1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2021 Netflix Inc. 5 * Written by: John Baldwin <jhb@FreeBSD.org> 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include <sys/param.h> 30 #include <sys/endian.h> 31 #include <sys/event.h> 32 #include <sys/ktls.h> 33 #include <sys/mman.h> 34 #include <sys/socket.h> 35 #include <sys/sysctl.h> 36 #include <netinet/in.h> 37 #include <netinet/tcp.h> 38 #include <crypto/cryptodev.h> 39 #include <assert.h> 40 #include <err.h> 41 #include <fcntl.h> 42 #include <libutil.h> 43 #include <netdb.h> 44 #include <poll.h> 45 #include <stdbool.h> 46 #include <stdlib.h> 47 #include <atf-c.h> 48 49 #include <openssl/err.h> 50 #include <openssl/evp.h> 51 #include <openssl/hmac.h> 52 53 static void 54 require_ktls(void) 55 { 56 size_t len; 57 bool enable; 58 59 len = sizeof(enable); 60 if (sysctlbyname("kern.ipc.tls.enable", &enable, &len, NULL, 0) == -1) { 61 if (errno == ENOENT) 62 atf_tc_skip("kernel does not support TLS offload"); 63 atf_libc_error(errno, "Failed to read kern.ipc.tls.enable"); 64 } 65 66 if (!enable) 67 atf_tc_skip("Kernel TLS is disabled"); 68 } 69 70 #define ATF_REQUIRE_KTLS() require_ktls() 71 72 static void 73 require_ktls_rx(void) 74 { 75 size_t len; 76 bool enable; 77 78 ATF_REQUIRE_KTLS(); 79 80 len = sizeof(enable); 81 if (sysctlbyname("kern.ipc.tls.rx_enable", &enable, &len, NULL, 0) == 82 -1) { 83 if (errno == ENOENT) 84 atf_tc_skip("kernel does not support TLS offload"); 85 atf_libc_error(errno, "Failed to read kern.ipc.tls.rx_enable"); 86 } 87 88 if (!enable) 89 atf_tc_skip("Kernel TLS receive is disabled"); 90 } 91 92 #define ATF_REQUIRE_KTLS_RX() require_ktls_rx() 93 94 static void 95 check_tls_mode(const atf_tc_t *tc, int s, int sockopt) 96 { 97 if (atf_tc_get_config_var_as_bool_wd(tc, "ktls.require_ifnet", false)) { 98 socklen_t len; 99 int mode; 100 101 len = sizeof(mode); 102 if (getsockopt(s, IPPROTO_TCP, sockopt, &mode, &len) == -1) 103 atf_libc_error(errno, "Failed to fetch TLS mode"); 104 105 if (mode != TCP_TLS_MODE_IFNET) 106 atf_tc_skip("connection did not use ifnet TLS"); 107 } 108 109 if (atf_tc_get_config_var_as_bool_wd(tc, "ktls.require_toe", false)) { 110 socklen_t len; 111 int mode; 112 113 len = sizeof(mode); 114 if (getsockopt(s, IPPROTO_TCP, sockopt, &mode, &len) == -1) 115 atf_libc_error(errno, "Failed to fetch TLS mode"); 116 117 if (mode != TCP_TLS_MODE_TOE) 118 atf_tc_skip("connection did not use TOE TLS"); 119 } 120 } 121 122 static void __printflike(2, 3) 123 debug(const atf_tc_t *tc, const char *fmt, ...) 124 { 125 if (!atf_tc_get_config_var_as_bool_wd(tc, "ktls.debug", false)) 126 return; 127 128 va_list ap; 129 va_start(ap, fmt); 130 vprintf(fmt, ap); 131 va_end(ap); 132 } 133 134 static void 135 debug_hexdump(const atf_tc_t *tc, const void *buf, int length, 136 const char *label) 137 { 138 if (!atf_tc_get_config_var_as_bool_wd(tc, "ktls.debug", false)) 139 return; 140 141 if (label != NULL) 142 printf("%s:\n", label); 143 hexdump(buf, length, NULL, 0); 144 } 145 146 static char 147 rdigit(void) 148 { 149 /* ASCII printable values between 0x20 and 0x7e */ 150 return (0x20 + random() % (0x7f - 0x20)); 151 } 152 153 static char * 154 alloc_buffer(size_t len) 155 { 156 char *buf; 157 size_t i; 158 159 if (len == 0) 160 return (NULL); 161 buf = malloc(len); 162 for (i = 0; i < len; i++) 163 buf[i] = rdigit(); 164 return (buf); 165 } 166 167 static bool 168 socketpair_tcp(int sv[2]) 169 { 170 struct pollfd pfd; 171 struct sockaddr_in sin; 172 socklen_t len; 173 int as, cs, ls; 174 175 ls = socket(PF_INET, SOCK_STREAM, 0); 176 if (ls == -1) { 177 warn("socket() for listen"); 178 return (false); 179 } 180 181 memset(&sin, 0, sizeof(sin)); 182 sin.sin_len = sizeof(sin); 183 sin.sin_family = AF_INET; 184 sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK); 185 if (bind(ls, (struct sockaddr *)&sin, sizeof(sin)) == -1) { 186 warn("bind"); 187 close(ls); 188 return (false); 189 } 190 191 if (listen(ls, 1) == -1) { 192 warn("listen"); 193 close(ls); 194 return (false); 195 } 196 197 len = sizeof(sin); 198 if (getsockname(ls, (struct sockaddr *)&sin, &len) == -1) { 199 warn("getsockname"); 200 close(ls); 201 return (false); 202 } 203 204 cs = socket(PF_INET, SOCK_STREAM | SOCK_NONBLOCK, 0); 205 if (cs == -1) { 206 warn("socket() for connect"); 207 close(ls); 208 return (false); 209 } 210 211 if (connect(cs, (struct sockaddr *)&sin, sizeof(sin)) == -1) { 212 if (errno != EINPROGRESS) { 213 warn("connect"); 214 close(ls); 215 close(cs); 216 return (false); 217 } 218 } 219 220 as = accept4(ls, NULL, NULL, SOCK_NONBLOCK); 221 if (as == -1) { 222 warn("accept4"); 223 close(ls); 224 close(cs); 225 return (false); 226 } 227 228 close(ls); 229 230 pfd.fd = cs; 231 pfd.events = POLLOUT; 232 pfd.revents = 0; 233 ATF_REQUIRE_INTEQ(1, poll(&pfd, 1, INFTIM)); 234 ATF_REQUIRE_INTEQ(POLLOUT, pfd.revents); 235 236 sv[0] = cs; 237 sv[1] = as; 238 return (true); 239 } 240 241 static bool 242 echo_socket(const atf_tc_t *tc, int sv[2]) 243 { 244 const char *cause, *host, *port; 245 struct addrinfo hints, *ai, *tofree; 246 int error, flags, s; 247 248 host = atf_tc_get_config_var(tc, "ktls.host"); 249 port = atf_tc_get_config_var_wd(tc, "ktls.port", "echo"); 250 memset(&hints, 0, sizeof(hints)); 251 hints.ai_family = AF_UNSPEC; 252 hints.ai_socktype = SOCK_STREAM; 253 hints.ai_protocol = IPPROTO_TCP; 254 error = getaddrinfo(host, port, &hints, &tofree); 255 if (error != 0) { 256 warnx("getaddrinfo(%s:%s) failed: %s", host, port, 257 gai_strerror(error)); 258 return (false); 259 } 260 261 cause = NULL; 262 for (ai = tofree; ai != NULL; ai = ai->ai_next) { 263 s = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol); 264 if (s == -1) { 265 cause = "socket"; 266 error = errno; 267 continue; 268 } 269 270 if (connect(s, ai->ai_addr, ai->ai_addrlen) == -1) { 271 cause = "connect"; 272 error = errno; 273 close(s); 274 continue; 275 } 276 277 freeaddrinfo(tofree); 278 279 ATF_REQUIRE((flags = fcntl(s, F_GETFL)) != -1); 280 flags |= O_NONBLOCK; 281 ATF_REQUIRE(fcntl(s, F_SETFL, flags) != -1); 282 283 sv[0] = s; 284 sv[1] = s; 285 return (true); 286 } 287 288 warnc(error, "%s", cause); 289 freeaddrinfo(tofree); 290 return (false); 291 } 292 293 static bool 294 open_sockets(const atf_tc_t *tc, int sv[2]) 295 { 296 if (atf_tc_has_config_var(tc, "ktls.host")) 297 return (echo_socket(tc, sv)); 298 else 299 return (socketpair_tcp(sv)); 300 } 301 302 static void 303 close_sockets(int sv[2]) 304 { 305 if (sv[0] != sv[1]) 306 ATF_REQUIRE(close(sv[1]) == 0); 307 ATF_REQUIRE(close(sv[0]) == 0); 308 } 309 310 static void 311 close_sockets_ignore_errors(int sv[2]) 312 { 313 if (sv[0] != sv[1]) 314 close(sv[1]); 315 close(sv[0]); 316 } 317 318 static void 319 fd_set_blocking(int fd) 320 { 321 int flags; 322 323 ATF_REQUIRE((flags = fcntl(fd, F_GETFL)) != -1); 324 flags &= ~O_NONBLOCK; 325 ATF_REQUIRE(fcntl(fd, F_SETFL, flags) != -1); 326 } 327 328 static void 329 tcp_nodelay(int fd) 330 { 331 int nodelay = 1; 332 333 ATF_REQUIRE(setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &nodelay, 334 sizeof(nodelay)) == 0); 335 } 336 337 static bool 338 cbc_crypt(const EVP_CIPHER *cipher, const char *key, const char *iv, 339 const char *input, char *output, size_t size, int enc) 340 { 341 EVP_CIPHER_CTX *ctx; 342 int outl, total; 343 344 ctx = EVP_CIPHER_CTX_new(); 345 if (ctx == NULL) { 346 warnx("EVP_CIPHER_CTX_new failed: %s", 347 ERR_error_string(ERR_get_error(), NULL)); 348 return (false); 349 } 350 if (EVP_CipherInit_ex(ctx, cipher, NULL, (const u_char *)key, 351 (const u_char *)iv, enc) != 1) { 352 warnx("EVP_CipherInit_ex failed: %s", 353 ERR_error_string(ERR_get_error(), NULL)); 354 EVP_CIPHER_CTX_free(ctx); 355 return (false); 356 } 357 EVP_CIPHER_CTX_set_padding(ctx, 0); 358 if (EVP_CipherUpdate(ctx, (u_char *)output, &outl, 359 (const u_char *)input, size) != 1) { 360 warnx("EVP_CipherUpdate failed: %s", 361 ERR_error_string(ERR_get_error(), NULL)); 362 EVP_CIPHER_CTX_free(ctx); 363 return (false); 364 } 365 total = outl; 366 if (EVP_CipherFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) { 367 warnx("EVP_CipherFinal_ex failed: %s", 368 ERR_error_string(ERR_get_error(), NULL)); 369 EVP_CIPHER_CTX_free(ctx); 370 return (false); 371 } 372 total += outl; 373 if ((size_t)total != size) { 374 warnx("decrypt size mismatch: %zu vs %d", size, total); 375 EVP_CIPHER_CTX_free(ctx); 376 return (false); 377 } 378 EVP_CIPHER_CTX_free(ctx); 379 return (true); 380 } 381 382 static bool 383 cbc_encrypt(const EVP_CIPHER *cipher, const char *key, const char *iv, 384 const char *input, char *output, size_t size) 385 { 386 return (cbc_crypt(cipher, key, iv, input, output, size, 1)); 387 } 388 389 static bool 390 cbc_decrypt(const EVP_CIPHER *cipher, const char *key, const char *iv, 391 const char *input, char *output, size_t size) 392 { 393 return (cbc_crypt(cipher, key, iv, input, output, size, 0)); 394 } 395 396 static bool 397 compute_hash(const EVP_MD *md, const void *key, size_t key_len, const void *aad, 398 size_t aad_len, const void *buffer, size_t len, void *digest, 399 u_int *digest_len) 400 { 401 HMAC_CTX *ctx; 402 403 ctx = HMAC_CTX_new(); 404 if (ctx == NULL) { 405 warnx("HMAC_CTX_new failed: %s", 406 ERR_error_string(ERR_get_error(), NULL)); 407 return (false); 408 } 409 if (HMAC_Init_ex(ctx, key, key_len, md, NULL) != 1) { 410 warnx("HMAC_Init_ex failed: %s", 411 ERR_error_string(ERR_get_error(), NULL)); 412 HMAC_CTX_free(ctx); 413 return (false); 414 } 415 if (HMAC_Update(ctx, aad, aad_len) != 1) { 416 warnx("HMAC_Update (aad) failed: %s", 417 ERR_error_string(ERR_get_error(), NULL)); 418 HMAC_CTX_free(ctx); 419 return (false); 420 } 421 if (HMAC_Update(ctx, buffer, len) != 1) { 422 warnx("HMAC_Update (payload) failed: %s", 423 ERR_error_string(ERR_get_error(), NULL)); 424 HMAC_CTX_free(ctx); 425 return (false); 426 } 427 if (HMAC_Final(ctx, digest, digest_len) != 1) { 428 warnx("HMAC_Final failed: %s", 429 ERR_error_string(ERR_get_error(), NULL)); 430 HMAC_CTX_free(ctx); 431 return (false); 432 } 433 HMAC_CTX_free(ctx); 434 return (true); 435 } 436 437 static bool 438 verify_hash(const EVP_MD *md, const void *key, size_t key_len, const void *aad, 439 size_t aad_len, const void *buffer, size_t len, const void *digest) 440 { 441 unsigned char digest2[EVP_MAX_MD_SIZE]; 442 u_int digest_len; 443 444 if (!compute_hash(md, key, key_len, aad, aad_len, buffer, len, digest2, 445 &digest_len)) 446 return (false); 447 if (memcmp(digest, digest2, digest_len) != 0) { 448 warnx("HMAC mismatch"); 449 return (false); 450 } 451 return (true); 452 } 453 454 static bool 455 aead_encrypt(const EVP_CIPHER *cipher, const char *key, const char *nonce, 456 const void *aad, size_t aad_len, const char *input, char *output, 457 size_t size, char *tag, size_t tag_len) 458 { 459 EVP_CIPHER_CTX *ctx; 460 int outl, total; 461 462 ctx = EVP_CIPHER_CTX_new(); 463 if (ctx == NULL) { 464 warnx("EVP_CIPHER_CTX_new failed: %s", 465 ERR_error_string(ERR_get_error(), NULL)); 466 return (false); 467 } 468 if (EVP_EncryptInit_ex(ctx, cipher, NULL, (const u_char *)key, 469 (const u_char *)nonce) != 1) { 470 warnx("EVP_EncryptInit_ex failed: %s", 471 ERR_error_string(ERR_get_error(), NULL)); 472 EVP_CIPHER_CTX_free(ctx); 473 return (false); 474 } 475 EVP_CIPHER_CTX_set_padding(ctx, 0); 476 if (aad != NULL) { 477 if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)aad, 478 aad_len) != 1) { 479 warnx("EVP_EncryptUpdate for AAD failed: %s", 480 ERR_error_string(ERR_get_error(), NULL)); 481 EVP_CIPHER_CTX_free(ctx); 482 return (false); 483 } 484 } 485 if (EVP_EncryptUpdate(ctx, (u_char *)output, &outl, 486 (const u_char *)input, size) != 1) { 487 warnx("EVP_EncryptUpdate failed: %s", 488 ERR_error_string(ERR_get_error(), NULL)); 489 EVP_CIPHER_CTX_free(ctx); 490 return (false); 491 } 492 total = outl; 493 if (EVP_EncryptFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) { 494 warnx("EVP_EncryptFinal_ex failed: %s", 495 ERR_error_string(ERR_get_error(), NULL)); 496 EVP_CIPHER_CTX_free(ctx); 497 return (false); 498 } 499 total += outl; 500 if ((size_t)total != size) { 501 warnx("encrypt size mismatch: %zu vs %d", size, total); 502 EVP_CIPHER_CTX_free(ctx); 503 return (false); 504 } 505 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, tag_len, tag) != 506 1) { 507 warnx("EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_GET_TAG) failed: %s", 508 ERR_error_string(ERR_get_error(), NULL)); 509 EVP_CIPHER_CTX_free(ctx); 510 return (false); 511 } 512 EVP_CIPHER_CTX_free(ctx); 513 return (true); 514 } 515 516 static bool 517 aead_decrypt(const EVP_CIPHER *cipher, const char *key, const char *nonce, 518 const void *aad, size_t aad_len, const char *input, char *output, 519 size_t size, const char *tag, size_t tag_len) 520 { 521 EVP_CIPHER_CTX *ctx; 522 int outl, total; 523 bool valid; 524 525 ctx = EVP_CIPHER_CTX_new(); 526 if (ctx == NULL) { 527 warnx("EVP_CIPHER_CTX_new failed: %s", 528 ERR_error_string(ERR_get_error(), NULL)); 529 return (false); 530 } 531 if (EVP_DecryptInit_ex(ctx, cipher, NULL, (const u_char *)key, 532 (const u_char *)nonce) != 1) { 533 warnx("EVP_DecryptInit_ex failed: %s", 534 ERR_error_string(ERR_get_error(), NULL)); 535 EVP_CIPHER_CTX_free(ctx); 536 return (false); 537 } 538 EVP_CIPHER_CTX_set_padding(ctx, 0); 539 if (aad != NULL) { 540 if (EVP_DecryptUpdate(ctx, NULL, &outl, (const u_char *)aad, 541 aad_len) != 1) { 542 warnx("EVP_DecryptUpdate for AAD failed: %s", 543 ERR_error_string(ERR_get_error(), NULL)); 544 EVP_CIPHER_CTX_free(ctx); 545 return (false); 546 } 547 } 548 if (EVP_DecryptUpdate(ctx, (u_char *)output, &outl, 549 (const u_char *)input, size) != 1) { 550 warnx("EVP_DecryptUpdate failed: %s", 551 ERR_error_string(ERR_get_error(), NULL)); 552 EVP_CIPHER_CTX_free(ctx); 553 return (false); 554 } 555 total = outl; 556 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, tag_len, 557 __DECONST(char *, tag)) != 1) { 558 warnx("EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_SET_TAG) failed: %s", 559 ERR_error_string(ERR_get_error(), NULL)); 560 EVP_CIPHER_CTX_free(ctx); 561 return (false); 562 } 563 valid = (EVP_DecryptFinal_ex(ctx, (u_char *)output + outl, &outl) == 1); 564 total += outl; 565 if ((size_t)total != size) { 566 warnx("decrypt size mismatch: %zu vs %d", size, total); 567 EVP_CIPHER_CTX_free(ctx); 568 return (false); 569 } 570 if (!valid) 571 warnx("tag mismatch"); 572 EVP_CIPHER_CTX_free(ctx); 573 return (valid); 574 } 575 576 static void 577 build_tls_enable(const atf_tc_t *tc, int cipher_alg, size_t cipher_key_len, 578 int auth_alg, int minor, uint64_t seqno, struct tls_enable *en) 579 { 580 u_int auth_key_len, iv_len; 581 582 memset(en, 0, sizeof(*en)); 583 584 switch (cipher_alg) { 585 case CRYPTO_AES_CBC: 586 if (minor == TLS_MINOR_VER_ZERO) 587 iv_len = AES_BLOCK_LEN; 588 else 589 iv_len = 0; 590 break; 591 case CRYPTO_AES_NIST_GCM_16: 592 if (minor == TLS_MINOR_VER_TWO) 593 iv_len = TLS_AEAD_GCM_LEN; 594 else 595 iv_len = TLS_1_3_GCM_IV_LEN; 596 break; 597 case CRYPTO_CHACHA20_POLY1305: 598 iv_len = TLS_CHACHA20_IV_LEN; 599 break; 600 default: 601 iv_len = 0; 602 break; 603 } 604 switch (auth_alg) { 605 case CRYPTO_SHA1_HMAC: 606 auth_key_len = SHA1_HASH_LEN; 607 break; 608 case CRYPTO_SHA2_256_HMAC: 609 auth_key_len = SHA2_256_HASH_LEN; 610 break; 611 case CRYPTO_SHA2_384_HMAC: 612 auth_key_len = SHA2_384_HASH_LEN; 613 break; 614 default: 615 auth_key_len = 0; 616 break; 617 } 618 en->cipher_key = alloc_buffer(cipher_key_len); 619 debug_hexdump(tc, en->cipher_key, cipher_key_len, "cipher key"); 620 en->iv = alloc_buffer(iv_len); 621 if (iv_len != 0) 622 debug_hexdump(tc, en->iv, iv_len, "iv"); 623 en->auth_key = alloc_buffer(auth_key_len); 624 if (auth_key_len != 0) 625 debug_hexdump(tc, en->auth_key, auth_key_len, "auth key"); 626 en->cipher_algorithm = cipher_alg; 627 en->cipher_key_len = cipher_key_len; 628 en->iv_len = iv_len; 629 en->auth_algorithm = auth_alg; 630 en->auth_key_len = auth_key_len; 631 en->tls_vmajor = TLS_MAJOR_VER_ONE; 632 en->tls_vminor = minor; 633 be64enc(en->rec_seq, seqno); 634 debug(tc, "seqno: %ju\n", (uintmax_t)seqno); 635 } 636 637 static void 638 free_tls_enable(struct tls_enable *en) 639 { 640 free(__DECONST(void *, en->cipher_key)); 641 free(__DECONST(void *, en->iv)); 642 free(__DECONST(void *, en->auth_key)); 643 } 644 645 static const EVP_CIPHER * 646 tls_EVP_CIPHER(const struct tls_enable *en) 647 { 648 switch (en->cipher_algorithm) { 649 case CRYPTO_AES_CBC: 650 switch (en->cipher_key_len) { 651 case 128 / 8: 652 return (EVP_aes_128_cbc()); 653 case 256 / 8: 654 return (EVP_aes_256_cbc()); 655 default: 656 return (NULL); 657 } 658 break; 659 case CRYPTO_AES_NIST_GCM_16: 660 switch (en->cipher_key_len) { 661 case 128 / 8: 662 return (EVP_aes_128_gcm()); 663 case 256 / 8: 664 return (EVP_aes_256_gcm()); 665 default: 666 return (NULL); 667 } 668 break; 669 case CRYPTO_CHACHA20_POLY1305: 670 return (EVP_chacha20_poly1305()); 671 default: 672 return (NULL); 673 } 674 } 675 676 static const EVP_MD * 677 tls_EVP_MD(const struct tls_enable *en) 678 { 679 switch (en->auth_algorithm) { 680 case CRYPTO_SHA1_HMAC: 681 return (EVP_sha1()); 682 case CRYPTO_SHA2_256_HMAC: 683 return (EVP_sha256()); 684 case CRYPTO_SHA2_384_HMAC: 685 return (EVP_sha384()); 686 default: 687 return (NULL); 688 } 689 } 690 691 static size_t 692 tls_header_len(struct tls_enable *en) 693 { 694 size_t len; 695 696 len = sizeof(struct tls_record_layer); 697 switch (en->cipher_algorithm) { 698 case CRYPTO_AES_CBC: 699 if (en->tls_vminor != TLS_MINOR_VER_ZERO) 700 len += AES_BLOCK_LEN; 701 return (len); 702 case CRYPTO_AES_NIST_GCM_16: 703 if (en->tls_vminor == TLS_MINOR_VER_TWO) 704 len += sizeof(uint64_t); 705 return (len); 706 case CRYPTO_CHACHA20_POLY1305: 707 return (len); 708 default: 709 return (0); 710 } 711 } 712 713 static size_t 714 tls_mac_len(struct tls_enable *en) 715 { 716 switch (en->cipher_algorithm) { 717 case CRYPTO_AES_CBC: 718 switch (en->auth_algorithm) { 719 case CRYPTO_SHA1_HMAC: 720 return (SHA1_HASH_LEN); 721 case CRYPTO_SHA2_256_HMAC: 722 return (SHA2_256_HASH_LEN); 723 case CRYPTO_SHA2_384_HMAC: 724 return (SHA2_384_HASH_LEN); 725 default: 726 return (0); 727 } 728 case CRYPTO_AES_NIST_GCM_16: 729 return (AES_GMAC_HASH_LEN); 730 case CRYPTO_CHACHA20_POLY1305: 731 return (POLY1305_HASH_LEN); 732 default: 733 return (0); 734 } 735 } 736 737 /* Includes maximum padding for MTE. */ 738 static size_t 739 tls_trailer_len(struct tls_enable *en) 740 { 741 size_t len; 742 743 len = tls_mac_len(en); 744 if (en->cipher_algorithm == CRYPTO_AES_CBC) 745 len += AES_BLOCK_LEN; 746 if (en->tls_vminor == TLS_MINOR_VER_THREE) 747 len++; 748 return (len); 749 } 750 751 /* Minimum valid record payload size for a given cipher suite. */ 752 static size_t 753 tls_minimum_record_payload(struct tls_enable *en) 754 { 755 size_t len; 756 757 len = tls_header_len(en); 758 if (en->cipher_algorithm == CRYPTO_AES_CBC) 759 len += roundup2(tls_mac_len(en) + 1, AES_BLOCK_LEN); 760 else 761 len += tls_mac_len(en); 762 if (en->tls_vminor == TLS_MINOR_VER_THREE) 763 len++; 764 return (len - sizeof(struct tls_record_layer)); 765 } 766 767 /* 'len' is the length of the payload application data. */ 768 static void 769 tls_mte_aad(struct tls_enable *en, size_t len, 770 const struct tls_record_layer *hdr, uint64_t seqno, struct tls_mac_data *ad) 771 { 772 ad->seq = htobe64(seqno); 773 ad->type = hdr->tls_type; 774 ad->tls_vmajor = hdr->tls_vmajor; 775 ad->tls_vminor = hdr->tls_vminor; 776 ad->tls_length = htons(len); 777 } 778 779 static void 780 tls_12_aead_aad(struct tls_enable *en, size_t len, 781 const struct tls_record_layer *hdr, uint64_t seqno, 782 struct tls_aead_data *ad) 783 { 784 ad->seq = htobe64(seqno); 785 ad->type = hdr->tls_type; 786 ad->tls_vmajor = hdr->tls_vmajor; 787 ad->tls_vminor = hdr->tls_vminor; 788 ad->tls_length = htons(len); 789 } 790 791 static void 792 tls_13_aad(struct tls_enable *en, const struct tls_record_layer *hdr, 793 uint64_t seqno, struct tls_aead_data_13 *ad) 794 { 795 ad->type = hdr->tls_type; 796 ad->tls_vmajor = hdr->tls_vmajor; 797 ad->tls_vminor = hdr->tls_vminor; 798 ad->tls_length = hdr->tls_length; 799 } 800 801 static void 802 tls_12_gcm_nonce(struct tls_enable *en, const struct tls_record_layer *hdr, 803 char *nonce) 804 { 805 memcpy(nonce, en->iv, TLS_AEAD_GCM_LEN); 806 memcpy(nonce + TLS_AEAD_GCM_LEN, hdr + 1, sizeof(uint64_t)); 807 } 808 809 static void 810 tls_13_nonce(struct tls_enable *en, uint64_t seqno, char *nonce) 811 { 812 static_assert(TLS_1_3_GCM_IV_LEN == TLS_CHACHA20_IV_LEN, 813 "TLS 1.3 nonce length mismatch"); 814 memcpy(nonce, en->iv, TLS_1_3_GCM_IV_LEN); 815 *(uint64_t *)(nonce + 4) ^= htobe64(seqno); 816 } 817 818 /* 819 * Decrypt a TLS record 'len' bytes long at 'src' and store the result at 820 * 'dst'. If the TLS record header length doesn't match or 'dst' doesn't 821 * have sufficient room ('avail'), fail the test. 822 */ 823 static size_t 824 decrypt_tls_aes_cbc_mte(const atf_tc_t *tc, struct tls_enable *en, 825 uint64_t seqno, const void *src, size_t len, void *dst, size_t avail, 826 uint8_t *record_type) 827 { 828 const struct tls_record_layer *hdr; 829 struct tls_mac_data aad; 830 const char *iv; 831 char *buf; 832 size_t hdr_len, mac_len, payload_len; 833 int padding; 834 835 hdr = src; 836 hdr_len = tls_header_len(en); 837 mac_len = tls_mac_len(en); 838 ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor); 839 ATF_REQUIRE_INTEQ(en->tls_vminor, hdr->tls_vminor); 840 debug(tc, "decrypting MTE record seqno %ju:\n", (uintmax_t)seqno); 841 debug_hexdump(tc, src, len, NULL); 842 843 /* First, decrypt the outer payload into a temporary buffer. */ 844 payload_len = len - hdr_len; 845 buf = malloc(payload_len); 846 if (en->tls_vminor == TLS_MINOR_VER_ZERO) 847 iv = en->iv; 848 else 849 iv = (void *)(hdr + 1); 850 debug_hexdump(tc, iv, AES_BLOCK_LEN, "iv"); 851 ATF_REQUIRE(cbc_decrypt(tls_EVP_CIPHER(en), en->cipher_key, iv, 852 (const u_char *)src + hdr_len, buf, payload_len)); 853 debug_hexdump(tc, buf, payload_len, "decrypted buffer"); 854 855 /* 856 * Copy the last encrypted block to use as the IV for the next 857 * record for TLS 1.0. 858 */ 859 if (en->tls_vminor == TLS_MINOR_VER_ZERO) 860 memcpy(__DECONST(uint8_t *, en->iv), (const u_char *)src + 861 (len - AES_BLOCK_LEN), AES_BLOCK_LEN); 862 863 /* 864 * Verify trailing padding and strip. 865 * 866 * The kernel always generates the smallest amount of padding. 867 */ 868 padding = buf[payload_len - 1] + 1; 869 ATF_REQUIRE_MSG(padding > 0 && padding <= AES_BLOCK_LEN, 870 "invalid padding %d", padding); 871 ATF_REQUIRE_MSG(payload_len >= mac_len + padding, 872 "payload_len (%zu) < mac_len (%zu) + padding (%d)", payload_len, 873 mac_len, padding); 874 payload_len -= padding; 875 876 /* Verify HMAC. */ 877 payload_len -= mac_len; 878 tls_mte_aad(en, payload_len, hdr, seqno, &aad); 879 debug_hexdump(tc, &aad, sizeof(aad), "aad"); 880 ATF_REQUIRE(verify_hash(tls_EVP_MD(en), en->auth_key, en->auth_key_len, 881 &aad, sizeof(aad), buf, payload_len, buf + payload_len)); 882 883 ATF_REQUIRE_MSG(payload_len <= avail, "payload_len (%zu) < avail (%zu)", 884 payload_len, avail); 885 memcpy(dst, buf, payload_len); 886 *record_type = hdr->tls_type; 887 return (payload_len); 888 } 889 890 static size_t 891 decrypt_tls_12_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno, 892 const void *src, size_t len, void *dst, uint8_t *record_type) 893 { 894 const struct tls_record_layer *hdr; 895 struct tls_aead_data aad; 896 char nonce[12]; 897 size_t hdr_len, mac_len, payload_len; 898 899 hdr = src; 900 901 hdr_len = tls_header_len(en); 902 mac_len = tls_mac_len(en); 903 payload_len = len - (hdr_len + mac_len); 904 ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor); 905 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, hdr->tls_vminor); 906 debug(tc, "decrypting TLS 1.2 record seqno %ju:\n", (uintmax_t)seqno); 907 debug_hexdump(tc, src, len, NULL); 908 909 tls_12_aead_aad(en, payload_len, hdr, seqno, &aad); 910 debug_hexdump(tc, &aad, sizeof(aad), "aad"); 911 if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16) 912 tls_12_gcm_nonce(en, hdr, nonce); 913 else 914 tls_13_nonce(en, seqno, nonce); 915 debug_hexdump(tc, nonce, sizeof(nonce), "nonce"); 916 917 ATF_REQUIRE(aead_decrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce, 918 &aad, sizeof(aad), (const char *)src + hdr_len, dst, payload_len, 919 (const char *)src + hdr_len + payload_len, mac_len)); 920 921 *record_type = hdr->tls_type; 922 return (payload_len); 923 } 924 925 static size_t 926 decrypt_tls_13_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno, 927 const void *src, size_t len, void *dst, uint8_t *record_type) 928 { 929 const struct tls_record_layer *hdr; 930 struct tls_aead_data_13 aad; 931 char nonce[12]; 932 char *buf; 933 size_t hdr_len, mac_len, payload_len; 934 935 hdr = src; 936 937 hdr_len = tls_header_len(en); 938 mac_len = tls_mac_len(en); 939 payload_len = len - (hdr_len + mac_len); 940 ATF_REQUIRE_MSG(payload_len >= 1, 941 "payload_len (%zu) too short: len %zu hdr_len %zu mac_len %zu", 942 payload_len, len, hdr_len, mac_len); 943 ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, hdr->tls_type); 944 ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor); 945 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, hdr->tls_vminor); 946 debug(tc, "decrypting TLS 1.3 record seqno %ju:\n", (uintmax_t)seqno); 947 debug_hexdump(tc, src, len, NULL); 948 949 tls_13_aad(en, hdr, seqno, &aad); 950 debug_hexdump(tc, &aad, sizeof(aad), "aad"); 951 tls_13_nonce(en, seqno, nonce); 952 debug_hexdump(tc, nonce, sizeof(nonce), "nonce"); 953 954 /* 955 * Have to use a temporary buffer for the output due to the 956 * record type as the last byte of the trailer. 