projects/linux·blob master · refs

3508 lines · 88.0 KiB

1// SPDX-License-Identifier: GPL-2.0
2
3#define _GNU_SOURCE
4
5#include <arpa/inet.h>
6#include <errno.h>
7#include <error.h>
8#include <fcntl.h>
9#include <poll.h>
10#include <stdio.h>
11#include <stdlib.h>
12#include <unistd.h>
13
14#include <linux/tls.h>
15#include <linux/tcp.h>
16#include <linux/socket.h>
17
18#include <sys/epoll.h>
19#include <sys/types.h>
20#include <sys/sendfile.h>
21#include <sys/socket.h>
22#include <sys/stat.h>
23
24#include "kselftest_harness.h"
25
26#define TLS_PAYLOAD_MAX_LEN 16384
27#define TLS_HDR_LEN 5
28#define SOL_TLS 282
29
30static int fips_enabled;
31
32struct tls_crypto_info_keys {
33 union {
34 struct tls_crypto_info crypto_info;
35 struct tls12_crypto_info_aes_gcm_128 aes128;
36 struct tls12_crypto_info_chacha20_poly1305 chacha20;
37 struct tls12_crypto_info_sm4_gcm sm4gcm;
38 struct tls12_crypto_info_sm4_ccm sm4ccm;
39 struct tls12_crypto_info_aes_ccm_128 aesccm128;
40 struct tls12_crypto_info_aes_gcm_256 aesgcm256;
41 struct tls12_crypto_info_aria_gcm_128 ariagcm128;
42 struct tls12_crypto_info_aria_gcm_256 ariagcm256;
43 };
44 size_t len;
45};
46
47static void tls_crypto_info_init(uint16_t tls_version, uint16_t cipher_type,
48 struct tls_crypto_info_keys *tls12,
49 char key_generation)
50{
51 memset(tls12, key_generation, sizeof(*tls12));
52 memset(tls12, 0, sizeof(struct tls_crypto_info));
53
54 switch (cipher_type) {
55 case TLS_CIPHER_CHACHA20_POLY1305:
56 tls12->len = sizeof(struct tls12_crypto_info_chacha20_poly1305);
57 tls12->chacha20.info.version = tls_version;
58 tls12->chacha20.info.cipher_type = cipher_type;
59 break;
60 case TLS_CIPHER_AES_GCM_128:
61 tls12->len = sizeof(struct tls12_crypto_info_aes_gcm_128);
62 tls12->aes128.info.version = tls_version;
63 tls12->aes128.info.cipher_type = cipher_type;
64 break;
65 case TLS_CIPHER_SM4_GCM:
66 tls12->len = sizeof(struct tls12_crypto_info_sm4_gcm);
67 tls12->sm4gcm.info.version = tls_version;
68 tls12->sm4gcm.info.cipher_type = cipher_type;
69 break;
70 case TLS_CIPHER_SM4_CCM:
71 tls12->len = sizeof(struct tls12_crypto_info_sm4_ccm);
72 tls12->sm4ccm.info.version = tls_version;
73 tls12->sm4ccm.info.cipher_type = cipher_type;
74 break;
75 case TLS_CIPHER_AES_CCM_128:
76 tls12->len = sizeof(struct tls12_crypto_info_aes_ccm_128);
77 tls12->aesccm128.info.version = tls_version;
78 tls12->aesccm128.info.cipher_type = cipher_type;
79 break;
80 case TLS_CIPHER_AES_GCM_256:
81 tls12->len = sizeof(struct tls12_crypto_info_aes_gcm_256);
82 tls12->aesgcm256.info.version = tls_version;
83 tls12->aesgcm256.info.cipher_type = cipher_type;
84 break;
85 case TLS_CIPHER_ARIA_GCM_128:
86 tls12->len = sizeof(struct tls12_crypto_info_aria_gcm_128);
87 tls12->ariagcm128.info.version = tls_version;
88 tls12->ariagcm128.info.cipher_type = cipher_type;
89 break;
90 case TLS_CIPHER_ARIA_GCM_256:
91 tls12->len = sizeof(struct tls12_crypto_info_aria_gcm_256);
92 tls12->ariagcm256.info.version = tls_version;
93 tls12->ariagcm256.info.cipher_type = cipher_type;
94 break;
95 default:
96 break;
97 }
98}
99
100static void memrnd(void *s, size_t n)
101{
102 int *dword = s;
103 char *byte;
104
105 for (; n >= 4; n -= 4)
106 *dword++ = rand();
107 byte = (void *)dword;
108 while (n--)
109 *byte++ = rand();
110}
111
112static void ulp_sock_pair(struct __test_metadata *_metadata,
113 int *fd, int *cfd, bool *notls)
114{
115 struct sockaddr_in addr;
116 socklen_t len;
117 int sfd, ret;
118
119 *notls = false;
120 len = sizeof(addr);
121
122 addr.sin_family = AF_INET;
123 addr.sin_addr.s_addr = htonl(INADDR_ANY);
124 addr.sin_port = 0;
125
126 *fd = socket(AF_INET, SOCK_STREAM, 0);
127 sfd = socket(AF_INET, SOCK_STREAM, 0);
128
129 ret = bind(sfd, &addr, sizeof(addr));
130 ASSERT_EQ(ret, 0);
131 ret = listen(sfd, 10);
132 ASSERT_EQ(ret, 0);
133
134 ret = getsockname(sfd, &addr, &len);
135 ASSERT_EQ(ret, 0);
136
137 ret = connect(*fd, &addr, sizeof(addr));
138 ASSERT_EQ(ret, 0);
139
140 *cfd = accept(sfd, &addr, &len);
141 ASSERT_GE(*cfd, 0);
142
143 close(sfd);
144
145 ret = setsockopt(*fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
146 if (ret != 0) {
147 ASSERT_EQ(errno, ENOENT);
148 *notls = true;
149 printf("Failure setting TCP_ULP, testing without tls\n");
150 return;
151 }
152
153 ret = setsockopt(*cfd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
154 ASSERT_EQ(ret, 0);
155}
156
157/* Produce a basic cmsg */
158static int tls_send_cmsg(int fd, unsigned char record_type,
159 void *data, size_t len, int flags)
160{
161 char cbuf[CMSG_SPACE(sizeof(char))];
162 int cmsg_len = sizeof(char);
163 struct cmsghdr *cmsg;
164 struct msghdr msg;
165 struct iovec vec;
166
167 vec.iov_base = data;
168 vec.iov_len = len;
169 memset(&msg, 0, sizeof(struct msghdr));
170 msg.msg_iov = &vec;
171 msg.msg_iovlen = 1;
172 msg.msg_control = cbuf;
173 msg.msg_controllen = sizeof(cbuf);
174 cmsg = CMSG_FIRSTHDR(&msg);
175 cmsg->cmsg_level = SOL_TLS;
176 /* test sending non-record types. */
177 cmsg->cmsg_type = TLS_SET_RECORD_TYPE;
178 cmsg->cmsg_len = CMSG_LEN(cmsg_len);
179 *CMSG_DATA(cmsg) = record_type;
180 msg.msg_controllen = cmsg->cmsg_len;
181
182 return sendmsg(fd, &msg, flags);
183}
184
185static int __tls_recv_cmsg(struct __test_metadata *_metadata,
186 int fd, unsigned char *ctype,
187 void *data, size_t len, int flags)
188{
189 char cbuf[CMSG_SPACE(sizeof(char))];
190 struct cmsghdr *cmsg;
191 struct msghdr msg;
192 struct iovec vec;
193 int n;
194
195 vec.iov_base = data;
196 vec.iov_len = len;
197 memset(&msg, 0, sizeof(struct msghdr));
198 msg.msg_iov = &vec;
199 msg.msg_iovlen = 1;
200 msg.msg_control = cbuf;
201 msg.msg_controllen = sizeof(cbuf);
202
203 n = recvmsg(fd, &msg, flags);
204
205 cmsg = CMSG_FIRSTHDR(&msg);
206 EXPECT_NE(cmsg, NULL);
207 EXPECT_EQ(cmsg->cmsg_level, SOL_TLS);
208 EXPECT_EQ(cmsg->cmsg_type, TLS_GET_RECORD_TYPE);
209 if (ctype)
210 *ctype = *((unsigned char *)CMSG_DATA(cmsg));
211
212 return n;
213}
214
215static int tls_recv_cmsg(struct __test_metadata *_metadata,
216 int fd, unsigned char record_type,
217 void *data, size_t len, int flags)
218{
219 unsigned char ctype;
220 int n;
221
222 n = __tls_recv_cmsg(_metadata, fd, &ctype, data, len, flags);
223 EXPECT_EQ(ctype, record_type);
224
225 return n;
226}
227
228FIXTURE(tls_basic)
229{
230 int fd, cfd;
231 bool notls;
232};
233
234FIXTURE_SETUP(tls_basic)
235{
236 ulp_sock_pair(_metadata, &self->fd, &self->cfd, &self->notls);
237}
238
239FIXTURE_TEARDOWN(tls_basic)
240{
241 close(self->fd);
242 close(self->cfd);
243}
244
245/* Send some data through with ULP but no keys */
246TEST_F(tls_basic, base_base)
247{
248 char const *test_str = "test_read";
249 int send_len = 10;
250 char buf[10];
251
252 ASSERT_EQ(strlen(test_str) + 1, send_len);
253
254 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
255 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1);
256 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
257};
258
259TEST_F(tls_basic, bad_cipher)
260{
261 struct tls_crypto_info_keys tls12;
262
263 tls12.crypto_info.version = 200;
264 tls12.crypto_info.cipher_type = TLS_CIPHER_AES_GCM_128;
265 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, sizeof(struct tls12_crypto_info_aes_gcm_128)), -1);
266
267 tls12.crypto_info.version = TLS_1_2_VERSION;
268 tls12.crypto_info.cipher_type = 50;
269 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, sizeof(struct tls12_crypto_info_aes_gcm_128)), -1);
270
271 tls12.crypto_info.version = TLS_1_2_VERSION;
272 tls12.crypto_info.cipher_type = 59;
273 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, sizeof(struct tls12_crypto_info_aes_gcm_128)), -1);
274
275 tls12.crypto_info.version = TLS_1_2_VERSION;
276 tls12.crypto_info.cipher_type = 10;
277 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, sizeof(struct tls12_crypto_info_aes_gcm_128)), -1);
278
279 tls12.crypto_info.version = TLS_1_2_VERSION;
280 tls12.crypto_info.cipher_type = 70;
281 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, sizeof(struct tls12_crypto_info_aes_gcm_128)), -1);
282}
283
284TEST_F(tls_basic, recseq_wrap)
285{
286 struct tls_crypto_info_keys tls12;
287 char const *test_str = "test_read";
288 int send_len = 10;
289
290 if (self->notls)
291 SKIP(return, "no TLS support");
292
293 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_GCM_128, &tls12, 0);
294 memset(&tls12.aes128.rec_seq, 0xff, sizeof(tls12.aes128.rec_seq));
295
296 ASSERT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
297 ASSERT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
298
299 EXPECT_EQ(send(self->fd, test_str, send_len, 0), -1);
300 EXPECT_EQ(errno, EBADMSG);
301}
302
303FIXTURE(tls)
304{
305 int fd, cfd;
306 bool notls;
307};
308
309FIXTURE_VARIANT(tls)
310{
311 uint16_t tls_version;
312 uint16_t cipher_type;
313 bool nopad, fips_non_compliant;
314};
315
316FIXTURE_VARIANT_ADD(tls, 12_aes_gcm)
317{
318 .tls_version = TLS_1_2_VERSION,
319 .cipher_type = TLS_CIPHER_AES_GCM_128,
320};
321
322FIXTURE_VARIANT_ADD(tls, 13_aes_gcm)
323{
324 .tls_version = TLS_1_3_VERSION,
325 .cipher_type = TLS_CIPHER_AES_GCM_128,
326};
327
328FIXTURE_VARIANT_ADD(tls, 12_chacha)
329{
330 .tls_version = TLS_1_2_VERSION,
331 .cipher_type = TLS_CIPHER_CHACHA20_POLY1305,
332 .fips_non_compliant = true,
333};
334
335FIXTURE_VARIANT_ADD(tls, 13_chacha)
336{
337 .tls_version = TLS_1_3_VERSION,
338 .cipher_type = TLS_CIPHER_CHACHA20_POLY1305,
339 .fips_non_compliant = true,
340};
341
342FIXTURE_VARIANT_ADD(tls, 13_sm4_gcm)
343{
344 .tls_version = TLS_1_3_VERSION,
345 .cipher_type = TLS_CIPHER_SM4_GCM,
346 .fips_non_compliant = true,
347};
348
349FIXTURE_VARIANT_ADD(tls, 13_sm4_ccm)
350{
351 .tls_version = TLS_1_3_VERSION,
352 .cipher_type = TLS_CIPHER_SM4_CCM,
353 .fips_non_compliant = true,
354};
355
356FIXTURE_VARIANT_ADD(tls, 12_aes_ccm)
357{
358 .tls_version = TLS_1_2_VERSION,
359 .cipher_type = TLS_CIPHER_AES_CCM_128,
360};
361
362FIXTURE_VARIANT_ADD(tls, 13_aes_ccm)
363{
364 .tls_version = TLS_1_3_VERSION,
365 .cipher_type = TLS_CIPHER_AES_CCM_128,
366};
367
368FIXTURE_VARIANT_ADD(tls, 12_aes_gcm_256)
369{
370 .tls_version = TLS_1_2_VERSION,
371 .cipher_type = TLS_CIPHER_AES_GCM_256,
372};
373
374FIXTURE_VARIANT_ADD(tls, 13_aes_gcm_256)
375{
376 .tls_version = TLS_1_3_VERSION,
377 .cipher_type = TLS_CIPHER_AES_GCM_256,
378};
379
380FIXTURE_VARIANT_ADD(tls, 13_nopad)
381{
382 .tls_version = TLS_1_3_VERSION,
383 .cipher_type = TLS_CIPHER_AES_GCM_128,
384 .nopad = true,
385};
386
387FIXTURE_VARIANT_ADD(tls, 12_aria_gcm)
388{
389 .tls_version = TLS_1_2_VERSION,
390 .cipher_type = TLS_CIPHER_ARIA_GCM_128,
391};
392
393FIXTURE_VARIANT_ADD(tls, 12_aria_gcm_256)
394{
395 .tls_version = TLS_1_2_VERSION,
396 .cipher_type = TLS_CIPHER_ARIA_GCM_256,
397};
398
399FIXTURE_SETUP(tls)
400{
401 struct tls_crypto_info_keys tls12;
402 int one = 1;
403 int ret;
404
405 if (fips_enabled && variant->fips_non_compliant)
406 SKIP(return, "Unsupported cipher in FIPS mode");
407
408 tls_crypto_info_init(variant->tls_version, variant->cipher_type,
409 &tls12, 0);
410
411 ulp_sock_pair(_metadata, &self->fd, &self->cfd, &self->notls);
412
413 if (self->notls)
414 return;
415
416 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len);
417 ASSERT_EQ(ret, 0);
418
419 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len);
420 ASSERT_EQ(ret, 0);
421
422 if (variant->nopad) {
423 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD,
424 (void *)&one, sizeof(one));
425 ASSERT_EQ(ret, 0);
426 }
427}
428
429FIXTURE_TEARDOWN(tls)
430{
431 close(self->fd);
432 close(self->cfd);
433}
434
435TEST_F(tls, sendfile)
436{
437 int filefd = open("/proc/self/exe", O_RDONLY);
438 struct stat st;
439
440 EXPECT_GE(filefd, 0);
441 fstat(filefd, &st);
442 EXPECT_GE(sendfile(self->fd, filefd, 0, st.st_size), 0);
443
444 close(filefd);
445}
446
447TEST_F(tls, send_then_sendfile)
448{
449 int filefd = open("/proc/self/exe", O_RDONLY);
450 char const *test_str = "test_send";
451 int to_send = strlen(test_str) + 1;
452 char recv_buf[10];
453 struct stat st;
454 char *buf;
455
456 EXPECT_GE(filefd, 0);
457 fstat(filefd, &st);
458 buf = (char *)malloc(st.st_size);
459
460 EXPECT_EQ(send(self->fd, test_str, to_send, 0), to_send);
461 EXPECT_EQ(recv(self->cfd, recv_buf, to_send, MSG_WAITALL), to_send);
462 EXPECT_EQ(memcmp(test_str, recv_buf, to_send), 0);
463
464 EXPECT_GE(sendfile(self->fd, filefd, 0, st.st_size), 0);
465 EXPECT_EQ(recv(self->cfd, buf, st.st_size, MSG_WAITALL), st.st_size);
466
467 free(buf);
468 close(filefd);
469}
470
471static void chunked_sendfile(struct __test_metadata *_metadata,
472 struct _test_data_tls *self,
473 uint16_t chunk_size,
474 uint16_t extra_payload_size)
475{
476 char buf[TLS_PAYLOAD_MAX_LEN];
477 uint16_t test_payload_size;
478 int size = 0;
479 int ret;
480 char filename[] = "/tmp/mytemp.XXXXXX";
481 int fd = mkstemp(filename);
482 off_t offset = 0;
483
484 unlink(filename);
485 ASSERT_GE(fd, 0);
486 EXPECT_GE(chunk_size, 1);
487 test_payload_size = chunk_size + extra_payload_size;
488 ASSERT_GE(TLS_PAYLOAD_MAX_LEN, test_payload_size);
489 memset(buf, 1, test_payload_size);
490 size = write(fd, buf, test_payload_size);
491 EXPECT_EQ(size, test_payload_size);
492 fsync(fd);
493
494 while (size > 0) {
495 ret = sendfile(self->fd, fd, &offset, chunk_size);
496 EXPECT_GE(ret, 0);
497 size -= ret;
498 }
499
500 EXPECT_EQ(recv(self->cfd, buf, test_payload_size, MSG_WAITALL),
501 test_payload_size);
502
503 close(fd);
504}
505
506TEST_F(tls, multi_chunk_sendfile)
507{
508 chunked_sendfile(_metadata, self, 4096, 4096);
509 chunked_sendfile(_metadata, self, 4096, 0);
510 chunked_sendfile(_metadata, self, 4096, 1);
511 chunked_sendfile(_metadata, self, 4096, 2048);
512 chunked_sendfile(_metadata, self, 8192, 2048);
513 chunked_sendfile(_metadata, self, 4096, 8192);
514 chunked_sendfile(_metadata, self, 8192, 4096);
515 chunked_sendfile(_metadata, self, 12288, 1024);
516 chunked_sendfile(_metadata, self, 12288, 2000);
517 chunked_sendfile(_metadata, self, 15360, 100);
518 chunked_sendfile(_metadata, self, 15360, 300);
519 chunked_sendfile(_metadata, self, 1, 4096);
