selftests/net: add TFO key rotation selftest (10fbcdd1) · Commits · 戴 / test

tools/testing/selftests/net/.gitignore

+1 −0

Original line number	Diff line number	Diff line
		@@ -20,3 +20,4 @@ ip_defrag
		so_txtime
		flowlabel
		flowlabel_mgr
		tcp_fastopen_backup_key

tools/testing/selftests/net/Makefile

+2 −0

Original line number	Diff line number	Diff line
		@@ -10,12 +10,14 @@ TEST_PROGS += fib_tests.sh fib-onlink-tests.sh pmtu.sh udpgso.sh ip_defrag.sh
		TEST_PROGS += udpgso_bench.sh fib_rule_tests.sh msg_zerocopy.sh psock_snd.sh
		TEST_PROGS += udpgro_bench.sh udpgro.sh test_vxlan_under_vrf.sh reuseport_addr_any.sh
		TEST_PROGS += test_vxlan_fdb_changelink.sh so_txtime.sh ipv6_flowlabel.sh
		TEST_PROGS += tcp_fastopen_backup_key.sh
		TEST_PROGS_EXTENDED := in_netns.sh
		TEST_GEN_FILES = socket
		TEST_GEN_FILES += psock_fanout psock_tpacket msg_zerocopy reuseport_addr_any
		TEST_GEN_FILES += tcp_mmap tcp_inq psock_snd txring_overwrite
		TEST_GEN_FILES += udpgso udpgso_bench_tx udpgso_bench_rx ip_defrag
		TEST_GEN_FILES += so_txtime ipv6_flowlabel ipv6_flowlabel_mgr
		TEST_GEN_FILES += tcp_fastopen_backup_key
		TEST_GEN_PROGS = reuseport_bpf reuseport_bpf_cpu reuseport_bpf_numa
		TEST_GEN_PROGS += reuseport_dualstack reuseaddr_conflict tls

tools/testing/selftests/net/tcp_fastopen_backup_key.c

0 → 100644

+336 −0

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0

		/*
		* Test key rotation for TFO.
		* New keys are 'rotated' in two steps:
		* 1) Add new key as the 'backup' key 'behind' the primary key
		* 2) Make new key the primary by swapping the backup and primary keys
		*
		* The rotation is done in stages using multiple sockets bound
		* to the same port via SO_REUSEPORT. This simulates key rotation
		* behind say a load balancer. We verify that across the rotation
		* there are no cases in which a cookie is not accepted by verifying
		* that TcpExtTCPFastOpenPassiveFail remains 0.
		*/
		#define _GNU_SOURCE
		#include <arpa/inet.h>
		#include <errno.h>
		#include <error.h>
		#include <stdbool.h>
		#include <stdio.h>
		#include <stdlib.h>
		#include <string.h>
		#include <sys/epoll.h>
		#include <unistd.h>
		#include <netinet/tcp.h>
		#include <fcntl.h>
		#include <time.h>

		#ifndef TCP_FASTOPEN_KEY
		#define TCP_FASTOPEN_KEY 33
		#endif

		#define N_LISTEN 10
		#define PROC_FASTOPEN_KEY "/proc/sys/net/ipv4/tcp_fastopen_key"
		#define KEY_LENGTH 16

		#ifndef ARRAY_SIZE
		#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
		#endif

		static bool do_ipv6;
		static bool do_sockopt;
		static bool do_rotate;
		static int key_len = KEY_LENGTH;
		static int rcv_fds[N_LISTEN];
		static int proc_fd;
		static const char *IP4_ADDR = "127.0.0.1";
		static const char *IP6_ADDR = "::1";
		static const int PORT = 8891;

		static void get_keys(int fd, uint32_t *keys)
		{
		char buf[128];
		int len = KEY_LENGTH * 2;

