1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2021 Netflix Inc. 5 * Written by: John Baldwin <jhb@FreeBSD.org> 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include <sys/param.h> 30 #include <sys/endian.h> 31 #include <sys/event.h> 32 #include <sys/ktls.h> 33 #include <sys/mman.h> 34 #include <sys/socket.h> 35 #include <sys/sysctl.h> 36 #include <netinet/in.h> 37 #include <netinet/tcp.h> 38 #include <crypto/cryptodev.h> 39 #include <assert.h> 40 #include <err.h> 41 #include <fcntl.h> 42 #include <libutil.h> 43 #include <netdb.h> 44 #include <poll.h> 45 #include <stdbool.h> 46 #include <stdlib.h> 47 #include <atf-c.h> 48 49 #include <openssl/err.h> 50 #include <openssl/evp.h> 51 #include <openssl/hmac.h> 52 53 static void 54 require_ktls(void) 55 { 56 size_t len; 57 bool enable; 58 59 len = sizeof(enable); 60 if (sysctlbyname("kern.ipc.tls.enable", &enable, &len, NULL, 0) == -1) { 61 if (errno == ENOENT) 62 atf_tc_skip("kernel does not support TLS offload"); 63 atf_libc_error(errno, "Failed to read kern.ipc.tls.enable"); 64 } 65 66 if (!enable) 67 atf_tc_skip("Kernel TLS is disabled"); 68 } 69 70 #define ATF_REQUIRE_KTLS() require_ktls() 71 72 static void 73 check_tls_mode(const atf_tc_t *tc, int s, int sockopt) 74 { 75 if (atf_tc_get_config_var_as_bool_wd(tc, "ktls.require_ifnet", false)) { 76 socklen_t len; 77 int mode; 78 79 len = sizeof(mode); 80 if (getsockopt(s, IPPROTO_TCP, sockopt, &mode, &len) == -1) 81 atf_libc_error(errno, "Failed to fetch TLS mode"); 82 83 if (mode != TCP_TLS_MODE_IFNET) 84 atf_tc_skip("connection did not use ifnet TLS"); 85 } 86 87 if (atf_tc_get_config_var_as_bool_wd(tc, "ktls.require_toe", false)) { 88 socklen_t len; 89 int mode; 90 91 len = sizeof(mode); 92 if (getsockopt(s, IPPROTO_TCP, sockopt, &mode, &len) == -1) 93 atf_libc_error(errno, "Failed to fetch TLS mode"); 94 95 if (mode != TCP_TLS_MODE_TOE) 96 atf_tc_skip("connection did not use TOE TLS"); 97 } 98 } 99 100 static void __printflike(2, 3) 101 debug(const atf_tc_t *tc, const char *fmt, ...) 102 { 103 if (!atf_tc_get_config_var_as_bool_wd(tc, "ktls.debug", false)) 104 return; 105 106 va_list ap; 107 va_start(ap, fmt); 108 vprintf(fmt, ap); 109 va_end(ap); 110 } 111 112 static void 113 debug_hexdump(const atf_tc_t *tc, const void *buf, int length, 114 const char *label) 115 { 116 if (!atf_tc_get_config_var_as_bool_wd(tc, "ktls.debug", false)) 117 return; 118 119 if (label != NULL) 120 printf("%s:\n", label); 121 hexdump(buf, length, NULL, 0); 122 } 123 124 static char 125 rdigit(void) 126 { 127 /* ASCII printable values between 0x20 and 0x7e */ 128 return (0x20 + random() % (0x7f - 0x20)); 129 } 130 131 static char * 132 alloc_buffer(size_t len) 133 { 134 char *buf; 135 size_t i; 136 137 if (len == 0) 138 return (NULL); 139 buf = malloc(len); 140 for (i = 0; i < len; i++) 141 buf[i] = rdigit(); 142 return (buf); 143 } 144 145 static bool 146 socketpair_tcp(int sv[2]) 147 { 148 struct pollfd pfd; 149 struct sockaddr_in sin; 150 socklen_t len; 151 int as, cs, ls; 152 153 ls = socket(PF_INET, SOCK_STREAM, 0); 154 if (ls == -1) { 155 warn("socket() for listen"); 156 return (false); 157 } 158 159 memset(&sin, 0, sizeof(sin)); 160 sin.sin_len = sizeof(sin); 161 sin.sin_family = AF_INET; 162 sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK); 163 if (bind(ls, (struct sockaddr *)&sin, sizeof(sin)) == -1) { 164 warn("bind"); 165 close(ls); 166 return (false); 167 } 168 169 if (listen(ls, 1) == -1) { 170 warn("listen"); 171 close(ls); 172 return (false); 173 } 174 175 len = sizeof(sin); 176 if (getsockname(ls, (struct sockaddr *)&sin, &len) == -1) { 177 warn("getsockname"); 178 close(ls); 179 return (false); 180 } 181 182 cs = socket(PF_INET, SOCK_STREAM | SOCK_NONBLOCK, 0); 183 if (cs == -1) { 184 warn("socket() for connect"); 185 close(ls); 186 return (false); 187 } 188 189 if (connect(cs, (struct sockaddr *)&sin, sizeof(sin)) == -1) { 190 if (errno != EINPROGRESS) { 191 warn("connect"); 192 close(ls); 193 close(cs); 194 return (false); 195 } 196 } 197 198 as = accept4(ls, NULL, NULL, SOCK_NONBLOCK); 199 if (as == -1) { 200 warn("accept4"); 201 close(ls); 202 close(cs); 203 return (false); 204 } 205 206 close(ls); 207 208 pfd.fd = cs; 209 pfd.events = POLLOUT; 210 pfd.revents = 0; 211 ATF_REQUIRE_INTEQ(1, poll(&pfd, 1, INFTIM)); 212 ATF_REQUIRE_INTEQ(POLLOUT, pfd.revents); 213 214 sv[0] = cs; 215 sv[1] = as; 216 return (true); 217 } 218 219 static bool 220 echo_socket(const atf_tc_t *tc, int sv[2]) 221 { 222 const char *cause, *host, *port; 223 struct addrinfo hints, *ai, *tofree; 224 int error, flags, s; 225 226 host = atf_tc_get_config_var(tc, "ktls.host"); 227 port = atf_tc_get_config_var_wd(tc, "ktls.port", "echo"); 228 memset(&hints, 0, sizeof(hints)); 229 hints.ai_family = AF_UNSPEC; 230 hints.ai_socktype = SOCK_STREAM; 231 hints.ai_protocol = IPPROTO_TCP; 232 error = getaddrinfo(host, port, &hints, &tofree); 233 if (error != 0) { 234 warnx("getaddrinfo(%s:%s) failed: %s", host, port, 235 gai_strerror(error)); 236 return (false); 237 } 238 239 cause = NULL; 240 for (ai = tofree; ai != NULL; ai = ai->ai_next) { 241 s = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol); 242 if (s == -1) { 243 cause = "socket"; 244 error = errno; 245 continue; 246 } 247 248 if (connect(s, ai->ai_addr, ai->ai_addrlen) == -1) { 249 cause = "connect"; 250 error = errno; 251 close(s); 252 continue; 253 } 254 255 freeaddrinfo(tofree); 256 257 ATF_REQUIRE((flags = fcntl(s, F_GETFL)) != -1); 258 flags |= O_NONBLOCK; 259 ATF_REQUIRE(fcntl(s, F_SETFL, flags) != -1); 260 261 sv[0] = s; 262 sv[1] = s; 263 return (true); 264 } 265 266 warnc(error, "%s", cause); 267 freeaddrinfo(tofree); 268 return (false); 269 } 270 271 static bool 272 open_sockets(const atf_tc_t *tc, int sv[2]) 273 { 274 if (atf_tc_has_config_var(tc, "ktls.host")) 275 return (echo_socket(tc, sv)); 276 else 277 return (socketpair_tcp(sv)); 278 } 279 280 static void 281 close_sockets(int sv[2]) 282 { 283 if (sv[0] != sv[1]) 284 ATF_REQUIRE(close(sv[1]) == 0); 285 ATF_REQUIRE(close(sv[0]) == 0); 286 } 287 288 static void 289 close_sockets_ignore_errors(int sv[2]) 290 { 291 if (sv[0] != sv[1]) 292 close(sv[1]); 293 close(sv[0]); 294 } 295 296 static void 297 fd_set_blocking(int fd) 298 { 299 int flags; 300 301 ATF_REQUIRE((flags = fcntl(fd, F_GETFL)) != -1); 302 flags &= ~O_NONBLOCK; 303 ATF_REQUIRE(fcntl(fd, F_SETFL, flags) != -1); 304 } 305 306 static bool 307 cbc_crypt(const EVP_CIPHER *cipher, const char *key, const char *iv, 308 const char *input, char *output, size_t size, int enc) 309 { 310 EVP_CIPHER_CTX *ctx; 311 int outl, total; 312 313 ctx = EVP_CIPHER_CTX_new(); 314 if (ctx == NULL) { 315 warnx("EVP_CIPHER_CTX_new failed: %s", 316 ERR_error_string(ERR_get_error(), NULL)); 317 return (false); 318 } 319 if (EVP_CipherInit_ex(ctx, cipher, NULL, (const u_char *)key, 320 (const u_char *)iv, enc) != 1) { 321 warnx("EVP_CipherInit_ex failed: %s", 322 ERR_error_string(ERR_get_error(), NULL)); 323 EVP_CIPHER_CTX_free(ctx); 324 return (false); 325 } 326 EVP_CIPHER_CTX_set_padding(ctx, 0); 327 if (EVP_CipherUpdate(ctx, (u_char *)output, &outl, 328 (const u_char *)input, size) != 1) { 329 warnx("EVP_CipherUpdate failed: %s", 330 ERR_error_string(ERR_get_error(), NULL)); 331 EVP_CIPHER_CTX_free(ctx); 332 return (false); 333 } 334 total = outl; 335 if (EVP_CipherFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) { 336 warnx("EVP_CipherFinal_ex failed: %s", 337 ERR_error_string(ERR_get_error(), NULL)); 338 EVP_CIPHER_CTX_free(ctx); 339 return (false); 340 } 341 total += outl; 342 if ((size_t)total != size) { 343 warnx("decrypt size mismatch: %zu vs %d", size, total); 344 EVP_CIPHER_CTX_free(ctx); 345 return (false); 346 } 347 EVP_CIPHER_CTX_free(ctx); 348 return (true); 349 } 350 351 static bool 352 cbc_encrypt(const EVP_CIPHER *cipher, const char *key, const char *iv, 353 const char *input, char *output, size_t size) 354 { 355 return (cbc_crypt(cipher, key, iv, input, output, size, 1)); 356 } 357 358 static bool 359 cbc_decrypt(const EVP_CIPHER *cipher, const char *key, const char *iv, 360 const char *input, char *output, size_t size) 361 { 362 return (cbc_crypt(cipher, key, iv, input, output, size, 0)); 363 } 364 365 static bool 366 compute_hash(const EVP_MD *md, const void *key, size_t key_len, const void *aad, 367 size_t aad_len, const void *buffer, size_t len, void *digest, 368 u_int *digest_len) 369 { 370 HMAC_CTX *ctx; 371 372 ctx = HMAC_CTX_new(); 373 if (ctx == NULL) { 374 warnx("HMAC_CTX_new failed: %s", 375 ERR_error_string(ERR_get_error(), NULL)); 376 return (false); 377 } 378 if (HMAC_Init_ex(ctx, key, key_len, md, NULL) != 1) { 379 warnx("HMAC_Init_ex failed: %s", 380 ERR_error_string(ERR_get_error(), NULL)); 381 HMAC_CTX_free(ctx); 382 return (false); 383 } 384 if (HMAC_Update(ctx, aad, aad_len) != 1) { 385 warnx("HMAC_Update (aad) failed: %s", 386 ERR_error_string(ERR_get_error(), NULL)); 387 HMAC_CTX_free(ctx); 388 return (false); 389 } 390 if (HMAC_Update(ctx, buffer, len) != 1) { 391 warnx("HMAC_Update (payload) failed: %s", 392 ERR_error_string(ERR_get_error(), NULL)); 393 HMAC_CTX_free(ctx); 394 return (false); 395 } 396 if (HMAC_Final(ctx, digest, digest_len) != 1) { 397 warnx("HMAC_Final failed: %s", 398 ERR_error_string(ERR_get_error(), NULL)); 399 HMAC_CTX_free(ctx); 400 return (false); 401 } 402 HMAC_CTX_free(ctx); 403 return (true); 404 } 405 406 static bool 407 verify_hash(const EVP_MD *md, const void *key, size_t key_len, const void *aad, 408 size_t aad_len, const void *buffer, size_t len, const void *digest) 409 { 410 unsigned char digest2[EVP_MAX_MD_SIZE]; 411 u_int digest_len; 412 413 if (!compute_hash(md, key, key_len, aad, aad_len, buffer, len, digest2, 414 &digest_len)) 415 return (false); 416 if (memcmp(digest, digest2, digest_len) != 0) { 417 warnx("HMAC mismatch"); 418 return (false); 419 } 420 return (true); 421 } 422 423 static bool 424 aead_encrypt(const EVP_CIPHER *cipher, const char *key, const char *nonce, 425 const void *aad, size_t aad_len, const char *input, char *output, 426 size_t size, char *tag, size_t tag_len) 427 { 428 EVP_CIPHER_CTX *ctx; 429 int outl, total; 430 431 ctx = EVP_CIPHER_CTX_new(); 432 if (ctx == NULL) { 433 warnx("EVP_CIPHER_CTX_new failed: %s", 434 ERR_error_string(ERR_get_error(), NULL)); 435 return (false); 436 } 437 if (EVP_EncryptInit_ex(ctx, cipher, NULL, (const u_char *)key, 438 (const u_char *)nonce) != 1) { 439 warnx("EVP_EncryptInit_ex failed: %s", 440 ERR_error_string(ERR_get_error(), NULL)); 441 EVP_CIPHER_CTX_free(ctx); 442 return (false); 443 } 444 EVP_CIPHER_CTX_set_padding(ctx, 0); 445 if (aad != NULL) { 446 if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)aad, 447 aad_len) != 1) { 448 warnx("EVP_EncryptUpdate for AAD failed: %s", 449 ERR_error_string(ERR_get_error(), NULL)); 450 EVP_CIPHER_CTX_free(ctx); 451 return (false); 452 } 453 } 454 if (EVP_EncryptUpdate(ctx, (u_char *)output, &outl, 455 (const u_char *)input, size) != 1) { 456 warnx("EVP_EncryptUpdate failed: %s", 457 ERR_error_string(ERR_get_error(), NULL)); 458 EVP_CIPHER_CTX_free(ctx); 459 return (false); 460 } 461 total = outl; 462 if (EVP_EncryptFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) { 463 warnx("EVP_EncryptFinal_ex failed: %s", 464 ERR_error_string(ERR_get_error(), NULL)); 465 EVP_CIPHER_CTX_free(ctx); 466 return (false); 467 } 468 total += outl; 469 if ((size_t)total != size) { 470 warnx("encrypt size mismatch: %zu vs %d", size, total); 471 EVP_CIPHER_CTX_free(ctx); 472 return (false); 473 } 474 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, tag_len, tag) != 475 1) { 476 warnx("EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_GET_TAG) failed: %s", 477 ERR_error_string(ERR_get_error(), NULL)); 478 EVP_CIPHER_CTX_free(ctx); 479 return (false); 480 } 481 EVP_CIPHER_CTX_free(ctx); 482 return (true); 483 } 484 485 static bool 486 aead_decrypt(const EVP_CIPHER *cipher, const char *key, const char *nonce, 487 const void *aad, size_t aad_len, const