520 chunked_sendfile(_metadata, self, 2048, 4096);
521 chunked_sendfile(_metadata, self, 2048, 8192);
522 chunked_sendfile(_metadata, self, 4096, 8192);
523 chunked_sendfile(_metadata, self, 1024, 12288);
524 chunked_sendfile(_metadata, self, 2000, 12288);
525 chunked_sendfile(_metadata, self, 100, 15360);
526 chunked_sendfile(_metadata, self, 300, 15360);
527}
528
529TEST_F(tls, recv_max)
530{
531 unsigned int send_len = TLS_PAYLOAD_MAX_LEN;
532 char recv_mem[TLS_PAYLOAD_MAX_LEN];
533 char buf[TLS_PAYLOAD_MAX_LEN];
534
535 memrnd(buf, sizeof(buf));
536
537 EXPECT_GE(send(self->fd, buf, send_len, 0), 0);
538 EXPECT_NE(recv(self->cfd, recv_mem, send_len, 0), -1);
539 EXPECT_EQ(memcmp(buf, recv_mem, send_len), 0);
540}
541
542TEST_F(tls, recv_small)
543{
544 char const *test_str = "test_read";
545 int send_len = 10;
546 char buf[10];
547
548 send_len = strlen(test_str) + 1;
549 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
550 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1);
551 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
552}
553
554TEST_F(tls, msg_more)
555{
556 char const *test_str = "test_read";
557 int send_len = 10;
558 char buf[10 * 2];
559
560 EXPECT_EQ(send(self->fd, test_str, send_len, MSG_MORE), send_len);
561 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_DONTWAIT), -1);
562 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
563 EXPECT_EQ(recv(self->cfd, buf, send_len * 2, MSG_WAITALL),
564 send_len * 2);
565 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
566}
567
568TEST_F(tls, cmsg_msg_more)
569{
570 char *test_str = "test_read";
571 char record_type = 100;
572 int send_len = 10;
573
574 /* we don't allow MSG_MORE with non-DATA records */
575 EXPECT_EQ(tls_send_cmsg(self->fd, record_type, test_str, send_len,
576 MSG_MORE), -1);
577 EXPECT_EQ(errno, EINVAL);
578}
579
580TEST_F(tls, msg_more_then_cmsg)
581{
582 char *test_str = "test_read";
583 char record_type = 100;
584 int send_len = 10;
585 char buf[10 * 2];
586 int ret;
587
588 EXPECT_EQ(send(self->fd, test_str, send_len, MSG_MORE), send_len);
589 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_DONTWAIT), -1);
590
591 ret = tls_send_cmsg(self->fd, record_type, test_str, send_len, 0);
592 EXPECT_EQ(ret, send_len);
593
594 /* initial DATA record didn't get merged with the non-DATA record */
595 EXPECT_EQ(recv(self->cfd, buf, send_len * 2, 0), send_len);
596
597 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, record_type,
598 buf, sizeof(buf), MSG_WAITALL),
599 send_len);
600}
601
602TEST_F(tls, msg_more_unsent)
603{
604 char const *test_str = "test_read";
605 int send_len = 10;
606 char buf[10];
607
608 EXPECT_EQ(send(self->fd, test_str, send_len, MSG_MORE), send_len);
609 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_DONTWAIT), -1);
610}
611
612TEST_F(tls, msg_eor)
613{
614 char const *test_str = "test_read";
615 int send_len = 10;
616 char buf[10];
617
618 EXPECT_EQ(send(self->fd, test_str, send_len, MSG_EOR), send_len);
619 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_WAITALL), send_len);
620 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
621}
622
623TEST_F(tls, sendmsg_single)
624{
625 struct msghdr msg;
626
627 char const *test_str = "test_sendmsg";
628 size_t send_len = 13;
629 struct iovec vec;
630 char buf[13];
631
632 vec.iov_base = (char *)test_str;
633 vec.iov_len = send_len;
634 memset(&msg, 0, sizeof(struct msghdr));
635 msg.msg_iov = &vec;
636 msg.msg_iovlen = 1;
637 EXPECT_EQ(sendmsg(self->fd, &msg, 0), send_len);
638 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_WAITALL), send_len);
639 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
640}
641
642#define MAX_FRAGS 64
643#define SEND_LEN 13
644TEST_F(tls, sendmsg_fragmented)
645{
646 char const *test_str = "test_sendmsg";
647 char buf[SEND_LEN * MAX_FRAGS];
648 struct iovec vec[MAX_FRAGS];
649 struct msghdr msg;
650 int i, frags;
651
652 for (frags = 1; frags <= MAX_FRAGS; frags++) {
653 for (i = 0; i < frags; i++) {
654 vec[i].iov_base = (char *)test_str;
655 vec[i].iov_len = SEND_LEN;
656 }
657
658 memset(&msg, 0, sizeof(struct msghdr));
659 msg.msg_iov = vec;
660 msg.msg_iovlen = frags;
661
662 EXPECT_EQ(sendmsg(self->fd, &msg, 0), SEND_LEN * frags);
663 EXPECT_EQ(recv(self->cfd, buf, SEND_LEN * frags, MSG_WAITALL),
664 SEND_LEN * frags);
665
666 for (i = 0; i < frags; i++)
667 EXPECT_EQ(memcmp(buf + SEND_LEN * i,
668 test_str, SEND_LEN), 0);
669 }
670}
671#undef MAX_FRAGS
672#undef SEND_LEN
673
674TEST_F(tls, sendmsg_large)
675{
676 void *mem = malloc(16384);
677 size_t send_len = 16384;
678 size_t sends = 128;
679 struct msghdr msg;
680 size_t recvs = 0;
681 size_t sent = 0;
682
683 memset(&msg, 0, sizeof(struct msghdr));
684 while (sent++ < sends) {
685 struct iovec vec = { (void *)mem, send_len };
686
687 msg.msg_iov = &vec;
688 msg.msg_iovlen = 1;
689 EXPECT_EQ(sendmsg(self->fd, &msg, 0), send_len);
690 }
691
692 while (recvs++ < sends) {
693 EXPECT_NE(recv(self->cfd, mem, send_len, 0), -1);
694 }
695
696 free(mem);
697}
698
699TEST_F(tls, sendmsg_multiple)
700{
701 char const *test_str = "test_sendmsg_multiple";
702 struct iovec vec[5];
703 char *test_strs[5];
704 struct msghdr msg;
705 int total_len = 0;
706 int len_cmp = 0;
707 int iov_len = 5;
708 char *buf;
709 int i;
710
711 memset(&msg, 0, sizeof(struct msghdr));
712 for (i = 0; i < iov_len; i++) {
713 test_strs[i] = (char *)malloc(strlen(test_str) + 1);
714 snprintf(test_strs[i], strlen(test_str) + 1, "%s", test_str);
715 vec[i].iov_base = (void *)test_strs[i];
716 vec[i].iov_len = strlen(test_strs[i]) + 1;
717 total_len += vec[i].iov_len;
718 }
719 msg.msg_iov = vec;
720 msg.msg_iovlen = iov_len;
721
722 EXPECT_EQ(sendmsg(self->fd, &msg, 0), total_len);
723 buf = malloc(total_len);
724 EXPECT_NE(recv(self->cfd, buf, total_len, 0), -1);
725 for (i = 0; i < iov_len; i++) {
726 EXPECT_EQ(memcmp(test_strs[i], buf + len_cmp,
727 strlen(test_strs[i])),
728 0);
729 len_cmp += strlen(buf + len_cmp) + 1;
730 }
731 for (i = 0; i < iov_len; i++)
732 free(test_strs[i]);
733 free(buf);
734}
735
736TEST_F(tls, sendmsg_multiple_stress)
737{
738 char const *test_str = "abcdefghijklmno";
739 struct iovec vec[1024];
740 char *test_strs[1024];
741 int iov_len = 1024;
742 int total_len = 0;
743 char buf[1 << 14];
744 struct msghdr msg;
745 int len_cmp = 0;
746 int i;
747
748 memset(&msg, 0, sizeof(struct msghdr));
749 for (i = 0; i < iov_len; i++) {
750 test_strs[i] = (char *)malloc(strlen(test_str) + 1);
751 snprintf(test_strs[i], strlen(test_str) + 1, "%s", test_str);
752 vec[i].iov_base = (void *)test_strs[i];
753 vec[i].iov_len = strlen(test_strs[i]) + 1;
754 total_len += vec[i].iov_len;
755 }
756 msg.msg_iov = vec;
757 msg.msg_iovlen = iov_len;
758
759 EXPECT_EQ(sendmsg(self->fd, &msg, 0), total_len);
760 EXPECT_NE(recv(self->cfd, buf, total_len, 0), -1);
761
762 for (i = 0; i < iov_len; i++)
763 len_cmp += strlen(buf + len_cmp) + 1;
764
765 for (i = 0; i < iov_len; i++)
766 free(test_strs[i]);
767}
768
769TEST_F(tls, splice_from_pipe)
770{
771 int send_len = TLS_PAYLOAD_MAX_LEN;
772 char mem_send[TLS_PAYLOAD_MAX_LEN];
773 char mem_recv[TLS_PAYLOAD_MAX_LEN];
774 int p[2];
775
776 ASSERT_GE(pipe(p), 0);
777 EXPECT_GE(write(p[1], mem_send, send_len), 0);
778 EXPECT_GE(splice(p[0], NULL, self->fd, NULL, send_len, 0), 0);
779 EXPECT_EQ(recv(self->cfd, mem_recv, send_len, MSG_WAITALL), send_len);
780 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
781}
782
783TEST_F(tls, splice_more)
784{
785 unsigned int f = SPLICE_F_NONBLOCK | SPLICE_F_MORE | SPLICE_F_GIFT;
786 int send_len = TLS_PAYLOAD_MAX_LEN;
787 char mem_send[TLS_PAYLOAD_MAX_LEN];
788 int i, send_pipe = 1;
789 int p[2];
790
791 ASSERT_GE(pipe(p), 0);
792 EXPECT_GE(write(p[1], mem_send, send_len), 0);
793 for (i = 0; i < 32; i++)
794 EXPECT_EQ(splice(p[0], NULL, self->fd, NULL, send_pipe, f), 1);
795}
796
797TEST_F(tls, splice_from_pipe2)
798{
799 int send_len = 16000;
800 char mem_send[16000];
801 char mem_recv[16000];
802 int p2[2];
803 int p[2];
804
805 memrnd(mem_send, sizeof(mem_send));
806
807 ASSERT_GE(pipe(p), 0);
808 ASSERT_GE(pipe(p2), 0);
809 EXPECT_EQ(write(p[1], mem_send, 8000), 8000);
810 EXPECT_EQ(splice(p[0], NULL, self->fd, NULL, 8000, 0), 8000);
811 EXPECT_EQ(write(p2[1], mem_send + 8000, 8000), 8000);
812 EXPECT_EQ(splice(p2[0], NULL, self->fd, NULL, 8000, 0), 8000);
813 EXPECT_EQ(recv(self->cfd, mem_recv, send_len, MSG_WAITALL), send_len);
814 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
815}
816
817TEST_F(tls, send_and_splice)
818{
819 int send_len = TLS_PAYLOAD_MAX_LEN;
820 char mem_send[TLS_PAYLOAD_MAX_LEN];
821 char mem_recv[TLS_PAYLOAD_MAX_LEN];
822 char const *test_str = "test_read";
823 int send_len2 = 10;
824 char buf[10];
825 int p[2];
826
827 ASSERT_GE(pipe(p), 0);
828 EXPECT_EQ(send(self->fd, test_str, send_len2, 0), send_len2);
829 EXPECT_EQ(recv(self->cfd, buf, send_len2, MSG_WAITALL), send_len2);
830 EXPECT_EQ(memcmp(test_str, buf, send_len2), 0);
831
832 EXPECT_GE(write(p[1], mem_send, send_len), send_len);
833 EXPECT_GE(splice(p[0], NULL, self->fd, NULL, send_len, 0), send_len);
834
835 EXPECT_EQ(recv(self->cfd, mem_recv, send_len, MSG_WAITALL), send_len);
836 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
837}
838
839TEST_F(tls, splice_onto_full_record)
840{
841 char mem_send[4608];
842 char mem_recv[4608];
843 int frag_len = 100;
844 int nfrags, i, off;
845 int p[2];
846
847 memrnd(mem_send, sizeof(mem_send));
848 ASSERT_GE(pipe(p), 0);
849
850 for (nfrags = 16; nfrags <= 44; nfrags++) {
851 for (i = 0, off = 0; i < nfrags; i++, off += frag_len) {
852 EXPECT_EQ(write(p[1], mem_send + off, frag_len), frag_len);
853 EXPECT_EQ(splice(p[0], NULL, self->fd, NULL, frag_len,
854 SPLICE_F_MORE), frag_len);
855 }
856
857 EXPECT_EQ(send(self->fd, mem_send + off, 1, MSG_MORE), 1);
858 off++;
859
860 EXPECT_EQ(write(p[1], mem_send + off, frag_len), frag_len);
861 EXPECT_EQ(splice(p[0], NULL, self->fd, NULL, frag_len,
862 SPLICE_F_MORE), frag_len);
863 off += frag_len;
864
865 EXPECT_EQ(send(self->fd, mem_send + off, 1, 0), 1);
866 off++;
867
868 EXPECT_EQ(recv(self->cfd, mem_recv, off, MSG_WAITALL), off);
869 EXPECT_EQ(memcmp(mem_send, mem_recv, off), 0);
870 }
871
872 close(p[0]);
873 close(p[1]);
874}
875
876TEST_F(tls, splice_to_pipe)
877{
878 int send_len = TLS_PAYLOAD_MAX_LEN;
879 char mem_send[TLS_PAYLOAD_MAX_LEN];
880 char mem_recv[TLS_PAYLOAD_MAX_LEN];
881 int p[2];
882
883 memrnd(mem_send, sizeof(mem_send));
884
885 ASSERT_GE(pipe(p), 0);
886 EXPECT_EQ(send(self->fd, mem_send, send_len, 0), send_len);
887 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, send_len, 0), send_len);
888 EXPECT_EQ(read(p[0], mem_recv, send_len), send_len);
889 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
890}
891
892TEST_F(tls, splice_cmsg_to_pipe)
893{
894 char *test_str = "test_read";
895 char record_type = 100;
896 int send_len = 10;
897 char buf[10];
898 int p[2];
899
900 if (self->notls)
901 SKIP(return, "no TLS support");
902
903 ASSERT_GE(pipe(p), 0);
904 EXPECT_EQ(tls_send_cmsg(self->fd, 100, test_str, send_len, 0), 10);
905 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, send_len, 0), -1);
906 EXPECT_EQ(errno, EINVAL);
907 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), -1);
908 EXPECT_EQ(errno, EIO);
909 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, record_type,
910 buf, sizeof(buf), MSG_WAITALL),
911 send_len);
912 EXPECT_EQ(memcmp(test_str, buf, send_len), 0);
913}
914
915TEST_F(tls, splice_dec_cmsg_to_pipe)
916{
917 char *test_str = "test_read";
918 char record_type = 100;
919 int send_len = 10;
920 char buf[10];
921 int p[2];
922
923 if (self->notls)
924 SKIP(return, "no TLS support");
925
926 ASSERT_GE(pipe(p), 0);
927 EXPECT_EQ(tls_send_cmsg(self->fd, 100, test_str, send_len, 0), 10);
928 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), -1);
929 EXPECT_EQ(errno, EIO);
930 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, send_len, 0), -1);
931 EXPECT_EQ(errno, EINVAL);
932 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, record_type,
933 buf, sizeof(buf), MSG_WAITALL),
934 send_len);
935 EXPECT_EQ(memcmp(test_str, buf, send_len), 0);
936}
937
938TEST_F(tls, recv_and_splice)
939{
940 int send_len = TLS_PAYLOAD_MAX_LEN;
941 char mem_send[TLS_PAYLOAD_MAX_LEN];
942 char mem_recv[TLS_PAYLOAD_MAX_LEN];
943 int half = send_len / 2;
944 int p[2];
945
946 ASSERT_GE(pipe(p), 0);
947 EXPECT_EQ(send(self->fd, mem_send, send_len, 0), send_len);
948 /* Recv hald of the record, splice the other half */
949 EXPECT_EQ(recv(self->cfd, mem_recv, half, MSG_WAITALL), half);
950 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, half, SPLICE_F_NONBLOCK),
951 half);
952 EXPECT_EQ(read(p[0], &mem_recv[half], half), half);
953 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
954}
955
956TEST_F(tls, peek_and_splice)
957{
958 int send_len = TLS_PAYLOAD_MAX_LEN;
959 char mem_send[TLS_PAYLOAD_MAX_LEN];
960 char mem_recv[TLS_PAYLOAD_MAX_LEN];
961 int chunk = TLS_PAYLOAD_MAX_LEN / 4;
962 int n, i, p[2];
963
964 memrnd(mem_send, sizeof(mem_send));
965
966 ASSERT_GE(pipe(p), 0);
967 for (i = 0; i < 4; i++)
968 EXPECT_EQ(send(self->fd, &mem_send[chunk * i], chunk, 0),
969 chunk);
970
971 EXPECT_EQ(recv(self->cfd, mem_recv, chunk * 5 / 2,
972 MSG_WAITALL | MSG_PEEK),
973 chunk * 5 / 2);
974 EXPECT_EQ(memcmp(mem_send, mem_recv, chunk * 5 / 2), 0);
975
976 n = 0;
977 while (n < send_len) {
978 i = splice(self->cfd, NULL, p[1], NULL, send_len - n, 0);
979 EXPECT_GT(i, 0);
980 n += i;
981 }
982 EXPECT_EQ(n, send_len);
983 EXPECT_EQ(read(p[0], mem_recv, send_len), send_len);
984 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
985}
986
987TEST_F(tls, splice_to_pipe_small)
988{
989 int send_len = TLS_PAYLOAD_MAX_LEN;
990 char mem_send[TLS_PAYLOAD_MAX_LEN];
991 char mem_recv[TLS_PAYLOAD_MAX_LEN];
992 size_t total = 0;
993 int p[2];
994
995 memrnd(mem_send, sizeof(mem_send));
996
997 ASSERT_GE(pipe(p), 0);
998
999 /* Shrink pipe to 1 page (typically 4096 bytes) to force multiple
1000 * splice iterations for a 16384-byte TLS record.
