1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) Meta Platforms, Inc. and affiliates. */
3 
4 #define _GNU_SOURCE
5 #include <sched.h>
6 #include <linux/socket.h>
7 #include <linux/tls.h>
8 #include <net/if.h>
9 
10 #include "test_progs.h"
11 #include "cgroup_helpers.h"
12 #include "network_helpers.h"
13 
14 #include "setget_sockopt.skel.h"
15 
16 #define CG_NAME "/setget-sockopt-test"
17 
18 static const char addr4_str[] = "127.0.0.1";
19 static const char addr6_str[] = "::1";
20 static struct setget_sockopt *skel;
21 static int cg_fd;
22 
create_netns(void)23 static int create_netns(void)
24 {
25 	if (!ASSERT_OK(unshare(CLONE_NEWNET), "create netns"))
26 		return -1;
27 
28 	if (!ASSERT_OK(system("ip link set dev lo up"), "set lo up"))
29 		return -1;
30 
31 	if (!ASSERT_OK(system("ip link add dev binddevtest1 type veth peer name binddevtest2"),
32 		       "add veth"))
33 		return -1;
34 
35 	if (!ASSERT_OK(system("ip link set dev binddevtest1 up"),
36 		       "bring veth up"))
37 		return -1;
38 
39 	return 0;
40 }
41 
test_tcp(int family)42 static void test_tcp(int family)
43 {
44 	struct setget_sockopt__bss *bss = skel->bss;
45 	int sfd, cfd;
46 
47 	memset(bss, 0, sizeof(*bss));
48 
49 	sfd = start_server(family, SOCK_STREAM,
50 			   family == AF_INET6 ? addr6_str : addr4_str, 0, 0);
51 	if (!ASSERT_GE(sfd, 0, "start_server"))
52 		return;
53 
54 	cfd = connect_to_fd(sfd, 0);
55 	if (!ASSERT_GE(cfd, 0, "connect_to_fd_server")) {
56 		close(sfd);
57 		return;
58 	}
59 	close(sfd);
60 	close(cfd);
61 
62 	ASSERT_EQ(bss->nr_listen, 1, "nr_listen");
63 	ASSERT_EQ(bss->nr_connect, 1, "nr_connect");
64 	ASSERT_EQ(bss->nr_active, 1, "nr_active");
65 	ASSERT_EQ(bss->nr_passive, 1, "nr_passive");
66 	ASSERT_EQ(bss->nr_socket_post_create, 2, "nr_socket_post_create");
67 	ASSERT_EQ(bss->nr_binddev, 2, "nr_bind");
68 }
69 
test_udp(int family)70 static void test_udp(int family)
71 {
72 	struct setget_sockopt__bss *bss = skel->bss;
73 	int sfd;
74 
75 	memset(bss, 0, sizeof(*bss));
76 
77 	sfd = start_server(family, SOCK_DGRAM,
78 			   family == AF_INET6 ? addr6_str : addr4_str, 0, 0);
79 	if (!ASSERT_GE(sfd, 0, "start_server"))
80 		return;
81 	close(sfd);
82 
83 	ASSERT_GE(bss->nr_socket_post_create, 1, "nr_socket_post_create");
84 	ASSERT_EQ(bss->nr_binddev, 1, "nr_bind");
85 }
86 
test_ktls(int family)87 static void test_ktls(int family)
88 {
89 	struct tls12_crypto_info_aes_gcm_128 aes128;
90 	struct setget_sockopt__bss *bss = skel->bss;
91 	int cfd = -1, sfd = -1, fd = -1, ret;
92 	char buf;
93 
94 	memset(bss, 0, sizeof(*bss));
95 
96 	sfd = start_server(family, SOCK_STREAM,
97 			   family == AF_INET6 ? addr6_str : addr4_str, 0, 0);
98 	if (!ASSERT_GE(sfd, 0, "start_server"))
99 		return;
100 	fd = connect_to_fd(sfd, 0);
101 	if (!ASSERT_GE(fd, 0, "connect_to_fd"))
102 		goto err_out;
