461 lines · c
1// SPDX-License-Identifier: GPL-2.02/*3 * The test checks that both active and passive reset have correct TCP-AO4 * signature. An "active" reset (abort) here is procured from closing5 * listen() socket with non-accepted connections in the queue:6 * inet_csk_listen_stop() => inet_child_forget() =>7 * => tcp_disconnect() => tcp_send_active_reset()8 *9 * The passive reset is quite hard to get on established TCP connections.10 * It could be procured from non-established states, but the synchronization11 * part from userspace in order to reliably get RST seems uneasy.12 * So, instead it's procured by corrupting SEQ number on TIMED-WAIT state.13 *14 * It's important to test both passive and active RST as they go through15 * different code-paths:16 * - tcp_send_active_reset() makes no-data skb, sends it with tcp_transmit_skb()17 * - tcp_v*_send_reset() create their reply skbs and send them with18 * ip_send_unicast_reply()19 *20 * In both cases TCP-AO signatures have to be correct, which is verified by21 * (1) checking that the TCP-AO connection was reset and (2) TCP-AO counters.22 *23 * Author: Dmitry Safonov <dima@arista.com>24 */25#include <inttypes.h>26#include "../../../../include/linux/kernel.h"27#include "aolib.h"28 29const size_t quota = 1000;30const size_t packet_sz = 100;31/*32 * Backlog == 0 means 1 connection in queue, see:33 * commit 64a146513f8f ("[NET]: Revert incorrect accept queue...")34 */35const unsigned int backlog;36 37static void netstats_check(struct netstat *before, struct netstat *after,38 char *msg)39{40 uint64_t before_cnt, after_cnt;41 42 before_cnt = netstat_get(before, "TCPAORequired", NULL);43 after_cnt = netstat_get(after, "TCPAORequired", NULL);44 if (after_cnt > before_cnt)45 test_fail("Segments without AO sign (%s): %" PRIu64 " => %" PRIu64,46 msg, before_cnt, after_cnt);47 else48 test_ok("No segments without AO sign (%s)", msg);49 50 before_cnt = netstat_get(before, "TCPAOGood", NULL);51 after_cnt = netstat_get(after, "TCPAOGood", NULL);52 if (after_cnt <= before_cnt)53 test_fail("Signed AO segments (%s): %" PRIu64 " => %" PRIu64,54 msg, before_cnt, after_cnt);55 else56 test_ok("Signed AO segments (%s): %" PRIu64 " => %" PRIu64,57 msg, before_cnt, after_cnt);58 59 before_cnt = netstat_get(before, "TCPAOBad", NULL);60 after_cnt = netstat_get(after, "TCPAOBad", NULL);61 if (after_cnt > before_cnt)62 test_fail("Segments with bad AO sign (%s): %" PRIu64 " => %" PRIu64,63 msg, before_cnt, after_cnt);64 else65 test_ok("No segments with bad AO sign (%s)", msg);66}67 68/*69 * Another way to send RST, but not through tcp_v{4,6}_send_reset()70 * is tcp_send_active_reset(), that is not in reply to inbound segment,71 * but rather active send. It uses tcp_transmit_skb(), so that should72 * work, but as it also sends RST - nice that it can be covered as well.73 */74static void close_forced(int sk)75{76 struct linger sl;77 78 sl.l_onoff = 1;79 sl.l_linger = 0;80 if (setsockopt(sk, SOL_SOCKET, SO_LINGER, &sl, sizeof(sl)))81 test_error("setsockopt(SO_LINGER)");82 close(sk);83}84 85static void test_server_active_rst(unsigned int port)86{87 struct tcp_ao_counters cnt1, cnt2;88 ssize_t bytes;89 int sk, lsk;90 91 lsk = test_listen_socket(this_ip_addr, port, backlog);92 if (test_add_key(lsk, DEFAULT_TEST_PASSWORD, this_ip_dest, -1, 100, 100))93 test_error("setsockopt(TCP_AO_ADD_KEY)");94 if (test_get_tcp_ao_counters(lsk, &cnt1))95 test_error("test_get_tcp_ao_counters()");96 97 synchronize_threads(); /* 1: MKT added */98 if (test_wait_fd(lsk, TEST_TIMEOUT_SEC, 0))99 test_error("test_wait_fd()");100 101 sk = accept(lsk, NULL, NULL);102 if (sk < 0)103 test_error("accept()");104 105 