1 /* 2 * Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include "ssl_local.h" 11 #include "internal/ktls.h" 12 13 #ifndef OPENSSL_NO_KTLS_RX 14 /* 15 * Count the number of records that were not processed yet from record boundary. 16 * 17 * This function assumes that there are only fully formed records read in the 18 * record layer. If read_ahead is enabled, then this might be false and this 19 * function will fail. 20 */ 21 static int count_unprocessed_records(SSL *s) 22 { 23 SSL3_BUFFER *rbuf = RECORD_LAYER_get_rbuf(&s->rlayer); 24 PACKET pkt, subpkt; 25 int count = 0; 26 27 if (!PACKET_buf_init(&pkt, rbuf->buf + rbuf->offset, rbuf->left)) 28 return -1; 29 30 while (PACKET_remaining(&pkt) > 0) { 31 /* Skip record type and version */ 32 if (!PACKET_forward(&pkt, 3)) 33 return -1; 34 35 /* Read until next record */ 36 if (!PACKET_get_length_prefixed_2(&pkt, &subpkt)) 37 return -1; 38 39 count += 1; 40 } 41 42 return count; 43 } 44 45 /* 46 * The kernel cannot offload receive if a partial TLS record has been read. 47 * Check the read buffer for unprocessed records. If the buffer contains a 48 * partial record, fail and return 0. Otherwise, update the sequence 49 * number at *rec_seq for the count of unprocessed records and return 1. 50 */ 51 static int check_rx_read_ahead(SSL *s, unsigned char *rec_seq) 52 { 53 int bit, count_unprocessed; 54 55 count_unprocessed = count_unprocessed_records(s); 56 if (count_unprocessed < 0) 57 return 0; 58 59 /* increment the crypto_info record sequence */ 60 while (count_unprocessed) { 61 for (bit = 7; bit >= 0; bit--) { /* increment */ 62 ++rec_seq[bit]; 63 if (rec_seq[bit] != 0) 64 break; 65 } 66 count_unprocessed--; 67 68 } 69 70 return 1; 71 } 72 #endif 73 74 #if defined(__FreeBSD__) 75 # include <crypto/cryptodev.h> 76 77 /*- 78 * Check if a given cipher is supported by the KTLS interface. 79 * The kernel might still fail the setsockopt() if no suitable 80 * provider is found, but this checks if the socket option 81 * supports the cipher suite used at all. 82 */ 83 int ktls_check_supported_cipher(const SSL *s, const EVP_CIPHER *c, 84 const EVP_CIPHER_CTX *dd) 85 { 86 87 switch (s->version) { 88 case TLS1_VERSION: 89 case TLS1_1_VERSION: 90 case TLS1_2_VERSION: 91 case TLS1_3_VERSION: 92 break; 93 default: 94 return 0; 95 } 96 97 switch (s->s3->tmp.new_cipher->algorithm_enc) { 98 case SSL_AES128GCM: 99 case SSL_AES256GCM: 100 return 1; 101 # ifdef OPENSSL_KTLS_CHACHA20_POLY1305 102 case SSL_CHACHA20POLY1305: 103 return 1; 104 # endif 105 case SSL_AES128: 106 case SSL_AES256: 107 if (s->ext.use_etm) 108 return 0; 109 switch (s->s3->tmp.new_cipher->algorithm_mac) { 110 case SSL_SHA1: 111 case SSL_SHA256: 112 case SSL_SHA384: 113 return 1; 114 default: 115 return 0; 116 } 117 default: 118 return 0; 119 } 120 } 121 122 /* Function to configure kernel TLS structure */ 123 int ktls_configure_crypto(SSL *s, const EVP_CIPHER *c, EVP_CIPHER_CTX *dd, 124 void *rl_sequence, ktls_crypto_info_t *crypto_info, 125 int is_tx, unsigned char *iv, 126 unsigned char *key, unsigned char *mac_key, 127 size_t mac_secret_size) 128 { 129 memset(crypto_info, 0, sizeof(*crypto_info)); 130 switch (s->s3->tmp.new_cipher->algorithm_enc) { 131 case SSL_AES128GCM: 132 case SSL_AES256GCM: 133 crypto_info->cipher_algorithm = CRYPTO_AES_NIST_GCM_16; 134 if (s->version == TLS1_3_VERSION) 135 crypto_info->iv_len = EVP_CIPHER_CTX_iv_length(dd); 136 else 137 crypto_info->iv_len = EVP_GCM_TLS_FIXED_IV_LEN; 138 break; 139 # ifdef OPENSSL_KTLS_CHACHA20_POLY1305 140 case SSL_CHACHA20POLY1305: 141 crypto_info->cipher_algorithm = CRYPTO_CHACHA20_POLY1305; 142 crypto_info->iv_len = EVP_CIPHER_CTX_iv_length(dd); 143 break; 144 # endif 145 case SSL_AES128: 146 case SSL_AES256: 147 switch (s->s3->tmp.new_cipher->algorithm_mac) { 148 case SSL_SHA1: 149 crypto_info->auth_algorithm = CRYPTO_SHA1_HMAC; 150 break; 151 case SSL_SHA256: 152 crypto_info->auth_algorithm = CRYPTO_SHA2_256_HMAC; 153 break; 154 case SSL_SHA384: 155 crypto_info->auth_algorithm = CRYPTO_SHA2_384_HMAC; 156 break; 157 default: 158 return 0; 159 } 160 crypto_info->cipher_algorithm = CRYPTO_AES_CBC; 161 crypto_info->iv_len = EVP_CIPHER_iv_length(c); 162 crypto_info->auth_key = mac_key; 163 crypto_info->auth_key_len = mac_secret_size; 164 break; 165 default: 166 return 0; 167 } 168 crypto_info->cipher_key = key; 169 crypto_info->cipher_key_len = EVP_CIPHER_key_length(c); 170 crypto_info->iv = iv; 171 crypto_info->tls_vmajor = (s->version >> 8) & 0x000000ff; 172 crypto_info->tls_vminor = (s->version & 0x000000ff); 173 # ifdef TCP_RXTLS_ENABLE 174 memcpy(crypto_info->rec_seq, rl_sequence, sizeof(crypto_info->rec_seq)); 175 if (!is_tx && !check_rx_read_ahead(s, crypto_info->rec_seq)) 176 return 0; 177 # else 178 if (!is_tx) 179 return 0; 180 # endif 181 return 1; 182 }; 183 184 #endif /* __FreeBSD__ */ 185 186 #if defined(OPENSSL_SYS_LINUX) 187 188 /* Function to check supported ciphers in Linux */ 189 int ktls_check_supported_cipher(const SSL *s, const EVP_CIPHER *c, 190 const EVP_CIPHER_CTX *dd) 191 { 192 switch (s->version) { 193 case TLS1_2_VERSION: 194 case TLS1_3_VERSION: 195 break; 196 default: 197 return 0; 198 } 199 200 /* check that cipher is AES_GCM_128, AES_GCM_256, AES_CCM_128 201 * or Chacha20-Poly1305 202 */ 203 switch (EVP_CIPHER_nid(c)) 204 { 205 # ifdef OPENSSL_KTLS_AES_CCM_128 206 case NID_aes_128_ccm: 207 if (EVP_CIPHER_CTX_tag_length(dd) != EVP_CCM_TLS_TAG_LEN) 208 return 0; 209 # endif 210 # ifdef OPENSSL_KTLS_AES_GCM_128 211 /* Fall through */ 212 case NID_aes_128_gcm: 213 # endif 214 # ifdef OPENSSL_KTLS_AES_GCM_256 215 case NID_aes_256_gcm: 216 # endif 217 # ifdef OPENSSL_KTLS_CHACHA20_POLY1305 218 case NID_chacha20_poly1305: 219 # endif 220 return 1; 221 default: 222 return 0; 223 } 224 } 225 226 /* Function to configure kernel TLS structure */ 227 int ktls_configure_crypto(SSL *s, const EVP_CIPHER *c, EVP_CIPHER_CTX *dd, 228 void *rl_sequence, ktls_crypto_info_t *crypto_info, 229 int is_tx, unsigned char *iv, 230 unsigned char *key, unsigned char *mac_key, 231 size_t mac_secret_size) 232 { 233 unsigned char geniv[12]; 234 unsigned char *iiv = iv; 235 236 # ifdef OPENSSL_NO_KTLS_RX 237 if (!is_tx) 238 return 0; 239 # endif 240 241 if (s->version == TLS1_2_VERSION && 242 EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) { 243 EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GET_IV, 244 EVP_GCM_TLS_FIXED_IV_LEN + EVP_GCM_TLS_EXPLICIT_IV_LEN, 245 geniv); 246 iiv = geniv; 247 } 248 249 memset(crypto_info, 0, sizeof(*crypto_info)); 250 switch (EVP_CIPHER_nid(c)) 251 { 252 # ifdef OPENSSL_KTLS_AES_GCM_128 253 case NID_aes_128_gcm: 254 crypto_info->gcm128.info.cipher_type = TLS_CIPHER_AES_GCM_128; 255 crypto_info->gcm128.info.version = s->version; 256 crypto_info->tls_crypto_info_len = sizeof(crypto_info->gcm128); 257 memcpy(crypto_info->gcm128.iv, iiv + EVP_GCM_TLS_FIXED_IV_LEN, 258 TLS_CIPHER_AES_GCM_128_IV_SIZE); 259 memcpy(crypto_info->gcm128.salt, iiv, TLS_CIPHER_AES_GCM_128_SALT_SIZE); 260 memcpy(crypto_info->gcm128.key, key, EVP_CIPHER_key_length(c)); 261 memcpy(crypto_info->gcm128.rec_seq, rl_sequence, 262 TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE); 263 if (!is_tx && !check_rx_read_ahead(s, crypto_info->gcm128.rec_seq)) 264 return 0; 265 return 1; 266 # endif 267 # ifdef OPENSSL_KTLS_AES_GCM_256 268 case NID_aes_256_gcm: 269 crypto_info->gcm256.info.cipher_type = TLS_CIPHER_AES_GCM_256; 270 crypto_info->gcm256.info.version = s->version; 271 crypto_info->tls_crypto_info_len = sizeof(crypto_info->gcm256); 272 memcpy(crypto_info->gcm256.iv, iiv + EVP_GCM_TLS_FIXED_IV_LEN, 273 TLS_CIPHER_AES_GCM_256_IV_SIZE); 274 memcpy(crypto_info->gcm256.salt, iiv, TLS_CIPHER_AES_GCM_256_SALT_SIZE); 275 memcpy(crypto_info->gcm256.key, key, EVP_CIPHER_key_length(c)); 276 memcpy(crypto_info->gcm256.rec_seq, rl_sequence, 277 TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE); 278 if (!is_tx && !check_rx_read_ahead(s, crypto_info->gcm256.rec_seq)) 279 return 0; 280 return 1; 281 # endif 282 # ifdef OPENSSL_KTLS_AES_CCM_128 283 case NID_aes_128_ccm: 284 crypto_info->ccm128.info.cipher_type = TLS_CIPHER_AES_CCM_128; 285 crypto_info->ccm128.info.version = s->version; 286 crypto_info->tls_crypto_info_len = sizeof(crypto_info->ccm128); 287 memcpy(crypto_info->ccm128.iv, iiv + EVP_CCM_TLS_FIXED_IV_LEN, 288 TLS_CIPHER_AES_CCM_128_IV_SIZE); 289 memcpy(crypto_info->ccm128.salt, iiv, TLS_CIPHER_AES_CCM_128_SALT_SIZE); 290 memcpy(crypto_info->ccm128.key, key, EVP_CIPHER_key_length(c)); 291 memcpy(crypto_info->ccm128.rec_seq, rl_sequence, 292 TLS_CIPHER_AES_CCM_128_REC_SEQ_SIZE); 293 if (!is_tx && !check_rx_read_ahead(s, crypto_info->ccm128.rec_seq)) 294 return 0; 295 return 1; 296 # endif 297 # ifdef OPENSSL_KTLS_CHACHA20_POLY1305 298 case NID_chacha20_poly1305: 299 crypto_info->chacha20poly1305.info.cipher_type = TLS_CIPHER_CHACHA20_POLY1305; 300 crypto_info->chacha20poly1305.info.version = s->version; 301 crypto_info->tls_crypto_info_len = sizeof(crypto_info->chacha20poly1305); 302 memcpy(crypto_info->chacha20poly1305.iv, iiv, 303 TLS_CIPHER_CHACHA20_POLY1305_IV_SIZE); 304 memcpy(crypto_info->chacha20poly1305.key, key, EVP_CIPHER_key_length(c)); 305 memcpy(crypto_info->chacha20poly1305.rec_seq, rl_sequence, 306 TLS_CIPHER_CHACHA20_POLY1305_REC_SEQ_SIZE); 307 if (!is_tx 308 && !check_rx_read_ahead(s, 309 crypto_info->chacha20poly1305.rec_seq)) 310 return 0; 311 return 1; 312 # endif 313 default: 314 return 0; 315 } 316 317 } 318 319 #endif /* OPENSSL_SYS_LINUX */ 320