[0]; 2648 rec_off = 0; 2649 for (i = 0; i < 4; i++) { 2650 int j, ret; 2651 2652 ret = variant->recv_ret[i] >= 0 ? variant->recv_ret[i] : -1; 2653 EXPECT_EQ(__tls_recv_cmsg(_metadata, self->cfd, NULL, 2654 buf, sizeof(buf), MSG_DONTWAIT), ret); 2655 if (ret == -1) 2656 EXPECT_EQ(errno, -variant->recv_ret[i]); 2657 if (variant->recv_ret[i] == -EAGAIN) 2658 break; 2659 2660 for (j = 0; j < ret; j++) { 2661 while (rec_off == (*rec)->plain_len) { 2662 rec++; 2663 rec_off = 0; 2664 } 2665 EXPECT_EQ(buf[j], (*rec)->plain_data[rec_off]); 2666 rec_off++; 2667 } 2668 } 2669 }; 2670 2671 FIXTURE(tls_err) 2672 { 2673 int fd, cfd; 2674 int fd2, cfd2; 2675 bool notls; 2676 }; 2677 2678 FIXTURE_VARIANT(tls_err) 2679 { 2680 uint16_t tls_version; 2681 }; 2682 2683 FIXTURE_VARIANT_ADD(tls_err, 12_aes_gcm) 2684 { 2685 .tls_version = TLS_1_2_VERSION, 2686 }; 2687 2688 FIXTURE_VARIANT_ADD(tls_err, 13_aes_gcm) 2689 { 2690 .tls_version = TLS_1_3_VERSION, 2691 }; 2692 2693 FIXTURE_SETUP(tls_err) 2694 { 2695 struct tls_crypto_info_keys tls12; 2696 int ret; 2697 2698 tls_crypto_info_init(variant->tls_version, TLS_CIPHER_AES_GCM_128, 2699 &tls12, 0); 2700 2701 ulp_sock_pair(_metadata, &self->fd, &self->cfd, &self->notls); 2702 ulp_sock_pair(_metadata, &self->fd2, &self->cfd2, &self->notls); 2703 if (self->notls) 2704 return; 2705 2706 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len); 2707 ASSERT_EQ(ret, 0); 2708 2709 ret = setsockopt(self->cfd2, SOL_TLS, TLS_RX, &tls12, tls12.len); 2710 ASSERT_EQ(ret, 0); 2711 } 2712 2713 FIXTURE_TEARDOWN(tls_err) 2714 { 2715 close(self->fd); 2716 close(self->cfd); 2717 close(self->fd2); 2718 close(self->cfd2); 2719 } 2720 2721 TEST_F(tls_err, bad_rec) 2722 { 2723 char buf[64]; 2724 2725 if (self->notls) 2726 SKIP(return, "no TLS support"); 2727 2728 memset(buf, 0x55, sizeof(buf)); 2729 EXPECT_EQ(send(self->fd2, buf, sizeof(buf), 0), sizeof(buf)); 2730 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1); 2731 EXPECT_EQ(errno, EMSGSIZE); 2732 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), MSG_DONTWAIT), -1); 2733 EXPECT_EQ(errno, EAGAIN); 2734 } 2735 2736 /* cfd carries a byte stream, so one recv() can return part of a 2737 * record. Take the fragment length from the record header and wait 2738 * for the remainder. 2739 */ 2740 static void tls_send_bad_auth(struct __test_metadata *_metadata, 2741 int fd, int cfd, int fd2) 2742 { 2743 char buf[128]; 2744 int len; 2745 2746 memrnd(buf, sizeof(buf) / 2); 2747 ASSERT_EQ(send(fd, buf, sizeof(buf) / 2, 0), sizeof(buf) / 2); 2748 2749 ASSERT_EQ(recv(cfd, buf, TLS_HDR_LEN, MSG_WAITALL), TLS_HDR_LEN); 2750 2751 len = ((unsigned char)buf[3] << 8) | (unsigned char)buf[4]; 2752 ASSERT_GT(len, 0); 2753 ASSERT_LE(len, (int)sizeof(buf) - TLS_HDR_LEN); 2754 2755 ASSERT_EQ(recv(cfd, buf + TLS_HDR_LEN, len, MSG_WAITALL), len); 2756 2757 buf[TLS_HDR_LEN + len - 1]++; 2758 2759 ASSERT_EQ(send(fd2, buf, TLS_HDR_LEN + len, 0), TLS_HDR_LEN + len); 2760 } 2761 2762 TEST_F(tls_err, bad_auth) 2763 { 2764 char buf[128]; 2765 2766 if (self->notls) 2767 SKIP(return, "no TLS support"); 2768 2769 tls_send_bad_auth(_metadata, self->fd, self->cfd, self->fd2); 2770 2771 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1); 2772 EXPECT_EQ(errno, EBADMSG); 2773 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1); 2774 EXPECT_EQ(errno, EBADMSG); 2775 } 2776 2777 /* A record that did not authenticate breaks the connection for every 2778 * reader, splice included. 