xref: /freebsd/tests/sys/kern/ktls_test.c (revision 505103215ee2e3e31d233b952633e5697ac5da5f)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2021 Netflix Inc.
5  * Written by: John Baldwin <jhb@FreeBSD.org>
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include <sys/param.h>
30 #include <sys/endian.h>
31 #include <sys/event.h>
32 #include <sys/ktls.h>
33 #include <sys/mman.h>
34 #include <sys/socket.h>
35 #include <sys/sysctl.h>
36 #include <netinet/in.h>
37 #include <netinet/tcp.h>
38 #include <crypto/cryptodev.h>
39 #include <assert.h>
40 #include <err.h>
41 #include <fcntl.h>
42 #include <libutil.h>
43 #include <netdb.h>
44 #include <poll.h>
45 #include <stdbool.h>
46 #include <stdlib.h>
47 #include <atf-c.h>
48 
49 #include <openssl/err.h>
50 #include <openssl/evp.h>
51 #include <openssl/hmac.h>
52 
53 static void
require_ktls(void)54 require_ktls(void)
55 {
56 	size_t len;
57 	bool enable;
58 
59 	len = sizeof(enable);
60 	if (sysctlbyname("kern.ipc.tls.enable", &enable, &len, NULL, 0) == -1) {
61 		if (errno == ENOENT)
62 			atf_tc_skip("kernel does not support TLS offload");
63 		atf_libc_error(errno, "Failed to read kern.ipc.tls.enable");
64 	}
65 
66 	if (!enable)
67 		atf_tc_skip("Kernel TLS is disabled");
68 }
69 
70 #define	ATF_REQUIRE_KTLS()	require_ktls()
71 
72 static void
require_ktls_rx(void)73 require_ktls_rx(void)
74 {
75 	size_t len;
76 	bool enable;
77 
78 	ATF_REQUIRE_KTLS();
79 
80 	len = sizeof(enable);
81 	if (sysctlbyname("kern.ipc.tls.rx_enable", &enable, &len, NULL, 0) ==
82 	    -1) {
83 		if (errno == ENOENT)
84 			atf_tc_skip("kernel does not support TLS offload");
85 		atf_libc_error(errno, "Failed to read kern.ipc.tls.rx_enable");
86 	}
87 
88 	if (!enable)
89 		atf_tc_skip("Kernel TLS receive is disabled");
90 }
91 
92 #define	ATF_REQUIRE_KTLS_RX()	require_ktls_rx()
93 
94 static void
check_tls_mode(const atf_tc_t * tc,int s,int sockopt)95 check_tls_mode(const atf_tc_t *tc, int s, int sockopt)
96 {
97 	if (atf_tc_get_config_var_as_bool_wd(tc, "ktls.require_ifnet", false)) {
98 		socklen_t len;
99 		int mode;
100 
101 		len = sizeof(mode);
102 		if (getsockopt(s, IPPROTO_TCP, sockopt, &mode, &len) == -1)
103 			atf_libc_error(errno, "Failed to fetch TLS mode");
104 
105 		if (mode != TCP_TLS_MODE_IFNET)
106 			atf_tc_skip("connection did not use ifnet TLS");
107 	}
108 
109 	if (atf_tc_get_config_var_as_bool_wd(tc, "ktls.require_toe", false)) {
110 		socklen_t len;
111 		int mode;
112 
113 		len = sizeof(mode);
114 		if (getsockopt(s, IPPROTO_TCP, sockopt, &mode, &len) == -1)
115 			atf_libc_error(errno, "Failed to fetch TLS mode");
116 
117 		if (mode != TCP_TLS_MODE_TOE)
118 			atf_tc_skip("connection did not use TOE TLS");
119 	}
120 }
121 
122 static void __printflike(2, 3)
debug(const atf_tc_t * tc,const char * fmt,...)123 debug(const atf_tc_t *tc, const char *fmt, ...)
124 {
125 	if (!atf_tc_get_config_var_as_bool_wd(tc, "ktls.debug", false))
126 		return;
127 
128 	va_list ap;
129 	va_start(ap, fmt);
130 	vprintf(fmt, ap);
131 	va_end(ap);
132 }
133 
134 static void
debug_hexdump(const atf_tc_t * tc,const void * buf,int length,const char * label)135 debug_hexdump(const atf_tc_t *tc, const void *buf, int length,
136     const char *label)
137 {
138 	if (!atf_tc_get_config_var_as_bool_wd(tc, "ktls.debug", false))
139 		return;
140 
141 	if (label != NULL)
142 		printf("%s:\n", label);
143 	hexdump(buf, length, NULL, 0);
144 }
145 
146 static char
rdigit(void)147 rdigit(void)
148 {
149 	/* ASCII printable values between 0x20 and 0x7e */
150 	return (0x20 + random() % (0x7f - 0x20));
151 }
152 
153 static char *
alloc_buffer(size_t len)154 alloc_buffer(size_t len)
155 {
156 	char *buf;
157 	size_t i;
158 
159 	if (len == 0)
160 		return (NULL);
161 	buf = malloc(len);
162 	for (i = 0; i < len; i++)
163 		buf[i] = rdigit();
164 	return (buf);
165 }
166 
167 static bool
socketpair_tcp(int sv[2])168 socketpair_tcp(int sv[2])
169 {
170 	struct pollfd pfd;
171 	struct sockaddr_in sin;
172 	socklen_t len;
173 	int as, cs, ls;
174 
175 	ls = socket(PF_INET, SOCK_STREAM, 0);
176 	if (ls == -1) {
177 		warn("socket() for listen");
178 		return (false);
179 	}
180 
181 	memset(&sin, 0, sizeof(sin));
182 	sin.sin_len = sizeof(sin);
183 	sin.sin_family = AF_INET;
184 	sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
185 	if (bind(ls, (struct sockaddr *)&sin, sizeof(sin)) == -1) {
186 		warn("bind");
187 		close(ls);
188 		return (false);
189 	}
190 
191 	if (listen(ls, 1) == -1) {
192 		warn("listen");
193 		close(ls);
194 		return (false);
195 	}
196 
197 	len = sizeof(sin);
198 	if (getsockname(ls, (struct sockaddr *)&sin, &len) == -1) {
199 		warn("getsockname");
200 		close(ls);
201 		return (false);
202 	}
203 
204 	cs = socket(PF_INET, SOCK_STREAM | SOCK_NONBLOCK, 0);
205 	if (cs == -1) {
206 		warn("socket() for connect");
207 		close(ls);
208 		return (false);
209 	}
210 
211 	if (connect(cs, (struct sockaddr *)&sin, sizeof(sin)) == -1) {
212 		if (errno != EINPROGRESS) {
213 			warn("connect");
214 			close(ls);
215 			close(cs);
216 			return (false);
217 		}
218 	}
219 
220 	as = accept4(ls, NULL, NULL, SOCK_NONBLOCK);
221 	if (as == -1) {
222 		warn("accept4");
223 		close(ls);
224 		close(cs);
225 		return (false);
226 	}
227 
228 	close(ls);
229 
230 	pfd.fd = cs;
231 	pfd.events = POLLOUT;
232 	pfd.revents = 0;
233 	ATF_REQUIRE_INTEQ(1, poll(&pfd, 1, INFTIM));
234 	ATF_REQUIRE_INTEQ(POLLOUT, pfd.revents);
235 
236 	sv[0] = cs;
237 	sv[1] = as;
238 	return (true);
239 }
240 
241 static bool
echo_socket(const atf_tc_t * tc,int sv[2])242 echo_socket(const atf_tc_t *tc, int sv[2])
243 {
244 	const char *cause, *host, *port;
245 	struct addrinfo hints, *ai, *tofree;
246 	int error, flags, s;
247 
248 	host = atf_tc_get_config_var(tc, "ktls.host");
249 	port = atf_tc_get_config_var_wd(tc, "ktls.port", "echo");
250 	memset(&hints, 0, sizeof(hints));
251 	hints.ai_family = AF_UNSPEC;
252 	hints.ai_socktype = SOCK_STREAM;
253 	hints.ai_protocol = IPPROTO_TCP;
254 	error = getaddrinfo(host, port, &hints, &tofree);
255 	if (error != 0) {
256 		warnx("getaddrinfo(%s:%s) failed: %s", host, port,
257 		    gai_strerror(error));
258 		return (false);
259 	}
260 
261 	cause = NULL;
262 	for (ai = tofree; ai != NULL; ai = ai->ai_next) {
263 		s = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
264 		if (s == -1) {
265 			cause = "socket";
266 			error = errno;
267 			continue;
268 		}
269 
270 		if (connect(s, ai->ai_addr, ai->ai_addrlen) == -1) {
271 			cause = "connect";
272 			error = errno;
273 			close(s);
274 			continue;
275 		}
276 
277 		freeaddrinfo(tofree);
278 
279 		ATF_REQUIRE((flags = fcntl(s, F_GETFL)) != -1);
280 		flags |= O_NONBLOCK;
281 		ATF_REQUIRE(fcntl(s, F_SETFL, flags) != -1);
282 
283 		sv[0] = s;
284 		sv[1] = s;
285 		return (true);
286 	}
287 
288 	warnc(error, "%s", cause);
289 	freeaddrinfo(tofree);
290 	return (false);
291 }
292 
293 static bool
open_sockets(const atf_tc_t * tc,int sv[2])294 open_sockets(const atf_tc_t *tc, int sv[2])
295 {
296 	if (atf_tc_has_config_var(tc, "ktls.host"))
297 		return (echo_socket(tc, sv));
298 	else
299 		return (socketpair_tcp(sv));
300 }
301 
302 static void
close_sockets(int sv[2])303 close_sockets(int sv[2])
304 {
305 	if (sv[0] != sv[1])
306 		ATF_REQUIRE(close(sv[1]) == 0);
307 	ATF_REQUIRE(close(sv[0]) == 0);
308 }
309 
310 static void
close_sockets_ignore_errors(int sv[2])311 close_sockets_ignore_errors(int sv[2])
312 {
313 	if (sv[0] != sv[1])
314 		close(sv[1]);
315 	close(sv[0]);
316 }
317 
318 static void
fd_set_blocking(int fd)319 fd_set_blocking(int fd)
320 {
321 	int flags;
322 
323 	ATF_REQUIRE((flags = fcntl(fd, F_GETFL)) != -1);
324 	flags &= ~O_NONBLOCK;
325 	ATF_REQUIRE(fcntl(fd, F_SETFL, flags) != -1);
326 }
327 
328 static void
tcp_nodelay(int fd)329 tcp_nodelay(int fd)
330 {
331 	int nodelay = 1;
332 
333 	ATF_REQUIRE(setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &nodelay,
334 	    sizeof(nodelay)) == 0);
335 }
336 
337 static bool
cbc_crypt(const EVP_CIPHER * cipher,const char * key,const char * iv,const char * input,char * output,size_t size,int enc)338 cbc_crypt(const EVP_CIPHER *cipher, const char *key, const char *iv,
339     const char *input, char *output, size_t size, int enc)
340 {
341 	EVP_CIPHER_CTX *ctx;
342 	int outl, total;
343 
344 	ctx = EVP_CIPHER_CTX_new();
345 	if (ctx == NULL) {
346 		warnx("EVP_CIPHER_CTX_new failed: %s",
347 		    ERR_error_string(ERR_get_error(), NULL));
348 		return (false);
349 	}
350 	if (EVP_CipherInit_ex(ctx, cipher, NULL, (const u_char *)key,
351 	    (const u_char *)iv, enc) != 1) {
352 		warnx("EVP_CipherInit_ex failed: %s",
353 		    ERR_error_string(ERR_get_error(), NULL));
354 		EVP_CIPHER_CTX_free(ctx);
355 		return (false);
356 	}
357 	EVP_CIPHER_CTX_set_padding(ctx, 0);
358 	if (EVP_CipherUpdate(ctx, (u_char *)output, &outl,
359 	    (const u_char *)input, size) != 1) {
360 		warnx("EVP_CipherUpdate failed: %s",
361 		    ERR_error_string(ERR_get_error(), NULL));
362 		EVP_CIPHER_CTX_free(ctx);
363 		return (false);
364 	}
365 	total = outl;
366 	if (EVP_CipherFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) {
367 		warnx("EVP_CipherFinal_ex failed: %s",
368 		    ERR_error_string(ERR_get_error(), NULL));
369 		EVP_CIPHER_CTX_free(ctx);
370 		return (false);
371 	}
372 	total += outl;
373 	if ((size_t)total != size) {
374 		warnx("decrypt size mismatch: %zu vs %d", size, total);
375 		EVP_CIPHER_CTX_free(ctx);
376 		return (false);
377 	}
378 	EVP_CIPHER_CTX_free(ctx);
379 	return (true);
380 }
381 
382 static bool
cbc_encrypt(const EVP_CIPHER * cipher,const char * key,const char * iv,const char * input,char * output,size_t size)383 cbc_encrypt(const EVP_CIPHER *cipher, const char *key, const char *iv,
384     const char *input, char *output, size_t size)
385 {
386 	return (cbc_crypt(cipher, key, iv, input, output, size, 1));
387 }
388 
389 static bool
cbc_decrypt(const EVP_CIPHER * cipher,const char * key,const char * iv,const char * input,char * output,size_t size)390 cbc_decrypt(const EVP_CIPHER *cipher, const char *key, const char *iv,
391     const char *input, char *output, size_t size)
392 {
393 	return (cbc_crypt(cipher, key, iv, input, output, size, 0));
394 }
395 
396 static bool
compute_hash(const EVP_MD * md,const void * key,size_t key_len,const void * aad,size_t aad_len,const void * buffer,size_t len,void * digest,u_int * digest_len)397 compute_hash(const EVP_MD *md, const void *key, size_t key_len, const void *aad,
398     size_t aad_len, const void *buffer, size_t len, void *digest,
399     u_int *digest_len)
400 {
401 	HMAC_CTX *ctx;
402 
403 	ctx = HMAC_CTX_new();
404 	if (ctx == NULL) {
405 		warnx("HMAC_CTX_new failed: %s",
406 		    ERR_error_string(ERR_get_error(), NULL));
407 		return (false);
408 	}
409 	if (HMAC_Init_ex(ctx, key, key_len, md, NULL) != 1) {
410 		warnx("HMAC_Init_ex failed: %s",
411 		    ERR_error_string(ERR_get_error(), NULL));
412 		HMAC_CTX_free(ctx);
413 		return (false);
414 	}
415 	if (HMAC_Update(ctx, aad, aad_len) != 1) {
416 		warnx("HMAC_Update (aad) failed: %s",
417 		    ERR_error_string(ERR_get_error(), NULL));
418 		HMAC_CTX_free(ctx);
419 		return (false);
420 	}
421 	if (HMAC_Update(ctx, buffer, len) != 1) {
422 		warnx("HMAC_Update (payload) failed: %s",
423 		    ERR_error_string(ERR_get_error(), NULL));
424 		HMAC_CTX_free(ctx);
425 		return (false);
426 	}
427 	if (HMAC_Final(ctx, digest, digest_len) != 1) {
428 		warnx("HMAC_Final failed: %s",
429 		    ERR_error_string(ERR_get_error(), NULL));
430 		HMAC_CTX_free(ctx);
431 		return (false);
432 	}
433 	HMAC_CTX_free(ctx);
434 	return (true);
435 }
436 
437 static bool
verify_hash(const EVP_MD * md,const void * key,size_t key_len,const void * aad,size_t aad_len,const void * buffer,size_t len,const void * digest)438 verify_hash(const EVP_MD *md, const void *key, size_t key_len, const void *aad,
439     size_t aad_len, const void *buffer, size_t len, const void *digest)
440 {
441 	unsigned char digest2[EVP_MAX_MD_SIZE];
442 	u_int digest_len;
443 
444 	if (!compute_hash(md, key, key_len, aad, aad_len, buffer, len, digest2,
445 	    &digest_len))
446 		return (false);
447 	if (memcmp(digest, digest2, digest_len) != 0) {
448 		warnx("HMAC mismatch");
