rst.c

  1// SPDX-License-Identifier: GPL-2.0
  2/*
  3 * The test checks that both active and passive reset have correct TCP-AO
  4 * signature. An "active" reset (abort) here is procured from closing
  5 * listen() socket with non-accepted connections in the queue:
  6 * inet_csk_listen_stop() => inet_child_forget() =>
  7 *                        => tcp_disconnect() => tcp_send_active_reset()
  8 *
  9 * The passive reset is quite hard to get on established TCP connections.
 10 * It could be procured from non-established states, but the synchronization
 11 * part from userspace in order to reliably get RST seems uneasy.
 12 * So, instead it's procured by corrupting SEQ number on TIMED-WAIT state.
 13 *
 14 * It's important to test both passive and active RST as they go through
 15 * different code-paths:
 16 * - tcp_send_active_reset() makes no-data skb, sends it with tcp_transmit_skb()
 17 * - tcp_v*_send_reset() create their reply skbs and send them with
 18 *   ip_send_unicast_reply()
 19 *
 20 * In both cases TCP-AO signatures have to be correct, which is verified by
 21 * (1) checking that the TCP-AO connection was reset and (2) TCP-AO counters.
 22 *
 23 * Author: Dmitry Safonov <dima@arista.com>
 24 */
 25#include <inttypes.h>
 26#include "../../../../include/linux/kernel.h"
 27#include "aolib.h"
 28
 29const size_t quota = 1000;
 30const size_t packet_sz = 100;
 31/*
 32 * Backlog == 0 means 1 connection in queue, see:
 33 * commit 64a146513f8f ("[NET]: Revert incorrect accept queue...")
 34 */
 35const unsigned int backlog;
 36
 37static void netstats_check(struct netstat *before, struct netstat *after,
 38			   char *msg)
 39{
 40	uint64_t before_cnt, after_cnt;
 41
 42	before_cnt = netstat_get(before, "TCPAORequired", NULL);
 43	after_cnt = netstat_get(after, "TCPAORequired", NULL);
 44	if (after_cnt > before_cnt)
 45		test_fail("Segments without AO sign (%s): %" PRIu64 " => %" PRIu64,
 46			  msg, before_cnt, after_cnt);
 47	else
 48		test_ok("No segments without AO sign (%s)", msg);
 49
 50	before_cnt = netstat_get(before, "TCPAOGood", NULL);
 51	after_cnt = netstat_get(after, "TCPAOGood", NULL);
 52	if (after_cnt <= before_cnt)
 53		test_fail("Signed AO segments (%s): %" PRIu64 " => %" PRIu64,
 54			  msg, before_cnt, after_cnt);
 55	else
 56		test_ok("Signed AO segments (%s): %" PRIu64 " => %" PRIu64,
 57			  msg, before_cnt, after_cnt);
 58
 59	before_cnt = netstat_get(before, "TCPAOBad", NULL);
 60	after_cnt = netstat_get(after, "TCPAOBad", NULL);
 61	if (after_cnt > before_cnt)
 62		test_fail("Segments with bad AO sign (%s): %" PRIu64 " => %" PRIu64,
 63			  msg, before_cnt, after_cnt);
 64	else
 65		test_ok("No segments with bad AO sign (%s)", msg);
 66}
 67
 68/*
 69 * Another way to send RST, but not through tcp_v{4,6}_send_reset()
 70 * is tcp_send_active_reset(), that is not in reply to inbound segment,
 71 * but rather active send. It uses tcp_transmit_skb(), so that should
 72 * work, but as it also sends RST - nice that it can be covered as well.
