2 * SPDX-License-Identifier: BSD-2-Clause
4 * Copyright (c) 2021 Netflix Inc.
5 * Written by: John Baldwin <jhb@FreeBSD.org>
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 #include <sys/param.h>
30 #include <sys/endian.h>
31 #include <sys/event.h>
33 #include <sys/socket.h>
34 #include <sys/sysctl.h>
35 #include <netinet/in.h>
36 #include <netinet/tcp.h>
37 #include <crypto/cryptodev.h>
48 #include <openssl/err.h>
49 #include <openssl/evp.h>
50 #include <openssl/hmac.h>
59 if (sysctlbyname("kern.ipc.tls.enable", &enable, &len, NULL, 0) == -1) {
61 atf_tc_skip("kernel does not support TLS offload");
62 atf_libc_error(errno, "Failed to read kern.ipc.tls.enable");
66 atf_tc_skip("Kernel TLS is disabled");
69 #define ATF_REQUIRE_KTLS() require_ktls()
72 check_tls_mode(const atf_tc_t *tc, int s, int sockopt)
74 if (atf_tc_get_config_var_as_bool_wd(tc, "ktls.require_ifnet", false)) {
79 if (getsockopt(s, IPPROTO_TCP, sockopt, &mode, &len) == -1)
80 atf_libc_error(errno, "Failed to fetch TLS mode");
82 if (mode != TCP_TLS_MODE_IFNET)
83 atf_tc_skip("connection did not use ifnet TLS");
86 if (atf_tc_get_config_var_as_bool_wd(tc, "ktls.require_toe", false)) {
91 if (getsockopt(s, IPPROTO_TCP, sockopt, &mode, &len) == -1)
92 atf_libc_error(errno, "Failed to fetch TLS mode");
94 if (mode != TCP_TLS_MODE_TOE)
95 atf_tc_skip("connection did not use TOE TLS");
99 static void __printflike(2, 3)
100 debug(const atf_tc_t *tc, const char *fmt, ...)
102 if (!atf_tc_get_config_var_as_bool_wd(tc, "ktls.debug", false))
112 debug_hexdump(const atf_tc_t *tc, const void *buf, int length,
115 if (!atf_tc_get_config_var_as_bool_wd(tc, "ktls.debug", false))
119 printf("%s:\n", label);
120 hexdump(buf, length, NULL, 0);
126 /* ASCII printable values between 0x20 and 0x7e */
127 return (0x20 + random() % (0x7f - 0x20));
131 alloc_buffer(size_t len)
139 for (i = 0; i < len; i++)
145 socketpair_tcp(int sv[2])
148 struct sockaddr_in sin;
152 ls = socket(PF_INET, SOCK_STREAM, 0);
154 warn("socket() for listen");
158 memset(&sin, 0, sizeof(sin));
159 sin.sin_len = sizeof(sin);
160 sin.sin_family = AF_INET;
161 sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
162 if (bind(ls, (struct sockaddr *)&sin, sizeof(sin)) == -1) {
168 if (listen(ls, 1) == -1) {
175 if (getsockname(ls, (struct sockaddr *)&sin, &len) == -1) {
181 cs = socket(PF_INET, SOCK_STREAM | SOCK_NONBLOCK, 0);
183 warn("socket() for connect");
188 if (connect(cs, (struct sockaddr *)&sin, sizeof(sin)) == -1) {
189 if (errno != EINPROGRESS) {
197 as = accept4(ls, NULL, NULL, SOCK_NONBLOCK);
208 pfd.events = POLLOUT;
210 ATF_REQUIRE_INTEQ(1, poll(&pfd, 1, INFTIM));
211 ATF_REQUIRE_INTEQ(POLLOUT, pfd.revents);
219 echo_socket(const atf_tc_t *tc, int sv[2])
221 const char *cause, *host, *port;
222 struct addrinfo hints, *ai, *tofree;
225 host = atf_tc_get_config_var(tc, "ktls.host");
226 port = atf_tc_get_config_var_wd(tc, "ktls.port", "echo");
227 memset(&hints, 0, sizeof(hints));
228 hints.ai_family = AF_UNSPEC;
229 hints.ai_socktype = SOCK_STREAM;
230 hints.ai_protocol = IPPROTO_TCP;
231 error = getaddrinfo(host, port, &hints, &tofree);
233 warnx("getaddrinfo(%s:%s) failed: %s", host, port,
234 gai_strerror(error));
239 for (ai = tofree; ai != NULL; ai = ai->ai_next) {
240 s = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
247 if (connect(s, ai->ai_addr, ai->ai_addrlen) == -1) {
254 freeaddrinfo(tofree);
256 ATF_REQUIRE((flags = fcntl(s, F_GETFL)) != -1);
258 ATF_REQUIRE(fcntl(s, F_SETFL, flags) != -1);
265 warnc(error, "%s", cause);
266 freeaddrinfo(tofree);
271 open_sockets(const atf_tc_t *tc, int sv[2])
273 if (atf_tc_has_config_var(tc, "ktls.host"))
274 return (echo_socket(tc, sv));
276 return (socketpair_tcp(sv));
280 close_sockets(int sv[2])
283 ATF_REQUIRE(close(sv[1]) == 0);
284 ATF_REQUIRE(close(sv[0]) == 0);
288 close_sockets_ignore_errors(int sv[2])
296 fd_set_blocking(int fd)
300 ATF_REQUIRE((flags = fcntl(fd, F_GETFL)) != -1);
301 flags &= ~O_NONBLOCK;
302 ATF_REQUIRE(fcntl(fd, F_SETFL, flags) != -1);
306 cbc_crypt(const EVP_CIPHER *cipher, const char *key, const char *iv,
307 const char *input, char *output, size_t size, int enc)
312 ctx = EVP_CIPHER_CTX_new();
314 warnx("EVP_CIPHER_CTX_new failed: %s",
315 ERR_error_string(ERR_get_error(), NULL));
318 if (EVP_CipherInit_ex(ctx, cipher, NULL, (const u_char *)key,
319 (const u_char *)iv, enc) != 1) {
320 warnx("EVP_CipherInit_ex failed: %s",
321 ERR_error_string(ERR_get_error(), NULL));
322 EVP_CIPHER_CTX_free(ctx);
325 EVP_CIPHER_CTX_set_padding(ctx, 0);
326 if (EVP_CipherUpdate(ctx, (u_char *)output, &outl,
327 (const u_char *)input, size) != 1) {
328 warnx("EVP_CipherUpdate failed: %s",
329 ERR_error_string(ERR_get_error(), NULL));
330 EVP_CIPHER_CTX_free(ctx);
334 if (EVP_CipherFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) {
335 warnx("EVP_CipherFinal_ex failed: %s",
336 ERR_error_string(ERR_get_error(), NULL));
337 EVP_CIPHER_CTX_free(ctx);
341 if ((size_t)total != size) {
342 warnx("decrypt size mismatch: %zu vs %d", size, total);
343 EVP_CIPHER_CTX_free(ctx);
346 EVP_CIPHER_CTX_free(ctx);
351 cbc_encrypt(const EVP_CIPHER *cipher, const char *key, const char *iv,
352 const char *input, char *output, size_t size)
354 return (cbc_crypt(cipher, key, iv, input, output, size, 1));
358 cbc_decrypt(const EVP_CIPHER *cipher, const char *key, const char *iv,
359 const char *input, char *output, size_t size)
361 return (cbc_crypt(cipher, key, iv, input, output, size, 0));
365 compute_hash(const EVP_MD *md, const void *key, size_t key_len, const void *aad,
366 size_t aad_len, const void *buffer, size_t len, void *digest,
371 ctx = HMAC_CTX_new();
373 warnx("HMAC_CTX_new failed: %s",
374 ERR_error_string(ERR_get_error(), NULL));
377 if (HMAC_Init_ex(ctx, key, key_len, md, NULL) != 1) {
378 warnx("HMAC_Init_ex failed: %s",
379 ERR_error_string(ERR_get_error(), NULL));
383 if (HMAC_Update(ctx, aad, aad_len) != 1) {
384 warnx("HMAC_Update (aad) failed: %s",
385 ERR_error_string(ERR_get_error(), NULL));
389 if (HMAC_Update(ctx, buffer, len) != 1) {
390 warnx("HMAC_Update (payload) failed: %s",
391 ERR_error_string(ERR_get_error(), NULL));
395 if (HMAC_Final(ctx, digest, digest_len) != 1) {
396 warnx("HMAC_Final failed: %s",
397 ERR_error_string(ERR_get_error(), NULL));
406 verify_hash(const EVP_MD *md, const void *key, size_t key_len, const void *aad,
407 size_t aad_len, const void *buffer, size_t len, const void *digest)