char *input, char *output, 488 size_t size, const char *tag, size_t tag_len) 489 { 490 EVP_CIPHER_CTX *ctx; 491 int outl, total; 492 bool valid; 493 494 ctx = EVP_CIPHER_CTX_new(); 495 if (ctx == NULL) { 496 warnx("EVP_CIPHER_CTX_new failed: %s", 497 ERR_error_string(ERR_get_error(), NULL)); 498 return (false); 499 } 500 if (EVP_DecryptInit_ex(ctx, cipher, NULL, (const u_char *)key, 501 (const u_char *)nonce) != 1) { 502 warnx("EVP_DecryptInit_ex failed: %s", 503 ERR_error_string(ERR_get_error(), NULL)); 504 EVP_CIPHER_CTX_free(ctx); 505 return (false); 506 } 507 EVP_CIPHER_CTX_set_padding(ctx, 0); 508 if (aad != NULL) { 509 if (EVP_DecryptUpdate(ctx, NULL, &outl, (const u_char *)aad, 510 aad_len) != 1) { 511 warnx("EVP_DecryptUpdate for AAD failed: %s", 512 ERR_error_string(ERR_get_error(), NULL)); 513 EVP_CIPHER_CTX_free(ctx); 514 return (false); 515 } 516 } 517 if (EVP_DecryptUpdate(ctx, (u_char *)output, &outl, 518 (const u_char *)input, size) != 1) { 519 warnx("EVP_DecryptUpdate failed: %s", 520 ERR_error_string(ERR_get_error(), NULL)); 521 EVP_CIPHER_CTX_free(ctx); 522 return (false); 523 } 524 total = outl; 525 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, tag_len, 526 __DECONST(char *, tag)) != 1) { 527 warnx("EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_SET_TAG) failed: %s", 528 ERR_error_string(ERR_get_error(), NULL)); 529 EVP_CIPHER_CTX_free(ctx); 530 return (false); 531 } 532 valid = (EVP_DecryptFinal_ex(ctx, (u_char *)output + outl, &outl) == 1); 533 total += outl; 534 if ((size_t)total != size) { 535 warnx("decrypt size mismatch: %zu vs %d", size, total); 536 EVP_CIPHER_CTX_free(ctx); 537 return (false); 538 } 539 if (!valid) 540 warnx("tag mismatch"); 541 EVP_CIPHER_CTX_free(ctx); 542 return (valid); 543 } 544 545 static void 546 build_tls_enable(const atf_tc_t *tc, int cipher_alg, size_t cipher_key_len, 547 int auth_alg, int minor, uint64_t seqno, struct tls_enable *en) 548 { 549 u_int auth_key_len, iv_len; 550 551 memset(en, 0, sizeof(*en)); 552 553 switch (cipher_alg) { 554 case CRYPTO_AES_CBC: 555 if (minor == TLS_MINOR_VER_ZERO) 556 iv_len = AES_BLOCK_LEN; 557 else 558 iv_len = 0; 559 break; 560 case CRYPTO_AES_NIST_GCM_16: 561 if (minor == TLS_MINOR_VER_TWO) 562 iv_len = TLS_AEAD_GCM_LEN; 563 else 564 iv_len = TLS_1_3_GCM_IV_LEN; 565 break; 566 case CRYPTO_CHACHA20_POLY1305: 567 iv_len = TLS_CHACHA20_IV_LEN; 568 break; 569 default: 570 iv_len = 0; 571 break; 572 } 573 switch (auth_alg) { 574 case CRYPTO_SHA1_HMAC: 575 auth_key_len = SHA1_HASH_LEN; 576 break; 577 case CRYPTO_SHA2_256_HMAC: 578 auth_key_len = SHA2_256_HASH_LEN; 579 break; 580 case CRYPTO_SHA2_384_HMAC: 581 auth_key_len = SHA2_384_HASH_LEN; 582 break; 583 default: 584 auth_key_len = 0; 585 break; 586 } 587 en->cipher_key = alloc_buffer(cipher_key_len); 588 debug_hexdump(tc, en->cipher_key, cipher_key_len, "cipher key"); 589 en->iv = alloc_buffer(iv_len); 590 if (iv_len != 0) 591 debug_hexdump(tc, en->iv, iv_len, "iv"); 592 en->auth_key = alloc_buffer(auth_key_len); 593 if (auth_key_len != 0) 594 debug_hexdump(tc, en->auth_key, auth_key_len, "auth key"); 595 en->cipher_algorithm = cipher_alg; 596 en->cipher_key_len = cipher_key_len; 597 en->iv_len = iv_len; 598 en->auth_algorithm = auth_alg; 599 en->auth_key_len = auth_key_len; 600 en->tls_vmajor = TLS_MAJOR_VER_ONE; 601 en->tls_vminor = minor; 602 be64enc(en->rec_seq, seqno); 603 debug(tc, "seqno: %ju\n", (uintmax_t)seqno); 604 } 605 606 static void 607 free_tls_enable(struct tls_enable *en) 608 { 609 free(__DECONST(void *, en->cipher_key)); 610 free(__DECONST(void *, en->iv)); 611 free(__DECONST(void *, en->auth_key)); 612 } 613 614 static const EVP_CIPHER * 615 tls_EVP_CIPHER(const struct tls_enable *en) 616 { 617 switch (en->cipher_algorithm) { 618 case CRYPTO_AES_CBC: 619 switch (en->cipher_key_len) { 620 case 128 / 8: 621 return (EVP_aes_128_cbc()); 622 case 256 / 8: 623 return (EVP_aes_256_cbc()); 624 default: 625 return (NULL); 626 } 627 break; 628 case CRYPTO_AES_NIST_GCM_16: 629 switch (en->cipher_key_len) { 630 case 128 / 8: 631 return (EVP_aes_128_gcm()); 632 case 256 / 8: 633 return (EVP_aes_256_gcm()); 634 default: 635 return (NULL); 636 } 637 break; 638 case CRYPTO_CHACHA20_POLY1305: 639 return (EVP_chacha20_poly1305()); 640 default: 641 return (NULL); 642 } 643 } 644 645 static const EVP_MD * 646 tls_EVP_MD(const struct tls_enable *en) 647 { 648 switch (en->auth_algorithm) { 649 case CRYPTO_SHA1_HMAC: 650 return (EVP_sha1()); 651 case CRYPTO_SHA2_256_HMAC: 652 return (EVP_sha256()); 653 case CRYPTO_SHA2_384_HMAC: 654 return (EVP_sha384()); 655 default: 656 return (NULL); 657 } 658 } 659 660 static size_t 661 tls_header_len(struct tls_enable *en) 662 { 663 size_t len; 664 665 len = sizeof(struct tls_record_layer); 666 switch (en->cipher_algorithm) { 667 case CRYPTO_AES_CBC: 668 if (en->tls_vminor != TLS_MINOR_VER_ZERO) 669 len += AES_BLOCK_LEN; 670 return (len); 671 case CRYPTO_AES_NIST_GCM_16: 672 if (en->tls_vminor == TLS_MINOR_VER_TWO) 673 len += sizeof(uint64_t); 674 return (len); 675 case CRYPTO_CHACHA20_POLY1305: 676 return (len); 677 default: 678 return (0); 679 } 680 } 681 682 static size_t 683 tls_mac_len(struct tls_enable *en) 684 { 685 switch (en->cipher_algorithm) { 686 case CRYPTO_AES_CBC: 687 switch (en->auth_algorithm) { 688 case CRYPTO_SHA1_HMAC: 689 return (SHA1_HASH_LEN); 690 case CRYPTO_SHA2_256_HMAC: 691 return (SHA2_256_HASH_LEN); 692 case CRYPTO_SHA2_384_HMAC: 693 return (SHA2_384_HASH_LEN); 694 default: 695 return (0); 696 } 697 case CRYPTO_AES_NIST_GCM_16: 698 return (AES_GMAC_HASH_LEN); 699 case CRYPTO_CHACHA20_POLY1305: 700 return (POLY1305_HASH_LEN); 701 default: 702 return (0); 703 } 704 } 705 706 /* Includes maximum padding for MTE. */ 707 static size_t 708 tls_trailer_len(struct tls_enable *en) 709 { 710 size_t len; 711 712 len = tls_mac_len(en); 713 if (en->cipher_algorithm == CRYPTO_AES_CBC) 714 len += AES_BLOCK_LEN; 715 if (en->tls_vminor == TLS_MINOR_VER_THREE) 716 len++; 717 return (len); 718 } 719 720 /* Minimum valid record payload size for a given cipher suite. */ 721 static size_t 722 tls_minimum_record_payload(struct tls_enable *en) 723 { 724 size_t len; 725 726 len = tls_header_len(en); 727 if (en->cipher_algorithm == CRYPTO_AES_CBC) 728 len += roundup2(tls_mac_len(en) + 1, AES_BLOCK_LEN); 729 else 730 len += tls_mac_len(en); 731 if (en->tls_vminor == TLS_MINOR_VER_THREE) 732 len++; 733 return (len - sizeof(struct tls_record_layer)); 734 } 735 736 /* 'len' is the length of the payload application data. */ 737 static void 738 tls_mte_aad(struct tls_enable *en, size_t len, 739 const struct tls_record_layer *hdr, uint64_t seqno, struct tls_mac_data *ad) 740 { 741 ad->seq = htobe64(seqno); 742 ad->type = hdr->tls_type; 743 ad->tls_vmajor = hdr->tls_vmajor; 744 ad->tls_vminor = hdr->tls_vminor; 745 ad->tls_length = htons(len); 746 } 747 748 static void 749 tls_12_aead_aad(struct tls_enable *en, size_t len, 750 const struct tls_record_layer *hdr, uint64_t seqno, 751 struct tls_aead_data *ad) 752 { 753 ad->seq = htobe64(seqno); 754 ad->type = hdr->tls_type; 755 ad->tls_vmajor = hdr->tls_vmajor; 756 ad->tls_vminor = hdr->tls_vminor; 757 ad->tls_length = htons(len); 758 } 759 760 static void 761 tls_13_aad(struct tls_enable *en, const struct tls_record_layer *hdr, 762 uint64_t seqno, struct tls_aead_data_13 *ad) 763 { 764 ad->type = hdr->tls_type; 765 ad->tls_vmajor = hdr->tls_vmajor; 766 ad->tls_vminor = hdr->tls_vminor; 767 ad->tls_length = hdr->tls_length; 768 } 769 770 static void 771 tls_12_gcm_nonce(struct tls_enable *en, const struct tls_record_layer *hdr, 772 char *nonce) 773 { 774 memcpy(nonce, en->iv, TLS_AEAD_GCM_LEN); 775 memcpy(nonce + TLS_AEAD_GCM_LEN, hdr + 1, sizeof(uint64_t)); 776 } 777 778 static void 779 tls_13_nonce(struct tls_enable *en, uint64_t seqno, char *nonce) 780 { 781 static_assert(TLS_1_3_GCM_IV_LEN == TLS_CHACHA20_IV_LEN, 782 "TLS 1.3 nonce length mismatch"); 783 memcpy(nonce, en->iv, TLS_1_3_GCM_IV_LEN); 784 *(uint64_t *)(nonce + 4) ^= htobe64(seqno); 785 } 786 787 /* 788 * Decrypt a TLS record 'len' bytes long at 'src' and store the result at 789 * 'dst'. If the TLS record header length doesn't match or 'dst' doesn't 790 * have sufficient room ('avail'), fail the test. 791 */ 792 static size_t 793 decrypt_tls_aes_cbc_mte(const atf_tc_t *tc, struct tls_enable *en, 794 uint64_t seqno, const void *src, size_t len, void *dst, size_t avail, 795 uint8_t *record_type) 796 { 797 const struct tls_record_layer *hdr; 798 struct tls_mac_data aad; 799 const char *iv; 800 char *buf; 801 size_t hdr_len, mac_len, payload_len; 802 int padding; 803 804 hdr = src; 805 hdr_len = tls_header_len(en); 806 mac_len = tls_mac_len(en); 807 ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor); 808 ATF_REQUIRE_INTEQ(en->tls_vminor, hdr->tls_vminor); 809 debug(tc, "decrypting MTE record seqno %ju:\n", (uintmax_t)seqno); 810 debug_hexdump(tc, src, len, NULL); 811 812 /* First, decrypt the outer payload into a temporary buffer. */ 813 payload_len = len - hdr_len; 814 buf = malloc(payload_len); 815 if (en->tls_vminor == TLS_MINOR_VER_ZERO) 816 iv = en->iv; 817 else 818 iv = (void *)(hdr + 1); 819 debug_hexdump(tc, iv, AES_BLOCK_LEN, "iv"); 820 ATF_REQUIRE(cbc_decrypt(tls_EVP_CIPHER(en), en->cipher_key, iv, 821 (const u_char *)src + hdr_len, buf, payload_len)); 822 debug_hexdump(tc, buf, payload_len, "decrypted buffer"); 823 824 /* 825 * Copy the last encrypted block to use as the IV for the next 826 * record for TLS 1.0. 827 */ 828 if (en->tls_vminor == TLS_MINOR_VER_ZERO) 829 memcpy(__DECONST(uint8_t *, en->iv), (const u_char *)src + 830 (len - AES_BLOCK_LEN), AES_BLOCK_LEN); 831 832 /* 833 * Verify trailing padding and strip. 834 * 835 * The kernel always generates the smallest amount of padding. 836 */ 837 padding = buf[payload_len - 1] + 1; 838 ATF_REQUIRE_MSG(padding > 0 && padding <= AES_BLOCK_LEN, 839 "invalid padding %d", padding); 840 ATF_REQUIRE_MSG(payload_len >= mac_len + padding, 841 "payload_len (%zu) < mac_len (%zu) + padding (%d)", payload_len, 842 mac_len, padding); 843 payload_len -= padding; 844 845 /* Verify HMAC. */ 846 payload_len -= mac_len; 847 tls_mte_aad(en, payload_len, hdr, seqno, &aad); 848 debug_hexdump(tc, &aad, sizeof(aad), "aad"); 849 ATF_REQUIRE(verify_hash(tls_EVP_MD(en), en->auth_key, en->auth_key_len, 850 &aad, sizeof(aad), buf, payload_len, buf + payload_len)); 851 852 ATF_REQUIRE_MSG(payload_len <= avail, "payload_len (%zu) < avail (%zu)", 853 payload_len, avail); 854 memcpy(dst, buf, payload_len); 855 *record_type = hdr->tls_type; 856 return (payload_len); 857 } 858 859 static size_t 860 decrypt_tls_12_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno, 861 const void *src, size_t len, void *dst, uint8_t *record_type) 862 { 863 const struct tls_record_layer *hdr; 864 struct tls_aead_data aad; 865 char nonce[12]; 866 size_t hdr_len, mac_len, payload_len; 867 868 hdr = src; 869 870 hdr_len = tls_header_len(en); 871 mac_len = tls_mac_len(en); 872 payload_len = len - (hdr_len + mac_len); 873 ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor); 874 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, hdr->tls_vminor); 875 debug(tc, "decrypting TLS 1.2 record seqno %ju:\n", (uintmax_t)seqno); 876 debug_hexdump(tc, src, len, NULL); 877 878 tls_12_aead_aad(en, payload_len, hdr, seqno, &aad); 879 debug_hexdump(tc, &aad, sizeof(aad), "aad"); 880 if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16) 881 tls_12_gcm_nonce(en, hdr, nonce); 882 else 883 tls_13_nonce(en, seqno, nonce); 884 debug_hexdump(tc, nonce, sizeof(nonce), "nonce"); 885 886 ATF_REQUIRE(aead_decrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce, 887 &aad, sizeof(aad), (const char *)src + hdr_len, dst, payload_len, 888 (const char *)src + hdr_len + payload_len, mac_len)); 889 890 *record_type = hdr->tls_type; 891 return (payload_len); 892 } 893 894 static size_t 895 decrypt_tls_13_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno, 896 const void *src, size_t len, void *dst, uint8_t *record_type) 897 { 898 const struct tls_record_layer *hdr; 899 struct tls_aead_data_13 aad; 900 char nonce[12]; 901 char *buf; 902 size_t hdr_len, mac_len, payload_len; 903 904 hdr = src; 905 906 hdr_len = tls_header_len(en); 907 mac_len = tls_mac_len(en); 908 payload_len = len - (hdr_len + mac_len); 909 ATF_REQUIRE_MSG(payload_len >= 1, 910 "payload_len (%zu) too short: len %zu hdr_len %zu mac_len %zu", 911 payload_len, len, hdr_len, mac_len); 912 ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, hdr->tls_type); 913 ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor); 914 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, hdr->tls_vminor); 915 debug(tc, "decrypting TLS 1.3 record seqno %ju:\n", (uintmax_t)seqno); 916 debug_hexdump(tc, src, len, NULL); 917 918 tls_13_aad(en, hdr, seqno, &aad); 919 debug_hexdump(tc, &aad, sizeof(aad), "aad"); 920 tls_13_nonce(en, seqno, nonce); 921 debug_hexdump(tc, nonce, sizeof(nonce), "nonce"); 922 923 /* 924 * Have to use a temporary buffer for the output due to the 925 * record type as the last byte of the trailer. 