 73 */
 74static void close_forced(int sk)
 75{
 76	struct linger sl;
 77
 78	sl.l_onoff = 1;
 79	sl.l_linger = 0;
 80	if (setsockopt(sk, SOL_SOCKET, SO_LINGER, &sl, sizeof(sl)))
 81		test_error("setsockopt(SO_LINGER)");
 82	close(sk);
 83}
 84
 85static void test_server_active_rst(unsigned int port)
 86{
 87	struct tcp_counters cnt1, cnt2;
 88	ssize_t bytes;
 89	int sk, lsk;
 90
 91	lsk = test_listen_socket(this_ip_addr, port, backlog);
 92	if (test_add_key(lsk, DEFAULT_TEST_PASSWORD, this_ip_dest, -1, 100, 100))
 93		test_error("setsockopt(TCP_AO_ADD_KEY)");
 94	if (test_get_tcp_counters(lsk, &cnt1))
 95		test_error("test_get_tcp_counters()");
 96
 97	synchronize_threads(); /* 1: MKT added */
 98	if (test_wait_fd(lsk, TEST_TIMEOUT_SEC, 0))
 99		test_error("test_wait_fd()");
100
101	sk = accept(lsk, NULL, NULL);
102	if (sk < 0)
103		test_error("accept()");
104
105	synchronize_threads(); /* 2: connection accept()ed, another queued */
106	if (test_get_tcp_counters(lsk, &cnt2))
107		test_error("test_get_tcp_counters()");
108
109	synchronize_threads(); /* 3: close listen socket */
110	close(lsk);
111	bytes = test_server_run(sk, quota, 0);
112	if (bytes != quota)
113		test_error("servered only %zd bytes", bytes);
114	else
115		test_ok("servered %zd bytes", bytes);
116
117	synchronize_threads(); /* 4: finishing up */
118	close_forced(sk);
119
120	synchronize_threads(); /* 5: closed active sk */
121
122	synchronize_threads(); /* 6: counters checks */
123	if (test_assert_counters("active RST server", &cnt1, &cnt2, TEST_CNT_GOOD))
124		test_fail("MKT counters (server) have not only good packets");
125	else
126		test_ok("MKT counters are good on server");
127}
128
129static void test_server_passive_rst(unsigned int port)
130{
131	struct tcp_counters cnt1, cnt2;
132	int sk, lsk;
133	ssize_t bytes;
134
135	lsk = test_listen_socket(this_ip_addr, port, 1);
136
137	if (test_add_key(lsk, DEFAULT_TEST_PASSWORD, this_ip_dest, -1, 100, 100))
138		test_error("setsockopt(TCP_AO_ADD_KEY)");
139
140	synchronize_threads(); /* 1: MKT added => connect() */
141	if (test_wait_fd(lsk, TEST_TIMEOUT_SEC, 0))
142		test_error("test_wait_fd()");
143
144	sk = accept(lsk, NULL, NULL);
145	if (sk < 0)
146		test_error("accept()");
147
148	synchronize_threads(); /* 2: accepted => send data */
149	close(lsk);
150	if (test_get_tcp_counters(sk, &cnt1))
151		test_error("test_get_tcp_counters()");
152
153	bytes = test_server_run(sk, quota, TEST_TIMEOUT_SEC);
154	if (bytes != quota) {
155		if (bytes > 0)
156			test_fail("server served: %zd", bytes);
157		else
158			test_fail("server returned %zd", bytes);
159	}
160
161	synchronize_threads(); /* 3: checkpoint the client */
162	synchronize_threads(); /* 4: close the server, creating twsk */
163	if (test_get_tcp_counters(sk, &cnt2))
164		test_error("test_get_tcp_counters()");
165	close(sk);
166
167	synchronize_threads(); /* 5: restore the socket, send more data */
168	test_assert_counters("passive RST server", &cnt1, &cnt2, TEST_CNT_GOOD);
169
170	synchronize_threads(); /* 6: server exits */
171}
172
173static void *server_fn(void *arg)
174{
175	struct netstat *ns_before, *ns_after;
176	unsigned int port = test_server_port;
177
178	ns_before = netstat_read();
179
180	test_server_active_rst(port++);
181	test_server_passive_rst(port++);
182
183	ns_after = netstat_read();
184	netstats_check(ns_before, ns_after, "server");
185	netstat_free(ns_after);
186	netstat_free(ns_before);
187	synchronize_threads(); /* exit */
188
189	synchronize_threads(); /* don't race to exit() - client exits */
190	return NULL;
191}
192
193static int test_wait_fds(int sk[], size_t nr, bool is_writable[],
194			 ssize_t wait_for, time_t sec)
195{
196	struct timeval tv = { .tv_sec = sec };
197	struct timeval *ptv = NULL;
198	fd_set left;
199	size_t i;
200	int ret;
201
202	FD_ZERO(&left);
203	for (i = 0; i < nr; i++) {
204		FD_SET(sk[i], &left);
205		if (is_writable)
206			is_writable[i] = false;
207	}
208
209	if (sec)
210		ptv = &tv;
211
212	do {
213		bool is_empty = true;
214		fd_set fds, efds;
215		int nfd = 0;
216
217		FD_ZERO(&fds);
218		FD_ZERO(&efds);
219		for (i = 0; i < nr; i++) {
220			if (!FD_ISSET(sk[i], &left))
221				continue;
222
223			if (sk[i] > nfd)
224				nfd = sk[i];