2779 * 2780 * The two decrypt paths reach that result differently. A synchronous 2781 * decrypt leaves the record parsed, so the splice re-runs the decrypt 2782 * and fails on the record itself; the ctx->async_wait.err check in 2783 * tls_sw_splice_read() is not what stops it. Only an asynchronous 2784 * decrypt, which needs a TLS 1.2 socket and an AEAD advertising 2785 * CRYPTO_ALG_ASYNC, consumes the record before the failure is 2786 * recorded, leaving that check the sole reason the splice fails. 2787 */ 2788 TEST_F(tls_err, bad_auth_splice) 2789 { 2790 char buf[128]; 2791 ssize_t ret; 2792 int p[2]; 2793 2794 if (self->notls) 2795 SKIP(return, "no TLS support"); 2796 2797 tls_send_bad_auth(_metadata, self->fd, self->cfd, self->fd2); 2798 2799 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1); 2800 EXPECT_EQ(errno, EBADMSG); 2801 2802 ASSERT_GE(pipe(p), 0); 2803 2804 ret = splice(self->cfd2, NULL, p[1], NULL, sizeof(buf), 2805 SPLICE_F_NONBLOCK); 2806 EXPECT_EQ(ret, -1); 2807 EXPECT_EQ(errno, EBADMSG); 2808 2809 close(p[0]); 2810 close(p[1]); 2811 } 2812 2813 TEST_F(tls_err, bad_in_large_read) 2814 { 2815 char txt[3][64]; 2816 char cip[3][128]; 2817 char buf[3 * 128]; 2818 int i, n; 2819 2820 if (self->notls) 2821 SKIP(return, "no TLS support"); 2822 2823 /* Put 3 records in the sockets */ 2824 for (i = 0; i < 3; i++) { 2825 memrnd(txt[i], sizeof(txt[i])); 2826 EXPECT_EQ(send(self->fd, txt[i], sizeof(txt[i]), 0), 2827 sizeof(txt[i])); 2828 n = recv(self->cfd, cip[i], sizeof(cip[i]), 0); 2829 EXPECT_GT(n, sizeof(txt[i])); 2830 /* Break the third message */ 2831 if (i == 2) 2832 cip[2][n - 1]++; 2833 EXPECT_EQ(send(self->fd2, cip[i], n, 0), n); 2834 } 2835 2836 /* We should be able to receive the first two messages */ 2837 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), sizeof(txt[0]) * 2); 2838 EXPECT_EQ(memcmp(buf, txt[0], sizeof(txt[0])), 0); 2839 EXPECT_EQ(memcmp(buf + sizeof(txt[0]), txt[1], sizeof(txt[1])), 0); 2840 /* Third mesasge is bad */ 2841 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1); 2842 EXPECT_EQ(errno, EBADMSG); 2843 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1); 2844 EXPECT_EQ(errno, EBADMSG); 2845 } 2846 2847 TEST_F(tls_err, bad_cmsg) 2848 { 2849 char *test_str = "test_read"; 2850 int send_len = 10; 2851 char cip[128]; 2852 char buf[128]; 2853 char txt[64]; 2854 int n; 2855 2856 if (self->notls) 2857 SKIP(return, "no TLS support"); 2858 2859 /* Queue up one data record */ 2860 memrnd(txt, sizeof(txt)); 2861 EXPECT_EQ(send(self->fd, txt, sizeof(txt), 0), sizeof(txt)); 2862 n = recv(self->cfd, cip, sizeof(cip), 0); 2863 EXPECT_GT(n, sizeof(txt)); 2864 EXPECT_EQ(send(self->fd2, cip, n, 