926 */ 927 buf = malloc(payload_len); 928 929 ATF_REQUIRE(aead_decrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce, 930 &aad, sizeof(aad), (const char *)src + hdr_len, buf, payload_len, 931 (const char *)src + hdr_len + payload_len, mac_len)); 932 debug_hexdump(tc, buf, payload_len, "decrypted buffer"); 933 934 /* Trim record type. */ 935 *record_type = buf[payload_len - 1]; 936 payload_len--; 937 938 memcpy(dst, buf, payload_len); 939 free(buf); 940 941 return (payload_len); 942 } 943 944 static size_t 945 decrypt_tls_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno, 946 const void *src, size_t len, void *dst, size_t avail, uint8_t *record_type) 947 { 948 const struct tls_record_layer *hdr; 949 size_t payload_len; 950 951 hdr = src; 952 ATF_REQUIRE_INTEQ(len, ntohs(hdr->tls_length) + sizeof(*hdr)); 953 954 payload_len = len - (tls_header_len(en) + tls_trailer_len(en)); 955 ATF_REQUIRE_MSG(payload_len <= avail, "payload_len (%zu) > avail (%zu)", 956 payload_len, avail); 957 958 if (en->tls_vminor == TLS_MINOR_VER_TWO) { 959 ATF_REQUIRE_INTEQ(payload_len, decrypt_tls_12_aead(tc, en, 960 seqno, src, len, dst, record_type)); 961 } else { 962 ATF_REQUIRE_INTEQ(payload_len, decrypt_tls_13_aead(tc, en, 963 seqno, src, len, dst, record_type)); 964 } 965 966 return (payload_len); 967 } 968 969 static size_t 970 decrypt_tls_record(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno, 971 const void *src, size_t len, void *dst, size_t avail, uint8_t *record_type) 972 { 973 if (en->cipher_algorithm == CRYPTO_AES_CBC) 974 return (decrypt_tls_aes_cbc_mte(tc, en, seqno, src, len, dst, 975 avail, record_type)); 976 else 977 return (decrypt_tls_aead(tc, en, seqno, src, len, dst, avail, 978 record_type)); 979 } 980 981 /* 982 * Encrypt a TLS record of type 'record_type' with payload 'len' bytes 983 * long at 'src' and store the result at 'dst'. If 'dst' doesn't have 984 * sufficient room ('avail'), fail the test. 'padding' is the amount 985 * of additional padding to include beyond any amount mandated by the 986 * cipher suite. 987 */ 988 static size_t 989 encrypt_tls_aes_cbc_mte(const atf_tc_t *tc, struct tls_enable *en, 990 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst, 991 size_t avail, size_t padding) 992 { 993 struct tls_record_layer *hdr; 994 struct tls_mac_data aad; 995 char *buf, *iv; 996 size_t hdr_len, mac_len, record_len; 997 u_int digest_len, i; 998 999 ATF_REQUIRE_INTEQ(0, padding % 16); 1000 1001 hdr = dst; 1002 buf = dst; 1003 1004 debug(tc, "encrypting MTE record seqno %ju:\n", (uintmax_t)seqno); 1005 hdr_len = tls_header_len(en); 1006 mac_len = tls_mac_len(en); 1007 padding += (AES_BLOCK_LEN - (len + mac_len) % AES_BLOCK_LEN); 1008 ATF_REQUIRE_MSG(padding > 0 && padding <= 255, "invalid padding (%zu)", 1009 padding); 1010 1011 record_len = hdr_len + len + mac_len + padding; 1012 ATF_REQUIRE_MSG(record_len <= avail, "record_len (%zu) > avail (%zu): " 1013 "hdr_len %zu, len %zu, mac_len %zu, padding %zu", record_len, 1014 avail, hdr_len, len, mac_len, padding); 1015 1016 hdr->tls_type = record_type; 1017 hdr->tls_vmajor = TLS_MAJOR_VER_ONE; 1018 hdr->tls_vminor = en->tls_vminor; 1019 hdr->tls_length = htons(record_len - sizeof(*hdr)); 1020 iv = (char *)(hdr + 1); 1021 for (i = 0; i < AES_BLOCK_LEN; i++) 1022 iv[i] = rdigit(); 1023 debug_hexdump(tc, iv, AES_BLOCK_LEN, "explicit IV"); 1024 1025 /* Copy plaintext to ciphertext region. */ 1026 memcpy(buf + hdr_len, src, len); 1027 1028 /* Compute HMAC. */ 1029 tls_mte_aad(en, len, hdr, seqno, &aad); 1030 debug_hexdump(tc, &aad, sizeof(aad), "aad"); 1031 debug_hexdump(tc, src, len, "plaintext"); 1032 ATF_REQUIRE(compute_hash(tls_EVP_MD(en), en->auth_key, en->auth_key_len, 1033 &aad, sizeof(aad), src, len, buf + hdr_len + len, &digest_len)); 1034 ATF_REQUIRE_INTEQ(mac_len, digest_len); 1035 1036 /* Store padding. */ 1037 for (i = 0; i < padding; i++) 1038 buf[hdr_len + len + mac_len + i] = padding - 1; 1039 debug_hexdump(tc, buf + hdr_len + len, mac_len + padding, 1040 "MAC and padding"); 1041 1042 /* Encrypt the record. */ 1043 ATF_REQUIRE(cbc_encrypt(tls_EVP_CIPHER(en), en->cipher_key, iv, 1044 buf + hdr_len, buf + hdr_len, len + mac_len + padding)); 1045 debug_hexdump(tc, dst, record_len, "encrypted record"); 1046 1047 return (record_len); 1048 } 1049 1050 static size_t 1051 encrypt_tls_12_aead(const atf_tc_t *tc, struct tls_enable *en, 1052 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst) 1053 { 1054 struct tls_record_layer *hdr; 1055 struct tls_aead_data aad; 1056 char nonce[12]; 1057 size_t hdr_len, mac_len, record_len; 1058 1059 hdr = dst; 1060 1061 debug(tc, "encrypting TLS 1.2 record seqno %ju:\n", (uintmax_t)seqno); 1062 hdr_len = tls_header_len(en); 1063 mac_len = tls_mac_len(en); 1064 record_len = hdr_len + len + mac_len; 1065 1066 hdr->tls_type = record_type; 1067 hdr->tls_vmajor = TLS_MAJOR_VER_ONE; 1068 hdr->tls_vminor = TLS_MINOR_VER_TWO; 1069 hdr->tls_length = htons(record_len - sizeof(*hdr)); 1070 if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16) 1071 memcpy(hdr + 1, &seqno, sizeof(seqno)); 1072 1073 tls_12_aead_aad(en, len, hdr, seqno, &aad); 1074 debug_hexdump(tc, &aad, sizeof(aad), "aad"); 1075 if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16) 1076 tls_12_gcm_nonce(en, hdr, nonce); 1077 else 1078 tls_13_nonce(en, seqno, nonce); 1079 debug_hexdump(tc, nonce, sizeof(nonce), "nonce"); 1080 1081 debug_hexdump(tc, src, len, "plaintext"); 1082 ATF_REQUIRE(aead_encrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce, 1083 &aad, sizeof(aad), src, (char *)dst + hdr_len, len, 1084 (char *)dst + hdr_len + len, mac_len)); 1085 debug_hexdump(tc, dst, record_len, "encrypted record"); 1086 1087 return (record_len); 1088 } 1089 1090 static size_t 1091 encrypt_tls_13_aead(const atf_tc_t *tc, struct tls_enable *en, 1092 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst, 1093 size_t padding) 1094 { 1095 struct tls_record_layer *hdr; 1096 struct tls_aead_data_13 aad; 1097 char nonce[12]; 1098 char *buf; 1099 size_t hdr_len, mac_len, record_len; 1100 1101 hdr = dst; 1102 1103 debug(tc, "encrypting TLS 1.3 record seqno %ju:\n", (uintmax_t)seqno); 1104 hdr_len = tls_header_len(en); 1105 mac_len = tls_mac_len(en); 1106 record_len = hdr_len + len + 1 + padding + mac_len; 1107 1108 hdr->tls_type = TLS_RLTYPE_APP; 1109 hdr->tls_vmajor = TLS_MAJOR_VER_ONE; 1110 hdr->tls_vminor = TLS_MINOR_VER_TWO; 1111 hdr->tls_length = htons(record_len - sizeof(*hdr)); 1112 1113 tls_13_aad(en, hdr, seqno, &aad); 1114 debug_hexdump(tc, &aad, sizeof(aad), "aad"); 1115 tls_13_nonce(en, seqno, nonce); 1116 debug_hexdump(tc, nonce, sizeof(nonce), "nonce"); 1117 1118 /* 1119 * Have to use a temporary buffer for the input so that the record 1120 * type can be appended. 1121 */ 1122 buf = malloc(len + 1 + padding); 1123 memcpy(buf, src, len); 1124 buf[len] = record_type; 1125 memset(buf + len + 1, 0, padding); 1126 debug_hexdump(tc, buf, len + 1 + padding, "plaintext + type + padding"); 1127 1128 ATF_REQUIRE(aead_encrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce, 1129 &aad, sizeof(aad), buf, (char *)dst + hdr_len, len + 1 + padding, 1130 (char *)dst + hdr_len + len + 1 + padding, mac_len)); 1131 debug_hexdump(tc, dst, record_len, "encrypted record"); 1132 1133 free(buf); 1134 1135 return (record_len); 1136 } 1137 1138 static size_t 1139 encrypt_tls_aead(const atf_tc_t *tc, struct tls_enable *en, 1140 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst, 1141 size_t avail, size_t padding) 1142 { 1143 size_t record_len; 1144 1145 record_len = tls_header_len(en) + len + padding + tls_trailer_len(en); 1146 ATF_REQUIRE_MSG(record_len <= avail, "record_len (%zu) > avail (%zu): " 1147 "header %zu len %zu padding %zu trailer %zu", record_len, avail, 1148 tls_header_len(en), len, padding, tls_trailer_len(en)); 1149 1150 if (en->tls_vminor == TLS_MINOR_VER_TWO) { 1151 ATF_REQUIRE_INTEQ(0, padding); 1152 ATF_REQUIRE_INTEQ(record_len, encrypt_tls_12_aead(tc, en, 1153 record_type, seqno, src, len, dst)); 1154 } else 1155 ATF_REQUIRE_INTEQ(record_len, encrypt_tls_13_aead(tc, en, 1156 record_type, seqno, src, len, dst, padding)); 1157 1158 return (record_len); 1159 } 1160 1161 static size_t 1162 encrypt_tls_record(const atf_tc_t *tc, struct tls_enable *en, 1163 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst, 1164 size_t avail, size_t padding) 1165 { 1166 if (en->cipher_algorithm == CRYPTO_AES_CBC) 1167 return (encrypt_tls_aes_cbc_mte(tc, en, record_type, seqno, src, 1168 len, dst, avail, padding)); 1169 else 1170 return (encrypt_tls_aead(tc, en, record_type, seqno, src, len, 1171 dst, avail, padding)); 1172 } 1173 1174 static void 1175 test_ktls_transmit_app_data(const atf_tc_t *tc, struct tls_enable *en, 1176 uint64_t seqno, size_t len) 1177 { 1178 struct kevent ev; 1179 struct tls_record_layer *hdr; 1180 char *plaintext, *decrypted, *outbuf; 1181 size_t decrypted_len, outbuf_len, outbuf_cap, record_len, written; 1182 ssize_t rv; 1183 int kq, sockets[2]; 1184 uint8_t record_type; 1185 1186 plaintext = alloc_buffer(len); 1187 debug_hexdump(tc, plaintext, len, "plaintext"); 1188 decrypted = malloc(len); 1189 outbuf_cap = tls_header_len(en) + TLS_MAX_MSG_SIZE_V10_2 + 1190 tls_trailer_len(en); 1191 outbuf = malloc(outbuf_cap); 1192 hdr = (struct tls_record_layer *)outbuf; 1193 1194 ATF_REQUIRE((kq = kqueue()) != -1); 1195 1196 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1197 1198 ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en, 1199 sizeof(*en)) == 0); 1200 check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE); 1201 1202 EV_SET(&ev, sockets[0], EVFILT_READ, EV_ADD, 0, 0, NULL); 1203 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0); 1204 EV_SET(&ev, sockets[1], EVFILT_WRITE, EV_ADD, 0, 0, NULL); 1205 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0); 1206 1207 decrypted_len = 0; 1208 outbuf_len = 0; 1209 written = 0; 1210 1211 while (decrypted_len != len) { 1212 ATF_REQUIRE(kevent(kq, NULL, 0, &ev, 1, NULL) == 1); 1213 1214 switch (ev.filter) { 1215 case EVFILT_WRITE: 1216 /* Try to write any remaining data. */ 1217 rv = write(ev.ident, plaintext + written, 1218 len - written); 1219 ATF_REQUIRE_MSG(rv > 0, 1220 "failed to write to socket"); 1221 written += rv; 1222 if (written == len) { 1223 ev.flags = EV_DISABLE; 1224 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, 1225 NULL) == 0); 1226 } 1227 break; 1228 1229 case EVFILT_READ: 1230 ATF_REQUIRE((ev.flags & EV_EOF) == 0); 1231 1232 /* 1233 * Try to read data for the next TLS record 1234 * into outbuf. Start by reading the header 1235 * to determine how much additional data to 1236 * read. 1237 */ 1238 if (outbuf_len < sizeof(struct tls_record_layer)) { 1239 rv = read(ev.ident, outbuf + outbuf_len, 1240 sizeof(struct tls_record_layer) - 1241 outbuf_len); 1242 ATF_REQUIRE_MSG(rv > 0, 1243 "failed to read from