1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
|
// SPDX-License-Identifier: GPL-2.0
// Copyright (c) 2020 Cloudflare
/*
* Tests for sockmap/sockhash holding kTLS sockets.
*/
#include <error.h>
#include <netinet/tcp.h>
#include <linux/tls.h>
#include "test_progs.h"
#include "sockmap_helpers.h"
#include "test_skmsg_load_helpers.skel.h"
#define MAX_TEST_NAME 80
#define TCP_ULP 31
static int init_ktls_pairs(int c, int p)
{
int err;
struct tls12_crypto_info_aes_gcm_128 crypto_rx;
struct tls12_crypto_info_aes_gcm_128 crypto_tx;
err = setsockopt(c, IPPROTO_TCP, TCP_ULP, "tls", strlen("tls"));
if (!ASSERT_OK(err, "setsockopt(TCP_ULP)"))
goto out;
err = setsockopt(p, IPPROTO_TCP, TCP_ULP, "tls", strlen("tls"));
if (!ASSERT_OK(err, "setsockopt(TCP_ULP)"))
goto out;
memset(&crypto_rx, 0, sizeof(crypto_rx));
memset(&crypto_tx, 0, sizeof(crypto_tx));
crypto_rx.info.version = TLS_1_2_VERSION;
crypto_tx.info.version = TLS_1_2_VERSION;
crypto_rx.info.cipher_type = TLS_CIPHER_AES_GCM_128;
crypto_tx.info.cipher_type = TLS_CIPHER_AES_GCM_128;
err = setsockopt(c, SOL_TLS, TLS_TX, &crypto_tx, sizeof(crypto_tx));
if (!ASSERT_OK(err, "setsockopt(TLS_TX)"))
goto out;
err = setsockopt(p, SOL_TLS, TLS_RX, &crypto_rx, sizeof(crypto_rx));
if (!ASSERT_OK(err, "setsockopt(TLS_RX)"))
goto out;
return 0;
out:
return -1;
}
static int create_ktls_pairs(int family, int sotype, int *c, int *p)
{
int err;
err = create_pair(family, sotype, c, p);
if (!ASSERT_OK(err, "create_pair()"))
return -1;
err = init_ktls_pairs(*c, *p);
if (!ASSERT_OK(err, "init_ktls_pairs(c, p)"))
return -1;
return 0;
}
static void test_sockmap_ktls_update_fails_when_sock_has_ulp(int family, int map)
{
struct sockaddr_storage addr = {};
socklen_t len = sizeof(addr);
struct sockaddr_in6 *v6;
struct sockaddr_in *v4;
int err, s, zero = 0;
switch (family) {
case AF_INET:
v4 = (struct sockaddr_in *)&addr;
v4->sin_family = AF_INET;
break;
case AF_INET6:
v6 = (struct sockaddr_in6 *)&addr;
v6->sin6_family = AF_INET6;
break;
default:
PRINT_FAIL("unsupported socket family %d", family);
return;
}
s = socket(family, SOCK_STREAM, 0);
if (!ASSERT_GE(s, 0, "socket"))
return;
err = bind(s, (struct sockaddr *)&addr, len);
if (!ASSERT_OK(err, "bind"))
goto close;
err = getsockname(s, (struct sockaddr *)&addr, &len);
if (!ASSERT_OK(err, "getsockname"))
goto close;
err = connect(s, (struct sockaddr *)&addr, len);
if (!ASSERT_OK(err, "connect"))
goto close;
/* save sk->sk_prot and set it to tls_prots */
err = setsockopt(s, IPPROTO_TCP, TCP_ULP, "tls", strlen("tls"));
if (!ASSERT_OK(err, "setsockopt(TCP_ULP)"))
goto close;
/* sockmap update should not affect saved sk_prot */
err = bpf_map_update_elem(map, &zero, &s, BPF_ANY);
if (!ASSERT_ERR(err, "sockmap update elem"))
goto close;
/* call sk->sk_prot->setsockopt to dispatch to saved sk_prot */
err = setsockopt(s, IPPROTO_TCP, TCP_NODELAY, &zero, sizeof(zero));
ASSERT_OK(err, "setsockopt(TCP_NODELAY)");
close:
close(s);
}
static void test_sockmap_ktls_enable_fails_when_in_sockmap(int family, int map)
{
struct tls12_crypto_info_aes_gcm_128 crypto = {
.info = {
.version = TLS_1_2_VERSION,
.cipher_type = TLS_CIPHER_AES_GCM_128,
},
};
