/*-
 * SPDX-License-Identifier: BSD-2-Clause
 *
 * Copyright (c) 2024 Stormshield
 */

#include <sys/capsicum.h>
#include <sys/event.h>
#include <sys/filio.h>
#include <sys/socket.h>
#include <sys/wait.h>

#include <netinet/in.h>
#include <netinet/tcp.h>

#include <errno.h>
#include <poll.h>
#include <pthread.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>

#include <atf-c.h>

static void
checked_close(int fd)
{
        int error;

        error = close(fd);
        ATF_REQUIRE_MSG(error == 0, "close failed: %s", strerror(errno));
}

static int
fionread(int fd)
{
        int data, error;

        data = 0;
        error = ioctl(fd, FIONREAD, &data);
        ATF_REQUIRE_MSG(error == 0, "ioctl failed: %s", strerror(errno));
        ATF_REQUIRE(data >= 0);
        return (data);
}

static void
noblocking(int fd)
{
        int flags, error;

        flags = fcntl(fd, F_GETFL);
        ATF_REQUIRE_MSG(flags != -1, "fcntl failed: %s", strerror(errno));
        flags |= O_NONBLOCK;
        error = fcntl(fd, F_SETFL, flags);
        ATF_REQUIRE_MSG(error == 0, "fcntl failed: %s", strerror(errno));
}

/*
 * Create a pair of connected TCP sockets, returned via the "out" array.
 */
static void
tcp_socketpair(int out[2], int domain)
{
        struct sockaddr_in sin;
        struct sockaddr_in6 sin6;
        struct sockaddr *sinp;
        int error, sd[2];

        sd[0] = socket(domain, SOCK_STREAM, 0);
        ATF_REQUIRE_MSG(sd[0] >= 0, "socket failed: %s", strerror(errno));
        sd[1] = socket(domain, SOCK_STREAM, 0);
        ATF_REQUIRE_MSG(sd[1] >= 0, "socket failed: %s", strerror(errno));

        error = setsockopt(sd[0], IPPROTO_TCP, TCP_NODELAY, &(int){ 1 },
            sizeof(int));
        ATF_REQUIRE_MSG(error == 0, "setsockopt failed: %s", strerror(errno));
        error = setsockopt(sd[1], IPPROTO_TCP, TCP_NODELAY, &(int){ 1 },
            sizeof(int));
        ATF_REQUIRE_MSG(error == 0, "setsockopt failed: %s", strerror(errno));

        if (domain == PF_INET) {
                memset(&sin, 0, sizeof(sin));
                sin.sin_family = AF_INET;
                sin.sin_len = sizeof(sin);
                sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
                sin.sin_port = htons(0);
                sinp = (struct sockaddr *)&sin;
        } else {
                ATF_REQUIRE(domain == PF_INET6);
                memset(&sin6, 0, sizeof(sin6));
                sin6.sin6_family = AF_INET6;
                sin6.sin6_len = sizeof(sin6);
                sin6.sin6_addr = in6addr_loopback;
                sin6.sin6_port = htons(0);
                sinp = (struct sockaddr *)&sin6;
        }

        error = bind(sd[0], sinp, sinp->sa_len);
        ATF_REQUIRE_MSG(error == 0, "bind failed: %s", strerror(errno));
        error = listen(sd[0], 1);
        ATF_REQUIRE_MSG(error == 0, "listen failed: %s", strerror(errno));

        error = getsockname(sd[0], sinp, &(socklen_t){ sinp->sa_len });
        ATF_REQUIRE_MSG(error == 0, "getsockname failed: %s", strerror(errno));

        error = connect(sd[1], sinp, sinp->sa_len);
        ATF_REQUIRE_MSG(error == 0, "connect failed: %s", strerror(errno));
        out[0] = accept(sd[0], NULL, NULL);
        ATF_REQUIRE_MSG(out[0] >= 0, "accept failed: %s", strerror(errno));
        checked_close(sd[0]);
        out[1] = sd[1];
}

static void
tcp4_socketpair(int out[2])
{
        tcp_socketpair(out, PF_INET);
}

static void
tcp6_socketpair(int out[2])
{
        tcp_socketpair(out, PF_INET6);
}

static off_t
nspliced(int sd)
{
        off_t n;
        socklen_t len;
        int error;

        len = sizeof(n);
        error = getsockopt(sd, SOL_SOCKET, SO_SPLICE, &n, &len);
        ATF_REQUIRE_MSG(error == 0, "getsockopt failed: %s", strerror(errno));
        ATF_REQUIRE_MSG(len == sizeof(n), "unexpected length: %d", len);
        return (n);
}