socket"); 1244 outbuf_len += rv; 1245 1246 if (outbuf_len == 1247 sizeof(struct tls_record_layer)) { 1248 debug(tc, "TLS header for seqno %ju:\n", 1249 (uintmax_t)seqno); 1250 debug_hexdump(tc, outbuf, outbuf_len, 1251 NULL); 1252 } 1253 } 1254 1255 if (outbuf_len < sizeof(struct tls_record_layer)) 1256 break; 1257 1258 record_len = sizeof(struct tls_record_layer) + 1259 ntohs(hdr->tls_length); 1260 debug(tc, "record_len %zu outbuf_cap %zu\n", 1261 record_len, outbuf_cap); 1262 ATF_REQUIRE(record_len <= outbuf_cap); 1263 ATF_REQUIRE(record_len > outbuf_len); 1264 rv = read(ev.ident, outbuf + outbuf_len, 1265 record_len - outbuf_len); 1266 if (rv == -1 && errno == EAGAIN) 1267 break; 1268 ATF_REQUIRE_MSG(rv > 0, 1269 "failed to read from socket: %s", strerror(errno)); 1270 1271 outbuf_len += rv; 1272 if (outbuf_len == record_len) { 1273 decrypted_len += decrypt_tls_record(tc, en, 1274 seqno, outbuf, outbuf_len, 1275 decrypted + decrypted_len, 1276 len - decrypted_len, &record_type); 1277 ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, record_type); 1278 1279 seqno++; 1280 outbuf_len = 0; 1281 } 1282 break; 1283 } 1284 } 1285 1286 ATF_REQUIRE_MSG(written == decrypted_len, 1287 "read %zu decrypted bytes, but wrote %zu", decrypted_len, written); 1288 1289 ATF_REQUIRE(memcmp(plaintext, decrypted, len) == 0); 1290 1291 free(outbuf); 1292 free(decrypted); 1293 free(plaintext); 1294 1295 close_sockets(sockets); 1296 ATF_REQUIRE(close(kq) == 0); 1297 } 1298 1299 static void 1300 ktls_send_control_message(int fd, uint8_t type, void *data, size_t len) 1301 { 1302 struct msghdr msg; 1303 struct cmsghdr *cmsg; 1304 char cbuf[CMSG_SPACE(sizeof(type))]; 1305 struct iovec iov; 1306 1307 memset(&msg, 0, sizeof(msg)); 1308 1309 msg.msg_control = cbuf; 1310 msg.msg_controllen = sizeof(cbuf); 1311 cmsg = CMSG_FIRSTHDR(&msg); 1312 cmsg->cmsg_level = IPPROTO_TCP; 1313 cmsg->cmsg_type = TLS_SET_RECORD_TYPE; 1314 cmsg->cmsg_len = CMSG_LEN(sizeof(type)); 1315 *(uint8_t *)CMSG_DATA(cmsg) = type; 1316 1317 iov.iov_base = data; 1318 iov.iov_len = len; 1319 msg.msg_iov = &iov; 1320 msg.msg_iovlen = 1; 1321 1322 ATF_REQUIRE_INTEQ((ssize_t)len, sendmsg(fd, &msg, 0)); 1323 } 1324 1325 static void 1326 test_ktls_transmit_control(const atf_tc_t *tc, struct tls_enable *en, 1327 uint64_t seqno, uint8_t type, size_t len) 1328 { 1329 struct tls_record_layer *hdr; 1330 char *plaintext, *decrypted, *outbuf; 1331 size_t outbuf_cap, payload_len, record_len; 1332 ssize_t rv; 1333 int sockets[2]; 1334 uint8_t record_type; 1335 1336 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); 1337 1338 plaintext = alloc_buffer(len); 1339 decrypted = malloc(len); 1340 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); 1341 outbuf = malloc(outbuf_cap); 1342 hdr = (struct tls_record_layer *)outbuf; 1343 1344 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1345 1346 ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en, 1347 sizeof(*en)) == 0); 1348 check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE); 1349 1350 fd_set_blocking(sockets[0]); 1351 fd_set_blocking(sockets[1]); 1352 1353 ktls_send_control_message(sockets[1], type, plaintext, len); 1354 1355 /* 1356 * First read the header to determine how much additional data 1357 * to read. 1358 */ 1359 rv = read(sockets[0], outbuf, sizeof(struct tls_record_layer)); 1360 ATF_REQUIRE_INTEQ(sizeof(struct tls_record_layer), rv); 1361 payload_len = ntohs(hdr->tls_length); 1362 record_len = payload_len + sizeof(struct tls_record_layer); 1363 ATF_REQUIRE_MSG(record_len <= outbuf_cap, 1364 "record_len (%zu) > outbuf_cap (%zu)", record_len, outbuf_cap); 1365 rv = read(sockets[0], outbuf + sizeof(struct tls_record_layer), 1366 payload_len); 1367 ATF_REQUIRE_INTEQ((ssize_t)payload_len, rv); 1368 1369 rv = decrypt_tls_record(tc, en, seqno, outbuf, record_len, decrypted, 1370 len, &record_type); 1371 1372 ATF_REQUIRE_MSG((ssize_t)len == rv, 1373 "read %zd decrypted bytes, but wrote %zu", rv, len); 1374 ATF_REQUIRE_INTEQ(type, record_type); 1375 1376 ATF_REQUIRE(memcmp(plaintext, decrypted, len) == 0); 1377 1378 free(outbuf); 1379 free(decrypted); 1380 free(plaintext); 1381 1382 close_sockets(sockets); 1383 } 1384 1385 static void 1386 test_ktls_transmit_empty_fragment(const atf_tc_t *tc, struct tls_enable *en, 1387 uint64_t seqno) 1388 { 1389 struct tls_record_layer *hdr; 1390 char *outbuf; 1391 size_t outbuf_cap, payload_len, record_len; 1392 ssize_t rv; 1393 int sockets[2]; 1394 uint8_t record_type; 1395 1396 outbuf_cap = tls_header_len(en) + tls_trailer_len(en); 1397 outbuf = malloc(outbuf_cap); 1398 hdr = (struct tls_record_layer *)outbuf; 1399 1400 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1401 1402 ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en, 1403 sizeof(*en)) == 0); 1404 check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE); 1405 1406 fd_set_blocking(sockets[0]); 1407 fd_set_blocking(sockets[1]); 1408 1409 /* 1410 * A write of zero bytes should send an empty fragment only for 1411 * TLS 1.0, otherwise an error should be raised. 1412 */ 1413 rv = write(sockets[1], NULL, 0); 1414 if (rv == 0) { 1415 ATF_REQUIRE_INTEQ(CRYPTO_AES_CBC, en->cipher_algorithm); 1416 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_ZERO, en->tls_vminor); 1417 } else { 1418 ATF_REQUIRE_INTEQ(-1, rv); 1419 ATF_REQUIRE_ERRNO(EINVAL, true); 1420 goto out; 1421 } 1422 1423 /* 1424 * First read the header to determine how much additional data 1425 * to read. 1426 */ 1427 rv = read(sockets[0], outbuf, sizeof(struct tls_record_layer)); 1428 ATF_REQUIRE_INTEQ(sizeof(struct tls_record_layer), rv); 1429 payload_len = ntohs(hdr->tls_length); 1430 record_len = payload_len + sizeof(struct tls_record_layer); 1431 ATF_REQUIRE_MSG(record_len <= outbuf_cap, 1432 "record_len (%zu) > outbuf_cap (%zu)", record_len, outbuf_cap); 1433 rv = read(sockets[0], outbuf + sizeof(struct tls_record_layer), 1434 payload_len); 1435 ATF_REQUIRE_INTEQ((ssize_t)payload_len, rv); 1436 1437 rv = decrypt_tls_record(tc, en, seqno, outbuf, record_len, NULL, 0, 1438 &record_type); 1439 1440 ATF_REQUIRE_MSG(rv == 0, 1441 "read %zd decrypted bytes for an empty fragment", rv); 1442 ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, record_type); 1443 1444 out: 1445 free(outbuf); 1446 1447 close_sockets(sockets); 1448 } 1449 1450 static size_t 1451 ktls_receive_tls_record(struct tls_enable *en, int fd, uint8_t record_type, 1452 void *data, size_t len) 1453 { 1454 struct msghdr msg; 1455 struct cmsghdr *cmsg; 1456 struct tls_get_record *tgr; 1457 char cbuf[CMSG_SPACE(sizeof(*tgr))]; 1458 struct iovec iov; 1459 ssize_t rv; 1460 1461 memset(&msg, 0, sizeof(msg)); 1462 1463 msg.msg_control = cbuf; 1464 msg.msg_controllen = sizeof(cbuf); 1465 1466 iov.iov_base = data; 1467 iov.iov_len = len; 1468 msg.msg_iov = &iov; 1469 msg.msg_iovlen = 1; 1470 1471 ATF_REQUIRE((rv = recvmsg(fd, &msg, 0)) > 0); 1472 1473 ATF_REQUIRE((msg.msg_flags & (MSG_EOR | MSG_CTRUNC)) == MSG_EOR); 1474 1475 cmsg = CMSG_FIRSTHDR(&msg); 1476 ATF_REQUIRE(cmsg != NULL); 1477 ATF_REQUIRE_INTEQ(IPPROTO_TCP, cmsg->cmsg_level); 1478 ATF_REQUIRE_INTEQ(TLS_GET_RECORD, cmsg->cmsg_type); 1479 ATF_REQUIRE_INTEQ(CMSG_LEN(sizeof(*tgr)), cmsg->cmsg_len); 1480 1481 tgr = (struct tls_get_record *)CMSG_DATA(cmsg); 1482 ATF_REQUIRE_INTEQ(record_type, tgr->tls_type); 1483 ATF_REQUIRE_INTEQ(en->tls_vmajor, tgr->tls_vmajor); 1484 /* XXX: Not sure if this is what OpenSSL expects? */ 1485 if (en->tls_vminor == TLS_MINOR_VER_THREE) 1486 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, tgr->tls_vminor); 1487 else 1488 ATF_REQUIRE_INTEQ(en->tls_vminor, tgr->tls_vminor); 1489 ATF_REQUIRE_INTEQ(htons(rv), tgr->tls_length); 1490 1491 return (rv); 1492 } 1493 1494 static void 1495 test_ktls_receive_app_data(const atf_tc_t *tc, struct tls_enable *en, 1496 uint64_t seqno, size_t len, size_t padding) 1497 { 1498 struct kevent ev; 1499 char *plaintext, *received, *outbuf; 1500 size_t outbuf_cap, outbuf_len, outbuf_sent, received_len, todo, written; 1501 ssize_t rv; 1502 int kq, sockets[2]; 1503 1504 plaintext = alloc_buffer(len); 1505 received = malloc(len); 1506 outbuf_cap = tls_header_len(en) + TLS_MAX_MSG_SIZE_V10_2 + 1507 tls_trailer_len(en); 1508 outbuf = malloc(outbuf_cap); 1509 1510 ATF_REQUIRE((kq = kqueue()) != -1); 1511 1512 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1513 1514 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, 1515 sizeof(*en)) == 0); 1516 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); 1517 1518 EV_SET(&ev, sockets[0], EVFILT_READ, EV_ADD, 0, 0, NULL); 1519 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0); 1520 EV_SET(&ev, sockets[1], EVFILT_WRITE, EV_ADD, 0, 0, NULL); 1521 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0); 1522 1523 received_len = 0; 1524 outbuf_len = 0; 1525 written = 0; 1526 1527 while (received_len != len) { 1528 ATF_REQUIRE(kevent(kq, NULL, 0, &ev, 1, NULL) == 1); 1529 1530 switch (ev.filter) { 1531 case EVFILT_WRITE: 1532 /* 1533 * Compose the next TLS record to send. 1534 */ 1535 if (outbuf_len == 0) { 1536 ATF_REQUIRE(written < len); 1537 todo = len - written; 1538 if (todo > TLS_MAX_MSG_SIZE_V10_2 - padding) 1539 todo = TLS_MAX_MSG_SIZE_V10_2 - padding; 1540 outbuf_len = encrypt_tls_record(tc, en, 1541 TLS_RLTYPE_APP, seqno, plaintext + written, 1542 todo, outbuf, outbuf_cap, padding); 1543 outbuf_sent = 0; 1544 written += todo; 1545 seqno++; 1546 } 1547 1548 /* 1549 * Try to write the remainder of the current 1550 * TLS record. 1551 */ 1552 rv = write(ev.ident, outbuf + outbuf_sent, 1553 outbuf_len - outbuf_sent); 1554 ATF_REQUIRE_MSG(rv > 0, 1555 "failed to write to socket: %s", strerror(errno)); 1556 outbuf_sent += rv; 1557 if (outbuf_sent == outbuf_len) { 1558 outbuf_len = 0; 1559 if (written == len) { 1560 ev.flags = EV_DISABLE; 1561 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, 1562 NULL) == 0); 1563 } 1564 } 1565 break; 1566 1567 case EVFILT_READ: 1568 ATF_REQUIRE((ev.flags & EV_EOF) == 0); 1569 1570 rv = ktls_receive_tls_record(en, ev.ident, 1571 TLS_RLTYPE_APP, received + received_len, 1572 len - received_len); 1573 received_len += rv; 1574 break; 1575 } 1576 } 1577 1578 ATF_REQUIRE_MSG(written == received_len, 1579 "read %zu decrypted bytes, but wrote %zu", received_len, written); 1580 1581 ATF_REQUIRE(memcmp(plaintext, received, len) == 0); 1582 1583 free(outbuf); 1584 free(received); 1585 free(plaintext); 1586 1587 close_sockets(sockets); 1588 ATF_REQUIRE(close(kq) == 0); 1589 } 1590 1591 static void 1592 ktls_receive_tls_error(int fd, int expected_error) 1593 { 1594 struct msghdr msg; 1595 struct tls_get_record *tgr; 1596 char cbuf[CMSG_SPACE(sizeof(*tgr))]; 1597 char buf[64]; 1598 struct iovec iov; 1599 1600 memset(&msg, 0, sizeof(msg)); 1601 1602 msg.msg_control = cbuf; 1603 msg.msg_controllen = sizeof(cbuf); 1604 1605 iov.iov_base = buf; 1606 iov.iov_len = sizeof(buf); 1607 msg.msg_iov = &iov; 1608 msg.msg_iovlen = 1; 1609 1610 ATF_REQUIRE(recvmsg(fd, &msg, 0) == -1); 1611 if (expected_error != 0) 1612 ATF_REQUIRE_ERRNO(expected_error, true); 1613 } 1614 1615 static void 1616 test_ktls_receive_corrupted_record(const atf_tc_t *tc, struct tls_enable *en, 1617 uint64_t seqno, size_t len, ssize_t offset) 1618 { 1619 char *plaintext, *outbuf; 1620 size_t outbuf_cap, outbuf_len; 1621 ssize_t rv; 1622 int sockets[2]; 1623 1624 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); 1625 1626 plaintext = alloc_buffer(len); 1627 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); 1628 outbuf = malloc(outbuf_cap); 1629 1630 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1631 1632 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, 1633 sizeof(*en)) == 0); 1634 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); 1635 1636 fd_set_blocking(sockets[0]); 1637 fd_set_blocking(sockets[1]); 1638 1639 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno, 1640 plaintext, len, outbuf, outbuf_cap, 0); 1641 1642 /* A negative offset is an offset from