struct sockaddr_storage addr = {};
socklen_t len = sizeof(addr);
struct sockaddr_in6 *v6;
struct sockaddr_in *v4;
int err, s, zero = 0;
switch (family) {
case AF_INET:
v4 = (struct sockaddr_in *)&addr;
v4->sin_family = AF_INET;
break;
case AF_INET6:
v6 = (struct sockaddr_in6 *)&addr;
v6->sin6_family = AF_INET6;
break;
default:
PRINT_FAIL("unsupported socket family %d", family);
return;
}
s = socket(family, SOCK_STREAM, 0);
if (!ASSERT_GE(s, 0, "socket"))
return;
err = bind(s, (struct sockaddr *)&addr, len);
if (!ASSERT_OK(err, "bind"))
goto close;
err = getsockname(s, (struct sockaddr *)&addr, &len);
if (!ASSERT_OK(err, "getsockname"))
goto close;
err = connect(s, (struct sockaddr *)&addr, len);
if (!ASSERT_OK(err, "connect"))
goto close;
/* Add the socket to the sockmap, attaching a psock. */
err = bpf_map_update_elem(map, &zero, &s, BPF_ANY);
if (!ASSERT_OK(err, "sockmap update elem"))
goto close;
/* Installing the TLS ULP is allowed, it does not touch the datapath. */
err = setsockopt(s, IPPROTO_TCP, TCP_ULP, "tls", strlen("tls"));
if (!ASSERT_OK(err, "setsockopt(TCP_ULP)"))
goto close;
/* Enabling the TLS crypto datapath must be rejected. */
err = setsockopt(s, SOL_TLS, TLS_TX, &crypto, sizeof(crypto));
ASSERT_ERR(err, "setsockopt(TLS_TX)");
close:
close(s);
}
static const char *fmt_test_name(const char *subtest_name, int family,
enum bpf_map_type map_type)
{
const char *map_type_str = BPF_MAP_TYPE_SOCKMAP ? "SOCKMAP" : "SOCKHASH";
const char *family_str = AF_INET ? "IPv4" : "IPv6";
static char test_name[MAX_TEST_NAME];
snprintf(test_name, MAX_TEST_NAME,
"sockmap_ktls %s %s %s",
subtest_name, family_str, map_type_str);
return test_name;
}
static void test_sockmap_ktls_offload(int family, int sotype)
{
int err;
int c = 0, p = 0, sent, recvd;
char msg[12] = "hello world\0";
char rcv[13];
err = create_ktls_pairs(family, sotype, &c, &p);
if (!ASSERT_OK(err, "create_ktls_pairs()"))
goto out;
sent = send(c, msg, sizeof(msg), 0);
if (!ASSERT_OK(err, "send(msg)"))
goto out;
recvd = recv(p, rcv, sizeof(rcv), 0);
if (!ASSERT_OK(err, "recv(msg)") ||
!ASSERT_EQ(recvd, sent, "length mismatch"))
goto out;
ASSERT_OK(memcmp(msg, rcv, sizeof(msg)), "data mismatch");
out:
if (c)
close(c);
if (p)
close(p);
}
static void run_tests(int family, enum bpf_map_type map_type)
{
int map;
map = bpf_map_create(map_type, NULL, sizeof(int), sizeof(int), 1, NULL);
if (!ASSERT_GE(map, 0, "bpf_map_create"))
return;
if (test__start_subtest(fmt_test_name("update_fails_when_sock_has_ulp", family, map_type)))
test_sockmap_ktls_update_fails_when_sock_has_ulp(family, map);
if (test__start_subtest(fmt_test_name("enable_fails_when_in_sockmap", family, map_type)))
test_sockmap_ktls_enable_fails_when_in_sockmap(family, map);
close(map);
}
static void run_ktls_test(int family, int sotype)
{
if (test__start_subtest("tls simple offload"))
test_sockmap_ktls_offload(family, sotype);
}
void test_sockmap_ktls(void)
{
run_tests(AF_INET, BPF_MAP_TYPE_SOCKMAP);
run_tests(AF_INET, BPF_MAP_TYPE_SOCKHASH);
run_tests(AF_INET6, BPF_MAP_TYPE_SOCKMAP);
run_tests(AF_INET6, BPF_MAP_TYPE_SOCKHASH);
run_ktls_test(AF_INET, SOCK_STREAM);
run_ktls_test(AF_INET6, SOCK_STREAM);
}
|