0), n); 2865 2866 EXPECT_EQ(tls_send_cmsg(self->fd, 100, test_str, send_len, 0), 10); 2867 n = recv(self->cfd, cip, sizeof(cip), 0); 2868 cip[n - 1]++; /* Break it */ 2869 EXPECT_GT(n, send_len); 2870 EXPECT_EQ(send(self->fd2, cip, n, 0), n); 2871 2872 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), sizeof(txt)); 2873 EXPECT_EQ(memcmp(buf, txt, sizeof(txt)), 0); 2874 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1); 2875 EXPECT_EQ(errno, EBADMSG); 2876 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1); 2877 EXPECT_EQ(errno, EBADMSG); 2878 } 2879 2880 TEST_F(tls_err, timeo) 2881 { 2882 struct timeval tv = { .tv_usec = 10000, }; 2883 char buf[128]; 2884 int ret; 2885 2886 if (self->notls) 2887 SKIP(return, "no TLS support"); 2888 2889 ret = setsockopt(self->cfd2, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)); 2890 ASSERT_EQ(ret, 0); 2891 2892 ret = fork(); 2893 ASSERT_GE(ret, 0); 2894 2895 if (ret) { 2896 usleep(1000); /* Give child a head start */ 2897 2898 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1); 2899 EXPECT_EQ(errno, EAGAIN); 2900 2901 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1); 2902 EXPECT_EQ(errno, EAGAIN); 2903 2904 wait(&ret); 2905 } else { 2906 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1); 2907 EXPECT_EQ(errno, EAGAIN); 2908 exit(0); 2909 } 2910 } 2911 2912 TEST_F(tls_err, poll_partial_rec) 2913 { 2914 struct pollfd pfd = { }; 2915 ssize_t rec_len; 2916 char rec[256]; 2917 char buf[128]; 2918 2919 if (self->notls) 2920 SKIP(return, "no TLS support"); 2921 2922 pfd.fd = self->cfd2; 2923 pfd.events = POLLIN; 2924 EXPECT_EQ(poll(&pfd, 1, 1), 0); 2925 2926 memrnd(buf, sizeof(buf)); 2927 EXPECT_EQ(send(self->fd, buf, sizeof(buf), 0), sizeof(buf)); 2928 rec_len = recv(self->cfd, rec, sizeof(rec), 0); 2929 EXPECT_GT(rec_len, sizeof(buf)); 2930 2931 /* Write 100B, not the full record ... */ 2932 EXPECT_EQ(send(self->fd2, rec, 100, 0), 100); 2933 /* ... no full record should mean no POLLIN */ 2934 pfd.fd = self->cfd2; 2935 pfd.events = POLLIN; 2936 EXPECT_EQ(poll(&pfd, 1, 1), 0); 2937 /* Now write the rest, and it should all pop out of the other end. */ 2938 EXPECT_EQ(send(self->fd2, rec + 100, rec_len - 100, 0), rec_len - 100); 2939 pfd.fd = self->cfd2; 2940 pfd.events = POLLIN; 2941 EXPECT_EQ(poll(&pfd, 1, 1), 1); 2942 EXPECT_EQ(recv(self->cfd2, rec, sizeof(rec), 0), sizeof(buf)); 2943 EXPECT_EQ(memcmp(buf, rec, sizeof(buf)), 0); 2944 } 2945 2946 TEST_F(tls_err, epoll_partial_rec) 2947 { 2948 struct epoll_event ev, events[10]; 2949 ssize_t rec_len; 2950 char rec[256]; 2951 char buf[128]; 2952 int epollfd; 2953 2954 if (self->notls) 2955 SKIP(return, "no TLS support"); 2956 2957 epollfd = epoll_create1(0); 2958 ASSERT_GE(epollfd, 0); 2959 2960 memset(&ev, 0, sizeof(ev)); 2961 ev.events = EPOLLIN; 2962 ev.data.fd = self->cfd2; 2963 ASSERT_GE(epoll_ctl(epollfd, EPOLL_CTL_ADD, self->cfd2, &ev), 0); 2964 2965 EXPECT_EQ(epoll_wait(epollfd, events, 10, 0), 0); 2966 2967 memrnd(buf, sizeof(buf)); 2968 EXPECT_EQ(send(self->fd, buf, sizeof(buf), 