1001 */
1002 EXPECT_GE(fcntl(p[1], F_SETPIPE_SZ, 4096), 4096);
1003
1004 EXPECT_EQ(send(self->fd, mem_send, send_len, 0), send_len);
1005
1006 while (total < (size_t)send_len) {
1007 ssize_t spliced, drained;
1008
1009 spliced = splice(self->cfd, NULL, p[1], NULL,
1010 send_len - total, 0);
1011 EXPECT_GT(spliced, 0);
1012 if (spliced <= 0)
1013 break;
1014
1015 drained = read(p[0], mem_recv + total, spliced);
1016 EXPECT_EQ(drained, spliced);
1017 if (drained <= 0)
1018 break;
1019
1020 total += drained;
1021 }
1022
1023 EXPECT_EQ(total, (size_t)send_len);
1024 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
1025
1026 close(p[0]);
1027 close(p[1]);
1028}
1029
1030#define MAX_FRAGS 48
1031TEST_F(tls, splice_short)
1032{
1033 struct iovec sendchar_iov;
1034 char read_buf[0x10000];
1035 char sendbuf[0x100];
1036 char sendchar = 'S';
1037 int pipefds[2];
1038 int pipe_sz;
1039 int ret;
1040 int i;
1041
1042 sendchar_iov.iov_base = &sendchar;
1043 sendchar_iov.iov_len = 1;
1044
1045 memset(sendbuf, 's', sizeof(sendbuf));
1046
1047 ASSERT_GE(pipe2(pipefds, O_NONBLOCK), 0);
1048 pipe_sz = (MAX_FRAGS + 1) * getpagesize();
1049 ret = fcntl(pipefds[0], F_SETPIPE_SZ, pipe_sz);
1050 if (ret < 0 && errno == EPERM)
1051 SKIP(return, "insufficient pipe capacity");
1052 ASSERT_GE(ret, pipe_sz);
1053
1054 for (i = 0; i < MAX_FRAGS; i++)
1055 ASSERT_GE(vmsplice(pipefds[1], &sendchar_iov, 1, 0), 0);
1056
1057 ASSERT_EQ(write(pipefds[1], sendbuf, sizeof(sendbuf)), sizeof(sendbuf));
1058
1059 EXPECT_EQ(splice(pipefds[0], NULL, self->fd, NULL, MAX_FRAGS + 0x1000, 0),
1060 MAX_FRAGS + sizeof(sendbuf));
1061 EXPECT_EQ(recv(self->cfd, read_buf, sizeof(read_buf), 0), MAX_FRAGS + sizeof(sendbuf));
1062 EXPECT_EQ(recv(self->cfd, read_buf, sizeof(read_buf), MSG_DONTWAIT), -1);
1063 EXPECT_EQ(errno, EAGAIN);
1064}
1065#undef MAX_FRAGS
1066
1067TEST_F(tls, recvmsg_single)
1068{
1069 char const *test_str = "test_recvmsg_single";
1070 int send_len = strlen(test_str) + 1;
1071 char buf[20];
1072 struct msghdr hdr;
1073 struct iovec vec;
1074
1075 memset(&hdr, 0, sizeof(hdr));
1076 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1077 vec.iov_base = (char *)buf;
1078 vec.iov_len = send_len;
1079 hdr.msg_iovlen = 1;
1080 hdr.msg_iov = &vec;
1081 EXPECT_NE(recvmsg(self->cfd, &hdr, 0), -1);
1082 EXPECT_EQ(memcmp(test_str, buf, send_len), 0);
1083}
1084
1085TEST_F(tls, recvmsg_single_max)
1086{
1087 int send_len = TLS_PAYLOAD_MAX_LEN;
1088 char send_mem[TLS_PAYLOAD_MAX_LEN];
1089 char recv_mem[TLS_PAYLOAD_MAX_LEN];
1090 struct iovec vec;
1091 struct msghdr hdr;
1092
1093 memrnd(send_mem, sizeof(send_mem));
1094
1095 EXPECT_EQ(send(self->fd, send_mem, send_len, 0), send_len);
1096 vec.iov_base = (char *)recv_mem;
1097 vec.iov_len = TLS_PAYLOAD_MAX_LEN;
1098
1099 hdr.msg_iovlen = 1;
1100 hdr.msg_iov = &vec;
1101 EXPECT_NE(recvmsg(self->cfd, &hdr, 0), -1);
1102 EXPECT_EQ(memcmp(send_mem, recv_mem, send_len), 0);
1103}
1104
1105TEST_F(tls, recvmsg_multiple)
1106{
1107 unsigned int msg_iovlen = 1024;
1108 struct iovec vec[1024];
1109 char *iov_base[1024];
1110 unsigned int iov_len = 16;
1111 int send_len = 1 << 14;
1112 char buf[1 << 14];
1113 struct msghdr hdr;
1114 int i;
1115
1116 memrnd(buf, sizeof(buf));
1117
1118 EXPECT_EQ(send(self->fd, buf, send_len, 0), send_len);
1119 for (i = 0; i < msg_iovlen; i++) {
1120 iov_base[i] = (char *)malloc(iov_len);
1121 vec[i].iov_base = iov_base[i];
1122 vec[i].iov_len = iov_len;
1123 }
1124
1125 hdr.msg_iovlen = msg_iovlen;
1126 hdr.msg_iov = vec;
1127 EXPECT_NE(recvmsg(self->cfd, &hdr, 0), -1);
1128
1129 for (i = 0; i < msg_iovlen; i++)
1130 free(iov_base[i]);
1131}
1132
1133TEST_F(tls, single_send_multiple_recv)
1134{
1135 unsigned int total_len = TLS_PAYLOAD_MAX_LEN * 2;
1136 unsigned int send_len = TLS_PAYLOAD_MAX_LEN;
1137 char send_mem[TLS_PAYLOAD_MAX_LEN * 2];
1138 char recv_mem[TLS_PAYLOAD_MAX_LEN * 2];
1139
1140 memrnd(send_mem, sizeof(send_mem));
1141
1142 EXPECT_GE(send(self->fd, send_mem, total_len, 0), 0);
1143 memset(recv_mem, 0, total_len);
1144
1145 EXPECT_NE(recv(self->cfd, recv_mem, send_len, 0), -1);
1146 EXPECT_NE(recv(self->cfd, recv_mem + send_len, send_len, 0), -1);
1147 EXPECT_EQ(memcmp(send_mem, recv_mem, total_len), 0);
1148}
1149
1150TEST_F(tls, multiple_send_single_recv)
1151{
1152 unsigned int total_len = 2 * 10;
1153 unsigned int send_len = 10;
1154 char recv_mem[2 * 10];
1155 char send_mem[10];
1156
1157 memrnd(send_mem, sizeof(send_mem));
1158
1159 EXPECT_GE(send(self->fd, send_mem, send_len, 0), 0);
1160 EXPECT_GE(send(self->fd, send_mem, send_len, 0), 0);
1161 memset(recv_mem, 0, total_len);
1162 EXPECT_EQ(recv(self->cfd, recv_mem, total_len, MSG_WAITALL), total_len);
1163
1164 EXPECT_EQ(memcmp(send_mem, recv_mem, send_len), 0);
1165 EXPECT_EQ(memcmp(send_mem, recv_mem + send_len, send_len), 0);
1166}
1167
1168TEST_F(tls, single_send_multiple_recv_non_align)
1169{
1170 const unsigned int total_len = 15;
1171 const unsigned int recv_len = 10;
1172 char recv_mem[recv_len * 2];
1173 char send_mem[total_len];
1174
1175 memrnd(send_mem, sizeof(send_mem));
1176
1177 EXPECT_GE(send(self->fd, send_mem, total_len, 0), 0);
1178 memset(recv_mem, 0, total_len);
1179
1180 EXPECT_EQ(recv(self->cfd, recv_mem, recv_len, 0), recv_len);
1181 EXPECT_EQ(recv(self->cfd, recv_mem + recv_len, recv_len, 0), 5);
1182 EXPECT_EQ(memcmp(send_mem, recv_mem, total_len), 0);
1183}
1184
1185TEST_F(tls, recv_partial)
1186{
1187 char const *test_str = "test_read_partial";
1188 char const *test_str_first = "test_read";
1189 char const *test_str_second = "_partial";
1190 int send_len = strlen(test_str) + 1;
1191 char recv_mem[18];
1192
1193 memset(recv_mem, 0, sizeof(recv_mem));
1194 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1195 EXPECT_EQ(recv(self->cfd, recv_mem, strlen(test_str_first),
1196 MSG_WAITALL), strlen(test_str_first));
1197 EXPECT_EQ(memcmp(test_str_first, recv_mem, strlen(test_str_first)), 0);
1198 memset(recv_mem, 0, sizeof(recv_mem));
1199 EXPECT_EQ(recv(self->cfd, recv_mem, strlen(test_str_second),
1200 MSG_WAITALL), strlen(test_str_second));
1201 EXPECT_EQ(memcmp(test_str_second, recv_mem, strlen(test_str_second)),
1202 0);
1203}
1204
1205TEST_F(tls, recv_nonblock)
1206{
1207 char buf[4096];
1208 bool err;
1209
1210 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_DONTWAIT), -1);
1211 err = (errno == EAGAIN || errno == EWOULDBLOCK);
1212 EXPECT_EQ(err, true);
1213}
1214
1215TEST_F(tls, recv_peek)
1216{
1217 char const *test_str = "test_read_peek";
1218 int send_len = strlen(test_str) + 1;
1219 char buf[15];
1220
1221 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1222 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_PEEK), send_len);
1223 EXPECT_EQ(memcmp(test_str, buf, send_len), 0);
1224 memset(buf, 0, sizeof(buf));
1225 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len);
1226 EXPECT_EQ(memcmp(test_str, buf, send_len), 0);
1227}
1228
1229TEST_F(tls, recv_peek_multiple)
1230{
1231 char const *test_str = "test_read_peek";
1232 int send_len = strlen(test_str) + 1;
1233 unsigned int num_peeks = 100;
1234 char buf[15];
1235 int i;
1236
1237 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1238 for (i = 0; i < num_peeks; i++) {
1239 EXPECT_NE(recv(self->cfd, buf, send_len, MSG_PEEK), -1);
1240 EXPECT_EQ(memcmp(test_str, buf, send_len), 0);
1241 memset(buf, 0, sizeof(buf));
1242 }
1243 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1);
1244 EXPECT_EQ(memcmp(test_str, buf, send_len), 0);
1245}
1246
1247TEST_F(tls, recv_peek_multiple_records)
1248{
1249 char const *test_str = "test_read_peek_mult_recs";
1250 char const *test_str_first = "test_read_peek";
1251 char const *test_str_second = "_mult_recs";
1252 int len;
1253 char buf[64];
1254
1255 len = strlen(test_str_first);
1256 EXPECT_EQ(send(self->fd, test_str_first, len, 0), len);
1257
1258 len = strlen(test_str_second) + 1;
1259 EXPECT_EQ(send(self->fd, test_str_second, len, 0), len);
1260
1261 len = strlen(test_str_first);
1262 memset(buf, 0, len);
1263 EXPECT_EQ(recv(self->cfd, buf, len, MSG_PEEK | MSG_WAITALL), len);
1264
1265 /* MSG_PEEK can only peek into the current record. */
1266 len = strlen(test_str_first);
1267 EXPECT_EQ(memcmp(test_str_first, buf, len), 0);
1268
1269 len = strlen(test_str) + 1;
1270 memset(buf, 0, len);
1271 EXPECT_EQ(recv(self->cfd, buf, len, MSG_WAITALL), len);
1272
1273 /* Non-MSG_PEEK will advance strparser (and therefore record)
1274 * however.
1275 */
1276 len = strlen(test_str) + 1;
1277 EXPECT_EQ(memcmp(test_str, buf, len), 0);
1278
1279 /* MSG_MORE will hold current record open, so later MSG_PEEK
1280 * will see everything.