225
226			FD_SET(sk[i], &fds);
227			FD_SET(sk[i], &efds);
228			is_empty = false;
229		}
230		if (is_empty)
231			return -ENOENT;
232
233		errno = 0;
234		ret = select(nfd + 1, NULL, &fds, &efds, ptv);
235		if (ret < 0)
236			return -errno;
237		if (!ret)
238			return -ETIMEDOUT;
239		for (i = 0; i < nr; i++) {
240			if (FD_ISSET(sk[i], &fds)) {
241				if (is_writable)
242					is_writable[i] = true;
243				FD_CLR(sk[i], &left);
244				wait_for--;
245				continue;
246			}
247			if (FD_ISSET(sk[i], &efds)) {
248				FD_CLR(sk[i], &left);
249				wait_for--;
250			}
251		}
252	} while (wait_for > 0);
253
254	return 0;
255}
256
257static void test_client_active_rst(unsigned int port)
258{
259	int i, sk[3], err;
260	bool is_writable[ARRAY_SIZE(sk)] = {false};
261	unsigned int last = ARRAY_SIZE(sk) - 1;
262
263	for (i = 0; i < ARRAY_SIZE(sk); i++) {
264		sk[i] = socket(test_family, SOCK_STREAM, IPPROTO_TCP);
265		if (sk[i] < 0)
266			test_error("socket()");
267		if (test_add_key(sk[i], DEFAULT_TEST_PASSWORD,
268				 this_ip_dest, -1, 100, 100))
269			test_error("setsockopt(TCP_AO_ADD_KEY)");
270	}
271
272	synchronize_threads(); /* 1: MKT added */
273	for (i = 0; i < last; i++) {
274		err = _test_connect_socket(sk[i], this_ip_dest, port, i != 0);
275		if (err < 0)
276			test_error("failed to connect()");
277	}
278
279	synchronize_threads(); /* 2: two connections: one accept()ed, another queued */
280	err = test_wait_fds(sk, last, is_writable, last, TEST_TIMEOUT_SEC);
281	if (err < 0)
282		test_error("test_wait_fds(): %d", err);
283
284	/* async connect() with third sk to get into request_sock_queue */
285	err = _test_connect_socket(sk[last], this_ip_dest, port, 1);
286	if (err < 0)
287		test_error("failed to connect()");
288
289	synchronize_threads(); /* 3: close listen socket */
290	if (test_client_verify(sk[0], packet_sz, quota / packet_sz))
291		test_fail("Failed to send data on connected socket");
292	else
293		test_ok("Verified established tcp connection");
294
295	synchronize_threads(); /* 4: finishing up */
296
297	synchronize_threads(); /* 5: closed active sk */
298	/*
299	 * Wait for 2 connections: one accepted, another in the accept queue,
300	 * the one in request_sock_queue won't get fully established, so
301	 * doesn't receive an active RST, see inet_csk_listen_stop().
302	 */
303	err = test_wait_fds(sk, last, NULL, last, TEST_TIMEOUT_SEC);
304	if (err < 0)
305		test_error("select(): %d", err);
306
307	for (i = 0; i < ARRAY_SIZE(sk); i++) {
308		socklen_t slen = sizeof(err);
309
310		if (getsockopt(sk[i], SOL_SOCKET, SO_ERROR, &err, &slen))
311			test_error("getsockopt()");
312		if (is_writable[i] && err != ECONNRESET) {
313			test_fail("sk[%d] = %d, err = %d, connection wasn't reset",
314				  i, sk[i], err);
315		} else {
316			test_ok("sk[%d] = %d%s", i, sk[i],
317				is_writable[i] ? ", connection was reset" : "");
318		}
319	}
320	synchronize_threads(); /* 6: counters checks */
321}
322
323static void test_client_passive_rst(unsigned int port)
324{
325	struct tcp_counters cnt1, cnt2;
326	struct tcp_ao_repair ao_img;
327	struct tcp_sock_state img;
328	sockaddr_af saddr;
329	int sk, err;
330
331	sk = socket(test_family, SOCK_STREAM, IPPROTO_TCP);
332	if (sk < 0)
333		test_error("socket()");
334
335	if (test_add_key(sk, DEFAULT_TEST_PASSWORD, this_ip_dest, -1, 100, 100))
336		test_error("setsockopt(TCP_AO_ADD_KEY)");
337
338	synchronize_threads(); /* 1: MKT added => connect() */
339	if (test_connect_socket(sk, this_ip_dest, port) <= 0)
340		test_error("failed to connect()");
341
342	synchronize_threads(); /* 2: accepted => send data */
343	if (test_client_verify(sk, packet_sz, quota / packet_sz))
344		test_fail("Failed to send data on connected socket");
345	else
346		test_ok("Verified established tcp connection");
347
348	synchronize_threads(); /* 3: checkpoint the client */
349	test_enable_repair(sk);
350	test_sock_checkpoint(sk, &img, &saddr);
351	test_ao_checkpoint(sk, &ao_img);
352	test_disable_repair(sk);
353
354	synchronize_threads(); /* 4: close the server, creating twsk */
355
356	/*
357	 * The "corruption" in SEQ has to be small enough to fit into TCP
358	 * window, see tcp_timewait_state_process() for out-of-window
359	 * segments.