409 unsigned char digest2[EVP_MAX_MD_SIZE];
412 if (!compute_hash(md, key, key_len, aad, aad_len, buffer, len, digest2,
415 if (memcmp(digest, digest2, digest_len) != 0) {
416 warnx("HMAC mismatch");
423 aead_encrypt(const EVP_CIPHER *cipher, const char *key, const char *nonce,
424 const void *aad, size_t aad_len, const char *input, char *output,
425 size_t size, char *tag, size_t tag_len)
430 ctx = EVP_CIPHER_CTX_new();
432 warnx("EVP_CIPHER_CTX_new failed: %s",
433 ERR_error_string(ERR_get_error(), NULL));
436 if (EVP_EncryptInit_ex(ctx, cipher, NULL, (const u_char *)key,
437 (const u_char *)nonce) != 1) {
438 warnx("EVP_EncryptInit_ex failed: %s",
439 ERR_error_string(ERR_get_error(), NULL));
440 EVP_CIPHER_CTX_free(ctx);
443 EVP_CIPHER_CTX_set_padding(ctx, 0);
445 if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)aad,
447 warnx("EVP_EncryptUpdate for AAD failed: %s",
448 ERR_error_string(ERR_get_error(), NULL));
449 EVP_CIPHER_CTX_free(ctx);
453 if (EVP_EncryptUpdate(ctx, (u_char *)output, &outl,
454 (const u_char *)input, size) != 1) {
455 warnx("EVP_EncryptUpdate failed: %s",
456 ERR_error_string(ERR_get_error(), NULL));
457 EVP_CIPHER_CTX_free(ctx);
461 if (EVP_EncryptFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) {
462 warnx("EVP_EncryptFinal_ex failed: %s",
463 ERR_error_string(ERR_get_error(), NULL));
464 EVP_CIPHER_CTX_free(ctx);
468 if ((size_t)total != size) {
469 warnx("encrypt size mismatch: %zu vs %d", size, total);
470 EVP_CIPHER_CTX_free(ctx);
473 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, tag_len, tag) !=
475 warnx("EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_GET_TAG) failed: %s",
476 ERR_error_string(ERR_get_error(), NULL));
477 EVP_CIPHER_CTX_free(ctx);
480 EVP_CIPHER_CTX_free(ctx);
485 aead_decrypt(const EVP_CIPHER *cipher, const char *key, const char *nonce,
486 const void *aad, size_t aad_len, const char *input, char *output,
487 size_t size, const char *tag, size_t tag_len)
493 ctx = EVP_CIPHER_CTX_new();
495 warnx("EVP_CIPHER_CTX_new failed: %s",
496 ERR_error_string(ERR_get_error(), NULL));
499 if (EVP_DecryptInit_ex(ctx, cipher, NULL, (const u_char *)key,
500 (const u_char *)nonce) != 1) {
501 warnx("EVP_DecryptInit_ex failed: %s",
502 ERR_error_string(ERR_get_error(), NULL));
503 EVP_CIPHER_CTX_free(ctx);
506 EVP_CIPHER_CTX_set_padding(ctx, 0);
508 if (EVP_DecryptUpdate(ctx, NULL, &outl, (const u_char *)aad,
510 warnx("EVP_DecryptUpdate for AAD failed: %s",
511 ERR_error_string(ERR_get_error(), NULL));
512 EVP_CIPHER_CTX_free(ctx);
516 if (EVP_DecryptUpdate(ctx, (u_char *)output, &outl,
517 (const u_char *)input, size) != 1) {
518 warnx("EVP_DecryptUpdate failed: %s",
519 ERR_error_string(ERR_get_error(), NULL));
520 EVP_CIPHER_CTX_free(ctx);
524 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, tag_len,
525 __DECONST(char *, tag)) != 1) {
526 warnx("EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_SET_TAG) failed: %s",
527 ERR_error_string(ERR_get_error(), NULL));
528 EVP_CIPHER_CTX_free(ctx);
531 valid = (EVP_DecryptFinal_ex(ctx, (u_char *)output + outl, &outl) == 1);
533 if ((size_t)total != size) {
534 warnx("decrypt size mismatch: %zu vs %d", size, total);
535 EVP_CIPHER_CTX_free(ctx);
539 warnx("tag mismatch");
540 EVP_CIPHER_CTX_free(ctx);
545 build_tls_enable(const atf_tc_t *tc, int cipher_alg, size_t cipher_key_len,
546 int auth_alg, int minor, uint64_t seqno, struct tls_enable *en)
548 u_int auth_key_len, iv_len;
550 memset(en, 0, sizeof(*en));
552 switch (cipher_alg) {
554 if (minor == TLS_MINOR_VER_ZERO)
555 iv_len = AES_BLOCK_LEN;
559 case CRYPTO_AES_NIST_GCM_16:
560 if (minor == TLS_MINOR_VER_TWO)
561 iv_len = TLS_AEAD_GCM_LEN;
563 iv_len = TLS_1_3_GCM_IV_LEN;
565 case CRYPTO_CHACHA20_POLY1305:
566 iv_len = TLS_CHACHA20_IV_LEN;
573 case CRYPTO_SHA1_HMAC:
574 auth_key_len = SHA1_HASH_LEN;
576 case CRYPTO_SHA2_256_HMAC:
577 auth_key_len = SHA2_256_HASH_LEN;
579 case CRYPTO_SHA2_384_HMAC:
580 auth_key_len = SHA2_384_HASH_LEN;
586 en->cipher_key = alloc_buffer(cipher_key_len);
587 debug_hexdump(tc, en->cipher_key, cipher_key_len, "cipher key");
588 en->iv = alloc_buffer(iv_len);
590 debug_hexdump(tc, en->iv, iv_len, "iv");
591 en->auth_key = alloc_buffer(auth_key_len);
592 if (auth_key_len != 0)
593 debug_hexdump(tc, en->auth_key, auth_key_len, "auth key");
594 en->cipher_algorithm = cipher_alg;
595 en->cipher_key_len = cipher_key_len;
597 en->auth_algorithm = auth_alg;
598 en->auth_key_len = auth_key_len;
599 en->tls_vmajor = TLS_MAJOR_VER_ONE;
600 en->tls_vminor = minor;
601 be64enc(en->rec_seq, seqno);
602 debug(tc, "seqno: %ju\n", (uintmax_t)seqno);
606 free_tls_enable(struct tls_enable *en)
608 free(__DECONST(void *, en->cipher_key));
609 free(__DECONST(void *, en->iv));
610 free(__DECONST(void *, en->auth_key));
613 static const EVP_CIPHER *
614 tls_EVP_CIPHER(const struct tls_enable *en)
616 switch (en->cipher_algorithm) {
618 switch (en->cipher_key_len) {
620 return (EVP_aes_128_cbc());
622 return (EVP_aes_256_cbc());
627 case CRYPTO_AES_NIST_GCM_16:
628 switch (en->cipher_key_len) {
630 return (EVP_aes_128_gcm());
632 return (EVP_aes_256_gcm());
637 case CRYPTO_CHACHA20_POLY1305:
638 return (EVP_chacha20_poly1305());
644 static const EVP_MD *
645 tls_EVP_MD(const struct tls_enable *en)
647 switch (en->auth_algorithm) {
648 case CRYPTO_SHA1_HMAC:
650 case CRYPTO_SHA2_256_HMAC:
651 return (EVP_sha256());
652 case CRYPTO_SHA2_384_HMAC:
653 return (EVP_sha384());
660 tls_header_len(struct tls_enable *en)
664 len = sizeof(struct tls_record_layer);
665 switch (en->cipher_algorithm) {
667 if (en->tls_vminor != TLS_MINOR_VER_ZERO)
668 len += AES_BLOCK_LEN;
670 case CRYPTO_AES_NIST_GCM_16:
671 if (en->tls_vminor == TLS_MINOR_VER_TWO)
672 len += sizeof(uint64_t);
674 case CRYPTO_CHACHA20_POLY1305:
682 tls_mac_len(struct tls_enable *en)
684 switch (en->cipher_algorithm) {
686 switch (en->auth_algorithm) {
687 case CRYPTO_SHA1_HMAC:
688 return (SHA1_HASH_LEN);
689 case CRYPTO_SHA2_256_HMAC:
690 return (SHA2_256_HASH_LEN);
691 case CRYPTO_SHA2_384_HMAC:
692 return (SHA2_384_HASH_LEN);
696 case CRYPTO_AES_NIST_GCM_16:
697 return (AES_GMAC_HASH_LEN);
698 case CRYPTO_CHACHA20_POLY1305:
699 return (POLY1305_HASH_LEN);
705 /* Includes maximum padding for MTE. */
707 tls_trailer_len(struct tls_enable *en)
711 len = tls_mac_len(en);
712 if (en->cipher_algorithm == CRYPTO_AES_CBC)
713 len += AES_BLOCK_LEN;