the end. */ 1643 if (offset < 0) 1644 offset += outbuf_len; 1645 outbuf[offset] ^= 0x01; 1646 1647 rv = write(sockets[1], outbuf, outbuf_len); 1648 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv); 1649 1650 ktls_receive_tls_error(sockets[0], EBADMSG); 1651 1652 free(outbuf); 1653 free(plaintext); 1654 1655 close_sockets_ignore_errors(sockets); 1656 } 1657 1658 static void 1659 test_ktls_receive_corrupted_iv(const atf_tc_t *tc, struct tls_enable *en, 1660 uint64_t seqno, size_t len) 1661 { 1662 ATF_REQUIRE(tls_header_len(en) > sizeof(struct tls_record_layer)); 1663 1664 /* Corrupt the first byte of the explicit IV after the header. */ 1665 test_ktls_receive_corrupted_record(tc, en, seqno, len, 1666 sizeof(struct tls_record_layer)); 1667 } 1668 1669 static void 1670 test_ktls_receive_corrupted_data(const atf_tc_t *tc, struct tls_enable *en, 1671 uint64_t seqno, size_t len) 1672 { 1673 ATF_REQUIRE(len > 0); 1674 1675 /* Corrupt the first ciphertext byte after the header. */ 1676 test_ktls_receive_corrupted_record(tc, en, seqno, len, 1677 tls_header_len(en)); 1678 } 1679 1680 static void 1681 test_ktls_receive_corrupted_mac(const atf_tc_t *tc, struct tls_enable *en, 1682 uint64_t seqno, size_t len) 1683 { 1684 size_t offset; 1685 1686 /* Corrupt the first byte of the MAC. */ 1687 if (en->cipher_algorithm == CRYPTO_AES_CBC) 1688 offset = tls_header_len(en) + len; 1689 else 1690 offset = -tls_mac_len(en); 1691 test_ktls_receive_corrupted_record(tc, en, seqno, len, offset); 1692 } 1693 1694 static void 1695 test_ktls_receive_corrupted_padding(const atf_tc_t *tc, struct tls_enable *en, 1696 uint64_t seqno, size_t len) 1697 { 1698 ATF_REQUIRE_INTEQ(CRYPTO_AES_CBC, en->cipher_algorithm); 1699 1700 /* Corrupt the last byte of the padding. */ 1701 test_ktls_receive_corrupted_record(tc, en, seqno, len, -1); 1702 } 1703 1704 static void 1705 test_ktls_receive_truncated_record(const atf_tc_t *tc, struct tls_enable *en, 1706 uint64_t seqno, size_t len) 1707 { 1708 char *plaintext, *outbuf; 1709 size_t outbuf_cap, outbuf_len; 1710 ssize_t rv; 1711 int sockets[2]; 1712 1713 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); 1714 1715 plaintext = alloc_buffer(len); 1716 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); 1717 outbuf = malloc(outbuf_cap); 1718 1719 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1720 1721 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, 1722 sizeof(*en)) == 0); 1723 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); 1724 1725 fd_set_blocking(sockets[0]); 1726 fd_set_blocking(sockets[1]); 1727 1728 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno, 1729 plaintext, len, outbuf, outbuf_cap, 0); 1730 1731 rv = write(sockets[1], outbuf, outbuf_len / 2); 1732 ATF_REQUIRE_INTEQ((ssize_t)(outbuf_len / 2), rv); 1733 1734 ATF_REQUIRE(shutdown(sockets[1], SHUT_WR) == 0); 1735 1736 ktls_receive_tls_error(sockets[0], EMSGSIZE); 1737 1738 free(outbuf); 1739 free(plaintext); 1740 1741 close_sockets_ignore_errors(sockets); 1742 } 1743 1744 static void 1745 test_ktls_receive_bad_major(const atf_tc_t *tc, struct tls_enable *en, 1746 uint64_t seqno, size_t len) 1747 { 1748 struct tls_record_layer *hdr; 1749 char *plaintext, *outbuf; 1750 size_t outbuf_cap, outbuf_len; 1751 ssize_t rv; 1752 int sockets[2]; 1753 1754 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); 1755 1756 plaintext = alloc_buffer(len); 1757 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); 1758 outbuf = malloc(outbuf_cap); 1759 1760 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1761 1762 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, 1763 sizeof(*en)) == 0); 1764 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); 1765 1766 fd_set_blocking(sockets[0]); 1767 fd_set_blocking(sockets[1]); 1768 1769 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno, 1770 plaintext, len, outbuf, outbuf_cap, 0); 1771 1772 hdr = (void *)outbuf; 1773 hdr->tls_vmajor++; 1774 1775 rv = write(sockets[1], outbuf, outbuf_len); 1776 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv); 1777 1778 ktls_receive_tls_error(sockets[0], EINVAL); 1779 1780 free(outbuf); 1781 free(plaintext); 1782 1783 close_sockets_ignore_errors(sockets); 1784 } 1785 1786 static void 1787 test_ktls_receive_bad_minor(const atf_tc_t *tc, struct tls_enable *en, 1788 uint64_t seqno, size_t len) 1789 { 1790 struct tls_record_layer *hdr; 1791 char *plaintext, *outbuf; 1792 size_t outbuf_cap, outbuf_len; 1793 ssize_t rv; 1794 int sockets[2]; 1795 1796 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); 1797 1798 plaintext = alloc_buffer(len); 1799 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); 1800 outbuf = malloc(outbuf_cap); 1801 1802 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1803 1804 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, 1805 sizeof(*en)) == 0); 1806 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); 1807 1808 fd_set_blocking(sockets[0]); 1809 fd_set_blocking(sockets[1]); 1810 1811 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno, 1812 plaintext, len, outbuf, outbuf_cap, 0); 1813 1814 hdr = (void *)outbuf; 1815 hdr->tls_vminor++; 1816 1817 rv = write(sockets[1], outbuf, outbuf_len); 1818 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv); 1819 1820 ktls_receive_tls_error(sockets[0], EINVAL); 1821 1822 free(outbuf); 1823 free(plaintext); 1824 1825 close_sockets_ignore_errors(sockets); 1826 } 1827 1828 static void 1829 test_ktls_receive_bad_type(const atf_tc_t *tc, struct tls_enable *en, 1830 uint64_t seqno, size_t len) 1831 { 1832 struct tls_record_layer *hdr; 1833 char *plaintext, *outbuf; 1834 size_t outbuf_cap, outbuf_len; 1835 ssize_t rv; 1836 int sockets[2]; 1837 1838 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); 1839 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_THREE, en->tls_vminor); 1840 1841 plaintext = alloc_buffer(len); 1842 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); 1843 outbuf = malloc(outbuf_cap); 1844 1845 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1846 1847 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, 1848 sizeof(*en)) == 0); 1849 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); 1850 1851 fd_set_blocking(sockets[0]); 1852 fd_set_blocking(sockets[1]); 1853 1854 outbuf_len = encrypt_tls_record(tc, en, 0x21 /* Alert */, seqno, 1855 plaintext, len, outbuf, outbuf_cap, 0); 1856 1857 hdr = (void *)outbuf; 1858 hdr->tls_type = TLS_RLTYPE_APP + 1; 1859 1860 rv = write(sockets[1], outbuf, outbuf_len); 1861 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv); 1862 1863 ktls_receive_tls_error(sockets[0], EINVAL); 1864 1865 free(outbuf); 1866 free(plaintext); 1867 1868 close_sockets_ignore_errors(sockets); 1869 } 1870 1871 static void 1872 test_ktls_receive_bad_size(const atf_tc_t *tc, struct tls_enable *en, 1873 uint64_t seqno, size_t len) 1874 { 1875 struct tls_record_layer *hdr; 1876 char *outbuf; 1877 size_t outbuf_len; 1878 ssize_t rv; 1879 int sockets[2]; 1880 1881 outbuf_len = sizeof(*hdr) + len; 1882 outbuf = calloc(1, outbuf_len); 1883 1884 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1885 1886 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, 1887 sizeof(*en)) == 0); 1888 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); 1889 1890 fd_set_blocking(sockets[0]); 1891 fd_set_blocking(sockets[1]); 1892 1893 hdr = (void *)outbuf; 1894 hdr->tls_vmajor = en->tls_vmajor; 1895 if (en->tls_vminor == TLS_MINOR_VER_THREE) 1896 hdr->tls_vminor = TLS_MINOR_VER_TWO; 1897 else 1898 hdr->tls_vminor = en->tls_vminor; 1899 hdr->tls_type = TLS_RLTYPE_APP; 1900 hdr->tls_length = htons(len); 1901 1902 rv = write(sockets[1], outbuf, outbuf_len); 1903 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv); 1904 1905 /* 1906 * The other end may notice the error and drop the connection 1907 * before this executes resulting in shutdown() failing with 1908 * either ENOTCONN or ECONNRESET. Ignore this error if it 1909 * occurs. 1910 */ 1911 if (shutdown(sockets[1], SHUT_WR) != 0) { 1912 ATF_REQUIRE_MSG(errno == ENOTCONN || errno == ECONNRESET, 1913 "shutdown() failed: %s", strerror(errno)); 1914 } 1915 1916 ktls_receive_tls_error(sockets[0], EMSGSIZE); 1917 1918 free(outbuf); 1919 1920 close_sockets_ignore_errors(sockets); 1921 } 1922 1923 #define TLS_10_TESTS(M) \ 1924 M(aes128_cbc_1_0_sha1, CRYPTO_AES_CBC, 128 / 8, \ 1925 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO) \ 1926 M(aes256_cbc_1_0_sha1, CRYPTO_AES_CBC, 256 / 8, \ 1927 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO) 1928 1929 #define TLS_13_TESTS(M) \ 1930 M(aes128_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \ 1931 TLS_MINOR_VER_THREE) \ 1932 M(aes256_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0, \ 1933 TLS_MINOR_VER_THREE) \ 1934 M(chacha20_poly1305_1_3, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \ 1935 TLS_MINOR_VER_THREE) 1936 1937 #define AES_CBC_NONZERO_TESTS(M) \ 1938 M(aes128_cbc_1_1_sha1, CRYPTO_AES_CBC, 128 / 8, \ 1939 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ONE) \ 1940 M(aes256_cbc_1_1_sha1, CRYPTO_AES_CBC, 256 / 8, \ 1941 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ONE) \ 1942 M(aes128_cbc_1_2_sha1, CRYPTO_AES_CBC, 128 / 8, \ 1943 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_TWO) \ 1944 M(aes256_cbc_1_2_sha1, CRYPTO_AES_CBC, 256 / 8, \ 1945 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_TWO) \ 1946 M(aes128_cbc_1_2_sha256, CRYPTO_AES_CBC, 128 / 8, \ 1947 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_TWO) \ 1948 M(aes256_cbc_1_2_sha256, CRYPTO_AES_CBC, 256 / 8, \ 1949 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_TWO) \ 1950 M(aes128_cbc_1_2_sha384, CRYPTO_AES_CBC, 128 / 8, \ 1951 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_TWO) \ 1952 M(aes256_cbc_1_2_sha384, CRYPTO_AES_CBC, 256 / 8, \ 1953 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_TWO) \ 1954 1955 #define AES_CBC_TESTS(M) \ 1956 TLS_10_TESTS(M) \ 1957 AES_CBC_NONZERO_TESTS(M) 1958 1959 #define AES_GCM_12_TESTS(M) \ 1960 M(aes128_gcm_1_2, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \ 1961 TLS_MINOR_VER_TWO) \ 1962 M(aes256_gcm_1_2, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0, \ 1963 TLS_MINOR_VER_TWO) 1964 1965 #define AES_GCM_TESTS(M) \ 1966 AES_GCM_12_TESTS(M) \ 1967 M(aes128_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \ 1968 TLS_MINOR_VER_THREE) \ 1969 M(aes256_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0, \ 1970 TLS_MINOR_VER_THREE) 1971 1972 #define CHACHA20_TESTS(M) \ 1973 M(chacha20_poly1305_1_2, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \ 1974 TLS_MINOR_VER_TWO) \ 1975 M(chacha20_poly1305_1_3, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \ 1976 TLS_MINOR_VER_THREE) 1977 1978 #define GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 1979 auth_alg, minor, name, len) \ 1980 ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_##name); \ 1981 ATF_TC_BODY(ktls_transmit_##cipher_name##_##name, tc) \ 1982 { \ 1983 struct tls_enable en; \ 1984 uint64_t seqno; \ 1985 \ 1986 ATF_REQUIRE_KTLS(); \ 1987 seqno = random(); \ 1988 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 1989 seqno, &en); \ 1990 test_ktls_transmit_app_data(tc, &en, seqno, len); \ 1991 free_tls_enable(&en); \ 1992 } 1993 1994 #define ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 1995 auth_alg, minor, name) \ 1996 ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_##name); 1997 1998 #define GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 1999 auth_alg, minor, name, type, len) \ 2000 ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_##name); \ 2001 ATF_TC_BODY(ktls_transmit_##cipher_name##_##name, tc) \ 2002 { \ 2003 struct tls_enable en; \ 2004 uint64_t seqno; \ 2005 \ 2006 ATF_REQUIRE_KTLS(); \ 2007 seqno = random(); \ 2008 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2009 seqno, &en); \ 2010 test_ktls_transmit_control(tc, &en, seqno, type, len); \ 2011 free_tls_enable(&en); \ 