From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=pass header.oldest-pass=0 smtp.remote-ip=100.103.45.18 ARC-Seal: i=2; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=pass; t=1793359101; b=I3X/WpBU9tVAkb74yRGH6ye5YU9a07cic80qO8/xuuj0yVgQLLuqyfEhihucTClyg89t /udX1U5Jb1I726nsr5WIV4j8CxPOIeXXx4K88fAJO+kJKp0LPbmvOm+oloIOBVB5d1yw5 8ZRJWGCi/kXJ0dfiRHtEcxqiKOCPFDhO59hmiKBJq3l7l37Dsyqj/zGcGGXt6A/mcOJrK 3ss5Xuk8oxOoew3RR+3kHjnNeKplbpPEU0/fKfT+J1TvMshV+dUrfUbngqBuLIFXNJDCi RJaqW9u4mA6Yz4HBYCjwcWo2fzNIeLjNjfn4tCHRE2tOOTe8ue0iJLk7iSfKTIYOV+w== ARC-Message-Signature: i=2; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793359101; h=Received:DKIM-Signature:Received:From:Date:Subject:MIME-Version: Content-Type:Content-Transfer-Encoding:Message-Id:References: In-Reply-To:To:Cc:X-Mailer:X-Developer-Signature:X-Developer-Key: X-Endpoint-Received:X-Original-From:Reply-To; bh=ihdgh8i0k8CkeIzoge4mnBfQNxoghdnfgdx899eDkQg=; b=UwX2f+LfpJ5D2KvH+tEnHlecItWUws2BSceHffCclv/qe4gT72A6IueVINdhJso2Vpue Ii2y3h8lAUSKCFZ8I+yUS6dbcR75+38utuaeAm9cYtvDaDWbYOExWhzNJsjNztj8QYARg qkvgIOlUfEXyoA6sh1DU9xibjzNWu+b7OiPTh4dR4l2AXDCX5JK4nZHvoD5W2I9IXUDnM NC4bt0LRqOqvrcm9MJVjyAUBKsy+qyfdU0PS7Sc6FdYoWGHMNUSN6Xa/EDRU05OKCnP/o kPWf82iH1alKh9ghXJMiSrY+O24mXdSdzf2hZ3Cv+VnMJIVPipDwiE/UxfbSIm0v1bg== ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=ZeteDPXH; arc=pass header.oldest-pass=0 smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E1FE7606A333; Fri, 30 Oct 2026 11:18:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=ZeteDPXH Authentication-Results: smtp.kernel.org; arc=none smtp.remote-ip=100.80.115.77 ARC-Seal: i=1; d=kernel.org; s=arc20260519; a=rsa-sha256; cv=none; t=1793359100; b=uEXmRWagrkvG0vp73u2YeRx7S3Lae8qpjWs3mD75U4Omyk7lGQEAShvzdDva+DjuXq0/ ssRK72Hm4L57oHMR4lOQlFkMDwIoKEVdN4X5MtFiCHttuC6B3HwTheoKwyu6+rUqXaWl4 QaM3N77H3xMZGjezsecWkeHZIBK/N07D/aYs0cp/PiCnTQ6lyDxpVHaYEfUNxWggn6bNC WdAlReHmmmndDaCtBQt63sHM5aijnlSCzI9J0oCghWrJUWCT8y5xhhsW6VYW4lqhpAa9l hii2GphJg/jkwgj25mi+3SylPks87TtNdROKF03zYlFgunXuR6oFN3kDacuE3TZ/CCQ== ARC-Message-Signature: i=1; d=kernel.org; s=arc20260519; a=rsa-sha256; c=relaxed/relaxed; t=1793359100; h=DKIM-Signature:Received:From:Date:Subject:MIME-Version:Content-Type: Content-Transfer-Encoding:Message-Id:References:In-Reply-To:To:Cc: X-Mailer:X-Developer-Signature:X-Developer-Key:X-Endpoint-Received: X-Original-From:Reply-To; bh=ihdgh8i0k8CkeIzoge4mnBfQNxoghdnfgdx899eDkQg=; b=acvrqylZ5Q1tZOwubUOHy75Bbe8lX+DqS1ZBJxrlDCJ82WzsoO1OgYDDfMv65YIW4IYq Nu3GqO4K8Jp4il0/yD/XW0MBODEsn9/aICIg+KSCDKOCPUCNjXb37v7cCllsFqPHFdBGi ug2AzTCBigsihBW+hwaUEO2k3cB04FDKMiTMxYiFXSOYRGTFmr/VDQ7suQcqH7F/+UFbw /1KDCS4q5fdjE90kKL5iUdxJfpMwokC1+JPxHLJ+9t1i57eG3E5HYWvXAJ2vyw4mx+BOs li0qU5a381Rffzyor8IBrNK1gwaCrBBZAytwxHWoSR8hWUuye4zj4Lc4sPGmBaEhXZA== ARC-Authentication-Results: i=1; smtp.kernel.org; arc=none smtp.remote-ip=100.80.115.77 Received: from lkml.kernel.org (nexus.subspace.kernel.org [100.80.115.77]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.kernel.org (Postfix) with ESMTPS id 8BC201F00A17; Fri, 30 Oct 2026 11:18:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1793359100; bh=ihdgh8i0k8CkeIzoge4mnBfQNxoghdnfgdx899eDkQg=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To; b=ZeteDPXH8K+mA8dwHzpqwy2h0+EMfdErZ8c7hbooCVHrt+u5GnIWYIKKfLO7HxfgJ 4kMP8uh5iqcVIp6Z56Q/th+G6JnUZ8YZ7gTfeQQt9y3MQUWB8BdBmT+S5tedv719y5 YVbcP6j8cbz69DXkl/kzh/RLfiZU4pkC2pdK/8tzx9xhVPBQzkTkhI+IY397yLFPtY ch8kOKo3ZP8FJdUt4iiKcnYjslvjX1n5BllBWW1JzP7hkSVmtK6aPBDQZciTDeDgKf 2Gdhmnc/3hzf5GeHTgRvDlH0bFabM5BBePmW41V6+nMe5guYD4AAiYDPEf/RXYOMvp RLq8SPx9W+3mw== Received: from nexus.subspace.kernel.org (localhost [IPv6:::1]) by lkml.kernel.org (Postfix) with ESMTP id 982E34377F; Fri, 30 Oct 2026 11:18:17 +0000 (UTC) From: Martin Belanger via B4 Relay Date: Fri, 30 Oct 2026 07:18:16 -0400 Subject: [PATCH RFC net-next v3 5/5] selftests/tls: add KeyUpdate tests X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261030-keyupdate-rfc-v3-5-8e1e32226e51@gmail.com> References: <20261030-keyupdate-rfc-v3-0-8e1e32226e51@gmail.com> In-Reply-To: <20261030-keyupdate-rfc-v3-0-8e1e32226e51@gmail.com> To: John Fastabend , Jakub Kicinski , Sabrina Dubroca , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , Jonathan Corbet , Shuah Khan , Randy Dunlap , Shuah Khan Cc: linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-doc@vger.kernel.org, linux-kselftest@vger.kernel.org, Hannes Reinecke , Chuck Lever , kernel-tls-handshake@lists.linux.dev, linux-nvme@lists.infradead.org, Alistair Francis , Martin Belanger X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1793359096; l=16565; i=martin.nvme.dev@gmail.com; s=20261014; h=from:subject:message-id; bh=u5fJ0H+vKV5P99QHe0x9MGoFOlXtwZN/1Yx7QIfnM2A=; b=rq7rkLLlCEaJA2ayOGAEKURWmiLbdONPzFDnbaGORLhEks0ELbi2a5oRwZTk/mr8ye5Xqm1iU OBOou4rkTaSBFtLfURi1AjDdjdKcNVZliYcI1MdwIQI4ymkV5DwSUCx X-Developer-Key: i=martin.nvme.dev@gmail.com; a=ed25519; pk=4K+XXetGK35w2LzRRddd/bbHawZU222BN+YZRuSpN+k= X-Endpoint-Received: by B4 Relay for martin.nvme.dev@gmail.com/20261014 with auth_id=1176 X-Original-From: Martin Belanger Reply-To: martin.nvme.dev@gmail.com From: Martin Belanger Test the in-kernel KeyUpdate on a bidirectional connection with both traffic secrets registered on each socket: - registration errors: wrong length, missing key, TLS 1.2, SM4, the RX secret before the TX secret, and a secret that does not give the installed key; - KeyUpdates in both directions with data around them; - a data record, a KeyUpdate and another data record queued before the first read; - update_requested: the peer answers before its next data, and a second request waits for the answer; - splice() across a KeyUpdate; - one write that crosses the record limit gets a KeyUpdate in the middle; - a key installed with TLS_TX removes the registered secrets; - after a key installed with TLS_RX, a new update_requested is accepted; - TLS_TX_KEY_UPDATE on a shut down socket does not raise