![]() |
The FreeRADIUS server $Id: a4e7f8c94e8038b7627bcf52356b7ed15955c1d7 $
|
TLS server test framework, using the TLS bio. More...
#include <freeradius-devel/server/base.h>#include <freeradius-devel/server/module_rlm.h>#include <freeradius-devel/io/listen.h>#include <freeradius-devel/io/thread.h>#include <freeradius-devel/tls/base.h>#include <freeradius-devel/tls/dtls.h>#include <freeradius-devel/tls/strerror.h>#include <freeradius-devel/tls/version.h>#include <freeradius-devel/tls/connection.h>#include <freeradius-devel/bio/base.h>#include <freeradius-devel/bio/fd.h>#include <freeradius-devel/bio/tls.h>#include <freeradius-devel/util/misc.h>#include <freeradius-devel/unlang/base.h>#include <freeradius-devel/unlang/function.h>#include <freeradius-devel/unlang/interpret.h>#include <freeradius-devel/util/socket.h>#include <freeradius-devel/protocol/freeradius/freeradius.internal.h>#include <sys/wait.h>
Include dependency graph for unit_test_bio.c:Go to the source code of this file.
Data Structures | |
| struct | unit_test_bio_conf_t |
| struct | unit_test_bio_socket_t |
| The "unit_test_tls" section. More... | |
| struct | unit_test_bio_t |
| State of the test program. More... | |
Macros | |
| #define | EXIT_WITH_FAILURE |
Functions | |
| static void | _request_detach (request_t *request, UNUSED void *uctx) |
| static void | _request_done_detached (request_t *request, UNUSED rlm_rcode_t rcode, UNUSED void *uctx) |
| static void | _request_done_external (request_t *request, UNUSED rlm_rcode_t rcode, UNUSED void *uctx) |
| static void | _request_done_internal (request_t *request, UNUSED rlm_rcode_t rcode, UNUSED void *uctx) |
| static void | _request_init_internal (request_t *request, void *uctx) |
| An internal request created by the interpreter has to run on ours. | |
| static void | _request_resume (request_t *request, UNUSED void *uctx) |
| static void | _request_runnable (request_t *request, void *uctx) |
| static bool | _request_scheduled (request_t const *request, UNUSED void *uctx) |
| static void | _request_yield (request_t *request, void *uctx) |
| static void | _tls_command_exit (fr_event_list_t *el, pid_t pid, int status, void *uctx) |
| Record that the command started by -e has exited. | |
| static void | _tls_connection_start (UNUSED fr_event_list_t *el, void *uctx) |
| Start the TLS bio, from inside the event loop. | |
| static void | _tls_hold_error (UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, UNUSED int fd_errno, void *uctx) |
| static void | _tls_hold_read (UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx) |
| Something happened on a connection which -H holds open. | |
| static void | _tls_runnable (UNUSED fr_event_list_t *el, UNUSED fr_time_t now, void *uctx) |
| Drain the runnable heap once per pass of the event loop. | |
| static void | _tls_socket_accept (fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx) |
| Accept the connection once the listening socket is readable. | |
| static void | _tls_socket_accept_start (fr_event_list_t *el, void *uctx) |
| Start waiting for a connection, from inside the event loop. | |
| static void | _tls_socket_error (fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, UNUSED void *uctx) |
| Stop waiting for a connection if the listening socket fails. | |
| int | main (int argc, char *argv[]) |
| static unsigned char * | tls_alpn_build (TALLOC_CTX *ctx, char const *names) |
| Turn a comma separated list of names into the wire format ALPN uses. | |
| static void | tls_bio_connected (fr_bio_t *bio) |
| The connection is up, and can carry application data. | |
| static void | tls_bio_failed (fr_bio_t *bio) |
| The TLS bio says the connection failed, at any point. | |
| static fr_client_t * | tls_client_alloc (TALLOC_CTX *ctx, fr_ipaddr_t const *ipaddr) |
| Build an internal client. | |
| static int | tls_command_start (unit_test_bio_t *utt, char const *command) |
| Start the command named by -e. | |
| static void | tls_command_wait (unit_test_bio_t *utt) |
| Wait for the command started by -e to exit, so its output is complete. | |
| static int | tls_connection_run (unit_test_bio_t *utt) |
| Run one connection from the first byte to the last. | |
| static void | tls_done (unit_test_bio_t *utt) |
| Stop the event loop, recording why. | |
| static request_t * | tls_request_alloc (TALLOC_CTX *ctx, fr_bio_t *fd_bio, int socket_type) |
| Build the request the handshake runs under. | |
| static void | tls_request_failed (unit_test_bio_t *utt) |
| Record a failure this program cannot recover from, and stop. | |
| static void | tls_runnable_insert (unit_test_bio_t *utt, request_t *request) |
| Schedule a request, once. | |
| static int | tls_socket_accept (unit_test_bio_t *utt) |
| Wait for a connection, or for the command started by -e to exit without connecting. | |
| static int | tls_socket_accept_one (unit_test_bio_t *utt) |
| Accept a connection, if the listening socket has one queued. | |
| static int | tls_socket_connect (unit_test_bio_t *utt) |
| Connect to the server named by -s. | |
| static int | tls_socket_open (unit_test_bio_t *utt) |
| Open the listening socket described by the "unit_test_tls" section. | |
| static void | usage (main_config_t const *config, int status) |
Variables | |
| static fr_dict_t const * | dict_freeradius |
| static fr_dict_t const * | dict_tls |
| char const * | radiusd_version = RADIUSD_VERSION_BUILD("unit_test_bio") |
| static const conf_parser_t | unit_test_bio_config [] |
| fr_dict_autoload_t | unit_test_bio_dict [] |
| static const conf_parser_t | unit_test_bio_socket_config [] |
| The socket items, parsed once per transport subsection. | |
TLS server test framework, using the TLS bio.