449 		return (false);
450 	}
451 	return (true);
452 }
453 
454 static bool
aead_encrypt(const EVP_CIPHER * cipher,const char * key,const char * nonce,const void * aad,size_t aad_len,const char * input,char * output,size_t size,char * tag,size_t tag_len)455 aead_encrypt(const EVP_CIPHER *cipher, const char *key, const char *nonce,
456     const void *aad, size_t aad_len, const char *input, char *output,
457     size_t size, char *tag, size_t tag_len)
458 {
459 	EVP_CIPHER_CTX *ctx;
460 	int outl, total;
461 
462 	ctx = EVP_CIPHER_CTX_new();
463 	if (ctx == NULL) {
464 		warnx("EVP_CIPHER_CTX_new failed: %s",
465 		    ERR_error_string(ERR_get_error(), NULL));
466 		return (false);
467 	}
468 	if (EVP_EncryptInit_ex(ctx, cipher, NULL, (const u_char *)key,
469 	    (const u_char *)nonce) != 1) {
470 		warnx("EVP_EncryptInit_ex failed: %s",
471 		    ERR_error_string(ERR_get_error(), NULL));
472 		EVP_CIPHER_CTX_free(ctx);
473 		return (false);
474 	}
475 	EVP_CIPHER_CTX_set_padding(ctx, 0);
476 	if (aad != NULL) {
477 		if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)aad,
478 		    aad_len) != 1) {
479 			warnx("EVP_EncryptUpdate for AAD failed: %s",
480 			    ERR_error_string(ERR_get_error(), NULL));
481 			EVP_CIPHER_CTX_free(ctx);
482 			return (false);
483 		}
484 	}
485 	if (EVP_EncryptUpdate(ctx, (u_char *)output, &outl,
486 	    (const u_char *)input, size) != 1) {
487 		warnx("EVP_EncryptUpdate failed: %s",
488 		    ERR_error_string(ERR_get_error(), NULL));
489 		EVP_CIPHER_CTX_free(ctx);
490 		return (false);
491 	}
492 	total = outl;
493 	if (EVP_EncryptFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) {
494 		warnx("EVP_EncryptFinal_ex failed: %s",
495 		    ERR_error_string(ERR_get_error(), NULL));
496 		EVP_CIPHER_CTX_free(ctx);
497 		return (false);
498 	}
499 	total += outl;
500 	if ((size_t)total != size) {
501 		warnx("encrypt size mismatch: %zu vs %d", size, total);
502 		EVP_CIPHER_CTX_free(ctx);
503 		return (false);
504 	}
505 	if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, tag_len, tag) !=
506 	    1) {
507 		warnx("EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_GET_TAG) failed: %s",
508 		    ERR_error_string(ERR_get_error(), NULL));
509 		EVP_CIPHER_CTX_free(ctx);
510 		return (false);
511 	}
512 	EVP_CIPHER_CTX_free(ctx);
513 	return (true);
514 }
515 
516 static bool
aead_decrypt(const EVP_CIPHER * cipher,const char * key,const char * nonce,const void * aad,size_t aad_len,const char * input,char * output,size_t size,const char * tag,size_t tag_len)517 aead_decrypt(const EVP_CIPHER *cipher, const char *key, const char *nonce,
518     const void *aad, size_t aad_len, const char *input, char *output,
519     size_t size, const char *tag, size_t tag_len)
520 {
521 	EVP_CIPHER_CTX *ctx;
522 	int outl, total;
523 	bool valid;
524 
525 	ctx = EVP_CIPHER_CTX_new();
526 	if (ctx == NULL) {
527 		warnx("EVP_CIPHER_CTX_new failed: %s",
528 		    ERR_error_string(ERR_get_error(), NULL));
529 		return (false);
530 	}
531 	if (EVP_DecryptInit_ex(ctx, cipher, NULL, (const u_char *)key,
532 	    (const u_char *)nonce) != 1) {
533 		warnx("EVP_DecryptInit_ex failed: %s",
534 		    ERR_error_string(ERR_get_error(), NULL));
535 		EVP_CIPHER_CTX_free(ctx);
536 		return (false);
537 	}
538 	EVP_CIPHER_CTX_set_padding(ctx, 0);
539 	if (aad != NULL) {
540 		if (EVP_DecryptUpdate(ctx, NULL, &outl, (const u_char *)aad,
541 		    aad_len) != 1) {
542 			warnx("EVP_DecryptUpdate for AAD failed: %s",
543 			    ERR_error_string(ERR_get_error(), NULL));
544 			EVP_CIPHER_CTX_free(ctx);
545 			return (false);
546 		}
547 	}
548 	if (EVP_DecryptUpdate(ctx, (u_char *)output, &outl,
549 	    (const u_char *)input, size) != 1) {
550 		warnx("EVP_DecryptUpdate failed: %s",
551 		    ERR_error_string(ERR_get_error(), NULL));
552 		EVP_CIPHER_CTX_free(ctx);
553 		return (false);
554 	}
555 	total = outl;
556 	if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, tag_len,
557 	    __DECONST(char *, tag)) != 1) {
558 		warnx("EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_SET_TAG) failed: %s",
559 		    ERR_error_string(ERR_get_error(), NULL));
560 		EVP_CIPHER_CTX_free(ctx);
561 		return (false);
562 	}
563 	valid = (EVP_DecryptFinal_ex(ctx, (u_char *)output + outl, &outl) == 1);
564 	total += outl;
565 	if ((size_t)total != size) {
566 		warnx("decrypt size mismatch: %zu vs %d", size, total);
567 		EVP_CIPHER_CTX_free(ctx);
568 		return (false);
569 	}
570 	if (!valid)
571 		warnx("tag mismatch");
572 	EVP_CIPHER_CTX_free(ctx);
573 	return (valid);
574 }
575 
576 static void
build_tls_enable(const atf_tc_t * tc,int cipher_alg,size_t cipher_key_len,int auth_alg,int minor,uint64_t seqno,struct tls_enable * en)577 build_tls_enable(const atf_tc_t *tc, int cipher_alg, size_t cipher_key_len,
578     int auth_alg, int minor, uint64_t seqno, struct tls_enable *en)
579 {
580 	u_int auth_key_len, iv_len;
581 
582 	memset(en, 0, sizeof(*en));
583 
584 	switch (cipher_alg) {
585 	case CRYPTO_AES_CBC:
586 		if (minor == TLS_MINOR_VER_ZERO)
587 			iv_len = AES_BLOCK_LEN;
588 		else
589 			iv_len = 0;
590 		break;
591 	case CRYPTO_AES_NIST_GCM_16:
592 		if (minor == TLS_MINOR_VER_TWO)
593 			iv_len = TLS_AEAD_GCM_LEN;
594 		else
595 			iv_len = TLS_1_3_GCM_IV_LEN;
596 		break;
597 	case CRYPTO_CHACHA20_POLY1305:
598 		iv_len = TLS_CHACHA20_IV_LEN;
599 		break;
600 	default:
601 		iv_len = 0;
602 		break;
603 	}
604 	switch (auth_alg) {
605 	case CRYPTO_SHA1_HMAC:
606 		auth_key_len = SHA1_HASH_LEN;
607 		break;
608 	case CRYPTO_SHA2_256_HMAC:
609 		auth_key_len = SHA2_256_HASH_LEN;
610 		break;
611 	case CRYPTO_SHA2_384_HMAC:
612 		auth_key_len = SHA2_384_HASH_LEN;
613 		break;
614 	default:
615 		auth_key_len = 0;
616 		break;
617 	}
618 	en->cipher_key = alloc_buffer(cipher_key_len);
619 	debug_hexdump(tc, en->cipher_key, cipher_key_len, "cipher key");
620 	en->iv = alloc_buffer(iv_len);
621 	if (iv_len != 0)
622 		debug_hexdump(tc, en->iv, iv_len, "iv");
623 	en->auth_key = alloc_buffer(auth_key_len);
624 	if (auth_key_len != 0)
625 		debug_hexdump(tc, en->auth_key, auth_key_len, "auth key");
626 	en->cipher_algorithm = cipher_alg;
627 	en->cipher_key_len = cipher_key_len;
628 	en->iv_len = iv_len;
629 	en->auth_algorithm = auth_alg;
630 	en->auth_key_len = auth_key_len;
631 	en->tls_vmajor = TLS_MAJOR_VER_ONE;
632 	en->tls_vminor = minor;
633 	be64enc(en->rec_seq, seqno);
634 	debug(tc, "seqno: %ju\n", (uintmax_t)seqno);
635 }
636 
637 static void
free_tls_enable(struct tls_enable * en)638 free_tls_enable(struct tls_enable *en)
639 {
640 	free(__DECONST(void *, en->cipher_key));
641 	free(__DECONST(void *, en->iv));
642 	free(__DECONST(void *, en->auth_key));
643 }
644 
645 static const EVP_CIPHER *
tls_EVP_CIPHER(const struct tls_enable * en)646 tls_EVP_CIPHER(const struct tls_enable *en)
647 {
648 	switch (en->cipher_algorithm) {
649 	case CRYPTO_AES_CBC:
650 		switch (en->cipher_key_len) {
651 		case 128 / 8:
652 			return (EVP_aes_128_cbc());
653 		case 256 / 8:
654 			return (EVP_aes_256_cbc());
655 		default:
656 			return (NULL);
657 		}
658 		break;
659 	case CRYPTO_AES_NIST_GCM_16:
660 		switch (en->cipher_key_len) {
661 		case 128 / 8:
662 			return (EVP_aes_128_gcm());
663 		case 256 / 8:
664 			return (EVP_aes_256_gcm());
665 		default:
666 			return (NULL);
667 		}
668 		break;
669 	case CRYPTO_CHACHA20_POLY1305:
670 		return (EVP_chacha20_poly1305());
671 	default:
672 		return (NULL);
673 	}
674 }
675 
676 static const EVP_MD *
tls_EVP_MD(const struct tls_enable * en)677 tls_EVP_MD(const struct tls_enable *en)
678 {
679 	switch (en->auth_algorithm) {
680 	case CRYPTO_SHA1_HMAC:
681 		return (EVP_sha1());
682 	case CRYPTO_SHA2_256_HMAC:
683 		return (EVP_sha256());
684 	case CRYPTO_SHA2_384_HMAC:
685 		return (EVP_sha384());
686 	default:
687 		return (NULL);
688 	}
689 }
690 
691 static size_t
tls_header_len(struct tls_enable * en)692 tls_header_len(struct tls_enable *en)
693 {
694 	size_t len;
695 
696 	len = sizeof(struct tls_record_layer);
697 	switch (en->cipher_algorithm) {
698 	case CRYPTO_AES_CBC:
699 		if (en->tls_vminor != TLS_MINOR_VER_ZERO)
700 			len += AES_BLOCK_LEN;
701 		return (len);
702 	case CRYPTO_AES_NIST_GCM_16:
703 		if (en->tls_vminor == TLS_MINOR_VER_TWO)
704 			len += sizeof(uint64_t);
705 		return (len);
706 	case CRYPTO_CHACHA20_POLY1305:
707 		return (len);
708 	default:
709 		return (0);
710 	}
711 }
712 
713 static size_t
tls_mac_len(struct tls_enable * en)714 tls_mac_len(struct tls_enable *en)
715 {
716 	switch (en->cipher_algorithm) {
717 	case CRYPTO_AES_CBC:
718 		switch (en->auth_algorithm) {
719 		case CRYPTO_SHA1_HMAC:
720 			return (SHA1_HASH_LEN);
721 		case CRYPTO_SHA2_256_HMAC:
722 			return (SHA2_256_HASH_LEN);
723 		case CRYPTO_SHA2_384_HMAC:
724 			return (SHA2_384_HASH_LEN);
725 		default:
726 			return (0);
727 		}
728 	case CRYPTO_AES_NIST_GCM_16:
729 		return (AES_GMAC_HASH_LEN);
730 	case CRYPTO_CHACHA20_POLY1305:
731 		return (POLY1305_HASH_LEN);
732 	default:
733 		return (0);
734 	}
735 }
736 
737 /* Includes maximum padding for MTE. */
738 static size_t
tls_trailer_len(struct tls_enable * en)739 tls_trailer_len(struct tls_enable *en)
740 {
741 	size_t len;
742 
743 	len = tls_mac_len(en);
744 	if (en->cipher_algorithm == CRYPTO_AES_CBC)
745 		len += AES_BLOCK_LEN;
746 	if (en->tls_vminor == TLS_MINOR_VER_THREE)
747 		len++;
748 	return (len);
749 }
750 
751 /* Minimum valid record payload size for a given cipher suite. */
752 static size_t
tls_minimum_record_payload(struct tls_enable * en)753 tls_minimum_record_payload(struct tls_enable *en)
754 {
755 	size_t len;
756 
757 	len = tls_header_len(en);
758 	if (en->cipher_algorithm == CRYPTO_AES_CBC)
759 		len += roundup2(tls_mac_len(en) + 1, AES_BLOCK_LEN);
760 	else
761 		len += tls_mac_len(en);
762 	if (en->tls_vminor == TLS_MINOR_VER_THREE)
763 		len++;
764 	return (len - sizeof(struct tls_record_layer));
765 }
766 
767 /* 'len' is the length of the payload application data. */
768 static void
tls_mte_aad(struct tls_enable * en,size_t len,const struct tls_record_layer * hdr,uint64_t seqno,struct tls_mac_data * ad)769 tls_mte_aad(struct tls_enable *en, size_t len,
770     const struct tls_record_layer *hdr, uint64_t seqno, struct tls_mac_data *ad)
771 {
772 	ad->seq = htobe64(seqno);
773 	ad->type = hdr->tls_type;
774 	ad->tls_vmajor = hdr->tls_vmajor;
775 	ad->tls_vminor = hdr->tls_vminor;
776 	ad->tls_length = htons(len);
777 }
778 
779 static void
tls_12_aead_aad(struct tls_enable * en,size_t len,const struct tls_record_layer * hdr,uint64_t seqno,struct tls_aead_data * ad)780 tls_12_aead_aad(struct tls_enable *en, size_t len,
781     const struct tls_record_layer *hdr, uint64_t seqno,
782     struct tls_aead_data *ad)
783 {
784 	ad->seq = htobe64(seqno);
785 	ad->type = hdr->tls_type;
786 	ad->tls_vmajor = hdr->tls_vmajor;
787 	ad->tls_vminor = hdr->tls_vminor;
788 	ad->tls_length = htons(len);
789 }
790 
791 static void
tls_13_aad(struct tls_enable * en,const struct tls_record_layer * hdr,uint64_t seqno,struct tls_aead_data_13 * ad)792 tls_13_aad(struct tls_enable *en, const struct tls_record_layer *hdr,
793     uint64_t seqno, struct tls_aead_data_13 *ad)
794 {
795 	ad->type = hdr->tls_type;
796 	ad->tls_vmajor = hdr->tls_vmajor;
797 	ad->tls_vminor = hdr->tls_vminor;
798 	ad->tls_length = hdr->tls_length;
799 }
800 
801 static void
tls_12_gcm_nonce(struct tls_enable * en,const struct tls_record_layer * hdr,char * nonce)802 tls_12_gcm_nonce(struct tls_enable *en, const struct tls_record_layer *hdr,
803     char *nonce)
804 {
805 	memcpy(nonce, en->iv, TLS_AEAD_GCM_LEN);
806 	memcpy(nonce + TLS_AEAD_GCM_LEN, hdr + 1, sizeof(uint64_t));
807 }
808 
809 static void
tls_13_nonce(struct tls_enable * en,uint64_t seqno,char * nonce)810 tls_13_nonce(struct tls_enable *en, uint64_t seqno, char *nonce)
811 {
812 	static_assert(TLS_1_3_GCM_IV_LEN == TLS_CHACHA20_IV_LEN,
813 	    "TLS 1.3 nonce length mismatch");
814 	memcpy(nonce, en->iv, TLS_1_3_GCM_IV_LEN);
815 	*(uint64_t *)(nonce + 4) ^= htobe64(seqno);
816 }
817 
818 /*
819  * Decrypt a TLS record 'len' bytes long at 'src' and store the result at
820  * 'dst'.  If the TLS record header length doesn't match or 'dst' doesn't
821  * have sufficient room ('avail'), fail the test.