/*
 * Use a macro so that ATF_REQUIRE_MSG prints a useful line number.
 */
#define check_nspliced(sd, n) do {                                      \
        off_t sofar;                                                    \
                                                                        \
        sofar = nspliced(sd);                                           \
        ATF_REQUIRE_MSG(sofar == (off_t)n, "spliced %jd bytes, expected %jd", \
            (intmax_t)sofar, (intmax_t)n);                              \
} while (0)

static void
splice_init(struct splice *sp, int fd, off_t max, struct timeval *tv)
{
        memset(sp, 0, sizeof(*sp));
        sp->sp_fd = fd;
        sp->sp_max = max;
        if (tv != NULL)
                sp->sp_idle = *tv;
        else
                sp->sp_idle.tv_sec = sp->sp_idle.tv_usec = 0;
}

static void
unsplice(int fd)
{
        struct splice sp;
        int error;

        splice_init(&sp, -1, 0, NULL);
        error = setsockopt(fd, SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_MSG(error == 0, "setsockopt failed: %s", strerror(errno));
}

static void
unsplice_pair(int fd1, int fd2)
{
        unsplice(fd1);
        unsplice(fd2);
}

static void
splice_pair(int fd1, int fd2, off_t max, struct timeval *tv)
{
        struct splice sp;
        int error;

        splice_init(&sp, fd1, max, tv);
        error = setsockopt(fd2, SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_MSG(error == 0, "setsockopt failed: %s", strerror(errno));

        splice_init(&sp, fd2, max, tv);
        error = setsockopt(fd1, SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_MSG(error == 0, "setsockopt failed: %s", strerror(errno));
}

/*
 * A structure representing a spliced pair of connections.  left[1] is
 * bidirectionally spliced with right[0].
 */
struct splice_conn {
        int left[2];
        int right[2];
};

/*
 * Initialize a splice connection with the given maximum number of bytes to
 * splice and the given idle timeout.  For now we're forced to use TCP socket,
 * but at some point it would be nice (and simpler) to use pairs of PF_LOCAL
 * sockets.
 */
static void
splice_conn_init_limits(struct splice_conn *sc, off_t max, struct timeval *tv)
{
        memset(sc, 0, sizeof(*sc));
        tcp4_socketpair(sc->left);
        tcp4_socketpair(sc->right);
        splice_pair(sc->left[1], sc->right[0], max, tv);
}

static void
splice_conn_init(struct splice_conn *sc)
{
        splice_conn_init_limits(sc, 0, NULL);
}

static void
splice_conn_check_empty(struct splice_conn *sc)
{
        int data;

        data = fionread(sc->left[0]);
        ATF_REQUIRE_MSG(data == 0, "unexpected data on left[0]: %d", data);
        data = fionread(sc->left[1]);
        ATF_REQUIRE_MSG(data == 0, "unexpected data on left[1]: %d", data);
        data = fionread(sc->right[0]);
        ATF_REQUIRE_MSG(data == 0, "unexpected data on right[0]: %d", data);
        data = fionread(sc->right[1]);
        ATF_REQUIRE_MSG(data == 0, "unexpected data on right[1]: %d", data);
}

static void
splice_conn_fini(struct splice_conn *sc)
{
        checked_close(sc->left[0]);
        checked_close(sc->left[1]);
        checked_close(sc->right[0]);
        checked_close(sc->right[1]);
}

static void
splice_conn_noblocking(struct splice_conn *sc)
{
        noblocking(sc->left[0]);
        noblocking(sc->left[1]);
        noblocking(sc->right[0]);
        noblocking(sc->right[1]);
}

/* Pass a byte through a pair of spliced connections. */
ATF_TC_WITHOUT_HEAD(splice_basic);
ATF_TC_BODY(splice_basic, tc)
{
        struct splice_conn sc;
        ssize_t n;
        char c;

        splice_conn_init(&sc);

        check_nspliced(sc.left[1], 0);
        check_nspliced(sc.right[0], 0);