957 */ 958 buf = malloc(payload_len); 959 960 ATF_REQUIRE(aead_decrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce, 961 &aad, sizeof(aad), (const char *)src + hdr_len, buf, payload_len, 962 (const char *)src + hdr_len + payload_len, mac_len)); 963 debug_hexdump(tc, buf, payload_len, "decrypted buffer"); 964 965 /* Trim record type. */ 966 *record_type = buf[payload_len - 1]; 967 payload_len--; 968 969 memcpy(dst, buf, payload_len); 970 free(buf); 971 972 return (payload_len); 973 } 974 975 static size_t 976 decrypt_tls_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno, 977 const void *src, size_t len, void *dst, size_t avail, uint8_t *record_type) 978 { 979 const struct tls_record_layer *hdr; 980 size_t payload_len; 981 982 hdr = src; 983 ATF_REQUIRE_INTEQ(len, ntohs(hdr->tls_length) + sizeof(*hdr)); 984 985 payload_len = len - (tls_header_len(en) + tls_trailer_len(en)); 986 ATF_REQUIRE_MSG(payload_len <= avail, "payload_len (%zu) > avail (%zu)", 987 payload_len, avail); 988 989 if (en->tls_vminor == TLS_MINOR_VER_TWO) { 990 ATF_REQUIRE_INTEQ(payload_len, decrypt_tls_12_aead(tc, en, 991 seqno, src, len, dst, record_type)); 992 } else { 993 ATF_REQUIRE_INTEQ(payload_len, decrypt_tls_13_aead(tc, en, 994 seqno, src, len, dst, record_type)); 995 } 996 997 return (payload_len); 998 } 999 1000 static size_t 1001 decrypt_tls_record(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno, 1002 const void *src, size_t len, void *dst, size_t avail, uint8_t *record_type) 1003 { 1004 if (en->cipher_algorithm == CRYPTO_AES_CBC) 1005 return (decrypt_tls_aes_cbc_mte(tc, en, seqno, src, len, dst, 1006 avail, record_type)); 1007 else 1008 return (decrypt_tls_aead(tc, en, seqno, src, len, dst, avail, 1009 record_type)); 1010 } 1011 1012 /* 1013 * Encrypt a TLS record of type 'record_type' with payload 'len' bytes 1014 * long at 'src' and store the result at 'dst'. If 'dst' doesn't have 1015 * sufficient room ('avail'), fail the test. 'padding' is the amount 1016 * of additional padding to include beyond any amount mandated by the 1017 * cipher suite. 1018 */ 1019 static size_t 1020 encrypt_tls_aes_cbc_mte(const atf_tc_t *tc, struct tls_enable *en, 1021 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst, 1022 size_t avail, size_t padding) 1023 { 1024 struct tls_record_layer *hdr; 1025 struct tls_mac_data aad; 1026 char *buf, *iv; 1027 size_t hdr_len, mac_len, record_len; 1028 u_int digest_len, i; 1029 1030 ATF_REQUIRE_INTEQ(0, padding % 16); 1031 1032 hdr = dst; 1033 buf = dst; 1034 1035 debug(tc, "encrypting MTE record seqno %ju:\n", (uintmax_t)seqno); 1036 hdr_len = tls_header_len(en); 1037 mac_len = tls_mac_len(en); 1038 padding += (AES_BLOCK_LEN - (len + mac_len) % AES_BLOCK_LEN); 1039 ATF_REQUIRE_MSG(padding > 0 && padding <= 255, "invalid padding (%zu)", 1040 padding); 1041 1042 record_len = hdr_len + len + mac_len + padding; 1043 ATF_REQUIRE_MSG(record_len <= avail, "record_len (%zu) > avail (%zu): " 1044 "hdr_len %zu, len %zu, mac_len %zu, padding %zu", record_len, 1045 avail, hdr_len, len, mac_len, padding); 1046 1047 hdr->tls_type = record_type; 1048 hdr->tls_vmajor = TLS_MAJOR_VER_ONE; 1049 hdr->tls_vminor = en->tls_vminor; 1050 hdr->tls_length = htons(record_len - sizeof(*hdr)); 1051 iv = (char *)(hdr + 1); 1052 for (i = 0; i < AES_BLOCK_LEN; i++) 1053 iv[i] = rdigit(); 1054 debug_hexdump(tc, iv, AES_BLOCK_LEN, "explicit IV"); 1055 1056 /* Copy plaintext to ciphertext region. */ 1057 memcpy(buf + hdr_len, src, len); 1058 1059 /* Compute HMAC. */ 1060 tls_mte_aad(en, len, hdr, seqno, &aad); 1061 debug_hexdump(tc, &aad, sizeof(aad), "aad"); 1062 debug_hexdump(tc, src, len, "plaintext"); 1063 ATF_REQUIRE(compute_hash(tls_EVP_MD(en), en->auth_key, en->auth_key_len, 1064 &aad, sizeof(aad), src, len, buf + hdr_len + len, &digest_len)); 1065 ATF_REQUIRE_INTEQ(mac_len, digest_len); 1066 1067 /* Store padding. */ 1068 for (i = 0; i < padding; i++) 1069 buf[hdr_len + len + mac_len + i] = padding - 1; 1070 debug_hexdump(tc, buf + hdr_len + len, mac_len + padding, 1071 "MAC and padding"); 1072 1073 /* Encrypt the record. */ 1074 ATF_REQUIRE(cbc_encrypt(tls_EVP_CIPHER(en), en->cipher_key, iv, 1075 buf + hdr_len, buf + hdr_len, len + mac_len + padding)); 1076 debug_hexdump(tc, dst, record_len, "encrypted record"); 1077 1078 return (record_len); 1079 } 1080 1081 static size_t 1082 encrypt_tls_12_aead(const atf_tc_t *tc, struct tls_enable *en, 1083 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst) 1084 { 1085 struct tls_record_layer *hdr; 1086 struct tls_aead_data aad; 1087 char nonce[12]; 1088 size_t hdr_len, mac_len, record_len; 1089 1090 hdr = dst; 1091 1092 debug(tc, "encrypting TLS 1.2 record seqno %ju:\n", (uintmax_t)seqno); 1093 hdr_len = tls_header_len(en); 1094 mac_len = tls_mac_len(en); 1095 record_len = hdr_len + len + mac_len; 1096 1097 hdr->tls_type = record_type; 1098 hdr->tls_vmajor = TLS_MAJOR_VER_ONE; 1099 hdr->tls_vminor = TLS_MINOR_VER_TWO; 1100 hdr->tls_length = htons(record_len - sizeof(*hdr)); 1101 if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16) 1102 memcpy(hdr + 1, &seqno, sizeof(seqno)); 1103 1104 tls_12_aead_aad(en, len, hdr, seqno, &aad); 1105 debug_hexdump(tc, &aad, sizeof(aad), "aad"); 1106 if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16) 1107 tls_12_gcm_nonce(en, hdr, nonce); 1108 else 1109 tls_13_nonce(en, seqno, nonce); 1110 debug_hexdump(tc, nonce, sizeof(nonce), "nonce"); 1111 1112 debug_hexdump(tc, src, len, "plaintext"); 1113 ATF_REQUIRE(aead_encrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce, 1114 &aad, sizeof(aad), src, (char *)dst + hdr_len, len, 1115 (char *)dst + hdr_len + len, mac_len)); 1116 debug_hexdump(tc, dst, record_len, "encrypted record"); 1117 1118 return (record_len); 1119 } 1120 1121 static size_t 1122 encrypt_tls_13_aead(const atf_tc_t *tc, struct tls_enable *en, 1123 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst, 1124 size_t padding) 1125 { 1126 struct tls_record_layer *hdr; 1127 struct tls_aead_data_13 aad; 1128 char nonce[12]; 1129 char *buf; 1130 size_t hdr_len, mac_len, record_len; 1131 1132 hdr = dst; 1133 1134 debug(tc, "encrypting TLS 1.3 record seqno %ju:\n", (uintmax_t)seqno); 1135 hdr_len = tls_header_len(en); 1136 mac_len = tls_mac_len(en); 1137 record_len = hdr_len + len + 1 + padding + mac_len; 1138 1139 hdr->tls_type = TLS_RLTYPE_APP; 1140 hdr->tls_vmajor = TLS_MAJOR_VER_ONE; 1141 hdr->tls_vminor = TLS_MINOR_VER_TWO; 1142 hdr->tls_length = htons(record_len - sizeof(*hdr)); 1143 1144 tls_13_aad(en, hdr, seqno, &aad); 1145 debug_hexdump(tc, &aad, sizeof(aad), "aad"); 1146 tls_13_nonce(en, seqno, nonce); 1147 debug_hexdump(tc, nonce, sizeof(nonce), "nonce"); 1148 1149 /* 1150 * Have to use a temporary buffer for the input so that the record 1151 * type can be appended. 1152 */ 1153 buf = malloc(len + 1 + padding); 1154 memcpy(buf, src, len); 1155 buf[len] = record_type; 1156 memset(buf + len + 1, 0, padding); 1157 debug_hexdump(tc, buf, len + 1 + padding, "plaintext + type + padding"); 1158 1159 ATF_REQUIRE(aead_encrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce, 1160 &aad, sizeof(aad), buf, (char *)dst + hdr_len, len + 1 + padding, 1161 (char *)dst + hdr_len + len + 1 + padding, mac_len)); 1162 debug_hexdump(tc, dst, record_len, "encrypted record"); 1163 1164 free(buf); 1165 1166 return (record_len); 1167 } 1168 1169 static size_t 1170 encrypt_tls_aead(const atf_tc_t *tc, struct tls_enable *en, 1171 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst, 1172 size_t avail, size_t padding) 1173 { 1174 size_t record_len; 1175 1176 record_len = tls_header_len(en) + len + padding + tls_trailer_len(en); 1177 ATF_REQUIRE_MSG(record_len <= avail, "record_len (%zu) > avail (%zu): " 1178 "header %zu len %zu padding %zu trailer %zu", record_len, avail, 1179 tls_header_len(en), len, padding, tls_trailer_len(en)); 1180 1181 if (en->tls_vminor == TLS_MINOR_VER_TWO) { 1182 ATF_REQUIRE_INTEQ(0, padding); 1183 ATF_REQUIRE_INTEQ(record_len, encrypt_tls_12_aead(tc, en, 1184 record_type, seqno, src, len, dst)); 1185 } else 1186 ATF_REQUIRE_INTEQ(record_len, encrypt_tls_13_aead(tc, en, 1187 record_type, seqno, src, len, dst, padding)); 1188 1189 return (record_len); 1190 } 1191 1192 static size_t 1193 encrypt_tls_record(const atf_tc_t *tc, struct tls_enable *en, 1194 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst, 1195 size_t avail, size_t padding) 1196 { 1197 if (en->cipher_algorithm == CRYPTO_AES_CBC) 1198 return (encrypt_tls_aes_cbc_mte(tc, en, record_type, seqno, src, 1199 len, dst, avail, padding)); 1200 else 1201 return (encrypt_tls_aead(tc, en, record_type, seqno, src, len, 1202 dst, avail, padding)); 1203 } 1204 1205 static void 1206 test_ktls_transmit_app_data(const atf_tc_t *tc, struct tls_enable *en, 1207 uint64_t seqno, size_t len) 1208 { 1209 struct kevent ev; 1210 struct tls_record_layer *hdr; 1211 char *plaintext, *decrypted, *outbuf; 1212 size_t decrypted_len, outbuf_len, outbuf_cap, record_len, written; 1213 ssize_t rv; 1214 int kq, sockets[2]; 1215 uint8_t record_type; 1216 1217 plaintext = alloc_buffer(len); 1218 debug_hexdump(tc, plaintext, len, "plaintext"); 1219 decrypted = malloc(len); 1220 outbuf_cap = tls_header_len(en) + TLS_MAX_MSG_SIZE_V10_2 + 1221 tls_trailer_len(en); 1222 outbuf = malloc(outbuf_cap); 1223 hdr = (struct tls_record_layer *)outbuf; 1224 1225 ATF_REQUIRE((kq = kqueue()) != -1); 1226 1227 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1228 1229 ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en, 1230 sizeof(*en)) == 0); 1231 check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE); 1232 1233 EV_SET(&ev, sockets[0], EVFILT_READ, EV_ADD, 0, 0, NULL); 1234 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0); 1235 EV_SET(&ev, sockets[1], EVFILT_WRITE, EV_ADD, 0, 0, NULL); 1236 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0); 1237 1238 decrypted_len = 0; 1239 outbuf_len = 0; 1240 written = 0; 1241 1242 while (decrypted_len != len) { 1243 ATF_REQUIRE(kevent(kq, NULL, 0, &ev, 1, NULL) == 1); 1244 1245 switch (ev.filter) { 1246 case EVFILT_WRITE: 1247 /* Try to write any remaining data. */ 1248 rv = write(ev.ident, plaintext + written, 1249 len - written); 1250 ATF_REQUIRE_MSG(rv > 0, 1251 "failed to write to socket"); 1252 written += rv; 1253 if (written == len) { 1254 ev.flags = EV_DISABLE; 1255 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, 1256 NULL) == 0); 1257 } 1258 break; 1259 1260 case EVFILT_READ: 1261 ATF_REQUIRE((ev.flags & EV_EOF) == 0); 1262 1263 /* 1264 * Try to read data for the next TLS record 1265 * into outbuf. Start by reading the header 1266 * to determine how much additional data to 1267 * read. 1268 */ 1269 if (outbuf_len < sizeof(struct tls_record_layer)) { 1270 rv = read(ev.ident, outbuf + outbuf_len, 1271 sizeof(struct tls_record_layer) - 1272 outbuf_len); 1273 ATF_REQUIRE_MSG(rv > 0, 1274 "failed to read from socket"); 1275 outbuf_len += rv; 1276 1277 if (outbuf_len == 1278 sizeof(struct tls_record_layer)) { 1279 debug(tc, "TLS header for seqno %ju:\n", 1280 (uintmax_t)seqno); 1281 debug_hexdump(tc, outbuf, outbuf_len, 1282 NULL); 1283 } 1284 } 1285 1286 if (outbuf_len < sizeof(struct tls_record_layer)) 1287 break; 1288 1289 record_len = sizeof(struct tls_record_layer) + 1290 ntohs(hdr->tls_length); 1291 debug(tc, "record_len %zu outbuf_cap %zu\n", 1292 record_len, outbuf_cap); 1293 ATF_REQUIRE(record_len <= outbuf_cap); 1294 ATF_REQUIRE(record_len > outbuf_len); 1295 rv = read(ev.ident, outbuf + outbuf_len, 1296 record_len - outbuf_len); 1297 if (rv == -1 && errno == EAGAIN) 1298 break; 1299 ATF_REQUIRE_MSG(rv > 0, 1300 "failed to read from socket: %s", strerror(errno)); 1301 1302 outbuf_len += rv; 1303 if (outbuf_len == record_len) { 1304 decrypted_len += decrypt_tls_record(tc, en, 1305 seqno, outbuf, outbuf_len, 