2012 } 2013 2014 #define ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2015 auth_alg, minor, name) \ 2016 ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_##name); 2017 2018 #define GEN_TRANSMIT_EMPTY_FRAGMENT_TEST(cipher_name, cipher_alg, \ 2019 key_size, auth_alg, minor) \ 2020 ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_empty_fragment); \ 2021 ATF_TC_BODY(ktls_transmit_##cipher_name##_empty_fragment, tc) \ 2022 { \ 2023 struct tls_enable en; \ 2024 uint64_t seqno; \ 2025 \ 2026 ATF_REQUIRE_KTLS(); \ 2027 seqno = random(); \ 2028 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2029 seqno, &en); \ 2030 test_ktls_transmit_empty_fragment(tc, &en, seqno); \ 2031 free_tls_enable(&en); \ 2032 } 2033 2034 #define ADD_TRANSMIT_EMPTY_FRAGMENT_TEST(cipher_name, cipher_alg, \ 2035 key_size, auth_alg, minor) \ 2036 ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_empty_fragment); 2037 2038 #define GEN_TRANSMIT_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ 2039 minor) \ 2040 GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2041 auth_alg, minor, short, 64) \ 2042 GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2043 auth_alg, minor, long, 64 * 1024) \ 2044 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2045 auth_alg, minor, control, 0x21 /* Alert */, 32) 2046 2047 #define ADD_TRANSMIT_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ 2048 minor) \ 2049 ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2050 auth_alg, minor, short) \ 2051 ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2052 auth_alg, minor, long) \ 2053 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2054 auth_alg, minor, control) 2055 2056 /* 2057 * For each supported cipher suite, run three transmit tests: 2058 * 2059 * - a short test which sends 64 bytes of application data (likely as 2060 * a single TLS record) 2061 * 2062 * - a long test which sends 64KB of application data (split across 2063 * multiple TLS records) 2064 * 2065 * - a control test which sends a single record with a specific 2066 * content type via sendmsg() 2067 */ 2068 AES_CBC_TESTS(GEN_TRANSMIT_TESTS); 2069 AES_GCM_TESTS(GEN_TRANSMIT_TESTS); 2070 CHACHA20_TESTS(GEN_TRANSMIT_TESTS); 2071 2072 #define GEN_TRANSMIT_PADDING_TESTS(cipher_name, cipher_alg, key_size, \ 2073 auth_alg, minor) \ 2074 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2075 auth_alg, minor, padding_1, 0x21 /* Alert */, 1) \ 2076 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2077 auth_alg, minor, padding_2, 0x21 /* Alert */, 2) \ 2078 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2079 auth_alg, minor, padding_3, 0x21 /* Alert */, 3) \ 2080 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2081 auth_alg, minor, padding_4, 0x21 /* Alert */, 4) \ 2082 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2083 auth_alg, minor, padding_5, 0x21 /* Alert */, 5) \ 2084 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2085 auth_alg, minor, padding_6, 0x21 /* Alert */, 6) \ 2086 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2087 auth_alg, minor, padding_7, 0x21 /* Alert */, 7) \ 2088 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2089 auth_alg, minor, padding_8, 0x21 /* Alert */, 8) \ 2090 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2091 auth_alg, minor, padding_9, 0x21 /* Alert */, 9) \ 2092 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2093 auth_alg, minor, padding_10, 0x21 /* Alert */, 10) \ 2094 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2095 auth_alg, minor, padding_11, 0x21 /* Alert */, 11) \ 2096 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2097 auth_alg, minor, padding_12, 0x21 /* Alert */, 12) \ 2098 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2099 auth_alg, minor, padding_13, 0x21 /* Alert */, 13) \ 2100 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2101 auth_alg, minor, padding_14, 0x21 /* Alert */, 14) \ 2102 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2103 auth_alg, minor, padding_15, 0x21 /* Alert */, 15) \ 2104 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2105 auth_alg, minor, padding_16, 0x21 /* Alert */, 16) 2106 2107 #define ADD_TRANSMIT_PADDING_TESTS(cipher_name, cipher_alg, key_size, \ 2108 auth_alg, minor) \ 2109 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2110 auth_alg, minor, padding_1) \ 2111 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2112 auth_alg, minor, padding_2) \ 2113 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2114 auth_alg, minor, padding_3) \ 2115 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2116 auth_alg, minor, padding_4) \ 2117 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2118 auth_alg, minor, padding_5) \ 2119 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2120 auth_alg, minor, padding_6) \ 2121 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2122 auth_alg, minor, padding_7) \ 2123 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2124 auth_alg, minor, padding_8) \ 2125 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2126 auth_alg, minor, padding_9) \ 2127 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2128 auth_alg, minor, padding_10) \ 2129 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2130 auth_alg, minor, padding_11) \ 2131 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2132 auth_alg, minor, padding_12) \ 2133 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2134 auth_alg, minor, padding_13) \ 2135 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2136 auth_alg, minor, padding_14) \ 2137 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2138 auth_alg, minor, padding_15) \ 2139 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2140 auth_alg, minor, padding_16) 2141 2142 /* 2143 * For AES-CBC MTE cipher suites using padding, add tests of messages 2144 * with each possible padding size. Note that the padding_<N> tests 2145 * do not necessarily test <N> bytes of padding as the padding is a 2146 * function of the cipher suite's MAC length. However, cycling 2147 * through all of the payload sizes from 1 to 16 should exercise all 2148 * of the possible padding lengths for each suite. 2149 */ 2150 AES_CBC_TESTS(GEN_TRANSMIT_PADDING_TESTS); 2151 2152 /* 2153 * Test "empty fragments" which are TLS records with no payload that 2154 * OpenSSL can send for TLS 1.0 connections. 2155 */ 2156 AES_CBC_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST); 2157 AES_GCM_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST); 2158 CHACHA20_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST); 2159 2160 static void 2161 test_ktls_invalid_transmit_cipher_suite(const atf_tc_t *tc, 2162 struct tls_enable *en) 2163 { 2164 int sockets[2]; 2165 2166 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 2167 2168 ATF_REQUIRE_ERRNO(EINVAL, setsockopt(sockets[1], IPPROTO_TCP, 2169 TCP_TXTLS_ENABLE, en, sizeof(*en)) == -1); 2170 2171 close_sockets(sockets); 2172 } 2173 2174 #define GEN_INVALID_TRANSMIT_TEST(name, cipher_alg, key_size, auth_alg, \ 2175 minor) \ 2176 ATF_TC_WITHOUT_HEAD(ktls_transmit_invalid_##name); \ 2177 ATF_TC_BODY(ktls_transmit_invalid_##name, tc) \ 2178 { \ 2179 struct tls_enable en; \ 2180 uint64_t seqno; \ 2181 \ 2182 ATF_REQUIRE_KTLS(); \ 2183 seqno = random(); \ 2184 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2185 seqno, &en); \ 2186 test_ktls_invalid_transmit_cipher_suite(tc, &en); \ 2187 free_tls_enable(&en); \ 2188 } 2189 2190 #define ADD_INVALID_TRANSMIT_TEST(name, cipher_alg, key_size, auth_alg, \ 2191 minor) \ 2192 ATF_TP_ADD_TC(tp, ktls_transmit_invalid_##name); 2193 2194 #define INVALID_CIPHER_SUITES(M) \ 2195 M(aes128_cbc_1_0_sha256, CRYPTO_AES_CBC, 128 / 8, \ 2196 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_ZERO) \ 2197 M(aes128_cbc_1_0_sha384, CRYPTO_AES_CBC, 128 / 8, \ 2198 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_ZERO) \ 2199 M(aes128_gcm_1_0, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \ 2200 TLS_MINOR_VER_ZERO) \ 2201 M(chacha20_poly1305_1_0, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \ 2202 TLS_MINOR_VER_ZERO) \ 2203 M(aes128_cbc_1_1_sha256, CRYPTO_AES_CBC, 128 / 8, \ 2204 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_ONE) \ 2205 M(aes128_cbc_1_1_sha384, CRYPTO_AES_CBC, 128 / 8, \ 2206 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_ONE) \ 2207 M(aes128_gcm_1_1, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \ 2208 TLS_MINOR_VER_ONE) \ 2209 M(chacha20_poly1305_1_1, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \ 2210 TLS_MINOR_VER_ONE) \ 2211 M(aes128_cbc_1_3_sha1, CRYPTO_AES_CBC, 128 / 8, \ 2212 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_THREE) \ 2213 M(aes128_cbc_1_3_sha256, CRYPTO_AES_CBC, 128 / 8, \ 2214 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_THREE) \ 2215 M(aes128_cbc_1_3_sha384, CRYPTO_AES_CBC, 128 / 8, \ 2216 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_THREE) 2217 2218 /* 2219 * Ensure that invalid cipher suites are rejected for transmit. 2220 */ 2221 INVALID_CIPHER_SUITES(GEN_INVALID_TRANSMIT_TEST); 2222 2223 #define GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2224 auth_alg, minor, name, len, padding) \ 2225 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_##name); \ 2226 ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ 2227 { \ 2228 struct tls_enable en; \ 2229 uint64_t seqno; \ 2230 \ 2231 ATF_REQUIRE_KTLS(); \ 2232 seqno = random(); \ 2233 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2234 seqno, &en); \ 2235 test_ktls_receive_app_data(tc, &en, seqno, len, padding); \ 2236 free_tls_enable(&en); \ 2237 } 2238 2239 #define ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2240 auth_alg, minor, name) \ 2241 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name); 2242 2243 #define GEN_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2244 auth_alg, minor, len) \ 2245 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_data); \ 2246 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_data, tc) \ 2247 { \ 2248 struct tls_enable en; \ 2249 uint64_t seqno; \ 2250 \ 2251 ATF_REQUIRE_KTLS(); \ 2252 seqno = random(); \ 2253 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2254 seqno, &en); \ 2255 test_ktls_receive_corrupted_data(tc, &en, seqno, len); \ 2256 free_tls_enable(&en); \ 2257 } 2258 2259 #define ADD_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2260 auth_alg, minor) \ 2261 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_data); 2262 2263 #define GEN_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size, \ 2264 auth_alg, minor, len) \ 2265 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_mac); \ 2266 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_mac, tc) \ 2267 { \ 2268 struct tls_enable en; \ 2269 uint64_t seqno; \ 2270 \ 2271 ATF_REQUIRE_KTLS(); \ 2272 seqno = random(); \ 2273 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2274 seqno, &en); \ 2275 test_ktls_receive_corrupted_mac(tc, &en, seqno, len); \ 2276 free_tls_enable(&en); \ 2277 } 2278 2279 #define ADD_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size, \ 2280 auth_alg, minor) \ 2281 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_mac); 2282 2283 #define GEN_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size, \ 2284 auth_alg, minor, len) \ 2285 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_truncated_record); \ 2286 ATF_TC_BODY(ktls_receive_##cipher_name##_truncated_record, tc) \ 2287 { \ 2288 struct tls_enable en; \ 2289 uint64_t seqno; \ 2290 \ 2291 ATF_REQUIRE_KTLS(); \ 2292 seqno = random(); \ 2293 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2294 seqno, &en); \ 2295 test_ktls_receive_truncated_record(tc, &en, seqno, len); \ 2296 free_tls_enable(&en); \ 2297 } 2298 2299 #define ADD_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size, \ 2300 auth_alg, minor) \ 2301 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_truncated_record); 2302 2303 #define