        /* Left-to-right. */
        c = 'M';
        n = write(sc.left[0], &c, 1);
        ATF_REQUIRE_MSG(n == 1, "write failed: %s", strerror(errno));
        n = read(sc.right[1], &c, 1);
        ATF_REQUIRE_MSG(n == 1, "read failed: %s", strerror(errno));
        ATF_REQUIRE_MSG(c == 'M', "unexpected character: %c", c);
        check_nspliced(sc.left[1], 1);
        check_nspliced(sc.right[0], 0);

        /* Right-to-left. */
        c = 'J';
        n = write(sc.right[1], &c, 1);
        ATF_REQUIRE_MSG(n == 1, "write failed: %s", strerror(errno));
        n = read(sc.left[0], &c, 1);
        ATF_REQUIRE_MSG(n == 1, "read failed: %s", strerror(errno));
        ATF_REQUIRE_MSG(c == 'J', "unexpected character: %c", c);
        check_nspliced(sc.left[1], 1);
        check_nspliced(sc.right[0], 1);

        /* Unsplice and verify that the byte counts haven't changed. */
        unsplice(sc.left[1]);
        unsplice(sc.right[0]);
        check_nspliced(sc.left[1], 1);
        check_nspliced(sc.right[0], 1);

        splice_conn_fini(&sc);
}

static void
remove_rights(int fd, const cap_rights_t *toremove)
{
        cap_rights_t rights;
        int error;

        error = cap_rights_get(fd, &rights);
        ATF_REQUIRE_MSG(error == 0, "cap_rights_get failed: %s",
            strerror(errno));
        cap_rights_remove(&rights, toremove);
        error = cap_rights_limit(fd, &rights);
        ATF_REQUIRE_MSG(error == 0, "cap_rights_limit failed: %s",
            strerror(errno));
}

/*
 * Verify that splicing fails when the socket is missing the necessary rights.
 */
ATF_TC_WITHOUT_HEAD(splice_capsicum);
ATF_TC_BODY(splice_capsicum, tc)
{
        struct splice sp;
        cap_rights_t rights;
        off_t n;
        int error, left[2], right[2];

        tcp4_socketpair(left);
        tcp4_socketpair(right);

        /*
         * Make sure that we can't splice a socket that's missing recv rights.
         */
        remove_rights(left[1], cap_rights_init(&rights, CAP_RECV));
        splice_init(&sp, right[0], 0, NULL);
        error = setsockopt(left[1], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_ERRNO(ENOTCAPABLE, error == -1);

        /* Make sure we can still splice left[1] in the other direction. */
        splice_init(&sp, left[1], 0, NULL);
        error = setsockopt(right[0], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_MSG(error == 0, "setsockopt failed: %s", strerror(errno));
        splice_init(&sp, -1, 0, NULL);
        error = setsockopt(right[0], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_MSG(error == 0, "setsockopt failed: %s", strerror(errno));

        /*
         * Now remove send rights from left[1] and verify that splicing is no
         * longer possible.
         */
        remove_rights(left[1], cap_rights_init(&rights, CAP_SEND));
        splice_init(&sp, left[1], 0, NULL);
        error = setsockopt(right[0], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_ERRNO(ENOTCAPABLE, error == -1);

        /*
         * It's still ok to query the SO_SPLICE state though.
         */
        n = -1;
        error = getsockopt(left[1], SOL_SOCKET, SO_SPLICE, &n,
            &(socklen_t){ sizeof(n) });
        ATF_REQUIRE_MSG(error == 0, "getsockopt failed: %s", strerror(errno));
        ATF_REQUIRE(n == 0);

        /*
         * Make sure that we can unsplice a spliced pair without any rights
         * other than CAP_SETSOCKOPT.
         */
        splice_pair(left[0], right[1], 0, NULL);
        error = cap_rights_limit(left[0],
            cap_rights_init(&rights, CAP_SETSOCKOPT));
        ATF_REQUIRE_MSG(error == 0, "cap_rights_limit failed: %s",
            strerror(errno));
        unsplice(left[0]);

        checked_close(left[0]);
        checked_close(left[1]);
        checked_close(right[0]);
        checked_close(right[1]);
}

/*
 * Check various error cases in splice configuration.
 */
ATF_TC_WITHOUT_HEAD(splice_error);
ATF_TC_BODY(splice_error, tc)
{
        struct splice_conn sc;
        struct splice sp;
        char path[PATH_MAX];
        int error, fd, sd, usd[2];

        memset(&sc, 0, sizeof(sc));
        tcp4_socketpair(sc.left);
        tcp4_socketpair(sc.right);