1281 */
1282 len = strlen(test_str_first);
1283 EXPECT_EQ(send(self->fd, test_str_first, len, MSG_MORE), len);
1284
1285 len = strlen(test_str_second) + 1;
1286 EXPECT_EQ(send(self->fd, test_str_second, len, 0), len);
1287
1288 len = strlen(test_str) + 1;
1289 memset(buf, 0, len);
1290 EXPECT_EQ(recv(self->cfd, buf, len, MSG_PEEK | MSG_WAITALL), len);
1291
1292 len = strlen(test_str) + 1;
1293 EXPECT_EQ(memcmp(test_str, buf, len), 0);
1294}
1295
1296TEST_F(tls, recv_peek_large_buf_mult_recs)
1297{
1298 char const *test_str = "test_read_peek_mult_recs";
1299 char const *test_str_first = "test_read_peek";
1300 char const *test_str_second = "_mult_recs";
1301 int len;
1302 char buf[64];
1303
1304 len = strlen(test_str_first);
1305 EXPECT_EQ(send(self->fd, test_str_first, len, 0), len);
1306
1307 len = strlen(test_str_second) + 1;
1308 EXPECT_EQ(send(self->fd, test_str_second, len, 0), len);
1309
1310 len = strlen(test_str) + 1;
1311 memset(buf, 0, len);
1312 EXPECT_NE((len = recv(self->cfd, buf, len,
1313 MSG_PEEK | MSG_WAITALL)), -1);
1314 len = strlen(test_str) + 1;
1315 EXPECT_EQ(memcmp(test_str, buf, len), 0);
1316}
1317
1318TEST_F(tls, recv_lowat)
1319{
1320 char send_mem[10] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 };
1321 char recv_mem[20];
1322 int lowat = 8;
1323
1324 EXPECT_EQ(send(self->fd, send_mem, 10, 0), 10);
1325 EXPECT_EQ(send(self->fd, send_mem, 5, 0), 5);
1326
1327 memset(recv_mem, 0, 20);
1328 EXPECT_EQ(setsockopt(self->cfd, SOL_SOCKET, SO_RCVLOWAT,
1329 &lowat, sizeof(lowat)), 0);
1330 EXPECT_EQ(recv(self->cfd, recv_mem, 1, MSG_WAITALL), 1);
1331 EXPECT_EQ(recv(self->cfd, recv_mem + 1, 6, MSG_WAITALL), 6);
1332 EXPECT_EQ(recv(self->cfd, recv_mem + 7, 10, 0), 8);
1333
1334 EXPECT_EQ(memcmp(send_mem, recv_mem, 10), 0);
1335 EXPECT_EQ(memcmp(send_mem, recv_mem + 10, 5), 0);
1336}
1337
1338TEST_F(tls, bidir)
1339{
1340 char const *test_str = "test_read";
1341 int send_len = 10;
1342 char buf[10];
1343 int ret;
1344
1345 if (!self->notls) {
1346 struct tls_crypto_info_keys tls12;
1347
1348 tls_crypto_info_init(variant->tls_version, variant->cipher_type,
1349 &tls12, 0);
1350
1351 ret = setsockopt(self->fd, SOL_TLS, TLS_RX, &tls12,
1352 tls12.len);
1353 ASSERT_EQ(ret, 0);
1354
1355 ret = setsockopt(self->cfd, SOL_TLS, TLS_TX, &tls12,
1356 tls12.len);
1357 ASSERT_EQ(ret, 0);
1358 }
1359
1360 ASSERT_EQ(strlen(test_str) + 1, send_len);
1361
1362 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1363 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1);
1364 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
1365
1366 memset(buf, 0, sizeof(buf));
1367
1368 EXPECT_EQ(send(self->cfd, test_str, send_len, 0), send_len);
1369 EXPECT_NE(recv(self->fd, buf, send_len, 0), -1);
1370 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
1371};
1372
1373TEST_F(tls, pollin)
1374{
1375 char const *test_str = "test_poll";
1376 struct pollfd fd = { 0, 0, 0 };
1377 char buf[10];
1378 int send_len = 10;
1379
1380 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1381 fd.fd = self->cfd;
1382 fd.events = POLLIN;
1383
1384 EXPECT_EQ(poll(&fd, 1, 20), 1);
1385 EXPECT_EQ(fd.revents & POLLIN, 1);
1386 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_WAITALL), send_len);
1387 /* Test timing out */
1388 EXPECT_EQ(poll(&fd, 1, 20), 0);
1389}
1390
1391TEST_F(tls, poll_wait)
1392{
1393 char const *test_str = "test_poll_wait";
1394 int send_len = strlen(test_str) + 1;
1395 struct pollfd fd = { 0, 0, 0 };
1396 char recv_mem[15];
1397
1398 fd.fd = self->cfd;
1399 fd.events = POLLIN;
1400 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1401 /* Set timeout to inf. secs */
1402 EXPECT_EQ(poll(&fd, 1, -1), 1);
1403 EXPECT_EQ(fd.revents & POLLIN, 1);
1404 EXPECT_EQ(recv(self->cfd, recv_mem, send_len, MSG_WAITALL), send_len);
1405}
1406
1407TEST_F(tls, poll_wait_split)
1408{
1409 struct pollfd fd = { 0, 0, 0 };
1410 char send_mem[20] = {};
1411 char recv_mem[15];
1412
1413 fd.fd = self->cfd;
1414 fd.events = POLLIN;
1415 /* Send 20 bytes */
1416 EXPECT_EQ(send(self->fd, send_mem, sizeof(send_mem), 0),
1417 sizeof(send_mem));
1418 /* Poll with inf. timeout */
1419 EXPECT_EQ(poll(&fd, 1, -1), 1);
1420 EXPECT_EQ(fd.revents & POLLIN, 1);
1421 EXPECT_EQ(recv(self->cfd, recv_mem, sizeof(recv_mem), MSG_WAITALL),
1422 sizeof(recv_mem));
1423
1424 /* Now the remaining 5 bytes of record data are in TLS ULP */
1425 fd.fd = self->cfd;
1426 fd.events = POLLIN;
1427 EXPECT_EQ(poll(&fd, 1, -1), 1);
1428 EXPECT_EQ(fd.revents & POLLIN, 1);
1429 EXPECT_EQ(recv(self->cfd, recv_mem, sizeof(recv_mem), 0),
1430 sizeof(send_mem) - sizeof(recv_mem));
1431}
1432
1433TEST_F(tls, blocking)
1434{
1435 size_t data = 100000;
1436 int res = fork();
1437
1438 EXPECT_NE(res, -1);
1439
1440 if (res) {
1441 /* parent */
1442 size_t left = data;
1443 char buf[16384];
1444 int status;
1445 int pid2;
1446
1447 while (left) {
1448 int res = send(self->fd, buf,
1449 left > 16384 ? 16384 : left, 0);
1450
1451 EXPECT_GE(res, 0);
1452 left -= res;
1453 }
1454
1455 pid2 = wait(&status);
1456 EXPECT_EQ(status, 0);
1457 EXPECT_EQ(res, pid2);
1458 } else {
1459 /* child */
1460 size_t left = data;
1461 char buf[16384];
1462
1463 while (left) {
1464 int res = recv(self->cfd, buf,
1465 left > 16384 ? 16384 : left, 0);
1466
1467 EXPECT_GE(res, 0);
1468 left -= res;
1469 }
1470 }
1471}
1472
1473TEST_F(tls, nonblocking)
1474{
1475 size_t data = 100000;
1476 int sendbuf = 100;
1477 int flags;
1478 int res;
1479
1480 flags = fcntl(self->fd, F_GETFL, 0);
1481 fcntl(self->fd, F_SETFL, flags | O_NONBLOCK);
1482 fcntl(self->cfd, F_SETFL, flags | O_NONBLOCK);
1483
1484 /* Ensure nonblocking behavior by imposing a small send
1485 * buffer.
1486 */
1487 EXPECT_EQ(setsockopt(self->fd, SOL_SOCKET, SO_SNDBUF,
1488 &sendbuf, sizeof(sendbuf)), 0);
1489
1490 res = fork();
1491 EXPECT_NE(res, -1);
1492
1493 if (res) {
1494 /* parent */
1495 bool eagain = false;
1496 size_t left = data;
1497 char buf[16384];
1498 int status;
1499 int pid2;
1500
1501 while (left) {
1502 int res = send(self->fd, buf,
1503 left > 16384 ? 16384 : left, 0);
1504
1505 if (res == -1 && errno == EAGAIN) {
1506 eagain = true;
1507 usleep(10000);
1508 continue;
1509 }
1510 EXPECT_GE(res, 0);
1511 left -= res;
1512 }
1513
1514 EXPECT_TRUE(eagain);
1515 pid2 = wait(&status);
1516
1517 EXPECT_EQ(status, 0);
1518 EXPECT_EQ(res, pid2);
1519 } else {
1520 /* child */
1521 bool eagain = false;
1522 size_t left = data;
1523 char buf[16384];
1524
1525 while (left) {
1526 int res = recv(self->cfd, buf,
1527 left > 16384 ? 16384 : left, 0);
1528
1529 if (res == -1 && errno == EAGAIN) {
1530 eagain = true;
1531 usleep(10000);
1532 continue;
1533 }
1534 EXPECT_GE(res, 0);
1535 left -= res;
1536 }
1537 EXPECT_TRUE(eagain);
1538 }
1539}
1540
1541static void
1542test_mutliproc(struct __test_metadata *_metadata, struct _test_data_tls *self,
1543 bool sendpg, unsigned int n_readers, unsigned int n_writers)
1544{
1545 const unsigned int n_children = n_readers + n_writers;
1546 const size_t data = 6 * 1000 * 1000;
1547 const size_t file_sz = data / 100;
1548 size_t read_bias, write_bias;
1549 int i, fd, child_id;
1550 char buf[file_sz];
1551 pid_t pid;
1552
1553 /* Only allow multiples for simplicity */
1554 ASSERT_EQ(!(n_readers % n_writers) || !(n_writers % n_readers), true);
1555 read_bias = n_writers / n_readers ?: 1;
1556 write_bias = n_readers / n_writers ?: 1;
1557
1558 /* prep a file to send */
1559 fd = open("/tmp/", O_TMPFILE | O_RDWR, 0600);
1560 ASSERT_GE(fd, 0);
1561
1562 memset(buf, 0xac, file_sz);
1563 ASSERT_EQ(write(fd, buf, file_sz), file_sz);
1564
1565 /* spawn children */
1566 for (child_id = 0; child_id < n_children; child_id++) {
1567 pid = fork();
1568 ASSERT_NE(pid, -1);
1569 if (!pid)
1570 break;
1571 }
1572
1573 /* parent waits for all children */
1574 if (pid) {
1575 for (i = 0; i < n_children; i++) {
1576 int status;
1577
1578 wait(&status);
1579 EXPECT_EQ(status, 0);
1580 }
1581
1582 return;
1583 }
1584
1585 /* Split threads for reading and writing */
1586 if (child_id < n_readers) {
1587 size_t left = data * read_bias;
1588 char rb[8001];
1589
1590 while (left) {
1591 int res;
1592
1593 res = recv(self->cfd, rb,
1594 left > sizeof(rb) ? sizeof(rb) : left, 0);
1595
1596 ASSERT_GE(res, 0);
1597 left -= res;
1598 }
1599 } else {
1600 size_t left = data * write_bias;
1601
1602 while (left) {
1603 int res;
1604
1605 ASSERT_EQ(lseek(fd, 0, SEEK_SET), 0);
1606 if (sendpg)
1607 res = sendfile(self->fd, fd, NULL,
1608 left > file_sz ? file_sz : left);
1609 else
1610 res = send(self->fd, buf,
1611 left > file_sz ? file_sz : left, 0);
1612
1613 ASSERT_GE(res, 0);
1614 left -= res;
1615 }
1616 }
1617}
1618
1619TEST_F(tls, mutliproc_even)
1620{
1621 test_mutliproc(_metadata, self, false, 6, 6);
1622}
1623
1624TEST_F(tls, mutliproc_readers)
1625{
1626 test_mutliproc(_metadata, self, false, 4, 12);
1627}
1628
1629TEST_F(tls, mutliproc_writers)
1630{
1631 test_mutliproc(_metadata, self, false, 10, 2);
1632}
1633
1634TEST_F(tls, mutliproc_sendpage_even)
1635{
1636 test_mutliproc(_metadata, self, true, 6, 6);
1637}
1638
1639TEST_F(tls, mutliproc_sendpage_readers)
1640{
1641 test_mutliproc(_metadata, self, true, 4, 12);
1642}
1643
1644TEST_F(tls, mutliproc_sendpage_writers)
1645{
1646 test_mutliproc(_metadata, self, true, 10, 2);
1647}
1648
1649TEST_F(tls, control_msg)
1650{
1651 char *test_str = "test_read";
1652 char record_type = 100;
1653 int send_len = 10;
1654 char buf[10];
1655
1656 if (self->notls)
1657 SKIP(return, "no TLS support");
1658
1659 EXPECT_EQ(tls_send_cmsg(self->fd, record_type, test_str, send_len, 0),
1660 send_len);
1661 /* Should fail because we didn't provide a control message */
1662 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), -1);
1663
1664 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, record_type,
1665 buf, sizeof(buf), MSG_WAITALL | MSG_PEEK),
1666 send_len);
1667 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
1668
1669 /* Recv the message again without MSG_PEEK */
1670 memset(buf, 0, sizeof(buf));
1671
1672 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, record_type,
1673 buf, sizeof(buf), MSG_WAITALL),
1674 send_len);
1675 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
1676}
1677
1678TEST_F(tls, control_msg_nomerge)
1679{
1680 char *rec1 = "1111";
1681 char *rec2 = "2222";
1682 int send_len = 5;
1683 char buf[15];
1684
1685 if (self->notls)
1686 SKIP(return, "no TLS support");
1687
1688 EXPECT_EQ(tls_send_cmsg(self->fd, 100, rec1, send_len, 0), send_len);
1689 EXPECT_EQ(tls_send_cmsg(self->fd, 100, rec2, send_len, 0), send_len);
1690
1691 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, 100, buf, sizeof(buf), MSG_PEEK), send_len);
1692 EXPECT_EQ(memcmp(buf, rec1, send_len), 0);
1693
1694 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, 100, buf, sizeof(buf), MSG_PEEK), send_len);
1695 EXPECT_EQ(memcmp(buf, rec1, send_len), 0);
1696
1697 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, 100, buf, sizeof(buf), 0), send_len);
1698 EXPECT_EQ(memcmp(buf, rec1, send_len), 0);
1699
1700 EXPECT_EQ(tls_recv_cmsg(_metadata, self->cfd, 100, buf, sizeof(buf), 0), send_len);
1701 EXPECT_EQ(memcmp(buf, rec2, send_len), 0);
1702}
1703
1704TEST_F(tls, data_control_data)
1705{
1706 char *rec1 = "1111";
1707 char *rec2 = "2222";
1708 char *rec3 = "3333";
1709 int send_len = 5;
1710 char buf[15];
1711
1712 if (self->notls)
1713 SKIP(return, "no TLS support");
1714
1715 EXPECT_EQ(send(self->fd, rec1, send_len, 0), send_len);
1716 EXPECT_EQ(tls_send_cmsg(self->fd, 100, rec2, send_len, 0), send_len);
1717 EXPECT_EQ(send(self->fd, rec3, send_len, 0), send_len);
1718
1719 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_PEEK), send_len);
1720 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_PEEK), send_len);
1721}
1722
1723TEST_F(tls, shutdown)
1724{
1725 char const *test_str = "test_read";
1726 int send_len = 10;
1727 char buf[10];
1728
1729 ASSERT_EQ(strlen(test_str) + 1, send_len);
1730
1731 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1732 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1);
1733 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
1734
1735 shutdown(self->fd, SHUT_RDWR);
1736 shutdown(self->cfd, SHUT_RDWR);
1737}
1738
1739TEST_F(tls, shutdown_unsent)
1740{
1741 char const *test_str = "test_read";
1742 int send_len = 10;
1743
1744 EXPECT_EQ(send(self->fd, test_str, send_len, MSG_MORE), send_len);
1745
1746 shutdown(self->fd, SHUT_RDWR);
1747 shutdown(self->cfd, SHUT_RDWR);
1748}
1749
1750TEST_F(tls, shutdown_reuse)
1751{
1752 struct sockaddr_in addr;
1753 int ret;
1754
1755 shutdown(self->fd, SHUT_RDWR);
1756 shutdown(self->cfd, SHUT_RDWR);
1757 close(self->cfd);
1758
1759 addr.sin_family = AF_INET;
1760 addr.sin_addr.s_addr = htonl(INADDR_ANY);
1761 addr.sin_port = 0;
1762
1763 ret = bind(self->fd, &addr, sizeof(addr));
1764 EXPECT_EQ(ret, 0);
1765 ret = listen(self->fd, 10);
1766 EXPECT_EQ(ret, -1);
1767 EXPECT_EQ(errno, EINVAL);
1768
1769 ret = connect(self->fd, &addr, sizeof(addr));
1770 EXPECT_EQ(ret, -1);
1771 EXPECT_EQ(errno, EISCONN);
1772}
1773
1774TEST_F(tls, getsockopt)
1775{
1776 struct tls_crypto_info_keys expect, get;
1777 socklen_t len;
1778
1779 /* get only the version/cipher */
1780 len = sizeof(struct tls_crypto_info);
1781 memrnd(&get, sizeof(get));
1782 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &get, &len), 0);
1783 EXPECT_EQ(len, sizeof(struct tls_crypto_info));
1784 EXPECT_EQ(get.crypto_info.version, variant->tls_version);
1785 EXPECT_EQ(get.crypto_info.cipher_type, variant->cipher_type);
1786
1787 /* get the full crypto_info */
1788 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &expect, 0);
1789 len = expect.len;
1790 memrnd(&get, sizeof(get));
1791 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &get, &len), 0);
1792 EXPECT_EQ(len, expect.len);
1793 EXPECT_EQ(get.crypto_info.version, variant->tls_version);
1794 EXPECT_EQ(get.crypto_info.cipher_type, variant->cipher_type);
1795 EXPECT_EQ(memcmp(&get, &expect, expect.len), 0);
1796
1797 /* short get should fail */
1798 len = sizeof(struct tls_crypto_info) - 1;
1799 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &get, &len), -1);
1800 EXPECT_EQ(errno, EINVAL);
1801
1802 /* partial get of the cipher data should fail */
1803 len = expect.len - 1;
1804 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &get, &len), -1);