714 if (en->tls_vminor == TLS_MINOR_VER_THREE)
719 /* Minimum valid record payload size for a given cipher suite. */
721 tls_minimum_record_payload(struct tls_enable *en)
725 len = tls_header_len(en);
726 if (en->cipher_algorithm == CRYPTO_AES_CBC)
727 len += roundup2(tls_mac_len(en) + 1, AES_BLOCK_LEN);
729 len += tls_mac_len(en);
730 if (en->tls_vminor == TLS_MINOR_VER_THREE)
732 return (len - sizeof(struct tls_record_layer));
735 /* 'len' is the length of the payload application data. */
737 tls_mte_aad(struct tls_enable *en, size_t len,
738 const struct tls_record_layer *hdr, uint64_t seqno, struct tls_mac_data *ad)
740 ad->seq = htobe64(seqno);
741 ad->type = hdr->tls_type;
742 ad->tls_vmajor = hdr->tls_vmajor;
743 ad->tls_vminor = hdr->tls_vminor;
744 ad->tls_length = htons(len);
748 tls_12_aead_aad(struct tls_enable *en, size_t len,
749 const struct tls_record_layer *hdr, uint64_t seqno,
750 struct tls_aead_data *ad)
752 ad->seq = htobe64(seqno);
753 ad->type = hdr->tls_type;
754 ad->tls_vmajor = hdr->tls_vmajor;
755 ad->tls_vminor = hdr->tls_vminor;
756 ad->tls_length = htons(len);
760 tls_13_aad(struct tls_enable *en, const struct tls_record_layer *hdr,
761 uint64_t seqno, struct tls_aead_data_13 *ad)
763 ad->type = hdr->tls_type;
764 ad->tls_vmajor = hdr->tls_vmajor;
765 ad->tls_vminor = hdr->tls_vminor;
766 ad->tls_length = hdr->tls_length;
770 tls_12_gcm_nonce(struct tls_enable *en, const struct tls_record_layer *hdr,
773 memcpy(nonce, en->iv, TLS_AEAD_GCM_LEN);
774 memcpy(nonce + TLS_AEAD_GCM_LEN, hdr + 1, sizeof(uint64_t));
778 tls_13_nonce(struct tls_enable *en, uint64_t seqno, char *nonce)
780 static_assert(TLS_1_3_GCM_IV_LEN == TLS_CHACHA20_IV_LEN,
781 "TLS 1.3 nonce length mismatch");
782 memcpy(nonce, en->iv, TLS_1_3_GCM_IV_LEN);
783 *(uint64_t *)(nonce + 4) ^= htobe64(seqno);
787 * Decrypt a TLS record 'len' bytes long at 'src' and store the result at
788 * 'dst'. If the TLS record header length doesn't match or 'dst' doesn't
789 * have sufficient room ('avail'), fail the test.
792 decrypt_tls_aes_cbc_mte(const atf_tc_t *tc, struct tls_enable *en,
793 uint64_t seqno, const void *src, size_t len, void *dst, size_t avail,
794 uint8_t *record_type)
796 const struct tls_record_layer *hdr;
797 struct tls_mac_data aad;
800 size_t hdr_len, mac_len, payload_len;
804 hdr_len = tls_header_len(en);
805 mac_len = tls_mac_len(en);
806 ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor);
807 ATF_REQUIRE_INTEQ(en->tls_vminor, hdr->tls_vminor);
808 debug(tc, "decrypting MTE record seqno %ju:\n", (uintmax_t)seqno);
809 debug_hexdump(tc, src, len, NULL);
811 /* First, decrypt the outer payload into a temporary buffer. */
812 payload_len = len - hdr_len;
813 buf = malloc(payload_len);
814 if (en->tls_vminor == TLS_MINOR_VER_ZERO)
817 iv = (void *)(hdr + 1);
818 debug_hexdump(tc, iv, AES_BLOCK_LEN, "iv");
819 ATF_REQUIRE(cbc_decrypt(tls_EVP_CIPHER(en), en->cipher_key, iv,
820 (const u_char *)src + hdr_len, buf, payload_len));
821 debug_hexdump(tc, buf, payload_len, "decrypted buffer");
824 * Copy the last encrypted block to use as the IV for the next
825 * record for TLS 1.0.
827 if (en->tls_vminor == TLS_MINOR_VER_ZERO)
828 memcpy(__DECONST(uint8_t *, en->iv), (const u_char *)src +
829 (len - AES_BLOCK_LEN), AES_BLOCK_LEN);
832 * Verify trailing padding and strip.
834 * The kernel always generates the smallest amount of padding.
836 padding = buf[payload_len - 1] + 1;
837 ATF_REQUIRE_MSG(padding > 0 && padding <= AES_BLOCK_LEN,
838 "invalid padding %d", padding);
839 ATF_REQUIRE_MSG(payload_len >= mac_len + padding,
840 "payload_len (%zu) < mac_len (%zu) + padding (%d)", payload_len,
842 payload_len -= padding;
845 payload_len -= mac_len;
846 tls_mte_aad(en, payload_len, hdr, seqno, &aad);
847 debug_hexdump(tc, &aad, sizeof(aad), "aad");
848 ATF_REQUIRE(verify_hash(tls_EVP_MD(en), en->auth_key, en->auth_key_len,
849 &aad, sizeof(aad), buf, payload_len, buf + payload_len));
851 ATF_REQUIRE_MSG(payload_len <= avail, "payload_len (%zu) < avail (%zu)",
853 memcpy(dst, buf, payload_len);
854 *record_type = hdr->tls_type;
855 return (payload_len);
859 decrypt_tls_12_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno,
860 const void *src, size_t len, void *dst, uint8_t *record_type)
862 const struct tls_record_layer *hdr;
863 struct tls_aead_data aad;
865 size_t hdr_len, mac_len, payload_len;
869 hdr_len = tls_header_len(en);
870 mac_len = tls_mac_len(en);
871 payload_len = len - (hdr_len + mac_len);
872 ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor);
873 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, hdr->tls_vminor);
874 debug(tc, "decrypting TLS 1.2 record seqno %ju:\n", (uintmax_t)seqno);
875 debug_hexdump(tc, src, len, NULL);
877 tls_12_aead_aad(en, payload_len, hdr, seqno, &aad);
878 debug_hexdump(tc, &aad, sizeof(aad), "aad");
879 if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16)
880 tls_12_gcm_nonce(en, hdr, nonce);
882 tls_13_nonce(en, seqno, nonce);
883 debug_hexdump(tc, nonce, sizeof(nonce), "nonce");
885 ATF_REQUIRE(aead_decrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce,
886 &aad, sizeof(aad), (const char *)src + hdr_len, dst, payload_len,
887 (const char *)src + hdr_len + payload_len, mac_len));
889 *record_type = hdr->tls_type;
890 return (payload_len);
894 decrypt_tls_13_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno,
895 const void *src, size_t len, void *dst, uint8_t *record_type)
897 const struct tls_record_layer *hdr;
898 struct tls_aead_data_13 aad;
901 size_t hdr_len, mac_len, payload_len;
905 hdr_len = tls_header_len(en);
906 mac_len = tls_mac_len(en);
907 payload_len = len - (hdr_len + mac_len);
908 ATF_REQUIRE_MSG(payload_len >= 1,
909 "payload_len (%zu) too short: len %zu hdr_len %zu mac_len %zu",
910 payload_len, len, hdr_len, mac_len);
911 ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, hdr->tls_type);
912 ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor);
913 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, hdr->tls_vminor);
914 debug(tc, "decrypting TLS 1.3 record seqno %ju:\n", (uintmax_t)seqno);
915 debug_hexdump(tc, src, len, NULL);
917 tls_13_aad(en, hdr, seqno, &aad);
918 debug_hexdump(tc, &aad, sizeof(aad), "aad");
919 tls_13_nonce(en, seqno, nonce);
920 debug_hexdump(tc, nonce, sizeof(nonce), "nonce");
923 * Have to use a temporary buffer for the output due to the
924 * record type as the last byte of the trailer.
926 buf = malloc(payload_len);
928 ATF_REQUIRE(aead_decrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce,
929 &aad, sizeof(aad), (const char *)src + hdr_len, buf, payload_len,
930 (const char *)src + hdr_len + payload_len, mac_len));
931 debug_hexdump(tc, buf, payload_len, "decrypted buffer");
933 /* Trim record type. */
934 *record_type = buf[payload_len - 1];
937 memcpy(dst, buf, payload_len);
940 return (payload_len);
944 decrypt_tls_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno,
945 const void *src, size_t len, void *dst, size_t avail, uint8_t *record_type)
947 const struct tls_record_layer *hdr;
951 ATF_REQUIRE_INTEQ(len, ntohs(hdr->tls_length) + sizeof(*hdr));
953 payload_len = len - (tls_header_len(en) + tls_trailer_len(en));
954 ATF_REQUIRE_MSG(payload_len <= avail, "payload_len (%zu) > avail (%zu)",
957 if (en->tls_vminor == TLS_MINOR_VER_TWO) {
958 ATF_REQUIRE_INTEQ(payload_len, decrypt_tls_12_aead(tc, en,
959 seqno, src, len, dst, record_type));
961 ATF_REQUIRE_INTEQ(payload_len, decrypt_tls_13_aead(tc, en,
962 seqno, src, len, dst, record_type));
965 return (payload_len);
969 decrypt_tls_record(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno,
970 const void *src, size_t len, void *dst, size_t avail, uint8_t *record_type)
972 if (en->cipher_algorithm == CRYPTO_AES_CBC)
973 return (decrypt_tls_aes_cbc_mte(tc, en, seqno, src, len, dst,
974 avail, record_type));
976 return (decrypt_tls_aead(tc, en, seqno, src, len, dst, avail,
981 * Encrypt a TLS record of type 'record_type' with payload 'len' bytes
982 * long at 'src' and store the result at 'dst'. If 'dst' doesn't have
983 * sufficient room ('avail'), fail the test. 'padding' is the amount
984 * of additional padding to include beyond any amount mandated by the
988 encrypt_tls_aes_cbc_mte(const atf_tc_t *tc, struct tls_enable *en,
989 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst,
990 size_t avail, size_t padding)
992 struct tls_record_layer *hdr;
993 struct tls_mac_data aad;
995 size_t hdr_len, mac_len, record_len;
998 ATF_REQUIRE_INTEQ(0, padding % 16);
1003 debug(tc, "encrypting MTE record seqno %ju:\n", (uintmax_t)seqno);
1004 hdr_len = tls_header_len(en);
1005 mac_len = tls_mac_len(en);
1006 padding += (AES_BLOCK_LEN - (len + mac_len) % AES_BLOCK_LEN);
1007 ATF_REQUIRE_MSG(padding > 0 && padding <= 255, "invalid padding (%zu)",
1010 record_len = hdr_len + len + mac_len + padding;
1011 ATF_REQUIRE_MSG(record_len <= avail, "record_len (%zu) > avail (%zu): "
1012 "hdr_len %zu, len %zu, mac_len %zu, padding %zu", record_len,
1013 avail, hdr_len, len, mac_len, padding);
1015 hdr->tls_type = record_type;
1016 hdr->tls_vmajor = TLS_MAJOR_VER_ONE;
1017 hdr->tls_vminor = en->tls_vminor;
1018 hdr->tls_length = htons(record_len - sizeof(*hdr));
1019 iv = (char *)(hdr + 1);
1020 for (i = 0; i < AES_BLOCK_LEN; i++)
1022 debug_hexdump(tc, iv, AES_BLOCK_LEN, "explicit IV");
1024 /* Copy plaintext to ciphertext region. */
1025 memcpy(buf + hdr_len, src, len);
1028 tls_mte_aad(en, len, hdr, seqno, &aad);
1029 debug_hexdump(tc, &aad, sizeof(aad), "aad");
1030 debug_hexdump(tc, src, len, "plaintext");
1031 ATF_REQUIRE(compute_hash(tls_EVP_MD(en), en->auth_key, en->auth_key_len,
1032 &aad, sizeof(aad), src, len, buf + hdr_len + len, &digest_len));
1033 ATF_REQUIRE_INTEQ(mac_len, digest_len);
1035 /* Store padding. */
1036 for (i = 0; i < padding; i++)
1037 buf[hdr_len + len + mac_len + i] = padding - 1;
1038 debug_hexdump(tc, buf + hdr_len + len, mac_len + padding,
1041 /* Encrypt the record. */
1042 ATF_REQUIRE(cbc_encrypt(tls_EVP_CIPHER(en), en->cipher_key, iv,
1043 buf + hdr_len, buf + hdr_len, len + mac_len + padding));
1044 debug_hexdump(tc, dst, record_len, "encrypted record");
1046 return (record_len);
1050 encrypt_tls_12_aead(const atf_tc_t *tc, struct tls_enable *en,
1051 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst)
1053 struct tls_record_layer *hdr;
1054 struct tls_aead_data aad;
1056 size_t hdr_len, mac_len, record_len;
1060 debug(tc, "encrypting TLS 1.2 record seqno %ju:\n", (uintmax_t)seqno);
1061 hdr_len = tls_header_len(en);
1062 mac_len = tls_mac_len(en);
1063 record_len = hdr_len + len + mac_len;
1065 hdr->tls_type = record_type;
1066 hdr->tls_vmajor = TLS_MAJOR_VER_ONE;
1067 hdr->tls_vminor = TLS_MINOR_VER_TWO;
1068 hdr->tls_length = htons(record_len - sizeof(*hdr));
1069 if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16)
1070 memcpy(hdr + 1, &seqno, sizeof(seqno));
1072 tls_12_aead_aad(en, len, hdr, seqno, &aad);
1073 debug_hexdump(tc, &aad, sizeof(aad), "aad");
1074 if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16)
1075 tls_12_gcm_nonce(en, hdr, nonce);
1077 tls_13_nonce(en, seqno, nonce);
1078 debug_hexdump(tc, nonce, sizeof(nonce), "nonce");
1080 debug_hexdump(tc, src, len, "plaintext");
1081 ATF_REQUIRE(aead_encrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce,
1082 &aad, sizeof(aad), src, (char *)dst + hdr_len, len,
1083 (char *)dst + hdr_len + len, mac_len));
1084 debug_hexdump(tc, dst, record_len, "encrypted record");
1086 return (record_len);
1090 encrypt_tls_13_aead(const atf_tc_t *tc, struct tls_enable *en,
1091 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst,
1094 struct tls_record_layer *hdr;
1095 struct tls_aead_data_13 aad;
1098 size_t hdr_len, mac_len, record_len;
1102 debug(tc, "encrypting TLS 1.3 record seqno %ju:\n", (uintmax_t)seqno);
1103 hdr_len = tls_header_len(en);
1104 mac_len = tls_mac_len(en);
1105 record_len = hdr_len + len + 1 + padding + mac_len;
1107 hdr->tls_type = TLS_RLTYPE_APP;
1108 hdr->tls_vmajor = TLS_MAJOR_VER_ONE;
1109 hdr->tls_vminor = TLS_MINOR_VER_TWO;
1110 hdr->tls_length = htons(record_len - sizeof(*hdr));
1112 tls_13_aad(en, hdr, seqno, &aad);
1113 debug_hexdump(tc, &aad, sizeof(aad), "aad");
1114 tls_13_nonce(en, seqno, nonce);
1115 debug_hexdump(tc, nonce, sizeof(nonce), "nonce");
1118 * Have to use a temporary buffer for the input so that the record
1119 * type can be appended.