SIGPIPE; - more than 8 KeyUpdates in one second, and an invalid request_update value, end the connection. The keys are derived from the secrets with HKDF-Expand-Label, with the HMAC of the kernel through AF_ALG. Assisted-by: LLM Reviewed-by: Hannes Reinecke Signed-off-by: Martin Belanger --- tools/testing/selftests/net/config | 4 + tools/testing/selftests/net/tls.c | 461 +++++++++++++++++++++++++++++++++++++ 2 files changed, 465 insertions(+) diff --git a/tools/testing/selftests/net/config b/tools/testing/selftests/net/config index cb8cb4696df7..0de4011cfabd 100644 --- a/tools/testing/selftests/net/config +++ b/tools/testing/selftests/net/config @@ -10,8 +10,12 @@ CONFIG_CAN_VXCAN=m CONFIG_CGROUPS=y CONFIG_CRYPTO_ARIA=y CONFIG_CRYPTO_CHACHA20POLY1305=m +CONFIG_CRYPTO_HMAC=y CONFIG_CRYPTO_SHA1=y +CONFIG_CRYPTO_SHA256=y +CONFIG_CRYPTO_SHA512=y CONFIG_CRYPTO_SM4_GENERIC=y +CONFIG_CRYPTO_USER_API_HASH=y CONFIG_DEBUG_INFO_BTF=y CONFIG_DEBUG_INFO_BTF_MODULES=n CONFIG_DUMMY=y diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c index 9d3cd4fff062..abc543a5e3d9 100644 --- a/tools/testing/selftests/net/tls.c +++ b/tools/testing/selftests/net/tls.c @@ -11,6 +11,7 @@ #include #include +#include #include #include #include @@ -2390,6 +2391,466 @@ TEST_F(tls, rekey_poll_delay) } } +#ifndef SOL_ALG +#define SOL_ALG 279 +#endif + +/* RFC 9846 section 7.1, HKDF-Expand-Label with an empty context, for an + * output no longer than the hash. The HMAC comes from the kernel. + */ +static bool hkdf_expand_label(const unsigned char *secret, int secret_len, + const char *label, unsigned char *out, + int out_len) +{ + struct sockaddr_alg sa = { + .salg_family = AF_ALG, + .salg_type = "hash", + }; + unsigned char info[2 + 1 + 255 + 1 + 1], md[48]; + int tfm, op, n = 0, label_len = 6 + strlen(label); + bool ok = false; + + strcpy((char *)sa.salg_name, + secret_len == 48 ? "hmac(sha384)" : "hmac(sha256)"); + + info[n++] = out_len >> 8; + info[n++] = out_len; + info[n++] = label_len; + memcpy(info + n, "tls13 ", 6); + memcpy(info + n + 6, label, label_len - 6); + n += label_len; + info[n++] = 0; /* context */ + info[n++] = 1; /* HKDF-Expand counter */ + + tfm = socket(AF_ALG, SOCK_SEQPACKET, 0); + if (tfm < 0) + return false; + if (bind(tfm, (struct sockaddr *)&sa, sizeof(sa)) || + setsockopt(tfm, SOL_ALG, ALG_SET_KEY, secret, secret_len)) + goto out; + + op = accept(tfm, NULL, 0); + if (op < 0) + goto out; + ok = write(op, info, n) == n && read(op, md, secret_len) == secret_len; + close(op); + if (ok) + memcpy(out, md, out_len); +out: + close(tfm); + return ok; +} + +/* Fill @keys with the key and IV that @secret gives, record number 0 */ +static bool keyupdate_keys(uint16_t cipher_type, const unsigned char *secret, + int secret_len, struct tls_crypto_info_keys *keys) +{ + unsigned char *key, *salt, *iv; + int key_len, salt_len, iv_len; + unsigned char nonce[12]; + + tls_crypto_info_init(TLS_1_3_VERSION, cipher_type, keys, 0); + + switch (cipher_type) { + case TLS_CIPHER_AES_GCM_128: + key = keys->aes128.key; + salt = keys->aes128.salt; + iv = keys->aes128.iv; + key_len = sizeof(keys->aes128.key); + salt_len = sizeof(keys->aes128.salt); + iv_len = sizeof(keys->aes128.iv); + break; + case TLS_CIPHER_AES_GCM_256: + key = keys->aesgcm256.key; + salt = keys->aesgcm256.salt; + iv = keys->aesgcm256.iv; + key_len = sizeof(keys->aesgcm256.key); + salt_len = sizeof(keys->aesgcm256.salt); + iv_len = sizeof(keys->aesgcm256.iv); + break; + case TLS_CIPHER_AES_CCM_128: + key = keys->aesccm128.key; + salt = keys->aesccm128.salt; + iv = keys->aesccm128.iv; + key_len = sizeof(keys->aesccm128.key); + salt_len = sizeof(keys->aesccm128.salt); + iv_len = sizeof(keys->aesccm128.iv); + break; + case TLS_CIPHER_CHACHA20_POLY1305: + key = keys->chacha20.key; + salt = keys->chacha20.salt; + iv = keys->chacha20.iv; + key_len = sizeof(keys->chacha20.key); + salt_len = 0; + iv_len = sizeof(keys->chacha20.iv); + break; + default: + return false; + } + + if (!hkdf_expand_label(secret, secret_len, "key", key, key_len) || + !hkdf_expand_label(secret, secret_len, "iv", nonce, + salt_len + iv_len)) + return false; + + memcpy(salt, nonce, salt_len); + memcpy(iv, nonce + salt_len, iv_len); + return true; +} + +/* In-kernel KeyUpdate: fd and cfd both register the TX and RX traffic + * secrets of a bidirectional connection. fd -> cfd starts at record + * number @seq. Returns false if the variant does not support it. + */ +static bool keyupdate_setup_seq(struct __test_metadata *_metadata, + FIXTURE_DATA(tls) *self, + const FIXTURE_VARIANT(tls) *variant, + uint64_t seq) +{ + struct tls_crypto_info_keys keys_a, keys_b; + unsigned char secret_a[48], secret_b[48]; + unsigned char *rec_seq; + int len, i; + + if (self->notls || variant->tls_version != TLS_1_3_VERSION) + return false; + + switch (variant->cipher_type) { + case TLS_CIPHER_AES_GCM_128: + case TLS_CIPHER_AES_CCM_128: + case TLS_CIPHER_CHACHA20_POLY1305: + len = 32; + break; + case TLS_CIPHER_AES_GCM_256: + len = 48; + break; + default: + return false; + } + + memset(secret_a, 0xa5, sizeof(secret_a)); + memset(secret_b, 0x5a, sizeof(secret_b)); + + /* the keys must be the ones that the secrets give */ + ASSERT_TRUE(keyupdate_keys(variant->cipher_type, secret_a, len, + &keys_a)); + ASSERT_TRUE(keyupdate_keys(variant->cipher_type, secret_b, len, + &keys_b)); + + /* rec_seq is the last member of each crypto_info */ + rec_seq = (unsigned char *)&keys_a + keys_a.len - 8; + for (i = 0; i < 8; i++) + rec_seq[i] = seq >> (56 - 8 * i); + + /* fd -> cfd: replace the keys of the fixture */ + EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &keys_a, + keys_a.len), 0); + EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX, &keys_a, + keys_a.len), 0); + /* cfd -> fd */ + EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_RX, &keys_b, + keys_b.len), 0); + EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_TX, &keys_b, + keys_b.len), 0); + + /* the