1306 decrypted + decrypted_len, 1307 len - decrypted_len, &record_type); 1308 ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, record_type); 1309 1310 seqno++; 1311 outbuf_len = 0; 1312 } 1313 break; 1314 } 1315 } 1316 1317 ATF_REQUIRE_MSG(written == decrypted_len, 1318 "read %zu decrypted bytes, but wrote %zu", decrypted_len, written); 1319 1320 ATF_REQUIRE(memcmp(plaintext, decrypted, len) == 0); 1321 1322 free(outbuf); 1323 free(decrypted); 1324 free(plaintext); 1325 1326 close_sockets(sockets); 1327 ATF_REQUIRE(close(kq) == 0); 1328 } 1329 1330 static void 1331 ktls_send_control_message(int fd, uint8_t type, void *data, size_t len) 1332 { 1333 struct msghdr msg; 1334 struct cmsghdr *cmsg; 1335 char cbuf[CMSG_SPACE(sizeof(type))]; 1336 struct iovec iov; 1337 1338 memset(&msg, 0, sizeof(msg)); 1339 1340 msg.msg_control = cbuf; 1341 msg.msg_controllen = sizeof(cbuf); 1342 cmsg = CMSG_FIRSTHDR(&msg); 1343 cmsg->cmsg_level = IPPROTO_TCP; 1344 cmsg->cmsg_type = TLS_SET_RECORD_TYPE; 1345 cmsg->cmsg_len = CMSG_LEN(sizeof(type)); 1346 *(uint8_t *)CMSG_DATA(cmsg) = type; 1347 1348 iov.iov_base = data; 1349 iov.iov_len = len; 1350 msg.msg_iov = &iov; 1351 msg.msg_iovlen = 1; 1352 1353 ATF_REQUIRE_INTEQ((ssize_t)len, sendmsg(fd, &msg, 0)); 1354 } 1355 1356 static void 1357 test_ktls_transmit_control(const atf_tc_t *tc, struct tls_enable *en, 1358 uint64_t seqno, uint8_t type, size_t len) 1359 { 1360 struct tls_record_layer *hdr; 1361 char *plaintext, *decrypted, *outbuf; 1362 size_t outbuf_cap, payload_len, record_len; 1363 ssize_t rv; 1364 int sockets[2]; 1365 uint8_t record_type; 1366 1367 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); 1368 1369 plaintext = alloc_buffer(len); 1370 decrypted = malloc(len); 1371 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); 1372 outbuf = malloc(outbuf_cap); 1373 hdr = (struct tls_record_layer *)outbuf; 1374 1375 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1376 1377 ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en, 1378 sizeof(*en)) == 0); 1379 check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE); 1380 1381 fd_set_blocking(sockets[0]); 1382 fd_set_blocking(sockets[1]); 1383 1384 ktls_send_control_message(sockets[1], type, plaintext, len); 1385 1386 /* 1387 * First read the header to determine how much additional data 1388 * to read. 1389 */ 1390 rv = read(sockets[0], outbuf, sizeof(struct tls_record_layer)); 1391 ATF_REQUIRE_INTEQ(sizeof(struct tls_record_layer), rv); 1392 payload_len = ntohs(hdr->tls_length); 1393 record_len = payload_len + sizeof(struct tls_record_layer); 1394 ATF_REQUIRE_MSG(record_len <= outbuf_cap, 1395 "record_len (%zu) > outbuf_cap (%zu)", record_len, outbuf_cap); 1396 rv = read(sockets[0], outbuf + sizeof(struct tls_record_layer), 1397 payload_len); 1398 ATF_REQUIRE_INTEQ((ssize_t)payload_len, rv); 1399 1400 rv = decrypt_tls_record(tc, en, seqno, outbuf, record_len, decrypted, 1401 len, &record_type); 1402 1403 ATF_REQUIRE_MSG((ssize_t)len == rv, 1404 "read %zd decrypted bytes, but wrote %zu", rv, len); 1405 ATF_REQUIRE_INTEQ(type, record_type); 1406 1407 ATF_REQUIRE(memcmp(plaintext, decrypted, len) == 0); 1408 1409 free(outbuf); 1410 free(decrypted); 1411 free(plaintext); 1412 1413 close_sockets(sockets); 1414 } 1415 1416 static void 1417 test_ktls_transmit_empty_fragment(const atf_tc_t *tc, struct tls_enable *en, 1418 uint64_t seqno) 1419 { 1420 struct tls_record_layer *hdr; 1421 char *outbuf; 1422 size_t outbuf_cap, payload_len, record_len; 1423 ssize_t rv; 1424 int sockets[2]; 1425 uint8_t record_type; 1426 1427 outbuf_cap = tls_header_len(en) + tls_trailer_len(en); 1428 outbuf = malloc(outbuf_cap); 1429 hdr = (struct tls_record_layer *)outbuf; 1430 1431 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1432 1433 ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en, 1434 sizeof(*en)) == 0); 1435 check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE); 1436 1437 fd_set_blocking(sockets[0]); 1438 fd_set_blocking(sockets[1]); 1439 1440 /* 1441 * A write of zero bytes should send an empty fragment only for 1442 * TLS 1.0, otherwise an error should be raised. 1443 */ 1444 rv = write(sockets[1], NULL, 0); 1445 if (rv == 0) { 1446 ATF_REQUIRE_INTEQ(CRYPTO_AES_CBC, en->cipher_algorithm); 1447 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_ZERO, en->tls_vminor); 1448 } else { 1449 ATF_REQUIRE_INTEQ(-1, rv); 1450 ATF_REQUIRE_ERRNO(EINVAL, true); 1451 goto out; 1452 } 1453 1454 /* 1455 * First read the header to determine how much additional data 1456 * to read. 1457 */ 1458 rv = read(sockets[0], outbuf, sizeof(struct tls_record_layer)); 1459 ATF_REQUIRE_INTEQ(sizeof(struct tls_record_layer), rv); 1460 payload_len = ntohs(hdr->tls_length); 1461 record_len = payload_len + sizeof(struct tls_record_layer); 1462 ATF_REQUIRE_MSG(record_len <= outbuf_cap, 1463 "record_len (%zu) > outbuf_cap (%zu)", record_len, outbuf_cap); 1464 rv = read(sockets[0], outbuf + sizeof(struct tls_record_layer), 1465 payload_len); 1466 ATF_REQUIRE_INTEQ((ssize_t)payload_len, rv); 1467 1468 rv = decrypt_tls_record(tc, en, seqno, outbuf, record_len, NULL, 0, 1469 &record_type); 1470 1471 ATF_REQUIRE_MSG(rv == 0, 1472 "read %zd decrypted bytes for an empty fragment", rv); 1473 ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, record_type); 1474 1475 out: 1476 free(outbuf); 1477 1478 close_sockets(sockets); 1479 } 1480 1481 static size_t 1482 ktls_receive_tls_record(struct tls_enable *en, int fd, uint8_t record_type, 1483 void *data, size_t len) 1484 { 1485 struct msghdr msg; 1486 struct cmsghdr *cmsg; 1487 struct tls_get_record *tgr; 1488 char cbuf[CMSG_SPACE(sizeof(*tgr))]; 1489 struct iovec iov; 1490 ssize_t rv; 1491 1492 memset(&msg, 0, sizeof(msg)); 1493 1494 msg.msg_control = cbuf; 1495 msg.msg_controllen = sizeof(cbuf); 1496 1497 iov.iov_base = data; 1498 iov.iov_len = len; 1499 msg.msg_iov = &iov; 1500 msg.msg_iovlen = 1; 1501 1502 ATF_REQUIRE((rv = recvmsg(fd, &msg, 0)) > 0); 1503 1504 ATF_REQUIRE((msg.msg_flags & (MSG_EOR | MSG_CTRUNC)) == MSG_EOR); 1505 1506 cmsg = CMSG_FIRSTHDR(&msg); 1507 ATF_REQUIRE(cmsg != NULL); 1508 ATF_REQUIRE_INTEQ(IPPROTO_TCP, cmsg->cmsg_level); 1509 ATF_REQUIRE_INTEQ(TLS_GET_RECORD, cmsg->cmsg_type); 1510 ATF_REQUIRE_INTEQ(CMSG_LEN(sizeof(*tgr)), cmsg->cmsg_len); 1511 1512 tgr = (struct tls_get_record *)CMSG_DATA(cmsg); 1513 ATF_REQUIRE_INTEQ(record_type, tgr->tls_type); 1514 ATF_REQUIRE_INTEQ(en->tls_vmajor, tgr->tls_vmajor); 1515 /* XXX: Not sure if this is what OpenSSL expects? */ 1516 if (en->tls_vminor == TLS_MINOR_VER_THREE) 1517 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, tgr->tls_vminor); 1518 else 1519 ATF_REQUIRE_INTEQ(en->tls_vminor, tgr->tls_vminor); 1520 ATF_REQUIRE_INTEQ(htons(rv), tgr->tls_length); 1521 1522 return (rv); 1523 } 1524 1525 static void 1526 test_ktls_receive_app_data(const atf_tc_t *tc, struct tls_enable *en, 1527 uint64_t seqno, size_t len, size_t padding) 1528 { 1529 struct kevent ev; 1530 char *plaintext, *received, *outbuf; 1531 size_t outbuf_cap, outbuf_len, outbuf_sent, received_len, todo, written; 1532 ssize_t rv; 1533 int kq, sockets[2]; 1534 1535 plaintext = alloc_buffer(len); 1536 received = malloc(len); 1537 outbuf_cap = tls_header_len(en) + TLS_MAX_MSG_SIZE_V10_2 + 1538 tls_trailer_len(en); 1539 outbuf = malloc(outbuf_cap); 1540 1541 ATF_REQUIRE((kq = kqueue()) != -1); 1542 1543 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1544 1545 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, 1546 sizeof(*en)) == 0); 1547 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); 1548 1549 EV_SET(&ev, sockets[0], EVFILT_READ, EV_ADD, 0, 0, NULL); 1550 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0); 1551 EV_SET(&ev, sockets[1], EVFILT_WRITE, EV_ADD, 0, 0, NULL); 1552 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0); 1553 1554 received_len = 0; 1555 outbuf_len = 0; 1556 written = 0; 1557 1558 while (received_len != len) { 1559 ATF_REQUIRE(kevent(kq, NULL, 0, &ev, 1, NULL) == 1); 1560 1561 switch (ev.filter) { 1562 case EVFILT_WRITE: 1563 /* 1564 * Compose the next TLS record to send. 1565 */ 1566 if (outbuf_len == 0) { 1567 ATF_REQUIRE(written < len); 1568 todo = len - written; 1569 if (todo > TLS_MAX_MSG_SIZE_V10_2 - padding) 1570 todo = TLS_MAX_MSG_SIZE_V10_2 - padding; 1571 outbuf_len = encrypt_tls_record(tc, en, 1572 TLS_RLTYPE_APP, seqno, plaintext + written, 1573 todo, outbuf, outbuf_cap, padding); 1574 outbuf_sent = 0; 1575 written += todo; 1576 seqno++; 1577 } 1578 1579 /* 1580 * Try to write the remainder of the current 1581 * TLS record. 1582 */ 1583 rv = write(ev.ident, outbuf + outbuf_sent, 1584 outbuf_len - outbuf_sent); 1585 ATF_REQUIRE_MSG(rv > 0, 1586 "failed to write to socket: %s", strerror(errno)); 1587 outbuf_sent += rv; 1588 if (outbuf_sent == outbuf_len) { 1589 outbuf_len = 0; 1590 if (written == len) { 1591 ev.flags = EV_DISABLE; 1592 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, 1593 NULL) == 0); 1594 } 1595 } 1596 break; 1597 1598 case EVFILT_READ: 1599 ATF_REQUIRE((ev.flags & EV_EOF) == 0); 1600 1601 rv = ktls_receive_tls_record(en, ev.ident, 1602 TLS_RLTYPE_APP, received + received_len, 1603 len - received_len); 1604 received_len += rv; 1605 break; 1606 } 1607 } 1608 1609 ATF_REQUIRE_MSG(written == received_len, 1610 "read %zu decrypted bytes, but wrote %zu", received_len, written); 1611 1612 ATF_REQUIRE(memcmp(plaintext, received, len) == 0); 1613 1614 free(outbuf); 1615 free(received); 1616 free(plaintext); 1617 1618 close_sockets(sockets); 1619 ATF_REQUIRE(close(kq) == 0); 1620 } 1621 1622 static void 1623 ktls_receive_tls_error(int fd, int expected_error) 1624 { 1625 struct msghdr msg; 1626 struct tls_get_record *tgr; 1627 char cbuf[CMSG_SPACE(sizeof(*tgr))]; 1628 char buf[64]; 1629 struct iovec iov; 1630 1631 memset(&msg, 0, sizeof(msg)); 1632 1633 msg.msg_control = cbuf; 1634 msg.msg_controllen = sizeof(cbuf); 1635 1636 iov.iov_base = buf; 1637 iov.iov_len = sizeof(buf); 1638 msg.msg_iov = &iov; 1639 msg.msg_iovlen = 1; 1640 1641 ATF_REQUIRE(recvmsg(fd, &msg, 0) == -1); 1642 if (expected_error != 0) 1643 ATF_REQUIRE_ERRNO(expected_error, true); 1644 } 1645 1646 static void 1647 test_ktls_receive_corrupted_record(const atf_tc_t *tc, struct tls_enable *en, 1648 uint64_t seqno, size_t len, ssize_t offset) 1649 { 1650 char *plaintext, *outbuf; 1651 size_t outbuf_cap, outbuf_len; 1652 ssize_t rv; 1653 int sockets[2]; 1654 1655 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); 1656 1657 plaintext = alloc_buffer(len); 1658 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); 1659 outbuf = malloc(outbuf_cap); 1660 1661 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1662 1663 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, 1664 sizeof(*en)) == 0); 1665 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); 1666 1667 fd_set_blocking(sockets[0]); 1668 fd_set_blocking(sockets[1]); 1669 1670 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno, 1671 plaintext, len, outbuf, outbuf_cap, 0); 1672 1673 /* A negative offset is an offset from the end. */ 1674 if (offset < 0) 1675 offset += outbuf_len; 1676 outbuf[offset] ^= 0x01; 1677 1678 rv = write(sockets[1], outbuf, outbuf_len); 1679 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv); 1680 1681 ktls_receive_tls_error(sockets[0], EBADMSG); 1682 1683 free(outbuf); 1684 free(plaintext); 1685 1686 close_sockets_ignore_errors(sockets); 1687 } 1688 1689 static void 1690 test_ktls_receive_corrupted_iv(const atf_tc_t *tc, struct tls_enable *en, 1691 uint64_t seqno, size_t len) 1692 { 1693 ATF_REQUIRE(tls_header_len(en) > sizeof(struct tls_record_layer)); 1694 1695 /* Corrupt the first byte of the explicit IV after the header. */ 1696 test_ktls_receive_corrupted_record(tc, en, seqno, len, 1697 sizeof(struct tls_record_layer)); 1698 } 1699 1700 static void 1701 test_ktls_receive_corrupted_data(const atf_tc_t *tc, struct tls_enable *en, 1702 uint64_t seqno, size_t len) 1703 { 1704 ATF_REQUIRE(len > 0); 1705 1706 /* Corrupt the first ciphertext byte after the header. */ 1707 test_ktls_receive_corrupted_record(tc, en, seqno, len, 1708 tls_header_len(en)); 1709 } 1710 1711 static void 1712 test_ktls_receive_corrupted_mac(const atf_tc_t *tc, struct tls_enable *en, 1713 uint64_t seqno, size_t len) 1714 { 1715 size_t offset; 1716 1717 /* Corrupt the first byte of the MAC. */ 1718 if (en->cipher_algorithm == CRYPTO_AES_CBC) 1719 offset = tls_header_len(en) + len; 1720 else 1721 offset = -tls_mac_len(en); 1722 