1121 buf = malloc(len + 1 + padding);
1122 memcpy(buf, src, len);
1123 buf[len] = record_type;
1124 memset(buf + len + 1, 0, padding);
1125 debug_hexdump(tc, buf, len + 1 + padding, "plaintext + type + padding");
1127 ATF_REQUIRE(aead_encrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce,
1128 &aad, sizeof(aad), buf, (char *)dst + hdr_len, len + 1 + padding,
1129 (char *)dst + hdr_len + len + 1 + padding, mac_len));
1130 debug_hexdump(tc, dst, record_len, "encrypted record");
1134 return (record_len);
1138 encrypt_tls_aead(const atf_tc_t *tc, struct tls_enable *en,
1139 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst,
1140 size_t avail, size_t padding)
1144 record_len = tls_header_len(en) + len + padding + tls_trailer_len(en);
1145 ATF_REQUIRE_MSG(record_len <= avail, "record_len (%zu) > avail (%zu): "
1146 "header %zu len %zu padding %zu trailer %zu", record_len, avail,
1147 tls_header_len(en), len, padding, tls_trailer_len(en));
1149 if (en->tls_vminor == TLS_MINOR_VER_TWO) {
1150 ATF_REQUIRE_INTEQ(0, padding);
1151 ATF_REQUIRE_INTEQ(record_len, encrypt_tls_12_aead(tc, en,
1152 record_type, seqno, src, len, dst));
1154 ATF_REQUIRE_INTEQ(record_len, encrypt_tls_13_aead(tc, en,
1155 record_type, seqno, src, len, dst, padding));
1157 return (record_len);
1161 encrypt_tls_record(const atf_tc_t *tc, struct tls_enable *en,
1162 uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst,
1163 size_t avail, size_t padding)
1165 if (en->cipher_algorithm == CRYPTO_AES_CBC)
1166 return (encrypt_tls_aes_cbc_mte(tc, en, record_type, seqno, src,
1167 len, dst, avail, padding));
1169 return (encrypt_tls_aead(tc, en, record_type, seqno, src, len,
1170 dst, avail, padding));
1174 test_ktls_transmit_app_data(const atf_tc_t *tc, struct tls_enable *en,
1175 uint64_t seqno, size_t len)
1178 struct tls_record_layer *hdr;
1179 char *plaintext, *decrypted, *outbuf;
1180 size_t decrypted_len, outbuf_len, outbuf_cap, record_len, written;
1183 uint8_t record_type;
1185 plaintext = alloc_buffer(len);
1186 debug_hexdump(tc, plaintext, len, "plaintext");
1187 decrypted = malloc(len);
1188 outbuf_cap = tls_header_len(en) + TLS_MAX_MSG_SIZE_V10_2 +
1189 tls_trailer_len(en);
1190 outbuf = malloc(outbuf_cap);
1191 hdr = (struct tls_record_layer *)outbuf;
1193 ATF_REQUIRE((kq = kqueue()) != -1);
1195 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1197 ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en,
1199 check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE);
1201 EV_SET(&ev, sockets[0], EVFILT_READ, EV_ADD, 0, 0, NULL);
1202 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0);
1203 EV_SET(&ev, sockets[1], EVFILT_WRITE, EV_ADD, 0, 0, NULL);
1204 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0);
1210 while (decrypted_len != len) {
1211 ATF_REQUIRE(kevent(kq, NULL, 0, &ev, 1, NULL) == 1);
1213 switch (ev.filter) {
1215 /* Try to write any remaining data. */
1216 rv = write(ev.ident, plaintext + written,
1218 ATF_REQUIRE_MSG(rv > 0,
1219 "failed to write to socket");
1221 if (written == len) {
1222 ev.flags = EV_DISABLE;
1223 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0,
1229 ATF_REQUIRE((ev.flags & EV_EOF) == 0);
1232 * Try to read data for the next TLS record
1233 * into outbuf. Start by reading the header
1234 * to determine how much additional data to
1237 if (outbuf_len < sizeof(struct tls_record_layer)) {
1238 rv = read(ev.ident, outbuf + outbuf_len,
1239 sizeof(struct tls_record_layer) -
1241 ATF_REQUIRE_MSG(rv > 0,
1242 "failed to read from socket");
1246 sizeof(struct tls_record_layer)) {
1247 debug(tc, "TLS header for seqno %ju:\n",
1249 debug_hexdump(tc, outbuf, outbuf_len,
1254 if (outbuf_len < sizeof(struct tls_record_layer))
1257 record_len = sizeof(struct tls_record_layer) +
1258 ntohs(hdr->tls_length);
1259 debug(tc, "record_len %zu outbuf_cap %zu\n",
1260 record_len, outbuf_cap);
1261 ATF_REQUIRE(record_len <= outbuf_cap);
1262 ATF_REQUIRE(record_len > outbuf_len);
1263 rv = read(ev.ident, outbuf + outbuf_len,
1264 record_len - outbuf_len);
1265 if (rv == -1 && errno == EAGAIN)
1267 ATF_REQUIRE_MSG(rv > 0,
1268 "failed to read from socket: %s", strerror(errno));
1271 if (outbuf_len == record_len) {
1272 decrypted_len += decrypt_tls_record(tc, en,
1273 seqno, outbuf, outbuf_len,
1274 decrypted + decrypted_len,
1275 len - decrypted_len, &record_type);
1276 ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, record_type);
1285 ATF_REQUIRE_MSG(written == decrypted_len,
1286 "read %zu decrypted bytes, but wrote %zu", decrypted_len, written);
1288 ATF_REQUIRE(memcmp(plaintext, decrypted, len) == 0);
1294 close_sockets(sockets);
1295 ATF_REQUIRE(close(kq) == 0);
1299 ktls_send_control_message(int fd, uint8_t type, void *data, size_t len)
1302 struct cmsghdr *cmsg;
1303 char cbuf[CMSG_SPACE(sizeof(type))];
1306 memset(&msg, 0, sizeof(msg));
1308 msg.msg_control = cbuf;
1309 msg.msg_controllen = sizeof(cbuf);
1310 cmsg = CMSG_FIRSTHDR(&msg);
1311 cmsg->cmsg_level = IPPROTO_TCP;
1312 cmsg->cmsg_type = TLS_SET_RECORD_TYPE;
1313 cmsg->cmsg_len = CMSG_LEN(sizeof(type));
1314 *(uint8_t *)CMSG_DATA(cmsg) = type;
1316 iov.iov_base = data;
1321 ATF_REQUIRE_INTEQ((ssize_t)len, sendmsg(fd, &msg, 0));
1325 test_ktls_transmit_control(const atf_tc_t *tc, struct tls_enable *en,
1326 uint64_t seqno, uint8_t type, size_t len)
1328 struct tls_record_layer *hdr;
1329 char *plaintext, *decrypted, *outbuf;
1330 size_t outbuf_cap, payload_len, record_len;
1333 uint8_t record_type;
1335 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1337 plaintext = alloc_buffer(len);
1338 decrypted = malloc(len);
1339 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1340 outbuf = malloc(outbuf_cap);
1341 hdr = (struct tls_record_layer *)outbuf;
1343 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1345 ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en,
1347 check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE);
1349 fd_set_blocking(sockets[0]);
1350 fd_set_blocking(sockets[1]);
1352 ktls_send_control_message(sockets[1], type, plaintext, len);
1355 * First read the header to determine how much additional data
1358 rv = read(sockets[0], outbuf, sizeof(struct tls_record_layer));
1359 ATF_REQUIRE_INTEQ(sizeof(struct tls_record_layer), rv);
1360 payload_len = ntohs(hdr->tls_length);
1361 record_len = payload_len + sizeof(struct tls_record_layer);
1362 ATF_REQUIRE_MSG(record_len <= outbuf_cap,
1363 "record_len (%zu) > outbuf_cap (%zu)", record_len, outbuf_cap);
1364 rv = read(sockets[0], outbuf + sizeof(struct tls_record_layer),
1366 ATF_REQUIRE_INTEQ((ssize_t)payload_len, rv);
1368 rv = decrypt_tls_record(tc, en, seqno, outbuf, record_len, decrypted,
1371 ATF_REQUIRE_MSG((ssize_t)len == rv,
1372 "read %zd decrypted bytes, but wrote %zu", rv, len);
1373 ATF_REQUIRE_INTEQ(type, record_type);
1375 ATF_REQUIRE(memcmp(plaintext, decrypted, len) == 0);
1381 close_sockets(sockets);
1385 test_ktls_transmit_empty_fragment(const atf_tc_t *tc, struct tls_enable *en,
1388 struct tls_record_layer *hdr;
1390 size_t outbuf_cap, payload_len, record_len;
1393 uint8_t record_type;
1395 outbuf_cap = tls_header_len(en) + tls_trailer_len(en);
1396 outbuf = malloc(outbuf_cap);
1397 hdr = (struct tls_record_layer *)outbuf;
1399 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1401 ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en,
1403 check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE);
1405 fd_set_blocking(sockets[0]);
1406 fd_set_blocking(sockets[1]);
1409 * A write of zero bytes should send an empty fragment only for
1410 * TLS 1.0, otherwise an error should be raised.