This program loads the "tls" protocol and reads two top-level sections from unit_test_tls.conf. The "tls" section supplies the TLS server context, and takes exactly the items that a TLS configuration takes anywhere else in the server. The "unit_test_tls" section supplies what steers the test program itself, which is the address of the listening TCP socket and whether a client certificate is required.
One connection is accepted, and the TLS handshake for that connection is run to completion.
This program is unit_test_tls.c reworked to use the TLS bio in src/lib/bio/tls.c. The program opens the sockets as fd bios, and the TLS bio runs everything else for a connection: the connect, the handshake, the IO, and the policies. The program supplies the request, the interpreter, and two callbacks, connected and failed. The section is still called "unit_test_tls", so the configuration files of unit_test_tls work here too. Setting drop_datagram is an error, as the TLS bio does not offer a place to drop a datagram.
The handshake runs on a persistent asynchronous interpreter, the same way radiusd runs one. A persistent interpreter keeps the handshake state across the several rounds of a single connection.
The "virtual_server" item in the "tls" section names a virtual server. That virtual server supplies the "verify certificate", "load session", "store session" and "clear session" sections which the handshake calls.
To run the test, start unit_test_tls with the test configuration, then connect to the listening socket:
src/tests/tls/unit_test_tls.conf documents every configuration item.
Definition in file unit_test_bio.c.
| struct unit_test_bio_conf_t |
Definition at line 131 of file unit_test_bio.c.
Collaboration diagram for unit_test_bio_conf_t:| Data Fields | ||
|---|---|---|
| fr_tls_conf_t * | client |
The client { ... } subsection, used with -s. |
| uint32_t | drop_datagram |
Drop this datagram rather than sending it, counting from one. Zero drops nothing. |
| fr_ipaddr_t | ipaddr |
Address of the listening socket, copied from whichever subsection transport named. |
| uint16_t | port | Port of the listening socket, and the default port for -s. |
| bool | require_client_certificate | Whether the client has to present a certificate. |
| fr_tls_conf_t * | server |
The server { ... } subsection. |
| int | socket_type |
SOCK_STREAM or SOCK_DGRAM, from transport. |
| unit_test_bio_socket_t | tcp |
The tcp { ... } subsection. |
| char const * | transport | "tcp" or "udp", naming the subsection below which holds the socket. |
| unit_test_bio_socket_t | udp |
The udp { ... } subsection. |
| struct unit_test_bio_socket_t |
The "unit_test_tls" section.
The items at the top level steer the test program and do not configure TLS. The TLS configuration for each role is a subsection. fr_tls_server_config and fr_tls_client_config parse the subsections, so each subsection takes exactly the items that a tls { ... } section takes anywhere else in the server. One transport's socket, named by transport in the configuration
Definition at line 126 of file unit_test_bio.c.
Collaboration diagram for unit_test_bio_socket_t:| Data Fields | ||
|---|---|---|
| fr_ipaddr_t | ipaddr | Address of the listening socket. |
| uint16_t | port | Port of the listening socket. |
| struct unit_test_bio_t |
State of the test program.
The interpreter and the runnable heap live for the whole of the connection. A TLS handshake takes several rounds, and each round may yield while a virtual server section runs. The interpreter and the runnable heap therefore cannot be allocated once per round.