1805 EXPECT_EQ(errno, EINVAL);
1806}
1807
1808TEST_F(tls, recv_efault)
1809{
1810 char *rec1 = "1111111111";
1811 char *rec2 = "2222222222";
1812 struct msghdr hdr = {};
1813 struct iovec iov[2];
1814 char recv_mem[12];
1815 int ret;
1816
1817 if (self->notls)
1818 SKIP(return, "no TLS support");
1819
1820 EXPECT_EQ(send(self->fd, rec1, 10, 0), 10);
1821 EXPECT_EQ(send(self->fd, rec2, 10, 0), 10);
1822
1823 iov[0].iov_base = recv_mem;
1824 iov[0].iov_len = sizeof(recv_mem);
1825 iov[1].iov_base = NULL; /* broken iov to make process_rx_list fail */
1826 iov[1].iov_len = 1;
1827
1828 hdr.msg_iovlen = 2;
1829 hdr.msg_iov = iov;
1830
1831 EXPECT_EQ(recv(self->cfd, recv_mem, 1, 0), 1);
1832 EXPECT_EQ(recv_mem[0], rec1[0]);
1833
1834 ret = recvmsg(self->cfd, &hdr, 0);
1835 EXPECT_LE(ret, sizeof(recv_mem));
1836 EXPECT_GE(ret, 9);
1837 EXPECT_EQ(memcmp(rec1, recv_mem, 9), 0);
1838 if (ret > 9)
1839 EXPECT_EQ(memcmp(rec2, recv_mem + 9, ret - 9), 0);
1840}
1841
1842#define TLS_RECORD_TYPE_HANDSHAKE 0x16
1843
1844TEST_F(tls_basic, recvmsg_nopad_retry_iov)
1845{
1846 char payload[32];
1847 char first_iov[sizeof(payload)];
1848 char later_iov[sizeof(payload) * 2];
1849 char expected_later_iov[sizeof(later_iov)];
1850 char cbuf[CMSG_SPACE(sizeof(char))];
1851 struct tls_crypto_info_keys tls13;
1852 struct iovec iov[] = {
1853 { .iov_base = first_iov, .iov_len = sizeof(first_iov) },
1854 { .iov_base = later_iov, .iov_len = sizeof(later_iov) },
1855 };
1856 struct msghdr msg = {
1857 .msg_iov = iov,
1858 .msg_iovlen = ARRAY_SIZE(iov),
1859 .msg_control = cbuf,
1860 .msg_controllen = sizeof(cbuf),
1861 };
1862 int one = 1;
1863 int ret;
1864 int i;
1865
1866 if (self->notls)
1867 SKIP(return, "no TLS support");
1868
1869 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128,
1870 &tls13, 0);
1871
1872 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls13, tls13.len);
1873 ASSERT_EQ(ret, 0);
1874
1875 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls13, tls13.len);
1876 ASSERT_EQ(ret, 0);
1877
1878 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD,
1879 &one, sizeof(one));
1880 ASSERT_EQ(ret, 0);
1881
1882 for (i = 0; i < sizeof(payload); i++)
1883 payload[i] = 0x40 + i;
1884 memset(first_iov, 0xa5, sizeof(first_iov));
1885 memset(later_iov, 0x5a, sizeof(later_iov));
1886 memset(expected_later_iov, 0x5a, sizeof(expected_later_iov));
1887
1888 /* A control record forces optimistic TLS 1.3 RX to retry. */
1889 ret = tls_send_cmsg(self->fd, TLS_RECORD_TYPE_HANDSHAKE,
1890 payload, sizeof(payload), 0);
1891 ASSERT_EQ(ret, sizeof(payload));
1892
1893 ret = recvmsg(self->cfd, &msg, 0);
1894 ASSERT_EQ(ret, sizeof(payload));
1895 EXPECT_EQ(memcmp(first_iov, payload, sizeof(payload)), 0);
1896 EXPECT_EQ(memcmp(later_iov, expected_later_iov,
1897 sizeof(later_iov)), 0);
1898}
1899
1900/* key_update, length 1, update_not_requested */
1901static const char key_update_msg[] = "\x18\x00\x00\x01\x00";
1902static void tls_send_keyupdate(struct __test_metadata *_metadata, int fd)
1903{
1904 size_t len = sizeof(key_update_msg);
1905
1906 EXPECT_EQ(tls_send_cmsg(fd, TLS_RECORD_TYPE_HANDSHAKE,
1907 (char *)key_update_msg, len, 0),
1908 len);
1909}
1910
1911static void tls_recv_keyupdate(struct __test_metadata *_metadata, int fd, int flags)
1912{
1913 char buf[100];
1914
1915 EXPECT_EQ(tls_recv_cmsg(_metadata, fd, TLS_RECORD_TYPE_HANDSHAKE, buf, sizeof(buf), flags),
1916 sizeof(key_update_msg));
1917 EXPECT_EQ(memcmp(buf, key_update_msg, sizeof(key_update_msg)), 0);
1918}
1919
1920/* set the key to 0 then 1 for RX, immediately to 1 for TX */
1921TEST_F(tls_basic, rekey_rx)
1922{
1923 struct tls_crypto_info_keys tls12_0, tls12_1;
1924 char const *test_str = "test_message";
1925 int send_len = strlen(test_str) + 1;
1926 char buf[20];
1927 int ret;
1928
1929 if (self->notls)
1930 return;
1931
1932 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128,
1933 &tls12_0, 0);
1934 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128,
1935 &tls12_1, 1);
1936
1937 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12_1, tls12_1.len);
1938 ASSERT_EQ(ret, 0);
1939
1940 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12_0, tls12_0.len);
1941 ASSERT_EQ(ret, 0);
1942
1943 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12_1, tls12_1.len);
1944 EXPECT_EQ(ret, 0);
1945
1946 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1947 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len);
1948 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
1949}
1950
1951/* set the key to 0 then 1 for TX, immediately to 1 for RX */
1952TEST_F(tls_basic, rekey_tx)
1953{
1954 struct tls_crypto_info_keys tls12_0, tls12_1;
1955 char const *test_str = "test_message";
1956 int send_len = strlen(test_str) + 1;
1957 char buf[20];
1958 int ret;
1959
1960 if (self->notls)
1961 return;
1962
1963 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128,
1964 &tls12_0, 0);
1965 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128,
1966 &tls12_1, 1);
1967
1968 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12_0, tls12_0.len);
1969 ASSERT_EQ(ret, 0);
1970
1971 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12_1, tls12_1.len);
1972 ASSERT_EQ(ret, 0);
1973
1974 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12_1, tls12_1.len);
1975 EXPECT_EQ(ret, 0);
1976
1977 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1978 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len);
1979 EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
1980}
1981
1982TEST_F(tls_basic, disconnect)
1983{
1984 char const *test_str = "test_message";
1985 int send_len = strlen(test_str) + 1;
1986 struct tls_crypto_info_keys key;
1987 struct sockaddr_in addr;
1988 char buf[20];
1989 int ret;
1990
1991 if (self->notls)
1992 return;
1993
1994 tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128,
1995 &key, 0);
1996
1997 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &key, key.len);
1998 ASSERT_EQ(ret, 0);
1999
2000 /* Pre-queue the data so that setsockopt parses it but doesn't
2001 * dequeue it from the TCP socket. recvmsg would dequeue.
2002 */
2003 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
2004
2005 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &key, key.len);
2006 ASSERT_EQ(ret, 0);
2007
2008 addr.sin_family = AF_UNSPEC;
2009 addr.sin_addr.s_addr = htonl(INADDR_ANY);
2010 addr.sin_port = 0;
2011 ret = connect(self->cfd, &addr, sizeof(addr));
2012 EXPECT_EQ(ret, -1);
2013 EXPECT_EQ(errno, EOPNOTSUPP);
2014
2015 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len);
2016}
2017
2018TEST_F(tls, rekey)
2019{
2020 char const *test_str_1 = "test_message_before_rekey";
2021 char const *test_str_2 = "test_message_after_rekey";
2022 struct tls_crypto_info_keys tls12;
2023 int send_len;
2024 char buf[100];
2025
2026 if (variant->tls_version != TLS_1_3_VERSION)
2027 return;
2028
2029 /* initial send/recv */
2030 send_len = strlen(test_str_1) + 1;
2031 EXPECT_EQ(send(self->fd, test_str_1, send_len, 0), send_len);
2032 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len);
2033 EXPECT_EQ(memcmp(buf, test_str_1, send_len), 0);
2034
2035 /* update TX key */
2036 tls_send_keyupdate(_metadata, self->fd);
2037 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2038 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
2039
2040 /* send after rekey */
2041 send_len = strlen(test_str_2) + 1;
2042 EXPECT_EQ(send(self->fd, test_str_2, send_len, 0), send_len);
2043
2044 /* can't receive the KeyUpdate without a control message */
2045 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), -1);
2046
2047 /* get KeyUpdate */
2048 tls_recv_keyupdate(_metadata, self->cfd, 0);
2049
2050 /* recv blocking -> -EKEYEXPIRED */
2051 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), 0), -1);
2052 EXPECT_EQ(errno, EKEYEXPIRED);
2053
2054 /* recv non-blocking -> -EKEYEXPIRED */
2055 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_DONTWAIT), -1);
2056 EXPECT_EQ(errno, EKEYEXPIRED);
2057
2058 /* update RX key */
2059 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
2060
2061 /* recv after rekey */
2062 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1);
2063 EXPECT_EQ(memcmp(buf, test_str_2, send_len), 0);
2064}
2065
2066TEST_F(tls, rekey_fail)
2067{
2068 char const *test_str_1 = "test_message_before_rekey";
2069 char const *test_str_2 = "test_message_after_rekey";
2070 struct tls_crypto_info_keys tls12;
2071 int send_len;
2072 char buf[100];
2073
2074 /* initial send/recv */
2075 send_len = strlen(test_str_1) + 1;
2076 EXPECT_EQ(send(self->fd, test_str_1, send_len, 0), send_len);
2077 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len);
2078 EXPECT_EQ(memcmp(buf, test_str_1, send_len), 0);
2079
2080 /* update TX key */
2081 tls_send_keyupdate(_metadata, self->fd);
2082
2083 if (variant->tls_version != TLS_1_3_VERSION) {
2084 /* just check that rekey is not supported and return */
2085 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2086 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), -1);
2087 EXPECT_EQ(errno, EBUSY);
2088 return;
2089 }
2090
2091 /* successful update */
2092 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2093 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
2094
2095 /* invalid update: change of version */
2096 tls_crypto_info_init(TLS_1_2_VERSION, variant->cipher_type, &tls12, 1);
2097 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), -1);
2098 EXPECT_EQ(errno, EINVAL);
2099
2100 /* invalid update (RX socket): change of version */
2101 tls_crypto_info_init(TLS_1_2_VERSION, variant->cipher_type, &tls12, 1);
2102 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), -1);
2103 EXPECT_EQ(errno, EINVAL);
2104
2105 /* invalid update: change of cipher */
2106 if (variant->cipher_type == TLS_CIPHER_AES_GCM_256)
2107 tls_crypto_info_init(variant->tls_version, TLS_CIPHER_CHACHA20_POLY1305, &tls12, 1);
2108 else
2109 tls_crypto_info_init(variant->tls_version, TLS_CIPHER_AES_GCM_256, &tls12, 1);
2110 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), -1);
2111 EXPECT_EQ(errno, EINVAL);
2112
2113 /* send after rekey, the invalid updates shouldn't have an effect */
2114 send_len = strlen(test_str_2) + 1;
2115 EXPECT_EQ(send(self->fd, test_str_2, send_len, 0), send_len);
2116
2117 /* can't receive the KeyUpdate without a control message */
2118 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), -1);
2119
2120 /* get KeyUpdate */
2121 tls_recv_keyupdate(_metadata, self->cfd, 0);
2122
2123 /* recv blocking -> -EKEYEXPIRED */
2124 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), 0), -1);
2125 EXPECT_EQ(errno, EKEYEXPIRED);
2126
2127 /* recv non-blocking -> -EKEYEXPIRED */
2128 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_DONTWAIT), -1);
2129 EXPECT_EQ(errno, EKEYEXPIRED);
2130
2131 /* update RX key */
2132 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2133 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
2134
2135 /* recv after rekey */
2136 EXPECT_NE(recv(self->cfd, buf, send_len, 0), -1);
2137 EXPECT_EQ(memcmp(buf, test_str_2, send_len), 0);
2138}
2139
2140TEST_F(tls, rekey_peek)
2141{
2142 char const *test_str_1 = "test_message_before_rekey";
2143 struct tls_crypto_info_keys tls12;
2144 int send_len;
2145 char buf[100];
2146
2147 if (variant->tls_version != TLS_1_3_VERSION)
2148 return;
2149
2150 send_len = strlen(test_str_1) + 1;
2151 EXPECT_EQ(send(self->fd, test_str_1, send_len, 0), send_len);
2152
2153 /* update TX key */
2154 tls_send_keyupdate(_metadata, self->fd);
2155 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2156 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
2157
2158 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_PEEK), send_len);
2159 EXPECT_EQ(memcmp(buf, test_str_1, send_len), 0);
2160
2161 EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len);
2162 EXPECT_EQ(memcmp(buf, test_str_1, send_len), 0);
2163
2164 /* can't receive the KeyUpdate without a control message */
2165 EXPECT_EQ(recv(self->cfd, buf, send_len, MSG_PEEK), -1);
2166
2167 /* peek KeyUpdate */
2168 tls_recv_keyupdate(_metadata, self->cfd, MSG_PEEK);
2169
2170 /* get KeyUpdate */
2171 tls_recv_keyupdate(_metadata, self->cfd, 0);
2172
2173 /* update RX key */
2174 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
2175}
2176
2177TEST_F(tls, splice_rekey)
2178{
2179 int send_len = TLS_PAYLOAD_MAX_LEN / 2;
2180 char mem_send[TLS_PAYLOAD_MAX_LEN];
2181 char mem_recv[TLS_PAYLOAD_MAX_LEN];
2182 struct tls_crypto_info_keys tls12;
2183 int p[2];
2184
2185 if (variant->tls_version != TLS_1_3_VERSION)
2186 return;
2187
2188 memrnd(mem_send, sizeof(mem_send));
2189
2190 ASSERT_GE(pipe(p), 0);
2191 EXPECT_EQ(send(self->fd, mem_send, send_len, 0), send_len);
2192
2193 /* update TX key */
2194 tls_send_keyupdate(_metadata, self->fd);
2195 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2196 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
2197
2198 EXPECT_EQ(send(self->fd, mem_send, send_len, 0), send_len);
2199
2200 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, TLS_PAYLOAD_MAX_LEN, 0), send_len);
2201 EXPECT_EQ(read(p[0], mem_recv, send_len), send_len);
2202 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
2203
2204 /* can't splice the KeyUpdate */
2205 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, TLS_PAYLOAD_MAX_LEN, 0), -1);
2206 EXPECT_EQ(errno, EINVAL);
2207
2208 /* peek KeyUpdate */
2209 tls_recv_keyupdate(_metadata, self->cfd, MSG_PEEK);
2210
2211 /* get KeyUpdate */
2212 tls_recv_keyupdate(_metadata, self->cfd, 0);
2213
2214 /* can't splice before updating the key */
2215 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, TLS_PAYLOAD_MAX_LEN, 0), -1);
2216 EXPECT_EQ(errno, EKEYEXPIRED);
2217
2218 /* update RX key */
2219 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
2220
2221 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, TLS_PAYLOAD_MAX_LEN, 0), send_len);
2222 EXPECT_EQ(read(p[0], mem_recv, send_len), send_len);
2223 EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
2224}
2225
2226TEST_F(tls, rekey_peek_splice)
2227{
2228 char const *test_str_1 = "test_message_before_rekey";
2229 struct tls_crypto_info_keys tls12;
2230 int send_len;
2231 char buf[100];
2232 char mem_recv[TLS_PAYLOAD_MAX_LEN];
2233 int p[2];
2234
2235 if (variant->tls_version != TLS_1_3_VERSION)
2236 return;
2237