		if (do_sockopt) {
		if (getsockopt(fd, SOL_TCP, TCP_FASTOPEN_KEY, keys, &len))
		error(1, errno, "Unable to get key");
		return;
		}
		lseek(proc_fd, 0, SEEK_SET);
		if (read(proc_fd, buf, sizeof(buf)) <= 0)
		error(1, errno, "Unable to read %s", PROC_FASTOPEN_KEY);
		if (sscanf(buf, "%x-%x-%x-%x,%x-%x-%x-%x", keys, keys + 1, keys + 2,
		keys + 3, keys + 4, keys + 5, keys + 6, keys + 7) != 8)
		error(1, 0, "Unable to parse %s", PROC_FASTOPEN_KEY);
		}

		static void set_keys(int fd, uint32_t *keys)
		{
		char buf[128];

		if (do_sockopt) {
		if (setsockopt(fd, SOL_TCP, TCP_FASTOPEN_KEY, keys,
		key_len))
		error(1, errno, "Unable to set key");
		return;
		}
		if (do_rotate)
		snprintf(buf, 128, "%08x-%08x-%08x-%08x,%08x-%08x-%08x-%08x",
		keys[0], keys[1], keys[2], keys[3], keys[4], keys[5],
		keys[6], keys[7]);
		else
		snprintf(buf, 128, "%08x-%08x-%08x-%08x",
		keys[0], keys[1], keys[2], keys[3]);
		lseek(proc_fd, 0, SEEK_SET);
		if (write(proc_fd, buf, sizeof(buf)) <= 0)
		error(1, errno, "Unable to write %s", PROC_FASTOPEN_KEY);
		}

		static void build_rcv_fd(int family, int proto, int *rcv_fds)
		{
		struct sockaddr_in addr4 = {0};
		struct sockaddr_in6 addr6 = {0};
		struct sockaddr *addr;
		int opt = 1, i, sz;
		int qlen = 100;
		uint32_t keys[8];

		switch (family) {
		case AF_INET:
		addr4.sin_family = family;
		addr4.sin_addr.s_addr = htonl(INADDR_ANY);
		addr4.sin_port = htons(PORT);
		sz = sizeof(addr4);
		addr = (struct sockaddr *)&addr4;
		break;
		case AF_INET6:
		addr6.sin6_family = AF_INET6;
		addr6.sin6_addr = in6addr_any;
		addr6.sin6_port = htons(PORT);
		sz = sizeof(addr6);
		addr = (struct sockaddr *)&addr6;
		break;
		default:
		error(1, 0, "Unsupported family %d", family);
		/* clang does not recognize error() above as terminating
		* the program, so it complains that saddr, sz are
		* not initialized when this code path is taken. Silence it.
		*/
		return;
		}
		for (i = 0; i < ARRAY_SIZE(keys); i++)
		keys[i] = rand();
		for (i = 0; i < N_LISTEN; i++) {
		rcv_fds[i] = socket(family, proto, 0);
		if (rcv_fds[i] < 0)
		error(1, errno, "failed to create receive socket");
		if (setsockopt(rcv_fds[i], SOL_SOCKET, SO_REUSEPORT, &opt,
		sizeof(opt)))
		error(1, errno, "failed to set SO_REUSEPORT");
		if (bind(rcv_fds[i], addr, sz))
		error(1, errno, "failed to bind receive socket");
		if (setsockopt(rcv_fds[i], SOL_TCP, TCP_FASTOPEN, &qlen,
		sizeof(qlen)))
		error(1, errno, "failed to set TCP_FASTOPEN");
		set_keys(rcv_fds[i], keys);
		if (proto == SOCK_STREAM && listen(rcv_fds[i], 10))
		error(1, errno, "failed to listen on receive port");
		}
		}

		static int connect_and_send(int family, int proto)
		{
		struct sockaddr_in saddr4 = {0};
		struct sockaddr_in daddr4 = {0};
		struct sockaddr_in6 saddr6 = {0};
		struct sockaddr_in6 daddr6 = {0};
		struct sockaddr saddr, daddr;
		int fd, sz, ret;
		char data[1];