822  */
823 static size_t
decrypt_tls_aes_cbc_mte(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,const void * src,size_t len,void * dst,size_t avail,uint8_t * record_type)824 decrypt_tls_aes_cbc_mte(const atf_tc_t *tc, struct tls_enable *en,
825     uint64_t seqno, const void *src, size_t len, void *dst, size_t avail,
826     uint8_t *record_type)
827 {
828 	const struct tls_record_layer *hdr;
829 	struct tls_mac_data aad;
830 	const char *iv;
831 	char *buf;
832 	size_t hdr_len, mac_len, payload_len;
833 	int padding;
834 
835 	hdr = src;
836 	hdr_len = tls_header_len(en);
837 	mac_len = tls_mac_len(en);
838 	ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor);
839 	ATF_REQUIRE_INTEQ(en->tls_vminor, hdr->tls_vminor);
840 	debug(tc, "decrypting MTE record seqno %ju:\n", (uintmax_t)seqno);
841 	debug_hexdump(tc, src, len, NULL);
842 
843 	/* First, decrypt the outer payload into a temporary buffer. */
844 	payload_len = len - hdr_len;
845 	buf = malloc(payload_len);
846 	if (en->tls_vminor == TLS_MINOR_VER_ZERO)
847 		iv = en->iv;
848 	else
849 		iv = (void *)(hdr + 1);
850 	debug_hexdump(tc, iv, AES_BLOCK_LEN, "iv");
851 	ATF_REQUIRE(cbc_decrypt(tls_EVP_CIPHER(en), en->cipher_key, iv,
852 	    (const u_char *)src + hdr_len, buf, payload_len));
853 	debug_hexdump(tc, buf, payload_len, "decrypted buffer");
854 
855 	/*
856 	 * Copy the last encrypted block to use as the IV for the next
857 	 * record for TLS 1.0.
858 	 */
859 	if (en->tls_vminor == TLS_MINOR_VER_ZERO)
860 		memcpy(__DECONST(uint8_t *, en->iv), (const u_char *)src +
861 		    (len - AES_BLOCK_LEN), AES_BLOCK_LEN);
862 
863 	/*
864 	 * Verify trailing padding and strip.
865 	 *
866 	 * The kernel always generates the smallest amount of padding.
867 	 */
868 	padding = buf[payload_len - 1] + 1;
869 	ATF_REQUIRE_MSG(padding > 0 && padding <= AES_BLOCK_LEN,
870 	    "invalid padding %d", padding);
871 	ATF_REQUIRE_MSG(payload_len >= mac_len + padding,
872 	    "payload_len (%zu) < mac_len (%zu) + padding (%d)", payload_len,
873 	    mac_len, padding);
874 	payload_len -= padding;
875 
876 	/* Verify HMAC. */
877 	payload_len -= mac_len;
878 	tls_mte_aad(en, payload_len, hdr, seqno, &aad);
879 	debug_hexdump(tc, &aad, sizeof(aad), "aad");
880 	ATF_REQUIRE(verify_hash(tls_EVP_MD(en), en->auth_key, en->auth_key_len,
881 	    &aad, sizeof(aad), buf, payload_len, buf + payload_len));
882 
883 	ATF_REQUIRE_MSG(payload_len <= avail, "payload_len (%zu) < avail (%zu)",
884 	    payload_len, avail);
885 	memcpy(dst, buf, payload_len);
886 	*record_type = hdr->tls_type;
887 	return (payload_len);
888 }
889 
890 static size_t
decrypt_tls_12_aead(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,const void * src,size_t len,void * dst,uint8_t * record_type)891 decrypt_tls_12_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno,
892     const void *src, size_t len, void *dst, uint8_t *record_type)
893 {
894 	const struct tls_record_layer *hdr;
895 	struct tls_aead_data aad;
896 	char nonce[12];
897 	size_t hdr_len, mac_len, payload_len;
898 
899 	hdr = src;
900 
901 	hdr_len = tls_header_len(en);
902 	mac_len = tls_mac_len(en);
903 	payload_len = len - (hdr_len + mac_len);
904 	ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor);
905 	ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, hdr->tls_vminor);
906 	debug(tc, "decrypting TLS 1.2 record seqno %ju:\n", (uintmax_t)seqno);
907 	debug_hexdump(tc, src, len, NULL);
908 
909 	tls_12_aead_aad(en, payload_len, hdr, seqno, &aad);
910 	debug_hexdump(tc, &aad, sizeof(aad), "aad");
911 	if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16)
912 		tls_12_gcm_nonce(en, hdr, nonce);
913 	else
914 		tls_13_nonce(en, seqno, nonce);
915 	debug_hexdump(tc, nonce, sizeof(nonce), "nonce");
916 
917 	ATF_REQUIRE(aead_decrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce,
918 	    &aad, sizeof(aad), (const char *)src + hdr_len, dst, payload_len,
919 	    (const char *)src + hdr_len + payload_len, mac_len));
920 
921 	*record_type = hdr->tls_type;
922 	return (payload_len);
923 }
924 
925 static size_t
decrypt_tls_13_aead(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,const void * src,size_t len,void * dst,uint8_t * record_type)926 decrypt_tls_13_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno,
927     const void *src, size_t len, void *dst, uint8_t *record_type)
928 {
929 	const struct tls_record_layer *hdr;
930 	struct tls_aead_data_13 aad;
931 	char nonce[12];
932 	char *buf;
933 	size_t hdr_len, mac_len, payload_len;
934 
935 	hdr = src;
936 
937 	hdr_len = tls_header_len(en);
938 	mac_len = tls_mac_len(en);
939 	payload_len = len - (hdr_len + mac_len);
940 	ATF_REQUIRE_MSG(payload_len >= 1,
941 	    "payload_len (%zu) too short: len %zu hdr_len %zu mac_len %zu",
942 	    payload_len, len, hdr_len, mac_len);
943 	ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, hdr->tls_type);
944 	ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor);
945 	ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, hdr->tls_vminor);
946 	debug(tc, "decrypting TLS 1.3 record seqno %ju:\n", (uintmax_t)seqno);
947 	debug_hexdump(tc, src, len, NULL);
948 
949 	tls_13_aad(en, hdr, seqno, &aad);
950 	debug_hexdump(tc, &aad, sizeof(aad), "aad");
951 	tls_13_nonce(en, seqno, nonce);
952 	debug_hexdump(tc, nonce, sizeof(nonce), "nonce");
953 
954 	/*
955 	 * Have to use a temporary buffer for the output due to the
956 	 * record type as the last byte of the trailer.
957 	 */
958 	buf = malloc(payload_len);
959 
960 	ATF_REQUIRE(aead_decrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce,
961 	    &aad, sizeof(aad), (const char *)src + hdr_len, buf, payload_len,
962 	    (const char *)src + hdr_len + payload_len, mac_len));
963 	debug_hexdump(tc, buf, payload_len, "decrypted buffer");
964 
965 	/* Trim record type. */
966 	*record_type = buf[payload_len - 1];
967 	payload_len--;
968 
969 	memcpy(dst, buf, payload_len);
970 	free(buf);
971 
972 	return (payload_len);
973 }
974 
975 static size_t
decrypt_tls_aead(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,const void * src,size_t len,void * dst,size_t avail,uint8_t * record_type)976 decrypt_tls_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno,
977     const void *src, size_t len, void *dst, size_t avail, uint8_t *record_type)
978 {
979 	const struct tls_record_layer *hdr;
980 	size_t payload_len;
981 
982 	hdr = src;
983 	ATF_REQUIRE_INTEQ(len, ntohs(hdr->tls_length) + sizeof(*hdr));
984 
985 	payload_len = len - (tls_header_len(en) + tls_trailer_len(en));
986 	ATF_REQUIRE_MSG(payload_len <= avail, "payload_len (%zu) > avail (%zu)",
987 	    payload_len, avail);
988 
989 	if (en->tls_vminor == TLS_MINOR_VER_TWO) {
990 		ATF_REQUIRE_INTEQ(payload_len, decrypt_tls_12_aead(tc, en,
991 		    seqno, src, len, dst, record_type));
992 	} else {
993 		ATF_REQUIRE_INTEQ(payload_len, decrypt_tls_13_aead(tc, en,
994 		    seqno, src, len, dst, record_type));
995 	}
996 
997 	return (payload_len);
998 }
999 
1000 static size_t
decrypt_tls_record(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,const void * src,size_t len,void * dst,size_t avail,uint8_t * record_type)1001 decrypt_tls_record(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno,
1002     const void *src, size_t len, void *dst, size_t avail, uint8_t *record_type)
1003 {
1004 	if (en->cipher_algorithm == CRYPTO_AES_CBC)
1005 		return (decrypt_tls_aes_cbc_mte(tc, en, seqno, src, len, dst,
1006 		    avail, record_type));
1007 	else
1008 		return (decrypt_tls_aead(tc, en, seqno, src, len, dst, avail,
1009 		    record_type));
1010 }
1011 
1012 /*
1013  * Encrypt a TLS record of type 'record_type' with payload 'len' bytes
1014  * long at 'src' and store the result at 'dst'.  If 'dst' doesn't have
1015  * sufficient room ('avail'), fail the test.  'padding' is the amount
1016  * of additional padding to include beyond any amount mandated by the
1017  * cipher suite.
1018  */
1019 static size_t
encrypt_tls_aes_cbc_mte(const atf_tc_t * tc,struct tls_enable * en,uint8_t record_type,uint64_t seqno,const void * src,size_t len,void * dst,size_t avail,size_t padding)1020 encrypt_tls_aes_cbc_mte(const atf_tc_t *tc, struct tls_enable *en,
1021     uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst,
1022     size_t avail, size_t padding)
1023 {
1024 	struct tls_record_layer *hdr;
1025 	struct tls_mac_data aad;
1026 	char *buf, *iv;
1027 	size_t hdr_len, mac_len, record_len;
1028 	u_int digest_len, i;
1029 
1030 	ATF_REQUIRE_INTEQ(0, padding % 16);
1031 
1032 	hdr = dst;
1033 	buf = dst;
1034 
1035 	debug(tc, "encrypting MTE record seqno %ju:\n", (uintmax_t)seqno);
1036 	hdr_len = tls_header_len(en);
1037 	mac_len = tls_mac_len(en);
1038 	padding += (AES_BLOCK_LEN - (len + mac_len) % AES_BLOCK_LEN);
1039 	ATF_REQUIRE_MSG(padding > 0 && padding <= 255, "invalid padding (%zu)",
1040 	    padding);
1041 
1042 	record_len = hdr_len + len + mac_len + padding;
1043 	ATF_REQUIRE_MSG(record_len <= avail, "record_len (%zu) > avail (%zu): "
1044 	    "hdr_len %zu, len %zu, mac_len %zu, padding %zu", record_len,
1045 	    avail, hdr_len, len, mac_len, padding);
1046 
1047 	hdr->tls_type = record_type;
1048 	hdr->tls_vmajor = TLS_MAJOR_VER_ONE;
1049 	hdr->tls_vminor = en->tls_vminor;
1050 	hdr->tls_length = htons(record_len - sizeof(*hdr));
1051 	iv = (char *)(hdr + 1);
1052 	for (i = 0; i < AES_BLOCK_LEN; i++)
1053 		iv[i] = rdigit();
1054 	debug_hexdump(tc, iv, AES_BLOCK_LEN, "explicit IV");
1055 
1056 	/* Copy plaintext to ciphertext region. */
1057 	memcpy(buf + hdr_len, src, len);
1058 
1059 	/* Compute HMAC. */
1060 	tls_mte_aad(en, len, hdr, seqno, &aad);
1061 	debug_hexdump(tc, &aad, sizeof(aad), "aad");
1062 	debug_hexdump(tc, src, len, "plaintext");
1063 	ATF_REQUIRE(compute_hash(tls_EVP_MD(en), en->auth_key, en->auth_key_len,
1064 	    &aad, sizeof(aad), src, len, buf + hdr_len + len, &digest_len));
1065 	ATF_REQUIRE_INTEQ(mac_len, digest_len);
1066 
1067 	/* Store padding. */
1068 	for (i = 0; i < padding; i++)
1069 		buf[hdr_len + len + mac_len + i] = padding - 1;
1070 	debug_hexdump(tc, buf + hdr_len + len, mac_len + padding,
1071 	    "MAC and padding");
1072 
1073 	/* Encrypt the record. */
1074 	ATF_REQUIRE(cbc_encrypt(tls_EVP_CIPHER(en), en->cipher_key, iv,
1075 	    buf + hdr_len, buf + hdr_len, len + mac_len + padding));
1076 	debug_hexdump(tc, dst, record_len, "encrypted record");
1077 
1078 	return (record_len);
1079 }
1080 
1081 static size_t
encrypt_tls_12_aead(const atf_tc_t * tc,struct tls_enable * en,uint8_t record_type,uint64_t seqno,const void * src,size_t len,void * dst)1082 encrypt_tls_12_aead(const atf_tc_t *tc, struct tls_enable *en,
1083     uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst)
1084 {
1085 	struct tls_record_layer *hdr;
1086 	struct tls_aead_data aad;
1087 	char nonce[12];
1088 	size_t hdr_len, mac_len, record_len;
1089 
1090 	hdr = dst;
1091 
1092 	debug(tc, "encrypting TLS 1.2 record seqno %ju:\n", (uintmax_t)seqno);
1093 	hdr_len = tls_header_len(en);
1094 	mac_len = tls_mac_len(en);
1095 	record_len = hdr_len + len + mac_len;
1096 
1097 	hdr->tls_type = record_type;
1098 	hdr->tls_vmajor = TLS_MAJOR_VER_ONE;
1099 	hdr->tls_vminor = TLS_MINOR_VER_TWO;
1100 	hdr->tls_length = htons(record_len - sizeof(*hdr));
1101 	if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16)
1102 		memcpy(hdr + 1, &seqno, sizeof(seqno));
1103 
1104 	tls_12_aead_aad(en, len, hdr, seqno, &aad);
1105 	debug_hexdump(tc, &aad, sizeof(aad), "aad");
1106 	if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16)
1107 		tls_12_gcm_nonce(en, hdr, nonce);
1108 	else
1109 		tls_13_nonce(en, seqno, nonce);
1110 	debug_hexdump(tc, nonce, sizeof(nonce), "nonce");
1111 
1112 	debug_hexdump(tc, src, len, "plaintext");
1113 	ATF_REQUIRE(aead_encrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce,
1114 	    &aad, sizeof(aad), src, (char *)dst + hdr_len, len,
1115 	    (char *)dst + hdr_len + len, mac_len));
1116 	debug_hexdump(tc, dst, record_len, "encrypted record");
1117 
1118 	return (record_len);
1119 }
1120 
1121 static size_t
encrypt_tls_13_aead(const atf_tc_t * tc,struct tls_enable * en,uint8_t record_type,uint64_t seqno,const void * src,size_t len,void * dst,size_t padding)1122 encrypt_tls_13_aead(const atf_tc_t *tc, struct tls_enable *en,
1123     uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst,
1124     size_t padding)
1125 {
1126 	struct tls_record_layer *hdr;
1127 	struct tls_aead_data_13 aad;
1128 	char nonce[12];
1129 	char *buf;
1130 	size_t hdr_len, mac_len, record_len;
1131 
1132 	hdr = dst;
1133 
1134 	debug(tc, "encrypting TLS 1.3 record seqno %ju:\n", (uintmax_t)seqno);
1135 	hdr_len = tls_header_len(en);
1136 	mac_len = tls_mac_len(en);
1137 	record_len = hdr_len + len + 1 + padding + mac_len;
1138 
1139 	hdr->tls_type = TLS_RLTYPE_APP;
1140 	hdr->tls_vmajor = TLS_MAJOR_VER_ONE;
1141 	hdr->tls_vminor = TLS_MINOR_VER_TWO;
1142 	hdr->tls_length = htons(record_len - sizeof(*hdr));
1143 
1144 	tls_13_aad(en, hdr, seqno, &aad);
1145 	debug_hexdump(tc, &aad, sizeof(aad), "aad");
1146 	tls_13_nonce(en, seqno, nonce);
1147 	debug_hexdump(tc, nonce, sizeof(nonce), "nonce");
1148 
1149 	/*
1150 	 * Have to use a temporary buffer for the input so that the record
1151 	 * type can be appended.