Definition at line 207 of file unit_test_bio.c.
Collaboration diagram for unit_test_bio_t:| Data Fields | ||
|---|---|---|
| bool | abort_pending |
Free the connection once the handshake succeeds, while store session is still queued, see -Q. |
| fr_event_fd_t * | accept_ef | Read event for sockfd, while waiting in tls_socket_accept(). |
| bool | accepting | Waiting in tls_socket_accept(). |
| bool | alert | Reject the peer with a TLS alert, see -A. |
| unsigned char * | alpn |
Protocol list built by -L, in the wire format fr_tls_conf_t expects. NULL means no ALPN. |
| bool | alpn_required | Set by -l. |
| bool | app_data | Send one byte of application data once the handshake is done, see -P. |
| fr_bio_tls_t * | bio | The TLS bio of the connection being run. |
| bool | client |
Act as the client and connect to a server, rather than accept a connection. Copied into every connection this program allocates. |
| char const * | command | Command to run, see -e. |
| fr_event_pid_t const * | command_ev | Waits for the command to exit. |
| bool | command_exited | The command has exited. |
| pid_t | command_pid | Command started by -e, or 0. |
| bool | command_waiting | Waiting in tls_command_wait(). |
| unit_test_bio_conf_t | conf | Parsed "unit_test_tls" section. |
| fr_tls_connection_t * | conn |
The connection of bio. The hooks of this program read this connection. |
| bool | connected |
The connected callback has run. |
| unsigned int | connections | How many connections have been run so far. |
| unsigned int | count | How many connections to run. |
| bool | done | Set once the connection has a result. |
| fr_event_list_t * | el | Event list everything runs on. |
| int | fd | Accepted or connected socket. |
| fr_bio_t * | fd_bio | The fd bio of the connection being run. |
| fr_bio_fd_config_t | fd_cfg |
Config of fd_bio. The bio keeps the pointer. |
| uint8_t * | first |
The datagram which named the peer, read from the listening socket before the connection's socket existed. Handed to the connection once the connection is running. |
| size_t | first_len |
Length of first. |
| bool | hold | Once connected, send nothing and stay connected, see -H. |
| unlang_interpret_t * | intp | Interpreter for the connection. |
| bool | invalid | Mark the session invalid mid-handshake, see -I. |
| fr_bio_t * | listen_bio | Listening fd bio. |
| fr_bio_fd_config_t | listen_cfg |
Config of listen_bio. The bio keeps the pointer. |
| bool | network_fail | Fail the session with a network error once the handshake succeeds, see -N. |
| bool | nonblock | Put the connection socket in non-blocking mode, see -B. |
| bool | reject | Reject the session once the handshake succeeds, see -R. |
| request_t * | request | The request the connection runs under. |
| int | ret | Exit status. |
| fr_heap_t * | runnable | Requests the interpreter has marked runnable. |
| fr_ipaddr_t | server_ipaddr | Server named by -s. |
| uint16_t | server_port | Port from -s, or from the configuration. |
| int | sockfd | Listening socket. |
| SSL_CTX * | ssl_ctx | Context built from the "tls" section. |
| int | yielded | How many requests are currently yielded. |
| #define EXIT_WITH_FAILURE |
Definition at line 97 of file unit_test_bio.c.
|
static |
|
static |
Definition at line 330 of file unit_test_bio.c.
|
static |
Definition at line 341 of file unit_test_bio.c.
|
static |
An internal request created by the interpreter has to run on ours.
The subrequests created for the "verify certificate" section and for the session cache sections reach this callback.
fr_tls_call_push() pushes each of them as a detachable subrequest, which the parent waits on rather than running inline, so the subrequest has to be scheduled here or nothing ever runs it.
Definition at line 314 of file unit_test_bio.c.
Here is the call graph for this function:Definition at line 375 of file unit_test_bio.c.
|
static |
|
static |
Definition at line 366 of file unit_test_bio.c.
|
static |
Record that the command started by -e has exited.
If the server is waiting for a connection, a command which exits has either connected already, and the connection is queued, or never will.
Definition at line 915 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Start the TLS bio, from inside the event loop.
See tls_connection_run() for why this runs from inside the event loop. The TLS bio adds the fd to the event loop, runs the handshake, and calls tls_bio_connected() or tls_bio_failed().
Definition at line 1165 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Definition at line 459 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Something happened on a connection which -H holds open.