        /* A negative byte limit is invalid. */
        splice_init(&sp, sc.right[0], -3, NULL);
        error = setsockopt(sc.left[1], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_ERRNO(EINVAL, error == -1);

        /* Can't unsplice a never-spliced socket. */
        splice_init(&sp, -1, 0, NULL);
        error = setsockopt(sc.left[1], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_ERRNO(ENOTCONN, error == -1);

        /* Can't double-unsplice a socket. */
        splice_init(&sp, sc.right[0], 0, NULL);
        error = setsockopt(sc.left[1], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_MSG(error == 0, "setsockopt failed: %s", strerror(errno));
        unsplice(sc.left[1]);
        splice_init(&sp, -1, 0, NULL);
        error = setsockopt(sc.left[1], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_ERRNO(ENOTCONN, error == -1);

        /* Can't splice a spliced socket */
        splice_init(&sp, sc.right[0], 0, NULL);
        error = setsockopt(sc.left[1], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_MSG(error == 0, "setsockopt failed: %s", strerror(errno));
        splice_init(&sp, sc.right[1], 0, NULL);
        error = setsockopt(sc.left[1], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_ERRNO(EBUSY, error == -1);
        splice_init(&sp, sc.right[0], 0, NULL);
        error = setsockopt(sc.left[0], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_ERRNO(EBUSY, error == -1);
        splice_init(&sp, -1, 0, NULL);
        error = setsockopt(sc.left[1], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));

        /* Can't splice to a non-socket. */
        snprintf(path, sizeof(path), "/tmp/splice_error.XXXXXX");
        fd = mkstemp(path);
        ATF_REQUIRE_MSG(fd >= 0, "mkstemp failed: %s", strerror(errno));
        splice_init(&sp, fd, 0, NULL);
        error = setsockopt(sc.left[1], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_ERRNO(ENOTSOCK, error == -1);

        /* Can't splice to an invalid fd. */
        checked_close(fd);
        splice_init(&sp, fd, 0, NULL);
        error = setsockopt(sc.left[1], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_ERRNO(EBADF, error == -1);

        /* Can't splice a unix stream socket. */
        error = socketpair(AF_UNIX, SOCK_STREAM, 0, usd);
        ATF_REQUIRE_MSG(error == 0, "socketpair failed: %s", strerror(errno));
        splice_init(&sp, usd[0], 0, NULL);
        error = setsockopt(sc.left[1], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_ERRNO(EPROTONOSUPPORT, error == -1);
        error = setsockopt(usd[1], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_ERRNO(EPROTONOSUPPORT, error == -1);
        checked_close(usd[0]);
        checked_close(usd[1]);

        /* Can't splice an unconnected TCP socket. */
        sd = socket(PF_INET, SOCK_STREAM, 0);
        ATF_REQUIRE_MSG(sd >= 0, "socket failed: %s", strerror(errno));
        splice_init(&sp, sd, 0, NULL);
        error = setsockopt(sc.left[1], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_ERRNO(ENOTCONN, error == -1);
        splice_init(&sp, sc.right[0], 0, NULL);
        error = setsockopt(sd, SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_ERRNO(ENOTCONN, error == -1);

        splice_conn_fini(&sc);
}

/*
 * Make sure that kevent() doesn't report read I/O events on spliced sockets.
 */
ATF_TC_WITHOUT_HEAD(splice_kevent);
ATF_TC_BODY(splice_kevent, tc)
{
        struct splice_conn sc;
        struct kevent kev;
        struct timespec ts;
        ssize_t n;
        int error, nev, kq;
        uint8_t b;

        splice_conn_init(&sc);

        kq = kqueue();
        ATF_REQUIRE_MSG(kq >= 0, "kqueue failed: %s", strerror(errno));