1152 	 */
1153 	buf = malloc(len + 1 + padding);
1154 	memcpy(buf, src, len);
1155 	buf[len] = record_type;
1156 	memset(buf + len + 1, 0, padding);
1157 	debug_hexdump(tc, buf, len + 1 + padding, "plaintext + type + padding");
1158 
1159 	ATF_REQUIRE(aead_encrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce,
1160 	    &aad, sizeof(aad), buf, (char *)dst + hdr_len, len + 1 + padding,
1161 	    (char *)dst + hdr_len + len + 1 + padding, mac_len));
1162 	debug_hexdump(tc, dst, record_len, "encrypted record");
1163 
1164 	free(buf);
1165 
1166 	return (record_len);
1167 }
1168 
1169 static size_t
encrypt_tls_aead(const atf_tc_t * tc,struct tls_enable * en,uint8_t record_type,uint64_t seqno,const void * src,size_t len,void * dst,size_t avail,size_t padding)1170 encrypt_tls_aead(const atf_tc_t *tc, struct tls_enable *en,
1171     uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst,
1172     size_t avail, size_t padding)
1173 {
1174 	size_t record_len;
1175 
1176 	record_len = tls_header_len(en) + len + padding + tls_trailer_len(en);
1177 	ATF_REQUIRE_MSG(record_len <= avail, "record_len (%zu) > avail (%zu): "
1178 	    "header %zu len %zu padding %zu trailer %zu", record_len, avail,
1179 	    tls_header_len(en), len, padding, tls_trailer_len(en));
1180 
1181 	if (en->tls_vminor == TLS_MINOR_VER_TWO) {
1182 		ATF_REQUIRE_INTEQ(0, padding);
1183 		ATF_REQUIRE_INTEQ(record_len, encrypt_tls_12_aead(tc, en,
1184 		    record_type, seqno, src, len, dst));
1185 	} else
1186 		ATF_REQUIRE_INTEQ(record_len, encrypt_tls_13_aead(tc, en,
1187 		    record_type, seqno, src, len, dst, padding));
1188 
1189 	return (record_len);
1190 }
1191 
1192 static size_t
encrypt_tls_record(const atf_tc_t * tc,struct tls_enable * en,uint8_t record_type,uint64_t seqno,const void * src,size_t len,void * dst,size_t avail,size_t padding)1193 encrypt_tls_record(const atf_tc_t *tc, struct tls_enable *en,
1194     uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst,
1195     size_t avail, size_t padding)
1196 {
1197 	if (en->cipher_algorithm == CRYPTO_AES_CBC)
1198 		return (encrypt_tls_aes_cbc_mte(tc, en, record_type, seqno, src,
1199 		    len, dst, avail, padding));
1200 	else
1201 		return (encrypt_tls_aead(tc, en, record_type, seqno, src, len,
1202 		    dst, avail, padding));
1203 }
1204 
1205 static void
test_ktls_transmit_app_data(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1206 test_ktls_transmit_app_data(const atf_tc_t *tc, struct tls_enable *en,
1207     uint64_t seqno, size_t len)
1208 {
1209 	struct kevent ev;
1210 	struct tls_record_layer *hdr;
1211 	char *plaintext, *decrypted, *outbuf;
1212 	size_t decrypted_len, outbuf_len, outbuf_cap, record_len, written;
1213 	ssize_t rv;
1214 	int kq, sockets[2];
1215 	uint8_t record_type;
1216 
1217 	plaintext = alloc_buffer(len);
1218 	debug_hexdump(tc, plaintext, len, "plaintext");
1219 	decrypted = malloc(len);
1220 	outbuf_cap = tls_header_len(en) + TLS_MAX_MSG_SIZE_V10_2 +
1221 	    tls_trailer_len(en);
1222 	outbuf = malloc(outbuf_cap);
1223 	hdr = (struct tls_record_layer *)outbuf;
1224 
1225 	ATF_REQUIRE((kq = kqueue()) != -1);
1226 
1227 	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1228 
1229 	ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en,
1230 	    sizeof(*en)) == 0);
1231 	check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE);
1232 
1233 	EV_SET(&ev, sockets[0], EVFILT_READ, EV_ADD, 0, 0, NULL);
1234 	ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0);
1235 	EV_SET(&ev, sockets[1], EVFILT_WRITE, EV_ADD, 0, 0, NULL);
1236 	ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0);
1237 
1238 	decrypted_len = 0;
1239 	outbuf_len = 0;
1240 	written = 0;
1241 
1242 	while (decrypted_len != len) {
1243 		ATF_REQUIRE(kevent(kq, NULL, 0, &ev, 1, NULL) == 1);
1244 
1245 		switch (ev.filter) {
1246 		case EVFILT_WRITE:
1247 			/* Try to write any remaining data. */
1248 			rv = write(ev.ident, plaintext + written,
1249 			    len - written);
1250 			ATF_REQUIRE_MSG(rv > 0,
1251 			    "failed to write to socket");
1252 			written += rv;
1253 			if (written == len) {
1254 				ev.flags = EV_DISABLE;
1255 				ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0,
1256 				    NULL) == 0);
1257 			}
1258 			break;
1259 
1260 		case EVFILT_READ:
1261 			ATF_REQUIRE((ev.flags & EV_EOF) == 0);
1262 
1263 			/*
1264 			 * Try to read data for the next TLS record
1265 			 * into outbuf.  Start by reading the header
1266 			 * to determine how much additional data to
1267 			 * read.
1268 			 */
1269 			if (outbuf_len < sizeof(struct tls_record_layer)) {
1270 				rv = read(ev.ident, outbuf + outbuf_len,
1271 				    sizeof(struct tls_record_layer) -
1272 				    outbuf_len);
1273 				ATF_REQUIRE_MSG(rv > 0,
1274 				    "failed to read from socket");
1275 				outbuf_len += rv;
1276 
1277 				if (outbuf_len ==
1278 				    sizeof(struct tls_record_layer)) {
1279 					debug(tc, "TLS header for seqno %ju:\n",
1280 					    (uintmax_t)seqno);
1281 					debug_hexdump(tc, outbuf, outbuf_len,
1282 					    NULL);
1283 				}
1284 			}
1285 
1286 			if (outbuf_len < sizeof(struct tls_record_layer))
1287 				break;
1288 
1289 			record_len = sizeof(struct tls_record_layer) +
1290 			    ntohs(hdr->tls_length);
1291 			debug(tc, "record_len %zu outbuf_cap %zu\n",
1292 			    record_len, outbuf_cap);
1293 			ATF_REQUIRE(record_len <= outbuf_cap);
1294 			ATF_REQUIRE(record_len > outbuf_len);
1295 			rv = read(ev.ident, outbuf + outbuf_len,
1296 			    record_len - outbuf_len);
1297 			if (rv == -1 && errno == EAGAIN)
1298 				break;
1299 			ATF_REQUIRE_MSG(rv > 0,
1300 			    "failed to read from socket: %s", strerror(errno));
1301 
1302 			outbuf_len += rv;
1303 			if (outbuf_len == record_len) {
1304 				decrypted_len += decrypt_tls_record(tc, en,
1305 				    seqno, outbuf, outbuf_len,
1306 				    decrypted + decrypted_len,
1307 				    len - decrypted_len, &record_type);
1308 				ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, record_type);
1309 
1310 				seqno++;
1311 				outbuf_len = 0;
1312 			}
1313 			break;
1314 		}
1315 	}
1316 
1317 	ATF_REQUIRE_MSG(written == decrypted_len,
1318 	    "read %zu decrypted bytes, but wrote %zu", decrypted_len, written);
1319 
1320 	ATF_REQUIRE(memcmp(plaintext, decrypted, len) == 0);
1321 
1322 	free(outbuf);
1323 	free(decrypted);
1324 	free(plaintext);
1325 
1326 	close_sockets(sockets);
1327 	ATF_REQUIRE(close(kq) == 0);
1328 }
1329 
1330 static void
ktls_send_control_message(int fd,uint8_t type,void * data,size_t len)1331 ktls_send_control_message(int fd, uint8_t type, void *data, size_t len)
1332 {
1333 	struct msghdr msg;
1334 	struct cmsghdr *cmsg;
1335 	char cbuf[CMSG_SPACE(sizeof(type))];
1336 	struct iovec iov;
1337 
1338 	memset(&msg, 0, sizeof(msg));
1339 
1340 	msg.msg_control = cbuf;
1341 	msg.msg_controllen = sizeof(cbuf);
1342 	cmsg = CMSG_FIRSTHDR(&msg);
1343 	cmsg->cmsg_level = IPPROTO_TCP;
1344 	cmsg->cmsg_type = TLS_SET_RECORD_TYPE;
1345 	cmsg->cmsg_len = CMSG_LEN(sizeof(type));
1346 	*(uint8_t *)CMSG_DATA(cmsg) = type;
1347 
1348 	iov.iov_base = data;
1349 	iov.iov_len = len;
1350 	msg.msg_iov = &iov;
1351 	msg.msg_iovlen = 1;
1352 
1353 	ATF_REQUIRE_INTEQ((ssize_t)len, sendmsg(fd, &msg, 0));
1354 }
1355 
1356 static void
test_ktls_transmit_control(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,uint8_t type,size_t len)1357 test_ktls_transmit_control(const atf_tc_t *tc, struct tls_enable *en,
1358     uint64_t seqno, uint8_t type, size_t len)
1359 {
1360 	struct tls_record_layer *hdr;
1361 	char *plaintext, *decrypted, *outbuf;
1362 	size_t outbuf_cap, payload_len, record_len;
1363 	ssize_t rv;
1364 	int sockets[2];
1365 	uint8_t record_type;
1366 
1367 	ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1368 
1369 	plaintext = alloc_buffer(len);
1370 	decrypted = malloc(len);
1371 	outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1372 	outbuf = malloc(outbuf_cap);
1373 	hdr = (struct tls_record_layer *)outbuf;
1374 
1375 	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1376 
1377 	ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en,
1378 	    sizeof(*en)) == 0);
1379 	check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE);
1380 
1381 	fd_set_blocking(sockets[0]);
1382 	fd_set_blocking(sockets[1]);
1383 
1384 	ktls_send_control_message(sockets[1], type, plaintext, len);
1385 
1386 	/*
1387 	 * First read the header to determine how much additional data
1388 	 * to read.
1389 	 */
1390 	rv = read(sockets[0], outbuf, sizeof(struct tls_record_layer));
1391 	ATF_REQUIRE_INTEQ(sizeof(struct tls_record_layer), rv);
1392 	payload_len = ntohs(hdr->tls_length);
1393 	record_len = payload_len + sizeof(struct tls_record_layer);
1394 	ATF_REQUIRE_MSG(record_len <= outbuf_cap,
1395 	    "record_len (%zu) > outbuf_cap (%zu)", record_len, outbuf_cap);
1396 	rv = read(sockets[0], outbuf + sizeof(struct tls_record_layer),
1397 	    payload_len);
1398 	ATF_REQUIRE_INTEQ((ssize_t)payload_len, rv);
1399 
1400 	rv = decrypt_tls_record(tc, en, seqno, outbuf, record_len, decrypted,
1401 	    len, &record_type);
1402 
1403 	ATF_REQUIRE_MSG((ssize_t)len == rv,
1404 	    "read %zd decrypted bytes, but wrote %zu", rv, len);
1405 	ATF_REQUIRE_INTEQ(type, record_type);
1406 
1407 	ATF_REQUIRE(memcmp(plaintext, decrypted, len) == 0);
1408 
1409 	free(outbuf);
1410 	free(decrypted);
1411 	free(plaintext);
1412 
1413 	close_sockets(sockets);
1414 }
1415 
1416 static void
test_ktls_transmit_empty_fragment(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno)1417 test_ktls_transmit_empty_fragment(const atf_tc_t *tc, struct tls_enable *en,
1418     uint64_t seqno)
1419 {
1420 	struct tls_record_layer *hdr;
1421 	char *outbuf;
1422 	size_t outbuf_cap, payload_len, record_len;
1423 	ssize_t rv;
1424 	int sockets[2];
1425 	uint8_t record_type;
1426 
1427 	outbuf_cap = tls_header_len(en) + tls_trailer_len(en);
1428 	outbuf = malloc(outbuf_cap);
1429 	hdr = (struct tls_record_layer *)outbuf;
1430 
1431 	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1432 
1433 	ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en,
1434 	    sizeof(*en)) == 0);
1435 	check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE);
1436 
1437 	fd_set_blocking(sockets[0]);
1438 	fd_set_blocking(sockets[1]);
1439 
1440 	/*
1441 	 * A write of zero bytes should send an empty fragment only for
1442 	 * TLS 1.0, otherwise an error should be raised.
1443 	 */
1444 	rv = write(sockets[1], NULL, 0);
1445 	if (rv == 0) {
1446 		ATF_REQUIRE_INTEQ(CRYPTO_AES_CBC, en->cipher_algorithm);
1447 		ATF_REQUIRE_INTEQ(TLS_MINOR_VER_ZERO, en->tls_vminor);
1448 	} else {
1449 		ATF_REQUIRE_INTEQ(-1, rv);
1450 		ATF_REQUIRE_ERRNO(EINVAL, true);
1451 		goto out;
1452 	}
1453 
1454 	/*
1455 	 * First read the header to determine how much additional data
1456 	 * to read.
1457 	 */
1458 	rv = read(sockets[0], outbuf, sizeof(struct tls_record_layer));
1459 	ATF_REQUIRE_INTEQ(sizeof(struct tls_record_layer), rv);
1460 	payload_len = ntohs(hdr->tls_length);
1461 	record_len = payload_len + sizeof(struct tls_record_layer);
1462 	ATF_REQUIRE_MSG(record_len <= outbuf_cap,
1463 	    "record_len (%zu) > outbuf_cap (%zu)", record_len, outbuf_cap);
1464 	rv = read(sockets[0], outbuf + sizeof(struct tls_record_layer),
1465 	    payload_len);
1466 	ATF_REQUIRE_INTEQ((ssize_t)payload_len, rv);
1467 
1468 	rv = decrypt_tls_record(tc, en, seqno, outbuf, record_len, NULL, 0,
1469 	    &record_type);
1470 
1471 	ATF_REQUIRE_MSG(rv == 0,
1472 	    "read %zd decrypted bytes for an empty fragment", rv);
1473 	ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, record_type);
1474 
1475 out:
1476 	free(outbuf);
1477 
1478 	close_sockets(sockets);
1479 }
1480 
1481 static size_t
ktls_receive_tls_record(struct tls_enable * en,int fd,uint8_t record_type,void * data,size_t len)1482 ktls_receive_tls_record(struct tls_enable *en, int fd, uint8_t record_type,
1483     void *data, size_t len)
1484 {
1485 	struct msghdr msg;
1486 	struct cmsghdr *cmsg;
1487 	struct tls_get_record *tgr;
1488 	char cbuf[CMSG_SPACE(sizeof(*tgr))];
1489 	struct iovec iov;
1490 	ssize_t rv;
1491 
1492 	memset(&msg, 0, sizeof(msg));
1493 
1494 	msg.msg_control = cbuf;
1495 	msg.msg_controllen = sizeof(cbuf);
1496 
1497 	iov.iov_base = data;
1498 	iov.iov_len = len;
1499 	msg.msg_iov = &iov;
1500 	msg.msg_iovlen = 1;
1501 
1502 	ATF_REQUIRE((rv = recvmsg(fd, &msg, 0)) > 0);
1503 
1504 	ATF_REQUIRE((msg.msg_flags & (MSG_EOR | MSG_CTRUNC)) == MSG_EOR);
1505 
1506 	cmsg = CMSG_FIRSTHDR(&msg);
1507 	ATF_REQUIRE(cmsg != NULL);
1508 	ATF_REQUIRE_INTEQ(IPPROTO_TCP, cmsg->cmsg_level);
1509 	ATF_REQUIRE_INTEQ(TLS_GET_RECORD, cmsg->cmsg_type);
1510 	ATF_REQUIRE_INTEQ(CMSG_LEN(sizeof(*tgr)), cmsg->cmsg_len);
1511 
1512 	tgr = (struct tls_get_record *)CMSG_DATA(cmsg);
1513 	ATF_REQUIRE_INTEQ(record_type, tgr->tls_type);
1514 	ATF_REQUIRE_INTEQ(en->tls_vmajor, tgr->tls_vmajor);
1515 	/* XXX: Not sure if this is what OpenSSL expects? */
1516 	if (en->tls_vminor == TLS_MINOR_VER_THREE)
1517 		ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, tgr->tls_vminor);
1518 	else
1519 		ATF_REQUIRE_INTEQ(en->tls_vminor, tgr->tls_vminor);
1520 	ATF_REQUIRE_INTEQ(htons(rv), tgr->tls_length);
1521 
1522 	return (rv);
1523 }
1524 
1525 static void
test_ktls_receive_app_data(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len,size_t padding)1526 test_ktls_receive_app_data(const atf_tc_t *tc, struct tls_enable *en,
1527     uint64_t seqno, size_t len, size_t padding)
1528 {
1529 	struct kevent ev;
1530 	char *plaintext, *received, *outbuf;
1531 	size_t outbuf_cap, outbuf_len, outbuf_sent, received_len, todo, written;
1532 	ssize_t rv;
1533 	int kq, sockets[2];
1534 
1535 	plaintext = alloc_buffer(len);
1536 	received = malloc(len);
1537 	outbuf_cap = tls_header_len(en) + TLS_MAX_MSG_SIZE_V10_2 +
1538 	    tls_trailer_len(en);
1539 	outbuf = malloc(outbuf_cap);
1540 
1541 	ATF_REQUIRE((kq = kqueue()) != -1);
1542 
1543 	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1544 
1545 	ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1546 	    sizeof(*en)) == 0);
1547 	check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1548 
1549 	EV_SET(&ev, sockets[0], EVFILT_READ, EV_ADD, 0, 0, NULL);
1550 	ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0);
1551 	EV_SET(&ev, sockets[1], EVFILT_WRITE, EV_ADD, 0, 0, NULL);
1552 	ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0);
1553 
1554 	received_len = 0;
1555 	outbuf_len = 0;
1556 	written = 0;
1557 
1558 	while (received_len != len) {
1559 		ATF_REQUIRE(kevent(kq, NULL, 0, &ev, 1, NULL) == 1);
1560 
1561 		switch (ev.filter) {
1562 		case EVFILT_WRITE:
1563 			/*
1564 			 * Compose the next TLS record to send.