synchronize_threads(); /* 2: connection accept()ed, another queued */106 if (test_get_tcp_ao_counters(lsk, &cnt2))107 test_error("test_get_tcp_ao_counters()");108 109 synchronize_threads(); /* 3: close listen socket */110 close(lsk);111 bytes = test_server_run(sk, quota, 0);112 if (bytes != quota)113 test_error("servered only %zd bytes", bytes);114 else115 test_ok("servered %zd bytes", bytes);116 117 synchronize_threads(); /* 4: finishing up */118 close_forced(sk);119 120 synchronize_threads(); /* 5: closed active sk */121 122 synchronize_threads(); /* 6: counters checks */123 if (test_tcp_ao_counters_cmp("active RST server", &cnt1, &cnt2, TEST_CNT_GOOD))124 test_fail("MKT counters (server) have not only good packets");125 else126 test_ok("MKT counters are good on server");127}128 129static void test_server_passive_rst(unsigned int port)130{131 struct tcp_ao_counters ao1, ao2;132 int sk, lsk;133 ssize_t bytes;134 135 lsk = test_listen_socket(this_ip_addr, port, 1);136 137 if (test_add_key(lsk, DEFAULT_TEST_PASSWORD, this_ip_dest, -1, 100, 100))138 test_error("setsockopt(TCP_AO_ADD_KEY)");139 140 synchronize_threads(); /* 1: MKT added => connect() */141 if (test_wait_fd(lsk, TEST_TIMEOUT_SEC, 0))142 test_error("test_wait_fd()");143 144 sk = accept(lsk, NULL, NULL);145 if (sk < 0)146 test_error("accept()");147 148 synchronize_threads(); /* 2: accepted => send data */149 close(lsk);150 if (test_get_tcp_ao_counters(sk, &ao1))151 test_error("test_get_tcp_ao_counters()");152 153 bytes = test_server_run(sk, quota, TEST_TIMEOUT_SEC);154 if (bytes != quota) {155 if (bytes > 0)156 test_fail("server served: %zd", bytes);157 else158 test_fail("server returned %zd", bytes);159 }160 161 synchronize_threads(); /* 3: checkpoint the client */162 synchronize_threads(); /* 4: close the server, creating twsk */163 if (test_get_tcp_ao_counters(sk, &ao2))164 test_error("test_get_tcp_ao_counters()");165 close(sk);166 167 synchronize_threads(); /* 5: restore the socket, send more data */168 test_tcp_ao_counters_cmp("passive RST server", &ao1, &ao2, TEST_CNT_GOOD);169 170 synchronize_threads(); /* 6: server exits */171}172 173static void *server_fn(void *arg)174{175 struct netstat *ns_before, *ns_after;176 unsigned int port = test_server_port;177 178 ns_before = netstat_read();179 180 test_server_active_rst(port++);181 test_server_passive_rst(port++);182 183 ns_after = netstat_read();184 netstats_check(ns_before, ns_after, "server");185 netstat_free(ns_after);186 netstat_free(ns_before);187 synchronize_threads(); /* exit */188 189 synchronize_threads(); /* don't race to exit() - client exits */190 return NULL;191}192 193static int test_wait_fds(int sk[], size_t nr, bool is_writable[],194 ssize_t wait_for, time_t sec)195{196 struct timeval tv = { .tv_sec = sec };197 struct timeval *ptv = NULL;198 fd_set left;199 size_t i;200 int ret;201 202 FD_ZERO(&left);203 for (i = 0; i < nr; i++) {204 FD_SET(sk[i], &left);205 if (is_writable)206 is_writable[i] = false;207 }208 209 if (sec)210 ptv = &tv;211 212 do {213 bool is_empty = true;214 fd_set fds, efds;215 int nfd = 0;216 217 FD_ZERO(&fds);218 FD_ZERO(&efds);219 for (i = 0; i < nr; i++) {220 if (!FD_ISSET(sk[i], &left))221 continue;222 223 if (sk[i] > nfd)224 nfd = sk[i];225 226 FD_SET(sk[i], &fds);227 FD_SET(sk[i], &efds);228 is_empty = false;229 }230 if (is_empty)231 return -ENOENT;232 233 errno = 0;234 ret = select(nfd + 1, NULL, &fds, &efds, ptv);235 if (ret < 0)236 return -errno;237 if (!ret)238 return -ETIMEDOUT;239 for (i = 0; i < nr; i++) {240 if (FD_ISSET(sk[i], &fds)) {241 if (is_writable)242 is_writable[i] = true;243 FD_CLR(sk[i], &left);244 wait_for--;245 continue;246 }247 if (FD_ISSET(sk[i], &efds)) {248 FD_CLR(sk[i], &left);249 wait_for--;250 }251 }252 } while (wait_for > 0);253 254 return 0;255}256 257static void test_client_active_rst(unsigned int port)258{259 int i, sk[3], err;260 bool is_writable[ARRAY_SIZE(sk)] = {false};261 unsigned int last = ARRAY_SIZE(sk) - 1;262 263 for (i = 0; i < ARRAY_SIZE(sk); i++) {264 sk[i] = socket(test_family, SOCK_STREAM, IPPROTO_TCP);265 if (sk[i] < 0)266 test_error("socket()");267 if (test_add_key(sk[i], DEFAULT_TEST_PASSWORD,268 this_ip_dest, -1, 100, 100))269 test_error("setsockopt(TCP_AO_ADD_KEY)");270 }271 272 synchronize_threads(); /* 1: MKT added */273 for (i = 0; i < last; i++) {274 err = _test_connect_socket(sk[i], this_ip_dest, port,275 (i == 0) ? TEST_TIMEOUT_SEC : -1);276 if (err < 0)277 test_error("failed to connect()");278 }279 280 synchronize_threads(); /* 2: two connections: one accept()ed, another queued */281 err = test_wait_fds(sk, last, is_writable, last, TEST_TIMEOUT_SEC);282 if (err < 0)283 test_error("test_wait_fds(): %d", err);284 285 /* async connect() with third sk to get into request_sock_queue */286 err = _test_connect_socket(sk[last], this_ip_dest, port, -1);287 if (err < 0)288 test_error("failed to connect()");289 290 synchronize_threads(); /* 3: close listen socket */291 if (test_client_verify(sk[0], packet_sz, quota / packet_sz, TEST_TIMEOUT_SEC))292 test_fail("Failed to send data on connected socket");293 else294 test_ok("Verified established tcp connection");295 296 synchronize_threads(); /* 4: finishing up */297 298 synchronize_threads(); /* 5: closed active sk */299 /*300 * Wait for 2 connections: one accepted, another in the accept queue,301 * the one in request_sock_queue won't get fully established, so302 * doesn't receive an active RST, see inet_csk_listen_stop().303 */304 err = test_wait_fds(sk, last, NULL, last, TEST_TIMEOUT_SEC);305 if (err < 0)306 test_error("select(): %d", err);307 308 for (i = 0; i < ARRAY_SIZE(sk); i++) {309 socklen_t slen = sizeof(err);310 311 if (getsockopt(sk[i], SOL_SOCKET, SO_ERROR, &err, &slen))312 test_error("getsockopt()");313 if (is_writable[i] && err != ECONNRESET) {314 test_fail("sk[%d] = %d, err = %d, connection wasn't reset",315 i, sk[i], err);316 } else {317 test_ok("sk[%d] = %d%s", i, sk[i],318 is_writable[i] ? ", connection was reset" : "");319 }320 }321 synchronize_threads(); /* 6: counters checks */322}323 324static void test_client_passive_rst(unsigned int port)325{326 struct tcp_ao_counters ao1, ao2;327 struct tcp_ao_repair ao_img;328 struct tcp_sock_state img;329 sockaddr_af saddr;330 int sk, err;331 332 sk = socket(test_family, SOCK_STREAM, IPPROTO_TCP);333 if (sk < 0)334 test_error("socket()");335 336 if (test_add_key(sk, DEFAULT_TEST_PASSWORD, this_ip_dest, -1, 100, 100))337 test_error("setsockopt(TCP_AO_ADD_KEY)");338 339 synchronize_threads(); /* 1: MKT added => connect() */340 if (test_connect_socket(sk, this_ip_dest, port) <= 0)341 test_error("failed to connect()");342 343 synchronize_threads(); /* 2: accepted => send data */344 if (test_client_verify(sk, packet_sz, quota / packet_sz, TEST_TIMEOUT_SEC))345 test_fail("Failed to send data on connected socket");346 else347 test_ok("Verified established tcp connection");348 349 synchronize_threads(); /* 3: checkpoint the client */350 test_enable_repair(sk);351 test_sock_checkpoint(sk, &img, &saddr);352 test_ao_checkpoint(sk, &ao_img);353 test_disable_repair(sk);354 355 synchronize_threads(); /* 4: close the server, creating twsk */356 357 /*358 * The "corruption" in SEQ has to be small enough to fit into TCP359 * window, see tcp_timewait_state_process() for out-of-window360 * segments.361 */362 img.out.seq += 