        EV_SET(&kev, sc.left[1], EVFILT_READ, EV_ADD, 0, 0, NULL);
        error = kevent(kq, &kev, 1, NULL, 0, NULL);
        ATF_REQUIRE_MSG(error == 0, "kevent failed: %s", strerror(errno));

        memset(&ts, 0, sizeof(ts));
        nev = kevent(kq, NULL, 0, &kev, 1, &ts);
        ATF_REQUIRE_MSG(nev >= 0, "kevent failed: %s", strerror(errno));
        ATF_REQUIRE(nev == 0);

        b = 'M';
        n = write(sc.left[0], &b, 1);
        ATF_REQUIRE_MSG(n == 1, "write failed: %s", strerror(errno));
        n = read(sc.right[1], &b, 1);
        ATF_REQUIRE_MSG(n == 1, "read failed: %s", strerror(errno));
        ATF_REQUIRE(b == 'M');

        nev = kevent(kq, NULL, 0, &kev, 1, &ts);
        ATF_REQUIRE_MSG(nev >= 0, "kevent failed: %s", strerror(errno));
        ATF_REQUIRE(nev == 0);

        b = 'J';
        n = write(sc.right[1], &b, 1);
        ATF_REQUIRE_MSG(n == 1, "write failed: %s", strerror(errno));
        n = read(sc.left[0], &b, 1);
        ATF_REQUIRE_MSG(n == 1, "read failed: %s", strerror(errno));
        ATF_REQUIRE(b == 'J');

        splice_conn_fini(&sc);
        checked_close(kq);
}

/*
 * Verify that a splice byte limit is applied.
 */
ATF_TC_WITHOUT_HEAD(splice_limit_bytes);
ATF_TC_BODY(splice_limit_bytes, tc)
{
        struct splice_conn sc;
        ssize_t n;
        uint8_t b, buf[128];

        splice_conn_init_limits(&sc, sizeof(buf) + 1, NULL);

        memset(buf, 'A', sizeof(buf));
        for (size_t total = sizeof(buf); total > 0; total -= n) {
                n = write(sc.left[0], buf, total);
                ATF_REQUIRE_MSG(n > 0, "write failed: %s", strerror(errno));
        }
        for (size_t total = sizeof(buf); total > 0; total -= n) {
                n = read(sc.right[1], buf, sizeof(buf));
                ATF_REQUIRE_MSG(n > 0, "read failed: %s", strerror(errno));
        }

        check_nspliced(sc.left[1], sizeof(buf));
        check_nspliced(sc.right[0], 0);

        /* Trigger an unsplice by writing the last byte. */
        b = 'B';
        n = write(sc.left[0], &b, 1);
        ATF_REQUIRE_MSG(n == 1, "write failed: %s", strerror(errno));
        n = read(sc.right[1], &b, 1);
        ATF_REQUIRE_MSG(n == 1, "read failed: %s", strerror(errno));
        ATF_REQUIRE(b == 'B');

        /*
         * The next byte should appear on the other side of the connection
         * rather than the splice.
         */
        b = 'C';
        n = write(sc.left[0], &b, 1);
        ATF_REQUIRE_MSG(n == 1, "write failed: %s", strerror(errno));
        n = read(sc.left[1], &b, 1);
        ATF_REQUIRE_MSG(n == 1, "write failed: %s", strerror(errno));
        ATF_REQUIRE(b == 'C');

        splice_conn_check_empty(&sc);

        splice_conn_fini(&sc);
}

/*
 * Verify that a splice timeout limit is applied.
 */
ATF_TC_WITHOUT_HEAD(splice_limit_timeout);
ATF_TC_BODY(splice_limit_timeout, tc)
{
        struct splice_conn sc;
        ssize_t n;
        int error;
        uint8_t b, buf[128];

        splice_conn_init_limits(&sc, 0,
            &(struct timeval){ .tv_sec = 0, .tv_usec = 500000 /* 500ms */ });

        /* Write some data through the splice. */
        memset(buf, 'A', sizeof(buf));
        for (size_t total = sizeof(buf); total > 0; total -= n) {
                n = write(sc.left[0], buf, total);
                ATF_REQUIRE_MSG(n > 0, "write failed: %s", strerror(errno));
        }
        for (size_t total = sizeof(buf); total > 0; total -= n) {
                n = read(sc.right[1], buf, sizeof(buf));
                ATF_REQUIRE_MSG(n > 0, "read failed: %s", strerror(errno));
        }

        check_nspliced(sc.left[1], sizeof(buf));
        check_nspliced(sc.right[0], 0);

        /* Wait for the splice to time out. */
        error = usleep(550000);
        ATF_REQUIRE_MSG(error == 0, "usleep failed: %s", strerror(errno));