1565 			 */
1566 			if (outbuf_len == 0) {
1567 				ATF_REQUIRE(written < len);
1568 				todo = len - written;
1569 				if (todo > TLS_MAX_MSG_SIZE_V10_2 - padding)
1570 					todo = TLS_MAX_MSG_SIZE_V10_2 - padding;
1571 				outbuf_len = encrypt_tls_record(tc, en,
1572 				    TLS_RLTYPE_APP, seqno, plaintext + written,
1573 				    todo, outbuf, outbuf_cap, padding);
1574 				outbuf_sent = 0;
1575 				written += todo;
1576 				seqno++;
1577 			}
1578 
1579 			/*
1580 			 * Try to write the remainder of the current
1581 			 * TLS record.
1582 			 */
1583 			rv = write(ev.ident, outbuf + outbuf_sent,
1584 			    outbuf_len - outbuf_sent);
1585 			ATF_REQUIRE_MSG(rv > 0,
1586 			    "failed to write to socket: %s", strerror(errno));
1587 			outbuf_sent += rv;
1588 			if (outbuf_sent == outbuf_len) {
1589 				outbuf_len = 0;
1590 				if (written == len) {
1591 					ev.flags = EV_DISABLE;
1592 					ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0,
1593 					    NULL) == 0);
1594 				}
1595 			}
1596 			break;
1597 
1598 		case EVFILT_READ:
1599 			ATF_REQUIRE((ev.flags & EV_EOF) == 0);
1600 
1601 			rv = ktls_receive_tls_record(en, ev.ident,
1602 			    TLS_RLTYPE_APP, received + received_len,
1603 			    len - received_len);
1604 			received_len += rv;
1605 			break;
1606 		}
1607 	}
1608 
1609 	ATF_REQUIRE_MSG(written == received_len,
1610 	    "read %zu decrypted bytes, but wrote %zu", received_len, written);
1611 
1612 	ATF_REQUIRE(memcmp(plaintext, received, len) == 0);
1613 
1614 	free(outbuf);
1615 	free(received);
1616 	free(plaintext);
1617 
1618 	close_sockets(sockets);
1619 	ATF_REQUIRE(close(kq) == 0);
1620 }
1621 
1622 static void
ktls_receive_tls_error(int fd,int expected_error)1623 ktls_receive_tls_error(int fd, int expected_error)
1624 {
1625 	struct msghdr msg;
1626 	struct tls_get_record *tgr;
1627 	char cbuf[CMSG_SPACE(sizeof(*tgr))];
1628 	char buf[64];
1629 	struct iovec iov;
1630 
1631 	memset(&msg, 0, sizeof(msg));
1632 
1633 	msg.msg_control = cbuf;
1634 	msg.msg_controllen = sizeof(cbuf);
1635 
1636 	iov.iov_base = buf;
1637 	iov.iov_len = sizeof(buf);
1638 	msg.msg_iov = &iov;
1639 	msg.msg_iovlen = 1;
1640 
1641 	ATF_REQUIRE(recvmsg(fd, &msg, 0) == -1);
1642 	if (expected_error != 0)
1643 		ATF_REQUIRE_ERRNO(expected_error, true);
1644 }
1645 
1646 static void
test_ktls_receive_corrupted_record(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len,ssize_t offset)1647 test_ktls_receive_corrupted_record(const atf_tc_t *tc, struct tls_enable *en,
1648     uint64_t seqno, size_t len, ssize_t offset)
1649 {
1650 	char *plaintext, *outbuf;
1651 	size_t outbuf_cap, outbuf_len;
1652 	ssize_t rv;
1653 	int sockets[2];
1654 
1655 	ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1656 
1657 	plaintext = alloc_buffer(len);
1658 	outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1659 	outbuf = malloc(outbuf_cap);
1660 
1661 	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1662 
1663 	ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1664 	    sizeof(*en)) == 0);
1665 	check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1666 
1667 	fd_set_blocking(sockets[0]);
1668 	fd_set_blocking(sockets[1]);
1669 
1670 	outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1671 	    plaintext, len, outbuf, outbuf_cap, 0);
1672 
1673 	/* A negative offset is an offset from the end. */
1674 	if (offset < 0)
1675 		offset += outbuf_len;
1676 	outbuf[offset] ^= 0x01;
1677 
1678 	rv = write(sockets[1], outbuf, outbuf_len);
1679 	ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1680 
1681 	ktls_receive_tls_error(sockets[0], EBADMSG);
1682 
1683 	free(outbuf);
1684 	free(plaintext);
1685 
1686 	close_sockets_ignore_errors(sockets);
1687 }
1688 
1689 static void
test_ktls_receive_corrupted_iv(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1690 test_ktls_receive_corrupted_iv(const atf_tc_t *tc, struct tls_enable *en,
1691     uint64_t seqno, size_t len)
1692 {
1693 	ATF_REQUIRE(tls_header_len(en) > sizeof(struct tls_record_layer));
1694 
1695 	/* Corrupt the first byte of the explicit IV after the header. */
1696 	test_ktls_receive_corrupted_record(tc, en, seqno, len,
1697 	    sizeof(struct tls_record_layer));
1698 }
1699 
1700 static void
test_ktls_receive_corrupted_data(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1701 test_ktls_receive_corrupted_data(const atf_tc_t *tc, struct tls_enable *en,
1702     uint64_t seqno, size_t len)
1703 {
1704 	ATF_REQUIRE(len > 0);
1705 
1706 	/* Corrupt the first ciphertext byte after the header. */
1707 	test_ktls_receive_corrupted_record(tc, en, seqno, len,
1708 	    tls_header_len(en));
1709 }
1710 
1711 static void
test_ktls_receive_corrupted_mac(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1712 test_ktls_receive_corrupted_mac(const atf_tc_t *tc, struct tls_enable *en,
1713     uint64_t seqno, size_t len)
1714 {
1715 	size_t offset;
1716 
1717 	/* Corrupt the first byte of the MAC. */
1718 	if (en->cipher_algorithm == CRYPTO_AES_CBC)
1719 		offset = tls_header_len(en) + len;
1720 	else
1721 		offset = -tls_mac_len(en);
1722 	test_ktls_receive_corrupted_record(tc, en, seqno, len, offset);
1723 }
1724 
1725 static void
test_ktls_receive_corrupted_padding(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1726 test_ktls_receive_corrupted_padding(const atf_tc_t *tc, struct tls_enable *en,
1727     uint64_t seqno, size_t len)
1728 {
1729 	ATF_REQUIRE_INTEQ(CRYPTO_AES_CBC, en->cipher_algorithm);
1730 
1731 	/* Corrupt the last byte of the padding. */
1732 	test_ktls_receive_corrupted_record(tc, en, seqno, len, -1);
1733 }
1734 
1735 static void
test_ktls_receive_truncated_record(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1736 test_ktls_receive_truncated_record(const atf_tc_t *tc, struct tls_enable *en,
1737     uint64_t seqno, size_t len)
1738 {
1739 	char *plaintext, *outbuf;
1740 	size_t outbuf_cap, outbuf_len;
1741 	ssize_t rv;
1742 	int sockets[2];
1743 
1744 	ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1745 
1746 	plaintext = alloc_buffer(len);
1747 	outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1748 	outbuf = malloc(outbuf_cap);
1749 
1750 	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1751 
1752 	ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1753 	    sizeof(*en)) == 0);
1754 	check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1755 
1756 	fd_set_blocking(sockets[0]);
1757 	fd_set_blocking(sockets[1]);
1758 
1759 	outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1760 	    plaintext, len, outbuf, outbuf_cap, 0);
1761 
1762 	rv = write(sockets[1], outbuf, outbuf_len / 2);
1763 	ATF_REQUIRE_INTEQ((ssize_t)(outbuf_len / 2), rv);
1764 
1765 	ATF_REQUIRE(shutdown(sockets[1], SHUT_WR) == 0);
1766 
1767 	ktls_receive_tls_error(sockets[0], EMSGSIZE);
1768 
1769 	free(outbuf);
1770 	free(plaintext);
1771 
1772 	close_sockets_ignore_errors(sockets);
1773 }
1774 
1775 static void
test_ktls_receive_bad_major(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1776 test_ktls_receive_bad_major(const atf_tc_t *tc, struct tls_enable *en,
1777     uint64_t seqno, size_t len)
1778 {
1779 	struct tls_record_layer *hdr;
1780 	char *plaintext, *outbuf;
1781 	size_t outbuf_cap, outbuf_len;
1782 	ssize_t rv;
1783 	int sockets[2];
1784 
1785 	ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1786 
1787 	plaintext = alloc_buffer(len);
1788 	outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1789 	outbuf = malloc(outbuf_cap);
1790 
1791 	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1792 
1793 	ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1794 	    sizeof(*en)) == 0);
1795 	check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1796 
1797 	fd_set_blocking(sockets[0]);
1798 	fd_set_blocking(sockets[1]);
1799 
1800 	outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1801 	    plaintext, len, outbuf, outbuf_cap, 0);
1802 
1803 	hdr = (void *)outbuf;
1804 	hdr->tls_vmajor++;
1805 
1806 	rv = write(sockets[1], outbuf, outbuf_len);
1807 	ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1808 
1809 	ktls_receive_tls_error(sockets[0], EINVAL);
1810 
1811 	free(outbuf);
1812 	free(plaintext);
1813 
1814 	close_sockets_ignore_errors(sockets);
1815 }
1816 
1817 static void
test_ktls_receive_bad_minor(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1818 test_ktls_receive_bad_minor(const atf_tc_t *tc, struct tls_enable *en,
1819     uint64_t seqno, size_t len)
1820 {
1821 	struct tls_record_layer *hdr;
1822 	char *plaintext, *outbuf;
1823 	size_t outbuf_cap, outbuf_len;
1824 	ssize_t rv;
1825 	int sockets[2];
1826 
1827 	ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1828 
1829 	plaintext = alloc_buffer(len);
1830 	outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1831 	outbuf = malloc(outbuf_cap);
1832 
1833 	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1834 
1835 	ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1836 	    sizeof(*en)) == 0);
1837 	check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1838 
1839 	fd_set_blocking(sockets[0]);
1840 	fd_set_blocking(sockets[1]);
1841 
1842 	outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1843 	    plaintext, len, outbuf, outbuf_cap, 0);
1844 
1845 	hdr = (void *)outbuf;
1846 	hdr->tls_vminor++;
1847 
1848 	rv = write(sockets[1], outbuf, outbuf_len);
1849 	ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1850 
1851 	ktls_receive_tls_error(sockets[0], EINVAL);
1852 
1853 	free(outbuf);
1854 	free(plaintext);
1855 
1856 	close_sockets_ignore_errors(sockets);
1857 }
1858 
1859 static void
test_ktls_receive_bad_type(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1860 test_ktls_receive_bad_type(const atf_tc_t *tc, struct tls_enable *en,
1861     uint64_t seqno, size_t len)
1862 {
1863 	struct tls_record_layer *hdr;
1864 	char *plaintext, *outbuf;
1865 	size_t outbuf_cap, outbuf_len;
1866 	ssize_t rv;
1867 	int sockets[2];
1868 
1869 	ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1870 	ATF_REQUIRE_INTEQ(TLS_MINOR_VER_THREE, en->tls_vminor);
1871 
1872 	plaintext = alloc_buffer(len);
1873 	outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1874 	outbuf = malloc(outbuf_cap);
1875 
1876 	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1877 
1878 	ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1879 	    sizeof(*en)) == 0);
1880 	check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1881 
1882 	fd_set_blocking(sockets[0]);
1883 	fd_set_blocking(sockets[1]);
1884 
1885 	outbuf_len = encrypt_tls_record(tc, en, 0x21 /* Alert */, seqno,
1886 	    plaintext, len, outbuf, outbuf_cap, 0);
1887 
1888 	hdr = (void *)outbuf;
1889 	hdr->tls_type = TLS_RLTYPE_APP + 1;
1890 
1891 	rv = write(sockets[1], outbuf, outbuf_len);
1892 	ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1893 
1894 	ktls_receive_tls_error(sockets[0], EINVAL);
1895 
1896 	free(outbuf);
1897 	free(plaintext);
1898 
1899 	close_sockets_ignore_errors(sockets);
1900 }
1901 
1902 static void
test_ktls_receive_bad_size(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len)1903 test_ktls_receive_bad_size(const atf_tc_t *tc, struct tls_enable *en,
1904     uint64_t seqno, size_t len)
1905 {
1906 	struct tls_record_layer *hdr;
1907 	char *outbuf;
1908 	size_t outbuf_len;
1909 	ssize_t rv;
1910 	int sockets[2];
1911 
1912 	outbuf_len = sizeof(*hdr) + len;
1913 	outbuf = calloc(1, outbuf_len);
1914 
1915 	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1916 
1917 	ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1918 	    sizeof(*en)) == 0);
1919 	check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1920 
1921 	fd_set_blocking(sockets[0]);
1922 	fd_set_blocking(sockets[1]);
1923 
1924 	hdr = (void *)outbuf;
1925 	hdr->tls_vmajor = en->tls_vmajor;
1926 	if (en->tls_vminor == TLS_MINOR_VER_THREE)
1927 		hdr->tls_vminor = TLS_MINOR_VER_TWO;
1928 	else
1929 		hdr->tls_vminor = en->tls_vminor;
1930 	hdr->tls_type = TLS_RLTYPE_APP;
1931 	hdr->tls_length = htons(len);
1932 
1933 	rv = write(sockets[1], outbuf, outbuf_len);
1934 	ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1935 
1936 	/*
1937 	 * The other end may notice the error and drop the connection
1938 	 * before this executes resulting in shutdown() failing with
1939 	 * either ENOTCONN or ECONNRESET.  Ignore this error if it
1940 	 * occurs.