0), sizeof(buf)); 2969 rec_len = recv(self->cfd, rec, sizeof(rec), 0); 2970 EXPECT_GT(rec_len, sizeof(buf)); 2971 2972 /* Write 100B, not the full record ... */ 2973 EXPECT_EQ(send(self->fd2, rec, 100, 0), 100); 2974 /* ... no full record should mean no POLLIN */ 2975 EXPECT_EQ(epoll_wait(epollfd, events, 10, 0), 0); 2976 /* Now write the rest, and it should all pop out of the other end. */ 2977 EXPECT_EQ(send(self->fd2, rec + 100, rec_len - 100, 0), rec_len - 100); 2978 EXPECT_EQ(epoll_wait(epollfd, events, 10, 0), 1); 2979 EXPECT_EQ(recv(self->cfd2, rec, sizeof(rec), 0), sizeof(buf)); 2980 EXPECT_EQ(memcmp(buf, rec, sizeof(buf)), 0); 2981 2982 close(epollfd); 2983 } 2984 2985 TEST_F(tls_err, poll_partial_rec_async) 2986 { 2987 struct pollfd pfd = { }; 2988 char token = '\0'; 2989 ssize_t rec_len; 2990 char rec[256]; 2991 char buf[128]; 2992 int p[2]; 2993 int ret; 2994 2995 if (self->notls) 2996 SKIP(return, "no TLS support"); 2997 2998 ASSERT_GE(pipe(p), 0); 2999 3000 memrnd(buf, sizeof(buf)); 3001 EXPECT_EQ(send(self->fd, buf, sizeof(buf), 0), sizeof(buf)); 3002 rec_len = recv(self->cfd, rec, sizeof(rec), 0); 3003 EXPECT_GT(rec_len, sizeof(buf)); 3004 3005 ret = fork(); 3006 ASSERT_GE(ret, 0); 3007 3008 if (ret) { 3009 int status, pid2; 3010 3011 close(p[1]); 3012 usleep(1000); /* Give child a head start */ 3013 3014 EXPECT_EQ(send(self->fd2, rec, 100, 0), 100); 3015 3016 EXPECT_EQ(read(p[0], &token, 1), 1); /* Barrier #1 */ 3017 3018 EXPECT_EQ(send(self->fd2, rec + 100, rec_len - 100, 0), 3019 rec_len - 100); 3020 3021 pid2 = wait(&status); 3022 EXPECT_EQ(pid2, ret); 3023 EXPECT_EQ(status, 0); 3024 } else { 3025 close(p[0]); 3026 3027 /* Child should sleep in poll(), never get a wake */ 3028 pfd.fd = self->cfd2; 3029 pfd.events = POLLIN; 3030 EXPECT_EQ(poll(&pfd, 1, 20), 0); 3031 3032 EXPECT_EQ(write(p[1], &token, 1), 1); /* Barrier #1 */ 3033 3034 pfd.fd = self->cfd2; 3035 pfd.events = POLLIN; 3036 EXPECT_EQ(poll(&pfd, 1, 20), 1); 3037 3038 exit(!__test_passed(_metadata)); 3039 } 3040 } 3041 3042 /* Use OOB+large send to trigger copy mode due to memory pressure. 3043 * OOB causes a short read. 3044 */ 3045 TEST_F(tls_err, oob_pressure) 3046 { 3047 char buf[1<<16]; 3048 int i; 3049 3050 memrnd(buf, sizeof(buf)); 3051 3052 EXPECT_EQ(send(self->fd2, buf, 5, MSG_OOB), 5); 3053 EXPECT_EQ(send(self->fd2, buf, sizeof(buf), 0), sizeof(buf)); 3054 for (i = 0; i < 64; i++) 3055 EXPECT_EQ(send(self->fd2, buf, 5, MSG_OOB), 5); 3056 } 3057 3058 /* 3059 * Parse a stream of TLS records and ensure that each record respects 3060 * the specified @max_payload_len. 3061 */ 3062 static size_t parse_tls_records(struct __test_metadata *_metadata, 3063 const __u8 *rx_buf, int rx_len, int overhead, 3064 __u16 max_payload_len) 3065 { 3066 const __u8 *rec = rx_buf; 3067 size_t total_plaintext_rx = 0; 3068 3069 while (rec < rx_buf + rx_len) { 3070 __u16 record_payload_len; 3071 __u16 plaintext_len; 3072 3073 /* Sanity check that it's a TLS header for application data */ 3074 ASSERT_EQ(rec[0], 23); 3075 ASSERT_EQ(rec[1], 0x3); 3076 