test_ktls_receive_corrupted_record(tc, en, seqno, len, offset); 1723 } 1724 1725 static void 1726 test_ktls_receive_corrupted_padding(const atf_tc_t *tc, struct tls_enable *en, 1727 uint64_t seqno, size_t len) 1728 { 1729 ATF_REQUIRE_INTEQ(CRYPTO_AES_CBC, en->cipher_algorithm); 1730 1731 /* Corrupt the last byte of the padding. */ 1732 test_ktls_receive_corrupted_record(tc, en, seqno, len, -1); 1733 } 1734 1735 static void 1736 test_ktls_receive_truncated_record(const atf_tc_t *tc, struct tls_enable *en, 1737 uint64_t seqno, size_t len) 1738 { 1739 char *plaintext, *outbuf; 1740 size_t outbuf_cap, outbuf_len; 1741 ssize_t rv; 1742 int sockets[2]; 1743 1744 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); 1745 1746 plaintext = alloc_buffer(len); 1747 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); 1748 outbuf = malloc(outbuf_cap); 1749 1750 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1751 1752 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, 1753 sizeof(*en)) == 0); 1754 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); 1755 1756 fd_set_blocking(sockets[0]); 1757 fd_set_blocking(sockets[1]); 1758 1759 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno, 1760 plaintext, len, outbuf, outbuf_cap, 0); 1761 1762 rv = write(sockets[1], outbuf, outbuf_len / 2); 1763 ATF_REQUIRE_INTEQ((ssize_t)(outbuf_len / 2), rv); 1764 1765 ATF_REQUIRE(shutdown(sockets[1], SHUT_WR) == 0); 1766 1767 ktls_receive_tls_error(sockets[0], EMSGSIZE); 1768 1769 free(outbuf); 1770 free(plaintext); 1771 1772 close_sockets_ignore_errors(sockets); 1773 } 1774 1775 static void 1776 test_ktls_receive_bad_major(const atf_tc_t *tc, struct tls_enable *en, 1777 uint64_t seqno, size_t len) 1778 { 1779 struct tls_record_layer *hdr; 1780 char *plaintext, *outbuf; 1781 size_t outbuf_cap, outbuf_len; 1782 ssize_t rv; 1783 int sockets[2]; 1784 1785 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); 1786 1787 plaintext = alloc_buffer(len); 1788 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); 1789 outbuf = malloc(outbuf_cap); 1790 1791 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1792 1793 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, 1794 sizeof(*en)) == 0); 1795 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); 1796 1797 fd_set_blocking(sockets[0]); 1798 fd_set_blocking(sockets[1]); 1799 1800 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno, 1801 plaintext, len, outbuf, outbuf_cap, 0); 1802 1803 hdr = (void *)outbuf; 1804 hdr->tls_vmajor++; 1805 1806 rv = write(sockets[1], outbuf, outbuf_len); 1807 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv); 1808 1809 ktls_receive_tls_error(sockets[0], EINVAL); 1810 1811 free(outbuf); 1812 free(plaintext); 1813 1814 close_sockets_ignore_errors(sockets); 1815 } 1816 1817 static void 1818 test_ktls_receive_bad_minor(const atf_tc_t *tc, struct tls_enable *en, 1819 uint64_t seqno, size_t len) 1820 { 1821 struct tls_record_layer *hdr; 1822 char *plaintext, *outbuf; 1823 size_t outbuf_cap, outbuf_len; 1824 ssize_t rv; 1825 int sockets[2]; 1826 1827 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); 1828 1829 plaintext = alloc_buffer(len); 1830 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); 1831 outbuf = malloc(outbuf_cap); 1832 1833 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1834 1835 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, 1836 sizeof(*en)) == 0); 1837 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); 1838 1839 fd_set_blocking(sockets[0]); 1840 fd_set_blocking(sockets[1]); 1841 1842 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno, 1843 plaintext, len, outbuf, outbuf_cap, 0); 1844 1845 hdr = (void *)outbuf; 1846 hdr->tls_vminor++; 1847 1848 rv = write(sockets[1], outbuf, outbuf_len); 1849 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv); 1850 1851 ktls_receive_tls_error(sockets[0], EINVAL); 1852 1853 free(outbuf); 1854 free(plaintext); 1855 1856 close_sockets_ignore_errors(sockets); 1857 } 1858 1859 static void 1860 test_ktls_receive_bad_type(const atf_tc_t *tc, struct tls_enable *en, 1861 uint64_t seqno, size_t len) 1862 { 1863 struct tls_record_layer *hdr; 1864 char *plaintext, *outbuf; 1865 size_t outbuf_cap, outbuf_len; 1866 ssize_t rv; 1867 int sockets[2]; 1868 1869 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); 1870 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_THREE, en->tls_vminor); 1871 1872 plaintext = alloc_buffer(len); 1873 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); 1874 outbuf = malloc(outbuf_cap); 1875 1876 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1877 1878 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, 1879 sizeof(*en)) == 0); 1880 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); 1881 1882 fd_set_blocking(sockets[0]); 1883 fd_set_blocking(sockets[1]); 1884 1885 outbuf_len = encrypt_tls_record(tc, en, 0x21 /* Alert */, seqno, 1886 plaintext, len, outbuf, outbuf_cap, 0); 1887 1888 hdr = (void *)outbuf; 1889 hdr->tls_type = TLS_RLTYPE_APP + 1; 1890 1891 rv = write(sockets[1], outbuf, outbuf_len); 1892 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv); 1893 1894 ktls_receive_tls_error(sockets[0], EINVAL); 1895 1896 free(outbuf); 1897 free(plaintext); 1898 1899 close_sockets_ignore_errors(sockets); 1900 } 1901 1902 static void 1903 test_ktls_receive_bad_size(const atf_tc_t *tc, struct tls_enable *en, 1904 uint64_t seqno, size_t len) 1905 { 1906 struct tls_record_layer *hdr; 1907 char *outbuf; 1908 size_t outbuf_len; 1909 ssize_t rv; 1910 int sockets[2]; 1911 1912 outbuf_len = sizeof(*hdr) + len; 1913 outbuf = calloc(1, outbuf_len); 1914 1915 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1916 1917 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, 1918 sizeof(*en)) == 0); 1919 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); 1920 1921 fd_set_blocking(sockets[0]); 1922 fd_set_blocking(sockets[1]); 1923 1924 hdr = (void *)outbuf; 1925 hdr->tls_vmajor = en->tls_vmajor; 1926 if (en->tls_vminor == TLS_MINOR_VER_THREE) 1927 hdr->tls_vminor = TLS_MINOR_VER_TWO; 1928 else 1929 hdr->tls_vminor = en->tls_vminor; 1930 hdr->tls_type = TLS_RLTYPE_APP; 1931 hdr->tls_length = htons(len); 1932 1933 rv = write(sockets[1], outbuf, outbuf_len); 1934 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv); 1935 1936 /* 1937 * The other end may notice the error and drop the connection 1938 * before this executes resulting in shutdown() failing with 1939 * either ENOTCONN or ECONNRESET. Ignore this error if it 1940 * occurs. 1941 */ 1942 if (shutdown(sockets[1], SHUT_WR) != 0) { 1943 ATF_REQUIRE_MSG(errno == ENOTCONN || errno == ECONNRESET, 1944 "shutdown() failed: %s", strerror(errno)); 1945 } 1946 1947 ktls_receive_tls_error(sockets[0], EMSGSIZE); 1948 1949 free(outbuf); 1950 1951 close_sockets_ignore_errors(sockets); 1952 } 1953 1954 static void 1955 test_ktls_receive_split_record(const atf_tc_t *tc, struct tls_enable *en, 1956 uint64_t seqno, size_t len, size_t first_len) 1957 { 1958 char *plaintext, *received, *outbuf; 1959 size_t outbuf_cap, outbuf_len; 1960 ssize_t rv; 1961 int sockets[2]; 1962 1963 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2); 1964 1965 plaintext = alloc_buffer(len); 1966 received = malloc(len); 1967 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en); 1968 outbuf = malloc(outbuf_cap); 1969 1970 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 1971 1972 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en, 1973 sizeof(*en)) == 0); 1974 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE); 1975 1976 fd_set_blocking(sockets[0]); 1977 fd_set_blocking(sockets[1]); 1978 1979 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno, 1980 plaintext, len, outbuf, outbuf_cap, 0); 1981 ATF_REQUIRE(first_len < outbuf_len); 1982 1983 tcp_nodelay(sockets[1]); 1984 rv = write(sockets[1], outbuf, first_len); 1985 ATF_REQUIRE_INTEQ((ssize_t)(first_len), rv); 1986 1987 rv = write(sockets[1], outbuf + first_len, outbuf_len - first_len); 1988 ATF_REQUIRE_INTEQ((ssize_t)(outbuf_len - first_len), rv); 1989 1990 rv = ktls_receive_tls_record(en, sockets[0], TLS_RLTYPE_APP, received, 1991 len); 1992 ATF_REQUIRE_INTEQ((ssize_t)len, rv); 1993 1994 ATF_REQUIRE(memcmp(plaintext, received, len) == 0); 1995 1996 free(outbuf); 1997 free(received); 1998 free(plaintext); 1999 2000 close_sockets(sockets); 2001 } 2002 2003 #define TLS_10_TESTS(M) \ 2004 M(aes128_cbc_1_0_sha1, CRYPTO_AES_CBC, 128 / 8, \ 2005 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO) \ 2006 M(aes256_cbc_1_0_sha1, CRYPTO_AES_CBC, 256 / 8, \ 2007 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO) 2008 2009 #define TLS_13_TESTS(M) \ 2010 M(aes128_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \ 2011 TLS_MINOR_VER_THREE) \ 2012 M(aes256_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0, \ 2013 TLS_MINOR_VER_THREE) \ 2014 M(chacha20_poly1305_1_3, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \ 2015 TLS_MINOR_VER_THREE) 2016 2017 #define AES_CBC_NONZERO_TESTS(M) \ 2018 M(aes128_cbc_1_1_sha1, CRYPTO_AES_CBC, 128 / 8, \ 2019 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ONE) \ 2020 M(aes256_cbc_1_1_sha1, CRYPTO_AES_CBC, 256 / 8, \ 2021 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ONE) \ 2022 M(aes128_cbc_1_2_sha1, CRYPTO_AES_CBC, 128 / 8, \ 2023 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_TWO) \ 2024 M(aes256_cbc_1_2_sha1, CRYPTO_AES_CBC, 256 / 8, \ 2025 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_TWO) \ 2026 M(aes128_cbc_1_2_sha256, CRYPTO_AES_CBC, 128 / 8, \ 2027 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_TWO) \ 2028 M(aes256_cbc_1_2_sha256, CRYPTO_AES_CBC, 256 / 8, \ 2029 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_TWO) \ 2030 M(aes128_cbc_1_2_sha384, CRYPTO_AES_CBC, 128 / 8, \ 2031 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_TWO) \ 2032 M(aes256_cbc_1_2_sha384, CRYPTO_AES_CBC, 256 / 8, \ 2033 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_TWO) \ 2034 2035 #define AES_CBC_TESTS(M) \ 2036 TLS_10_TESTS(M) \ 2037 AES_CBC_NONZERO_TESTS(M) 2038 2039 #define AES_GCM_12_TESTS(M) \ 2040 M(aes128_gcm_1_2, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \ 2041 TLS_MINOR_VER_TWO) \ 2042 M(aes256_gcm_1_2, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0, \ 2043 TLS_MINOR_VER_TWO) 2044 2045 #define AES_GCM_TESTS(M) \ 2046 AES_GCM_12_TESTS(M) \ 2047 M(aes128_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \ 2048 TLS_MINOR_VER_THREE) \ 2049 M(aes256_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0, \ 2050 TLS_MINOR_VER_THREE) 2051 2052 #define CHACHA20_TESTS(M) \ 2053 M(chacha20_poly1305_1_2, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \ 2054 TLS_MINOR_VER_TWO) \ 2055 M(chacha20_poly1305_1_3, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \ 2056 TLS_MINOR_VER_THREE) 2057 2058 #define GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2059 auth_alg, minor, name, len) \ 2060 ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_##name); \ 2061 ATF_TC_BODY(ktls_transmit_##cipher_name##_##name, tc) \ 2062 { \ 2063 struct tls_enable en; \ 2064 uint64_t seqno; \ 2065 \ 2066 ATF_REQUIRE_KTLS(); \ 2067 seqno = random(); \ 2068 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2069 seqno, &en); \ 2070 test_ktls_transmit_app_data(tc, &en, seqno, len); \ 2071 free_tls_enable(&en); \ 2072 } 2073 2074 #define ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2075 auth_alg, minor, name) \ 2076 ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_##name); 2077 2078 #define GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2079 auth_alg, minor, name, type, len) \ 2080 ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_##name); \ 2081 ATF_TC_BODY(ktls_transmit_##cipher_name##_##name, tc) \ 2082 { \ 2083 struct tls_enable en; \ 2084 uint64_t seqno; \ 2085 \ 2086 ATF_REQUIRE_KTLS(); \ 2087 seqno = random(); \ 2088 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2089 seqno, &en); \ 2090 test_ktls_transmit_control(tc, &en, seqno, type, len); \ 2091 free_tls_enable(&en); \ 2092 } 2093 2094 #define ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2095 auth_alg, minor, name) \ 2096 ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_##name); 2097 2098 #define GEN_TRANSMIT_EMPTY_FRAGMENT_TEST(cipher_name, cipher_alg, \ 2099 key_size, auth_alg, minor) \ 2100 ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_empty_fragment); \ 2101 ATF_TC_BODY(ktls_transmit_##cipher_name##_empty_fragment, tc) \ 2102 { \ 2103 struct tls_enable en; \ 2104 