		switch (family) {
		case AF_INET:
		saddr4.sin_family = AF_INET;
		saddr4.sin_addr.s_addr = htonl(INADDR_ANY);
		saddr4.sin_port = 0;

		daddr4.sin_family = AF_INET;
		if (!inet_pton(family, IP4_ADDR, &daddr4.sin_addr.s_addr))
		error(1, errno, "inet_pton failed: %s", IP4_ADDR);
		daddr4.sin_port = htons(PORT);

		sz = sizeof(saddr4);
		saddr = (struct sockaddr *)&saddr4;
		daddr = (struct sockaddr *)&daddr4;
		break;
		case AF_INET6:
		saddr6.sin6_family = AF_INET6;
		saddr6.sin6_addr = in6addr_any;

		daddr6.sin6_family = AF_INET6;
		if (!inet_pton(family, IP6_ADDR, &daddr6.sin6_addr))
		error(1, errno, "inet_pton failed: %s", IP6_ADDR);
		daddr6.sin6_port = htons(PORT);

		sz = sizeof(saddr6);
		saddr = (struct sockaddr *)&saddr6;
		daddr = (struct sockaddr *)&daddr6;
		break;
		default:
		error(1, 0, "Unsupported family %d", family);
		/* clang does not recognize error() above as terminating
		* the program, so it complains that saddr, daddr, sz are
		* not initialized when this code path is taken. Silence it.
		*/
		return -1;
		}
		fd = socket(family, proto, 0);
		if (fd < 0)
		error(1, errno, "failed to create send socket");
		if (bind(fd, saddr, sz))
		error(1, errno, "failed to bind send socket");
		data[0] = 'a';
		ret = sendto(fd, data, 1, MSG_FASTOPEN, daddr, sz);
		if (ret != 1)
		error(1, errno, "failed to sendto");

		return fd;
		}

		static bool is_listen_fd(int fd)
		{
		int i;

		for (i = 0; i < N_LISTEN; i++) {
		if (rcv_fds[i] == fd)
		return true;
		}
		return false;
		}

		static int rotate_key(int fd)
		{
		static int iter;
		static uint32_t new_key[4];
		uint32_t keys[8];
		uint32_t tmp_key[4];
		int i;
		int len = KEY_LENGTH * 2;

		if (iter < N_LISTEN) {
		/* first set new key as backups */
		if (iter == 0) {
		for (i = 0; i < ARRAY_SIZE(new_key); i++)
		new_key[i] = rand();
		}
		get_keys(fd, keys);
		memcpy(keys + 4, new_key, KEY_LENGTH);
		set_keys(fd, keys);
		} else {
		/* swap the keys */
		get_keys(fd, keys);
		memcpy(tmp_key, keys + 4, KEY_LENGTH);
		memcpy(keys + 4, keys, KEY_LENGTH);
		memcpy(keys, tmp_key, KEY_LENGTH);
		set_keys(fd, keys);
		}
		if (++iter >= (N_LISTEN * 2))
		iter = 0;
		}

		static void run_one_test(int family)
		{
		struct epoll_event ev;
		int i, send_fd;
		int n_loops = 10000;
		int rotate_key_fd = 0;
		int key_rotate_interval = 50;
		int fd, epfd;
		char buf[1];