        /*
         * The next byte should appear on the other side of the connection
         * rather than the splice.
         */
        b = 'C';
        n = write(sc.left[0], &b, 1);
        ATF_REQUIRE_MSG(n == 1, "write failed: %s", strerror(errno));
        n = read(sc.left[1], &b, 1);
        ATF_REQUIRE_MSG(n == 1, "write failed: %s", strerror(errno));
        ATF_REQUIRE(b == 'C');

        splice_conn_fini(&sc);
}

/*
 * Make sure that listen() fails on spliced sockets, and that SO_SPLICE can't be
 * used with listening sockets.
 */
ATF_TC_WITHOUT_HEAD(splice_listen);
ATF_TC_BODY(splice_listen, tc)
{
        struct splice sp;
        struct splice_conn sc;
        int error, sd[3];

        /*
         * These should fail regardless since the sockets are connected, but it
         * doesn't hurt to check.
         */
        splice_conn_init(&sc);
        error = listen(sc.left[1], 1);
        ATF_REQUIRE_ERRNO(EINVAL, error == -1);
        error = listen(sc.right[0], 1);
        ATF_REQUIRE_ERRNO(EINVAL, error == -1);
        splice_conn_fini(&sc);

        tcp4_socketpair(sd);
        sd[2] = socket(PF_INET, SOCK_STREAM, 0);
        ATF_REQUIRE_MSG(sd[2] >= 0, "socket failed: %s", strerror(errno));
        error = listen(sd[2], 1);
        ATF_REQUIRE_MSG(error == 0, "listen failed: %s", strerror(errno));

        /*
         * Make sure a listening socket can't be spliced in either direction.
         */
        splice_init(&sp, sd[2], 0, NULL);
        error = setsockopt(sd[1], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_ERRNO(EINVAL, error == -1);
        splice_init(&sp, sd[1], 0, NULL);
        error = setsockopt(sd[2], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_ERRNO(EINVAL, error == -1);

        /*
         * Make sure we can't try to unsplice a listening socket.
         */
        splice_init(&sp, -1, 0, NULL);
        error = setsockopt(sd[2], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_ERRNO(EINVAL, error == -1);

        checked_close(sd[0]);
        checked_close(sd[1]);
        checked_close(sd[2]);
}

static void
sigalarm(int sig __unused)
{
}

/*
 * Our SO_SPLICE implementation doesn't do anything to prevent loops.  We should
 * however make sure that they are interruptible.
 */
ATF_TC_WITHOUT_HEAD(splice_loop);
ATF_TC_BODY(splice_loop, tc)
{
        ssize_t n;
        int sd[2], status;
        pid_t child;
        char c;

        tcp_socketpair(sd, PF_INET);
        splice_pair(sd[0], sd[1], 0, NULL);

        /*
         * Let the child process trigger an infinite loop.  It should still be
         * possible to kill the child with a signal, causing the connection to
         * be dropped and ending the loop.
         */
        child = fork();
        ATF_REQUIRE_MSG(child >= 0, "fork failed: %s", strerror(errno));
        if (child == 0) {
                alarm(2);
                c = 42;
                n = write(sd[0], &c, 1);
                if (n != 1)
                        _exit(2);
                c = 24;
                n = write(sd[1], &c, 1);
                if (n != 1)
                        _exit(3);

                for (;;) {
                        /* Wait for SIGALARM. */
                        sleep(100);
                }

                _exit(0);
        } else {
                checked_close(sd[0]);
                checked_close(sd[1]);

                child = waitpid(child, &status, 0);
                ATF_REQUIRE_MSG(child >= 0,
                    "waitpid failed: %s", strerror(errno));
                ATF_REQUIRE(WIFSIGNALED(status));
                ATF_REQUIRE(WTERMSIG(status) == SIGALRM);
        }
}

/*
 * Simple I/O test.
 */
ATF_TC_WITHOUT_HEAD(splice_nonblock);
ATF_TC_BODY(splice_nonblock, tc)
{
        struct splice_conn sc;
        char buf[200];
        size_t sofar;
        ssize_t n;

        splice_conn_init(&sc);
        splice_conn_noblocking(&sc);

        memset(buf, 'A', sizeof(buf));
        for (sofar = 0;;) {
                n = write(sc.left[0], buf, sizeof(buf));
                if (n < 0) {
                        ATF_REQUIRE_ERRNO(EAGAIN, n == -1);
                        break;
                }
                sofar += n;
        }

        while (sofar > 0) {
                n = read(sc.right[1], buf, sizeof(buf));
                if (n < 0) {
                        ATF_REQUIRE_ERRNO(EAGAIN, n == -1);
                        usleep(100);
                } else {
                        for (size_t i = 0; i < (size_t)n; i++)
                                ATF_REQUIRE(buf[i] == 'A');
                        sofar -= n;
                }
        }

        splice_conn_fini(&sc);
}

ATF_TC_WITHOUT_HEAD(splice_resplice);
ATF_TC_BODY(splice_resplice, tc)
{
        struct splice_conn sc;
        ssize_t n;
        char c;

        splice_conn_init(&sc);