1412 rv = write(sockets[1], NULL, 0);
1414 ATF_REQUIRE_INTEQ(CRYPTO_AES_CBC, en->cipher_algorithm);
1415 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_ZERO, en->tls_vminor);
1417 ATF_REQUIRE_INTEQ(-1, rv);
1418 ATF_REQUIRE_ERRNO(EINVAL, true);
1423 * First read the header to determine how much additional data
1426 rv = read(sockets[0], outbuf, sizeof(struct tls_record_layer));
1427 ATF_REQUIRE_INTEQ(sizeof(struct tls_record_layer), rv);
1428 payload_len = ntohs(hdr->tls_length);
1429 record_len = payload_len + sizeof(struct tls_record_layer);
1430 ATF_REQUIRE_MSG(record_len <= outbuf_cap,
1431 "record_len (%zu) > outbuf_cap (%zu)", record_len, outbuf_cap);
1432 rv = read(sockets[0], outbuf + sizeof(struct tls_record_layer),
1434 ATF_REQUIRE_INTEQ((ssize_t)payload_len, rv);
1436 rv = decrypt_tls_record(tc, en, seqno, outbuf, record_len, NULL, 0,
1439 ATF_REQUIRE_MSG(rv == 0,
1440 "read %zd decrypted bytes for an empty fragment", rv);
1441 ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, record_type);
1446 close_sockets(sockets);
1450 ktls_receive_tls_record(struct tls_enable *en, int fd, uint8_t record_type,
1451 void *data, size_t len)
1454 struct cmsghdr *cmsg;
1455 struct tls_get_record *tgr;
1456 char cbuf[CMSG_SPACE(sizeof(*tgr))];
1460 memset(&msg, 0, sizeof(msg));
1462 msg.msg_control = cbuf;
1463 msg.msg_controllen = sizeof(cbuf);
1465 iov.iov_base = data;
1470 ATF_REQUIRE((rv = recvmsg(fd, &msg, 0)) > 0);
1472 ATF_REQUIRE((msg.msg_flags & (MSG_EOR | MSG_CTRUNC)) == MSG_EOR);
1474 cmsg = CMSG_FIRSTHDR(&msg);
1475 ATF_REQUIRE(cmsg != NULL);
1476 ATF_REQUIRE_INTEQ(IPPROTO_TCP, cmsg->cmsg_level);
1477 ATF_REQUIRE_INTEQ(TLS_GET_RECORD, cmsg->cmsg_type);
1478 ATF_REQUIRE_INTEQ(CMSG_LEN(sizeof(*tgr)), cmsg->cmsg_len);
1480 tgr = (struct tls_get_record *)CMSG_DATA(cmsg);
1481 ATF_REQUIRE_INTEQ(record_type, tgr->tls_type);
1482 ATF_REQUIRE_INTEQ(en->tls_vmajor, tgr->tls_vmajor);
1483 /* XXX: Not sure if this is what OpenSSL expects? */
1484 if (en->tls_vminor == TLS_MINOR_VER_THREE)
1485 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, tgr->tls_vminor);
1487 ATF_REQUIRE_INTEQ(en->tls_vminor, tgr->tls_vminor);
1488 ATF_REQUIRE_INTEQ(htons(rv), tgr->tls_length);
1494 test_ktls_receive_app_data(const atf_tc_t *tc, struct tls_enable *en,
1495 uint64_t seqno, size_t len, size_t padding)
1498 char *plaintext, *received, *outbuf;
1499 size_t outbuf_cap, outbuf_len, outbuf_sent, received_len, todo, written;
1503 plaintext = alloc_buffer(len);
1504 received = malloc(len);
1505 outbuf_cap = tls_header_len(en) + TLS_MAX_MSG_SIZE_V10_2 +
1506 tls_trailer_len(en);
1507 outbuf = malloc(outbuf_cap);
1509 ATF_REQUIRE((kq = kqueue()) != -1);
1511 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1513 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1515 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1517 EV_SET(&ev, sockets[0], EVFILT_READ, EV_ADD, 0, 0, NULL);
1518 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0);
1519 EV_SET(&ev, sockets[1], EVFILT_WRITE, EV_ADD, 0, 0, NULL);
1520 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0);
1526 while (received_len != len) {
1527 ATF_REQUIRE(kevent(kq, NULL, 0, &ev, 1, NULL) == 1);
1529 switch (ev.filter) {
1532 * Compose the next TLS record to send.
1534 if (outbuf_len == 0) {
1535 ATF_REQUIRE(written < len);
1536 todo = len - written;
1537 if (todo > TLS_MAX_MSG_SIZE_V10_2 - padding)
1538 todo = TLS_MAX_MSG_SIZE_V10_2 - padding;
1539 outbuf_len = encrypt_tls_record(tc, en,
1540 TLS_RLTYPE_APP, seqno, plaintext + written,
1541 todo, outbuf, outbuf_cap, padding);
1548 * Try to write the remainder of the current
1551 rv = write(ev.ident, outbuf + outbuf_sent,
1552 outbuf_len - outbuf_sent);
1553 ATF_REQUIRE_MSG(rv > 0,
1554 "failed to write to socket: %s", strerror(errno));
1556 if (outbuf_sent == outbuf_len) {
1558 if (written == len) {
1559 ev.flags = EV_DISABLE;
1560 ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0,
1567 ATF_REQUIRE((ev.flags & EV_EOF) == 0);
1569 rv = ktls_receive_tls_record(en, ev.ident,
1570 TLS_RLTYPE_APP, received + received_len,
1571 len - received_len);
1577 ATF_REQUIRE_MSG(written == received_len,
1578 "read %zu decrypted bytes, but wrote %zu", received_len, written);
1580 ATF_REQUIRE(memcmp(plaintext, received, len) == 0);
1586 close_sockets(sockets);
1587 ATF_REQUIRE(close(kq) == 0);
1591 ktls_receive_tls_error(int fd, int expected_error)
1594 struct tls_get_record *tgr;
1595 char cbuf[CMSG_SPACE(sizeof(*tgr))];
1599 memset(&msg, 0, sizeof(msg));
1601 msg.msg_control = cbuf;
1602 msg.msg_controllen = sizeof(cbuf);
1605 iov.iov_len = sizeof(buf);
1609 ATF_REQUIRE(recvmsg(fd, &msg, 0) == -1);
1610 if (expected_error != 0)
1611 ATF_REQUIRE_ERRNO(expected_error, true);
1615 test_ktls_receive_corrupted_record(const atf_tc_t *tc, struct tls_enable *en,
1616 uint64_t seqno, size_t len, ssize_t offset)
1618 char *plaintext, *outbuf;
1619 size_t outbuf_cap, outbuf_len;
1623 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1625 plaintext = alloc_buffer(len);
1626 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1627 outbuf = malloc(outbuf_cap);
1629 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1631 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1633 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1635 fd_set_blocking(sockets[0]);
1636 fd_set_blocking(sockets[1]);
1638 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1639 plaintext, len, outbuf, outbuf_cap, 0);
1641 /* A negative offset is an offset from the end. */
1643 offset += outbuf_len;
1644 outbuf[offset] ^= 0x01;
1646 rv = write(sockets[1], outbuf, outbuf_len);
1647 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1649 ktls_receive_tls_error(sockets[0], EBADMSG);
1654 close_sockets_ignore_errors(sockets);
1658 test_ktls_receive_corrupted_iv(const atf_tc_t *tc, struct tls_enable *en,
1659 uint64_t seqno, size_t len)
1661 ATF_REQUIRE(tls_header_len(en) > sizeof(struct tls_record_layer));
1663 /* Corrupt the first byte of the explicit IV after the header. */