		build_rcv_fd(family, SOCK_STREAM, rcv_fds);
		epfd = epoll_create(1);
		if (epfd < 0)
		error(1, errno, "failed to create epoll");
		ev.events = EPOLLIN;
		for (i = 0; i < N_LISTEN; i++) {
		ev.data.fd = rcv_fds[i];
		if (epoll_ctl(epfd, EPOLL_CTL_ADD, rcv_fds[i], &ev))
		error(1, errno, "failed to register sock epoll");
		}
		while (n_loops--) {
		send_fd = connect_and_send(family, SOCK_STREAM);
		if (do_rotate && ((n_loops % key_rotate_interval) == 0)) {
		rotate_key(rcv_fds[rotate_key_fd]);
		if (++rotate_key_fd >= N_LISTEN)
		rotate_key_fd = 0;
		}
		while (1) {
		i = epoll_wait(epfd, &ev, 1, -1);
		if (i < 0)
		error(1, errno, "epoll_wait failed");
		if (is_listen_fd(ev.data.fd)) {
		fd = accept(ev.data.fd, NULL, NULL);
		if (fd < 0)
		error(1, errno, "failed to accept");
		ev.data.fd = fd;
		if (epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &ev))
		error(1, errno, "failed epoll add");
		continue;
		}
		i = recv(ev.data.fd, buf, sizeof(buf), 0);
		if (i != 1)
		error(1, errno, "failed recv data");
		if (epoll_ctl(epfd, EPOLL_CTL_DEL, ev.data.fd, NULL))
		error(1, errno, "failed epoll del");
		close(ev.data.fd);
		break;
		}
		close(send_fd);
		}
		for (i = 0; i < N_LISTEN; i++)
		close(rcv_fds[i]);
		}

		static void parse_opts(int argc, char **argv)
		{
		int c;

		while ((c = getopt(argc, argv, "46sr")) != -1) {
		switch (c) {
		case '4':
		do_ipv6 = false;
		break;
		case '6':
		do_ipv6 = true;
		break;
		case 's':
		do_sockopt = true;
		break;
		case 'r':
		do_rotate = true;
		key_len = KEY_LENGTH * 2;
		break;
		default:
		error(1, 0, "%s: parse error", argv[0]);
		}
		}
		}

		int main(int argc, char **argv)
		{
		parse_opts(argc, argv);
		proc_fd = open(PROC_FASTOPEN_KEY, O_RDWR);
		if (proc_fd < 0)
		error(1, errno, "Unable to open %s", PROC_FASTOPEN_KEY);
		srand(time(NULL));
		if (do_ipv6)
		run_one_test(AF_INET6);
		else
		run_one_test(AF_INET);
		close(proc_fd);
		fprintf(stderr, "PASS\n");
		return 0;
		}

tools/testing/selftests/net/tcp_fastopen_backup_key.sh

0 → 100755

+55 −0

Original line number	Diff line number	Diff line
		#!/bin/bash
		# SPDX-License-Identifier: GPL-2.0
		#
		# rotate TFO keys for ipv4/ipv6 and verify that the client does
		# not present an invalid cookie.

		set +x
		set -e

		readonly NETNS="ns-$(mktemp -u XXXXXX)"

		setup() {
		ip netns add "${NETNS}"
		ip -netns "${NETNS}" link set lo up
		ip netns exec "${NETNS}" sysctl -w net.ipv4.tcp_fastopen=3 \
		>/dev/null 2>&1
		}

		cleanup() {
		ip netns del "${NETNS}"
		}

		trap cleanup EXIT
		setup

		do_test() {
		# flush routes before each run, otherwise successive runs can
		# initially present an old TFO cookie
		ip netns exec "${NETNS}" ip tcp_metrics flush
		ip netns exec "${NETNS}" ./tcp_fastopen_backup_key "$1"
		val=$(ip netns exec "${NETNS}" nstat -az \| \
		grep TcpExtTCPFastOpenPassiveFail \| awk '{print $2}')
		if [ $val -ne 0 ]; then
		echo "FAIL: TcpExtTCPFastOpenPassiveFail non-zero"
		return 1
		fi
		}

		do_test "-4"
		do_test "-6"
		do_test "-4"
		do_test "-6"
		do_test "-4s"
		do_test "-6s"
		do_test "-4s"
		do_test "-6s"
		do_test "-4r"
		do_test "-6r"
		do_test "-4r"
		do_test "-6r"
		do_test "-4sr"
		do_test "-6sr"
		do_test "-4sr"
		do_test "-6sr"
		echo "all tests done"

Admin message