        /* Left-to-right. */
        c = 'M';
        n = write(sc.left[0], &c, 1);
        ATF_REQUIRE_MSG(n == 1, "write failed: %s", strerror(errno));
        n = read(sc.right[1], &c, 1);
        ATF_REQUIRE_MSG(n == 1, "read failed: %s", strerror(errno));
        ATF_REQUIRE_MSG(c == 'M', "unexpected character: %c", c);
        check_nspliced(sc.left[1], 1);
        check_nspliced(sc.right[0], 0);

        /* Right-to-left. */
        c = 'J';
        n = write(sc.right[1], &c, 1);
        ATF_REQUIRE_MSG(n == 1, "write failed: %s", strerror(errno));
        n = read(sc.left[0], &c, 1);
        ATF_REQUIRE_MSG(n == 1, "read failed: %s", strerror(errno));
        ATF_REQUIRE_MSG(c == 'J', "unexpected character: %c", c);
        check_nspliced(sc.left[1], 1);
        check_nspliced(sc.right[0], 1);

        /* Unsplice and verify that the byte counts haven't changed. */
        unsplice(sc.left[1]);
        unsplice(sc.right[0]);
        check_nspliced(sc.left[1], 1);
        check_nspliced(sc.right[0], 1);

        /* Splice again, check that byte counts are reset. */
        splice_pair(sc.left[1], sc.right[0], 0, NULL);
        check_nspliced(sc.left[1], 0);
        check_nspliced(sc.right[0], 0);

        /* Left-to-right. */
        c = 'M';
        n = write(sc.left[0], &c, 1);
        ATF_REQUIRE_MSG(n == 1, "write failed: %s", strerror(errno));
        n = read(sc.right[1], &c, 1);
        ATF_REQUIRE_MSG(n == 1, "read failed: %s", strerror(errno));
        ATF_REQUIRE_MSG(c == 'M', "unexpected character: %c", c);
        check_nspliced(sc.left[1], 1);
        check_nspliced(sc.right[0], 0);

        /* Right-to-left. */
        c = 'J';
        n = write(sc.right[1], &c, 1);
        ATF_REQUIRE_MSG(n == 1, "write failed: %s", strerror(errno));
        n = read(sc.left[0], &c, 1);
        ATF_REQUIRE_MSG(n == 1, "read failed: %s", strerror(errno));
        ATF_REQUIRE_MSG(c == 'J', "unexpected character: %c", c);
        check_nspliced(sc.left[1], 1);
        check_nspliced(sc.right[0], 1);

        splice_conn_fini(&sc);
}

struct xfer_args {
        pthread_barrier_t *barrier;
        uint32_t bytes;
        int fd;
};

static void *
xfer(void *arg)
{
        struct xfer_args *xfer;
        uint8_t *buf;
        size_t sz;
        ssize_t n;
        uint32_t resid;
        int error;

        xfer = arg;

        error = fcntl(xfer->fd, F_SETFL, O_NONBLOCK);
        ATF_REQUIRE_MSG(error == 0, "fcntl failed: %s", strerror(errno));

        sz = MIN(xfer->bytes, 1024 * 1024);
        buf = malloc(sz);
        ATF_REQUIRE(buf != NULL);
        arc4random_buf(buf, sz);

        pthread_barrier_wait(xfer->barrier);

        for (resid = xfer->bytes; xfer->bytes > 0 || resid > 0;) {
                n = write(xfer->fd, buf, MIN(sz, xfer->bytes));
                if (n < 0) {
                        ATF_REQUIRE_ERRNO(EAGAIN, n == -1);
                        usleep(1000);
                } else {
                        ATF_REQUIRE(xfer->bytes >= (size_t)n);
                        xfer->bytes -= n;
                }

                n = read(xfer->fd, buf, sz);
                if (n < 0) {
                        ATF_REQUIRE_ERRNO(EAGAIN, n == -1);
                        usleep(1000);
                } else {
                        ATF_REQUIRE(resid >= (size_t)n);
                        resid -= n;
                }
        }

        free(buf);
        return (NULL);
}

/*
 * Use two threads to transfer data between two spliced connections.
 */
ATF_TC_WITHOUT_HEAD(splice_throughput);
ATF_TC_BODY(splice_throughput, tc)
{
        struct xfer_args xfers[2];
        pthread_t thread[2];
        pthread_barrier_t barrier;
        struct splice_conn sc;
        uint32_t bytes;
        int error;