The TLS bio removed its fd events when the connection connected, so the program watches the fd itself. Reading the bio is how the program learns that the peer has gone.
Definition at line 441 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Drain the runnable heap once per pass of the event loop.
A handshake round yields whenever the round runs a virtual server section. When that section finishes, unlang_interpret_mark_runnable() puts the request on the runnable heap, and this drains the heap again.
Definition at line 528 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Accept the connection once the listening socket is readable.
Definition at line 835 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Start waiting for a connection, from inside the event loop.
See tls_connection_run() for why this runs from inside the event loop.
Definition at line 858 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Stop waiting for a connection if the listening socket fails.
Definition at line 847 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:| int main | ( | int | argc, |
| char * | argv[] | ||
| ) |
Definition at line 1379 of file unit_test_bio.c.
|
static |
Turn a comma separated list of names into the wire format ALPN uses.
Each name becomes one length octet followed by the name. There is no terminator, so the caller takes the length from the array itself.
| [in] | ctx | to allocate in. |
| [in] | names | comma separated, in order of preference. |
Definition at line 1340 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
The connection is up, and can carry application data.
The TLS bio removed its fd events before calling this function. A program which had data to send would send it with fr_bio_write(), and close when it was done.
Definition at line 474 of file unit_test_bio.c.
Here is the call graph for this function:
|
static |
The TLS bio says the connection failed, at any point.
Definition at line 417 of file unit_test_bio.c.
Here is the call graph for this function:
|
static |
Build an internal client.
unit_test_tls accepts packets from anywhere (for now), and doesn't read "client" configuration sections.
The client is built by allocating a CONF_SECTION rather than by filling in fr_client_t manually, which allows fields to be examined by request.client().
"proto = tls" sets both the protocol and tls_required. It also fixes the secret at "radsec", so that is the secret set here.
Definition at line 1045 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Start the command named by -e.
A server starts the command once it is listening. A command which connects to the server connects to a socket which is already listening, so it can't be refused, and the server sees the command exit, so it never waits for a peer which has gone.
A client starts the command once its first connection succeeds.
Definition at line 946 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Wait for the command started by -e to exit, so its output is complete.
Definition at line 991 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Run one connection from the first byte to the last.
Everything which belongs to a single connection is allocated here and freed again at the end, so that the next connection starts clean. What survives is what the cache needs: the interpreter, the modules, and so the sessions a policy stored.
The program opens the fd bio, allocates the request, and allocates the TLS bio from the request. The TLS bio does the rest.
Definition at line 1204 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Stop the event loop, recording why.
The connection carries the result, so the exit status is decided here rather than by the TLS bio.
Definition at line 400 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Build the request the handshake runs under.
The TLS code reads the control list for TLS-Session-Cert-File and TLS-Session-Require-Client-Certificate, and writes the negotiated version and cipher suite into the session-state list, so a real request is needed.
Definition at line 1087 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Record a failure this program cannot recover from, and stop.
tls_done() reads the result from the connection, so a failure has to reach the connection before the program stops.
Definition at line 429 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Schedule a request, once.
A request reaches the heap from two directions: the interpreter creating it, and the interpreter marking it runnable again. Inserting a request which is already on the heap puts it there twice, and popping it then returns a request which the heap still holds, which the interpreter refuses to run.
Definition at line 298 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Wait for a connection, or for the command started by -e to exit without connecting.
Definition at line 886 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Accept a connection, if the listening socket has one queued.
Definition at line 713 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Connect to the server named by -s.
With -B the fd bio connects without blocking, and the TLS bio waits for the connect in the event loop.
Definition at line 1005 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Open the listening socket described by the "unit_test_tls" section.
The listening socket is an fd bio for both transports. fr_bio_fd_accept() accepts a stream connection, or takes the first datagram of a peer as a connection, see tls_socket_accept_one().
Definition at line 664 of file unit_test_bio.c.
Here is the call graph for this function:
Here is the caller graph for this function:
|
static |
Definition at line 2021 of file unit_test_bio.c.
|
static |
Definition at line 105 of file unit_test_bio.c.
|
static |
Definition at line 106 of file unit_test_bio.c.
| char const* radiusd_version = RADIUSD_VERSION_BUILD("unit_test_bio") |
Definition at line 103 of file unit_test_bio.c.
|
static |
Definition at line 164 of file unit_test_bio.c.
| fr_dict_autoload_t unit_test_bio_dict |
Definition at line 109 of file unit_test_bio.c.
|
static |
The socket items, parsed once per transport subsection.
Definition at line 154 of file unit_test_bio.c.
1.9.8