GEN_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size, \ 2304 auth_alg, minor, len) \ 2305 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_major); \ 2306 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_major, tc) \ 2307 { \ 2308 struct tls_enable en; \ 2309 uint64_t seqno; \ 2310 \ 2311 ATF_REQUIRE_KTLS(); \ 2312 seqno = random(); \ 2313 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2314 seqno, &en); \ 2315 test_ktls_receive_bad_major(tc, &en, seqno, len); \ 2316 free_tls_enable(&en); \ 2317 } 2318 2319 #define ADD_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size, \ 2320 auth_alg, minor) \ 2321 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_major); 2322 2323 #define GEN_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size, \ 2324 auth_alg, minor, len) \ 2325 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_minor); \ 2326 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_minor, tc) \ 2327 { \ 2328 struct tls_enable en; \ 2329 uint64_t seqno; \ 2330 \ 2331 ATF_REQUIRE_KTLS(); \ 2332 seqno = random(); \ 2333 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2334 seqno, &en); \ 2335 test_ktls_receive_bad_minor(tc, &en, seqno, len); \ 2336 free_tls_enable(&en); \ 2337 } 2338 2339 #define ADD_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size, \ 2340 auth_alg, minor) \ 2341 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_minor); 2342 2343 #define GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2344 auth_alg, minor, name, len) \ 2345 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_##name); \ 2346 ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ 2347 { \ 2348 struct tls_enable en; \ 2349 uint64_t seqno; \ 2350 \ 2351 ATF_REQUIRE_KTLS(); \ 2352 seqno = random(); \ 2353 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2354 seqno, &en); \ 2355 test_ktls_receive_bad_size(tc, &en, seqno, (len)); \ 2356 free_tls_enable(&en); \ 2357 } 2358 2359 #define ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2360 auth_alg, minor, name) \ 2361 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name); 2362 2363 #define GEN_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ 2364 minor) \ 2365 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2366 auth_alg, minor, short, 64, 0) \ 2367 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2368 auth_alg, minor, long, 64 * 1024, 0) \ 2369 GEN_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2370 auth_alg, minor, 64) \ 2371 GEN_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size, \ 2372 auth_alg, minor, 64) \ 2373 GEN_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size, \ 2374 auth_alg, minor, 64) \ 2375 GEN_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size, \ 2376 auth_alg, minor, 64) \ 2377 GEN_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size, \ 2378 auth_alg, minor, 64) \ 2379 GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2380 auth_alg, minor, small_record, \ 2381 tls_minimum_record_payload(&en) - 1) \ 2382 GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2383 auth_alg, minor, oversized_record, \ 2384 TLS_MAX_MSG_SIZE_V10_2 * 2) 2385 2386 #define ADD_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ 2387 minor) \ 2388 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2389 auth_alg, minor, short) \ 2390 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2391 auth_alg, minor, long) \ 2392 ADD_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2393 auth_alg, minor) \ 2394 ADD_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size, \ 2395 auth_alg, minor) \ 2396 ADD_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size, \ 2397 auth_alg, minor) \ 2398 ADD_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size, \ 2399 auth_alg, minor) \ 2400 ADD_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size, \ 2401 auth_alg, minor) \ 2402 ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2403 auth_alg, minor, small_record) \ 2404 ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2405 auth_alg, minor, oversized_record) 2406 2407 /* 2408 * For each supported cipher suite, run several receive tests: 2409 * 2410 * - a short test which sends 64 bytes of application data (likely as 2411 * a single TLS record) 2412 * 2413 * - a long test which sends 64KB of application data (split across 2414 * multiple TLS records) 2415 * 2416 * - a test with corrupted payload data in a single TLS record 2417 * 2418 * - a test with a corrupted MAC in a single TLS record 2419 * 2420 * - a test with a truncated TLS record 2421 * 2422 * - tests with invalid TLS major and minor versions 2423 * 2424 * - a tests with a record whose is one less than the smallest valid 2425 * size 2426 * 2427 * - a test with an oversized TLS record 2428 */ 2429 AES_CBC_NONZERO_TESTS(GEN_RECEIVE_TESTS); 2430 AES_GCM_TESTS(GEN_RECEIVE_TESTS); 2431 CHACHA20_TESTS(GEN_RECEIVE_TESTS); 2432 2433 #define GEN_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg, \ 2434 key_size, auth_alg, minor) \ 2435 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2436 auth_alg, minor, padding_1, 1, 0) \ 2437 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2438 auth_alg, minor, padding_2, 2, 0) \ 2439 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2440 auth_alg, minor, padding_3, 3, 0) \ 2441 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2442 auth_alg, minor, padding_4, 4, 0) \ 2443 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2444 auth_alg, minor, padding_5, 5, 0) \ 2445 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2446 auth_alg, minor, padding_6, 6, 0) \ 2447 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2448 auth_alg, minor, padding_7, 7, 0) \ 2449 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2450 auth_alg, minor, padding_8, 8, 0) \ 2451 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2452 auth_alg, minor, padding_9, 9, 0) \ 2453 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2454 auth_alg, minor, padding_10, 10, 0) \ 2455 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2456 auth_alg, minor, padding_11, 11, 0) \ 2457 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2458 auth_alg, minor, padding_12, 12, 0) \ 2459 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2460 auth_alg, minor, padding_13, 13, 0) \ 2461 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2462 auth_alg, minor, padding_14, 14, 0) \ 2463 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2464 auth_alg, minor, padding_15, 15, 0) \ 2465 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2466 auth_alg, minor, padding_16, 16, 0) \ 2467 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2468 auth_alg, minor, padding_16_extra, 16, 16) \ 2469 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2470 auth_alg, minor, padding_32_extra, 16, 32) 2471 2472 #define ADD_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg, \ 2473 key_size, auth_alg, minor) \ 2474 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2475 auth_alg, minor, padding_1) \ 2476 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2477 auth_alg, minor, padding_2) \ 2478 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2479 auth_alg, minor, padding_3) \ 2480 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2481 auth_alg, minor, padding_4) \ 2482 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2483 auth_alg, minor, padding_5) \ 2484 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2485 auth_alg, minor, padding_6) \ 2486 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2487 auth_alg, minor, padding_7) \ 2488 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2489 auth_alg, minor, padding_8) \ 2490 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2491 auth_alg, minor, padding_9) \ 2492 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2493 auth_alg, minor, padding_10) \ 2494 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2495 auth_alg, minor, padding_11) \ 2496 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2497 auth_alg, minor, padding_12) \ 2498 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2499 auth_alg, minor, padding_13) \ 2500 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2501 auth_alg, minor, padding_14) \ 2502 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2503 auth_alg, minor, padding_15) \ 2504 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2505 auth_alg, minor, padding_16) \ 2506 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2507 auth_alg, minor, padding_16_extra) \ 2508 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2509 auth_alg, minor, padding_32_extra) 2510 2511 #define GEN_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size, \ 2512 auth_alg, minor, len) \ 2513 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_padding); \ 2514 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_padding, tc) \ 2515 { \ 2516 struct tls_enable en; \ 2517 uint64_t seqno; \ 2518 \ 2519 ATF_REQUIRE_KTLS(); \ 2520 seqno = random(); \ 2521 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2522 seqno, &en); \ 2523 test_ktls_receive_corrupted_padding(tc, &en, seqno, len); \ 2524 free_tls_enable(&en); \ 2525 } 2526 2527 #define ADD_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size, \ 2528 auth_alg, minor) \ 2529 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_padding); 2530 2531 #define GEN_RECEIVE_MTE_TESTS(cipher_name, cipher_alg, key_size, \ 2532 auth_alg, minor) \ 2533 GEN_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg, \ 2534 key_size, auth_alg, minor) \ 2535 GEN_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size, \ 2536 auth_alg, minor, 64) \ 2537 GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2538 auth_alg, minor, non_block_size, \ 2539 tls_minimum_record_payload(&en) + 1) 2540 2541 #define ADD_RECEIVE_MTE_TESTS(cipher_name, cipher_alg, key_size, \ 2542 auth_alg, minor) \ 2543 ADD_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg, \ 2544 key_size, auth_alg, minor) \ 2545 ADD_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size, \ 2546 auth_alg, minor) \ 2547 ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2548 auth_alg, minor, non_block_size) 2549 2550 /* 2551 * For AES-CBC MTE cipher suites using padding, add tests of messages 2552 * with each possible padding size. Note that the padding_<N> tests 2553 * do not necessarily test <N> bytes of padding as the padding is a 2554 * function of the cipher suite's MAC length. However, cycling 2555 * through all of the payload sizes from 1 to 16 should exercise all 2556 * of the possible padding lengths for each suite. 2557 * 2558 * Two additional tests check for additional padding with an extra 2559 * 16 or 32 bytes beyond the normal padding. 2560 * 2561 * Another test checks for corrupted padding. 