ASSERT_EQ(rec[2], 0x3); 3077 3078 memcpy(&record_payload_len, rec + 3, 2); 3079 record_payload_len = ntohs(record_payload_len); 3080 ASSERT_GE(record_payload_len, overhead); 3081 3082 plaintext_len = record_payload_len - overhead; 3083 total_plaintext_rx += plaintext_len; 3084 3085 /* Plaintext must not exceed the specified limit */ 3086 ASSERT_LE(plaintext_len, max_payload_len); 3087 rec += TLS_HDR_LEN + record_payload_len; 3088 } 3089 3090 return total_plaintext_rx; 3091 } 3092 3093 TEST(tls_12_tx_max_payload_len) 3094 { 3095 struct tls_crypto_info_keys tls12; 3096 int cfd, ret, fd, overhead; 3097 size_t total_plaintext_rx = 0; 3098 __u8 tx[1024], rx[2000]; 3099 __u16 limit = 128; 3100 __u16 opt = 0; 3101 unsigned int optlen = sizeof(opt); 3102 bool notls; 3103 3104 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_CCM_128, 3105 &tls12, 0); 3106 3107 ulp_sock_pair(_metadata, &fd, &cfd, ¬ls); 3108 3109 if (notls) 3110 exit(KSFT_SKIP); 3111 3112 /* Don't install keys on fd, we'll parse raw records */ 3113 ret = setsockopt(cfd, SOL_TLS, TLS_TX, &tls12, tls12.len); 3114 ASSERT_EQ(ret, 0); 3115 3116 ret = setsockopt(cfd, SOL_TLS, TLS_TX_MAX_PAYLOAD_LEN, &limit, 3117 sizeof(limit)); 3118 ASSERT_EQ(ret, 0); 3119 3120 ret = getsockopt(cfd, SOL_TLS, TLS_TX_MAX_PAYLOAD_LEN, &opt, &optlen); 3121 EXPECT_EQ(ret, 0); 3122 EXPECT_EQ(limit, opt); 3123 EXPECT_EQ(optlen, sizeof(limit)); 3124 3125 memset(tx, 0, sizeof(tx)); 3126 ASSERT_EQ(send(cfd, tx, sizeof(tx), 0), sizeof(tx)); 3127 close(cfd); 3128 3129 ret = recv(fd, rx, sizeof(rx), 0); 3130 3131 /* 3132 * 16B tag + 8B IV -- record header (5B) is not counted but we'll 3133 * need it to walk the record stream 3134 */ 3135 overhead = 16 + 8; 3136 total_plaintext_rx = parse_tls_records(_metadata, rx, ret, overhead, 3137 limit); 3138 3139 ASSERT_EQ(total_plaintext_rx, sizeof(tx)); 3140 close(fd); 3141 } 3142 3143 TEST(tls_12_tx_max_payload_len_open_rec) 3144 { 3145 struct tls_crypto_info_keys tls12; 3146 int cfd, ret, fd, overhead; 3147 size_t total_plaintext_rx = 0; 3148 __u8 tx[1024], rx[2000]; 3149 __u16 tx_partial = 256; 3150 __u16 og_limit = 512, limit = 128; 3151 bool notls; 3152 3153 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_CCM_128, 3154 &tls12, 0); 3155 3156 ulp_sock_pair(_metadata, &fd, &cfd, ¬ls); 3157 3158 if (notls) 3159 exit(KSFT_SKIP); 3160 3161 /* Don't install keys on fd, we'll parse raw records */ 3162 ret = setsockopt(cfd, SOL_TLS, TLS_TX, &tls12, tls12.len); 3163 ASSERT_EQ(ret, 0); 3164 3165 ret = setsockopt(cfd, SOL_TLS, TLS_TX_MAX_PAYLOAD_LEN, &og_limit, 3166 sizeof(og_limit)); 3167 ASSERT_EQ(ret, 0); 3168 3169 memset(tx, 0, sizeof(tx)); 3170 ASSERT_EQ(send(cfd, tx, tx_partial, MSG_MORE), tx_partial); 3171 3172 /* 3173 * Changing the payload limit with a pending open record should 3174 * not be allowed. 