1664 test_ktls_receive_corrupted_record(tc, en, seqno, len,
1665 sizeof(struct tls_record_layer));
1669 test_ktls_receive_corrupted_data(const atf_tc_t *tc, struct tls_enable *en,
1670 uint64_t seqno, size_t len)
1672 ATF_REQUIRE(len > 0);
1674 /* Corrupt the first ciphertext byte after the header. */
1675 test_ktls_receive_corrupted_record(tc, en, seqno, len,
1676 tls_header_len(en));
1680 test_ktls_receive_corrupted_mac(const atf_tc_t *tc, struct tls_enable *en,
1681 uint64_t seqno, size_t len)
1685 /* Corrupt the first byte of the MAC. */
1686 if (en->cipher_algorithm == CRYPTO_AES_CBC)
1687 offset = tls_header_len(en) + len;
1689 offset = -tls_mac_len(en);
1690 test_ktls_receive_corrupted_record(tc, en, seqno, len, offset);
1694 test_ktls_receive_corrupted_padding(const atf_tc_t *tc, struct tls_enable *en,
1695 uint64_t seqno, size_t len)
1697 ATF_REQUIRE_INTEQ(CRYPTO_AES_CBC, en->cipher_algorithm);
1699 /* Corrupt the last byte of the padding. */
1700 test_ktls_receive_corrupted_record(tc, en, seqno, len, -1);
1704 test_ktls_receive_truncated_record(const atf_tc_t *tc, struct tls_enable *en,
1705 uint64_t seqno, size_t len)
1707 char *plaintext, *outbuf;
1708 size_t outbuf_cap, outbuf_len;
1712 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1714 plaintext = alloc_buffer(len);
1715 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1716 outbuf = malloc(outbuf_cap);
1718 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1720 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1722 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1724 fd_set_blocking(sockets[0]);
1725 fd_set_blocking(sockets[1]);
1727 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1728 plaintext, len, outbuf, outbuf_cap, 0);
1730 rv = write(sockets[1], outbuf, outbuf_len / 2);
1731 ATF_REQUIRE_INTEQ((ssize_t)(outbuf_len / 2), rv);
1733 ATF_REQUIRE(shutdown(sockets[1], SHUT_WR) == 0);
1735 ktls_receive_tls_error(sockets[0], EMSGSIZE);
1740 close_sockets_ignore_errors(sockets);
1744 test_ktls_receive_bad_major(const atf_tc_t *tc, struct tls_enable *en,
1745 uint64_t seqno, size_t len)
1747 struct tls_record_layer *hdr;
1748 char *plaintext, *outbuf;
1749 size_t outbuf_cap, outbuf_len;
1753 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1755 plaintext = alloc_buffer(len);
1756 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1757 outbuf = malloc(outbuf_cap);
1759 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1761 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1763 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1765 fd_set_blocking(sockets[0]);
1766 fd_set_blocking(sockets[1]);
1768 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1769 plaintext, len, outbuf, outbuf_cap, 0);
1771 hdr = (void *)outbuf;
1774 rv = write(sockets[1], outbuf, outbuf_len);
1775 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1777 ktls_receive_tls_error(sockets[0], EINVAL);
1782 close_sockets_ignore_errors(sockets);
1786 test_ktls_receive_bad_minor(const atf_tc_t *tc, struct tls_enable *en,
1787 uint64_t seqno, size_t len)
1789 struct tls_record_layer *hdr;
1790 char *plaintext, *outbuf;
1791 size_t outbuf_cap, outbuf_len;
1795 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1797 plaintext = alloc_buffer(len);
1798 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1799 outbuf = malloc(outbuf_cap);
1801 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1803 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1805 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1807 fd_set_blocking(sockets[0]);
1808 fd_set_blocking(sockets[1]);
1810 outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1811 plaintext, len, outbuf, outbuf_cap, 0);
1813 hdr = (void *)outbuf;
1816 rv = write(sockets[1], outbuf, outbuf_len);
1817 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1819 ktls_receive_tls_error(sockets[0], EINVAL);
1824 close_sockets_ignore_errors(sockets);
1828 test_ktls_receive_bad_type(const atf_tc_t *tc, struct tls_enable *en,
1829 uint64_t seqno, size_t len)
1831 struct tls_record_layer *hdr;
1832 char *plaintext, *outbuf;
1833 size_t outbuf_cap, outbuf_len;
1837 ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1838 ATF_REQUIRE_INTEQ(TLS_MINOR_VER_THREE, en->tls_vminor);
1840 plaintext = alloc_buffer(len);
1841 outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1842 outbuf = malloc(outbuf_cap);
1844 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1846 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1848 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1850 fd_set_blocking(sockets[0]);
1851 fd_set_blocking(sockets[1]);
1853 outbuf_len = encrypt_tls_record(tc, en, 0x21 /* Alert */, seqno,
1854 plaintext, len, outbuf, outbuf_cap, 0);
1856 hdr = (void *)outbuf;
1857 hdr->tls_type = TLS_RLTYPE_APP + 1;
1859 rv = write(sockets[1], outbuf, outbuf_len);
1860 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1862 ktls_receive_tls_error(sockets[0], EINVAL);
1867 close_sockets_ignore_errors(sockets);
1871 test_ktls_receive_bad_size(const atf_tc_t *tc, struct tls_enable *en,
1872 uint64_t seqno, size_t len)
1874 struct tls_record_layer *hdr;
1880 outbuf_len = sizeof(*hdr) + len;
1881 outbuf = calloc(1, outbuf_len);
1883 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1885 ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1887 check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1889 fd_set_blocking(sockets[0]);
1890 fd_set_blocking(sockets[1]);
1892 hdr = (void *)outbuf;
1893 hdr->tls_vmajor = en->tls_vmajor;
1894 if (en->tls_vminor == TLS_MINOR_VER_THREE)
1895 hdr->tls_vminor = TLS_MINOR_VER_TWO;
1897 hdr->tls_vminor = en->tls_vminor;
1898 hdr->tls_type = TLS_RLTYPE_APP;
1899 hdr->tls_length = htons(len);
1901 rv = write(sockets[1], outbuf, outbuf_len);
1902 ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1905 * The other end may notice the error and drop the connection
1906 * before this executes resulting in shutdown() failing with
1907 * ENOTCONN. Ignore this error if it occurs.