        /* Transfer an amount between 1B and 1GB. */
        bytes = arc4random_uniform(1024 * 1024 * 1024) + 1;
        splice_conn_init(&sc);

        error = pthread_barrier_init(&barrier, NULL, 2);
        ATF_REQUIRE(error == 0);
        xfers[0] = (struct xfer_args){
            .barrier = &barrier,
            .bytes = bytes,
            .fd = sc.left[0]
        };
        xfers[1] = (struct xfer_args){
            .barrier = &barrier,
            .bytes = bytes,
            .fd = sc.right[1]
        };

        error = pthread_create(&thread[0], NULL, xfer, &xfers[0]);
        ATF_REQUIRE_MSG(error == 0,
            "pthread_create failed: %s", strerror(errno));
        error = pthread_create(&thread[1], NULL, xfer, &xfers[1]);
        ATF_REQUIRE_MSG(error == 0,
            "pthread_create failed: %s", strerror(errno));

        error = pthread_join(thread[0], NULL);
        ATF_REQUIRE_MSG(error == 0,
            "pthread_join failed: %s", strerror(errno));
        error = pthread_join(thread[1], NULL);
        ATF_REQUIRE_MSG(error == 0,
            "pthread_join failed: %s", strerror(errno));

        error = pthread_barrier_destroy(&barrier);
        ATF_REQUIRE(error == 0);
        splice_conn_fini(&sc);
}

/*
 * Make sure it's possible to splice v4 and v6 sockets together.
 */
ATF_TC_WITHOUT_HEAD(splice_v4v6);
ATF_TC_BODY(splice_v4v6, tc)
{
        struct splice sp;
        ssize_t n;
        int sd4[2], sd6[2];
        int error;
        uint8_t b;

        tcp4_socketpair(sd4);
        tcp6_socketpair(sd6);

        splice_init(&sp, sd6[0], 0, NULL);
        error = setsockopt(sd4[1], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_MSG(error == 0, "setsockopt failed: %s", strerror(errno));

        splice_init(&sp, sd4[1], 0, NULL);
        error = setsockopt(sd6[0], SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp));
        ATF_REQUIRE_MSG(error == 0, "setsockopt failed: %s", strerror(errno));

        b = 'M';
        n = write(sd4[0], &b, 1);
        ATF_REQUIRE_MSG(n == 1, "write failed: %s", strerror(errno));
        n = read(sd6[1], &b, 1);
        ATF_REQUIRE_MSG(n == 1, "read failed: %s", strerror(errno));
        ATF_REQUIRE(b == 'M');

        b = 'J';
        n = write(sd6[1], &b, 1);
        ATF_REQUIRE_MSG(n == 1, "write failed: %s", strerror(errno));
        n = read(sd4[0], &b, 1);
        ATF_REQUIRE_MSG(n == 1, "read failed: %s", strerror(errno));
        ATF_REQUIRE(b == 'J');

        checked_close(sd4[0]);
        checked_close(sd4[1]);
        checked_close(sd6[0]);
        checked_close(sd6[1]);
}

ATF_TP_ADD_TCS(tp)
{
        ATF_TP_ADD_TC(tp, splice_basic);
        ATF_TP_ADD_TC(tp, splice_capsicum);
        ATF_TP_ADD_TC(tp, splice_error);
        ATF_TP_ADD_TC(tp, splice_kevent);
        ATF_TP_ADD_TC(tp, splice_limit_bytes);
        ATF_TP_ADD_TC(tp, splice_limit_timeout);
        ATF_TP_ADD_TC(tp, splice_listen);
        ATF_TP_ADD_TC(tp, splice_loop);
        ATF_TP_ADD_TC(tp, splice_nonblock);
        ATF_TP_ADD_TC(tp, splice_resplice);
        ATF_TP_ADD_TC(tp, splice_throughput);
        ATF_TP_ADD_TC(tp, splice_v4v6);
        return (atf_no_error());
}