1941 	 */
1942 	if (shutdown(sockets[1], SHUT_WR) != 0) {
1943 		ATF_REQUIRE_MSG(errno == ENOTCONN || errno == ECONNRESET,
1944 		    "shutdown() failed: %s", strerror(errno));
1945 	}
1946 
1947 	ktls_receive_tls_error(sockets[0], EMSGSIZE);
1948 
1949 	free(outbuf);
1950 
1951 	close_sockets_ignore_errors(sockets);
1952 }
1953 
1954 static void
test_ktls_receive_split_record(const atf_tc_t * tc,struct tls_enable * en,uint64_t seqno,size_t len,size_t first_len)1955 test_ktls_receive_split_record(const atf_tc_t *tc, struct tls_enable *en,
1956     uint64_t seqno, size_t len, size_t first_len)
1957 {
1958 	char *plaintext, *received, *outbuf;
1959 	size_t outbuf_cap, outbuf_len;
1960 	ssize_t rv;
1961 	int sockets[2];
1962 
1963 	ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1964 
1965 	plaintext = alloc_buffer(len);
1966 	received = malloc(len);
1967 	outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1968 	outbuf = malloc(outbuf_cap);
1969 
1970 	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1971 
1972 	ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1973 	    sizeof(*en)) == 0);
1974 	check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1975 
1976 	fd_set_blocking(sockets[0]);
1977 	fd_set_blocking(sockets[1]);
1978 
1979 	outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1980 	    plaintext, len, outbuf, outbuf_cap, 0);
1981 	ATF_REQUIRE(first_len < outbuf_len);
1982 
1983 	tcp_nodelay(sockets[1]);
1984 	rv = write(sockets[1], outbuf, first_len);
1985 	ATF_REQUIRE_INTEQ((ssize_t)(first_len), rv);
1986 
1987 	rv = write(sockets[1], outbuf + first_len, outbuf_len - first_len);
1988 	ATF_REQUIRE_INTEQ((ssize_t)(outbuf_len - first_len), rv);
1989 
1990 	rv = ktls_receive_tls_record(en, sockets[0], TLS_RLTYPE_APP, received,
1991 	    len);
1992 	ATF_REQUIRE_INTEQ((ssize_t)len, rv);
1993 
1994 	ATF_REQUIRE(memcmp(plaintext, received, len) == 0);
1995 
1996 	free(outbuf);
1997 	free(received);
1998 	free(plaintext);
1999 
2000 	close_sockets(sockets);
2001 }
2002 
2003 #define	TLS_10_TESTS(M)							\
2004 	M(aes128_cbc_1_0_sha1, CRYPTO_AES_CBC, 128 / 8,			\
2005 	    CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO)			\
2006 	M(aes256_cbc_1_0_sha1, CRYPTO_AES_CBC, 256 / 8,			\
2007 	    CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO)
2008 
2009 #define	TLS_13_TESTS(M)							\
2010 	M(aes128_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,		\
2011 	    TLS_MINOR_VER_THREE)					\
2012 	M(aes256_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0,		\
2013 	    TLS_MINOR_VER_THREE)					\
2014 	M(chacha20_poly1305_1_3, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0,	\
2015 	    TLS_MINOR_VER_THREE)
2016 
2017 #define	AES_CBC_NONZERO_TESTS(M)					\
2018 	M(aes128_cbc_1_1_sha1, CRYPTO_AES_CBC, 128 / 8,			\
2019 	    CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ONE)			\
2020 	M(aes256_cbc_1_1_sha1, CRYPTO_AES_CBC, 256 / 8,			\
2021 	    CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ONE)			\
2022 	M(aes128_cbc_1_2_sha1, CRYPTO_AES_CBC, 128 / 8,			\
2023 	    CRYPTO_SHA1_HMAC, TLS_MINOR_VER_TWO)			\
2024 	M(aes256_cbc_1_2_sha1, CRYPTO_AES_CBC, 256 / 8,			\
2025 	    CRYPTO_SHA1_HMAC, TLS_MINOR_VER_TWO)			\
2026 	M(aes128_cbc_1_2_sha256, CRYPTO_AES_CBC, 128 / 8,		\
2027 	    CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_TWO)			\
2028 	M(aes256_cbc_1_2_sha256, CRYPTO_AES_CBC, 256 / 8,		\
2029 	    CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_TWO)			\
2030 	M(aes128_cbc_1_2_sha384, CRYPTO_AES_CBC, 128 / 8,		\
2031 	    CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_TWO)			\
2032 	M(aes256_cbc_1_2_sha384, CRYPTO_AES_CBC, 256 / 8,		\
2033 	    CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_TWO)			\
2034 
2035 #define	AES_CBC_TESTS(M)						\
2036 	TLS_10_TESTS(M)							\
2037 	AES_CBC_NONZERO_TESTS(M)
2038 
2039 #define AES_GCM_12_TESTS(M)						\
2040 	M(aes128_gcm_1_2, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,		\
2041 	    TLS_MINOR_VER_TWO)						\
2042 	M(aes256_gcm_1_2, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0,		\
2043 	    TLS_MINOR_VER_TWO)
2044 
2045 #define AES_GCM_TESTS(M)						\
2046 	AES_GCM_12_TESTS(M)						\
2047 	M(aes128_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,		\
2048 	    TLS_MINOR_VER_THREE)					\
2049 	M(aes256_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0,		\
2050 	    TLS_MINOR_VER_THREE)
2051 
2052 #define CHACHA20_TESTS(M)						\
2053 	M(chacha20_poly1305_1_2, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0,	\
2054 	    TLS_MINOR_VER_TWO)						\
2055 	M(chacha20_poly1305_1_3, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0,	\
2056 	    TLS_MINOR_VER_THREE)
2057 
2058 #define GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2059 	    auth_alg, minor, name, len)					\
2060 ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_##name);		\
2061 ATF_TC_BODY(ktls_transmit_##cipher_name##_##name, tc)			\
2062 {									\
2063 	struct tls_enable en;						\
2064 	uint64_t seqno;							\
2065 									\
2066 	ATF_REQUIRE_KTLS();						\
2067 	seqno = random();						\
2068 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2069 	    seqno, &en);						\
2070 	test_ktls_transmit_app_data(tc, &en, seqno, len);		\
2071 	free_tls_enable(&en);						\
2072 }
2073 
2074 #define ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2075 	    auth_alg, minor, name)					\
2076 	ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_##name);
2077 
2078 #define GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2079 	    auth_alg, minor, name, type, len)				\
2080 ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_##name);		\
2081 ATF_TC_BODY(ktls_transmit_##cipher_name##_##name, tc)			\
2082 {									\
2083 	struct tls_enable en;						\
2084 	uint64_t seqno;							\
2085 									\
2086 	ATF_REQUIRE_KTLS();						\
2087 	seqno = random();						\
2088 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2089 	    seqno, &en);						\
2090 	test_ktls_transmit_control(tc, &en, seqno, type, len);		\
2091 	free_tls_enable(&en);						\
2092 }
2093 
2094 #define ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2095 	    auth_alg, minor, name)					\
2096 	ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_##name);
2097 
2098 #define GEN_TRANSMIT_EMPTY_FRAGMENT_TEST(cipher_name, cipher_alg,	\
2099 	    key_size, auth_alg, minor)					\
2100 ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_empty_fragment);	\
2101 ATF_TC_BODY(ktls_transmit_##cipher_name##_empty_fragment, tc)		\
2102 {									\
2103 	struct tls_enable en;						\
2104 	uint64_t seqno;							\
2105 									\
2106 	ATF_REQUIRE_KTLS();						\
2107 	seqno = random();						\
2108 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2109 	    seqno, &en);						\
2110 	test_ktls_transmit_empty_fragment(tc, &en, seqno);		\
2111 	free_tls_enable(&en);						\
2112 }
2113 
2114 #define ADD_TRANSMIT_EMPTY_FRAGMENT_TEST(cipher_name, cipher_alg,	\
2115 	    key_size, auth_alg, minor)					\
2116 	ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_empty_fragment);
2117 
2118 #define GEN_TRANSMIT_TESTS(cipher_name, cipher_alg, key_size, auth_alg,	\
2119 	    minor)							\
2120 	GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2121 	    auth_alg, minor, short, 64)					\
2122 	GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2123 	    auth_alg, minor, long, 64 * 1024)				\
2124 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2125 	    auth_alg, minor, control, 0x21 /* Alert */, 32)
2126 
2127 #define ADD_TRANSMIT_TESTS(cipher_name, cipher_alg, key_size, auth_alg,	\
2128 	    minor)							\
2129 	ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2130 	    auth_alg, minor, short)					\
2131 	ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2132 	    auth_alg, minor, long)					\
2133 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2134 	    auth_alg, minor, control)
2135 
2136 /*
2137  * For each supported cipher suite, run three transmit tests:
2138  *
2139  * - a short test which sends 64 bytes of application data (likely as
2140  *   a single TLS record)
2141  *
2142  * - a long test which sends 64KB of application data (split across
2143  *   multiple TLS records)
2144  *
2145  * - a control test which sends a single record with a specific
2146  *   content type via sendmsg()
2147  */
2148 AES_CBC_TESTS(GEN_TRANSMIT_TESTS);
2149 AES_GCM_TESTS(GEN_TRANSMIT_TESTS);
2150 CHACHA20_TESTS(GEN_TRANSMIT_TESTS);
2151 
2152 #define GEN_TRANSMIT_PADDING_TESTS(cipher_name, cipher_alg, key_size,	\
2153 	    auth_alg, minor)						\
2154 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2155 	    auth_alg, minor, padding_1, 0x21 /* Alert */, 1)		\
2156 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2157 	    auth_alg, minor, padding_2, 0x21 /* Alert */, 2)		\
2158 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2159 	    auth_alg, minor, padding_3, 0x21 /* Alert */, 3)		\
2160 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2161 	    auth_alg, minor, padding_4, 0x21 /* Alert */, 4)		\
2162 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2163 	    auth_alg, minor, padding_5, 0x21 /* Alert */, 5)		\
2164 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2165 	    auth_alg, minor, padding_6, 0x21 /* Alert */, 6)		\
2166 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2167 	    auth_alg, minor, padding_7, 0x21 /* Alert */, 7)		\
2168 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2169 	    auth_alg, minor, padding_8, 0x21 /* Alert */, 8)		\
2170 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2171 	    auth_alg, minor, padding_9, 0x21 /* Alert */, 9)		\
2172 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2173 	    auth_alg, minor, padding_10, 0x21 /* Alert */, 10)		\
2174 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2175 	    auth_alg, minor, padding_11, 0x21 /* Alert */, 11)		\
2176 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2177 	    auth_alg, minor, padding_12, 0x21 /* Alert */, 12)		\
2178 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2179 	    auth_alg, minor, padding_13, 0x21 /* Alert */, 13)		\
2180 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2181 	    auth_alg, minor, padding_14, 0x21 /* Alert */, 14)		\
2182 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2183 	    auth_alg, minor, padding_15, 0x21 /* Alert */, 15)		\
2184 	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2185 	    auth_alg, minor, padding_16, 0x21 /* Alert */, 16)
2186 
2187 #define ADD_TRANSMIT_PADDING_TESTS(cipher_name, cipher_alg, key_size,	\
2188 	    auth_alg, minor)						\
2189 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2190 	    auth_alg, minor, padding_1)					\
2191 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2192 	    auth_alg, minor, padding_2)					\
2193 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2194 	    auth_alg, minor, padding_3)					\
2195 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2196 	    auth_alg, minor, padding_4)					\
2197 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2198 	    auth_alg, minor, padding_5)					\
2199 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2200 	    auth_alg, minor, padding_6)					\
2201 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2202 	    auth_alg, minor, padding_7)					\
2203 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2204 	    auth_alg, minor, padding_8)					\
2205 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2206 	    auth_alg, minor, padding_9)					\
2207 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2208 	    auth_alg, minor, padding_10)				\
2209 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2210 	    auth_alg, minor, padding_11)				\
2211 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2212 	    auth_alg, minor, padding_12)				\
2213 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2214 	    auth_alg, minor, padding_13)				\
2215 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2216 	    auth_alg, minor, padding_14)				\
2217 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2218 	    auth_alg, minor, padding_15)				\
2219 	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2220 	    auth_alg, minor, padding_16)
2221 
2222 /*
2223  * For AES-CBC MTE cipher suites using padding, add tests of messages
2224  * with each possible padding size.  Note that the padding_<N> tests
2225  * do not necessarily test <N> bytes of padding as the padding is a
2226  * function of the cipher suite's MAC length.  However, cycling
2227  * through all of the payload sizes from 1 to 16 should exercise all
2228  * of the possible padding lengths for each suite.
2229  */
2230 AES_CBC_TESTS(GEN_TRANSMIT_PADDING_TESTS);
2231 
2232 /*
2233  * Test "empty fragments" which are TLS records with no payload that
2234  * OpenSSL can send for TLS 1.0 connections.
2235  */
2236 AES_CBC_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST);
2237 AES_GCM_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST);
2238 CHACHA20_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST);
2239 
2240 static void
test_ktls_invalid_transmit_cipher_suite(const atf_tc_t * tc,struct tls_enable * en)2241 test_ktls_invalid_transmit_cipher_suite(const atf_tc_t *tc,
2242     struct tls_enable *en)
2243 {
2244 	int sockets[2];
2245 
2246 	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
2247 
2248 	ATF_REQUIRE_ERRNO(EINVAL, setsockopt(sockets[1], IPPROTO_TCP,
2249 	    TCP_TXTLS_ENABLE, en, sizeof(*en)) == -1);
2250 
2251 	close_sockets(sockets);
2252 }
2253 
2254 #define GEN_INVALID_TRANSMIT_TEST(name, cipher_alg, key_size, auth_alg,	\
2255 	    minor)							\
2256 ATF_TC_WITHOUT_HEAD(ktls_transmit_invalid_##name);			\
2257 ATF_TC_BODY(ktls_transmit_invalid_##name, tc)				\
2258 {									\
2259 	struct tls_enable en;						\
2260 	uint64_t seqno;							\
2261 									\
2262 	ATF_REQUIRE_KTLS();						\
2263 	seqno = random();						\
2264 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2265 	    seqno, &en);						\
2266 	test_ktls_invalid_transmit_cipher_suite(tc, &en);		\
2267 	free_tls_enable(&en);						\
2268 }
2269 
2270 #define ADD_INVALID_TRANSMIT_TEST(name, cipher_alg, key_size, auth_alg, \
2271 	    minor)							\
2272 	ATF_TP_ADD_TC(tp, ktls_transmit_invalid_##name);
2273 
2274 #define	INVALID_CIPHER_SUITES(M)					\
2275 	M(aes128_cbc_1_0_sha256, CRYPTO_AES_CBC, 128 / 8,		\
2276 	    CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_ZERO)			\
2277 	M(aes128_cbc_1_0_sha384, CRYPTO_AES_CBC, 128 / 8,		\
2278 	    CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_ZERO)			\
2279 	M(aes128_gcm_1_0, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,		\
2280 	    TLS_MINOR_VER_ZERO)						\
2281 	M(chacha20_poly1305_1_0, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0,	\
2282 	    TLS_MINOR_VER_ZERO)						\
2283 	M(aes128_cbc_1_1_sha256, CRYPTO_AES_CBC, 128 / 8,		\
2284 	    CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_ONE)			\
2285 	M(aes128_cbc_1_1_sha384, CRYPTO_AES_CBC, 128 / 8,		\
2286 	    CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_ONE)			\
2287 	M(aes128_gcm_1_1, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,		\
2288 	    TLS_MINOR_VER_ONE)						\
2289 	M(chacha20_poly1305_1_1, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0,	\
2290 	    TLS_MINOR_VER_ONE)						\
2291 	M(aes128_cbc_1_3_sha1, CRYPTO_AES_CBC, 128 / 8,			\
2292 	    CRYPTO_SHA1_HMAC, TLS_MINOR_VER_THREE)			\
2293 	M(aes128_cbc_1_3_sha256, CRYPTO_AES_CBC, 128 / 8,		\
2294 	    CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_THREE)			\
2295 	M(aes128_cbc_1_3_sha384, CRYPTO_AES_CBC, 128 / 8,		\
2296 	    CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_THREE)
2297 
2298 /*
2299  * Ensure that invalid cipher suites are rejected for transmit.