uint64_t seqno; \ 2105 \ 2106 ATF_REQUIRE_KTLS(); \ 2107 seqno = random(); \ 2108 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2109 seqno, &en); \ 2110 test_ktls_transmit_empty_fragment(tc, &en, seqno); \ 2111 free_tls_enable(&en); \ 2112 } 2113 2114 #define ADD_TRANSMIT_EMPTY_FRAGMENT_TEST(cipher_name, cipher_alg, \ 2115 key_size, auth_alg, minor) \ 2116 ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_empty_fragment); 2117 2118 #define GEN_TRANSMIT_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ 2119 minor) \ 2120 GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2121 auth_alg, minor, short, 64) \ 2122 GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2123 auth_alg, minor, long, 64 * 1024) \ 2124 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2125 auth_alg, minor, control, 0x21 /* Alert */, 32) 2126 2127 #define ADD_TRANSMIT_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ 2128 minor) \ 2129 ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2130 auth_alg, minor, short) \ 2131 ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2132 auth_alg, minor, long) \ 2133 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2134 auth_alg, minor, control) 2135 2136 /* 2137 * For each supported cipher suite, run three transmit tests: 2138 * 2139 * - a short test which sends 64 bytes of application data (likely as 2140 * a single TLS record) 2141 * 2142 * - a long test which sends 64KB of application data (split across 2143 * multiple TLS records) 2144 * 2145 * - a control test which sends a single record with a specific 2146 * content type via sendmsg() 2147 */ 2148 AES_CBC_TESTS(GEN_TRANSMIT_TESTS); 2149 AES_GCM_TESTS(GEN_TRANSMIT_TESTS); 2150 CHACHA20_TESTS(GEN_TRANSMIT_TESTS); 2151 2152 #define GEN_TRANSMIT_PADDING_TESTS(cipher_name, cipher_alg, key_size, \ 2153 auth_alg, minor) \ 2154 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2155 auth_alg, minor, padding_1, 0x21 /* Alert */, 1) \ 2156 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2157 auth_alg, minor, padding_2, 0x21 /* Alert */, 2) \ 2158 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2159 auth_alg, minor, padding_3, 0x21 /* Alert */, 3) \ 2160 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2161 auth_alg, minor, padding_4, 0x21 /* Alert */, 4) \ 2162 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2163 auth_alg, minor, padding_5, 0x21 /* Alert */, 5) \ 2164 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2165 auth_alg, minor, padding_6, 0x21 /* Alert */, 6) \ 2166 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2167 auth_alg, minor, padding_7, 0x21 /* Alert */, 7) \ 2168 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2169 auth_alg, minor, padding_8, 0x21 /* Alert */, 8) \ 2170 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2171 auth_alg, minor, padding_9, 0x21 /* Alert */, 9) \ 2172 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2173 auth_alg, minor, padding_10, 0x21 /* Alert */, 10) \ 2174 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2175 auth_alg, minor, padding_11, 0x21 /* Alert */, 11) \ 2176 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2177 auth_alg, minor, padding_12, 0x21 /* Alert */, 12) \ 2178 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2179 auth_alg, minor, padding_13, 0x21 /* Alert */, 13) \ 2180 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2181 auth_alg, minor, padding_14, 0x21 /* Alert */, 14) \ 2182 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2183 auth_alg, minor, padding_15, 0x21 /* Alert */, 15) \ 2184 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2185 auth_alg, minor, padding_16, 0x21 /* Alert */, 16) 2186 2187 #define ADD_TRANSMIT_PADDING_TESTS(cipher_name, cipher_alg, key_size, \ 2188 auth_alg, minor) \ 2189 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2190 auth_alg, minor, padding_1) \ 2191 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2192 auth_alg, minor, padding_2) \ 2193 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2194 auth_alg, minor, padding_3) \ 2195 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2196 auth_alg, minor, padding_4) \ 2197 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2198 auth_alg, minor, padding_5) \ 2199 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2200 auth_alg, minor, padding_6) \ 2201 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2202 auth_alg, minor, padding_7) \ 2203 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2204 auth_alg, minor, padding_8) \ 2205 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2206 auth_alg, minor, padding_9) \ 2207 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2208 auth_alg, minor, padding_10) \ 2209 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2210 auth_alg, minor, padding_11) \ 2211 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2212 auth_alg, minor, padding_12) \ 2213 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2214 auth_alg, minor, padding_13) \ 2215 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2216 auth_alg, minor, padding_14) \ 2217 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2218 auth_alg, minor, padding_15) \ 2219 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \ 2220 auth_alg, minor, padding_16) 2221 2222 /* 2223 * For AES-CBC MTE cipher suites using padding, add tests of messages 2224 * with each possible padding size. Note that the padding_<N> tests 2225 * do not necessarily test <N> bytes of padding as the padding is a 2226 * function of the cipher suite's MAC length. However, cycling 2227 * through all of the payload sizes from 1 to 16 should exercise all 2228 * of the possible padding lengths for each suite. 2229 */ 2230 AES_CBC_TESTS(GEN_TRANSMIT_PADDING_TESTS); 2231 2232 /* 2233 * Test "empty fragments" which are TLS records with no payload that 2234 * OpenSSL can send for TLS 1.0 connections. 2235 */ 2236 AES_CBC_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST); 2237 AES_GCM_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST); 2238 CHACHA20_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST); 2239 2240 static void 2241 test_ktls_invalid_transmit_cipher_suite(const atf_tc_t *tc, 2242 struct tls_enable *en) 2243 { 2244 int sockets[2]; 2245 2246 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 2247 2248 ATF_REQUIRE_ERRNO(EINVAL, setsockopt(sockets[1], IPPROTO_TCP, 2249 TCP_TXTLS_ENABLE, en, sizeof(*en)) == -1); 2250 2251 close_sockets(sockets); 2252 } 2253 2254 #define GEN_INVALID_TRANSMIT_TEST(name, cipher_alg, key_size, auth_alg, \ 2255 minor) \ 2256 ATF_TC_WITHOUT_HEAD(ktls_transmit_invalid_##name); \ 2257 ATF_TC_BODY(ktls_transmit_invalid_##name, tc) \ 2258 { \ 2259 struct tls_enable en; \ 2260 uint64_t seqno; \ 2261 \ 2262 ATF_REQUIRE_KTLS(); \ 2263 seqno = random(); \ 2264 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2265 seqno, &en); \ 2266 test_ktls_invalid_transmit_cipher_suite(tc, &en); \ 2267 free_tls_enable(&en); \ 2268 } 2269 2270 #define ADD_INVALID_TRANSMIT_TEST(name, cipher_alg, key_size, auth_alg, \ 2271 minor) \ 2272 ATF_TP_ADD_TC(tp, ktls_transmit_invalid_##name); 2273 2274 #define INVALID_CIPHER_SUITES(M) \ 2275 M(aes128_cbc_1_0_sha256, CRYPTO_AES_CBC, 128 / 8, \ 2276 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_ZERO) \ 2277 M(aes128_cbc_1_0_sha384, CRYPTO_AES_CBC, 128 / 8, \ 2278 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_ZERO) \ 2279 M(aes128_gcm_1_0, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \ 2280 TLS_MINOR_VER_ZERO) \ 2281 M(chacha20_poly1305_1_0, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \ 2282 TLS_MINOR_VER_ZERO) \ 2283 M(aes128_cbc_1_1_sha256, CRYPTO_AES_CBC, 128 / 8, \ 2284 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_ONE) \ 2285 M(aes128_cbc_1_1_sha384, CRYPTO_AES_CBC, 128 / 8, \ 2286 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_ONE) \ 2287 M(aes128_gcm_1_1, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \ 2288 TLS_MINOR_VER_ONE) \ 2289 M(chacha20_poly1305_1_1, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \ 2290 TLS_MINOR_VER_ONE) \ 2291 M(aes128_cbc_1_3_sha1, CRYPTO_AES_CBC, 128 / 8, \ 2292 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_THREE) \ 2293 M(aes128_cbc_1_3_sha256, CRYPTO_AES_CBC, 128 / 8, \ 2294 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_THREE) \ 2295 M(aes128_cbc_1_3_sha384, CRYPTO_AES_CBC, 128 / 8, \ 2296 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_THREE) 2297 2298 /* 2299 * Ensure that invalid cipher suites are rejected for transmit. 2300 */ 2301 INVALID_CIPHER_SUITES(GEN_INVALID_TRANSMIT_TEST); 2302 2303 #define GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2304 auth_alg, minor, name, len, padding) \ 2305 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_##name); \ 2306 ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ 2307 { \ 2308 struct tls_enable en; \ 2309 uint64_t seqno; \ 2310 \ 2311 ATF_REQUIRE_KTLS_RX(); \ 2312 seqno = random(); \ 2313 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2314 seqno, &en); \ 2315 test_ktls_receive_app_data(tc, &en, seqno, len, padding); \ 2316 free_tls_enable(&en); \ 2317 } 2318 2319 #define ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2320 auth_alg, minor, name) \ 2321 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name); 2322 2323 #define GEN_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2324 auth_alg, minor, len) \ 2325 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_data); \ 2326 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_data, tc) \ 2327 { \ 2328 struct tls_enable en; \ 2329 uint64_t seqno; \ 2330 \ 2331 ATF_REQUIRE_KTLS_RX(); \ 2332 seqno = random(); \ 2333 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2334 seqno, &en); \ 2335 test_ktls_receive_corrupted_data(tc, &en, seqno, len); \ 2336 free_tls_enable(&en); \ 2337 } 2338 2339 #define ADD_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2340 auth_alg, minor) \ 2341 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_data); 2342 2343 #define GEN_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size, \ 2344 auth_alg, minor, len) \ 2345 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_mac); \ 2346 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_mac, tc) \ 2347 { \ 2348 struct tls_enable en; \ 2349 uint64_t seqno; \ 2350 \ 2351 ATF_REQUIRE_KTLS_RX(); \ 2352 seqno = random(); \ 2353 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2354 seqno, &en); \ 2355 test_ktls_receive_corrupted_mac(tc, &en, seqno, len); \ 2356 free_tls_enable(&en); \ 2357 } 2358 2359 #define ADD_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size, \ 2360 auth_alg, minor) \ 2361 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_mac); 2362 2363 #define GEN_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size, \ 2364 auth_alg, minor, len) \ 2365 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_truncated_record); \ 2366 ATF_TC_BODY(ktls_receive_##cipher_name##_truncated_record, tc) \ 2367 { \ 2368 struct tls_enable en; \ 2369 uint64_t seqno; \ 2370 \ 2371 ATF_REQUIRE_KTLS_RX(); \ 2372 seqno = random(); \ 2373 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2374 seqno, &en); \ 2375 test_ktls_receive_truncated_record(tc, &en, seqno, len); \ 2376 free_tls_enable(&en); \ 2377 } 2378 2379 #define ADD_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size, \ 2380 auth_alg, minor) \ 2381 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_truncated_record); 2382 2383 #define GEN_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size, \ 2384 auth_alg, minor, len) \ 2385 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_major); \ 2386 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_major, tc) \ 2387 { \ 2388 struct tls_enable en; \ 2389 uint64_t seqno; \ 2390 \ 2391 ATF_REQUIRE_KTLS_RX(); \ 2392 seqno = random(); \ 2393 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2394 seqno, &en); \ 2395 test_ktls_receive_bad_major(tc, &en, seqno, len); \ 2396 free_tls_enable(&en); \ 2397 } 2398 2399 #define ADD_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size, \ 2400 auth_alg, minor) \ 2401 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_major); 2402 2403 #define GEN_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size, \ 2404 auth_alg, minor, len) \ 2405 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_minor); \ 2406 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_minor, tc) \ 2407 { \ 2408 struct tls_enable en; \ 2409 uint64_t seqno; \ 2410 \ 2411 