2238 ASSERT_GE(pipe(p), 0);
2239
2240 send_len = strlen(test_str_1) + 1;
2241 EXPECT_EQ(send(self->fd, test_str_1, send_len, 0), send_len);
2242
2243 /* update TX key */
2244 tls_send_keyupdate(_metadata, self->fd);
2245 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2246 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
2247
2248 EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), MSG_PEEK), send_len);
2249 EXPECT_EQ(memcmp(buf, test_str_1, send_len), 0);
2250
2251 EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, TLS_PAYLOAD_MAX_LEN, 0), send_len);
2252 EXPECT_EQ(read(p[0], mem_recv, send_len), send_len);
2253 EXPECT_EQ(memcmp(mem_recv, test_str_1, send_len), 0);
2254}
2255
2256TEST_F(tls, rekey_getsockopt)
2257{
2258 struct tls_crypto_info_keys tls12;
2259 struct tls_crypto_info_keys tls12_get;
2260 socklen_t len;
2261
2262 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 0);
2263
2264 len = tls12.len;
2265 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &tls12_get, &len), 0);
2266 EXPECT_EQ(len, tls12.len);
2267 EXPECT_EQ(memcmp(&tls12_get, &tls12, tls12.len), 0);
2268
2269 len = tls12.len;
2270 EXPECT_EQ(getsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12_get, &len), 0);
2271 EXPECT_EQ(len, tls12.len);
2272 EXPECT_EQ(memcmp(&tls12_get, &tls12, tls12.len), 0);
2273
2274 if (variant->tls_version != TLS_1_3_VERSION)
2275 return;
2276
2277 tls_send_keyupdate(_metadata, self->fd);
2278 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2279 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
2280
2281 tls_recv_keyupdate(_metadata, self->cfd, 0);
2282 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
2283
2284 len = tls12.len;
2285 EXPECT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &tls12_get, &len), 0);
2286 EXPECT_EQ(len, tls12.len);
2287 EXPECT_EQ(memcmp(&tls12_get, &tls12, tls12.len), 0);
2288
2289 len = tls12.len;
2290 EXPECT_EQ(getsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12_get, &len), 0);
2291 EXPECT_EQ(len, tls12.len);
2292 EXPECT_EQ(memcmp(&tls12_get, &tls12, tls12.len), 0);
2293}
2294
2295TEST_F(tls, rekey_poll_pending)
2296{
2297 char const *test_str = "test_message_after_rekey";
2298 struct tls_crypto_info_keys tls12;
2299 struct pollfd pfd = { };
2300 int send_len;
2301 int ret;
2302
2303 if (variant->tls_version != TLS_1_3_VERSION)
2304 return;
2305
2306 /* update TX key */
2307 tls_send_keyupdate(_metadata, self->fd);
2308 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2309 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
2310
2311 /* get KeyUpdate */
2312 tls_recv_keyupdate(_metadata, self->cfd, 0);
2313
2314 /* send immediately after rekey */
2315 send_len = strlen(test_str) + 1;
2316 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
2317
2318 /* key hasn't been updated, expect cfd to be non-readable */
2319 pfd.fd = self->cfd;
2320 pfd.events = POLLIN;
2321 EXPECT_EQ(poll(&pfd, 1, 0), 0);
2322
2323 ret = fork();
2324 ASSERT_GE(ret, 0);
2325
2326 if (ret) {
2327 int pid2, status;
2328
2329 /* wait before installing the new key */
2330 sleep(1);
2331
2332 /* update RX key while poll() is sleeping */
2333 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
2334
2335 pid2 = wait(&status);
2336 EXPECT_EQ(pid2, ret);
2337 EXPECT_EQ(status, 0);
2338 } else {
2339 pfd.fd = self->cfd;
2340 pfd.events = POLLIN;
2341 EXPECT_EQ(poll(&pfd, 1, 5000), 1);
2342
2343 exit(!__test_passed(_metadata));
2344 }
2345}
2346
2347TEST_F(tls, rekey_poll_delay)
2348{
2349 char const *test_str = "test_message_after_rekey";
2350 struct tls_crypto_info_keys tls12;
2351 struct pollfd pfd = { };
2352 int send_len;
2353 int ret;
2354
2355 if (variant->tls_version != TLS_1_3_VERSION)
2356 return;
2357
2358 /* update TX key */
2359 tls_send_keyupdate(_metadata, self->fd);
2360 tls_crypto_info_init(variant->tls_version, variant->cipher_type, &tls12, 1);
2361 EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
2362
2363 /* get KeyUpdate */
2364 tls_recv_keyupdate(_metadata, self->cfd, 0);
2365
2366 ret = fork();
2367 ASSERT_GE(ret, 0);
2368
2369 if (ret) {
2370 int pid2, status;
2371
2372 /* wait before installing the new key */
2373 sleep(1);
2374
2375 /* update RX key while poll() is sleeping */
2376 EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
2377
2378 sleep(1);
2379 send_len = strlen(test_str) + 1;
2380 EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
2381
2382 pid2 = wait(&status);
2383 EXPECT_EQ(pid2, ret);
2384 EXPECT_EQ(status, 0);
2385 } else {
2386 pfd.fd = self->cfd;
2387 pfd.events = POLLIN;
2388 EXPECT_EQ(poll(&pfd, 1, 5000), 1);
2389 exit(!__test_passed(_metadata));
2390 }
2391}
2392
2393struct raw_rec {
2394 unsigned int plain_len;
2395 unsigned char plain_data[100];
2396 unsigned int cipher_len;
2397 unsigned char cipher_data[128];
2398};
2399
2400/* TLS 1.2, AES_CCM, data, seqno:0, plaintext: 'Hello world' */
2401static const struct raw_rec id0_data_l11 = {
2402 .plain_len = 11,
2403 .plain_data = {
2404 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f,
2405 0x72, 0x6c, 0x64,
2406 },
2407 .cipher_len = 40,
2408 .cipher_data = {
2409 0x17, 0x03, 0x03, 0x00, 0x23, 0x00, 0x00, 0x00,
2410 0x00, 0x00, 0x00, 0x00, 0x00, 0x26, 0xa2, 0x33,
2411 0xde, 0x8d, 0x94, 0xf0, 0x29, 0x6c, 0xb1, 0xaf,
2412 0x6a, 0x75, 0xb2, 0x93, 0xad, 0x45, 0xd5, 0xfd,
2413 0x03, 0x51, 0x57, 0x8f, 0xf9, 0xcc, 0x3b, 0x42,
2414 },
2415};
2416
2417/* TLS 1.2, AES_CCM, ctrl, seqno:0, plaintext: '' */
2418static const struct raw_rec id0_ctrl_l0 = {
2419 .plain_len = 0,
2420 .plain_data = {
2421 },
2422 .cipher_len = 29,
2423 .cipher_data = {
2424 0x16, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00,
2425 0x00, 0x00, 0x00, 0x00, 0x00, 0x13, 0x38, 0x7b,
2426 0xa6, 0x1c, 0xdd, 0xa7, 0x19, 0x33, 0xab, 0xae,
2427 0x88, 0xe1, 0xd2, 0x08, 0x4f,
2428 },
2429};
2430
2431/* TLS 1.2, AES_CCM, data, seqno:0, plaintext: '' */
2432static const struct raw_rec id0_data_l0 = {
2433 .plain_len = 0,
2434 .plain_data = {
2435 },
2436 .cipher_len = 29,
2437 .cipher_data = {
2438 0x17, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00,
2439 0x00, 0x00, 0x00, 0x00, 0x00, 0xc5, 0x37, 0x90,
2440 0x70, 0x45, 0x89, 0xfb, 0x5c, 0xc7, 0x89, 0x03,
2441 0x68, 0x80, 0xd3, 0xd8, 0xcc,
2442 },
2443};
2444
2445/* TLS 1.2, AES_CCM, data, seqno:1, plaintext: 'Hello world' */
2446static const struct raw_rec id1_data_l11 = {
2447 .plain_len = 11,
2448 .plain_data = {
2449 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f,
2450 0x72, 0x6c, 0x64,
2451 },
2452 .cipher_len = 40,
2453 .cipher_data = {
2454 0x17, 0x03, 0x03, 0x00, 0x23, 0x00, 0x00, 0x00,
2455 0x00, 0x00, 0x00, 0x00, 0x01, 0x3a, 0x1a, 0x9c,
2456 0xd0, 0xa8, 0x9a, 0xd6, 0x69, 0xd6, 0x1a, 0xe3,
2457 0xb5, 0x1f, 0x0d, 0x2c, 0xe2, 0x97, 0x46, 0xff,
2458 0x2b, 0xcc, 0x5a, 0xc4, 0xa3, 0xb9, 0xef, 0xba,
2459 },
2460};
2461
2462/* TLS 1.2, AES_CCM, ctrl, seqno:1, plaintext: '' */
2463static const struct raw_rec id1_ctrl_l0 = {
2464 .plain_len = 0,
2465 .plain_data = {
2466 },
2467 .cipher_len = 29,
2468 .cipher_data = {
2469 0x16, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00,
2470 0x00, 0x00, 0x00, 0x00, 0x01, 0x3e, 0xf0, 0xfe,
2471 0xee, 0xd9, 0xe2, 0x5d, 0xc7, 0x11, 0x4c, 0xe6,
2472 0xb4, 0x7e, 0xef, 0x40, 0x2b,
2473 },
2474};
2475
2476/* TLS 1.2, AES_CCM, data, seqno:1, plaintext: '' */
2477static const struct raw_rec id1_data_l0 = {
2478 .plain_len = 0,
2479 .plain_data = {
2480 },
2481 .cipher_len = 29,
2482 .cipher_data = {
2483 0x17, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00,
2484 0x00, 0x00, 0x00, 0x00, 0x01, 0xce, 0xfc, 0x86,
2485 0xc8, 0xf0, 0x55, 0xf9, 0x47, 0x3f, 0x74, 0xdc,
2486 0xc9, 0xbf, 0xfe, 0x5b, 0xb1,
2487 },
2488};
2489
2490/* TLS 1.2, AES_CCM, ctrl, seqno:2, plaintext: 'Hello world' */
2491static const struct raw_rec id2_ctrl_l11 = {
2492 .plain_len = 11,
2493 .plain_data = {
2494 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f,
2495 0x72, 0x6c, 0x64,
2496 },
2497 .cipher_len = 40,
2498 .cipher_data = {
2499 0x16, 0x03, 0x03, 0x00, 0x23, 0x00, 0x00, 0x00,
2500 0x00, 0x00, 0x00, 0x00, 0x02, 0xe5, 0x3d, 0x19,
2501 0x3d, 0xca, 0xb8, 0x16, 0xb6, 0xff, 0x79, 0x87,
2502 0x2a, 0x04, 0x11, 0x3d, 0xf8, 0x64, 0x5f, 0x36,
2503 0x8b, 0xa8, 0xee, 0x4c, 0x6d, 0x62, 0xa5, 0x00,
2504 },
2505};
2506
2507/* TLS 1.2, AES_CCM, data, seqno:2, plaintext: 'Hello world' */
2508static const struct raw_rec id2_data_l11 = {
2509 .plain_len = 11,
2510 .plain_data = {
2511 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f,
2512 0x72, 0x6c, 0x64,
2513 },
2514 .cipher_len = 40,
2515 .cipher_data = {
2516 0x17, 0x03, 0x03, 0x00, 0x23, 0x00, 0x00, 0x00,
2517 0x00, 0x00, 0x00, 0x00, 0x02, 0xe5, 0x3d, 0x19,
2518 0x3d, 0xca, 0xb8, 0x16, 0xb6, 0xff, 0x79, 0x87,
2519 0x8e, 0xa1, 0xd0, 0xcd, 0x33, 0xb5, 0x86, 0x2b,
2520 0x17, 0xf1, 0x52, 0x2a, 0x55, 0x62, 0x65, 0x11,
2521 },
2522};
2523
2524/* TLS 1.2, AES_CCM, ctrl, seqno:2, plaintext: '' */
2525static const struct raw_rec id2_ctrl_l0 = {
2526 .plain_len = 0,
2527 .plain_data = {
2528 },
2529 .cipher_len = 29,
2530 .cipher_data = {
2531 0x16, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00,
2532 0x00, 0x00, 0x00, 0x00, 0x02, 0xdc, 0x5c, 0x0e,
2533 0x41, 0xdd, 0xba, 0xd3, 0xcc, 0xcf, 0x6d, 0xd9,
2534 0x06, 0xdb, 0x79, 0xe5, 0x5d,
2535 },
2536};
2537
2538/* TLS 1.2, AES_CCM, data, seqno:2, plaintext: '' */
2539static const struct raw_rec id2_data_l0 = {
2540 .plain_len = 0,
2541 .plain_data = {
2542 },
2543 .cipher_len = 29,
2544 .cipher_data = {
2545 0x17, 0x03, 0x03, 0x00, 0x18, 0x00, 0x00, 0x00,
2546 0x00, 0x00, 0x00, 0x00, 0x02, 0xc3, 0xca, 0x26,
2547 0x22, 0xe4, 0x25, 0xfb, 0x5f, 0x6d, 0xbf, 0x83,
2548 0x30, 0x48, 0x69, 0x1a, 0x47,
2549 },
2550};
2551
2552FIXTURE(zero_len)
2553{
2554 int fd, cfd;
2555 bool notls;
2556};
2557
2558FIXTURE_VARIANT(zero_len)
2559{
2560 const struct raw_rec *recs[4];
2561 ssize_t recv_ret[4];
2562};
2563
2564FIXTURE_VARIANT_ADD(zero_len, data_data_data)
2565{
2566 .recs = { &id0_data_l11, &id1_data_l11, &id2_data_l11, },
2567 .recv_ret = { 33, -EAGAIN, },
2568};
2569
2570FIXTURE_VARIANT_ADD(zero_len, data_0ctrl_data)
2571{
2572 .recs = { &id0_data_l11, &id1_ctrl_l0, &id2_data_l11, },
2573 .recv_ret = { 11, 0, 11, -EAGAIN, },
2574};
2575
2576FIXTURE_VARIANT_ADD(zero_len, 0data_0data_0data)
2577{
2578 .recs = { &id0_data_l0, &id1_data_l0, &id2_data_l0, },
2579 .recv_ret = { -EAGAIN, },
2580};
2581
2582FIXTURE_VARIANT_ADD(zero_len, 0data_0data_ctrl)
2583{
2584 .recs = { &id0_data_l0, &id1_data_l0, &id2_ctrl_l11, },
2585 .recv_ret = { 0, 11, -EAGAIN, },
2586};
2587
2588FIXTURE_VARIANT_ADD(zero_len, 0data_0data_0ctrl)
2589{
2590 .recs = { &id0_data_l0, &id1_data_l0, &id2_ctrl_l0, },
2591 .recv_ret = { 0, 0, -EAGAIN, },
2592};
2593
2594FIXTURE_VARIANT_ADD(zero_len, 0ctrl_0ctrl_0ctrl)
2595{
2596 .recs = { &id0_ctrl_l0, &id1_ctrl_l0, &id2_ctrl_l0, },
2597 .recv_ret = { 0, 0, 0, -EAGAIN, },
2598};
2599
2600FIXTURE_VARIANT_ADD(zero_len, 0data_0data_data)
2601{
2602 .recs = { &id0_data_l0, &id1_data_l0, &id2_data_l11, },
2603 .recv_ret = { 11, -EAGAIN, },
2604};
2605
2606FIXTURE_VARIANT_ADD(zero_len, data_0data_0data)
2607{
2608 .recs = { &id0_data_l11, &id1_data_l0, &id2_data_l0, },
2609 .recv_ret = { 11, -EAGAIN, },
2610};
2611
2612FIXTURE_SETUP(zero_len)
2613{
2614 struct tls_crypto_info_keys tls12;
2615 int ret;
2616
2617 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_CCM_128,
2618 &tls12, 0);
2619
2620 ulp_sock_pair(_metadata, &self->fd, &self->cfd, &self->notls);
2621 if (self->notls)
2622 return;
2623
2624 /* Don't install keys on fd, we'll send raw records */
2625 ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, tls12.len);
2626 ASSERT_EQ(ret, 0);
2627}
2628
2629FIXTURE_TEARDOWN(zero_len)
2630{
2631 close(self->fd);
2632 close(self->cfd);
2633}
2634
2635TEST_F(zero_len, test)
2636{
2637 const struct raw_rec *const *rec;
2638 unsigned char buf[128];
2639 int rec_off;
2640 int i;
2641
2642 for (i = 0; i < 4 && variant->recs[i]; i++)
2643 EXPECT_EQ(send(self->fd, variant->recs[i]->cipher_data,
2644 variant->recs[i]->cipher_len, 0),
2645 variant->recs[i]->cipher_len);
2646
2647 rec = &variant->recs[0];
2648 rec_off = 0;
2649 for (i = 0; i < 4; i++) {
2650 int j, ret;
2651
2652 ret = variant->recv_ret[i] >= 0 ? variant->recv_ret[i] : -1;
2653 EXPECT_EQ(__tls_recv_cmsg(_metadata, self->cfd, NULL,
2654 buf, sizeof(buf), MSG_DONTWAIT), ret);
2655 if (ret == -1)
2656 EXPECT_EQ(errno, -variant->recv_ret[i]);
2657 if (variant->recv_ret[i] == -EAGAIN)
2658 break;
2659
2660 for (j = 0; j < ret; j++) {
2661 while (rec_off == (*rec)->plain_len) {
2662 rec++;
2663 rec_off = 0;
2664 }
2665 EXPECT_EQ(buf[j], (*rec)->plain_data[rec_off]);
2666 rec_off++;
2667 }
2668 }
2669};
2670
2671FIXTURE(tls_err)
2672{
2673 int fd, cfd;
2674 int fd2, cfd2;
2675 bool notls;
2676};
2677
2678FIXTURE_VARIANT(tls_err)
2679{
2680 uint16_t tls_version;
2681};
2682
2683FIXTURE_VARIANT_ADD(tls_err, 12_aes_gcm)
2684{
2685 .tls_version = TLS_1_2_VERSION,
2686};
2687
2688FIXTURE_VARIANT_ADD(tls_err, 13_aes_gcm)
2689{
2690 .tls_version = TLS_1_3_VERSION,
2691};
2692
2693FIXTURE_SETUP(tls_err)
2694{
2695 struct tls_crypto_info_keys tls12;
2696 int ret;
2697
2698 tls_crypto_info_init(variant->tls_version, TLS_CIPHER_AES_GCM_128,
2699 &tls12, 0);
2700
2701 ulp_sock_pair(_metadata, &self->fd, &self->cfd, &self->notls);
2702 ulp_sock_pair(_metadata, &self->fd2, &self->cfd2, &self->notls);
2703 if (self->notls)
2704 return;
2705
2706 ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len);
2707 ASSERT_EQ(ret, 0);
2708
2709 ret = setsockopt(self->cfd2, SOL_TLS, TLS_RX, &tls12, tls12.len);
2710 ASSERT_EQ(ret, 0);
2711}
2712
2713FIXTURE_TEARDOWN(tls_err)
2714{
2715 close(self->fd);
2716 close(self->cfd);
2717 close(self->fd2);
2718 close(self->cfd2);
2719}
2720
2721TEST_F(tls_err, bad_rec)
2722{
2723 char buf[64];
2724
2725 if (self->notls)
2726 SKIP(return, "no TLS support");
2727
2728 memset(buf, 0x55, sizeof(buf));
2729 EXPECT_EQ(send(self->fd2, buf, sizeof(buf), 0), sizeof(buf));
2730 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2731 EXPECT_EQ(errno, EMSGSIZE);
2732 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), MSG_DONTWAIT), -1);
2733 EXPECT_EQ(errno, EAGAIN);
2734}
2735
2736/* cfd carries a byte stream, so one recv() can return part of a
2737 * record. Take the fragment length from the record header and wait
2738 * for the remainder.