3175 */ 3176 ret = setsockopt(cfd, SOL_TLS, TLS_TX_MAX_PAYLOAD_LEN, &limit, 3177 sizeof(limit)); 3178 ASSERT_EQ(ret, -1); 3179 ASSERT_EQ(errno, EBUSY); 3180 3181 ASSERT_EQ(send(cfd, tx + tx_partial, sizeof(tx) - tx_partial, MSG_EOR), 3182 sizeof(tx) - tx_partial); 3183 close(cfd); 3184 3185 ret = recv(fd, rx, sizeof(rx), 0); 3186 3187 /* 3188 * 16B tag + 8B IV -- record header (5B) is not counted but we'll 3189 * need it to walk the record stream 3190 */ 3191 overhead = 16 + 8; 3192 total_plaintext_rx = parse_tls_records(_metadata, rx, ret, overhead, 3193 og_limit); 3194 ASSERT_EQ(total_plaintext_rx, sizeof(tx)); 3195 close(fd); 3196 } 3197 3198 TEST(non_established) { 3199 struct tls12_crypto_info_aes_gcm_256 tls12; 3200 struct sockaddr_in addr; 3201 int sfd, ret, fd; 3202 socklen_t len; 3203 3204 len = sizeof(addr); 3205 3206 memset(&tls12, 0, sizeof(tls12)); 3207 tls12.info.version = TLS_1_2_VERSION; 3208 tls12.info.cipher_type = TLS_CIPHER_AES_GCM_256; 3209 3210 addr.sin_family = AF_INET; 3211 addr.sin_addr.s_addr = htonl(INADDR_ANY); 3212 addr.sin_port = 0; 3213 3214 fd = socket(AF_INET, SOCK_STREAM, 0); 3215 sfd = socket(AF_INET, SOCK_STREAM, 0); 3216 3217 ret = bind(sfd, &addr, sizeof(addr)); 3218 ASSERT_EQ(ret, 0); 3219 ret = listen(sfd, 10); 3220 ASSERT_EQ(ret, 0); 3221 3222 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")); 3223 EXPECT_EQ(ret, -1); 3224 /* TLS ULP not supported */ 3225 if (errno == ENOENT) 3226 return; 3227 EXPECT_EQ(errno, ENOTCONN); 3228 3229 ret = setsockopt(sfd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")); 3230 EXPECT_EQ(ret, -1); 3231 EXPECT_EQ(errno, ENOTCONN); 3232 3233 ret = getsockname(sfd, &addr, &len); 3234 ASSERT_EQ(ret, 0); 3235 3236 ret = connect(fd, &addr, sizeof(addr)); 3237 ASSERT_EQ(ret, 0); 3238 3239 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")); 3240 ASSERT_EQ(ret, 0); 3241 3242 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")); 3243 EXPECT_EQ(ret, -1); 3244 EXPECT_EQ(errno, EEXIST); 3245 3246 close(fd); 3247 close(sfd); 3248 } 3249 3250 TEST(keysizes) { 3251 struct tls12_crypto_info_aes_gcm_256 tls12; 3252 int ret, fd, cfd; 3253 bool notls; 3254 3255 memset(&tls12, 0, sizeof(tls12)); 3256 tls12.info.version = TLS_1_2_VERSION; 3257 tls12.info.cipher_type = TLS_CIPHER_AES_GCM_256; 3258 3259 ulp_sock_pair(_metadata, &fd, &cfd, ¬ls); 3260 3261 if (!notls) { 3262 ret = setsockopt(fd, SOL_TLS, TLS_TX, &tls12, 3263 sizeof(tls12)); 3264 EXPECT_EQ(ret, 0); 3265 3266 ret = setsockopt(cfd, SOL_TLS, TLS_RX, &tls12, 3267 sizeof(tls12)); 3268 EXPECT_EQ(ret, 0); 3269 } 3270 3271 close(fd); 3272 close(cfd); 3273 } 3274 3275 TEST(no_pad) { 3276 struct tls12_crypto_info_aes_gcm_256 tls12; 3277 int ret, fd, cfd, val; 3278 socklen_t len; 3279 bool notls; 3280 3281 memset(&tls12, 0, sizeof(tls12)); 3282 tls12.info.version = TLS_1_3_VERSION; 3283 tls12.info.cipher_type = TLS_CIPHER_AES_GCM_256; 3284 3285 ulp_sock_pair(_metadata, &fd, &cfd, ¬ls); 3286 3287 if (notls) 3288 exit(KSFT_SKIP); 3289 3290 ret = setsockopt(fd, SOL_TLS, TLS_TX, &tls12, sizeof(tls12)); 3291 EXPECT_EQ(ret, 0); 3292 3293 ret = setsockopt(cfd, SOL_TLS, TLS_RX, &tls12, sizeof(tls12)); 3294 EXPECT_EQ(ret, 0); 3295 3296 val = 1; 3297 ret = setsockopt(cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD, 3298 (void *)&val, sizeof(val)); 