2300  */
2301 INVALID_CIPHER_SUITES(GEN_INVALID_TRANSMIT_TEST);
2302 
2303 #define GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2304 	    auth_alg, minor, name, len, padding)			\
2305 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_##name);		\
2306 ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc)			\
2307 {									\
2308 	struct tls_enable en;						\
2309 	uint64_t seqno;							\
2310 									\
2311 	ATF_REQUIRE_KTLS_RX();						\
2312 	seqno = random();						\
2313 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2314 	    seqno, &en);						\
2315 	test_ktls_receive_app_data(tc, &en, seqno, len, padding);	\
2316 	free_tls_enable(&en);						\
2317 }
2318 
2319 #define ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2320 	    auth_alg, minor, name)					\
2321 	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name);
2322 
2323 #define GEN_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2324 	    auth_alg, minor, len)					\
2325 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_data);		\
2326 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_data, tc)			\
2327 {									\
2328 	struct tls_enable en;						\
2329 	uint64_t seqno;							\
2330 									\
2331 	ATF_REQUIRE_KTLS_RX();						\
2332 	seqno = random();						\
2333 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2334 	    seqno, &en);						\
2335 	test_ktls_receive_corrupted_data(tc, &en, seqno, len);		\
2336 	free_tls_enable(&en);						\
2337 }
2338 
2339 #define ADD_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2340 	    auth_alg, minor)						\
2341 	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_data);
2342 
2343 #define GEN_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size,	\
2344 	    auth_alg, minor, len)					\
2345 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_mac);		\
2346 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_mac, tc)			\
2347 {									\
2348 	struct tls_enable en;						\
2349 	uint64_t seqno;							\
2350 									\
2351 	ATF_REQUIRE_KTLS_RX();						\
2352 	seqno = random();						\
2353 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2354 	    seqno, &en);						\
2355 	test_ktls_receive_corrupted_mac(tc, &en, seqno, len);		\
2356 	free_tls_enable(&en);						\
2357 }
2358 
2359 #define ADD_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size,	\
2360 	    auth_alg, minor)						\
2361 	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_mac);
2362 
2363 #define GEN_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size,	\
2364 	    auth_alg, minor, len)					\
2365 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_truncated_record);	\
2366 ATF_TC_BODY(ktls_receive_##cipher_name##_truncated_record, tc)		\
2367 {									\
2368 	struct tls_enable en;						\
2369 	uint64_t seqno;							\
2370 									\
2371 	ATF_REQUIRE_KTLS_RX();						\
2372 	seqno = random();						\
2373 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2374 	    seqno, &en);						\
2375 	test_ktls_receive_truncated_record(tc, &en, seqno, len);	\
2376 	free_tls_enable(&en);						\
2377 }
2378 
2379 #define ADD_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size,	\
2380 	    auth_alg, minor)						\
2381 	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_truncated_record);
2382 
2383 #define GEN_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size,	\
2384 	    auth_alg, minor, len)					\
2385 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_major);		\
2386 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_major, tc)			\
2387 {									\
2388 	struct tls_enable en;						\
2389 	uint64_t seqno;							\
2390 									\
2391 	ATF_REQUIRE_KTLS_RX();						\
2392 	seqno = random();						\
2393 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2394 	    seqno, &en);						\
2395 	test_ktls_receive_bad_major(tc, &en, seqno, len);		\
2396 	free_tls_enable(&en);						\
2397 }
2398 
2399 #define ADD_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size,	\
2400 	    auth_alg, minor)						\
2401 	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_major);
2402 
2403 #define GEN_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size,	\
2404 	    auth_alg, minor, len)					\
2405 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_minor);		\
2406 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_minor, tc)			\
2407 {									\
2408 	struct tls_enable en;						\
2409 	uint64_t seqno;							\
2410 									\
2411 	ATF_REQUIRE_KTLS_RX();						\
2412 	seqno = random();						\
2413 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2414 	    seqno, &en);						\
2415 	test_ktls_receive_bad_minor(tc, &en, seqno, len);		\
2416 	free_tls_enable(&en);						\
2417 }
2418 
2419 #define ADD_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size,	\
2420 	    auth_alg, minor)						\
2421 	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_minor);
2422 
2423 #define GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2424 	    auth_alg, minor, name, len)					\
2425 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_##name);		\
2426 ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc)			\
2427 {									\
2428 	struct tls_enable en;						\
2429 	uint64_t seqno;							\
2430 									\
2431 	ATF_REQUIRE_KTLS_RX();						\
2432 	seqno = random();						\
2433 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2434 	    seqno, &en);						\
2435 	test_ktls_receive_bad_size(tc, &en, seqno, (len));		\
2436 	free_tls_enable(&en);						\
2437 }
2438 
2439 #define ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2440 	    auth_alg, minor, name)					\
2441 	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name);
2442 
2443 #define GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg,		\
2444 	    key_size, auth_alg, minor, name, len, first_len)		\
2445 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_split_##name);		\
2446 ATF_TC_BODY(ktls_receive_##cipher_name##_split_##name, tc)		\
2447 {									\
2448 	struct tls_enable en;						\
2449 	uint64_t seqno;							\
2450 									\
2451 	ATF_REQUIRE_KTLS_RX();						\
2452 	seqno = random();						\
2453 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2454 	    seqno, &en);						\
2455 	test_ktls_receive_split_record(tc, &en, seqno, len, first_len);	\
2456 	free_tls_enable(&en);						\
2457 }
2458 
2459 #define ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg,		\
2460 	    key_size, auth_alg, minor, name)				\
2461 	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_split_##name);
2462 
2463 #define GEN_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg,	\
2464 	    minor)							\
2465 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2466 	    auth_alg, minor, short, 64, 0)				\
2467 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2468 	    auth_alg, minor, long, 64 * 1024, 0)			\
2469 	GEN_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2470 	    auth_alg, minor, 64)					\
2471 	GEN_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size,	\
2472 	    auth_alg, minor, 64)					\
2473 	GEN_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size,	\
2474 	    auth_alg, minor, 64)					\
2475 	GEN_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size,	\
2476 	    auth_alg, minor, 64)					\
2477 	GEN_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size,	\
2478 	    auth_alg, minor, 64)					\
2479 	GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2480 	    auth_alg, minor, small_record,				\
2481 	    tls_minimum_record_payload(&en) - 1)			\
2482 	GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2483 	    auth_alg, minor, oversized_record,				\
2484 	    TLS_MAX_MSG_SIZE_V10_2 * 2)					\
2485 	GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg,		\
2486 	    key_size, auth_alg, minor, header, 64,			\
2487 	    sizeof(struct tls_record_layer));				\
2488 	GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg,		\
2489 	    key_size, auth_alg, minor, full_header, 64,			\
2490 	    tls_header_len(&en));					\
2491 	GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg,		\
2492 	    key_size, auth_alg, minor, half, 64,			\
2493 	    tls_header_len(&en) + 32);					\
2494 	GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg,		\
2495 	    key_size, auth_alg, minor, trailer_start, 64,		\
2496 	    tls_header_len(&en) + 64);					\
2497 	GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg,		\
2498 	    key_size, auth_alg, minor, trailer_middle, 64,		\
2499 	    tls_header_len(&en) + 64 + tls_trailer_len(&en) / 2);
2500 
2501 #define ADD_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg,	\
2502 	    minor)							\
2503 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2504 	    auth_alg, minor, short)					\
2505 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2506 	    auth_alg, minor, long)					\
2507 	ADD_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2508 	    auth_alg, minor)						\
2509 	ADD_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size,	\
2510 	    auth_alg, minor)						\
2511 	ADD_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size,	\
2512 	    auth_alg, minor)						\
2513 	ADD_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size,	\
2514 	    auth_alg, minor)						\
2515 	ADD_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size,	\
2516 	    auth_alg, minor)						\
2517 	ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2518 	    auth_alg, minor, small_record)				\
2519 	ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2520 	    auth_alg, minor, oversized_record)				\
2521 	ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg,		\
2522 	    key_size, auth_alg, minor, header)				\
2523 	ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg,		\
2524 	    key_size, auth_alg, minor, full_header)			\
2525 	ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg,		\
2526 	    key_size, auth_alg, minor, half)				\
2527 	ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg,		\
2528 	    key_size, auth_alg, minor, trailer_start)			\
2529 	ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg,		\
2530 	    key_size, auth_alg, minor, trailer_middle)			\
2531 
2532 /*
2533  * For each supported cipher suite, run several receive tests:
2534  *
2535  * - a short test which sends 64 bytes of application data (likely as
2536  *   a single TLS record)
2537  *
2538  * - a long test which sends 64KB of application data (split across
2539  *   multiple TLS records)
2540  *
2541  * - a test with corrupted payload data in a single TLS record
2542  *
2543  * - a test with a corrupted MAC in a single TLS record
2544  *
2545  * - a test with a truncated TLS record
2546  *
2547  * - tests with invalid TLS major and minor versions
2548  *
2549  * - a tests with a record whose is one less than the smallest valid
2550  *   size
2551  *
2552  * - a test with an oversized TLS record
2553  *
2554  * - tests of a single record whose data is split across two writes,
2555  *   with each test using a different split point
2556  */
2557 AES_CBC_NONZERO_TESTS(GEN_RECEIVE_TESTS);
2558 AES_GCM_TESTS(GEN_RECEIVE_TESTS);
2559 CHACHA20_TESTS(GEN_RECEIVE_TESTS);
2560 
2561 #define	GEN_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg,		\
2562 	    key_size, auth_alg, minor)					\
2563 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2564 	    auth_alg, minor, padding_1, 1, 0)				\
2565 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2566 	    auth_alg, minor, padding_2, 2, 0)				\
2567 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2568 	    auth_alg, minor, padding_3, 3, 0)				\
2569 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2570 	    auth_alg, minor, padding_4, 4, 0)				\
2571 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2572 	    auth_alg, minor, padding_5, 5, 0)				\
2573 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2574 	    auth_alg, minor, padding_6, 6, 0)				\
2575 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2576 	    auth_alg, minor, padding_7, 7, 0)				\
2577 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2578 	    auth_alg, minor, padding_8, 8, 0)				\
2579 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2580 	    auth_alg, minor, padding_9, 9, 0)				\
2581 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2582 	    auth_alg, minor, padding_10, 10, 0)				\
2583 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2584 	    auth_alg, minor, padding_11, 11, 0)				\
2585 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2586 	    auth_alg, minor, padding_12, 12, 0)				\
2587 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2588 	    auth_alg, minor, padding_13, 13, 0)				\
2589 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2590 	    auth_alg, minor, padding_14, 14, 0)				\
2591 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2592 	    auth_alg, minor, padding_15, 15, 0)				\
2593 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2594 	    auth_alg, minor, padding_16, 16, 0)				\
2595 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2596 	    auth_alg, minor, padding_16_extra, 16, 16)			\
2597 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2598 	    auth_alg, minor, padding_32_extra, 16, 32)
2599 
2600 #define ADD_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg,		\
2601 	    key_size, auth_alg, minor)					\
2602 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2603 	    auth_alg, minor, padding_1)					\
2604 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2605 	    auth_alg, minor, padding_2)					\
2606 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2607 	    auth_alg, minor, padding_3)					\
2608 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2609 	    auth_alg, minor, padding_4)					\
2610 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2611 	    auth_alg, minor, padding_5)					\
2612 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2613 	    auth_alg, minor, padding_6)					\
2614 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2615 	    auth_alg, minor, padding_7)					\
2616 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2617 	    auth_alg, minor, padding_8)					\
2618 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2619 	    auth_alg, minor, padding_9)					\
2620 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2621 	    auth_alg, minor, padding_10)				\
2622 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2623 	    auth_alg, minor, padding_11)				\
2624 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2625 	    auth_alg, minor, padding_12)				\
2626 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2627 	    auth_alg, minor, padding_13)				\
2628 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2629 	    auth_alg, minor, padding_14)				\
2630 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2631 	    auth_alg, minor, padding_15)				\
2632 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2633 	    auth_alg, minor, padding_16)				\
2634 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2635 	    auth_alg, minor, padding_16_extra)				\
2636 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2637 	    auth_alg, minor, padding_32_extra)
2638 
2639 #define GEN_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size,	\
2640 	    auth_alg, minor, len)					\
2641 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_padding);		\
2642 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_padding, tc)		\
2643 {									\
2644 	struct tls_enable en;						\
2645 	uint64_t seqno;							\
2646 									\
2647 	ATF_REQUIRE_KTLS_RX();						\
2648 	seqno = random();						\
2649 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2650 	    seqno, &en);						\
2651 	test_ktls_receive_corrupted_padding(tc, &en, seqno, len);	\
2652 	free_tls_enable(&en);						\
2653 }
2654 
2655 #define ADD_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size,	\
2656 	    auth_alg, minor)						\
2657 	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_padding);
2658 
2659 #define	GEN_RECEIVE_MTE_TESTS(cipher_name, cipher_alg, key_size,	\
2660 	    auth_alg, minor)						\
2661 	GEN_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg,		\
2662 	    key_size, auth_alg, minor)					\
2663 	GEN_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size,	\
2664 	    auth_alg, minor, 64)					\
2665 	GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2666 	    auth_alg, minor, non_block_size,				\
2667 	    tls_minimum_record_payload(&en) + 1)
2668 
2669 #define	ADD_RECEIVE_MTE_TESTS(cipher_name, cipher_alg, key_size,	\
2670 	    auth_alg, minor)						\
2671 	ADD_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg,		\
2672 	    key_size, auth_alg, minor)					\
2673 	ADD_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size,	\
2674 	    auth_alg, minor)						\
2675 	ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2676 	    auth_alg, minor, non_block_size)
2677 
2678 /*
2679  * For AES-CBC MTE cipher suites using padding, add tests of messages
2680  * with each possible padding size.  Note that the padding_<N> tests
2681  * do not necessarily test <N> bytes of padding as the padding is a
2682  * function of the cipher suite's MAC length.  However, cycling
2683  * through all of the payload sizes from 1 to 16 should exercise all
2684  * of the possible padding lengths for each suite.
2685  *
2686  * Two additional tests check for additional padding with an extra
2687  * 16 or 32 bytes beyond the normal padding.
2688  *
2689  * Another test checks for corrupted padding.
2690  *
2691  * Another test checks for a record whose payload is not a multiple of
2692  * the AES block size.
2693  */
2694 AES_CBC_NONZERO_TESTS(GEN_RECEIVE_MTE_TESTS);
2695 
2696 #define GEN_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size,	\
2697 	    auth_alg, minor)						\
2698 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_iv);		\
2699 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_iv, tc)			\
2700 {									\
2701 	struct tls_enable en;						\
2702 	uint64_t seqno;							\
2703 									\
2704 	ATF_REQUIRE_KTLS_RX();						\
2705 	seqno = random();						\
2706 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2707 	    seqno, &en);						\
2708 	test_ktls_receive_corrupted_iv(tc, &en, seqno, 64);		\
2709 	free_tls_enable(&en);						\
2710 }
2711 
2712 #define ADD_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size,	\
2713 	    auth_alg, minor)						\
2714 	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_iv);
2715 
2716 #define	GEN_RECEIVE_EXPLICIT_IV_TESTS(cipher_name, cipher_alg,		\
2717 	    key_size, auth_alg, minor)					\
2718 	GEN_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size,	\
2719 	    auth_alg, minor)						\
2720 	GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2721 	    auth_alg, minor, short_header,				\
2722 	    sizeof(struct tls_record_layer) + 1)
2723 
2724 #define	ADD_RECEIVE_EXPLICIT_IV_TESTS(cipher_name, cipher_alg,		\
2725 	    key_size, auth_alg, minor)					\
2726 	ADD_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size,	\
2727 	    auth_alg, minor)						\
2728 	ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2729 	    auth_alg, minor, short_header)
2730 
2731 /*
2732  * For cipher suites with an explicit IV, run a receive test where the
2733  * explicit IV has been corrupted.  Also run a receive test that sends
2734  * a short record without a complete IV.