2562 * 2563 * Another test checks for a record whose payload is not a multiple of 2564 * the AES block size. 2565 */ 2566 AES_CBC_NONZERO_TESTS(GEN_RECEIVE_MTE_TESTS); 2567 2568 #define GEN_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size, \ 2569 auth_alg, minor) \ 2570 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_iv); \ 2571 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_iv, tc) \ 2572 { \ 2573 struct tls_enable en; \ 2574 uint64_t seqno; \ 2575 \ 2576 ATF_REQUIRE_KTLS(); \ 2577 seqno = random(); \ 2578 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2579 seqno, &en); \ 2580 test_ktls_receive_corrupted_iv(tc, &en, seqno, 64); \ 2581 free_tls_enable(&en); \ 2582 } 2583 2584 #define ADD_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size, \ 2585 auth_alg, minor) \ 2586 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_iv); 2587 2588 #define GEN_RECEIVE_EXPLICIT_IV_TESTS(cipher_name, cipher_alg, \ 2589 key_size, auth_alg, minor) \ 2590 GEN_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size, \ 2591 auth_alg, minor) \ 2592 GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2593 auth_alg, minor, short_header, \ 2594 sizeof(struct tls_record_layer) + 1) 2595 2596 #define ADD_RECEIVE_EXPLICIT_IV_TESTS(cipher_name, cipher_alg, \ 2597 key_size, auth_alg, minor) \ 2598 ADD_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size, \ 2599 auth_alg, minor) \ 2600 ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2601 auth_alg, minor, short_header) 2602 2603 /* 2604 * For cipher suites with an explicit IV, run a receive test where the 2605 * explicit IV has been corrupted. Also run a receive test that sends 2606 * a short record without a complete IV. 2607 */ 2608 AES_CBC_NONZERO_TESTS(GEN_RECEIVE_EXPLICIT_IV_TESTS); 2609 AES_GCM_12_TESTS(GEN_RECEIVE_EXPLICIT_IV_TESTS); 2610 2611 #define GEN_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size, \ 2612 auth_alg, minor, len) \ 2613 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_type); \ 2614 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_type, tc) \ 2615 { \ 2616 struct tls_enable en; \ 2617 uint64_t seqno; \ 2618 \ 2619 ATF_REQUIRE_KTLS(); \ 2620 seqno = random(); \ 2621 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2622 seqno, &en); \ 2623 test_ktls_receive_bad_type(tc, &en, seqno, len); \ 2624 free_tls_enable(&en); \ 2625 } 2626 2627 #define ADD_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size, \ 2628 auth_alg, minor) \ 2629 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_type); 2630 2631 #define GEN_RECEIVE_TLS13_TESTS(cipher_name, cipher_alg, key_size, \ 2632 auth_alg, minor) \ 2633 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2634 auth_alg, minor, short_padded, 64, 16) \ 2635 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2636 auth_alg, minor, long_padded, 64 * 1024, 15) \ 2637 GEN_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size, \ 2638 auth_alg, minor, 64) 2639 2640 #define ADD_RECEIVE_TLS13_TESTS(cipher_name, cipher_alg, key_size, \ 2641 auth_alg, minor) \ 2642 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2643 auth_alg, minor, short_padded) \ 2644 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2645 auth_alg, minor, long_padded) \ 2646 ADD_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size, \ 2647 auth_alg, minor) 2648 2649 /* 2650 * For TLS 1.3 cipher suites, run two additional receive tests which 2651 * use add padding to each record. Also run a test that uses an 2652 * invalid "outer" record type. 2653 */ 2654 TLS_13_TESTS(GEN_RECEIVE_TLS13_TESTS); 2655 2656 static void 2657 test_ktls_invalid_receive_cipher_suite(const atf_tc_t *tc, 2658 struct tls_enable *en) 2659 { 2660 int sockets[2]; 2661 2662 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 2663 2664 ATF_REQUIRE_ERRNO(EINVAL, setsockopt(sockets[1], IPPROTO_TCP, 2665 TCP_RXTLS_ENABLE, en, sizeof(*en)) == -1); 2666 2667 close_sockets(sockets); 2668 } 2669 2670 #define GEN_INVALID_RECEIVE_TEST(name, cipher_alg, key_size, auth_alg, \ 2671 minor) \ 2672 ATF_TC_WITHOUT_HEAD(ktls_receive_invalid_##name); \ 2673 ATF_TC_BODY(ktls_receive_invalid_##name, tc) \ 2674 { \ 2675 struct tls_enable en; \ 2676 uint64_t seqno; \ 2677 \ 2678 ATF_REQUIRE_KTLS(); \ 2679 seqno = random(); \ 2680 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2681 seqno, &en); \ 2682 test_ktls_invalid_receive_cipher_suite(tc, &en); \ 2683 free_tls_enable(&en); \ 2684 } 2685 2686 #define ADD_INVALID_RECEIVE_TEST(name, cipher_alg, key_size, auth_alg, \ 2687 minor) \ 2688 ATF_TP_ADD_TC(tp, ktls_receive_invalid_##name); 2689 2690 /* 2691 * Ensure that invalid cipher suites are rejected for receive. 2692 */ 2693 INVALID_CIPHER_SUITES(GEN_INVALID_RECEIVE_TEST); 2694 2695 static void 2696 test_ktls_unsupported_receive_cipher_suite(const atf_tc_t *tc, 2697 struct tls_enable *en) 2698 { 2699 int sockets[2]; 2700 2701 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 2702 2703 ATF_REQUIRE_ERRNO(EPROTONOSUPPORT, setsockopt(sockets[1], IPPROTO_TCP, 2704 TCP_RXTLS_ENABLE, en, sizeof(*en)) == -1); 2705 2706 close_sockets(sockets); 2707 } 2708 2709 #define GEN_UNSUPPORTED_RECEIVE_TEST(name, cipher_alg, key_size, \ 2710 auth_alg, minor) \ 2711 ATF_TC_WITHOUT_HEAD(ktls_receive_unsupported_##name); \ 2712 ATF_TC_BODY(ktls_receive_unsupported_##name, tc) \ 2713 { \ 2714 struct tls_enable en; \ 2715 uint64_t seqno; \ 2716 \ 2717 ATF_REQUIRE_KTLS(); \ 2718 seqno = random(); \ 2719 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2720 seqno, &en); \ 2721 test_ktls_unsupported_receive_cipher_suite(tc, &en); \ 2722 free_tls_enable(&en); \ 2723 } 2724 2725 #define ADD_UNSUPPORTED_RECEIVE_TEST(name, cipher_alg, key_size, \ 2726 auth_alg, minor) \ 2727 ATF_TP_ADD_TC(tp, ktls_receive_unsupported_##name); 2728 2729 /* 2730 * Ensure that valid cipher suites not supported for receive are 2731 * rejected. 2732 */ 2733 TLS_10_TESTS(GEN_UNSUPPORTED_RECEIVE_TEST); 2734 2735 /* 2736 * Try to perform an invalid sendto(2) on a TXTLS-enabled socket, to exercise 2737 * KTLS error handling in the socket layer. 2738 */ 2739 ATF_TC_WITHOUT_HEAD(ktls_sendto_baddst); 2740 ATF_TC_BODY(ktls_sendto_baddst, tc) 2741 { 2742 char buf[32]; 2743 struct sockaddr_in dst; 2744 struct tls_enable en; 2745 ssize_t n; 2746 int s; 2747 2748 ATF_REQUIRE_KTLS(); 2749 2750 s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); 2751 ATF_REQUIRE(s >= 0); 2752 2753 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, 2754 TLS_MINOR_VER_THREE, (uint64_t)random(), &en); 2755 2756 ATF_REQUIRE(setsockopt(s, IPPROTO_TCP, TCP_TXTLS_ENABLE, &en, 2757 sizeof(en)) == 0); 2758 2759 memset(&dst, 0, sizeof(dst)); 2760 dst.sin_family = AF_INET; 2761 dst.sin_len = sizeof(dst); 2762 dst.sin_addr.s_addr = htonl(INADDR_BROADCAST); 2763 dst.sin_port = htons(12345); 2764 2765 memset(buf, 0, sizeof(buf)); 2766 n = sendto(s, buf, sizeof(buf), 0, (struct sockaddr *)&dst, 2767 sizeof(dst)); 2768 2769 /* Can't transmit to the broadcast address over TCP. */ 2770 ATF_REQUIRE_ERRNO(EACCES, n == -1); 2771 ATF_REQUIRE(close(s) == 0); 2772 } 2773 2774 /* 2775 * Make sure that listen(2) returns an error for KTLS-enabled sockets, and 2776 * verify that an attempt to enable KTLS on a listening socket fails. 2777 */ 2778 ATF_TC_WITHOUT_HEAD(ktls_listening_socket); 2779 ATF_TC_BODY(ktls_listening_socket, tc) 2780 { 2781 struct tls_enable en; 2782 struct sockaddr_in sin; 2783 int s; 2784 2785 ATF_REQUIRE_KTLS(); 2786 2787 s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); 2788 ATF_REQUIRE(s >= 0); 2789 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, 2790 TLS_MINOR_VER_THREE, (uint64_t)random(), &en); 2791 ATF_REQUIRE(setsockopt(s, IPPROTO_TCP, TCP_TXTLS_ENABLE, &en, 2792 sizeof(en)) == 0); 2793 ATF_REQUIRE_ERRNO(EINVAL, listen(s, 1) == -1); 2794 ATF_REQUIRE(close(s) == 0); 2795 2796 s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); 2797 ATF_REQUIRE(s >= 0); 2798 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, 2799 TLS_MINOR_VER_THREE, (uint64_t)random(), &en); 2800 ATF_REQUIRE(setsockopt(s, IPPROTO_TCP, TCP_RXTLS_ENABLE, &en, 2801 sizeof(en)) == 0); 2802 ATF_REQUIRE_ERRNO(EINVAL, listen(s, 1) == -1); 2803 ATF_REQUIRE(close(s) == 0); 2804 2805 s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); 2806 ATF_REQUIRE(s >= 0); 2807 memset(&sin, 0, sizeof(sin)); 2808 sin.sin_family = AF_INET; 2809 sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK); 2810 ATF_REQUIRE(bind(s, (struct sockaddr *)&sin, sizeof(sin)) == 0); 2811 ATF_REQUIRE(listen(s, 1) == 0); 2812 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, 2813 TLS_MINOR_VER_THREE, (uint64_t)random(), &en); 2814 ATF_REQUIRE_ERRNO(ENOTCONN, 2815 setsockopt(s, IPPROTO_TCP, TCP_TXTLS_ENABLE, &en, sizeof(en)) != 0); 2816 ATF_REQUIRE_ERRNO(ENOTCONN, 2817 setsockopt(s, IPPROTO_TCP, TCP_RXTLS_ENABLE, &en, sizeof(en)) != 0); 2818 ATF_REQUIRE(close(s) == 0); 2819 } 2820 2821 /* 2822 * Verify that the KTLS receive path does not overwrite data belonging 2823 * to a file whose payload is transmitted over a loopback connection 2824 * via plain sendfile. 2825 */ 2826 ATF_TC_WITHOUT_HEAD(ktls_receive_loopback_sendfile); 2827 ATF_TC_BODY(ktls_receive_loopback_sendfile, tc) 2828 { 2829 struct tls_enable en; 2830 struct msghdr msg; 2831 struct sf_hdtr hdtr; 2832 struct iovec iov[2]; 2833 uint64_t seqno; 2834 off_t sbytes; 2835 char cbuf[CMSG_SPACE(sizeof(struct tls_get_record))]; 2836 char *plaintext, *ciphertext, *outbuf; 2837 void *p; 2838 const size_t payload_len = PAGE_SIZE; 2839 ssize_t rv; 2840 size_t len; 2841 int mode, shm, sockets[2]; 2842 socklen_t slen; 2843 2844 ATF_REQUIRE_KTLS(); 2845 seqno = random(); 2846 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, 2847 TLS_MINOR_VER_TWO, seqno, &en); 2848 2849 len = tls_header_len(&en) + payload_len + tls_trailer_len(&en); 2850 plaintext = alloc_buffer(payload_len); 2851 ciphertext = malloc(len); 2852 ATF_REQUIRE_INTEQ(len, encrypt_tls_record(tc, &en, TLS_RLTYPE_APP, 2853 seqno, plaintext, payload_len, ciphertext, len, 0)); 2854 2855 ATF_REQUIRE((shm = shm_open(SHM_ANON, O_RDWR, 0600)) > 0); 2856 ATF_REQUIRE_INTEQ(0, ftruncate(shm, payload_len)); 2857 ATF_REQUIRE((p = mmap(NULL, payload_len, PROT_READ | PROT_WRITE, 2858 MAP_SHARED, shm, 0)) != MAP_FAILED); 2859 memcpy(p, ciphertext + tls_header_len(&en), payload_len); 2860 2861 ATF_REQUIRE_MSG(socketpair_tcp(sockets), "failed to create sockets"); 2862 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, &en, 2863 sizeof(en)) == 0); 2864 slen = sizeof(mode); 2865 ATF_REQUIRE_INTEQ(0, getsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_MODE, 2866 &mode, &slen)); 2867 ATF_REQUIRE_INTEQ(TCP_TLS_MODE_SW, mode); 2868 2869 fd_set_blocking(sockets[0]); 2870 fd_set_blocking(sockets[1]); 2871 2872 iov[0].iov_base = ciphertext; 2873 iov[0].iov_len = tls_header_len(&en); 2874 iov[1].iov_base = ciphertext + tls_header_len(&en) + payload_len; 2875 iov[1].iov_len = tls_trailer_len(&en); 2876 hdtr.headers = iov; 2877 hdtr.hdr_cnt = 1; 2878 hdtr.trailers = iov + 1; 2879 hdtr.trl_cnt = 1; 2880 debug_hexdump(tc, p, payload_len, "shm buffer before"); 2881 ATF_REQUIRE_INTEQ(0, sendfile(shm, sockets[1], 0, payload_len, &hdtr, 2882 &sbytes, 0)); 2883 ATF_REQUIRE_INTEQ(sbytes, len); 2884 2885 outbuf = calloc(payload_len, 1); 2886 2887 memset(&msg, 0, sizeof(msg)); 2888 2889 msg.msg_control = cbuf; 2890 msg.msg_controllen = sizeof(cbuf); 2891 2892 iov[0].iov_base = outbuf; 2893 iov[0].iov_len = payload_len; 2894 msg.msg_iov = iov; 2895 msg.msg_iovlen = 1; 2896 2897 rv = recvmsg(sockets[0], &msg, 0); 2898 if (rv >= 0) { 2899 ATF_REQUIRE_INTEQ(payload_len, rv); 2900 ATF_REQUIRE_INTEQ(0, memcmp(outbuf, plaintext, payload_len)); 2901 } else 2902 ATF_REQUIRE_ERRNO(EBADMSG, true); 2903 2904 debug_hexdump(tc, p, payload_len, "shm buffer after"); 2905 ATF_REQUIRE_INTEQ(0, memcmp(p, ciphertext + tls_header_len(&en), 2906 payload_len)); 2907 2908 close_sockets_ignore_errors(sockets); 2909 (void)close(shm); 2910 } 2911 2912 ATF_TP_ADD_TCS(tp) 2913 { 2914 /* Transmit tests */ 2915 AES_CBC_TESTS(ADD_TRANSMIT_TESTS); 2916 AES_GCM_TESTS(ADD_TRANSMIT_TESTS); 2917 CHACHA20_TESTS(ADD_TRANSMIT_TESTS); 2918 AES_CBC_TESTS(ADD_TRANSMIT_PADDING_TESTS); 2919 AES_CBC_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST); 2920 AES_GCM_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST); 2921 CHACHA20_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST); 2922 INVALID_CIPHER_SUITES(ADD_INVALID_TRANSMIT_TEST); 2923 2924 /* Receive tests */ 2925 TLS_10_TESTS(ADD_UNSUPPORTED_RECEIVE_TEST); 2926 AES_CBC_NONZERO_TESTS(ADD_RECEIVE_TESTS); 2927 AES_GCM_TESTS(ADD_RECEIVE_TESTS); 2928 CHACHA20_TESTS(ADD_RECEIVE_TESTS); 2929 AES_CBC_NONZERO_TESTS(ADD_RECEIVE_MTE_TESTS); 2930 AES_CBC_NONZERO_TESTS(ADD_RECEIVE_EXPLICIT_IV_TESTS); 2931 AES_GCM_12_TESTS(ADD_RECEIVE_EXPLICIT_IV_TESTS); 2932 TLS_13_TESTS(ADD_RECEIVE_TLS13_TESTS); 2933 INVALID_CIPHER_SUITES(ADD_INVALID_RECEIVE_TEST); 2934 2935 /* Miscellaneous */ 2936 ATF_TP_ADD_TC(tp, ktls_sendto_baddst); 2937 ATF_TP_ADD_TC(tp, ktls_listening_socket); 2938 ATF_TP_ADD_TC(tp, ktls_receive_loopback_sendfile); 2939 2940 return (atf_no_error()); 2941 } 2942