3299 EXPECT_EQ(ret, 0); 3300 3301 len = sizeof(val); 3302 val = 2; 3303 ret = getsockopt(cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD, 3304 (void *)&val, &len); 3305 EXPECT_EQ(ret, 0); 3306 EXPECT_EQ(val, 1); 3307 EXPECT_EQ(len, 4); 3308 3309 val = 0; 3310 ret = setsockopt(cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD, 3311 (void *)&val, sizeof(val)); 3312 EXPECT_EQ(ret, 0); 3313 3314 len = sizeof(val); 3315 val = 2; 3316 ret = getsockopt(cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD, 3317 (void *)&val, &len); 3318 EXPECT_EQ(ret, 0); 3319 EXPECT_EQ(val, 0); 3320 EXPECT_EQ(len, 4); 3321 3322 close(fd); 3323 close(cfd); 3324 } 3325 3326 TEST(tls_v6ops) { 3327 struct tls_crypto_info_keys tls12; 3328 struct sockaddr_in6 addr, addr2; 3329 int sfd, ret, fd; 3330 socklen_t len, len2; 3331 3332 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_GCM_128, &tls12, 0); 3333 3334 addr.sin6_family = AF_INET6; 3335 addr.sin6_addr = in6addr_any; 3336 addr.sin6_port = 0; 3337 3338 fd = socket(AF_INET6, SOCK_STREAM, 0); 3339 sfd = socket(AF_INET6, SOCK_STREAM, 0); 3340 3341 ret = bind(sfd, &addr, sizeof(addr)); 3342 ASSERT_EQ(ret, 0); 3343 ret = listen(sfd, 10); 3344 ASSERT_EQ(ret, 0); 3345 3346 len = sizeof(addr); 3347 ret = getsockname(sfd, &addr, &len); 3348 ASSERT_EQ(ret, 0); 3349 3350 ret = connect(fd, &addr, sizeof(addr)); 3351 ASSERT_EQ(ret, 0); 3352 3353 len = sizeof(addr); 3354 ret = getsockname(fd, &addr, &len); 3355 ASSERT_EQ(ret, 0); 3356 3357 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")); 3358 if (ret) { 3359 ASSERT_EQ(errno, ENOENT); 3360 SKIP(return, "no TLS support"); 3361 } 3362 ASSERT_EQ(ret, 0); 3363 3364 ret = setsockopt(fd, SOL_TLS, TLS_TX, &tls12, tls12.len); 3365 ASSERT_EQ(ret, 0); 3366 3367 ret = setsockopt(fd, SOL_TLS, TLS_RX, &tls12, tls12.len); 3368 ASSERT_EQ(ret, 0); 3369 3370 len2 = sizeof(addr2); 3371 ret = getsockname(fd, &addr2, &len2); 3372 ASSERT_EQ(ret, 0); 3373 3374 EXPECT_EQ(len2, len); 3375 EXPECT_EQ(memcmp(&addr, &addr2, len), 0); 3376 3377 close(fd); 3378 close(sfd); 3379 } 3380 3381 TEST(prequeue) { 3382 struct tls_crypto_info_keys tls12; 3383 char buf[20000], buf2[20000]; 3384 struct sockaddr_in addr; 3385 int sfd, cfd, ret, fd; 3386 socklen_t len; 3387 3388 len = sizeof(addr); 3389 memrnd(buf, sizeof(buf)); 3390 3391 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_GCM_256, &tls12, 0); 3392 3393 addr.sin_family = AF_INET; 3394 addr.sin_addr.s_addr = htonl(INADDR_ANY); 3395 addr.sin_port = 0; 3396 3397 fd = socket(AF_INET, SOCK_STREAM, 0); 3398 sfd = socket(AF_INET, SOCK_STREAM, 0); 3399 3400 ASSERT_EQ(bind(sfd, &addr, sizeof(addr)), 0); 3401 ASSERT_EQ(listen(sfd, 10), 0); 3402 ASSERT_EQ(getsockname(sfd, &addr, &len), 0); 3403 ASSERT_EQ(connect(fd, &addr, sizeof(addr)), 0); 3404 ASSERT_GE(cfd = accept(sfd, &addr, &len), 0); 3405 close(sfd); 3406 3407 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")); 3408 if (ret) { 3409 ASSERT_EQ(errno, ENOENT); 3410 SKIP(return, "no TLS support"); 3411 } 3412 3413 ASSERT_EQ(setsockopt(fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0); 