ATF_REQUIRE_KTLS_RX(); \ 2412 seqno = random(); \ 2413 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2414 seqno, &en); \ 2415 test_ktls_receive_bad_minor(tc, &en, seqno, len); \ 2416 free_tls_enable(&en); \ 2417 } 2418 2419 #define ADD_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size, \ 2420 auth_alg, minor) \ 2421 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_minor); 2422 2423 #define GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2424 auth_alg, minor, name, len) \ 2425 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_##name); \ 2426 ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \ 2427 { \ 2428 struct tls_enable en; \ 2429 uint64_t seqno; \ 2430 \ 2431 ATF_REQUIRE_KTLS_RX(); \ 2432 seqno = random(); \ 2433 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2434 seqno, &en); \ 2435 test_ktls_receive_bad_size(tc, &en, seqno, (len)); \ 2436 free_tls_enable(&en); \ 2437 } 2438 2439 #define ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2440 auth_alg, minor, name) \ 2441 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name); 2442 2443 #define GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ 2444 key_size, auth_alg, minor, name, len, first_len) \ 2445 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_split_##name); \ 2446 ATF_TC_BODY(ktls_receive_##cipher_name##_split_##name, tc) \ 2447 { \ 2448 struct tls_enable en; \ 2449 uint64_t seqno; \ 2450 \ 2451 ATF_REQUIRE_KTLS_RX(); \ 2452 seqno = random(); \ 2453 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2454 seqno, &en); \ 2455 test_ktls_receive_split_record(tc, &en, seqno, len, first_len); \ 2456 free_tls_enable(&en); \ 2457 } 2458 2459 #define ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ 2460 key_size, auth_alg, minor, name) \ 2461 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_split_##name); 2462 2463 #define GEN_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ 2464 minor) \ 2465 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2466 auth_alg, minor, short, 64, 0) \ 2467 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2468 auth_alg, minor, long, 64 * 1024, 0) \ 2469 GEN_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2470 auth_alg, minor, 64) \ 2471 GEN_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size, \ 2472 auth_alg, minor, 64) \ 2473 GEN_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size, \ 2474 auth_alg, minor, 64) \ 2475 GEN_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size, \ 2476 auth_alg, minor, 64) \ 2477 GEN_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size, \ 2478 auth_alg, minor, 64) \ 2479 GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2480 auth_alg, minor, small_record, \ 2481 tls_minimum_record_payload(&en) - 1) \ 2482 GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2483 auth_alg, minor, oversized_record, \ 2484 TLS_MAX_MSG_SIZE_V10_2 * 2) \ 2485 GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ 2486 key_size, auth_alg, minor, header, 64, \ 2487 sizeof(struct tls_record_layer)); \ 2488 GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ 2489 key_size, auth_alg, minor, full_header, 64, \ 2490 tls_header_len(&en)); \ 2491 GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ 2492 key_size, auth_alg, minor, half, 64, \ 2493 tls_header_len(&en) + 32); \ 2494 GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ 2495 key_size, auth_alg, minor, trailer_start, 64, \ 2496 tls_header_len(&en) + 64); \ 2497 GEN_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ 2498 key_size, auth_alg, minor, trailer_middle, 64, \ 2499 tls_header_len(&en) + 64 + tls_trailer_len(&en) / 2); 2500 2501 #define ADD_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \ 2502 minor) \ 2503 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2504 auth_alg, minor, short) \ 2505 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2506 auth_alg, minor, long) \ 2507 ADD_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2508 auth_alg, minor) \ 2509 ADD_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size, \ 2510 auth_alg, minor) \ 2511 ADD_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size, \ 2512 auth_alg, minor) \ 2513 ADD_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size, \ 2514 auth_alg, minor) \ 2515 ADD_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size, \ 2516 auth_alg, minor) \ 2517 ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2518 auth_alg, minor, small_record) \ 2519 ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2520 auth_alg, minor, oversized_record) \ 2521 ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ 2522 key_size, auth_alg, minor, header) \ 2523 ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ 2524 key_size, auth_alg, minor, full_header) \ 2525 ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ 2526 key_size, auth_alg, minor, half) \ 2527 ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ 2528 key_size, auth_alg, minor, trailer_start) \ 2529 ADD_RECEIVE_SPLIT_RECORD_TEST(cipher_name, cipher_alg, \ 2530 key_size, auth_alg, minor, trailer_middle) \ 2531 2532 /* 2533 * For each supported cipher suite, run several receive tests: 2534 * 2535 * - a short test which sends 64 bytes of application data (likely as 2536 * a single TLS record) 2537 * 2538 * - a long test which sends 64KB of application data (split across 2539 * multiple TLS records) 2540 * 2541 * - a test with corrupted payload data in a single TLS record 2542 * 2543 * - a test with a corrupted MAC in a single TLS record 2544 * 2545 * - a test with a truncated TLS record 2546 * 2547 * - tests with invalid TLS major and minor versions 2548 * 2549 * - a tests with a record whose is one less than the smallest valid 2550 * size 2551 * 2552 * - a test with an oversized TLS record 2553 * 2554 * - tests of a single record whose data is split across two writes, 2555 * with each test using a different split point 2556 */ 2557 AES_CBC_NONZERO_TESTS(GEN_RECEIVE_TESTS); 2558 AES_GCM_TESTS(GEN_RECEIVE_TESTS); 2559 CHACHA20_TESTS(GEN_RECEIVE_TESTS); 2560 2561 #define GEN_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg, \ 2562 key_size, auth_alg, minor) \ 2563 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2564 auth_alg, minor, padding_1, 1, 0) \ 2565 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2566 auth_alg, minor, padding_2, 2, 0) \ 2567 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2568 auth_alg, minor, padding_3, 3, 0) \ 2569 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2570 auth_alg, minor, padding_4, 4, 0) \ 2571 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2572 auth_alg, minor, padding_5, 5, 0) \ 2573 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2574 auth_alg, minor, padding_6, 6, 0) \ 2575 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2576 auth_alg, minor, padding_7, 7, 0) \ 2577 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2578 auth_alg, minor, padding_8, 8, 0) \ 2579 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2580 auth_alg, minor, padding_9, 9, 0) \ 2581 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2582 auth_alg, minor, padding_10, 10, 0) \ 2583 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2584 auth_alg, minor, padding_11, 11, 0) \ 2585 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2586 auth_alg, minor, padding_12, 12, 0) \ 2587 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2588 auth_alg, minor, padding_13, 13, 0) \ 2589 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2590 auth_alg, minor, padding_14, 14, 0) \ 2591 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2592 auth_alg, minor, padding_15, 15, 0) \ 2593 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2594 auth_alg, minor, padding_16, 16, 0) \ 2595 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2596 auth_alg, minor, padding_16_extra, 16, 16) \ 2597 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2598 auth_alg, minor, padding_32_extra, 16, 32) 2599 2600 #define ADD_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg, \ 2601 key_size, auth_alg, minor) \ 2602 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2603 auth_alg, minor, padding_1) \ 2604 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2605 auth_alg, minor, padding_2) \ 2606 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2607 auth_alg, minor, padding_3) \ 2608 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2609 auth_alg, minor, padding_4) \ 2610 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2611 auth_alg, minor, padding_5) \ 2612 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2613 auth_alg, minor, padding_6) \ 2614 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2615 auth_alg, minor, padding_7) \ 2616 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2617 auth_alg, minor, padding_8) \ 2618 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2619 auth_alg, minor, padding_9) \ 2620 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2621 auth_alg, minor, padding_10) \ 2622 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2623 auth_alg, minor, padding_11) \ 2624 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2625 auth_alg, minor, padding_12) \ 2626 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2627 auth_alg, minor, padding_13) \ 2628 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2629 auth_alg, minor, padding_14) \ 2630 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2631 auth_alg, minor, padding_15) \ 2632 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2633 auth_alg, minor, padding_16) \ 2634 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2635 auth_alg, minor, padding_16_extra) \ 2636 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2637 auth_alg, minor, padding_32_extra) 2638 2639 #define GEN_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size, \ 2640 auth_alg, minor, len) \ 2641 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_padding); \ 2642 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_padding, tc) \ 2643 { \ 2644 struct tls_enable en; \ 2645 uint64_t seqno; \ 2646 \ 2647 ATF_REQUIRE_KTLS_RX(); \ 2648 seqno = random(); \ 2649 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2650 seqno, &en); \ 2651 test_ktls_receive_corrupted_padding(tc, &en, seqno, len); \ 2652 free_tls_enable(&en); \ 2653 } 2654 2655 #define ADD_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size, \ 2656 auth_alg, minor) \ 2657 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_padding); 2658 2659 #define GEN_RECEIVE_MTE_TESTS(cipher_name, cipher_alg, key_size, \ 2660 auth_alg, minor) \ 2661 GEN_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg, \ 2662 key_size, auth_alg, minor) \ 2663 GEN_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size, \ 2664 auth_alg, minor, 64) \ 2665 GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2666 auth_alg, minor, non_block_size, \ 2667 tls_minimum_record_payload(&en) + 1) 2668 2669 #define ADD_RECEIVE_MTE_TESTS(cipher_name, cipher_alg, key_size, \ 2670 auth_alg, minor) \ 2671 ADD_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg, \ 2672 key_size, auth_alg, minor) \ 2673 ADD_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size, \ 2674 auth_alg, minor) \ 2675 ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2676 auth_alg, minor, non_block_size) 2677 2678 /* 2679 * For AES-CBC MTE cipher suites using padding, add tests of messages 2680 * with each possible padding size. Note that the padding_<N> tests 2681 * do not necessarily test <N> bytes of padding as the padding is a 2682 * function of the cipher suite's MAC length. However, cycling 2683 * through all of the payload sizes from 1 to 16 should exercise all 2684 * of the possible padding lengths for each suite. 2685 * 2686 * Two additional tests check for additional padding with an extra 2687 * 16 or 32 bytes beyond the normal padding. 2688 * 2689 * Another test checks for corrupted padding. 