360	 */
361	img.out.seq += 5; /* 5 is more noticeable in tcpdump than 1 */
362
363	/*
364	 * FIXME: This is kind-of ugly and dirty, but it works.
365	 *
366	 * At this moment, the server has close'ed(sk).
367	 * The passive RST that is being targeted here is new data after
368	 * half-duplex close, see tcp_timewait_state_process() => TCP_TW_RST
369	 *
370	 * What is needed here is:
371	 * (1) wait for FIN from the server
372	 * (2) make sure that the ACK from the client went out
373	 * (3) make sure that the ACK was received and processed by the server
374	 *
375	 * Otherwise, the data that will be sent from "repaired" socket
376	 * post SEQ corruption may get to the server before it's in
377	 * TCP_FIN_WAIT2.
378	 *
379	 * (1) is easy with select()/poll()
380	 * (2) is possible by polling tcpi_state from TCP_INFO
381	 * (3) is quite complex: as server's socket was already closed,
382	 *     probably the way to do it would be tcp-diag.
383	 */
384	sleep(TEST_RETRANSMIT_SEC);
385
386	synchronize_threads(); /* 5: restore the socket, send more data */
387	test_kill_sk(sk);
388
389	sk = socket(test_family, SOCK_STREAM, IPPROTO_TCP);
390	if (sk < 0)
391		test_error("socket()");
392
393	test_enable_repair(sk);
394	test_sock_restore(sk, &img, &saddr, this_ip_dest, port);
395	if (test_add_repaired_key(sk, DEFAULT_TEST_PASSWORD, 0, this_ip_dest, -1, 100, 100))
396		test_error("setsockopt(TCP_AO_ADD_KEY)");
397	test_ao_restore(sk, &ao_img);
398
399	if (test_get_tcp_counters(sk, &cnt1))
400		test_error("test_get_tcp_counters()");
401
402	test_disable_repair(sk);
403	test_sock_state_free(&img);
404
405	/*
406	 * This is how "passive reset" is acquired in this test from TCP_TW_RST:
407	 *
408	 * IP 10.0.254.1.7011 > 10.0.1.1.59772: Flags [P.], seq 901:1001, ack 1001, win 249,
409	 *    options [tcp-ao keyid 100 rnextkeyid 100 mac 0x10217d6c36a22379086ef3b1], length 100
410	 * IP 10.0.254.1.7011 > 10.0.1.1.59772: Flags [F.], seq 1001, ack 1001, win 249,
411	 *    options [tcp-ao keyid 100 rnextkeyid 100 mac 0x104ffc99b98c10a5298cc268], length 0
412	 * IP 10.0.1.1.59772 > 10.0.254.1.7011: Flags [.], ack 1002, win 251,
413	 *    options [tcp-ao keyid 100 rnextkeyid 100 mac 0xe496dd4f7f5a8a66873c6f93,nop,nop,sack 1 {1001:1002}], length 0
414	 * IP 10.0.1.1.59772 > 10.0.254.1.7011: Flags [P.], seq 1006:1106, ack 1001, win 251,
415	 *    options [tcp-ao keyid 100 rnextkeyid 100 mac 0x1b5f3330fb23fbcd0c77d0ca], length 100
416	 * IP 10.0.254.1.7011 > 10.0.1.1.59772: Flags [R], seq 3215596252, win 0,
417	 *    options [tcp-ao keyid 100 rnextkeyid 100 mac 0x0bcfbbf497bce844312304b2], length 0
418	 */
419	err = test_client_verify(sk, packet_sz, quota / packet_sz);
420	/* Make sure that the connection was reset, not timeouted */
421	if (err && err == -ECONNRESET)
422		test_ok("client sock was passively reset post-seq-adjust");
423	else if (err)
424		test_fail("client sock was not reset post-seq-adjust: %d", err);
425	else
426		test_fail("client sock is yet connected post-seq-adjust");
427
428	if (test_get_tcp_counters(sk, &cnt2))
429		test_error("test_get_tcp_counters()");
430
431	synchronize_threads(); /* 6: server exits */
432	close(sk);
433	test_assert_counters("client passive RST", &cnt1, &cnt2, TEST_CNT_GOOD);
434}
435
436static void *client_fn(void *arg)
437{
438	struct netstat *ns_before, *ns_after;
439	unsigned int port = test_server_port;
440
441	ns_before = netstat_read();
442
443	test_client_active_rst(port++);
444	test_client_passive_rst(port++);
445
446	ns_after = netstat_read();
447	netstats_check(ns_before, ns_after, "client");
448	netstat_free(ns_after);
449	netstat_free(ns_before);
450
451	synchronize_threads(); /* exit */
452	return NULL;
453}
454
455int main(int argc, char *argv[])
456{
457	test_init(15, server_fn, client_fn);
458	return 0;
459}