3414 EXPECT_EQ(send(fd, buf, sizeof(buf), MSG_DONTWAIT), sizeof(buf)); 3415 3416 ASSERT_EQ(setsockopt(cfd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")), 0); 3417 ASSERT_EQ(setsockopt(cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0); 3418 EXPECT_EQ(recv(cfd, buf2, sizeof(buf2), MSG_WAITALL), sizeof(buf2)); 3419 3420 EXPECT_EQ(memcmp(buf, buf2, sizeof(buf)), 0); 3421 3422 close(fd); 3423 close(cfd); 3424 } 3425 3426 TEST(data_steal) { 3427 struct tls_crypto_info_keys tls; 3428 char buf[20000], buf2[20000]; 3429 struct sockaddr_in addr; 3430 int sfd, cfd, ret, fd; 3431 int pid, status; 3432 socklen_t len; 3433 3434 len = sizeof(addr); 3435 memrnd(buf, sizeof(buf)); 3436 3437 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_GCM_256, &tls, 0); 3438 3439 addr.sin_family = AF_INET; 3440 addr.sin_addr.s_addr = htonl(INADDR_ANY); 3441 addr.sin_port = 0; 3442 3443 fd = socket(AF_INET, SOCK_STREAM, 0); 3444 sfd = socket(AF_INET, SOCK_STREAM, 0); 3445 3446 ASSERT_EQ(bind(sfd, &addr, sizeof(addr)), 0); 3447 ASSERT_EQ(listen(sfd, 10), 0); 3448 ASSERT_EQ(getsockname(sfd, &addr, &len), 0); 3449 ASSERT_EQ(connect(fd, &addr, sizeof(addr)), 0); 3450 ASSERT_GE(cfd = accept(sfd, &addr, &len), 0); 3451 close(sfd); 3452 3453 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")); 3454 if (ret) { 3455 ASSERT_EQ(errno, ENOENT); 3456 SKIP(return, "no TLS support"); 3457 } 3458 ASSERT_EQ(setsockopt(cfd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")), 0); 3459 3460 /* Spawn a child and get it into the read wait path of the underlying 3461 * TCP socket (before kernel .recvmsg is replaced with the TLS one). 3462 */ 3463 pid = fork(); 3464 ASSERT_GE(pid, 0); 3465 if (!pid) { 3466 EXPECT_EQ(recv(cfd, buf, sizeof(buf) / 2 + 1, MSG_WAITALL), 3467 sizeof(buf) / 2 + 1); 3468 exit(!__test_passed(_metadata)); 3469 } 3470 3471 /* Send a sync byte and poll until it's consumed to ensure 3472 * the child is in recv() before we proceed to install TLS. 3473 */ 3474 ASSERT_EQ(send(fd, buf, 1, 0), 1); 3475 do { 3476 usleep(500); 3477 } while (recv(cfd, buf, 1, MSG_PEEK | MSG_DONTWAIT) == 1); 3478 EXPECT_EQ(errno, EAGAIN); 3479 3480 ASSERT_EQ(setsockopt(fd, SOL_TLS, TLS_TX, &tls, tls.len), 0); 3481 ASSERT_EQ(setsockopt(cfd, SOL_TLS, TLS_RX, &tls, tls.len), 0); 3482 3483 EXPECT_EQ(send(fd, buf, sizeof(buf), 0), sizeof(buf)); 3484 EXPECT_EQ(wait(&status), pid); 3485 EXPECT_EQ(status, 0); 3486 EXPECT_EQ(recv(cfd, buf2, sizeof(buf2), MSG_DONTWAIT), -1); 3487 /* Don't check errno, the error will be different depending 3488 * on what random bytes TLS interpreted as the record length. 3489 */ 3490 3491 close(fd); 3492 close(cfd); 3493 } 3494 3495 static void __attribute__((constructor)) fips_check(void) { 3496 int res; 3497 FILE *f; 3498 3499 f = fopen("/proc/sys/crypto/fips_enabled", "r"); 3500 if (f) { 3501 res = fscanf(f, "%d", &fips_enabled); 3502 if (res != 1) 3503 ksft_print_msg("ERROR: Couldn't read /proc/sys/crypto/fips_enabled\n"); 3504 fclose(f); 3505 } 3506 } 3507 3508 TEST_HARNESS_MAIN 3509