2739 */
2740static void tls_send_bad_auth(struct __test_metadata *_metadata,
2741 int fd, int cfd, int fd2)
2742{
2743 char buf[128];
2744 int len;
2745
2746 memrnd(buf, sizeof(buf) / 2);
2747 ASSERT_EQ(send(fd, buf, sizeof(buf) / 2, 0), sizeof(buf) / 2);
2748
2749 ASSERT_EQ(recv(cfd, buf, TLS_HDR_LEN, MSG_WAITALL), TLS_HDR_LEN);
2750
2751 len = ((unsigned char)buf[3] << 8) | (unsigned char)buf[4];
2752 ASSERT_GT(len, 0);
2753 ASSERT_LE(len, (int)sizeof(buf) - TLS_HDR_LEN);
2754
2755 ASSERT_EQ(recv(cfd, buf + TLS_HDR_LEN, len, MSG_WAITALL), len);
2756
2757 buf[TLS_HDR_LEN + len - 1]++;
2758
2759 ASSERT_EQ(send(fd2, buf, TLS_HDR_LEN + len, 0), TLS_HDR_LEN + len);
2760}
2761
2762TEST_F(tls_err, bad_auth)
2763{
2764 char buf[128];
2765
2766 if (self->notls)
2767 SKIP(return, "no TLS support");
2768
2769 tls_send_bad_auth(_metadata, self->fd, self->cfd, self->fd2);
2770
2771 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2772 EXPECT_EQ(errno, EBADMSG);
2773 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2774 EXPECT_EQ(errno, EBADMSG);
2775}
2776
2777/* A record that did not authenticate breaks the connection for every
2778 * reader, splice included.
2779 *
2780 * The two decrypt paths reach that result differently. A synchronous
2781 * decrypt leaves the record parsed, so the splice re-runs the decrypt
2782 * and fails on the record itself; the ctx->async_wait.err check in
2783 * tls_sw_splice_read() is not what stops it. Only an asynchronous
2784 * decrypt, which needs a TLS 1.2 socket and an AEAD advertising
2785 * CRYPTO_ALG_ASYNC, consumes the record before the failure is
2786 * recorded, leaving that check the sole reason the splice fails.
2787 */
2788TEST_F(tls_err, bad_auth_splice)
2789{
2790 char buf[128];
2791 ssize_t ret;
2792 int p[2];
2793
2794 if (self->notls)
2795 SKIP(return, "no TLS support");
2796
2797 tls_send_bad_auth(_metadata, self->fd, self->cfd, self->fd2);
2798
2799 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2800 EXPECT_EQ(errno, EBADMSG);
2801
2802 ASSERT_GE(pipe(p), 0);
2803
2804 ret = splice(self->cfd2, NULL, p[1], NULL, sizeof(buf),
2805 SPLICE_F_NONBLOCK);
2806 EXPECT_EQ(ret, -1);
2807 EXPECT_EQ(errno, EBADMSG);
2808
2809 close(p[0]);
2810 close(p[1]);
2811}
2812
2813TEST_F(tls_err, bad_in_large_read)
2814{
2815 char txt[3][64];
2816 char cip[3][128];
2817 char buf[3 * 128];
2818 int i, n;
2819
2820 if (self->notls)
2821 SKIP(return, "no TLS support");
2822
2823 /* Put 3 records in the sockets */
2824 for (i = 0; i < 3; i++) {
2825 memrnd(txt[i], sizeof(txt[i]));
2826 EXPECT_EQ(send(self->fd, txt[i], sizeof(txt[i]), 0),
2827 sizeof(txt[i]));
2828 n = recv(self->cfd, cip[i], sizeof(cip[i]), 0);
2829 EXPECT_GT(n, sizeof(txt[i]));
2830 /* Break the third message */
2831 if (i == 2)
2832 cip[2][n - 1]++;
2833 EXPECT_EQ(send(self->fd2, cip[i], n, 0), n);
2834 }
2835
2836 /* We should be able to receive the first two messages */
2837 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), sizeof(txt[0]) * 2);
2838 EXPECT_EQ(memcmp(buf, txt[0], sizeof(txt[0])), 0);
2839 EXPECT_EQ(memcmp(buf + sizeof(txt[0]), txt[1], sizeof(txt[1])), 0);
2840 /* Third mesasge is bad */
2841 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2842 EXPECT_EQ(errno, EBADMSG);
2843 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2844 EXPECT_EQ(errno, EBADMSG);
2845}
2846
2847TEST_F(tls_err, bad_cmsg)
2848{
2849 char *test_str = "test_read";
2850 int send_len = 10;
2851 char cip[128];
2852 char buf[128];
2853 char txt[64];
2854 int n;
2855
2856 if (self->notls)
2857 SKIP(return, "no TLS support");
2858
2859 /* Queue up one data record */
2860 memrnd(txt, sizeof(txt));
2861 EXPECT_EQ(send(self->fd, txt, sizeof(txt), 0), sizeof(txt));
2862 n = recv(self->cfd, cip, sizeof(cip), 0);
2863 EXPECT_GT(n, sizeof(txt));
2864 EXPECT_EQ(send(self->fd2, cip, n, 0), n);
2865
2866 EXPECT_EQ(tls_send_cmsg(self->fd, 100, test_str, send_len, 0), 10);
2867 n = recv(self->cfd, cip, sizeof(cip), 0);
2868 cip[n - 1]++; /* Break it */
2869 EXPECT_GT(n, send_len);
2870 EXPECT_EQ(send(self->fd2, cip, n, 0), n);
2871
2872 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), sizeof(txt));
2873 EXPECT_EQ(memcmp(buf, txt, sizeof(txt)), 0);
2874 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2875 EXPECT_EQ(errno, EBADMSG);
2876 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2877 EXPECT_EQ(errno, EBADMSG);
2878}
2879
2880TEST_F(tls_err, timeo)
2881{
2882 struct timeval tv = { .tv_usec = 10000, };
2883 char buf[128];
2884 int ret;
2885
2886 if (self->notls)
2887 SKIP(return, "no TLS support");
2888
2889 ret = setsockopt(self->cfd2, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
2890 ASSERT_EQ(ret, 0);
2891
2892 ret = fork();
2893 ASSERT_GE(ret, 0);
2894
2895 if (ret) {
2896 usleep(1000); /* Give child a head start */
2897
2898 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2899 EXPECT_EQ(errno, EAGAIN);
2900
2901 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2902 EXPECT_EQ(errno, EAGAIN);
2903
2904 wait(&ret);
2905 } else {
2906 EXPECT_EQ(recv(self->cfd2, buf, sizeof(buf), 0), -1);
2907 EXPECT_EQ(errno, EAGAIN);
2908 exit(0);
2909 }
2910}
2911
2912TEST_F(tls_err, poll_partial_rec)
2913{
2914 struct pollfd pfd = { };
2915 ssize_t rec_len;
2916 char rec[256];
2917 char buf[128];
2918
2919 if (self->notls)
2920 SKIP(return, "no TLS support");
2921
2922 pfd.fd = self->cfd2;
2923 pfd.events = POLLIN;
2924 EXPECT_EQ(poll(&pfd, 1, 1), 0);
2925
2926 memrnd(buf, sizeof(buf));
2927 EXPECT_EQ(send(self->fd, buf, sizeof(buf), 0), sizeof(buf));
2928 rec_len = recv(self->cfd, rec, sizeof(rec), 0);
2929 EXPECT_GT(rec_len, sizeof(buf));
2930
2931 /* Write 100B, not the full record ... */
2932 EXPECT_EQ(send(self->fd2, rec, 100, 0), 100);
2933 /* ... no full record should mean no POLLIN */
2934 pfd.fd = self->cfd2;
2935 pfd.events = POLLIN;
2936 EXPECT_EQ(poll(&pfd, 1, 1), 0);
2937 /* Now write the rest, and it should all pop out of the other end. */
2938 EXPECT_EQ(send(self->fd2, rec + 100, rec_len - 100, 0), rec_len - 100);
2939 pfd.fd = self->cfd2;
2940 pfd.events = POLLIN;
2941 EXPECT_EQ(poll(&pfd, 1, 1), 1);
2942 EXPECT_EQ(recv(self->cfd2, rec, sizeof(rec), 0), sizeof(buf));
2943 EXPECT_EQ(memcmp(buf, rec, sizeof(buf)), 0);
2944}
2945
2946TEST_F(tls_err, epoll_partial_rec)
2947{
2948 struct epoll_event ev, events[10];
2949 ssize_t rec_len;
2950 char rec[256];
2951 char buf[128];
2952 int epollfd;
2953
2954 if (self->notls)
2955 SKIP(return, "no TLS support");
2956
2957 epollfd = epoll_create1(0);
2958 ASSERT_GE(epollfd, 0);
2959
2960 memset(&ev, 0, sizeof(ev));
2961 ev.events = EPOLLIN;
2962 ev.data.fd = self->cfd2;
2963 ASSERT_GE(epoll_ctl(epollfd, EPOLL_CTL_ADD, self->cfd2, &ev), 0);
2964
2965 EXPECT_EQ(epoll_wait(epollfd, events, 10, 0), 0);
2966
2967 memrnd(buf, sizeof(buf));
2968 EXPECT_EQ(send(self->fd, buf, sizeof(buf), 0), sizeof(buf));
2969 rec_len = recv(self->cfd, rec, sizeof(rec), 0);
2970 EXPECT_GT(rec_len, sizeof(buf));
2971
2972 /* Write 100B, not the full record ... */
2973 EXPECT_EQ(send(self->fd2, rec, 100, 0), 100);
2974 /* ... no full record should mean no POLLIN */
2975 EXPECT_EQ(epoll_wait(epollfd, events, 10, 0), 0);
2976 /* Now write the rest, and it should all pop out of the other end. */
2977 EXPECT_EQ(send(self->fd2, rec + 100, rec_len - 100, 0), rec_len - 100);
2978 EXPECT_EQ(epoll_wait(epollfd, events, 10, 0), 1);
2979 EXPECT_EQ(recv(self->cfd2, rec, sizeof(rec), 0), sizeof(buf));
2980 EXPECT_EQ(memcmp(buf, rec, sizeof(buf)), 0);
2981
2982 close(epollfd);
2983}
2984
2985TEST_F(tls_err, poll_partial_rec_async)
2986{
2987 struct pollfd pfd = { };
2988 char token = '\0';
2989 ssize_t rec_len;
2990 char rec[256];
2991 char buf[128];
2992 int p[2];
2993 int ret;
2994
2995 if (self->notls)
2996 SKIP(return, "no TLS support");
2997
2998 ASSERT_GE(pipe(p), 0);
2999
3000 memrnd(buf, sizeof(buf));
3001 EXPECT_EQ(send(self->fd, buf, sizeof(buf), 0), sizeof(buf));
3002 rec_len = recv(self->cfd, rec, sizeof(rec), 0);
3003 EXPECT_GT(rec_len, sizeof(buf));
3004
3005 ret = fork();
3006 ASSERT_GE(ret, 0);
3007
3008 if (ret) {
3009 int status, pid2;
3010
3011 close(p[1]);
3012 usleep(1000); /* Give child a head start */
3013
3014 EXPECT_EQ(send(self->fd2, rec, 100, 0), 100);
3015
3016 EXPECT_EQ(read(p[0], &token, 1), 1); /* Barrier #1 */
3017
3018 EXPECT_EQ(send(self->fd2, rec + 100, rec_len - 100, 0),
3019 rec_len - 100);
3020
3021 pid2 = wait(&status);
3022 EXPECT_EQ(pid2, ret);
3023 EXPECT_EQ(status, 0);
3024 } else {
3025 close(p[0]);
3026
3027 /* Child should sleep in poll(), never get a wake */
3028 pfd.fd = self->cfd2;
3029 pfd.events = POLLIN;
3030 EXPECT_EQ(poll(&pfd, 1, 20), 0);
3031
3032 EXPECT_EQ(write(p[1], &token, 1), 1); /* Barrier #1 */
3033
3034 pfd.fd = self->cfd2;
3035 pfd.events = POLLIN;
3036 EXPECT_EQ(poll(&pfd, 1, 20), 1);
3037
3038 exit(!__test_passed(_metadata));
3039 }
3040}
3041
3042/* Use OOB+large send to trigger copy mode due to memory pressure.
3043 * OOB causes a short read.
3044 */
3045TEST_F(tls_err, oob_pressure)
3046{
3047 char buf[1<<16];
3048 int i;
3049
3050 memrnd(buf, sizeof(buf));
3051
3052 EXPECT_EQ(send(self->fd2, buf, 5, MSG_OOB), 5);
3053 EXPECT_EQ(send(self->fd2, buf, sizeof(buf), 0), sizeof(buf));
3054 for (i = 0; i < 64; i++)
3055 EXPECT_EQ(send(self->fd2, buf, 5, MSG_OOB), 5);
3056}
3057
3058/*
3059 * Parse a stream of TLS records and ensure that each record respects
3060 * the specified @max_payload_len.