RX secret needs the TX secret first */ + EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_RX_TRAFFIC_SECRET, + secret_b, len), -1); + EXPECT_EQ(errno, EINVAL); + + EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX_TRAFFIC_SECRET, + secret_a, len), 0); + EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_RX_TRAFFIC_SECRET, + secret_b, len), 0); + EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_TX_TRAFFIC_SECRET, + secret_b, len), 0); + EXPECT_EQ(setsockopt(self->cfd, SOL_TLS, TLS_RX_TRAFFIC_SECRET, + secret_a, len), 0); + + return true; +} + +static bool keyupdate_setup(struct __test_metadata *_metadata, + FIXTURE_DATA(tls) *self, + const FIXTURE_VARIANT(tls) *variant) +{ + return keyupdate_setup_seq(_metadata, self, variant, 0); +} + +static void keyupdate_send(struct __test_metadata *_metadata, int fd, + int request) +{ + EXPECT_EQ(setsockopt(fd, SOL_TLS, TLS_TX_KEY_UPDATE, + &request, sizeof(request)), 0); +} + +static void send_recv_str(struct __test_metadata *_metadata, int from, int to, + const char *str) +{ + int len = strlen(str) + 1; + char buf[64]; + + EXPECT_EQ(send(from, str, len, 0), len); + EXPECT_EQ(recv(to, buf, sizeof(buf), 0), len); + EXPECT_EQ(memcmp(buf, str, len), 0); +} + +TEST_F(tls, keyupdate_secret_errors) +{ + unsigned char secret[48] = {}; + int one = 1; + + if (self->notls) + SKIP(return, "no TLS support"); + + /* no secret registered */ + EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX_KEY_UPDATE, + &one, sizeof(one)), -1); + EXPECT_EQ(errno, EINVAL); + + if (variant->tls_version != TLS_1_3_VERSION) { + EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX_TRAFFIC_SECRET, + secret, 32), -1); + EXPECT_EQ(errno, EINVAL); + return; + } + + if (variant->cipher_type == TLS_CIPHER_SM4_GCM || + variant->cipher_type == TLS_CIPHER_SM4_CCM) { + EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX_TRAFFIC_SECRET, + secret, 32), -1); + EXPECT_EQ(errno, EOPNOTSUPP); + return; + } + + /* the RX key is not installed on fd */ + EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_RX_TRAFFIC_SECRET, + secret, 32), -1); + EXPECT_EQ(errno, EINVAL); + + /* wrong length */ + EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX_TRAFFIC_SECRET, + secret, 16), -1); + EXPECT_EQ(errno, EINVAL); + + /* the installed key does not come from this secret */ + EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX_TRAFFIC_SECRET, secret, + variant->cipher_type == TLS_CIPHER_AES_GCM_256 ? + 48 : 32), -1); + EXPECT_EQ(errno, EINVAL); +} + +TEST_F(tls, keyupdate) +{ + int i; + + if (!keyupdate_setup(_metadata, self, variant)) + SKIP(return, "no in-kernel KeyUpdate for this variant"); + + send_recv_str(_metadata, self->fd, self->cfd, "before"); + + /* stay below the limit of 8 received KeyUpdates per second */ + for (i = 0; i < 4; i++) { + keyupdate_send(_metadata, self->fd, 0); + send_recv_str(_metadata, self->fd, self->cfd, "after"); + keyupdate_send(_metadata, self->cfd, 