// SPDX-License-Identifier: GPL-2.0 /* * Test key rotation for TFO. * New keys are 'rotated' in two steps: * 1) Add new key as the 'backup' key 'behind' the primary key * 2) Make new key the primary by swapping the backup and primary keys * * The rotation is done in stages using multiple sockets bound * to the same port via SO_REUSEPORT. This simulates key rotation * behind say a load balancer. We verify that across the rotation * there are no cases in which a cookie is not accepted by verifying * that TcpExtTCPFastOpenPassiveFail remains 0. */ #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include "../kselftest.h" #ifndef TCP_FASTOPEN_KEY #define TCP_FASTOPEN_KEY 33 #endif #define N_LISTEN 10 #define PROC_FASTOPEN_KEY "/proc/sys/net/ipv4/tcp_fastopen_key" #define KEY_LENGTH 16 static bool do_ipv6; static bool do_sockopt; static bool do_rotate; static int key_len = KEY_LENGTH; static int rcv_fds[N_LISTEN]; static int proc_fd; static const char *IP4_ADDR = "127.0.0.1"; static const char *IP6_ADDR = "::1"; static const int PORT = 8891; static void get_keys(int fd, uint32_t *keys) { char buf[128]; socklen_t len = KEY_LENGTH * 2; if (do_sockopt) { if (getsockopt(fd, SOL_TCP, TCP_FASTOPEN_KEY, keys, &len)) error(1, errno, "Unable to get key"); return; } lseek(proc_fd, 0, SEEK_SET); if (read(proc_fd, buf, sizeof(buf)) <= 0) error(1, errno, "Unable to read %s", PROC_FASTOPEN_KEY); if (sscanf(buf, "%x-%x-%x-%x,%x-%x-%x-%x", keys, keys + 1, keys + 2, keys + 3, keys + 4, keys + 5, keys + 6, keys + 7) != 8) error(1, 0, "Unable to parse %s", PROC_FASTOPEN_KEY); } static void set_keys(int fd, uint32_t *keys) { char buf[128]; if (do_sockopt) { if (setsockopt(fd, SOL_TCP, TCP_FASTOPEN_KEY, keys, key_len)) error(1, errno, "Unable to set key"); return; } if (do_rotate) snprintf(buf, 128, "%08x-%08x-%08x-%08x,%08x-%08x-%08x-%08x", keys[0], keys[1], keys[2], keys[3], keys[4], keys[5], keys[6], keys[7]); else snprintf(buf, 128, "%08x-%08x-%08x-%08x", keys[0], keys[1], keys[2], keys[3]); lseek(proc_fd, 0, SEEK_SET); if (write(proc_fd, buf, sizeof(buf)) <= 0) error(1, errno, "Unable to write %s", PROC_FASTOPEN_KEY); } static void build_rcv_fd(int family, int proto, int *rcv_fds) { struct sockaddr_in addr4 = {0}; struct sockaddr_in6 addr6 = {0}; struct sockaddr *addr; int opt = 1, i, sz; int qlen = 100; uint32_t keys[8]; switch (family) { case AF_INET: addr4.sin_family = family; addr4.sin_addr.s_addr = htonl(INADDR_ANY); addr4.sin_port = htons(PORT); sz = sizeof(addr4); addr = (struct sockaddr *)&addr4; break; case AF_INET6: addr6.sin6_family = AF_INET6; addr6.sin6_addr = in6addr_any; addr6.sin6_port = htons(PORT); sz = sizeof(addr6); addr = (struct sockaddr *)&addr6; break; default: error(1, 0, "Unsupported family %d", family); /* clang does not recognize error() above as terminating * the program, so it complains that saddr, sz are * not initialized when this code path is taken. Silence it. */ return; } for (i = 0; i < ARRAY_SIZE(keys); i++) keys[i] = rand(); for (i = 0; i < N_LISTEN; i++) { rcv_fds[i] = socket(family, proto, 0); if (rcv_fds[i] < 0) error(1, errno, "failed to create receive socket"); if (setsockopt(rcv_fds[i], SOL_SOCKET, SO_REUSEPORT, &opt, sizeof(opt))) error(1, errno, "failed to set SO_REUSEPORT"); if (bind(rcv_fds[i], addr, sz)) error(1, errno, "failed to bind receive socket"); if (setsockopt(rcv_fds[i], SOL_TCP, TCP_FASTOPEN, &qlen, sizeof(qlen))) error(1, errno, "failed to set TCP_FASTOPEN"); set_keys(rcv_fds[i], keys); if (proto == SOCK_STREAM && listen(rcv_fds[i], 10)) error(1, errno, "failed to listen on receive port"); } } static int connect_and_send(int family, int proto) { struct sockaddr_in saddr4 = {0}; struct sockaddr_in daddr4 = {0}; struct sockaddr_in6 saddr6 = {0}; struct sockaddr_in6 daddr6 = {0}; struct sockaddr *saddr, *daddr; int fd, sz, ret; char data[1]; switch (family) { case AF_INET: saddr4.sin_family = AF_INET; saddr4.sin_addr.s_addr = htonl(INADDR_ANY); saddr4.sin_port = 0; daddr4.sin_family = AF_INET; if (!inet_pton(family, IP4_ADDR, &daddr4.sin_addr.s_addr)) error(1, errno, "inet_pton failed: %s", IP4_ADDR); daddr4.sin_port = htons(PORT); sz = sizeof(saddr4); saddr = (struct sockaddr *)&saddr4; daddr = (struct sockaddr *)&daddr4; break; case AF_INET6: saddr6.sin6_family = AF_INET6; saddr6.sin6_addr = in6addr_any; daddr6.sin6_family = AF_INET6; if (!inet_pton(family, IP6_ADDR, &daddr6.sin6_addr)) error(1, errno, "inet_pton failed: %s", IP6_ADDR); daddr6.sin6_port = htons(PORT); sz = sizeof(saddr6); saddr = (struct sockaddr *)&saddr6; daddr = (struct sockaddr *)&daddr6; break; default: error(1, 0, "Unsupported family %d", family); /* clang does not recognize error() above as terminating * the program, so it complains that saddr, daddr, sz are * not initialized when this code path is taken. Silence it. */ return -1; } fd = socket(family, proto, 0); if (fd < 0) error(1, errno, "failed to create send socket"); if (bind(fd, saddr, sz)) error(1, errno, "failed to bind send socket"); data[0] = 'a'; ret = sendto(fd, data, 1, MSG_FASTOPEN, daddr, sz); if (ret != 1) error(1, errno, "failed to sendto"); return fd; } static bool is_listen_fd(int fd) { int i; for (i = 0; i < N_LISTEN; i++) { if (rcv_fds[i] == fd) return true; } return false; } static void rotate_key(int fd) { static int iter; static uint32_t new_key[4]; uint32_t keys[8]; uint32_t tmp_key[4]; int i; if (iter < N_LISTEN) { /* first set new key as backups */ if (iter == 0) { for (i = 0; i < ARRAY_SIZE(new_key); i++) new_key[i] = rand(); } get_keys(fd, keys); memcpy(keys + 4, new_key, KEY_LENGTH); set_keys(fd, keys); } else { /* swap the keys */ get_keys(fd, keys); memcpy(tmp_key, keys + 4, KEY_LENGTH); memcpy(keys + 4, keys, KEY_LENGTH); memcpy(keys, tmp_key, KEY_LENGTH); set_keys(fd, keys); } if (++iter >= (N_LISTEN * 2)) iter = 0; } static void run_one_test(int family) { struct epoll_event ev; int i, send_fd; int n_loops = 10000; int rotate_key_fd = 0; int key_rotate_interval = 50; int fd, epfd; char buf[1]; build_rcv_fd(family, SOCK_STREAM, rcv_fds); epfd = epoll_create(1); if (epfd < 0) error(1, errno, "failed to create epoll"); ev.events = EPOLLIN; for (i = 0; i < N_LISTEN; i++) { ev.data.fd = rcv_fds[i]; if (epoll_ctl(epfd, EPOLL_CTL_ADD, rcv_fds[i], &ev)) error(1, errno, "failed to register sock epoll"); } while (n_loops--) { send_fd = connect_and_send(family, SOCK_STREAM); if (do_rotate && ((n_loops % key_rotate_interval) == 0)) { rotate_key(rcv_fds[rotate_key_fd]); if (++rotate_key_fd >= N_LISTEN) rotate_key_fd = 0; } while (1) { i = epoll_wait(epfd, &ev, 1, -1); if (i < 0) error(1, errno, "epoll_wait failed"); if (is_listen_fd(ev.data.fd)) { fd = accept(ev.data.fd, NULL, NULL); if (fd < 0) error(1, errno, "failed to accept"); ev.data.fd = fd; if (epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &ev)) error(1, errno, "failed epoll add"); continue; } i = recv(ev.data.fd, buf, sizeof(buf), 0); if (i != 1) error(1, errno, "failed recv data"); if (epoll_ctl(epfd, EPOLL_CTL_DEL, ev.data.fd, NULL)) error(1, errno, "failed epoll del"); close(ev.data.fd); break; } close(send_fd); } for (i = 0; i < N_LISTEN; i++) close(rcv_fds[i]); } static void parse_opts(int argc, char **argv) { int c; while ((c = getopt(argc, argv, "46sr")) != -1) { switch (c) { case '4': do_ipv6 = false; break; case '6': do_ipv6 = true; break; case 's': do_sockopt = true; break; case 'r': do_rotate = true; key_len = KEY_LENGTH * 2; break; default: error(1, 0, "%s: parse error", argv[0]); } } } int main(int argc, char **argv) { parse_opts(argc, argv); proc_fd = open(PROC_FASTOPEN_KEY, O_RDWR); if (proc_fd < 0) error(1, errno, "Unable to open %s", PROC_FASTOPEN_KEY); srand(time(NULL)); if (do_ipv6) run_one_test(AF_INET6); else run_one_test(AF_INET); close(proc_fd); fprintf(stderr, "PASS\n"); return 0; }