2690 * 2691 * Another test checks for a record whose payload is not a multiple of 2692 * the AES block size. 2693 */ 2694 AES_CBC_NONZERO_TESTS(GEN_RECEIVE_MTE_TESTS); 2695 2696 #define GEN_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size, \ 2697 auth_alg, minor) \ 2698 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_iv); \ 2699 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_iv, tc) \ 2700 { \ 2701 struct tls_enable en; \ 2702 uint64_t seqno; \ 2703 \ 2704 ATF_REQUIRE_KTLS_RX(); \ 2705 seqno = random(); \ 2706 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2707 seqno, &en); \ 2708 test_ktls_receive_corrupted_iv(tc, &en, seqno, 64); \ 2709 free_tls_enable(&en); \ 2710 } 2711 2712 #define ADD_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size, \ 2713 auth_alg, minor) \ 2714 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_iv); 2715 2716 #define GEN_RECEIVE_EXPLICIT_IV_TESTS(cipher_name, cipher_alg, \ 2717 key_size, auth_alg, minor) \ 2718 GEN_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size, \ 2719 auth_alg, minor) \ 2720 GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2721 auth_alg, minor, short_header, \ 2722 sizeof(struct tls_record_layer) + 1) 2723 2724 #define ADD_RECEIVE_EXPLICIT_IV_TESTS(cipher_name, cipher_alg, \ 2725 key_size, auth_alg, minor) \ 2726 ADD_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size, \ 2727 auth_alg, minor) \ 2728 ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \ 2729 auth_alg, minor, short_header) 2730 2731 /* 2732 * For cipher suites with an explicit IV, run a receive test where the 2733 * explicit IV has been corrupted. Also run a receive test that sends 2734 * a short record without a complete IV. 2735 */ 2736 AES_CBC_NONZERO_TESTS(GEN_RECEIVE_EXPLICIT_IV_TESTS); 2737 AES_GCM_12_TESTS(GEN_RECEIVE_EXPLICIT_IV_TESTS); 2738 2739 #define GEN_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size, \ 2740 auth_alg, minor, len) \ 2741 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_type); \ 2742 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_type, tc) \ 2743 { \ 2744 struct tls_enable en; \ 2745 uint64_t seqno; \ 2746 \ 2747 ATF_REQUIRE_KTLS_RX(); \ 2748 seqno = random(); \ 2749 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2750 seqno, &en); \ 2751 test_ktls_receive_bad_type(tc, &en, seqno, len); \ 2752 free_tls_enable(&en); \ 2753 } 2754 2755 #define ADD_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size, \ 2756 auth_alg, minor) \ 2757 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_type); 2758 2759 #define GEN_RECEIVE_TLS13_TESTS(cipher_name, cipher_alg, key_size, \ 2760 auth_alg, minor) \ 2761 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2762 auth_alg, minor, short_padded, 64, 16) \ 2763 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2764 auth_alg, minor, long_padded, 64 * 1024, 15) \ 2765 GEN_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size, \ 2766 auth_alg, minor, 64) 2767 2768 #define ADD_RECEIVE_TLS13_TESTS(cipher_name, cipher_alg, key_size, \ 2769 auth_alg, minor) \ 2770 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2771 auth_alg, minor, short_padded) \ 2772 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \ 2773 auth_alg, minor, long_padded) \ 2774 ADD_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size, \ 2775 auth_alg, minor) 2776 2777 /* 2778 * For TLS 1.3 cipher suites, run two additional receive tests which 2779 * use add padding to each record. Also run a test that uses an 2780 * invalid "outer" record type. 2781 */ 2782 TLS_13_TESTS(GEN_RECEIVE_TLS13_TESTS); 2783 2784 static void 2785 test_ktls_invalid_receive_cipher_suite(const atf_tc_t *tc, 2786 struct tls_enable *en) 2787 { 2788 int sockets[2]; 2789 2790 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 2791 2792 ATF_REQUIRE_ERRNO(EINVAL, setsockopt(sockets[1], IPPROTO_TCP, 2793 TCP_RXTLS_ENABLE, en, sizeof(*en)) == -1); 2794 2795 close_sockets(sockets); 2796 } 2797 2798 #define GEN_INVALID_RECEIVE_TEST(name, cipher_alg, key_size, auth_alg, \ 2799 minor) \ 2800 ATF_TC_WITHOUT_HEAD(ktls_receive_invalid_##name); \ 2801 ATF_TC_BODY(ktls_receive_invalid_##name, tc) \ 2802 { \ 2803 struct tls_enable en; \ 2804 uint64_t seqno; \ 2805 \ 2806 ATF_REQUIRE_KTLS_RX(); \ 2807 seqno = random(); \ 2808 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2809 seqno, &en); \ 2810 test_ktls_invalid_receive_cipher_suite(tc, &en); \ 2811 free_tls_enable(&en); \ 2812 } 2813 2814 #define ADD_INVALID_RECEIVE_TEST(name, cipher_alg, key_size, auth_alg, \ 2815 minor) \ 2816 ATF_TP_ADD_TC(tp, ktls_receive_invalid_##name); 2817 2818 /* 2819 * Ensure that invalid cipher suites are rejected for receive. 2820 */ 2821 INVALID_CIPHER_SUITES(GEN_INVALID_RECEIVE_TEST); 2822 2823 static void 2824 test_ktls_unsupported_receive_cipher_suite(const atf_tc_t *tc, 2825 struct tls_enable *en) 2826 { 2827 int sockets[2]; 2828 2829 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); 2830 2831 ATF_REQUIRE_ERRNO(EPROTONOSUPPORT, setsockopt(sockets[1], IPPROTO_TCP, 2832 TCP_RXTLS_ENABLE, en, sizeof(*en)) == -1); 2833 2834 close_sockets(sockets); 2835 } 2836 2837 #define GEN_UNSUPPORTED_RECEIVE_TEST(name, cipher_alg, key_size, \ 2838 auth_alg, minor) \ 2839 ATF_TC_WITHOUT_HEAD(ktls_receive_unsupported_##name); \ 2840 ATF_TC_BODY(ktls_receive_unsupported_##name, tc) \ 2841 { \ 2842 struct tls_enable en; \ 2843 uint64_t seqno; \ 2844 \ 2845 ATF_REQUIRE_KTLS_RX(); \ 2846 seqno = random(); \ 2847 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \ 2848 seqno, &en); \ 2849 test_ktls_unsupported_receive_cipher_suite(tc, &en); \ 2850 free_tls_enable(&en); \ 2851 } 2852 2853 #define ADD_UNSUPPORTED_RECEIVE_TEST(name, cipher_alg, key_size, \ 2854 auth_alg, minor) \ 2855 ATF_TP_ADD_TC(tp, ktls_receive_unsupported_##name); 2856 2857 /* 2858 * Ensure that valid cipher suites not supported for receive are 2859 * rejected. 2860 */ 2861 TLS_10_TESTS(GEN_UNSUPPORTED_RECEIVE_TEST); 2862 2863 /* 2864 * Try to perform an invalid sendto(2) on a TXTLS-enabled socket, to exercise 2865 * KTLS error handling in the socket layer. 2866 */ 2867 ATF_TC_WITHOUT_HEAD(ktls_sendto_baddst); 2868 ATF_TC_BODY(ktls_sendto_baddst, tc) 2869 { 2870 char buf[32]; 2871 struct sockaddr_in dst; 2872 struct tls_enable en; 2873 ssize_t n; 2874 int s; 2875 2876 ATF_REQUIRE_KTLS(); 2877 2878 s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); 2879 ATF_REQUIRE(s >= 0); 2880 2881 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, 2882 TLS_MINOR_VER_THREE, (uint64_t)random(), &en); 2883 2884 ATF_REQUIRE(setsockopt(s, IPPROTO_TCP, TCP_TXTLS_ENABLE, &en, 2885 sizeof(en)) == 0); 2886 2887 memset(&dst, 0, sizeof(dst)); 2888 dst.sin_family = AF_INET; 2889 dst.sin_len = sizeof(dst); 2890 dst.sin_addr.s_addr = htonl(INADDR_BROADCAST); 2891 dst.sin_port = htons(12345); 2892 2893 memset(buf, 0, sizeof(buf)); 2894 n = sendto(s, buf, sizeof(buf), 0, (struct sockaddr *)&dst, 2895 sizeof(dst)); 2896 2897 /* Can't transmit to the broadcast address over TCP. */ 2898 ATF_REQUIRE_ERRNO(EACCES, n == -1); 2899 ATF_REQUIRE(close(s) == 0); 2900 } 2901 2902 /* 2903 * Make sure that listen(2) returns an error for KTLS-enabled sockets, and 2904 * verify that an attempt to enable KTLS on a listening socket fails. 2905 */ 2906 static void 2907 ktls_listening_socket(const atf_tc_t *tc, int optname) 2908 { 2909 struct tls_enable en; 2910 struct sockaddr_in sin; 2911 int s; 2912 2913 s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); 2914 ATF_REQUIRE(s >= 0); 2915 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, 2916 TLS_MINOR_VER_THREE, (uint64_t)random(), &en); 2917 ATF_REQUIRE(setsockopt(s, IPPROTO_TCP, optname, &en, 2918 sizeof(en)) == 0); 2919 ATF_REQUIRE_ERRNO(EINVAL, listen(s, 1) == -1); 2920 ATF_REQUIRE(close(s) == 0); 2921 2922 s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); 2923 ATF_REQUIRE(s >= 0); 2924 memset(&sin, 0, sizeof(sin)); 2925 sin.sin_family = AF_INET; 2926 sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK); 2927 ATF_REQUIRE(bind(s, (struct sockaddr *)&sin, sizeof(sin)) == 0); 2928 ATF_REQUIRE(listen(s, 1) == 0); 2929 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, 2930 TLS_MINOR_VER_THREE, (uint64_t)random(), &en); 2931 ATF_REQUIRE_ERRNO(ENOTCONN, 2932 setsockopt(s, IPPROTO_TCP, optname, &en, sizeof(en)) != 0); 2933 ATF_REQUIRE(close(s) == 0); 2934 } 2935 2936 ATF_TC_WITHOUT_HEAD(ktls_listening_socket_tx); 2937 ATF_TC_BODY(ktls_listening_socket_tx, tc) 2938 { 2939 ATF_REQUIRE_KTLS(); 2940 2941 ktls_listening_socket(tc, TCP_TXTLS_ENABLE); 2942 } 2943 2944 ATF_TC_WITHOUT_HEAD(ktls_listening_socket_rx); 2945 ATF_TC_BODY(ktls_listening_socket_rx, tc) 2946 { 2947 ATF_REQUIRE_KTLS_RX(); 2948 2949 ktls_listening_socket(tc, TCP_RXTLS_ENABLE); 2950 } 2951 2952 /* 2953 * Verify that the KTLS receive path does not overwrite data belonging 2954 * to a file whose payload is transmitted over a loopback connection 2955 * via plain sendfile. 2956 */ 2957 ATF_TC_WITHOUT_HEAD(ktls_receive_loopback_sendfile); 2958 ATF_TC_BODY(ktls_receive_loopback_sendfile, tc) 2959 { 2960 struct tls_enable en; 2961 struct msghdr msg; 2962 struct sf_hdtr hdtr; 2963 struct iovec iov[2]; 2964 uint64_t seqno; 2965 off_t sbytes; 2966 char cbuf[CMSG_SPACE(sizeof(struct tls_get_record))]; 2967 char *plaintext, *ciphertext, *outbuf; 2968 void *p; 2969 const size_t payload_len = PAGE_SIZE; 2970 ssize_t rv; 2971 size_t len; 2972 int mode, shm, sockets[2]; 2973 socklen_t slen; 2974 2975 ATF_REQUIRE_KTLS_RX(); 2976 seqno = random(); 2977 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, 2978 TLS_MINOR_VER_TWO, seqno, &en); 2979 2980 len = tls_header_len(&en) + payload_len + tls_trailer_len(&en); 2981 plaintext = alloc_buffer(payload_len); 2982 ciphertext = malloc(len); 2983 ATF_REQUIRE_INTEQ(len, encrypt_tls_record(tc, &en, TLS_RLTYPE_APP, 2984 seqno, plaintext, payload_len, ciphertext, len, 0)); 2985 2986 ATF_REQUIRE((shm = shm_open(SHM_ANON, O_RDWR, 0600)) > 0); 2987 ATF_REQUIRE_INTEQ(0, ftruncate(shm, payload_len)); 2988 ATF_REQUIRE((p = mmap(NULL, payload_len, PROT_READ | PROT_WRITE, 2989 MAP_SHARED, shm, 0)) != MAP_FAILED); 2990 memcpy(p, ciphertext + tls_header_len(&en), payload_len); 2991 2992 ATF_REQUIRE_MSG(socketpair_tcp(sockets), "failed to create sockets"); 2993 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, &en, 2994 sizeof(en)) == 0); 2995 slen = sizeof(mode); 2996 ATF_REQUIRE_INTEQ(0, getsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_MODE, 2997 &mode, &slen)); 2998 ATF_REQUIRE_INTEQ(TCP_TLS_MODE_SW, mode); 2999 3000 fd_set_blocking(sockets[0]); 3001 fd_set_blocking(sockets[1]); 3002 3003 iov[0].iov_base = ciphertext; 3004 iov[0].iov_len = tls_header_len(&en); 3005 iov[1].iov_base = ciphertext + tls_header_len(&en) + payload_len; 3006 iov[1].iov_len = tls_trailer_len(&en); 3007 hdtr.headers = iov; 3008 hdtr.hdr_cnt = 1; 3009 hdtr.trailers = iov + 1; 3010 hdtr.trl_cnt = 1; 3011 debug_hexdump(tc, p, payload_len, "shm buffer before"); 3012 ATF_REQUIRE_INTEQ(0, sendfile(shm, sockets[1], 0, payload_len, &hdtr, 3013 &sbytes, 0)); 3014 ATF_REQUIRE_INTEQ(sbytes, (off_t)len); 3015 3016 outbuf = calloc(payload_len, 1); 3017 3018 memset(&msg, 0, sizeof(msg)); 3019 3020 msg.msg_control = cbuf; 3021 msg.msg_controllen = sizeof(cbuf); 3022 3023 iov[0].iov_base = outbuf; 3024 iov[0].iov_len = payload_len; 3025 msg.msg_iov = iov; 3026 msg.msg_iovlen = 1; 3027 3028 rv = recvmsg(sockets[0], &msg, 0); 3029 if (rv >= 0) { 3030 ATF_REQUIRE_INTEQ(payload_len, rv); 3031 ATF_REQUIRE_INTEQ(0, memcmp(outbuf, plaintext, payload_len)); 3032 } else 3033 ATF_REQUIRE_ERRNO(EBADMSG, true); 3034 3035 debug_hexdump(tc, p, payload_len, "shm buffer after"); 3036 ATF_REQUIRE_INTEQ(0, memcmp(p, ciphertext + tls_header_len(&en), 3037 payload_len)); 3038 3039 close_sockets_ignore_errors(sockets); 3040 (void)close(shm); 3041 } 3042 3043 ATF_TP_ADD_TCS(tp) 3044 { 3045 /* Transmit tests */ 3046 AES_CBC_TESTS(ADD_TRANSMIT_TESTS); 3047 AES_GCM_TESTS(ADD_TRANSMIT_TESTS); 3048 CHACHA20_TESTS(ADD_TRANSMIT_TESTS); 3049 AES_CBC_TESTS(ADD_TRANSMIT_PADDING_TESTS); 3050 AES_CBC_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST); 3051 AES_GCM_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST); 3052 CHACHA20_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST); 3053 INVALID_CIPHER_SUITES(ADD_INVALID_TRANSMIT_TEST); 3054 3055 /* Receive tests */ 3056 TLS_10_TESTS(ADD_UNSUPPORTED_RECEIVE_TEST); 3057 AES_CBC_NONZERO_TESTS(ADD_RECEIVE_TESTS); 3058 AES_GCM_TESTS(ADD_RECEIVE_TESTS); 3059 CHACHA20_TESTS(ADD_RECEIVE_TESTS); 3060 AES_CBC_NONZERO_TESTS(ADD_RECEIVE_MTE_TESTS); 3061 AES_CBC_NONZERO_TESTS(ADD_RECEIVE_EXPLICIT_IV_TESTS); 3062 AES_GCM_12_TESTS(ADD_RECEIVE_EXPLICIT_IV_TESTS); 3063 TLS_13_TESTS(ADD_RECEIVE_TLS13_TESTS); 3064 INVALID_CIPHER_SUITES(ADD_INVALID_RECEIVE_TEST); 3065 3066 /* Miscellaneous */ 3067 ATF_TP_ADD_TC(tp, ktls_sendto_baddst); 3068 ATF_TP_ADD_TC(tp, ktls_listening_socket_tx); 3069 ATF_TP_ADD_TC(tp, ktls_listening_socket_rx); 3070 ATF_TP_ADD_TC(tp, ktls_receive_loopback_sendfile); 3071 3072 return (atf_no_error()); 3073 } 3074