103 
104 	cfd = accept(sfd, NULL, 0);
105 	if (!ASSERT_GE(cfd, 0, "accept"))
106 		goto err_out;
107 
108 	close(sfd);
109 	sfd = -1;
110 
111 	/* Setup KTLS */
112 	ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
113 	if (!ASSERT_OK(ret, "setsockopt"))
114 		goto err_out;
115 	ret = setsockopt(cfd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
116 	if (!ASSERT_OK(ret, "setsockopt"))
117 		goto err_out;
118 
119 	memset(&aes128, 0, sizeof(aes128));
120 	aes128.info.version = TLS_1_2_VERSION;
121 	aes128.info.cipher_type = TLS_CIPHER_AES_GCM_128;
122 
123 	ret = setsockopt(fd, SOL_TLS, TLS_TX, &aes128, sizeof(aes128));
124 	if (!ASSERT_OK(ret, "setsockopt"))
125 		goto err_out;
126 
127 	ret = setsockopt(cfd, SOL_TLS, TLS_RX, &aes128, sizeof(aes128));
128 	if (!ASSERT_OK(ret, "setsockopt"))
129 		goto err_out;
130 
131 	/* KTLS is enabled */
132 
133 	close(fd);
134 	/* At this point, the cfd socket is at the CLOSE_WAIT state
135 	 * and still run TLS protocol.  The test for
136 	 * BPF_TCP_CLOSE_WAIT should be run at this point.
137 	 */
138 	ret = read(cfd, &buf, sizeof(buf));
139 	ASSERT_EQ(ret, 0, "read");
140 	close(cfd);
141 
142 	ASSERT_EQ(bss->nr_listen, 1, "nr_listen");
143 	ASSERT_EQ(bss->nr_connect, 1, "nr_connect");
144 	ASSERT_EQ(bss->nr_active, 1, "nr_active");
145 	ASSERT_EQ(bss->nr_passive, 1, "nr_passive");
146 	ASSERT_EQ(bss->nr_socket_post_create, 2, "nr_socket_post_create");
147 	ASSERT_EQ(bss->nr_binddev, 2, "nr_bind");
148 	ASSERT_EQ(bss->nr_fin_wait1, 1, "nr_fin_wait1");
149 	return;
150 
151 err_out:
152 	close(fd);
153 	close(cfd);
154 	close(sfd);
155 }
156 
test_setget_sockopt(void)157 void test_setget_sockopt(void)
158 {
159 	cg_fd = test__join_cgroup(CG_NAME);
160 	if (cg_fd < 0)
161 		return;
162 
163 	if (create_netns())
164 		goto done;
165 
166 	skel = setget_sockopt__open();
167 	if (!ASSERT_OK_PTR(skel, "open skel"))
168 		goto done;
169 
170 	strcpy(skel->rodata->veth, "binddevtest1");
171 	skel->rodata->veth_ifindex = if_nametoindex("binddevtest1");
172 	if (!ASSERT_GT(skel->rodata->veth_ifindex, 0, "if_nametoindex"))
173 		goto done;
174 
175 	if (!ASSERT_OK(setget_sockopt__load(skel), "load skel"))
176 		goto done;
177 
178 	skel->links.skops_sockopt =
179 		bpf_program__attach_cgroup(skel->progs.skops_sockopt, cg_fd);
180 	if (!ASSERT_OK_PTR(skel->links.skops_sockopt, "attach cgroup"))
181 		goto done;
182 
183 	skel->links.socket_post_create =
184 		bpf_program__attach_cgroup(skel->progs.socket_post_create, cg_fd);
185 	if (!ASSERT_OK_PTR(skel->links.socket_post_create, "attach_cgroup"))
186 		goto done;
187 
188 	test_tcp(AF_INET6);
189 	test_tcp(AF_INET);
190 	test_udp(AF_INET6);
191 	test_udp(AF_INET);
192 	test_ktls(AF_INET6);
193 	test_ktls(AF_INET);
194 
195 done:
196 	setget_sockopt__destroy(skel);
197 	close(cg_fd);
198 }
199