[PATCH RFC net-next v2 5/5] selftests/tls: add KeyUpdate tests

[Hannes Reinecke]

On 10/28/26 2:52 PM, Martin Belanger via B4 Relay wrote:
> From: Martin Belanger <martin.belanger at dell.com>
> 
> Test the in-kernel KeyUpdate on a bidirectional connection with both
> traffic secrets registered on each socket:
> 
> - registration errors: wrong length, missing key, TLS 1.2, SM4, the
>    RX secret before the TX secret, and a secret that does not give the
>    installed key;
> - KeyUpdates in both directions with data around them;
> - a data record, a KeyUpdate and another data record queued before
>    the first read;
> - update_requested: the peer answers before its next data, and a
>    second request waits for the answer;
> - splice() across a KeyUpdate;
> - a key installed with TLS_TX removes the registered secrets;
> - after a key installed with TLS_RX, a new update_requested is
>    accepted;
> - TLS_TX_KEY_UPDATE on a shut down socket does not raise SIGPIPE;
> - more than 8 KeyUpdates in one second, and an invalid
>    request_update value, end the connection.
> 
> The keys are derived from the secrets with HKDF-Expand-Label, with the
> HMAC of the kernel through AF_ALG.
> 
> Assisted-by: LLM
> Signed-off-by: Martin Belanger <martin.belanger at dell.com>
> ---
>   tools/testing/selftests/net/config |   4 +
>   tools/testing/selftests/net/tls.c  | 412 +++++++++++++++++++++++++++++++++++++
>   2 files changed, 416 insertions(+)
> 

Reviewed-by: Hannes Reinecke <hare at kernel.org>
Cheers,

Hannes

-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
hare at suse.de                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich