1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2021 Netflix Inc.
5 * Written by: John Baldwin <jhb@FreeBSD.org>
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include <sys/param.h>
30 #include <sys/endian.h>
31 #include <sys/event.h>
32 #include <sys/ktls.h>
33 #include <sys/mman.h>
34 #include <sys/socket.h>
35 #include <sys/sysctl.h>
36 #include <netinet/in.h>
37 #include <netinet/tcp.h>
38 #include <crypto/cryptodev.h>
39 #include <assert.h>
40 #include <err.h>
41 #include <fcntl.h>
42 #include <libutil.h>
43 #include <netdb.h>
44 #include <poll.h>
45 #include <stdbool.h>
46 #include <stdlib.h>
47 #include <atf-c.h>
48
49 #include <openssl/err.h>
50 #include <openssl/evp.h>
51 #include <openssl/hmac.h>
52
53 static void
require_ktls(void)54 require_ktls(void)
55 {
56 size_t len;
57 bool enable;
58
59 len = sizeof(enable);
60 if (sysctlbyname("kern.ipc.tls.enable", &enable, &len, NULL, 0) == -1) {
61 if (errno == ENOENT)
62 atf_tc_skip("kernel does not support TLS offload");
63 atf_libc_error(errno, "Failed to read kern.ipc.tls.enable");
64 }
65
66 if (!enable)
67 atf_tc_skip("Kernel TLS is disabled");
68 }
69
70 #define ATF_REQUIRE_KTLS() require_ktls()
71
72 static void
require_ktls_rx(void)73 require_ktls_rx(void)
74 {
75 size_t len;
76 bool enable;
77
78 ATF_REQUIRE_KTLS();
79
80 len = sizeof(enable);
81 if (sysctlbyname("kern.ipc.tls.rx_enable", &enable, &len, NULL, 0) ==
82 -1) {
83 if (errno == ENOENT)
84 atf_tc_skip("kernel does not support TLS offload");
85 atf_libc_error(errno, "Failed to read kern.ipc.tls.rx_enable");
86 }
87
88 if (!enable)
89 atf_tc_skip("Kernel TLS receive is disabled");
90 }
91
92 #define ATF_REQUIRE_KTLS_RX() require_ktls_rx()
93
94 static void
check_tls_mode(const atf_tc_t * tc,int s,int sockopt)95 check_tls_mode(const atf_tc_t *tc, int s, int sockopt)
96 {
97 if (atf_tc_get_config_var_as_bool_wd(tc, "ktls.require_ifnet", false)) {
98 socklen_t len;
99 int mode;
100
101 len = sizeof(mode);
102 if (getsockopt(s, IPPROTO_TCP, sockopt, &mode, &len) == -1)
103 atf_libc_error(errno, "Failed to fetch TLS mode");
104
105 if (mode != TCP_TLS_MODE_IFNET)
106 atf_tc_skip("connection did not use ifnet TLS");
107 }
108
109 if (atf_tc_get_config_var_as_bool_wd(tc, "ktls.require_toe", false)) {
110 socklen_t len;
111 int mode;
112
113 len = sizeof(mode);
114 if (getsockopt(s, IPPROTO_TCP, sockopt, &mode, &len) == -1)
115 atf_libc_error(errno, "Failed to fetch TLS mode");
116
117 if (mode != TCP_TLS_MODE_TOE)
118 atf_tc_skip("connection did not use TOE TLS");
119 }
120 }
121
122 static void __printflike(2, 3)
debug(const atf_tc_t * tc,const char * fmt,...)123 debug(const atf_tc_t *tc, const char *fmt, ...)
124 {
125 if (!atf_tc_get_config_var_as_bool_wd(tc, "ktls.debug", false))
126 return;
127
128 va_list ap;
129 va_start(ap, fmt);
130 vprintf(fmt, ap);
131 va_end(ap);
132 }
133
134 static void
debug_hexdump(const atf_tc_t * tc,const void * buf,int length,const char * label)135 debug_hexdump(const atf_tc_t *tc, const void *buf, int length,
136 const char *label)
137 {
138 if (!atf_tc_get_config_var_as_bool_wd(tc, "ktls.debug", false))
139 return;
140
141 if (label != NULL)
142 printf("%s:\n", label);
143 hexdump(buf, length, NULL, 0);
144 }
145
146 static char
rdigit(void)147 rdigit(void)
148 {
149 /* ASCII printable values between 0x20 and 0x7e */
150 return (0x20 + random() % (0x7f - 0x20));
151 }
152
153 static char *
alloc_buffer(size_t len)154 alloc_buffer(size_t len)
155 {
156 char *buf;
157 size_t i;
158
159 if (len == 0)
160 return (NULL);
161 buf = malloc(len);
162 for (i = 0; i < len; i++)
163 buf[i] = rdigit();
164 return (buf);
165 }
166
167 static bool
socketpair_tcp(int sv[2])168 socketpair_tcp(int sv[2])
169 {
170 struct pollfd pfd;
171 struct sockaddr_in sin;
172 socklen_t len;
173 int as, cs, ls;
174
175 ls = socket(PF_INET, SOCK_STREAM, 0);
176 if (ls == -1) {
177 warn("socket() for listen");
178 return (false);
179 }
180
181 memset(&sin, 0, sizeof(sin));
182 sin.sin_len = sizeof(sin);
183 sin.sin_family = AF_INET;
184 sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
185 if (bind(ls, (struct sockaddr *)&sin, sizeof(sin)) == -1) {
186 warn("bind");
187 close(ls);
188 return (false);
189 }
190
191 if (listen(ls, 1) == -1) {
192 warn("listen");
193 close(ls);
194 return (false);
195 }
196
197 len = sizeof(sin);
198 if (getsockname(ls, (struct sockaddr *)&sin, &len) == -1) {
199 warn("getsockname");
200 close(ls);
201 return (false);
202 }
203
204 cs = socket(PF_INET, SOCK_STREAM | SOCK_NONBLOCK, 0);
205 if (cs == -1) {
206 warn("socket() for connect");
207 close(ls);
208 return (false);
209 }
210
211 if (connect(cs, (struct sockaddr *)&sin, sizeof(sin)) == -1) {
212 if (errno != EINPROGRESS) {
213 warn("connect");
214 close(ls);
215 close(cs);
216 return (false);
217 }
218 }
219
220 as = accept4(ls, NULL, NULL, SOCK_NONBLOCK);
221 if (as == -1) {
222 warn("accept4");
223 close(ls);
224 close(cs);
225 return (false);
226 }
227
228 close(ls);
229
230 pfd.fd = cs;
231 pfd.events = POLLOUT;
232 pfd.revents = 0;
233 ATF_REQUIRE_INTEQ(1, poll(&pfd, 1, INFTIM));
234 ATF_REQUIRE_INTEQ(POLLOUT, pfd.revents);
235
236 sv[0] = cs;
237 sv[1] = as;
238 return (true);
239 }
240
241 static bool
echo_socket(const atf_tc_t * tc,int sv[2])242 echo_socket(const atf_tc_t *tc, int sv[2])
243 {
244 const char *cause, *host, *port;
245 struct addrinfo hints, *ai, *tofree;
246 int error, flags, s;
247
248 host = atf_tc_get_config_var(tc, "ktls.host");
249 port = atf_tc_get_config_var_wd(tc, "ktls.port", "echo");
250 memset(&hints, 0, sizeof(hints));
251 hints.ai_family = AF_UNSPEC;
252 hints.ai_socktype = SOCK_STREAM;
253 hints.ai_protocol = IPPROTO_TCP;
254 error = getaddrinfo(host, port, &hints, &tofree);
255 if (error != 0) {
256 warnx("getaddrinfo(%s:%s) failed: %s", host, port,
257 gai_strerror(error));
258 return (false);
259 }
260
261 cause = NULL;
262 for (ai = tofree; ai != NULL; ai = ai->ai_next) {
263 s = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
264 if (s == -1) {
265 cause = "socket";
266 error = errno;
267 continue;
268 }
269
270 if (connect(s, ai->ai_addr, ai->ai_addrlen) == -1) {
271 cause = "connect";
272 error = errno;
273 close(s);
274 continue;
275 }
276
277 freeaddrinfo(tofree);
278
279 ATF_REQUIRE((flags = fcntl(s, F_GETFL)) != -1);
280 flags |= O_NONBLOCK;
281 ATF_REQUIRE(fcntl(s, F_SETFL, flags) != -1);
282
283 sv[0] = s;
284 sv[1] = s;
285 return (true);
286 }
287
288 warnc(error, "%s", cause);
289 freeaddrinfo(tofree);
290 return (false);
291 }
292
293 static bool
open_sockets(const atf_tc_t * tc,int sv[2])294 open_sockets(const atf_tc_t *tc, int sv[2])
295 {
296 if (atf_tc_has_config_var(tc, "ktls.host"))
297 return (echo_socket(tc, sv));
298 else
299 return (socketpair_tcp(sv));
300 }
301
302 static void
close_sockets(int sv[2])303 close_sockets(int sv[2])
304 {
305 if (sv[0] != sv[1])
306 ATF_REQUIRE(close(sv[1]) == 0);
307 ATF_REQUIRE(close(sv[0]) == 0);
308 }
309
310 static void
close_sockets_ignore_errors(int sv[2])311 close_sockets_ignore_errors(int sv[2])
312 {
313 if (sv[0] != sv[1])
314 close(sv[1]);
315 close(sv[0]);
316 }
317
318 static void
fd_set_blocking(int fd)319 fd_set_blocking(int fd)
320 {
321 int flags;
322
323 ATF_REQUIRE((flags = fcntl(fd, F_GETFL)) != -1);
324 flags &= ~O_NONBLOCK;
325 ATF_REQUIRE(fcntl(fd, F_SETFL, flags) != -1);
326 }
327
328 static void
tcp_nodelay(int fd)329 tcp_nodelay(int fd)
330 {
331 int nodelay = 1;
332
333 ATF_REQUIRE(setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &nodelay,
334 sizeof(nodelay)) == 0);
335 }
336
337 static bool
cbc_crypt(const EVP_CIPHER * cipher,const char * key,const char * iv,const char * input,char * output,size_t size,int enc)338 cbc_crypt(const EVP_CIPHER *cipher, const char *key, const char *iv,
339 const char *input, char *output, size_t size, int enc)
340 {
341 EVP_CIPHER_CTX *ctx;
342 int outl, total;
343
344 ctx = EVP_CIPHER_CTX_new();
345 if (ctx == NULL) {
346 warnx("EVP_CIPHER_CTX_new failed: %s",
347 ERR_error_string(ERR_get_error(), NULL));
348 return (false);
349 }
350 if (EVP_CipherInit_ex(ctx, cipher, NULL, (const u_char *)key,
351 (const u_char *)iv, enc) != 1) {
352 warnx("EVP_CipherInit_ex failed: %s",
353 ERR_error_string(ERR_get_error(), NULL));
354 EVP_CIPHER_CTX_free(ctx);
355 return (false);
356 }
357 EVP_CIPHER_CTX_set_padding(ctx, 0);
358 if (EVP_CipherUpdate(ctx, (u_char *)output, &outl,
359 (const u_char *)input, size) != 1) {
360 warnx("EVP_CipherUpdate failed: %s",
361 ERR_error_string(ERR_get_error(), NULL));
362 EVP_CIPHER_CTX_free(ctx);
363 return (false);
364 }
365 total = outl;
366 if (EVP_CipherFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) {
367 warnx("EVP_CipherFinal_ex failed: %s",
368 ERR_error_string(ERR_get_error(), NULL));
369 EVP_CIPHER_CTX_free(ctx);
370 return (false);
371 }
372 total += outl;
373 if ((size_t)total != size) {
374 warnx("decrypt size mismatch: %zu vs %d", size, total);
375 EVP_CIPHER_CTX_free(ctx);
376 return (false);
377 }
378 EVP_CIPHER_CTX_free(ctx);
379 return (true);
380 }
381
382 static bool
cbc_encrypt(const EVP_CIPHER * cipher,const char * key,const char * iv,const char * input,char * output,size_t size)383 cbc_encrypt(const EVP_CIPHER *cipher, const char *key, const char *iv,
384 const char *input, char *output, size_t size)
385 {
386 return (cbc_crypt(cipher, key, iv, input, output, size, 1));
387 }
388
389 static bool
cbc_decrypt(const EVP_CIPHER * cipher,const char * key,const char * iv,const char * input,char * output,size_t size)390 cbc_decrypt(const EVP_CIPHER *cipher, const char *key, const char *iv,
391 const char *input, char *output, size_t size)
392 {
393 return (cbc_crypt(cipher, key, iv, input, output, size, 0));
394 }
395
396 static bool
compute_hash(const EVP_MD * md,const void * key,size_t key_len,const void * aad,size_t aad_len,const void * buffer,size_t len,void * digest,u_int * digest_len)397 compute_hash(const EVP_MD *md, const void *key, size_t key_len, const void *aad,
398 size_t aad_len, const void *buffer, size_t len, void *digest,
399 u_int *digest_len)
400 {
401 HMAC_CTX *ctx;
402
403 ctx = HMAC_CTX_new();
404 if (ctx == NULL) {
405 warnx("HMAC_CTX_new failed: %s",
406 ERR_error_string(ERR_get_error(), NULL));
407 return (false);
408 }
409 if (HMAC_Init_ex(ctx, key, key_len, md, NULL) != 1) {
410 warnx("HMAC_Init_ex failed: %s",
411 ERR_error_string(ERR_get_error(), NULL));
412 HMAC_CTX_free(ctx);
413 return (false);
414 }
415 if (HMAC_Update(ctx, aad, aad_len) != 1) {
416 warnx("HMAC_Update (aad) failed: %s",
417 ERR_error_string(ERR_get_error(), NULL));
418 HMAC_CTX_free(ctx);
419 return (false);
420 }
421 if (HMAC_Update(ctx, buffer, len) != 1) {
422 warnx("HMAC_Update (payload) failed: %s",
423 ERR_error_string(ERR_get_error(), NULL));
424 HMAC_CTX_free(ctx);
425 return (false);
426 }
427 if (HMAC_Final(ctx, digest, digest_len) != 1) {
428 warnx("HMAC_Final failed: %s",
429 ERR_error_string(ERR_get_error(), NULL));
430 HMAC_CTX_free(ctx);
431 return (false);
432 }
433 HMAC_CTX_free(ctx);
434 return (true);
435 }
436
437 static bool
verify_hash(const EVP_MD * md,const void * key,size_t key_len,const void * aad,size_t aad_len,const void * buffer,size_t len,const void * digest)438 verify_hash(const EVP_MD *md, const void *key, size_t key_len, const void *aad,
439 size_t aad_len, const void *buffer, size_t len, const void *digest)
440 {
441 unsigned char digest2[EVP_MAX_MD_SIZE];
442 u_int digest_len;
443
444 if (!compute_hash(md, key, key_len, aad, aad_len, buffer, len, digest2,
445 &digest_len))
446 return (false);
447 if (memcmp(digest, digest2, digest_len) != 0) {
448 warnx("HMAC mismatch");
449 return (false);
450 }
451 return (true);
452 }
453
454 static bool
aead_encrypt(const EVP_CIPHER * cipher,const char * key,const char * nonce,const void * aad,size_t aad_len,const char * input,char * output,size_t size,char * tag,size_t tag_len)455 aead_encrypt(const EVP_CIPHER *cipher, const char *key, const char *nonce,
456 const void *aad, size_t aad_len, const char *input, char *output,
457 size_t size, char *tag, size_t tag_len)
458 {
459 EVP_CIPHER_CTX *ctx;
460 int outl, total;
461
462 ctx = EVP_CIPHER_CTX_new();
463 if (ctx == NULL) {
464 warnx("EVP_CIPHER_CTX_new failed: %s",
465 ERR_error_string(ERR_get_error(), NULL));
466 return (false);
467 }
468 if (EVP_EncryptInit_ex(ctx, cipher, NULL, (const u_char *)key,
469 (const u_char *)nonce) != 1) {
470 warnx("EVP_EncryptInit_ex failed: %s",
471 ERR_error_string(ERR_get_error(), NULL));
472 EVP_CIPHER_CTX_free(ctx);
473 return (false);
474 }
475 EVP_CIPHER_CTX_set_padding(ctx, 0);
476 if (aad != NULL) {
477 if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)aad,
478 aad_len) != 1) {
479 warnx("EVP_EncryptUpdate for AAD failed: %s",
480 ERR_error_string(ERR_get_error(), NULL));
481 EVP_CIPHER_CTX_free(ctx);
482 return (false);
483 }
484 }
485 if (EVP_EncryptUpdate(ctx, (u_char *)output, &outl,
486 (const u_char *)input, size) != 1) {
487 warnx("EVP_EncryptUpdate failed: %s",
488 ERR_error_string(ERR_get_error(), NULL));
489 EVP_CIPHER_CTX_free(ctx);
490 return (false);
491 }
492 total = outl;
493 if (EVP_EncryptFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) {
494 warnx("EVP_EncryptFinal_ex failed: %s",
495 ERR_error_string(ERR_get_error(), NULL));
496 EVP_CIPHER_CTX_free(ctx);
497 return (false);
498 }
499 total += outl;
500 if ((size_t)total != size) {
501 warnx("encrypt size mismatch: %zu vs %d", size, total);
502 EVP_CIPHER_CTX_free(ctx);
503 return (false);
504 }
505 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, tag_len, tag) !=
506 1) {
507 warnx("EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_GET_TAG) failed: %s",
508 ERR_error_string(ERR_get_error(), NULL));
509 EVP_CIPHER_CTX_free(ctx);
510 return (false);
511 }
512 EVP_CIPHER_CTX_free(ctx);
513 return (true);
514 }
515
516 static bool
aead_decrypt(const EVP_CIPHER * cipher,const char * key,const char * nonce,const void * aad,size_t aad_len,const char * input,char * output,size_t size,const char * tag,size_t tag_len)517 aead_decrypt(const EVP_CIPHER *cipher, const char *key, const char *nonce,
518 const void *aad, size_t aad_len, const char *input, char *output,
519 size_t size, const char *tag, size_t tag_len)
520 {
521 EVP_CIPHER_CTX *ctx;
522 int outl, total;
523 bool valid;
524
525 ctx = EVP_CIPHER_CTX_new();
526 if (ctx == NULL) {
527 warnx("EVP_CIPHER_CTX_new failed: %s",
528 ERR_error_string(ERR_get_error(), NULL));
529 return (false);
530 }
531 if (EVP_DecryptInit_ex(ctx, cipher, NULL, (const u_char *)key,
532 (const u_char *)nonce) != 1) {
533 warnx("EVP_DecryptInit_ex failed: %s",
534 ERR_error_string(ERR_get_error(), NULL));
535 EVP_CIPHER_CTX_free(ctx);
536 return (false);
537 }
538 EVP_CIPHER_CTX_set_padding(ctx, 0);
539 if (aad != NULL) {
540 if (EVP_DecryptUpdate(ctx, NULL, &outl, (const u_char *)aad,
541 aad_len) != 1) {
542 warnx("EVP_DecryptUpdate for AAD failed: %s",
543 ERR_error_string(ERR_get_error(), NULL));
544 EVP_CIPHER_CTX_free(ctx);
545 return (false);
546 }
547 }
548 if (EVP_DecryptUpdate(ctx, (u_char *)output, &outl,
549 (const u_char *)input, size) != 1) {
550 warnx("EVP_DecryptUpdate failed: %s",
551 ERR_error_string(ERR_get_error(), NULL));
552 EVP_CIPHER_CTX_free(ctx);
553 return (false);
554 }
555 total = outl;
556 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, tag_len,
557 __DECONST(char *, tag)) != 1) {
558 warnx("EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_SET_TAG) failed: %s",
559 ERR_error_string(ERR_get_error(), NULL));
560 EVP_CIPHER_CTX_free(ctx);
561 return (false);
562 }
563 valid = (EVP_DecryptFinal_ex(ctx, (u_char *)output + outl, &outl) == 1);
564 total += outl;
565 if ((size_t)total != size) {
566 warnx("decrypt size mismatch: %zu vs %d", size, total);
567 EVP_CIPHER_CTX_free(ctx);
568 return (false);
569 }
570 if (!valid)
571 warnx("tag mismatch");
572 EVP_CIPHER_CTX_free(ctx);
573 return (valid);
574 }
575
576 static void
build_tls_enable(const atf_tc_t * tc,int cipher_alg,size_t cipher_key_len,int auth_alg,int minor,uint64_t seqno,struct tls_enable * en)577 build_tls_enable(const atf_tc_t *tc, int cipher_alg, size_t cipher_key_len,
578 int auth_alg, int minor, uint64_t seqno, struct tls_enable *en)
579 {
580 u_int auth_key_len, iv_len;
581
582 memset(en, 0, sizeof(*en));
583
584 switch (cipher_alg) {
585 case CRYPTO_AES_CBC:
586 if (minor == TLS_MINOR_VER_ZERO)
587 iv_len = AES_BLOCK_LEN;
588 else
589 iv_len = 0;
590 break;
591 case CRYPTO_AES_NIST_GCM_16:
592 if (minor == TLS_MINOR_VER_TWO)
593 iv_len = TLS_AEAD_GCM_LEN;
594 else
595 iv_len = TLS_1_3_GCM_IV_LEN;
596 break;
597 case CRYPTO_CHACHA20_POLY1305:
598 iv_len = TLS_CHACHA20_IV_LEN;
599 break;
600 default:
601 iv_len = 0;
602 break;
603 }
604 switch (auth_alg) {
605 case CRYPTO_SHA1_HMAC:
606 auth_key_len = SHA1_HASH_LEN;
607 break;
608 case CRYPTO_SHA2_256_HMAC:
609 auth_key_len = SHA2_256_HASH_LEN;
610 break;
611 case CRYPTO_SHA2_384_HMAC:
612 auth_key_len = SHA2_384_HASH_LEN;
613 break;
614 default:
615 auth_key_len = 0;
616 break;
617 }
618 en->cipher_key = alloc_buffer(cipher_key_len);
619 debug_hexdump(tc, en->cipher_key, cipher_key_len, "cipher key");
620 en->iv = alloc_buffer(iv_len);
621 if (iv_len != 0)
622 debug_hexdump(tc, en->iv, iv_len, "iv");
623 en->auth_key = alloc_buffer(auth_key_len);
624 if (auth_key_len != 0)
625 debug_hexdump(tc, en->auth_key, auth_key_len, "auth key");
626 en->cipher_algorithm = cipher_alg;
627 en->cipher_key_len = cipher_key_len;
628 en->iv_len = iv_len;
629 en->auth_algorithm = auth_alg;
630 en->auth_key_len = auth_key_len;
631 en->tls_vmajor = TLS_MAJOR_VER_ONE;
632 en->tls_vminor = minor;
633 be64enc(en->rec_seq, seqno);
634 debug(tc, "seqno: %ju\n", (uintmax_t)seqno);
635 }
636
637 static void
free_tls_enable(struct tls_enable * en)638 free_tls_enable(struct tls_enable *en)
639 {
640 free(__DECONST(void *, en->cipher_key));
641 free(__DECONST(void *, en->iv));
642 free(__DECONST(void *, en->auth_key));
643 }
644
645 static const EVP_CIPHER *
tls_EVP_CIPHER(const struct tls_enable * en)646 tls_EVP_CIPHER(const struct tls_enable *en)
647 {
648 switch (en->cipher_algorithm) {
649 case CRYPTO_AES_CBC:
650 switch (en->cipher_key_len) {
651 case 128 / 8:
652 return (EVP_aes_128_cbc());
653 case 256 / 8:
654 return (EVP_aes_256_cbc());
655 default:
656 return (NULL);
657 }
658 break;
659 case CRYPTO_AES_NIST_GCM_16:
660 switch (en->cipher_key_len) {
661 case 128 / 8:
662 return (EVP_aes_128_gcm());
663 case 256 / 8:
664 return (EVP_aes_256_gcm());
665 default:
666 return (NULL);
667 }
668 break;
669 case CRYPTO_CHACHA20_POLY1305:
670 return (EVP_chacha20_poly1305());
671 default:
672 return (NULL);
673 }
674 }
675
676 static const EVP_MD *
tls_EVP_MD(const struct tls_enable * en)677 tls_EVP_MD(const struct tls_enable *en)
678 {
679 switch (en->auth_algorithm) {
680 case CRYPTO_SHA1_HMAC:
681 return (EVP_sha1());
682 case CRYPTO_SHA2_256_HMAC:
683 return (EVP_sha256());
684 case CRYPTO_SHA2_384_HMAC:
685 return (EVP_sha384());
686 default:
687 return (NULL);
688 }
689 }
690
691 static size_t
tls_header_len(struct tls_enable * en)692 tls_header_len(struct tls_enable *en)
693 {
694 size_t len;
695
696 len = sizeof(struct tls_record_layer);
697 switch (en->cipher_algorithm) {
698 case CRYPTO_AES_CBC:
699 if (en->tls_vminor != TLS_MINOR_VER_ZERO)
700 len += AES_BLOCK_LEN;
701 return (len);
702 case CRYPTO_AES_NIST_GCM_16:
703 if (en->tls_vminor == TLS_MINOR_VER_TWO)
704 len += sizeof(uint64_t);
705 return (len);
706 case CRYPTO_CHACHA20_POLY1305:
707 return (len);
708 default:
709 return (0);
710 }
711 }
712
713 static size_t
tls_mac_len(struct tls_enable * en)714 tls_mac_len(struct tls_enable *en)
715 {
716 switch (en->cipher_algorithm) {
717 case CRYPTO_AES_CBC:
718 switch (en->auth_algorithm) {
719 case CRYPTO_SHA1_HMAC:
720 return (SHA1_HASH_LEN);
721 case CRYPTO_SHA2_256_HMAC:
722 return (SHA2_256_HASH_LEN);
723 case CRYPTO_SHA2_384_HMAC:
724 return (SHA2_384_HASH_LEN);
725 default:
726 return (0);
727 }
728 case CRYPTO_AES_NIST_GCM_16:
729 return (AES_GMAC_HASH_LEN);
730 case CRYPTO_CHACHA20_POLY1305:
731 return (POLY1305_HASH_LEN);
732 default:
733 return (0);
734 }
735 }
736
737 /* Includes maximum padding for MTE. */
738 static size_t
tls_trailer_len(struct tls_enable * en)739 tls_trailer_len(struct tls_enable *en)
740 {
741 size_t len;
742
743 len = tls_mac_len(en);
744 if (en->cipher_algorithm == CRYPTO_AES_CBC)
745 len += AES_BLOCK_LEN;
746 if (en->tls_vminor == TLS_MINOR_VER_THREE)
747 len++;
748 return (len);
749 }
750
751 /* Minimum valid record payload size for a given cipher suite. */
752 static size_t
tls_minimum_record_payload(struct tls_enable * en)753 tls_minimum_record_payload(struct tls_enable *en)
754 {
755 size_t len;
756
757 len = tls_header_len(en);
758 if (en->cipher_algorithm == CRYPTO_AES_CBC)
759 len += roundup2(tls_mac_len(en) + 1, AES_BLOCK_LEN);
760 else
761 len += tls_mac_len(en);
762 if (en->tls_vminor == TLS_MINOR_VER_THREE)
763 len++;
764 return (len - sizeof(struct tls_record_layer));
765 }
766
767 /* 'len' is the length of the payload application data. */
768 static void
tls_mte_aad(struct tls_enable * en,size_t len,const struct tls_record_layer * hdr,uint64_t seqno,struct tls_mac_data * ad)769 tls_mte_aad(struct tls_enable *en, size_t len,
770 const struct tls_record_layer *hdr, uint64_t seqno, struct tls_mac_data *ad)
771 {
772 ad->seq = htobe64(seqno);
773 ad->type = hdr->tls_type;
774 ad->tls_vmajor = hdr->tls_vmajor;
775 ad->tls_vminor = hdr->tls_vminor;
776 ad->tls_length = htons(len);
777 }
778
779 static void
tls_12_aead_aad(struct tls_enable * en,size_t len,const struct tls_record_layer * hdr,uint64_t seqno,struct tls_aead_data * ad)780 tls_12_aead_aad(struct tls_enable *en, size_t len,
781 const struct tls_record_layer *hdr, uint64_t seqno,
782 struct tls_aead_data *ad)
783 {
784 ad->seq = htobe64(seqno);
785 ad->type = hdr->tls_type;
786 ad->tls_vmajor = hdr->tls_vmajor;
787 ad->tls_vminor = hdr->tls_vminor;
788 ad->tls_length = htons(len);
789 }
790
791 static void
tls_13_aad(struct tls_enable * en,const struct tls_record_layer * hdr,uint64_t seqno,struct tls_aead_data_13 * ad)792 tls_13_aad(struct tls_enable *en, const struct tls_record_layer *hdr,
793 uint64_t seqno, struct tls_aead_data_13 *ad)
794 {
795 ad->type = hdr->tls_type;
796 ad->tls_vmajor = hdr->tls_vmajor;
797 ad->tls_vminor = hdr->tls_vminor;
798 ad->tls_length = hdr->tls_length;
799 }
800
801 static void
tls_12_gcm_nonce(struct tls_enable * en,const struct tls_record_layer * hdr,char * nonce)802 tls_12_gcm_nonce(struct tls_enable *en, const struct tls_record_layer *hdr,
803 char *nonce)
804 {
805 memcpy(nonce, en->iv, TLS_AEAD_GCM_LEN);
806 memcpy(nonce + TLS_AEAD_GCM_LEN, hdr + 1, sizeof(uint64_t));
807 }
808
809 static void
tls_13_nonce(struct tls_enable * en,uint64_t seqno,char * nonce)810 tls_13_nonce(struct tls_enable *en, uint64_t seqno, char *nonce)
811 {
812 static_assert(TLS_1_3_GCM_IV_LEN == TLS_CHACHA20_IV_LEN,
813 "TLS 1.3 nonce length mismatch");
814 memcpy(nonce, en->iv, TLS_1_3_GCM_IV_LEN);
815 *(uint64_t *)(nonce + 4) ^= htobe64(seqno);
816 }
817
818 /*
819 * Decrypt a TLS record 'len' bytes long at 'src' and store the result at
820 * 'dst'. If the TLS record header length doesn't match or 'dst' doesn't
821 * have sufficient room ('avail'), fail the test.
822 */
823 static size_t
decrypt_tls_aes_cbc_mte(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,const void * src,size_t len,void * dst,size_t avail,uint8_t * record_type)824 decrypt_tls_aes_cbc_mte(const atf_tc_t *tc, struct tls_enable *en,
825 uint64_t seqno, const void *src, size_t len, void *dst, size_t avail,
826 uint8_t *record_type)
827 {
828 const struct tls_record_layer *hdr;
829 struct tls_mac_data aad;
830 const char *iv;
831 char *buf;
832 size_t hdr_len, mac_len, payload_len;
833 int padding;
834
835 hdr = src;
836 hdr_len = tls_header_len(en);
837 mac_len = tls_mac_len(en);
838 ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor);
839 ATF_REQUIRE_INTEQ(en->tls_vminor, hdr->tls_vminor);
840 debug(tc, "decrypting MTE record seqno %ju:\n", (uintmax_t)seqno);
841 debug_hexdump(tc, src, len, NULL);
842
843 /* First, decrypt the outer payload into a temporary buffer. */
844 payload_len = len - hdr_len;
845 buf = malloc(payload_len);
846 if (en->tls_vminor == TLS_MINOR_VER_ZERO)
847 iv = en->iv;
848 else
849 iv = (void *)(hdr + 1);
850 debug_hexdump(tc, iv, AES_BLOCK_LEN, "iv");
851 ATF_REQUIRE(cbc_decrypt(tls_EVP_CIPHER(en), en->cipher_key, iv,
852 (const u_char *)src + hdr_len, buf, payload_len));
853 debug_hexdump(tc, buf, payload_len, "decrypted buffer");
854
855 /*
856 * Copy the last encrypted block to use as the IV for the next
857 * record for TLS 1.0.
858 */
859 if (en->tls_vminor == TLS_MINOR_VER_ZERO)
860 memcpy(__DECONST(uint8_t *, en->iv), (const u_char *)src +
861 (len - AES_BLOCK_LEN), AES_BLOCK_LEN);
862
863 /*
864 * Verify trailing padding and strip.
865 *
866 * The kernel always generates the smallest amount of padding.
867 */
868 padding = buf[payload_len - 1] + 1;
869 ATF_REQUIRE_MSG(padding > 0 && padding <= AES_BLOCK_LEN,
870 "invalid padding %d", padding);
871 ATF_REQUIRE_MSG(payload_len >= mac_len + padding,
872 "payload_len (%zu) < mac_len (%zu) + padding (%d)", payload_len,
873 mac_len, padding);
874 payload_len -= padding;
875
876 /* Verify HMAC. */
877 payload_len -= mac_len;
878 tls_mte_aad(en, payload_len, hdr, seqno, &aad);
879 debug_hexdump(tc, &aad, sizeof(aad), "aad");
880 ATF_REQUIRE(verify_hash(tls_EVP_MD(en), en->auth_key, en->auth_key_len,
881 &aad, sizeof(aad), buf, payload_len, buf + payload_len));
882
883 ATF_REQUIRE_MSG(payload_len <= avail, "payload_len (%zu) < avail (%zu)",
884 payload_len, avail);
885 memcpy(dst, buf, payload_len);
886 *record_type = hdr->tls_type;
887 return (payload_len);
888 }
889
890 static size_t
decrypt_tls_12_aead(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,const void * src,size_t len,void * dst,uint8_t * record_type)891 decrypt_tls_12_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno,
892 const void *src, size_t len, void *dst, uint8_t *record_type)
893 {
894 const struct tls_record_layer *hdr;
895 struct tls_aead_data aad;
896 char nonce[12];
897 size_t hdr_len, mac_len, payload_len;
898
899 hdr = src;
900
901 hdr_len = tls_header_len(en);
902 mac_len = tls_mac_len(en);
903 payload_len = len - (hdr_len + mac_len);
904 ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor);
905 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, hdr->tls_vminor);
906 debug(tc, "decrypting TLS 1.2 record seqno %ju:\n", (uintmax_t)seqno);
907 debug_hexdump(tc, src, len, NULL);
908
909 tls_12_aead_aad(en, payload_len, hdr, seqno, &aad);
910 debug_hexdump(tc, &aad, sizeof(aad), "aad");
911 if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16)
912 tls_12_gcm_nonce(en, hdr, nonce);
913 else
914 tls_13_nonce(en, seqno, nonce);
915 debug_hexdump(tc, nonce, sizeof(nonce), "nonce");
916
917 ATF_REQUIRE(aead_decrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce,
918 &aad, sizeof(aad), (const char *)src + hdr_len, dst, payload_len,
919 (const char *)src + hdr_len + payload_len, mac_len));
920
921 *record_type = hdr->tls_type;
922 return (payload_len);
923 }
924
925 static size_t
decrypt_tls_13_aead(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,const void * src,size_t len,void * dst,uint8_t * record_type)926 decrypt_tls_13_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno,
927 const void *src, size_t len, void *dst, uint8_t *record_type)
928 {
929 const struct tls_record_layer *hdr;
930 struct tls_aead_data_13 aad;
931 char nonce[12];
932 char *buf;
933 size_t hdr_len, mac_len, payload_len;
934
935 hdr = src;
936
937 hdr_len = tls_header_len(en);
938 mac_len = tls_mac_len(en);
939 payload_len = len - (hdr_len + mac_len);
940 ATF_REQUIRE_MSG(payload_len >= 1,
941 "payload_len (%zu) too short: len %zu hdr_len %zu mac_len %zu",
942 payload_len, len, hdr_len, mac_len);
943 ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, hdr->tls_type);
944 ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor);
945 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, hdr->tls_vminor);
946 debug(tc, "decrypting TLS 1.3 record seqno %ju:\n", (uintmax_t)seqno);
947 debug_hexdump(tc, src, len, NULL);
948
949 tls_13_aad(en, hdr, seqno, &aad);
950 debug_hexdump(tc, &aad, sizeof(aad), "aad");
951 tls_13_nonce(en, seqno, nonce);
952 debug_hexdump(tc, nonce, sizeof(nonce), "nonce");
953
954 /*
955 * Have to use a temporary buffer for the output due to the
956 * record type as the last byte of the trailer.
957 */
958 buf = malloc(payload_len);
959
960 ATF_REQUIRE(aead_decrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce,
961 &aad, sizeof(aad), (const char *)src + hdr_len, buf, payload_len,
962 (const char *)src + hdr_len + payload_len, mac_len));
963 debug_hexdump(tc, buf, payload_len, "decrypted buffer");
964
965 /* Trim record type. */
966 *record_type = buf[payload_len - 1];
967 payload_len--;
968
969 memcpy(dst, buf, payload_len);
970 free(buf);
971
972 return (payload_len);
973 }
974
975 static size_t
decrypt_tls_aead(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,const void * src,size_t len,void * dst,size_t avail,uint8_t * record_type)976 decrypt_tls_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno,
977 const void *src, size_t len, void *dst, size_t avail, uint8_t *record_type)
978 {
979 const struct tls_record_layer *hdr;
980 size_t payload_len;
981
982 hdr = src;
983 ATF_REQUIRE_INTEQ(len, ntohs(hdr->tls_length) + sizeof(*hdr));
984
985 payload_len = len - (tls_header_len(en) + tls_trailer_len(en));
986 ATF_REQUIRE_MSG(payload_len <= avail, "payload_len (%zu) > avail (%zu)",
987 payload_len, avail);
988
989 if (en->tls_vminor == TLS_MINOR_VER_TWO) {
990 ATF_REQUIRE_INTEQ(payload_len, decrypt_tls_12_aead(tc, en,
991 seqno, src, len, dst, record_type));
992 } else {
993 ATF_REQUIRE_INTEQ(payload_len, decrypt_tls_13_aead(tc, en,
994 seqno, src, len, dst, record_type));
995 }
996
997 return (payload_len);
998 }
999
1000 static size_t
decrypt_tls_record(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,const void * src,size_t len,void * dst,size_t avail,uint8_t * record_type)1001 decrypt_tls_record(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno,
1002 const void *src, size_t len, void *dst, size_t avail, uint8_t *record_type)
1003 {
1004 if (en->cipher_algorithm == CRYPTO_AES_CBC)
1005 return (decrypt_tls_aes_cbc_mte(tc, en, seqno, src, len, dst,
1006 avail, record_type));
1007 else
1008 return (decrypt_tls_aead(tc, en, seqno, src, len, dst, avail,
1009 record_type));
1010 }
1011
1012 /*
1013 * Encrypt a TLS record of type 'record_type' with payload 'len' bytes
1014 * long at 'src' and store the result at 'dst'. If 'dst' doesn't have
1015 * sufficient room ('avail'), fail the test. 'padding' is the amount
1016 * of additional padding to include beyond any amount mandated by the
1017 * cipher suite.
1018 */
1019 static size_t
encrypt_tls_aes_cbc_mte(const atf_tc_t * tc,struct tls_enable * en,uint8_t record_type,uint64_t seqno,const void * src,size_t len,void * dst,size_t avail,size_t padding)1020 encrypt_tls_aes_cbc_mte(const atf_tc_t *tc, struct tls_enable *en,
1021 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst,
1022 size_t avail, size_t padding)
1023 {
1024 struct tls_record_layer *hdr;
1025 struct tls_mac_data aad;
1026 char *buf, *iv;
1027 size_t hdr_len, mac_len, record_len;
1028 u_int digest_len, i;
1029
1030 ATF_REQUIRE_INTEQ(0, padding % 16);
1031
1032 hdr = dst;
1033 buf = dst;
1034
1035 debug(tc, "encrypting MTE record seqno %ju:\n", (uintmax_t)seqno);
1036 hdr_len = tls_header_len(en);
1037 mac_len = tls_mac_len(en);
1038 padding += (AES_BLOCK_LEN - (len + mac_len) % AES_BLOCK_LEN);
1039 ATF_REQUIRE_MSG(padding > 0 && padding <= 255, "invalid padding (%zu)",
1040 padding);
1041
1042 record_len = hdr_len + len + mac_len + padding;
1043 ATF_REQUIRE_MSG(record_len <= avail, "record_len (%zu) > avail (%zu): "
1044 "hdr_len %zu, len %zu, mac_len %zu, padding %zu", record_len,
1045 avail, hdr_len, len, mac_len, padding);
1046
1047 hdr->tls_type = record_type;
1048 hdr->tls_vmajor = TLS_MAJOR_VER_ONE;
1049 hdr->tls_vminor = en->tls_vminor;
1050 hdr->tls_length = htons(record_len - sizeof(*hdr));
1051 iv = (char *)(hdr + 1);
1052 for (i = 0; i < AES_BLOCK_LEN; i++)
1053 iv[i] = rdigit();
1054 debug_hexdump(tc, iv, AES_BLOCK_LEN, "explicit IV");
1055
1056 /* Copy plaintext to ciphertext region. */
1057 memcpy(buf + hdr_len, src, len);
1058
1059 /* Compute HMAC. */
1060 tls_mte_aad(en, len, hdr, seqno, &aad);
1061 debug_hexdump(tc, &aad, sizeof(aad), "aad");
1062 debug_hexdump(tc, src, len, "plaintext");
1063 ATF_REQUIRE(compute_hash(tls_EVP_MD(en), en->auth_key, en->auth_key_len,
1064 &aad, sizeof(aad), src, len, buf + hdr_len + len, &digest_len));
1065 ATF_REQUIRE_INTEQ(mac_len, digest_len);
1066
1067 /* Store padding. */
1068 for (i = 0; i < padding; i++)
1069 buf[hdr_len + len + mac_len + i] = padding - 1;
1070 debug_hexdump(tc, buf + hdr_len + len, mac_len + padding,
1071 "MAC and padding");
1072
1073 /* Encrypt the record. */
1074 ATF_REQUIRE(cbc_encrypt(tls_EVP_CIPHER(en), en->cipher_key, iv,
1075 buf + hdr_len, buf + hdr_len, len + mac_len + padding));
1076 debug_hexdump(tc, dst, record_len, "encrypted record");
1077
1078 return (record_len);
1079 }
1080
1081 static size_t
encrypt_tls_12_aead(const atf_tc_t * tc,struct tls_enable * en,uint8_t record_type,uint64_t seqno,const void * src,size_t len,void * dst)1082 encrypt_tls_12_aead(const atf_tc_t *tc, struct tls_enable *en,
1083 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst)
1084 {
1085 struct tls_record_layer *hdr;
1086 struct tls_aead_data aad;
1087 char nonce[12];
1088 size_t hdr_len, mac_len, record_len;
1089
1090 hdr = dst;
1091
1092 debug(tc, "encrypting TLS 1.2 record seqno %ju:\n", (uintmax_t)seqno);
1093 hdr_len = tls_header_len(en);
1094 mac_len = tls_mac_len(en);
1095 record_len = hdr_len + len + mac_len;
1096
1097 hdr->tls_type = record_type;
1098 hdr->tls_vmajor = TLS_MAJOR_VER_ONE;
1099 hdr->tls_vminor = TLS_MINOR_VER_TWO;
1100 hdr->tls_length = htons(record_len - sizeof(*hdr));
1101 if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16)
1102 memcpy(hdr + 1, &seqno, sizeof(seqno));
1103
1104 tls_12_aead_aad(en, len, hdr, seqno, &aad);
1105 debug_hexdump(tc, &aad, sizeof(aad), "aad");
1106 if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16)
1107 tls_12_gcm_nonce(en, hdr, nonce);
1108 else
1109 tls_13_nonce(en, seqno, nonce);
1110 debug_hexdump(tc, nonce, sizeof(nonce), "nonce");
1111
1112 debug_hexdump(tc, src, len, "plaintext");
1113 ATF_REQUIRE(aead_encrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce,
1114 &aad, sizeof(aad), src, (char *)dst + hdr_len, len,
1115 (char *)dst + hdr_len + len, mac_len));
1116 debug_hexdump(tc, dst, record_len, "encrypted record");
1117
1118 return (record_len);
1119 }
1120
1121 static size_t
encrypt_tls_13_aead(const atf_tc_t * tc,struct tls_enable * en,uint8_t record_type,uint64_t seqno,const void * src,size_t len,void * dst,size_t padding)1122 encrypt_tls_13_aead(const atf_tc_t *tc, struct tls_enable *en,
1123 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst,
1124 size_t padding)
1125 {
1126 struct tls_record_layer *hdr;
1127 struct tls_aead_data_13 aad;
1128 char nonce[12];
1129 char *buf;
1130 size_t hdr_len, mac_len, record_len;
1131
1132 hdr = dst;
1133
1134 debug(tc, "encrypting TLS 1.3 record seqno %ju:\n", (uintmax_t)seqno);
1135 hdr_len = tls_header_len(en);
1136 mac_len = tls_mac_len(en);
1137 record_len = hdr_len + len + 1 + padding + mac_len;
1138
1139 hdr->tls_type = TLS_RLTYPE_APP;
1140 hdr->tls_vmajor = TLS_MAJOR_VER_ONE;
1141 hdr->tls_vminor = TLS_MINOR_VER_TWO;
1142 hdr->tls_length = htons(record_len - sizeof(*hdr));
1143
1144 tls_13_aad(en, hdr, seqno, &aad);
1145 debug_hexdump(tc, &aad, sizeof(aad), "aad");
1146 tls_13_nonce(en, seqno, nonce);
1147 debug_hexdump(tc, nonce, sizeof(nonce), "nonce");
1148
1149 /*
1150 * Have to use a temporary buffer for the input so that the record
1151 * type can be appended.
1152 */
1153 buf = malloc(len + 1 + padding);
1154 memcpy(buf, src, len);
1155 buf[len] = record_type;
1156 memset(buf + len + 1, 0, padding);
1157 debug_hexdump(tc, buf, len + 1 + padding, "plaintext + type + padding");
1158
1159 ATF_REQUIRE(aead_encrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce,
1160 &aad, sizeof(aad), buf, (char *)dst + hdr_len, len + 1 + padding,
1161 (char *)dst + hdr_len + len + 1 + padding, mac_len));
1162 debug_hexdump(tc, dst, record_len, "encrypted record");
1163
1164 free(buf);
1165
1166 return (record_len);
1167 }
1168
1169 static size_t
encrypt_tls_aead(const atf_tc_t * tc,struct tls_enable * en,uint8_t record_type,uint64_t seqno,const void * src,size_t len,void * dst,size_t avail,size_t padding)1170 encrypt_tls_aead(const atf_tc_t *tc, struct tls_enable *en,
1171 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst,
1172 size_t avail, size_t padding)
1173 {
1174 size_t record_len;
1175
1176 record_len = tls_header_len(en) + len + padding + tls_trailer_len(en);
1177 ATF_REQUIRE_MSG(record_len <= avail, "record_len (%zu) > avail (%zu): "
1178 "header %zu len %zu padding %zu trailer %zu", record_len, avail,
1179 tls_header_len(en), len, padding, tls_trailer_len(en));
1180
1181 if (en->tls_vminor == TLS_MINOR_VER_TWO) {
1182 ATF_REQUIRE_INTEQ(0, padding);
1183 ATF_REQUIRE_INTEQ(record_len, encrypt_tls_12_aead(tc, en,
1184 record_type, seqno, src, len, dst));
1185 } else
1186 ATF_REQUIRE_INTEQ(record_len, encrypt_tls_13_aead(tc, en,
1187 record_type, seqno, src, len, dst, padding));
1188
1189 return (record_len);
1190 }
1191
1192 static size_t
encrypt_tls_record(const atf_tc_t * tc,struct tls_enable * en,uint8_t record_type,uint64_t seqno,const void * src,size_t len,void * dst,size_t avail,size_t padding)1193 encrypt_tls_record(const atf_tc_t *tc, struct tls_enable *en,
1194 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst,
1195 size_t avail, size_t padding)
1196 {
1197 if (en->cipher_algorithm == CRYPTO_AES_CBC)
1198 return (encrypt_tls_aes_cbc_mte(tc, en, record_type, seqno, src,
1199 len, dst, avail, padding));
1200 else
1201 return (encrypt_tls_aead(tc, en, record_type, seqno, src, len,
1202 dst, avail, padding));
1203 }
1204
1205 static void
test_ktls_transmit_app_data(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1206 test_ktls_transmit_app_data(const atf_tc_t *tc, struct tls_enable *en,
1207 uint64_t seqno, size_t len)
1208 {
1209 struct kevent ev;
1210 struct tls_record_layer *hdr;
1211 char *plaintext, *decrypted, *outbuf;
1212 size_t decrypted_len, outbuf_len, outbuf_cap, record_len, written;
1213 ssize_t rv;
1214 int kq, sockets[2];
1215 uint8_t record_type;
1216
1217 plaintext = alloc_buffer(len);
1218 debug_hexdump(tc, plaintext, len, "plaintext");
1219 decrypted = malloc(len);
1220 outbuf_cap = tls_header_len(en) + TLS_MAX_MSG_SIZE_V10_2 +
1221 tls_trailer_len(en);
1222 outbuf = malloc(outbuf_cap);
1223 hdr = (struct tls_record_layer *)outbuf;
1224
1225 ATF_REQUIRE((kq = kqueue()) != -1);
1226
1227 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1228
1229 ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en,
1230 sizeof(*en)) == 0);
1231 check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE);
1232
1233 EV_SET(&ev, sockets[0], EVFILT_READ, EV_ADD, 0, 0, NULL);
1234 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0);
1235 EV_SET(&ev, sockets[1], EVFILT_WRITE, EV_ADD, 0, 0, NULL);
1236 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0);
1237
1238 decrypted_len = 0;
1239 outbuf_len = 0;
1240 written = 0;
1241
1242 while (decrypted_len != len) {
1243 ATF_REQUIRE(kevent(kq, NULL, 0, &ev, 1, NULL) == 1);
1244
1245 switch (ev.filter) {
1246 case EVFILT_WRITE:
1247 /* Try to write any remaining data. */
1248 rv = write(ev.ident, plaintext + written,
1249 len - written);
1250 ATF_REQUIRE_MSG(rv > 0,
1251 "failed to write to socket");
1252 written += rv;
1253 if (written == len) {
1254 ev.flags = EV_DISABLE;
1255 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0,
1256 NULL) == 0);
1257 }
1258 break;
1259
1260 case EVFILT_READ:
1261 ATF_REQUIRE((ev.flags & EV_EOF) == 0);
1262
1263 /*
1264 * Try to read data for the next TLS record
1265 * into outbuf. Start by reading the header
1266 * to determine how much additional data to
1267 * read.
1268 */
1269 if (outbuf_len < sizeof(struct tls_record_layer)) {
1270 rv = read(ev.ident, outbuf + outbuf_len,
1271 sizeof(struct tls_record_layer) -
1272 outbuf_len);
1273 ATF_REQUIRE_MSG(rv > 0,
1274 "failed to read from socket");
1275 outbuf_len += rv;
1276
1277 if (outbuf_len ==
1278 sizeof(struct tls_record_layer)) {
1279 debug(tc, "TLS header for seqno %ju:\n",
1280 (uintmax_t)seqno);
1281 debug_hexdump(tc, outbuf, outbuf_len,
1282 NULL);
1283 }
1284 }
1285
1286 if (outbuf_len < sizeof(struct tls_record_layer))
1287 break;
1288
1289 record_len = sizeof(struct tls_record_layer) +
1290 ntohs(hdr->tls_length);
1291 debug(tc, "record_len %zu outbuf_cap %zu\n",
1292 record_len, outbuf_cap);
1293 ATF_REQUIRE(record_len <= outbuf_cap);
1294 ATF_REQUIRE(record_len > outbuf_len);
1295 rv = read(ev.ident, outbuf + outbuf_len,
1296 record_len - outbuf_len);
1297 if (rv == -1 && errno == EAGAIN)
1298 break;
1299 ATF_REQUIRE_MSG(rv > 0,
1300 "failed to read from socket: %s", strerror(errno));
1301
1302 outbuf_len += rv;
1303 if (outbuf_len == record_len) {
1304 decrypted_len += decrypt_tls_record(tc, en,
1305 seqno, outbuf, outbuf_len,
1306 decrypted + decrypted_len,
1307 len - decrypted_len, &record_type);
1308 ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, record_type);
1309
1310 seqno++;
1311 outbuf_len = 0;
1312 }
1313 break;
1314 }
1315 }
1316
1317 ATF_REQUIRE_MSG(written == decrypted_len,
1318 "read %zu decrypted bytes, but wrote %zu", decrypted_len, written);
1319
1320 ATF_REQUIRE(memcmp(plaintext, decrypted, len) == 0);
1321
1322 free(outbuf);
1323 free(decrypted);
1324 free(plaintext);
1325
1326 close_sockets(sockets);
1327 ATF_REQUIRE(close(kq) == 0);
1328 }
1329
1330 static void
ktls_send_control_message(int fd,uint8_t type,void * data,size_t len)1331 ktls_send_control_message(int fd, uint8_t type, void *data, size_t len)
1332 {
1333 struct msghdr msg;
1334 struct cmsghdr *cmsg;
1335 char cbuf[CMSG_SPACE(sizeof(type))];
1336 struct iovec iov;
1337
1338 memset(&msg, 0, sizeof(msg));
1339
1340 msg.msg_control = cbuf;
1341 msg.msg_controllen = sizeof(cbuf);
1342 cmsg = CMSG_FIRSTHDR(&msg);
1343 cmsg->cmsg_level = IPPROTO_TCP;
1344 cmsg->cmsg_type = TLS_SET_RECORD_TYPE;
1345 cmsg->cmsg_len = CMSG_LEN(sizeof(type));
1346 *(uint8_t *)CMSG_DATA(cmsg) = type;
1347
1348 iov.iov_base = data;
1349 iov.iov_len = len;
1350 msg.msg_iov = &iov;
1351 msg.msg_iovlen = 1;
1352
1353 ATF_REQUIRE_INTEQ((ssize_t)len, sendmsg(fd, &msg, 0));
1354 }
1355
1356 static void
test_ktls_transmit_control(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,uint8_t type,size_t len)1357 test_ktls_transmit_control(const atf_tc_t *tc, struct tls_enable *en,
1358 uint64_t seqno, uint8_t type, size_t len)
1359 {
1360 struct tls_record_layer *hdr;
1361 char *plaintext, *decrypted, *outbuf;
1362 size_t outbuf_cap, payload_len, record_len;
1363 ssize_t rv;
1364 int sockets[2];
1365 uint8_t record_type;
1366
1367 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1368
1369 plaintext = alloc_buffer(len);
1370 decrypted = malloc(len);
1371 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1372 outbuf = malloc(outbuf_cap);
1373 hdr = (struct tls_record_layer *)outbuf;
1374
1375 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1376
1377 ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en,
1378 sizeof(*en)) == 0);
1379 check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE);
1380
1381 fd_set_blocking(sockets[0]);
1382 fd_set_blocking(sockets[1]);
1383
1384 ktls_send_control_message(sockets[1], type, plaintext, len);
1385
1386 /*
1387 * First read the header to determine how much additional data
1388 * to read.
1389 */
1390 rv = read(sockets[0], outbuf, sizeof(struct tls_record_layer));
1391 ATF_REQUIRE_INTEQ(sizeof(struct tls_record_layer), rv);
1392 payload_len = ntohs(hdr->tls_length);
1393 record_len = payload_len + sizeof(struct tls_record_layer);
1394 ATF_REQUIRE_MSG(record_len <= outbuf_cap,
1395 "record_len (%zu) > outbuf_cap (%zu)", record_len, outbuf_cap);
1396 rv = read(sockets[0], outbuf + sizeof(struct tls_record_layer),
1397 payload_len);
1398 ATF_REQUIRE_INTEQ((ssize_t)payload_len, rv);
1399
1400 rv = decrypt_tls_record(tc, en, seqno, outbuf, record_len, decrypted,
1401 len, &record_type);
1402
1403 ATF_REQUIRE_MSG((ssize_t)len == rv,
1404 "read %zd decrypted bytes, but wrote %zu", rv, len);
1405 ATF_REQUIRE_INTEQ(type, record_type);
1406
1407 ATF_REQUIRE(memcmp(plaintext, decrypted, len) == 0);
1408
1409 free(outbuf);
1410 free(decrypted);
1411 free(plaintext);
1412
1413 close_sockets(sockets);
1414 }
1415
1416 static void
test_ktls_transmit_empty_fragment(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno)1417 test_ktls_transmit_empty_fragment(const atf_tc_t *tc, struct tls_enable *en,
1418 uint64_t seqno)
1419 {
1420 struct tls_record_layer *hdr;
1421 char *outbuf;
1422 size_t outbuf_cap, payload_len, record_len;
1423 ssize_t rv;
1424 int sockets[2];
1425 uint8_t record_type;
1426
1427 outbuf_cap = tls_header_len(en) + tls_trailer_len(en);
1428 outbuf = malloc(outbuf_cap);
1429 hdr = (struct tls_record_layer *)outbuf;
1430
1431 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1432
1433 ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en,
1434 sizeof(*en)) == 0);
1435 check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE);
1436
1437 fd_set_blocking(sockets[0]);
1438 fd_set_blocking(sockets[1]);
1439
1440 /*
1441 * A write of zero bytes should send an empty fragment only for
1442 * TLS 1.0, otherwise an error should be raised.
1443 */
1444 rv = write(sockets[1], NULL, 0);
1445 if (rv == 0) {
1446 ATF_REQUIRE_INTEQ(CRYPTO_AES_CBC, en->cipher_algorithm);
1447 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_ZERO, en->tls_vminor);
1448 } else {
1449 ATF_REQUIRE_INTEQ(-1, rv);
1450 ATF_REQUIRE_ERRNO(EINVAL, true);
1451 goto out;
1452 }
1453
1454 /*
1455 * First read the header to determine how much additional data
1456 * to read.
1457 */
1458 rv = read(sockets[0], outbuf, sizeof(struct tls_record_layer));
1459 ATF_REQUIRE_INTEQ(sizeof(struct tls_record_layer), rv);
1460 payload_len = ntohs(hdr->tls_length);
1461 record_len = payload_len + sizeof(struct tls_record_layer);
1462 ATF_REQUIRE_MSG(record_len <= outbuf_cap,
1463 "record_len (%zu) > outbuf_cap (%zu)", record_len, outbuf_cap);
1464 rv = read(sockets[0], outbuf + sizeof(struct tls_record_layer),
1465 payload_len);
1466 ATF_REQUIRE_INTEQ((ssize_t)payload_len, rv);
1467
1468 rv = decrypt_tls_record(tc, en, seqno, outbuf, record_len, NULL, 0,
1469 &record_type);
1470
1471 ATF_REQUIRE_MSG(rv == 0,
1472 "read %zd decrypted bytes for an empty fragment", rv);
1473 ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, record_type);
1474
1475 out:
1476 free(outbuf);
1477
1478 close_sockets(sockets);
1479 }
1480
1481 static size_t
ktls_receive_tls_record(struct tls_enable * en,int fd,uint8_t record_type,void * data,size_t len)1482 ktls_receive_tls_record(struct tls_enable *en, int fd, uint8_t record_type,
1483 void *data, size_t len)
1484 {
1485 struct msghdr msg;
1486 struct cmsghdr *cmsg;
1487 struct tls_get_record *tgr;
1488 char cbuf[CMSG_SPACE(sizeof(*tgr))];
1489 struct iovec iov;
1490 ssize_t rv;
1491
1492 memset(&msg, 0, sizeof(msg));
1493
1494 msg.msg_control = cbuf;
1495 msg.msg_controllen = sizeof(cbuf);
1496
1497 iov.iov_base = data;
1498 iov.iov_len = len;
1499 msg.msg_iov = &iov;
1500 msg.msg_iovlen = 1;
1501
1502 ATF_REQUIRE((rv = recvmsg(fd, &msg, 0)) > 0);
1503
1504 ATF_REQUIRE((msg.msg_flags & (MSG_EOR | MSG_CTRUNC)) == MSG_EOR);
1505
1506 cmsg = CMSG_FIRSTHDR(&msg);
1507 ATF_REQUIRE(cmsg != NULL);
1508 ATF_REQUIRE_INTEQ(IPPROTO_TCP, cmsg->cmsg_level);
1509 ATF_REQUIRE_INTEQ(TLS_GET_RECORD, cmsg->cmsg_type);
1510 ATF_REQUIRE_INTEQ(CMSG_LEN(sizeof(*tgr)), cmsg->cmsg_len);
1511
1512 tgr = (struct tls_get_record *)CMSG_DATA(cmsg);
1513 ATF_REQUIRE_INTEQ(record_type, tgr->tls_type);
1514 ATF_REQUIRE_INTEQ(en->tls_vmajor, tgr->tls_vmajor);
1515 /* XXX: Not sure if this is what OpenSSL expects? */
1516 if (en->tls_vminor == TLS_MINOR_VER_THREE)
1517 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, tgr->tls_vminor);
1518 else
1519 ATF_REQUIRE_INTEQ(en->tls_vminor, tgr->tls_vminor);
1520 ATF_REQUIRE_INTEQ(htons(rv), tgr->tls_length);
1521
1522 return (rv);
1523 }
1524
1525 static void
test_ktls_receive_app_data(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len,size_t padding)1526 test_ktls_receive_app_data(const atf_tc_t *tc, struct tls_enable *en,
1527 uint64_t seqno, size_t len, size_t padding)
1528 {
1529 struct kevent ev;
1530 char *plaintext, *received, *outbuf;
1531 size_t outbuf_cap, outbuf_len, outbuf_sent, received_len, todo, written;
1532 ssize_t rv;
1533 int kq, sockets[2];
1534
1535 plaintext = alloc_buffer(len);
1536 received = malloc(len);
1537 outbuf_cap = tls_header_len(en) + TLS_MAX_MSG_SIZE_V10_2 +
1538 tls_trailer_len(en);
1539 outbuf = malloc(outbuf_cap);
1540
1541 ATF_REQUIRE((kq = kqueue()) != -1);
1542
1543 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1544
1545 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1546 sizeof(*en)) == 0);
1547 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1548
1549 EV_SET(&ev, sockets[0], EVFILT_READ, EV_ADD, 0, 0, NULL);
1550 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0);
1551 EV_SET(&ev, sockets[1], EVFILT_WRITE, EV_ADD, 0, 0, NULL);
1552 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0);
1553
1554 received_len = 0;
1555 outbuf_len = 0;
1556 written = 0;
1557
1558 while (received_len != len) {
1559 ATF_REQUIRE(kevent(kq, NULL, 0, &ev, 1, NULL) == 1);
1560
1561 switch (ev.filter) {
1562 case EVFILT_WRITE:
1563 /*
1564 * Compose the next TLS record to send.
1565 */
1566 if (outbuf_len == 0) {
1567 ATF_REQUIRE(written < len);
1568 todo = len - written;
1569 if (todo > TLS_MAX_MSG_SIZE_V10_2 - padding)
1570 todo = TLS_MAX_MSG_SIZE_V10_2 - padding;
1571 outbuf_len = encrypt_tls_record(tc, en,
1572 TLS_RLTYPE_APP, seqno, plaintext + written,
1573 todo, outbuf, outbuf_cap, padding);
1574 outbuf_sent = 0;
1575 written += todo;
1576 seqno++;
1577 }
1578
1579 /*
1580 * Try to write the remainder of the current
1581 * TLS record.
1582 */
1583 rv = write(ev.ident, outbuf + outbuf_sent,
1584 outbuf_len - outbuf_sent);
1585 ATF_REQUIRE_MSG(rv > 0,
1586 "failed to write to socket: %s", strerror(errno));
1587 outbuf_sent += rv;
1588 if (outbuf_sent == outbuf_len) {
1589 outbuf_len = 0;
1590 if (written == len) {
1591 ev.flags = EV_DISABLE;
1592 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0,
1593 NULL) == 0);
1594 }
1595 }
1596 break;
1597
1598 case EVFILT_READ:
1599 ATF_REQUIRE((ev.flags & EV_EOF) == 0);
1600
1601 rv = ktls_receive_tls_record(en, ev.ident,
1602 TLS_RLTYPE_APP, received + received_len,
1603 len - received_len);
1604 received_len += rv;
1605 break;
1606 }
1607 }
1608
1609 ATF_REQUIRE_MSG(written == received_len,
1610 "read %zu decrypted bytes, but wrote %zu", received_len, written);
1611
1612 ATF_REQUIRE(memcmp(plaintext, received, len) == 0);
1613
1614 free(outbuf);
1615 free(received);
1616 free(plaintext);
1617
1618 close_sockets(sockets);
1619 ATF_REQUIRE(close(kq) == 0);
1620 }
1621
1622 static void
ktls_receive_tls_error(int fd,int expected_error)1623 ktls_receive_tls_error(int fd, int expected_error)
1624 {
1625 struct msghdr msg;
1626 struct tls_get_record *tgr;
1627 char cbuf[CMSG_SPACE(sizeof(*tgr))];
1628 char buf[64];
1629 struct iovec iov;
1630
1631 memset(&msg, 0, sizeof(msg));
1632
1633 msg.msg_control = cbuf;
1634 msg.msg_controllen = sizeof(cbuf);
1635
1636 iov.iov_base = buf;
1637 iov.iov_len = sizeof(buf);
1638 msg.msg_iov = &iov;
1639 msg.msg_iovlen = 1;
1640
1641 ATF_REQUIRE(recvmsg(fd, &msg, 0) == -1);
1642 if (expected_error != 0)
1643 ATF_REQUIRE_ERRNO(expected_error, true);
1644 }
1645
1646 static void
test_ktls_receive_corrupted_record(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len,ssize_t offset)1647 test_ktls_receive_corrupted_record(const atf_tc_t *tc, struct tls_enable *en,
1648 uint64_t seqno, size_t len, ssize_t offset)
1649 {
1650 char *plaintext, *outbuf;
1651 size_t outbuf_cap, outbuf_len;
1652 ssize_t rv;
1653 int sockets[2];
1654
1655 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1656
1657 plaintext = alloc_buffer(len);
1658 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1659 outbuf = malloc(outbuf_cap);
1660
1661 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1662
1663 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1664 sizeof(*en)) == 0);
1665 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1666
1667 fd_set_blocking(sockets[0]);
1668 fd_set_blocking(sockets[1]);
1669
1670 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1671 plaintext, len, outbuf, outbuf_cap, 0);
1672
1673 /* A negative offset is an offset from the end. */
1674 if (offset < 0)
1675 offset += outbuf_len;
1676 outbuf[offset] ^= 0x01;
1677
1678 rv = write(sockets[1], outbuf, outbuf_len);
1679 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1680
1681 ktls_receive_tls_error(sockets[0], EBADMSG);
1682
1683 free(outbuf);
1684 free(plaintext);
1685
1686 close_sockets_ignore_errors(sockets);
1687 }
1688
1689 static void
test_ktls_receive_corrupted_iv(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1690 test_ktls_receive_corrupted_iv(const atf_tc_t *tc, struct tls_enable *en,
1691 uint64_t seqno, size_t len)
1692 {
1693 ATF_REQUIRE(tls_header_len(en) > sizeof(struct tls_record_layer));
1694
1695 /* Corrupt the first byte of the explicit IV after the header. */
1696 test_ktls_receive_corrupted_record(tc, en, seqno, len,
1697 sizeof(struct tls_record_layer));
1698 }
1699
1700 static void
test_ktls_receive_corrupted_data(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1701 test_ktls_receive_corrupted_data(const atf_tc_t *tc, struct tls_enable *en,
1702 uint64_t seqno, size_t len)
1703 {
1704 ATF_REQUIRE(len > 0);
1705
1706 /* Corrupt the first ciphertext byte after the header. */
1707 test_ktls_receive_corrupted_record(tc, en, seqno, len,
1708 tls_header_len(en));
1709 }
1710
1711 static void
test_ktls_receive_corrupted_mac(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1712 test_ktls_receive_corrupted_mac(const atf_tc_t *tc, struct tls_enable *en,
1713 uint64_t seqno, size_t len)
1714 {
1715 size_t offset;
1716
1717 /* Corrupt the first byte of the MAC. */
1718 if (en->cipher_algorithm == CRYPTO_AES_CBC)
1719 offset = tls_header_len(en) + len;
1720 else
1721 offset = -tls_mac_len(en);
1722 test_ktls_receive_corrupted_record(tc, en, seqno, len, offset);
1723 }
1724
1725 static void
test_ktls_receive_corrupted_padding(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1726 test_ktls_receive_corrupted_padding(const atf_tc_t *tc, struct tls_enable *en,
1727 uint64_t seqno, size_t len)
1728 {
1729 ATF_REQUIRE_INTEQ(CRYPTO_AES_CBC, en->cipher_algorithm);
1730
1731 /* Corrupt the last byte of the padding. */
1732 test_ktls_receive_corrupted_record(tc, en, seqno, len, -1);
1733 }
1734
1735 static void
test_ktls_receive_truncated_record(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1736 test_ktls_receive_truncated_record(const atf_tc_t *tc, struct tls_enable *en,
1737 uint64_t seqno, size_t len)
1738 {
1739 char *plaintext, *outbuf;
1740 size_t outbuf_cap, outbuf_len;
1741 ssize_t rv;
1742 int sockets[2];
1743
1744 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1745
1746 plaintext = alloc_buffer(len);
1747 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1748 outbuf = malloc(outbuf_cap);
1749
1750 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1751
1752 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1753 sizeof(*en)) == 0);
1754 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1755
1756 fd_set_blocking(sockets[0]);
1757 fd_set_blocking(sockets[1]);
1758
1759 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1760 plaintext, len, outbuf, outbuf_cap, 0);
1761
1762 rv = write(sockets[1], outbuf, outbuf_len / 2);
1763 ATF_REQUIRE_INTEQ((ssize_t)(outbuf_len / 2), rv);
1764
1765 ATF_REQUIRE(shutdown(sockets[1], SHUT_WR) == 0);
1766
1767 ktls_receive_tls_error(sockets[0], EMSGSIZE);
1768
1769 free(outbuf);
1770 free(plaintext);
1771
1772 close_sockets_ignore_errors(sockets);
1773 }
1774
1775 static void
test_ktls_receive_bad_major(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1776 test_ktls_receive_bad_major(const atf_tc_t *tc, struct tls_enable *en,
1777 uint64_t seqno, size_t len)
1778 {
1779 struct tls_record_layer *hdr;
1780 char *plaintext, *outbuf;
1781 size_t outbuf_cap, outbuf_len;
1782 ssize_t rv;
1783 int sockets[2];
1784
1785 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1786
1787 plaintext = alloc_buffer(len);
1788 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1789 outbuf = malloc(outbuf_cap);
1790
1791 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1792
1793 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1794 sizeof(*en)) == 0);
1795 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1796
1797 fd_set_blocking(sockets[0]);
1798 fd_set_blocking(sockets[1]);
1799
1800 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1801 plaintext, len, outbuf, outbuf_cap, 0);
1802
1803 hdr = (void *)outbuf;
1804 hdr->tls_vmajor++;
1805
1806 rv = write(sockets[1], outbuf, outbuf_len);
1807 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1808
1809 ktls_receive_tls_error(sockets[0], EINVAL);
1810
1811 free(outbuf);
1812 free(plaintext);
1813
1814 close_sockets_ignore_errors(sockets);
1815 }
1816
1817 static void
test_ktls_receive_bad_minor(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1818 test_ktls_receive_bad_minor(const atf_tc_t *tc, struct tls_enable *en,
1819 uint64_t seqno, size_t len)
1820 {
1821 struct tls_record_layer *hdr;
1822 char *plaintext, *outbuf;
1823 size_t outbuf_cap, outbuf_len;
1824 ssize_t rv;
1825 int sockets[2];
1826
1827 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1828
1829 plaintext = alloc_buffer(len);
1830 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1831 outbuf = malloc(outbuf_cap);
1832
1833 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1834
1835 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1836 sizeof(*en)) == 0);
1837 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1838
1839 fd_set_blocking(sockets[0]);
1840 fd_set_blocking(sockets[1]);
1841
1842 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1843 plaintext, len, outbuf, outbuf_cap, 0);
1844
1845 hdr = (void *)outbuf;
1846 hdr->tls_vminor++;
1847
1848 rv = write(sockets[1], outbuf, outbuf_len);
1849 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1850
1851 ktls_receive_tls_error(sockets[0], EINVAL);
1852
1853 free(outbuf);
1854 free(plaintext);
1855
1856 close_sockets_ignore_errors(sockets);
1857 }
1858
1859 static void
test_ktls_receive_bad_type(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1860 test_ktls_receive_bad_type(const atf_tc_t *tc, struct tls_enable *en,
1861 uint64_t seqno, size_t len)
1862 {
1863 struct tls_record_layer *hdr;
1864 char *plaintext, *outbuf;
1865 size_t outbuf_cap, outbuf_len;
1866 ssize_t rv;
1867 int sockets[2];
1868
1869 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1870 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_THREE, en->tls_vminor);
1871
1872 plaintext = alloc_buffer(len);
1873 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1874 outbuf = malloc(outbuf_cap);
1875
1876 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1877
1878 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1879 sizeof(*en)) == 0);
1880 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1881
1882 fd_set_blocking(sockets[0]);
1883 fd_set_blocking(sockets[1]);
1884
1885 outbuf_len = encrypt_tls_record(tc, en, 0x21 /* Alert */, seqno,
1886 plaintext, len, outbuf, outbuf_cap, 0);
1887
1888 hdr = (void *)outbuf;
1889 hdr->tls_type = TLS_RLTYPE_APP + 1;
1890
1891 rv = write(sockets[1], outbuf, outbuf_len);
1892 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1893
1894 ktls_receive_tls_error(sockets[0], EINVAL);
1895
1896 free(outbuf);
1897 free(plaintext);
1898
1899 close_sockets_ignore_errors(sockets);
1900 }
1901
1902 static void
test_ktls_receive_bad_size(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1903 test_ktls_receive_bad_size(const atf_tc_t *tc, struct tls_enable *en,
1904 uint64_t seqno, size_t len)
1905 {
1906 struct tls_record_layer *hdr;
1907 char *outbuf;
1908 size_t outbuf_len;
1909 ssize_t rv;
1910 int sockets[2];
1911
1912 outbuf_len = sizeof(*hdr) + len;
1913 outbuf = calloc(1, outbuf_len);
1914
1915 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1916
1917 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1918 sizeof(*en)) == 0);
1919 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1920
1921 fd_set_blocking(sockets[0]);
1922 fd_set_blocking(sockets[1]);
1923
1924 hdr = (void *)outbuf;
1925 hdr->tls_vmajor = en->tls_vmajor;
1926 if (en->tls_vminor == TLS_MINOR_VER_THREE)
1927 hdr->tls_vminor = TLS_MINOR_VER_TWO;
1928 else
1929 hdr->tls_vminor = en->tls_vminor;
1930 hdr->tls_type = TLS_RLTYPE_APP;
1931 hdr->tls_length = htons(len);
1932
1933 rv = write(sockets[1], outbuf, outbuf_len);
1934 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1935
1936 /*
1937 * The other end may notice the error and drop the connection
1938 * before this executes resulting in shutdown() failing with
1939 * either ENOTCONN or ECONNRESET. Ignore this error if it
1940 * occurs.
1941 */
1942 if (shutdown(sockets[1], SHUT_WR) != 0) {
1943 ATF_REQUIRE_MSG(errno == ENOTCONN || errno == ECONNRESET,
1944 "shutdown() failed: %s", strerror(errno));
1945 }
1946
1947 ktls_receive_tls_error(sockets[0], EMSGSIZE);
1948
1949 free(outbuf);
1950
1951 close_sockets_ignore_errors(sockets);
1952 }
1953
1954 static void
test_ktls_receive_split_record(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len,size_t first_len)1955 test_ktls_receive_split_record(const atf_tc_t *tc, struct tls_enable *en,
1956 uint64_t seqno, size_t len, size_t first_len)
1957 {
1958 char *plaintext, *received, *outbuf;
1959 size_t outbuf_cap, outbuf_len;
1960 ssize_t rv;
1961 int sockets[2];
1962
1963 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1964
1965 plaintext = alloc_buffer(len);
1966 received = malloc(len);
1967 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1968 outbuf = malloc(outbuf_cap);
1969
1970 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1971
1972 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1973 sizeof(*en)) == 0);
1974 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1975
1976 fd_set_blocking(sockets[0]);
1977 fd_set_blocking(sockets[1]);
1978
1979 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1980 plaintext, len, outbuf, outbuf_cap, 0);
1981 ATF_REQUIRE(first_len < outbuf_len);
1982
1983 tcp_nodelay(sockets[1]);
1984 rv = write(sockets[1], outbuf, first_len);
1985 ATF_REQUIRE_INTEQ((ssize_t)(first_len), rv);
1986
1987 rv = write(sockets[1], outbuf + first_len, outbuf_len - first_len);
1988 ATF_REQUIRE_INTEQ((ssize_t)(outbuf_len - first_len), rv);
1989
1990 rv = ktls_receive_tls_record(en, sockets[0], TLS_RLTYPE_APP, received,
1991 len);
1992 ATF_REQUIRE_INTEQ((ssize_t)len, rv);
1993
1994 ATF_REQUIRE(memcmp(plaintext, received, len) == 0);
1995
1996 free(outbuf);
1997 free(received);
1998 free(plaintext);
1999
2000 close_sockets(sockets);
2001 }
2002
2003 #define TLS_10_TESTS(M) \
2004 M(aes128_cbc_1_0_sha1, CRYPTO_AES_CBC, 128 / 8, \
2005 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO) \
2006 M(aes256_cbc_1_0_sha1, CRYPTO_AES_CBC, 256 / 8, \
2007 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO)
2008
2009 #define TLS_13_TESTS(M) \
2010 M(aes128_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \
2011 TLS_MINOR_VER_THREE) \
2012 M(aes256_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0, \
2013 TLS_MINOR_VER_THREE) \
2014 M(chacha20_poly1305_1_3, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \
2015 TLS_MINOR_VER_THREE)
2016
2017 #define AES_CBC_NONZERO_TESTS(M) \
2018 M(aes128_cbc_1_1_sha1, CRYPTO_AES_CBC, 128 / 8, \
2019 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ONE) \
2020 M(aes256_cbc_1_1_sha1, CRYPTO_AES_CBC, 256 / 8, \
2021 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ONE) \
2022 M(aes128_cbc_1_2_sha1, CRYPTO_AES_CBC, 128 / 8, \
2023 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_TWO) \
2024 M(aes256_cbc_1_2_sha1, CRYPTO_AES_CBC, 256 / 8, \
2025 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_TWO) \
2026 M(aes128_cbc_1_2_sha256, CRYPTO_AES_CBC, 128 / 8, \
2027 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_TWO) \
2028 M(aes256_cbc_1_2_sha256, CRYPTO_AES_CBC, 256 / 8, \
2029 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_TWO) \
2030 M(aes128_cbc_1_2_sha384, CRYPTO_AES_CBC, 128 / 8, \
2031 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_TWO) \
2032 M(aes256_cbc_1_2_sha384, CRYPTO_AES_CBC, 256 / 8, \
2033 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_TWO) \
2034
2035 #define AES_CBC_TESTS(M) \
2036 TLS_10_TESTS(M) \
2037 AES_CBC_NONZERO_TESTS(M)
2038
2039 #define AES_GCM_12_TESTS(M) \
2040 M(aes128_gcm_1_2, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \
2041 TLS_MINOR_VER_TWO) \
2042 M(aes256_gcm_1_2, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0, \
2043 TLS_MINOR_VER_TWO)
2044
2045 #define AES_GCM_TESTS(M) \
2046 AES_GCM_12_TESTS(M) \
2047 M(aes128_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \
2048 TLS_MINOR_VER_THREE) \
2049 M(aes256_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0, \
2050 TLS_MINOR_VER_THREE)
2051
2052 #define CHACHA20_TESTS(M) \
2053 M(chacha20_poly1305_1_2, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \
2054 TLS_MINOR_VER_TWO) \
2055 M(chacha20_poly1305_1_3, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \
2056 TLS_MINOR_VER_THREE)
2057
2058 #define GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2059 auth_alg, minor, name, len) \
2060 ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_##name); \
2061 ATF_TC_BODY(ktls_transmit_##cipher_name##_##name, tc) \
2062 { \
2063 struct tls_enable en; \
2064 uint64_t seqno; \
2065 \
2066 ATF_REQUIRE_KTLS(); \
2067 seqno = random(); \
2068 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2069 seqno, &en); \
2070 test_ktls_transmit_app_data(tc, &en, seqno, len); \
2071 free_tls_enable(&en); \
2072 }
2073
2074 #define ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2075 auth_alg, minor, name) \
2076 ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_##name);
2077
2078 #define GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2079 auth_alg, minor, name, type, len) \
2080 ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_##name); \
2081 ATF_TC_BODY(ktls_transmit_##cipher_name##_##name, tc) \
2082 { \
2083 struct tls_enable en; \
2084 uint64_t seqno; \
2085 \
2086 ATF_REQUIRE_KTLS(); \
2087 seqno = random(); \
2088 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2089 seqno, &en); \
2090 test_ktls_transmit_control(tc, &en, seqno, type, len); \
2091 free_tls_enable(&en); \
2092 }
2093
2094 #define ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2095 auth_alg, minor, name) \
2096 ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_##name);
2097
2098 #define GEN_TRANSMIT_EMPTY_FRAGMENT_TEST(cipher_name, cipher_alg, \
2099 key_size, auth_alg, minor) \
2100 ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_empty_fragment); \
2101 ATF_TC_BODY(ktls_transmit_##cipher_name##_empty_fragment, tc) \
2102 { \
2103 struct tls_enable en; \
2104 uint64_t seqno; \
2105 \
2106 ATF_REQUIRE_KTLS(); \
2107 seqno = random(); \
2108 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2109 seqno, &en); \
2110 test_ktls_transmit_empty_fragment(tc, &en, seqno); \
2111 free_tls_enable(&en); \
2112 }
2113
2114 #define ADD_TRANSMIT_EMPTY_FRAGMENT_TEST(cipher_name, cipher_alg, \
2115 key_size, auth_alg, minor) \
2116 ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_empty_fragment);
2117
2118 #define GEN_TRANSMIT_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \
2119 minor) \
2120 GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2121 auth_alg, minor, short, 64) \
2122 GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2123 auth_alg, minor, long, 64 * 1024) \
2124 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2125 auth_alg, minor, control, 0x21 /* Alert */, 32)
2126
2127 #define ADD_TRANSMIT_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \
2128 minor) \
2129 ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2130 auth_alg, minor, short) \
2131 ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2132 auth_alg, minor, long) \
2133 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2134 auth_alg, minor, control)
2135
2136 /*
2137 * For each supported cipher suite, run three transmit tests:
2138 *
2139 * - a short test which sends 64 bytes of application data (likely as
2140 * a single TLS record)
2141 *
2142 * - a long test which sends 64KB of application data (split across
2143 * multiple TLS records)
2144 *
2145 * - a control test which sends a single record with a specific
2146 * content type via sendmsg()
2147 */
2148 AES_CBC_TESTS(GEN_TRANSMIT_TESTS);
2149 AES_GCM_TESTS(GEN_TRANSMIT_TESTS);
2150 CHACHA20_TESTS(GEN_TRANSMIT_TESTS);
2151
2152 #define GEN_TRANSMIT_PADDING_TESTS(cipher_name, cipher_alg, key_size, \
2153 auth_alg, minor) \
2154 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2155 auth_alg, minor, padding_1, 0x21 /* Alert */, 1) \
2156 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2157 auth_alg, minor, padding_2, 0x21 /* Alert */, 2) \
2158 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2159 auth_alg, minor, padding_3, 0x21 /* Alert */, 3) \
2160 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2161 auth_alg, minor, padding_4, 0x21 /* Alert */, 4) \
2162 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2163 auth_alg, minor, padding_5, 0x21 /* Alert */, 5) \
2164 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2165 auth_alg, minor, padding_6, 0x21 /* Alert */, 6) \
2166 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2167 auth_alg, minor, padding_7, 0x21 /* Alert */, 7) \
2168 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2169 auth_alg, minor, padding_8, 0x21 /* Alert */, 8) \
2170 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2171 auth_alg, minor, padding_9, 0x21 /* Alert */, 9) \
2172 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2173 auth_alg, minor, padding_10, 0x21 /* Alert */, 10) \
2174 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2175 auth_alg, minor, padding_11, 0x21 /* Alert */, 11) \
2176 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2177 auth_alg, minor, padding_12, 0x21 /* Alert */, 12) \
2178 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2179 auth_alg, minor, padding_13, 0x21 /* Alert */, 13) \
2180 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2181 auth_alg, minor, padding_14, 0x21 /* Alert */, 14) \
2182 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2183 auth_alg, minor, padding_15, 0x21 /* Alert */, 15) \
2184 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2185 auth_alg, minor, padding_16, 0x21 /* Alert */, 16)
2186
2187 #define ADD_TRANSMIT_PADDING_TESTS(cipher_name, cipher_alg, key_size, \
2188 auth_alg, minor) \
2189 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2190 auth_alg, minor, padding_1) \
2191 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2192 auth_alg, minor, padding_2) \
2193 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2194 auth_alg, minor, padding_3) \
2195 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2196 auth_alg, minor, padding_4) \
2197 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2198 auth_alg, minor, padding_5) \
2199 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2200 auth_alg, minor, padding_6) \
2201 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2202 auth_alg, minor, padding_7) \
2203 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2204 auth_alg, minor, padding_8) \
2205 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2206 auth_alg, minor, padding_9) \
2207 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2208 auth_alg, minor, padding_10) \
2209 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2210 auth_alg, minor, padding_11) \
2211 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2212 auth_alg, minor, padding_12) \
2213 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2214 auth_alg, minor, padding_13) \
2215 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2216 auth_alg, minor, padding_14) \
2217 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2218 auth_alg, minor, padding_15) \
2219 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2220 auth_alg, minor, padding_16)
2221
2222 /*
2223 * For AES-CBC MTE cipher suites using padding, add tests of messages
2224 * with each possible padding size. Note that the padding_<N> tests
2225 * do not necessarily test <N> bytes of padding as the padding is a
2226 * function of the cipher suite's MAC length. However, cycling
2227 * through all of the payload sizes from 1 to 16 should exercise all
2228 * of the possible padding lengths for each suite.
2229 */
2230 AES_CBC_TESTS(GEN_TRANSMIT_PADDING_TESTS);
2231
2232 /*
2233 * Test "empty fragments" which are TLS records with no payload that
2234 * OpenSSL can send for TLS 1.0 connections.
2235 */
2236 AES_CBC_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST);
2237 AES_GCM_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST);
2238 CHACHA20_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST);
2239
2240 static void
test_ktls_invalid_transmit_cipher_suite(const atf_tc_t * tc,struct tls_enable * en)2241 test_ktls_invalid_transmit_cipher_suite(const atf_tc_t *tc,
2242 struct tls_enable *en)
2243 {
2244 int sockets[2];
2245
2246 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
2247
2248 ATF_REQUIRE_ERRNO(EINVAL, setsockopt(sockets[1], IPPROTO_TCP,
2249 TCP_TXTLS_ENABLE, en, sizeof(*en)) == -1);
2250
2251 close_sockets(sockets);
2252 }
2253
2254 #define GEN_INVALID_TRANSMIT_TEST(name, cipher_alg, key_size, auth_alg, \
2255 minor) \
2256 ATF_TC_WITHOUT_HEAD(ktls_transmit_invalid_##name); \
2257 ATF_TC_BODY(ktls_transmit_invalid_##name, tc) \
2258 { \
2259 struct tls_enable en; \
2260 uint64_t seqno; \
2261 \
2262 ATF_REQUIRE_KTLS(); \
2263 seqno = random(); \
2264 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2265 seqno, &en); \
2266 test_ktls_invalid_transmit_cipher_suite(tc, &en); \
2267 free_tls_enable(&en); \
2268 }
2269
2270 #define ADD_INVALID_TRANSMIT_TEST(name, cipher_alg, key_size, auth_alg, \
2271 minor) \
2272 ATF_TP_ADD_TC(tp, ktls_transmit_invalid_##name);
2273
2274 #define INVALID_CIPHER_SUITES(M) \
2275 M(aes128_cbc_1_0_sha256, CRYPTO_AES_CBC, 128 / 8, \
2276 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_ZERO) \
2277 M(aes128_cbc_1_0_sha384, CRYPTO_AES_CBC, 128 / 8, \
2278 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_ZERO) \
2279 M(aes128_gcm_1_0, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \
2280 TLS_MINOR_VER_ZERO) \
2281 M(chacha20_poly1305_1_0, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \
2282 TLS_MINOR_VER_ZERO) \
2283 M(aes128_cbc_1_1_sha256, CRYPTO_AES_CBC, 128 / 8, \
2284 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_ONE) \
2285 M(aes128_cbc_1_1_sha384, CRYPTO_AES_CBC, 128 / 8, \
2286 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_ONE) \
2287 M(aes128_gcm_1_1, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \
2288 TLS_MINOR_VER_ONE) \
2289 M(chacha20_poly1305_1_1, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \
2290 TLS_MINOR_VER_ONE) \
2291 M(aes128_cbc_1_3_sha1, CRYPTO_AES_CBC, 128 / 8, \
2292 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_THREE) \
2293 M(aes128_cbc_1_3_sha256, CRYPTO_AES_CBC, 128 / 8, \
2294 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_THREE) \
2295 M(aes128_cbc_1_3_sha384, CRYPTO_AES_CBC, 128 / 8, \
2296 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_THREE)
2297
2298 /*
2299 * Ensure that invalid cipher suites are rejected for transmit.
2300 */
2301 INVALID_CIPHER_SUITES(GEN_INVALID_TRANSMIT_TEST);
2302
2303 #define GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2304 auth_alg, minor, name, len, padding) \
2305 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_##name); \
2306 ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \
2307 { \
2308 struct tls_enable en; \
2309 uint64_t seqno; \
2310 \
2311 ATF_REQUIRE_KTLS_RX(); \
2312 seqno = random(); \
2313 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2314 seqno, &en); \
2315 test_ktls_receive_app_data(tc, &en, seqno, len, padding); \
2316 free_tls_enable(&en); \
2317 }
2318
2319 #define ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2320 auth_alg, minor, name) \
2321 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name);
2322
2323 #define GEN_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size, \
2324 auth_alg, minor, len) \
2325 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_data); \
2326 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_data, tc) \
2327 { \
2328 struct tls_enable en; \
2329 uint64_t seqno; \
2330 \
2331 ATF_REQUIRE_KTLS_RX(); \
2332 seqno = random(); \
2333 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2334 seqno, &en); \
2335 test_ktls_receive_corrupted_data(tc, &en, seqno, len); \
2336 free_tls_enable(&en); \
2337 }
2338
2339 #define ADD_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size, \
2340 auth_alg, minor) \
2341 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_data);
2342
2343 #define GEN_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size, \
2344 auth_alg, minor, len) \
2345 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_mac); \
2346 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_mac, tc) \
2347 { \
2348 struct tls_enable en; \
2349 uint64_t seqno; \
2350 \
2351 ATF_REQUIRE_KTLS_RX(); \
2352 seqno = random(); \
2353 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2354 seqno, &en); \
2355 test_ktls_receive_corrupted_mac(tc, &en, seqno, len); \
2356 free_tls_enable(&en); \
2357 }
2358
2359 #define ADD_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size, \
2360 auth_alg, minor) \
2361 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_mac);
2362
2363 #define GEN_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size, \
2364 auth_alg, minor, len) \
2365 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_truncated_record); \
2366 ATF_TC_BODY(ktls_receive_##cipher_name##_truncated_record, tc) \
2367 { \
2368 struct tls_enable en; \
2369 uint64_t seqno; \
2370 \
2371 ATF_REQUIRE_KTLS_RX(); \
2372 seqno = random(); \
2373 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2374 seqno, &en); \
2375 test_ktls_receive_truncated_record(tc, &en, seqno, len); \
2376 free_tls_enable(&en); \
2377 }
2378
2379 #define ADD_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size, \
2380 auth_alg, minor) \
2381 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_truncated_record);
2382
2383 #define GEN_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size, \
2384 auth_alg, minor, len) \
2385 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_major); \
2386 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_major, tc) \
2387 { \
2388 struct tls_enable en; \
2389 uint64_t seqno; \
2390 \
2391 ATF_REQUIRE_KTLS_RX(); \
2392 seqno = random(); \
2393 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2394 seqno, &en); \
2395 test_ktls_receive_bad_major(tc, &en, seqno, len); \
2396 free_tls_enable(&en); \
2397 }
2398
2399 #define ADD_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size, \
2400 auth_alg, minor) \
2401 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_major);
2402
2403 #define GEN_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size, \
2404 auth_alg, minor, len) \
2405 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_minor); \
2406 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_minor, tc) \
2407 { \
2408 struct tls_enable en; \
2409 uint64_t seqno; \
2410 \
2411 ATF_REQUIRE_KTLS_RX(); \
2412 seqno = random(); \
2413 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2414 seqno, &en); \
2415 test_ktls_receive_bad_minor(tc, &en, seqno, len); \
2416 free_tls_enable(&en); \
2417 }
2418
2419 #define ADD_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size, \
2420 auth_alg, minor) \
2421 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_minor);
2422
2423 #define GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2424 auth_alg, minor, name, len) \
2425 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_##name); \
2426 ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \
2427 { \
2428 struct tls_enable en; \
2429 uint64_t seqno; \
2430 \
2431 ATF_REQUIRE_KTLS_RX(); \
2432 seqno = random(); \
2433 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2434 seqno, &en); \
2435 test_ktls_receive_bad_size(tc, &en, seqno, (len)); \
2436 free_tls_enable(&en); \
2437 }
2438
2439 #define ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2440 auth_alg, minor, name) \
2441 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name);
2442
2443 #define GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \
2444 key_size, auth_alg, minor, name, len, first_len) \
2445 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_split_##name); \
2446 ATF_TC_BODY(ktls_receive_##cipher_name##_split_##name, tc) \
2447 { \
2448 struct tls_enable en; \
2449 uint64_t seqno; \
2450 \
2451 ATF_REQUIRE_KTLS_RX(); \
2452 seqno = random(); \
2453 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2454 seqno, &en); \
2455 test_ktls_receive_split_record(tc, &en, seqno, len, first_len); \
2456 free_tls_enable(&en); \
2457 }
2458
2459 #define ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \
2460 key_size, auth_alg, minor, name) \
2461 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_split_##name);
2462
2463 #define GEN_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \
2464 minor) \
2465 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2466 auth_alg, minor, short, 64, 0) \
2467 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2468 auth_alg, minor, long, 64 * 1024, 0) \
2469 GEN_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size, \
2470 auth_alg, minor, 64) \
2471 GEN_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size, \
2472 auth_alg, minor, 64) \
2473 GEN_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size, \
2474 auth_alg, minor, 64) \
2475 GEN_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size, \
2476 auth_alg, minor, 64) \
2477 GEN_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size, \
2478 auth_alg, minor, 64) \
2479 GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2480 auth_alg, minor, small_record, \
2481 tls_minimum_record_payload(&en) - 1) \
2482 GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2483 auth_alg, minor, oversized_record, \
2484 TLS_MAX_MSG_SIZE_V10_2 * 2) \
2485 GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \
2486 key_size, auth_alg, minor, header, 64, \
2487 sizeof(struct tls_record_layer)); \
2488 GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \
2489 key_size, auth_alg, minor, full_header, 64, \
2490 tls_header_len(&en)); \
2491 GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \
2492 key_size, auth_alg, minor, half, 64, \
2493 tls_header_len(&en) + 32); \
2494 GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \
2495 key_size, auth_alg, minor, trailer_start, 64, \
2496 tls_header_len(&en) + 64); \
2497 GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \
2498 key_size, auth_alg, minor, trailer_middle, 64, \
2499 tls_header_len(&en) + 64 + tls_trailer_len(&en) / 2);
2500
2501 #define ADD_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \
2502 minor) \
2503 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2504 auth_alg, minor, short) \
2505 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2506 auth_alg, minor, long) \
2507 ADD_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size, \
2508 auth_alg, minor) \
2509 ADD_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size, \
2510 auth_alg, minor) \
2511 ADD_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size, \
2512 auth_alg, minor) \
2513 ADD_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size, \
2514 auth_alg, minor) \
2515 ADD_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size, \
2516 auth_alg, minor) \
2517 ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2518 auth_alg, minor, small_record) \
2519 ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2520 auth_alg, minor, oversized_record) \
2521 ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \
2522 key_size, auth_alg, minor, header) \
2523 ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \
2524 key_size, auth_alg, minor, full_header) \
2525 ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \
2526 key_size, auth_alg, minor, half) \
2527 ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \
2528 key_size, auth_alg, minor, trailer_start) \
2529 ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \
2530 key_size, auth_alg, minor, trailer_middle) \
2531
2532 /*
2533 * For each supported cipher suite, run several receive tests:
2534 *
2535 * - a short test which sends 64 bytes of application data (likely as
2536 * a single TLS record)
2537 *
2538 * - a long test which sends 64KB of application data (split across
2539 * multiple TLS records)
2540 *
2541 * - a test with corrupted payload data in a single TLS record
2542 *
2543 * - a test with a corrupted MAC in a single TLS record
2544 *
2545 * - a test with a truncated TLS record
2546 *
2547 * - tests with invalid TLS major and minor versions
2548 *
2549 * - a tests with a record whose is one less than the smallest valid
2550 * size
2551 *
2552 * - a test with an oversized TLS record
2553 *
2554 * - tests of a single record whose data is split across two writes,
2555 * with each test using a different split point
2556 */
2557 AES_CBC_NONZERO_TESTS(GEN_RECEIVE_TESTS);
2558 AES_GCM_TESTS(GEN_RECEIVE_TESTS);
2559 CHACHA20_TESTS(GEN_RECEIVE_TESTS);
2560
2561 #define GEN_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg, \
2562 key_size, auth_alg, minor) \
2563 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2564 auth_alg, minor, padding_1, 1, 0) \
2565 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2566 auth_alg, minor, padding_2, 2, 0) \
2567 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2568 auth_alg, minor, padding_3, 3, 0) \
2569 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2570 auth_alg, minor, padding_4, 4, 0) \
2571 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2572 auth_alg, minor, padding_5, 5, 0) \
2573 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2574 auth_alg, minor, padding_6, 6, 0) \
2575 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2576 auth_alg, minor, padding_7, 7, 0) \
2577 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2578 auth_alg, minor, padding_8, 8, 0) \
2579 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2580 auth_alg, minor, padding_9, 9, 0) \
2581 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2582 auth_alg, minor, padding_10, 10, 0) \
2583 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2584 auth_alg, minor, padding_11, 11, 0) \
2585 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2586 auth_alg, minor, padding_12, 12, 0) \
2587 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2588 auth_alg, minor, padding_13, 13, 0) \
2589 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2590 auth_alg, minor, padding_14, 14, 0) \
2591 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2592 auth_alg, minor, padding_15, 15, 0) \
2593 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2594 auth_alg, minor, padding_16, 16, 0) \
2595 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2596 auth_alg, minor, padding_16_extra, 16, 16) \
2597 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2598 auth_alg, minor, padding_32_extra, 16, 32)
2599
2600 #define ADD_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg, \
2601 key_size, auth_alg, minor) \
2602 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2603 auth_alg, minor, padding_1) \
2604 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2605 auth_alg, minor, padding_2) \
2606 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2607 auth_alg, minor, padding_3) \
2608 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2609 auth_alg, minor, padding_4) \
2610 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2611 auth_alg, minor, padding_5) \
2612 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2613 auth_alg, minor, padding_6) \
2614 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2615 auth_alg, minor, padding_7) \
2616 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2617 auth_alg, minor, padding_8) \
2618 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2619 auth_alg, minor, padding_9) \
2620 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2621 auth_alg, minor, padding_10) \
2622 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2623 auth_alg, minor, padding_11) \
2624 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2625 auth_alg, minor, padding_12) \
2626 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2627 auth_alg, minor, padding_13) \
2628 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2629 auth_alg, minor, padding_14) \
2630 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2631 auth_alg, minor, padding_15) \
2632 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2633 auth_alg, minor, padding_16) \
2634 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2635 auth_alg, minor, padding_16_extra) \
2636 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2637 auth_alg, minor, padding_32_extra)
2638
2639 #define GEN_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size, \
2640 auth_alg, minor, len) \
2641 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_padding); \
2642 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_padding, tc) \
2643 { \
2644 struct tls_enable en; \
2645 uint64_t seqno; \
2646 \
2647 ATF_REQUIRE_KTLS_RX(); \
2648 seqno = random(); \
2649 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2650 seqno, &en); \
2651 test_ktls_receive_corrupted_padding(tc, &en, seqno, len); \
2652 free_tls_enable(&en); \
2653 }
2654
2655 #define ADD_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size, \
2656 auth_alg, minor) \
2657 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_padding);
2658
2659 #define GEN_RECEIVE_MTE_TESTS(cipher_name, cipher_alg, key_size, \
2660 auth_alg, minor) \
2661 GEN_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg, \
2662 key_size, auth_alg, minor) \
2663 GEN_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size, \
2664 auth_alg, minor, 64) \
2665 GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2666 auth_alg, minor, non_block_size, \
2667 tls_minimum_record_payload(&en) + 1)
2668
2669 #define ADD_RECEIVE_MTE_TESTS(cipher_name, cipher_alg, key_size, \
2670 auth_alg, minor) \
2671 ADD_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg, \
2672 key_size, auth_alg, minor) \
2673 ADD_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size, \
2674 auth_alg, minor) \
2675 ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2676 auth_alg, minor, non_block_size)
2677
2678 /*
2679 * For AES-CBC MTE cipher suites using padding, add tests of messages
2680 * with each possible padding size. Note that the padding_<N> tests
2681 * do not necessarily test <N> bytes of padding as the padding is a
2682 * function of the cipher suite's MAC length. However, cycling
2683 * through all of the payload sizes from 1 to 16 should exercise all
2684 * of the possible padding lengths for each suite.
2685 *
2686 * Two additional tests check for additional padding with an extra
2687 * 16 or 32 bytes beyond the normal padding.
2688 *
2689 * Another test checks for corrupted padding.
2690 *
2691 * Another test checks for a record whose payload is not a multiple of
2692 * the AES block size.
2693 */
2694 AES_CBC_NONZERO_TESTS(GEN_RECEIVE_MTE_TESTS);
2695
2696 #define GEN_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size, \
2697 auth_alg, minor) \
2698 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_iv); \
2699 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_iv, tc) \
2700 { \
2701 struct tls_enable en; \
2702 uint64_t seqno; \
2703 \
2704 ATF_REQUIRE_KTLS_RX(); \
2705 seqno = random(); \
2706 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2707 seqno, &en); \
2708 test_ktls_receive_corrupted_iv(tc, &en, seqno, 64); \
2709 free_tls_enable(&en); \
2710 }
2711
2712 #define ADD_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size, \
2713 auth_alg, minor) \
2714 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_iv);
2715
2716 #define GEN_RECEIVE_EXPLICIT_IV_TESTS(cipher_name, cipher_alg, \
2717 key_size, auth_alg, minor) \
2718 GEN_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size, \
2719 auth_alg, minor) \
2720 GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2721 auth_alg, minor, short_header, \
2722 sizeof(struct tls_record_layer) + 1)
2723
2724 #define ADD_RECEIVE_EXPLICIT_IV_TESTS(cipher_name, cipher_alg, \
2725 key_size, auth_alg, minor) \
2726 ADD_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size, \
2727 auth_alg, minor) \
2728 ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2729 auth_alg, minor, short_header)
2730
2731 /*
2732 * For cipher suites with an explicit IV, run a receive test where the
2733 * explicit IV has been corrupted. Also run a receive test that sends
2734 * a short record without a complete IV.
2735 */
2736 AES_CBC_NONZERO_TESTS(GEN_RECEIVE_EXPLICIT_IV_TESTS);
2737 AES_GCM_12_TESTS(GEN_RECEIVE_EXPLICIT_IV_TESTS);
2738
2739 #define GEN_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size, \
2740 auth_alg, minor, len) \
2741 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_type); \
2742 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_type, tc) \
2743 { \
2744 struct tls_enable en; \
2745 uint64_t seqno; \
2746 \
2747 ATF_REQUIRE_KTLS_RX(); \
2748 seqno = random(); \
2749 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2750 seqno, &en); \
2751 test_ktls_receive_bad_type(tc, &en, seqno, len); \
2752 free_tls_enable(&en); \
2753 }
2754
2755 #define ADD_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size, \
2756 auth_alg, minor) \
2757 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_type);
2758
2759 #define GEN_RECEIVE_TLS13_TESTS(cipher_name, cipher_alg, key_size, \
2760 auth_alg, minor) \
2761 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2762 auth_alg, minor, short_padded, 64, 16) \
2763 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2764 auth_alg, minor, long_padded, 64 * 1024, 15) \
2765 GEN_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size, \
2766 auth_alg, minor, 64)
2767
2768 #define ADD_RECEIVE_TLS13_TESTS(cipher_name, cipher_alg, key_size, \
2769 auth_alg, minor) \
2770 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2771 auth_alg, minor, short_padded) \
2772 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2773 auth_alg, minor, long_padded) \
2774 ADD_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size, \
2775 auth_alg, minor)
2776
2777 /*
2778 * For TLS 1.3 cipher suites, run two additional receive tests which
2779 * use add padding to each record. Also run a test that uses an
2780 * invalid "outer" record type.
2781 */
2782 TLS_13_TESTS(GEN_RECEIVE_TLS13_TESTS);
2783
2784 static void
test_ktls_invalid_receive_cipher_suite(const atf_tc_t * tc,struct tls_enable * en)2785 test_ktls_invalid_receive_cipher_suite(const atf_tc_t *tc,
2786 struct tls_enable *en)
2787 {
2788 int sockets[2];
2789
2790 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
2791
2792 ATF_REQUIRE_ERRNO(EINVAL, setsockopt(sockets[1], IPPROTO_TCP,
2793 TCP_RXTLS_ENABLE, en, sizeof(*en)) == -1);
2794
2795 close_sockets(sockets);
2796 }
2797
2798 #define GEN_INVALID_RECEIVE_TEST(name, cipher_alg, key_size, auth_alg, \
2799 minor) \
2800 ATF_TC_WITHOUT_HEAD(ktls_receive_invalid_##name); \
2801 ATF_TC_BODY(ktls_receive_invalid_##name, tc) \
2802 { \
2803 struct tls_enable en; \
2804 uint64_t seqno; \
2805 \
2806 ATF_REQUIRE_KTLS_RX(); \
2807 seqno = random(); \
2808 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2809 seqno, &en); \
2810 test_ktls_invalid_receive_cipher_suite(tc, &en); \
2811 free_tls_enable(&en); \
2812 }
2813
2814 #define ADD_INVALID_RECEIVE_TEST(name, cipher_alg, key_size, auth_alg, \
2815 minor) \
2816 ATF_TP_ADD_TC(tp, ktls_receive_invalid_##name);
2817
2818 /*
2819 * Ensure that invalid cipher suites are rejected for receive.
2820 */
2821 INVALID_CIPHER_SUITES(GEN_INVALID_RECEIVE_TEST);
2822
2823 static void
test_ktls_unsupported_receive_cipher_suite(const atf_tc_t * tc,struct tls_enable * en)2824 test_ktls_unsupported_receive_cipher_suite(const atf_tc_t *tc,
2825 struct tls_enable *en)
2826 {
2827 int sockets[2];
2828
2829 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
2830
2831 ATF_REQUIRE_ERRNO(EPROTONOSUPPORT, setsockopt(sockets[1], IPPROTO_TCP,
2832 TCP_RXTLS_ENABLE, en, sizeof(*en)) == -1);
2833
2834 close_sockets(sockets);
2835 }
2836
2837 #define GEN_UNSUPPORTED_RECEIVE_TEST(name, cipher_alg, key_size, \
2838 auth_alg, minor) \
2839 ATF_TC_WITHOUT_HEAD(ktls_receive_unsupported_##name); \
2840 ATF_TC_BODY(ktls_receive_unsupported_##name, tc) \
2841 { \
2842 struct tls_enable en; \
2843 uint64_t seqno; \
2844 \
2845 ATF_REQUIRE_KTLS_RX(); \
2846 seqno = random(); \
2847 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2848 seqno, &en); \
2849 test_ktls_unsupported_receive_cipher_suite(tc, &en); \
2850 free_tls_enable(&en); \
2851 }
2852
2853 #define ADD_UNSUPPORTED_RECEIVE_TEST(name, cipher_alg, key_size, \
2854 auth_alg, minor) \
2855 ATF_TP_ADD_TC(tp, ktls_receive_unsupported_##name);
2856
2857 /*
2858 * Ensure that valid cipher suites not supported for receive are
2859 * rejected.
2860 */
2861 TLS_10_TESTS(GEN_UNSUPPORTED_RECEIVE_TEST);
2862
2863 /*
2864 * Try to perform an invalid sendto(2) on a TXTLS-enabled socket, to exercise
2865 * KTLS error handling in the socket layer.
2866 */
2867 ATF_TC_WITHOUT_HEAD(ktls_sendto_baddst);
ATF_TC_BODY(ktls_sendto_baddst,tc)2868 ATF_TC_BODY(ktls_sendto_baddst, tc)
2869 {
2870 char buf[32];
2871 struct sockaddr_in dst;
2872 struct tls_enable en;
2873 ssize_t n;
2874 int s;
2875
2876 ATF_REQUIRE_KTLS();
2877
2878 s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
2879 ATF_REQUIRE(s >= 0);
2880
2881 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
2882 TLS_MINOR_VER_THREE, (uint64_t)random(), &en);
2883
2884 ATF_REQUIRE(setsockopt(s, IPPROTO_TCP, TCP_TXTLS_ENABLE, &en,
2885 sizeof(en)) == 0);
2886
2887 memset(&dst, 0, sizeof(dst));
2888 dst.sin_family = AF_INET;
2889 dst.sin_len = sizeof(dst);
2890 dst.sin_addr.s_addr = htonl(INADDR_BROADCAST);
2891 dst.sin_port = htons(12345);
2892
2893 memset(buf, 0, sizeof(buf));
2894 n = sendto(s, buf, sizeof(buf), 0, (struct sockaddr *)&dst,
2895 sizeof(dst));
2896
2897 /* Can't transmit to the broadcast address over TCP. */
2898 ATF_REQUIRE_ERRNO(EACCES, n == -1);
2899 ATF_REQUIRE(close(s) == 0);
2900 }
2901
2902 /*
2903 * Make sure that listen(2) returns an error for KTLS-enabled sockets, and
2904 * verify that an attempt to enable KTLS on a listening socket fails.
2905 */
2906 static void
ktls_listening_socket(const atf_tc_t * tc,int optname)2907 ktls_listening_socket(const atf_tc_t *tc, int optname)
2908 {
2909 struct tls_enable en;
2910 struct sockaddr_in sin;
2911 int s;
2912
2913 s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
2914 ATF_REQUIRE(s >= 0);
2915 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
2916 TLS_MINOR_VER_THREE, (uint64_t)random(), &en);
2917 ATF_REQUIRE(setsockopt(s, IPPROTO_TCP, optname, &en,
2918 sizeof(en)) == 0);
2919 ATF_REQUIRE_ERRNO(EINVAL, listen(s, 1) == -1);
2920 ATF_REQUIRE(close(s) == 0);
2921
2922 s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
2923 ATF_REQUIRE(s >= 0);
2924 memset(&sin, 0, sizeof(sin));
2925 sin.sin_family = AF_INET;
2926 sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
2927 ATF_REQUIRE(bind(s, (struct sockaddr *)&sin, sizeof(sin)) == 0);
2928 ATF_REQUIRE(listen(s, 1) == 0);
2929 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
2930 TLS_MINOR_VER_THREE, (uint64_t)random(), &en);
2931 ATF_REQUIRE_ERRNO(ENOTCONN,
2932 setsockopt(s, IPPROTO_TCP, optname, &en, sizeof(en)) != 0);
2933 ATF_REQUIRE(close(s) == 0);
2934 }
2935
2936 ATF_TC_WITHOUT_HEAD(ktls_listening_socket_tx);
ATF_TC_BODY(ktls_listening_socket_tx,tc)2937 ATF_TC_BODY(ktls_listening_socket_tx, tc)
2938 {
2939 ATF_REQUIRE_KTLS();
2940
2941 ktls_listening_socket(tc, TCP_TXTLS_ENABLE);
2942 }
2943
2944 ATF_TC_WITHOUT_HEAD(ktls_listening_socket_rx);
ATF_TC_BODY(ktls_listening_socket_rx,tc)2945 ATF_TC_BODY(ktls_listening_socket_rx, tc)
2946 {
2947 ATF_REQUIRE_KTLS_RX();
2948
2949 ktls_listening_socket(tc, TCP_RXTLS_ENABLE);
2950 }
2951
2952 /*
2953 * Verify that the KTLS receive path does not overwrite data belonging
2954 * to a file whose payload is transmitted over a loopback connection
2955 * via plain sendfile.
2956 */
2957 ATF_TC_WITHOUT_HEAD(ktls_receive_loopback_sendfile);
ATF_TC_BODY(ktls_receive_loopback_sendfile,tc)2958 ATF_TC_BODY(ktls_receive_loopback_sendfile, tc)
2959 {
2960 struct tls_enable en;
2961 struct msghdr msg;
2962 struct sf_hdtr hdtr;
2963 struct iovec iov[2];
2964 uint64_t seqno;
2965 off_t sbytes;
2966 char cbuf[CMSG_SPACE(sizeof(struct tls_get_record))];
2967 char *plaintext, *ciphertext, *outbuf;
2968 void *p;
2969 const size_t payload_len = PAGE_SIZE;
2970 ssize_t rv;
2971 size_t len;
2972 int mode, shm, sockets[2];
2973 socklen_t slen;
2974
2975 ATF_REQUIRE_KTLS_RX();
2976 seqno = random();
2977 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
2978 TLS_MINOR_VER_TWO, seqno, &en);
2979
2980 len = tls_header_len(&en) + payload_len + tls_trailer_len(&en);
2981 plaintext = alloc_buffer(payload_len);
2982 ciphertext = malloc(len);
2983 ATF_REQUIRE_INTEQ(len, encrypt_tls_record(tc, &en, TLS_RLTYPE_APP,
2984 seqno, plaintext, payload_len, ciphertext, len, 0));
2985
2986 ATF_REQUIRE((shm = shm_open(SHM_ANON, O_RDWR, 0600)) > 0);
2987 ATF_REQUIRE_INTEQ(0, ftruncate(shm, payload_len));
2988 ATF_REQUIRE((p = mmap(NULL, payload_len, PROT_READ | PROT_WRITE,
2989 MAP_SHARED, shm, 0)) != MAP_FAILED);
2990 memcpy(p, ciphertext + tls_header_len(&en), payload_len);
2991
2992 ATF_REQUIRE_MSG(socketpair_tcp(sockets), "failed to create sockets");
2993 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, &en,
2994 sizeof(en)) == 0);
2995 slen = sizeof(mode);
2996 ATF_REQUIRE_INTEQ(0, getsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_MODE,
2997 &mode, &slen));
2998 ATF_REQUIRE_INTEQ(TCP_TLS_MODE_SW, mode);
2999
3000 fd_set_blocking(sockets[0]);
3001 fd_set_blocking(sockets[1]);
3002
3003 iov[0].iov_base = ciphertext;
3004 iov[0].iov_len = tls_header_len(&en);
3005 iov[1].iov_base = ciphertext + tls_header_len(&en) + payload_len;
3006 iov[1].iov_len = tls_trailer_len(&en);
3007 hdtr.headers = iov;
3008 hdtr.hdr_cnt = 1;
3009 hdtr.trailers = iov + 1;
3010 hdtr.trl_cnt = 1;
3011 debug_hexdump(tc, p, payload_len, "shm buffer before");
3012 ATF_REQUIRE_INTEQ(0, sendfile(shm, sockets[1], 0, payload_len, &hdtr,
3013 &sbytes, 0));
3014 ATF_REQUIRE_INTEQ(sbytes, (off_t)len);
3015
3016 outbuf = calloc(payload_len, 1);
3017
3018 memset(&msg, 0, sizeof(msg));
3019
3020 msg.msg_control = cbuf;
3021 msg.msg_controllen = sizeof(cbuf);
3022
3023 iov[0].iov_base = outbuf;
3024 iov[0].iov_len = payload_len;
3025 msg.msg_iov = iov;
3026 msg.msg_iovlen = 1;
3027
3028 rv = recvmsg(sockets[0], &msg, 0);
3029 if (rv >= 0) {
3030 ATF_REQUIRE_INTEQ(payload_len, rv);
3031 ATF_REQUIRE_INTEQ(0, memcmp(outbuf, plaintext, payload_len));
3032 } else
3033 ATF_REQUIRE_ERRNO(EBADMSG, true);
3034
3035 debug_hexdump(tc, p, payload_len, "shm buffer after");
3036 ATF_REQUIRE_INTEQ(0, memcmp(p, ciphertext + tls_header_len(&en),
3037 payload_len));
3038
3039 close_sockets_ignore_errors(sockets);
3040 (void)close(shm);
3041 }
3042
ATF_TP_ADD_TCS(tp)3043 ATF_TP_ADD_TCS(tp)
3044 {
3045 /* Transmit tests */
3046 AES_CBC_TESTS(ADD_TRANSMIT_TESTS);
3047 AES_GCM_TESTS(ADD_TRANSMIT_TESTS);
3048 CHACHA20_TESTS(ADD_TRANSMIT_TESTS);
3049 AES_CBC_TESTS(ADD_TRANSMIT_PADDING_TESTS);
3050 AES_CBC_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST);
3051 AES_GCM_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST);
3052 CHACHA20_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST);
3053 INVALID_CIPHER_SUITES(ADD_INVALID_TRANSMIT_TEST);
3054
3055 /* Receive tests */
3056 TLS_10_TESTS(ADD_UNSUPPORTED_RECEIVE_TEST);
3057 AES_CBC_NONZERO_TESTS(ADD_RECEIVE_TESTS);
3058 AES_GCM_TESTS(ADD_RECEIVE_TESTS);
3059 CHACHA20_TESTS(ADD_RECEIVE_TESTS);
3060 AES_CBC_NONZERO_TESTS(ADD_RECEIVE_MTE_TESTS);
3061 AES_CBC_NONZERO_TESTS(ADD_RECEIVE_EXPLICIT_IV_TESTS);
3062 AES_GCM_12_TESTS(ADD_RECEIVE_EXPLICIT_IV_TESTS);
3063 TLS_13_TESTS(ADD_RECEIVE_TLS13_TESTS);
3064 INVALID_CIPHER_SUITES(ADD_INVALID_RECEIVE_TEST);
3065
3066 /* Miscellaneous */
3067 ATF_TP_ADD_TC(tp, ktls_sendto_baddst);
3068 ATF_TP_ADD_TC(tp, ktls_listening_socket_tx);
3069 ATF_TP_ADD_TC(tp, ktls_listening_socket_rx);
3070 ATF_TP_ADD_TC(tp, ktls_receive_loopback_sendfile);
3071
3072 return (atf_no_error());
3073 }
3074