2735  */
2736 AES_CBC_NONZERO_TESTS(GEN_RECEIVE_EXPLICIT_IV_TESTS);
2737 AES_GCM_12_TESTS(GEN_RECEIVE_EXPLICIT_IV_TESTS);
2738 
2739 #define GEN_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size,	\
2740 	    auth_alg, minor, len)					\
2741 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_type);		\
2742 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_type, tc)			\
2743 {									\
2744 	struct tls_enable en;						\
2745 	uint64_t seqno;							\
2746 									\
2747 	ATF_REQUIRE_KTLS_RX();						\
2748 	seqno = random();						\
2749 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2750 	    seqno, &en);						\
2751 	test_ktls_receive_bad_type(tc, &en, seqno, len);		\
2752 	free_tls_enable(&en);						\
2753 }
2754 
2755 #define ADD_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size,	\
2756 	    auth_alg, minor)						\
2757 	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_type);
2758 
2759 #define GEN_RECEIVE_TLS13_TESTS(cipher_name, cipher_alg, key_size,	\
2760 	    auth_alg, minor)						\
2761 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2762 	    auth_alg, minor, short_padded, 64, 16)			\
2763 	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2764 	    auth_alg, minor, long_padded, 64 * 1024, 15)		\
2765 	GEN_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size,	\
2766 	    auth_alg, minor, 64)
2767 
2768 #define ADD_RECEIVE_TLS13_TESTS(cipher_name, cipher_alg, key_size,	\
2769 	    auth_alg, minor)						\
2770 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2771 	    auth_alg, minor, short_padded)				\
2772 	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2773 	    auth_alg, minor, long_padded)				\
2774 	ADD_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size,	\
2775 	    auth_alg, minor)
2776 
2777 /*
2778  * For TLS 1.3 cipher suites, run two additional receive tests which
2779  * use add padding to each record.  Also run a test that uses an
2780  * invalid "outer" record type.
2781  */
2782 TLS_13_TESTS(GEN_RECEIVE_TLS13_TESTS);
2783 
2784 static void
test_ktls_invalid_receive_cipher_suite(const atf_tc_t * tc,struct tls_enable * en)2785 test_ktls_invalid_receive_cipher_suite(const atf_tc_t *tc,
2786     struct tls_enable *en)
2787 {
2788 	int sockets[2];
2789 
2790 	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
2791 
2792 	ATF_REQUIRE_ERRNO(EINVAL, setsockopt(sockets[1], IPPROTO_TCP,
2793 	    TCP_RXTLS_ENABLE, en, sizeof(*en)) == -1);
2794 
2795 	close_sockets(sockets);
2796 }
2797 
2798 #define GEN_INVALID_RECEIVE_TEST(name, cipher_alg, key_size, auth_alg,	\
2799 	    minor)							\
2800 ATF_TC_WITHOUT_HEAD(ktls_receive_invalid_##name);			\
2801 ATF_TC_BODY(ktls_receive_invalid_##name, tc)				\
2802 {									\
2803 	struct tls_enable en;						\
2804 	uint64_t seqno;							\
2805 									\
2806 	ATF_REQUIRE_KTLS_RX();						\
2807 	seqno = random();						\
2808 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2809 	    seqno, &en);						\
2810 	test_ktls_invalid_receive_cipher_suite(tc, &en);		\
2811 	free_tls_enable(&en);						\
2812 }
2813 
2814 #define ADD_INVALID_RECEIVE_TEST(name, cipher_alg, key_size, auth_alg,	\
2815 	    minor)							\
2816 	ATF_TP_ADD_TC(tp, ktls_receive_invalid_##name);
2817 
2818 /*
2819  * Ensure that invalid cipher suites are rejected for receive.
2820  */
2821 INVALID_CIPHER_SUITES(GEN_INVALID_RECEIVE_TEST);
2822 
2823 static void
test_ktls_unsupported_receive_cipher_suite(const atf_tc_t * tc,struct tls_enable * en)2824 test_ktls_unsupported_receive_cipher_suite(const atf_tc_t *tc,
2825     struct tls_enable *en)
2826 {
2827 	int sockets[2];
2828 
2829 	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
2830 
2831 	ATF_REQUIRE_ERRNO(EPROTONOSUPPORT, setsockopt(sockets[1], IPPROTO_TCP,
2832 	    TCP_RXTLS_ENABLE, en, sizeof(*en)) == -1);
2833 
2834 	close_sockets(sockets);
2835 }
2836 
2837 #define GEN_UNSUPPORTED_RECEIVE_TEST(name, cipher_alg, key_size,	\
2838 	    auth_alg, minor)						\
2839 ATF_TC_WITHOUT_HEAD(ktls_receive_unsupported_##name);			\
2840 ATF_TC_BODY(ktls_receive_unsupported_##name, tc)			\
2841 {									\
2842 	struct tls_enable en;						\
2843 	uint64_t seqno;							\
2844 									\
2845 	ATF_REQUIRE_KTLS_RX();						\
2846 	seqno = random();						\
2847 	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2848 	    seqno, &en);						\
2849 	test_ktls_unsupported_receive_cipher_suite(tc, &en);		\
2850 	free_tls_enable(&en);						\
2851 }
2852 
2853 #define ADD_UNSUPPORTED_RECEIVE_TEST(name, cipher_alg, key_size,	\
2854 	    auth_alg, minor)						\
2855 	ATF_TP_ADD_TC(tp, ktls_receive_unsupported_##name);
2856 
2857 /*
2858  * Ensure that valid cipher suites not supported for receive are
2859  * rejected.
2860  */
2861 TLS_10_TESTS(GEN_UNSUPPORTED_RECEIVE_TEST);
2862 
2863 /*
2864  * Try to perform an invalid sendto(2) on a TXTLS-enabled socket, to exercise
2865  * KTLS error handling in the socket layer.
2866  */
2867 ATF_TC_WITHOUT_HEAD(ktls_sendto_baddst);
ATF_TC_BODY(ktls_sendto_baddst,tc)2868 ATF_TC_BODY(ktls_sendto_baddst, tc)
2869 {
2870 	char buf[32];
2871 	struct sockaddr_in dst;
2872 	struct tls_enable en;
2873 	ssize_t n;
2874 	int s;
2875 
2876 	ATF_REQUIRE_KTLS();
2877 
2878 	s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
2879 	ATF_REQUIRE(s >= 0);
2880 
2881 	build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
2882 	    TLS_MINOR_VER_THREE, (uint64_t)random(), &en);
2883 
2884 	ATF_REQUIRE(setsockopt(s, IPPROTO_TCP, TCP_TXTLS_ENABLE, &en,
2885 	    sizeof(en)) == 0);
2886 
2887 	memset(&dst, 0, sizeof(dst));
2888 	dst.sin_family = AF_INET;
2889 	dst.sin_len = sizeof(dst);
2890 	dst.sin_addr.s_addr = htonl(INADDR_BROADCAST);
2891 	dst.sin_port = htons(12345);
2892 
2893 	memset(buf, 0, sizeof(buf));
2894 	n = sendto(s, buf, sizeof(buf), 0, (struct sockaddr *)&dst,
2895 	    sizeof(dst));
2896 
2897 	/* Can't transmit to the broadcast address over TCP. */
2898 	ATF_REQUIRE_ERRNO(EACCES, n == -1);
2899 	ATF_REQUIRE(close(s) == 0);
2900 }
2901 
2902 /*
2903  * Make sure that listen(2) returns an error for KTLS-enabled sockets, and
2904  * verify that an attempt to enable KTLS on a listening socket fails.
2905  */
2906 static void
ktls_listening_socket(const atf_tc_t * tc,int optname)2907 ktls_listening_socket(const atf_tc_t *tc, int optname)
2908 {
2909 	struct tls_enable en;
2910 	struct sockaddr_in sin;
2911 	int s;
2912 
2913 	s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
2914 	ATF_REQUIRE(s >= 0);
2915 	build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
2916 	    TLS_MINOR_VER_THREE, (uint64_t)random(), &en);
2917 	ATF_REQUIRE(setsockopt(s, IPPROTO_TCP, optname, &en,
2918 	    sizeof(en)) == 0);
2919 	ATF_REQUIRE_ERRNO(EINVAL, listen(s, 1) == -1);
2920 	ATF_REQUIRE(close(s) == 0);
2921 
2922 	s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
2923 	ATF_REQUIRE(s >= 0);
2924 	memset(&sin, 0, sizeof(sin));
2925 	sin.sin_family = AF_INET;
2926 	sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
2927 	ATF_REQUIRE(bind(s, (struct sockaddr *)&sin, sizeof(sin)) == 0);
2928 	ATF_REQUIRE(listen(s, 1) == 0);
2929 	build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
2930 	    TLS_MINOR_VER_THREE, (uint64_t)random(), &en);
2931 	ATF_REQUIRE_ERRNO(ENOTCONN,
2932 	    setsockopt(s, IPPROTO_TCP, optname, &en, sizeof(en)) != 0);
2933 	ATF_REQUIRE(close(s) == 0);
2934 }
2935 
2936 ATF_TC_WITHOUT_HEAD(ktls_listening_socket_tx);
ATF_TC_BODY(ktls_listening_socket_tx,tc)2937 ATF_TC_BODY(ktls_listening_socket_tx, tc)
2938 {
2939 	ATF_REQUIRE_KTLS();
2940 
2941 	ktls_listening_socket(tc, TCP_TXTLS_ENABLE);
2942 }
2943 
2944 ATF_TC_WITHOUT_HEAD(ktls_listening_socket_rx);
ATF_TC_BODY(ktls_listening_socket_rx,tc)2945 ATF_TC_BODY(ktls_listening_socket_rx, tc)
2946 {
2947 	ATF_REQUIRE_KTLS_RX();
2948 
2949 	ktls_listening_socket(tc, TCP_RXTLS_ENABLE);
2950 }
2951 
2952 /*
2953  * Verify that the KTLS receive path does not overwrite data belonging
2954  * to a file whose payload is transmitted over a loopback connection
2955  * via plain sendfile.
2956  */
2957 ATF_TC_WITHOUT_HEAD(ktls_receive_loopback_sendfile);
ATF_TC_BODY(ktls_receive_loopback_sendfile,tc)2958 ATF_TC_BODY(ktls_receive_loopback_sendfile, tc)
2959 {
2960 	struct tls_enable en;
2961 	struct msghdr msg;
2962 	struct sf_hdtr hdtr;
2963 	struct iovec iov[2];
2964 	uint64_t seqno;
2965 	off_t sbytes;
2966 	char cbuf[CMSG_SPACE(sizeof(struct tls_get_record))];
2967 	char *plaintext, *ciphertext, *outbuf;
2968 	void *p;
2969 	const size_t payload_len = PAGE_SIZE;
2970 	ssize_t rv;
2971 	size_t len;
2972 	int mode, shm, sockets[2];
2973 	socklen_t slen;
2974 
2975 	ATF_REQUIRE_KTLS_RX();
2976 	seqno = random();
2977 	build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
2978 	    TLS_MINOR_VER_TWO, seqno, &en);
2979 
2980 	len = tls_header_len(&en) + payload_len + tls_trailer_len(&en);
2981 	plaintext = alloc_buffer(payload_len);
2982 	ciphertext = malloc(len);
2983 	ATF_REQUIRE_INTEQ(len, encrypt_tls_record(tc, &en, TLS_RLTYPE_APP,
2984 	    seqno, plaintext, payload_len, ciphertext, len, 0));
2985 
2986 	ATF_REQUIRE((shm = shm_open(SHM_ANON, O_RDWR, 0600)) > 0);
2987 	ATF_REQUIRE_INTEQ(0, ftruncate(shm, payload_len));
2988 	ATF_REQUIRE((p = mmap(NULL, payload_len, PROT_READ | PROT_WRITE,
2989 	    MAP_SHARED, shm, 0)) != MAP_FAILED);
2990 	memcpy(p, ciphertext + tls_header_len(&en), payload_len);
2991 
2992 	ATF_REQUIRE_MSG(socketpair_tcp(sockets), "failed to create sockets");
2993 	ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, &en,
2994 	    sizeof(en)) == 0);
2995 	slen = sizeof(mode);
2996 	ATF_REQUIRE_INTEQ(0, getsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_MODE,
2997 	    &mode, &slen));
2998 	ATF_REQUIRE_INTEQ(TCP_TLS_MODE_SW, mode);
2999 
3000 	fd_set_blocking(sockets[0]);
3001 	fd_set_blocking(sockets[1]);
3002 
3003 	iov[0].iov_base = ciphertext;
3004 	iov[0].iov_len = tls_header_len(&en);
3005 	iov[1].iov_base = ciphertext + tls_header_len(&en) + payload_len;
3006 	iov[1].iov_len = tls_trailer_len(&en);
3007 	hdtr.headers = iov;
3008 	hdtr.hdr_cnt = 1;
3009 	hdtr.trailers = iov + 1;
3010 	hdtr.trl_cnt = 1;
3011 	debug_hexdump(tc, p, payload_len, "shm buffer before");
3012 	ATF_REQUIRE_INTEQ(0, sendfile(shm, sockets[1], 0, payload_len, &hdtr,
3013 	    &sbytes, 0));
3014 	ATF_REQUIRE_INTEQ(sbytes, (off_t)len);
3015 
3016 	outbuf = calloc(payload_len, 1);
3017 
3018 	memset(&msg, 0, sizeof(msg));
3019 
3020 	msg.msg_control = cbuf;
3021 	msg.msg_controllen = sizeof(cbuf);
3022 
3023 	iov[0].iov_base = outbuf;
3024 	iov[0].iov_len = payload_len;
3025 	msg.msg_iov = iov;
3026 	msg.msg_iovlen = 1;
3027 
3028 	rv = recvmsg(sockets[0], &msg, 0);
3029 	if (rv >= 0) {
3030 		ATF_REQUIRE_INTEQ(payload_len, rv);
3031 		ATF_REQUIRE_INTEQ(0, memcmp(outbuf, plaintext, payload_len));
3032 	} else
3033 		ATF_REQUIRE_ERRNO(EBADMSG, true);
3034 
3035 	debug_hexdump(tc, p, payload_len, "shm buffer after");
3036 	ATF_REQUIRE_INTEQ(0, memcmp(p, ciphertext + tls_header_len(&en),
3037 	    payload_len));
3038 
3039 	close_sockets_ignore_errors(sockets);
3040 	(void)close(shm);
3041 }
3042 
ATF_TP_ADD_TCS(tp)3043 ATF_TP_ADD_TCS(tp)
3044 {
3045 	/* Transmit tests */
3046 	AES_CBC_TESTS(ADD_TRANSMIT_TESTS);
3047 	AES_GCM_TESTS(ADD_TRANSMIT_TESTS);
3048 	CHACHA20_TESTS(ADD_TRANSMIT_TESTS);
3049 	AES_CBC_TESTS(ADD_TRANSMIT_PADDING_TESTS);
3050 	AES_CBC_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST);
3051 	AES_GCM_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST);
3052 	CHACHA20_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST);
3053 	INVALID_CIPHER_SUITES(ADD_INVALID_TRANSMIT_TEST);
3054 
3055 	/* Receive tests */
3056 	TLS_10_TESTS(ADD_UNSUPPORTED_RECEIVE_TEST);
3057 	AES_CBC_NONZERO_TESTS(ADD_RECEIVE_TESTS);
3058 	AES_GCM_TESTS(ADD_RECEIVE_TESTS);
3059 	CHACHA20_TESTS(ADD_RECEIVE_TESTS);
3060 	AES_CBC_NONZERO_TESTS(ADD_RECEIVE_MTE_TESTS);
3061 	AES_CBC_NONZERO_TESTS(ADD_RECEIVE_EXPLICIT_IV_TESTS);
3062 	AES_GCM_12_TESTS(ADD_RECEIVE_EXPLICIT_IV_TESTS);
3063 	TLS_13_TESTS(ADD_RECEIVE_TLS13_TESTS);
3064 	INVALID_CIPHER_SUITES(ADD_INVALID_RECEIVE_TEST);
3065 
3066 	/* Miscellaneous */
3067 	ATF_TP_ADD_TC(tp, ktls_sendto_baddst);
3068 	ATF_TP_ADD_TC(tp, ktls_listening_socket_tx);
3069 	ATF_TP_ADD_TC(tp, ktls_listening_socket_rx);
3070 	ATF_TP_ADD_TC(tp, ktls_receive_loopback_sendfile);
3071 
3072 	return (atf_no_error());
3073 }
3074