5; /* 5 is more noticeable in tcpdump than 1 */363 364 /*365 * FIXME: This is kind-of ugly and dirty, but it works.366 *367 * At this moment, the server has close'ed(sk).368 * The passive RST that is being targeted here is new data after369 * half-duplex close, see tcp_timewait_state_process() => TCP_TW_RST370 *371 * What is needed here is:372 * (1) wait for FIN from the server373 * (2) make sure that the ACK from the client went out374 * (3) make sure that the ACK was received and processed by the server375 *376 * Otherwise, the data that will be sent from "repaired" socket377 * post SEQ corruption may get to the server before it's in378 * TCP_FIN_WAIT2.379 *380 * (1) is easy with select()/poll()381 * (2) is possible by polling tcpi_state from TCP_INFO382 * (3) is quite complex: as server's socket was already closed,383 * probably the way to do it would be tcp-diag.384 */385 sleep(TEST_RETRANSMIT_SEC);386 387 synchronize_threads(); /* 5: restore the socket, send more data */388 test_kill_sk(sk);389 390 sk = socket(test_family, SOCK_STREAM, IPPROTO_TCP);391 if (sk < 0)392 test_error("socket()");393 394 test_enable_repair(sk);395 test_sock_restore(sk, &img, &saddr, this_ip_dest, port);396 if (test_add_repaired_key(sk, DEFAULT_TEST_PASSWORD, 0, this_ip_dest, -1, 100, 100))397 test_error("setsockopt(TCP_AO_ADD_KEY)");398 test_ao_restore(sk, &ao_img);399 400 if (test_get_tcp_ao_counters(sk, &ao1))401 test_error("test_get_tcp_ao_counters()");402 403 test_disable_repair(sk);404 test_sock_state_free(&img);405 406 /*407 * This is how "passive reset" is acquired in this test from TCP_TW_RST:408 *409 * IP 10.0.254.1.7011 > 10.0.1.1.59772: Flags [P.], seq 901:1001, ack 1001, win 249,410 * options [tcp-ao keyid 100 rnextkeyid 100 mac 0x10217d6c36a22379086ef3b1], length 100411 * IP 10.0.254.1.7011 > 10.0.1.1.59772: Flags [F.], seq 1001, ack 1001, win 249,412 * options [tcp-ao keyid 100 rnextkeyid 100 mac 0x104ffc99b98c10a5298cc268], length 0413 * IP 10.0.1.1.59772 > 10.0.254.1.7011: Flags [.], ack 1002, win 251,414 * options [tcp-ao keyid 100 rnextkeyid 100 mac 0xe496dd4f7f5a8a66873c6f93,nop,nop,sack 1 {1001:1002}], length 0415 * IP 10.0.1.1.59772 > 10.0.254.1.7011: Flags [P.], seq 1006:1106, ack 1001, win 251,416 * options [tcp-ao keyid 100 rnextkeyid 100 mac 0x1b5f3330fb23fbcd0c77d0ca], length 100417 * IP 10.0.254.1.7011 > 10.0.1.1.59772: Flags [R], seq 3215596252, win 0,418 * options [tcp-ao keyid 100 rnextkeyid 100 mac 0x0bcfbbf497bce844312304b2], length 0419 */420 err = test_client_verify(sk, packet_sz, quota / packet_sz, 2 * TEST_TIMEOUT_SEC);421 /* Make sure that the connection was reset, not timeouted */422 if (err && err == -ECONNRESET)423 test_ok("client sock was passively reset post-seq-adjust");424 else if (err)425 test_fail("client sock was not reset post-seq-adjust: %d", err);426 else427 test_fail("client sock is yet connected post-seq-adjust");428 429 if (test_get_tcp_ao_counters(sk, &ao2))430 test_error("test_get_tcp_ao_counters()");431 432 synchronize_threads(); /* 6: server exits */433 close(sk);434 test_tcp_ao_counters_cmp("client passive RST", &ao1, &ao2, TEST_CNT_GOOD);435}436 437static void *client_fn(void *arg)438{439 struct netstat *ns_before, *ns_after;440 unsigned int port = test_server_port;441 442 ns_before = netstat_read();443 444 test_client_active_rst(port++);445 test_client_passive_rst(port++);446 447 ns_after = netstat_read();448 netstats_check(ns_before, ns_after, "client");449 netstat_free(ns_after);450 netstat_free(ns_before);451 452 synchronize_threads(); /* exit */453 return NULL;454}455 456int main(int argc, char *argv[])457{458 test_init(15, server_fn, client_fn);459 return 0;460}461