3061 */
3062static size_t parse_tls_records(struct __test_metadata *_metadata,
3063 const __u8 *rx_buf, int rx_len, int overhead,
3064 __u16 max_payload_len)
3065{
3066 const __u8 *rec = rx_buf;
3067 size_t total_plaintext_rx = 0;
3068
3069 while (rec < rx_buf + rx_len) {
3070 __u16 record_payload_len;
3071 __u16 plaintext_len;
3072
3073 /* Sanity check that it's a TLS header for application data */
3074 ASSERT_EQ(rec[0], 23);
3075 ASSERT_EQ(rec[1], 0x3);
3076 ASSERT_EQ(rec[2], 0x3);
3077
3078 memcpy(&record_payload_len, rec + 3, 2);
3079 record_payload_len = ntohs(record_payload_len);
3080 ASSERT_GE(record_payload_len, overhead);
3081
3082 plaintext_len = record_payload_len - overhead;
3083 total_plaintext_rx += plaintext_len;
3084
3085 /* Plaintext must not exceed the specified limit */
3086 ASSERT_LE(plaintext_len, max_payload_len);
3087 rec += TLS_HDR_LEN + record_payload_len;
3088 }
3089
3090 return total_plaintext_rx;
3091}
3092
3093TEST(tls_12_tx_max_payload_len)
3094{
3095 struct tls_crypto_info_keys tls12;
3096 int cfd, ret, fd, overhead;
3097 size_t total_plaintext_rx = 0;
3098 __u8 tx[1024], rx[2000];
3099 __u16 limit = 128;
3100 __u16 opt = 0;
3101 unsigned int optlen = sizeof(opt);
3102 bool notls;
3103
3104 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_CCM_128,
3105 &tls12, 0);
3106
3107 ulp_sock_pair(_metadata, &fd, &cfd, &notls);
3108
3109 if (notls)
3110 exit(KSFT_SKIP);
3111
3112 /* Don't install keys on fd, we'll parse raw records */
3113 ret = setsockopt(cfd, SOL_TLS, TLS_TX, &tls12, tls12.len);
3114 ASSERT_EQ(ret, 0);
3115
3116 ret = setsockopt(cfd, SOL_TLS, TLS_TX_MAX_PAYLOAD_LEN, &limit,
3117 sizeof(limit));
3118 ASSERT_EQ(ret, 0);
3119
3120 ret = getsockopt(cfd, SOL_TLS, TLS_TX_MAX_PAYLOAD_LEN, &opt, &optlen);
3121 EXPECT_EQ(ret, 0);
3122 EXPECT_EQ(limit, opt);
3123 EXPECT_EQ(optlen, sizeof(limit));
3124
3125 memset(tx, 0, sizeof(tx));
3126 ASSERT_EQ(send(cfd, tx, sizeof(tx), 0), sizeof(tx));
3127 close(cfd);
3128
3129 ret = recv(fd, rx, sizeof(rx), 0);
3130
3131 /*
3132 * 16B tag + 8B IV -- record header (5B) is not counted but we'll
3133 * need it to walk the record stream
3134 */
3135 overhead = 16 + 8;
3136 total_plaintext_rx = parse_tls_records(_metadata, rx, ret, overhead,
3137 limit);
3138
3139 ASSERT_EQ(total_plaintext_rx, sizeof(tx));
3140 close(fd);
3141}
3142
3143TEST(tls_12_tx_max_payload_len_open_rec)
3144{
3145 struct tls_crypto_info_keys tls12;
3146 int cfd, ret, fd, overhead;
3147 size_t total_plaintext_rx = 0;
3148 __u8 tx[1024], rx[2000];
3149 __u16 tx_partial = 256;
3150 __u16 og_limit = 512, limit = 128;
3151 bool notls;
3152
3153 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_CCM_128,
3154 &tls12, 0);
3155
3156 ulp_sock_pair(_metadata, &fd, &cfd, &notls);
3157
3158 if (notls)
3159 exit(KSFT_SKIP);
3160
3161 /* Don't install keys on fd, we'll parse raw records */
3162 ret = setsockopt(cfd, SOL_TLS, TLS_TX, &tls12, tls12.len);
3163 ASSERT_EQ(ret, 0);
3164
3165 ret = setsockopt(cfd, SOL_TLS, TLS_TX_MAX_PAYLOAD_LEN, &og_limit,
3166 sizeof(og_limit));
3167 ASSERT_EQ(ret, 0);
3168
3169 memset(tx, 0, sizeof(tx));
3170 ASSERT_EQ(send(cfd, tx, tx_partial, MSG_MORE), tx_partial);
3171
3172 /*
3173 * Changing the payload limit with a pending open record should
3174 * not be allowed.
3175 */
3176 ret = setsockopt(cfd, SOL_TLS, TLS_TX_MAX_PAYLOAD_LEN, &limit,
3177 sizeof(limit));
3178 ASSERT_EQ(ret, -1);
3179 ASSERT_EQ(errno, EBUSY);
3180
3181 ASSERT_EQ(send(cfd, tx + tx_partial, sizeof(tx) - tx_partial, MSG_EOR),
3182 sizeof(tx) - tx_partial);
3183 close(cfd);
3184
3185 ret = recv(fd, rx, sizeof(rx), 0);
3186
3187 /*
3188 * 16B tag + 8B IV -- record header (5B) is not counted but we'll
3189 * need it to walk the record stream
3190 */
3191 overhead = 16 + 8;
3192 total_plaintext_rx = parse_tls_records(_metadata, rx, ret, overhead,
3193 og_limit);
3194 ASSERT_EQ(total_plaintext_rx, sizeof(tx));
3195 close(fd);
3196}
3197
3198TEST(non_established) {
3199 struct tls12_crypto_info_aes_gcm_256 tls12;
3200 struct sockaddr_in addr;
3201 int sfd, ret, fd;
3202 socklen_t len;
3203
3204 len = sizeof(addr);
3205
3206 memset(&tls12, 0, sizeof(tls12));
3207 tls12.info.version = TLS_1_2_VERSION;
3208 tls12.info.cipher_type = TLS_CIPHER_AES_GCM_256;
3209
3210 addr.sin_family = AF_INET;
3211 addr.sin_addr.s_addr = htonl(INADDR_ANY);
3212 addr.sin_port = 0;
3213
3214 fd = socket(AF_INET, SOCK_STREAM, 0);
3215 sfd = socket(AF_INET, SOCK_STREAM, 0);
3216
3217 ret = bind(sfd, &addr, sizeof(addr));
3218 ASSERT_EQ(ret, 0);
3219 ret = listen(sfd, 10);
3220 ASSERT_EQ(ret, 0);
3221
3222 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
3223 EXPECT_EQ(ret, -1);
3224 /* TLS ULP not supported */
3225 if (errno == ENOENT)
3226 return;
3227 EXPECT_EQ(errno, ENOTCONN);
3228
3229 ret = setsockopt(sfd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
3230 EXPECT_EQ(ret, -1);
3231 EXPECT_EQ(errno, ENOTCONN);
3232
3233 ret = getsockname(sfd, &addr, &len);
3234 ASSERT_EQ(ret, 0);
3235
3236 ret = connect(fd, &addr, sizeof(addr));
3237 ASSERT_EQ(ret, 0);
3238
3239 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
3240 ASSERT_EQ(ret, 0);
3241
3242 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
3243 EXPECT_EQ(ret, -1);
3244 EXPECT_EQ(errno, EEXIST);
3245
3246 close(fd);
3247 close(sfd);
3248}
3249
3250TEST(keysizes) {
3251 struct tls12_crypto_info_aes_gcm_256 tls12;
3252 int ret, fd, cfd;
3253 bool notls;
3254
3255 memset(&tls12, 0, sizeof(tls12));
3256 tls12.info.version = TLS_1_2_VERSION;
3257 tls12.info.cipher_type = TLS_CIPHER_AES_GCM_256;
3258
3259 ulp_sock_pair(_metadata, &fd, &cfd, &notls);
3260
3261 if (!notls) {
3262 ret = setsockopt(fd, SOL_TLS, TLS_TX, &tls12,
3263 sizeof(tls12));
3264 EXPECT_EQ(ret, 0);
3265
3266 ret = setsockopt(cfd, SOL_TLS, TLS_RX, &tls12,
3267 sizeof(tls12));
3268 EXPECT_EQ(ret, 0);
3269 }
3270
3271 close(fd);
3272 close(cfd);
3273}
3274
3275TEST(no_pad) {
3276 struct tls12_crypto_info_aes_gcm_256 tls12;
3277 int ret, fd, cfd, val;
3278 socklen_t len;
3279 bool notls;
3280
3281 memset(&tls12, 0, sizeof(tls12));
3282 tls12.info.version = TLS_1_3_VERSION;
3283 tls12.info.cipher_type = TLS_CIPHER_AES_GCM_256;
3284
3285 ulp_sock_pair(_metadata, &fd, &cfd, &notls);
3286
3287 if (notls)
3288 exit(KSFT_SKIP);
3289
3290 ret = setsockopt(fd, SOL_TLS, TLS_TX, &tls12, sizeof(tls12));
3291 EXPECT_EQ(ret, 0);
3292
3293 ret = setsockopt(cfd, SOL_TLS, TLS_RX, &tls12, sizeof(tls12));
3294 EXPECT_EQ(ret, 0);
3295
3296 val = 1;
3297 ret = setsockopt(cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD,
3298 (void *)&val, sizeof(val));
3299 EXPECT_EQ(ret, 0);
3300
3301 len = sizeof(val);
3302 val = 2;
3303 ret = getsockopt(cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD,
3304 (void *)&val, &len);
3305 EXPECT_EQ(ret, 0);
3306 EXPECT_EQ(val, 1);
3307 EXPECT_EQ(len, 4);
3308
3309 val = 0;
3310 ret = setsockopt(cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD,
3311 (void *)&val, sizeof(val));
3312 EXPECT_EQ(ret, 0);
3313
3314 len = sizeof(val);
3315 val = 2;
3316 ret = getsockopt(cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD,
3317 (void *)&val, &len);
3318 EXPECT_EQ(ret, 0);
3319 EXPECT_EQ(val, 0);
3320 EXPECT_EQ(len, 4);
3321
3322 close(fd);
3323 close(cfd);
3324}
3325
3326TEST(tls_v6ops) {
3327 struct tls_crypto_info_keys tls12;
3328 struct sockaddr_in6 addr, addr2;
3329 int sfd, ret, fd;
3330 socklen_t len, len2;
3331
3332 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_GCM_128, &tls12, 0);
3333
3334 addr.sin6_family = AF_INET6;
3335 addr.sin6_addr = in6addr_any;
3336 addr.sin6_port = 0;
3337
3338 fd = socket(AF_INET6, SOCK_STREAM, 0);
3339 sfd = socket(AF_INET6, SOCK_STREAM, 0);
3340
3341 ret = bind(sfd, &addr, sizeof(addr));
3342 ASSERT_EQ(ret, 0);
3343 ret = listen(sfd, 10);
3344 ASSERT_EQ(ret, 0);
3345
3346 len = sizeof(addr);
3347 ret = getsockname(sfd, &addr, &len);
3348 ASSERT_EQ(ret, 0);
3349
3350 ret = connect(fd, &addr, sizeof(addr));
3351 ASSERT_EQ(ret, 0);
3352
3353 len = sizeof(addr);
3354 ret = getsockname(fd, &addr, &len);
3355 ASSERT_EQ(ret, 0);
3356
3357 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
3358 if (ret) {
3359 ASSERT_EQ(errno, ENOENT);
3360 SKIP(return, "no TLS support");
3361 }
3362 ASSERT_EQ(ret, 0);
3363
3364 ret = setsockopt(fd, SOL_TLS, TLS_TX, &tls12, tls12.len);
3365 ASSERT_EQ(ret, 0);
3366
3367 ret = setsockopt(fd, SOL_TLS, TLS_RX, &tls12, tls12.len);
3368 ASSERT_EQ(ret, 0);
3369
3370 len2 = sizeof(addr2);
3371 ret = getsockname(fd, &addr2, &len2);
3372 ASSERT_EQ(ret, 0);
3373
3374 EXPECT_EQ(len2, len);
3375 EXPECT_EQ(memcmp(&addr, &addr2, len), 0);
3376
3377 close(fd);
3378 close(sfd);
3379}
3380
3381TEST(prequeue) {
3382 struct tls_crypto_info_keys tls12;
3383 char buf[20000], buf2[20000];
3384 struct sockaddr_in addr;
3385 int sfd, cfd, ret, fd;
3386 socklen_t len;
3387
3388 len = sizeof(addr);
3389 memrnd(buf, sizeof(buf));
3390
3391 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_GCM_256, &tls12, 0);
3392
3393 addr.sin_family = AF_INET;
3394 addr.sin_addr.s_addr = htonl(INADDR_ANY);
3395 addr.sin_port = 0;
3396
3397 fd = socket(AF_INET, SOCK_STREAM, 0);
3398 sfd = socket(AF_INET, SOCK_STREAM, 0);
3399
3400 ASSERT_EQ(bind(sfd, &addr, sizeof(addr)), 0);
3401 ASSERT_EQ(listen(sfd, 10), 0);
3402 ASSERT_EQ(getsockname(sfd, &addr, &len), 0);
3403 ASSERT_EQ(connect(fd, &addr, sizeof(addr)), 0);
3404 ASSERT_GE(cfd = accept(sfd, &addr, &len), 0);
3405 close(sfd);
3406
3407 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
3408 if (ret) {
3409 ASSERT_EQ(errno, ENOENT);
3410 SKIP(return, "no TLS support");
3411 }
3412
3413 ASSERT_EQ(setsockopt(fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0);
3414 EXPECT_EQ(send(fd, buf, sizeof(buf), MSG_DONTWAIT), sizeof(buf));
3415
3416 ASSERT_EQ(setsockopt(cfd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")), 0);
3417 ASSERT_EQ(setsockopt(cfd, SOL_TLS, TLS_RX, &tls12, tls12.len), 0);
3418 EXPECT_EQ(recv(cfd, buf2, sizeof(buf2), MSG_WAITALL), sizeof(buf2));
3419
3420 EXPECT_EQ(memcmp(buf, buf2, sizeof(buf)), 0);
3421
3422 close(fd);
3423 close(cfd);
3424}
3425
3426TEST(data_steal) {
3427 struct tls_crypto_info_keys tls;
3428 char buf[20000], buf2[20000];
3429 struct sockaddr_in addr;
3430 int sfd, cfd, ret, fd;
3431 int pid, status;
3432 socklen_t len;
3433
3434 len = sizeof(addr);
3435 memrnd(buf, sizeof(buf));
3436
3437 tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_GCM_256, &tls, 0);
3438
3439 addr.sin_family = AF_INET;
3440 addr.sin_addr.s_addr = htonl(INADDR_ANY);
3441 addr.sin_port = 0;
3442
3443 fd = socket(AF_INET, SOCK_STREAM, 0);
3444 sfd = socket(AF_INET, SOCK_STREAM, 0);
3445
3446 ASSERT_EQ(bind(sfd, &addr, sizeof(addr)), 0);
3447 ASSERT_EQ(listen(sfd, 10), 0);
3448 ASSERT_EQ(getsockname(sfd, &addr, &len), 0);
3449 ASSERT_EQ(connect(fd, &addr, sizeof(addr)), 0);
3450 ASSERT_GE(cfd = accept(sfd, &addr, &len), 0);
3451 close(sfd);
3452
3453 ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
3454 if (ret) {
3455 ASSERT_EQ(errno, ENOENT);
3456 SKIP(return, "no TLS support");
3457 }
3458 ASSERT_EQ(setsockopt(cfd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")), 0);
3459
3460 /* Spawn a child and get it into the read wait path of the underlying
3461 * TCP socket (before kernel .recvmsg is replaced with the TLS one).
3462 */
3463 pid = fork();
3464 ASSERT_GE(pid, 0);
3465 if (!pid) {
3466 EXPECT_EQ(recv(cfd, buf, sizeof(buf) / 2 + 1, MSG_WAITALL),
3467 sizeof(buf) / 2 + 1);
3468 exit(!__test_passed(_metadata));
3469 }
3470
3471 /* Send a sync byte and poll until it's consumed to ensure
3472 * the child is in recv() before we proceed to install TLS.
3473 */
3474 ASSERT_EQ(send(fd, buf, 1, 0), 1);
3475 do {
3476 usleep(500);
3477 } while (recv(cfd, buf, 1, MSG_PEEK | MSG_DONTWAIT) == 1);
3478 EXPECT_EQ(errno, EAGAIN);
3479
3480 ASSERT_EQ(setsockopt(fd, SOL_TLS, TLS_TX, &tls, tls.len), 0);
3481 ASSERT_EQ(setsockopt(cfd, SOL_TLS, TLS_RX, &tls, tls.len), 0);
3482
3483 EXPECT_EQ(send(fd, buf, sizeof(buf), 0), sizeof(buf));
3484 EXPECT_EQ(wait(&status), pid);
3485 EXPECT_EQ(status, 0);
3486 EXPECT_EQ(recv(cfd, buf2, sizeof(buf2), MSG_DONTWAIT), -1);
3487 /* Don't check errno, the error will be different depending
3488 * on what random bytes TLS interpreted as the record length.
3489 */
3490
3491 close(fd);
3492 close(cfd);
3493}
3494
3495static void __attribute__((constructor)) fips_check(void) {
3496 int res;
3497 FILE *f;
3498
3499 f = fopen("/proc/sys/crypto/fips_enabled", "r");
3500 if (f) {
3501 res = fscanf(f, "%d", &fips_enabled);
3502 if (res != 1)
3503 ksft_print_msg("ERROR: Couldn't read /proc/sys/crypto/fips_enabled\n");
3504 fclose(f);
3505 }
3506}
3507
3508TEST_HARNESS_MAIN