0); + send_recv_str(_metadata, self->cfd, self->fd, "reverse"); + } +} + +TEST_F(tls, keyupdate_queued) +{ + const char *str = "queued behind a KeyUpdate"; + int len = strlen(str) + 1; + char buf[64]; + + if (!keyupdate_setup(_metadata, self, variant)) + SKIP(return, "no in-kernel KeyUpdate for this variant"); + + /* the record before the KeyUpdate, the KeyUpdate and the record + * after it are all queued before the first read + */ + EXPECT_EQ(send(self->fd, str, len, MSG_MORE), len); + keyupdate_send(_metadata, self->fd, 0); + EXPECT_EQ(send(self->fd, str, len, 0), len); + + EXPECT_EQ(recv(self->cfd, buf, len, MSG_WAITALL), len); + EXPECT_EQ(memcmp(buf, str, len), 0); + EXPECT_EQ(recv(self->cfd, buf, len, MSG_WAITALL), len); + EXPECT_EQ(memcmp(buf, str, len), 0); +} + +TEST_F(tls, keyupdate_request) +{ + int one = 1; + + if (!keyupdate_setup(_metadata, self, variant)) + SKIP(return, "no in-kernel KeyUpdate for this variant"); + + keyupdate_send(_metadata, self->fd, 1); + + /* no answer yet */ + EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX_KEY_UPDATE, + &one, sizeof(one)), -1); + EXPECT_EQ(errno, EBUSY); + + /* cfd processes the request, then answers ahead of its data */ + send_recv_str(_metadata, self->fd, self->cfd, "request"); + send_recv_str(_metadata, self->cfd, self->fd, "answer"); + + /* answered */ + keyupdate_send(_metadata, self->fd, 1); + send_recv_str(_metadata, self->fd, self->cfd, "request"); + send_recv_str(_metadata, self->cfd, self->fd, "answer"); +} + +TEST_F(tls, keyupdate_splice) +{ + const char *str = "spliced after a KeyUpdate"; + int len = strlen(str) + 1; + char buf[64]; + int p[2]; + + if (!keyupdate_setup(_metadata, self, variant)) + SKIP(return, "no in-kernel KeyUpdate for this variant"); + + ASSERT_GE(pipe(p), 0); + + keyupdate_send(_metadata, self->fd, 0); + EXPECT_EQ(send(self->fd, str, len, 0), len); + + EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, len, 0), len); + EXPECT_EQ(read(p[0], buf, len), len); + EXPECT_EQ(memcmp(buf, str, len), 0); + + close(p[0]); + close(p[1]); +} + +TEST_F(tls, keyupdate_manual_rekey) +{ + struct tls_crypto_info_keys tls12; + int zero = 0; + + if (!keyupdate_setup(_metadata, self, variant)) + SKIP(return, "no in-kernel KeyUpdate for this variant"); + + /* a key installed by the user removes the registered secrets */ + tls_crypto_info_init(variant->tls_version, variant->cipher_type, + &tls12, 2); + EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, tls12.len), 0); + + EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX_KEY_UPDATE, + &zero, sizeof(zero)), -1); + EXPECT_EQ(errno, EINVAL); +} + +TEST_F(tls, keyupdate_manual_rekey_request) +{ + struct tls_crypto_info_keys keys; + unsigned char secret[48]; + int len; + + if (!keyupdate_setup(_metadata, self, variant)) + SKIP(return, "no in-kernel KeyUpdate for this variant"); + + keyupdate_send(_metadata, self->fd, 1); + + /* the answer to the request now goes to user space */ + len = variant->cipher_type == TLS_CIPHER_AES_GCM_256 ? 