github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests: drv-net: psp: swap closed for connected sockets in assoc tests

Browse Source 
Future work will only allow rx-assoc and tx-assoc to be performed when
the sock is in TCP_ESTABLISHED state.

Several assoc_ tests, as well as dev_rotate_spi, test using the rx-assoc
and tx-assoc uapi calls against sockets in TCP_CLOSE state.
These tests don't involve sending or receiving data, nor involve looking
up psp device by dst entry, so using a disposable disconnected socket
was just a convenience. These can be replaced by a disposable loopback
socket.

The loopback sockets are IPv4, where the sockets they replace were
AF_INET6. This doesn't reduce coverage, since the assoc handlers accept
any TCP socket and don't look at the address family.

Some users of rx-assoc and tx-assoc on closed sockets are left if they
validate errors that are returned before the kernel will check the
socket for TCP_ESTABLISHED.

Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>
Fixes: 6b46ca260e ("net: psp: add socket security association code")
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260930-psp-defeat-v2-1-f266e7447129@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Daniel Zahka 2026-09-30 16:46:46 -07:00 committed by Jakub Kicinski
parent 9a550198d4
commit e404a2de7e
1 changed files with 19 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
tools/testing/selftests/drivers/net/psp.py
View File

@ -11,6 +11,8 @@ import struct
import termios
import time
from contextlib import contextmanager
from lib.py import defer
from lib.py import ksft_run, ksft_exit, ksft_pr
from lib.py import ksft_true, ksft_eq, ksft_ne, ksft_gt, ksft_raises
@ -58,6 +60,17 @@ def _make_psp_conn(cfg, version=0, ipver=None):
return s
@contextmanager
def _make_lo_conn():
# After tx-assoc, the client's egress is dropped, since lo has no
# psp_dev, so its FIN never reaches the server. Closing the server
# resets the unaccepted child, and the client accepts the cleartext
# RST because it hasn't received any PSP traffic yet.
with socket.create_server(("localhost", 0)) as srv, \
socket.create_connection(srv.getsockname()[:2]) as s:
yield s
def _close_conn(cfg, s):
_send_with_ack(cfg, b'data close\0')
s.close()
@ -200,20 +213,18 @@ def dev_rotate_spi(cfg):
_init_psp_dev(cfg)
top_a = top_b = 0
with socket.socket(socket.AF_INET6, socket.SOCK_STREAM) as s:
with _make_lo_conn() as s:
assoc_a = cfg.pspnl.rx_assoc({"version": 0,
"dev-id": cfg.psp_dev_id,
"sock-fd": s.fileno()})
top_a = assoc_a['rx-key']['spi'] >> 31
s.close()
rot = cfg.pspnl.key_rotate({"id": cfg.psp_dev_id})
with socket.socket(socket.AF_INET6, socket.SOCK_STREAM) as s:
with _make_lo_conn() as s:
ksft_eq(rot['id'], cfg.psp_dev_id)
assoc_b = cfg.pspnl.rx_assoc({"version": 0,
"dev-id": cfg.psp_dev_id,
"sock-fd": s.fileno()})
top_b = assoc_b['rx-key']['spi'] >> 31
s.close()
ksft_ne(top_a, top_b)
@ -221,7 +232,7 @@ def assoc_basic(cfg):
""" Test creating associations """
_init_psp_dev(cfg)
with socket.socket(socket.AF_INET6, socket.SOCK_STREAM) as s:
with _make_lo_conn() as s:
assoc = cfg.pspnl.rx_assoc({"version": 0,
"dev-id": cfg.psp_dev_id,
"sock-fd": s.fileno()})
@ -234,7 +245,6 @@ def assoc_basic(cfg):
"tx-key": assoc['rx-key'],
"sock-fd": s.fileno()})
ksft_eq(len(assoc), 0)
s.close()
def assoc_bad_dev(cfg):
@ -320,7 +330,7 @@ def assoc_version_mismatch(cfg):
# Translate versions to integers
versions = [cfg.pspnl.consts["version"].entries[v].value for v in versions]
with socket.socket(socket.AF_INET6, socket.SOCK_STREAM) as s:
with _make_lo_conn() as s:
rx = cfg.pspnl.rx_assoc({"version": versions[0],
"dev-id": cfg.psp_dev_id,
"sock-fd": s.fileno()})
@ -393,7 +403,7 @@ def assoc_twice(cfg):
return assoc
with socket.socket(socket.AF_INET6, socket.SOCK_STREAM) as s:
with _make_lo_conn() as s:
assoc = rx_assoc_check(s)
tx = cfg.pspnl.tx_assoc({"dev-id": cfg.psp_dev_id,
"version": 0,
@ -402,7 +412,7 @@ def assoc_twice(cfg):
ksft_eq(len(tx), 0)
# Use the same Tx assoc second time
with socket.socket(socket.AF_INET6, socket.SOCK_STREAM) as s2:
with _make_lo_conn() as s2:
rx_assoc_check(s2)
tx = cfg.pspnl.tx_assoc({"dev-id": cfg.psp_dev_id,
"version": 0,
@ -410,8 +420,6 @@ def assoc_twice(cfg):
"sock-fd": s2.fileno()})
ksft_eq(len(tx), 0)
s.close()
def _data_basic_send(cfg, version, ipver):
""" Test basic data send """