48 : 32; + memset(secret, 0x3c, sizeof(secret)); + ASSERT_TRUE(keyupdate_keys(variant->cipher_type, secret, len, &keys)); + EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_RX, &keys, keys.len), 0); + + EXPECT_EQ(setsockopt(self->fd, SOL_TLS, TLS_RX_TRAFFIC_SECRET, + secret, len), 0); + + keyupdate_send(_metadata, self->fd, 1); +} + +TEST_F(tls, keyupdate_nosignal) +{ + int zero = 0; + + if (!keyupdate_setup(_metadata, self, variant)) + SKIP(return, "no in-kernel KeyUpdate for this variant"); + + /* The default action of SIGPIPE ends the test. The result is not + * checked: as for sendmsg(), the error can show up only on the + * next call. + */ + EXPECT_EQ(shutdown(self->fd, SHUT_WR), 0); + setsockopt(self->fd, SOL_TLS, TLS_TX_KEY_UPDATE, &zero, sizeof(zero)); +} + +TEST_F(tls, keyupdate_rate_limit) +{ + char buf[64]; + int i; + + if (!keyupdate_setup(_metadata, self, variant)) + SKIP(return, "no in-kernel KeyUpdate for this variant"); + + /* the ninth KeyUpdate in one second ends the connection */ + for (i = 0; i < 9; i++) + keyupdate_send(_metadata, self->fd, 0); + EXPECT_EQ(send(self->fd, "x", 1, 0), 1); + + EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), 0), -1); + EXPECT_EQ(errno, EBADMSG); +} + +TEST_F(tls, keyupdate_record_limit) +{ + struct tls_crypto_info_keys get; + char sbuf[1024], rbuf[1024]; + socklen_t optlen; + unsigned char *rec_seq; + __u16 limit = 128; + int i; + + if (variant->cipher_type == TLS_CIPHER_CHACHA20_POLY1305) + SKIP(return, "no record limit for ChaCha20-Poly1305"); + if (!keyupdate_setup_seq(_metadata, self, variant, (1 << 24) - 2)) + SKIP(return, "no in-kernel KeyUpdate for this variant"); + + ASSERT_EQ(setsockopt(self->fd, SOL_TLS, TLS_TX_MAX_PAYLOAD_LEN, + &limit, sizeof(limit)), 0); + for (i = 0; i < sizeof(sbuf); i++) + sbuf[i] = i; + + /* one call writes 8 records or more, past the record limit */ + EXPECT_EQ(send(self->fd, sbuf, sizeof(sbuf), 0), sizeof(sbuf)); + EXPECT_EQ(recv(self->cfd, rbuf, sizeof(rbuf), MSG_WAITALL), + sizeof(rbuf)); + EXPECT_EQ(memcmp(sbuf, rbuf, sizeof(sbuf)), 0); + + /* the KeyUpdate in the middle of the call restarted at 0 */ + tls_crypto_info_init(variant->tls_version, variant->cipher_type, + &get, 0); + optlen = get.len; + ASSERT_EQ(getsockopt(self->fd, SOL_TLS, TLS_TX, &get, &optlen), 0); + rec_seq = (unsigned char *)&get + optlen - 8; + for (i = 0; i < 5; i++) + EXPECT_EQ(rec_seq[i], 0); +} + +TEST_F(tls, keyupdate_invalid) +{ + /* key_update, length 1, request_update 2 */ + static const char bad[] = "\x18\x00\x00\x01\x02"; + char buf[64]; + + if (!keyupdate_setup(_metadata, self, variant)) + SKIP(return, "no in-kernel KeyUpdate for this variant"); + + EXPECT_EQ(tls_send_cmsg(self->fd, TLS_RECORD_TYPE_HANDSHAKE, + (char *)bad, 5, 0), 5); + + EXPECT_EQ(recv(self->cfd, buf, sizeof(buf), 0), -1); + EXPECT_EQ(errno, EBADMSG); +} + struct raw_rec { unsigned int plain_len; unsigned char plain_data[100]; -- 2.53.0