1909 if (shutdown(sockets[1], SHUT_WR) != 0)
1910 ATF_REQUIRE_ERRNO(ENOTCONN, true);
1912 ktls_receive_tls_error(sockets[0], EMSGSIZE);
1916 close_sockets_ignore_errors(sockets);
1919 #define TLS_10_TESTS(M) \
1920 M(aes128_cbc_1_0_sha1, CRYPTO_AES_CBC, 128 / 8, \
1921 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO) \
1922 M(aes256_cbc_1_0_sha1, CRYPTO_AES_CBC, 256 / 8, \
1923 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO)
1925 #define TLS_13_TESTS(M) \
1926 M(aes128_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \
1927 TLS_MINOR_VER_THREE) \
1928 M(aes256_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0, \
1929 TLS_MINOR_VER_THREE) \
1930 M(chacha20_poly1305_1_3, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \
1931 TLS_MINOR_VER_THREE)
1933 #define AES_CBC_NONZERO_TESTS(M) \
1934 M(aes128_cbc_1_1_sha1, CRYPTO_AES_CBC, 128 / 8, \
1935 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ONE) \
1936 M(aes256_cbc_1_1_sha1, CRYPTO_AES_CBC, 256 / 8, \
1937 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ONE) \
1938 M(aes128_cbc_1_2_sha1, CRYPTO_AES_CBC, 128 / 8, \
1939 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_TWO) \
1940 M(aes256_cbc_1_2_sha1, CRYPTO_AES_CBC, 256 / 8, \
1941 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_TWO) \
1942 M(aes128_cbc_1_2_sha256, CRYPTO_AES_CBC, 128 / 8, \
1943 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_TWO) \
1944 M(aes256_cbc_1_2_sha256, CRYPTO_AES_CBC, 256 / 8, \
1945 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_TWO) \
1946 M(aes128_cbc_1_2_sha384, CRYPTO_AES_CBC, 128 / 8, \
1947 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_TWO) \
1948 M(aes256_cbc_1_2_sha384, CRYPTO_AES_CBC, 256 / 8, \
1949 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_TWO) \
1951 #define AES_CBC_TESTS(M) \
1953 AES_CBC_NONZERO_TESTS(M)
1955 #define AES_GCM_12_TESTS(M) \
1956 M(aes128_gcm_1_2, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \
1957 TLS_MINOR_VER_TWO) \
1958 M(aes256_gcm_1_2, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0, \
1961 #define AES_GCM_TESTS(M) \
1962 AES_GCM_12_TESTS(M) \
1963 M(aes128_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \
1964 TLS_MINOR_VER_THREE) \
1965 M(aes256_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0, \
1966 TLS_MINOR_VER_THREE)
1968 #define CHACHA20_TESTS(M) \
1969 M(chacha20_poly1305_1_2, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \
1970 TLS_MINOR_VER_TWO) \
1971 M(chacha20_poly1305_1_3, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \
1972 TLS_MINOR_VER_THREE)
1974 #define GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
1975 auth_alg, minor, name, len) \
1976 ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_##name); \
1977 ATF_TC_BODY(ktls_transmit_##cipher_name##_##name, tc) \
1979 struct tls_enable en; \
1982 ATF_REQUIRE_KTLS(); \
1984 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
1986 test_ktls_transmit_app_data(tc, &en, seqno, len); \
1987 free_tls_enable(&en); \
1990 #define ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
1991 auth_alg, minor, name) \
1992 ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_##name);
1994 #define GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
1995 auth_alg, minor, name, type, len) \
1996 ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_##name); \
1997 ATF_TC_BODY(ktls_transmit_##cipher_name##_##name, tc) \
1999 struct tls_enable en; \
2002 ATF_REQUIRE_KTLS(); \
2004 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2006 test_ktls_transmit_control(tc, &en, seqno, type, len); \
2007 free_tls_enable(&en); \
2010 #define ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2011 auth_alg, minor, name) \
2012 ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_##name);
2014 #define GEN_TRANSMIT_EMPTY_FRAGMENT_TEST(cipher_name, cipher_alg, \
2015 key_size, auth_alg, minor) \
2016 ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_empty_fragment); \
2017 ATF_TC_BODY(ktls_transmit_##cipher_name##_empty_fragment, tc) \
2019 struct tls_enable en; \
2022 ATF_REQUIRE_KTLS(); \
2024 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2026 test_ktls_transmit_empty_fragment(tc, &en, seqno); \
2027 free_tls_enable(&en); \
2030 #define ADD_TRANSMIT_EMPTY_FRAGMENT_TEST(cipher_name, cipher_alg, \
2031 key_size, auth_alg, minor) \
2032 ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_empty_fragment);
2034 #define GEN_TRANSMIT_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \
2036 GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2037 auth_alg, minor, short, 64) \
2038 GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2039 auth_alg, minor, long, 64 * 1024) \
2040 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2041 auth_alg, minor, control, 0x21 /* Alert */, 32)
2043 #define ADD_TRANSMIT_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \
2045 ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2046 auth_alg, minor, short) \
2047 ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2048 auth_alg, minor, long) \
2049 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2050 auth_alg, minor, control)
2053 * For each supported cipher suite, run three transmit tests:
2055 * - a short test which sends 64 bytes of application data (likely as
2056 * a single TLS record)
2058 * - a long test which sends 64KB of application data (split across
2059 * multiple TLS records)
2061 * - a control test which sends a single record with a specific
2062 * content type via sendmsg()
2064 AES_CBC_TESTS(GEN_TRANSMIT_TESTS);
2065 AES_GCM_TESTS(GEN_TRANSMIT_TESTS);
2066 CHACHA20_TESTS(GEN_TRANSMIT_TESTS);
2068 #define GEN_TRANSMIT_PADDING_TESTS(cipher_name, cipher_alg, key_size, \
2070 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2071 auth_alg, minor, padding_1, 0x21 /* Alert */, 1) \
2072 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2073 auth_alg, minor, padding_2, 0x21 /* Alert */, 2) \
2074 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2075 auth_alg, minor, padding_3, 0x21 /* Alert */, 3) \
2076 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2077 auth_alg, minor, padding_4, 0x21 /* Alert */, 4) \
2078 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2079 auth_alg, minor, padding_5, 0x21 /* Alert */, 5) \
2080 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2081 auth_alg, minor, padding_6, 0x21 /* Alert */, 6) \
2082 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2083 auth_alg, minor, padding_7, 0x21 /* Alert */, 7) \
2084 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2085 auth_alg, minor, padding_8, 0x21 /* Alert */, 8) \
2086 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2087 auth_alg, minor, padding_9, 0x21 /* Alert */, 9) \
2088 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2089 auth_alg, minor, padding_10, 0x21 /* Alert */, 10) \
2090 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2091 auth_alg, minor, padding_11, 0x21 /* Alert */, 11) \
2092 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2093 auth_alg, minor, padding_12, 0x21 /* Alert */, 12) \
2094 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2095 auth_alg, minor, padding_13, 0x21 /* Alert */, 13) \
2096 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2097 auth_alg, minor, padding_14, 0x21 /* Alert */, 14) \
2098 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2099 auth_alg, minor, padding_15, 0x21 /* Alert */, 15) \
2100 GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2101 auth_alg, minor, padding_16, 0x21 /* Alert */, 16)
2103 #define ADD_TRANSMIT_PADDING_TESTS(cipher_name, cipher_alg, key_size, \
2105 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2106 auth_alg, minor, padding_1) \
2107 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2108 auth_alg, minor, padding_2) \
2109 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2110 auth_alg, minor, padding_3) \
2111 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2112 auth_alg, minor, padding_4) \
2113 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2114 auth_alg, minor, padding_5) \
2115 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2116 auth_alg, minor, padding_6) \
2117 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2118 auth_alg, minor, padding_7) \
2119 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2120 auth_alg, minor, padding_8) \
2121 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2122 auth_alg, minor, padding_9) \
2123 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2124 auth_alg, minor, padding_10) \
2125 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2126 auth_alg, minor, padding_11) \
2127 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2128 auth_alg, minor, padding_12) \
2129 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2130 auth_alg, minor, padding_13) \
2131 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2132 auth_alg, minor, padding_14) \
2133 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2134 auth_alg, minor, padding_15) \
2135 ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size, \
2136 auth_alg, minor, padding_16)
2139 * For AES-CBC MTE cipher suites using padding, add tests of messages
2140 * with each possible padding size. Note that the padding_<N> tests
2141 * do not necessarily test <N> bytes of padding as the padding is a
2142 * function of the cipher suite's MAC length. However, cycling
2143 * through all of the payload sizes from 1 to 16 should exercise all
2144 * of the possible padding lengths for each suite.
2146 AES_CBC_TESTS(GEN_TRANSMIT_PADDING_TESTS);
2149 * Test "empty fragments" which are TLS records with no payload that
2150 * OpenSSL can send for TLS 1.0 connections.
2152 AES_CBC_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST);
2153 AES_GCM_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST);
2154 CHACHA20_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST);
2157 test_ktls_invalid_transmit_cipher_suite(const atf_tc_t *tc,
2158 struct tls_enable *en)
2162 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
2164 ATF_REQUIRE_ERRNO(EINVAL, setsockopt(sockets[1], IPPROTO_TCP,
2165 TCP_TXTLS_ENABLE, en, sizeof(*en)) == -1);
2167 close_sockets(sockets);
2170 #define GEN_INVALID_TRANSMIT_TEST(name, cipher_alg, key_size, auth_alg, \
2172 ATF_TC_WITHOUT_HEAD(ktls_transmit_invalid_##name); \
2173 ATF_TC_BODY(ktls_transmit_invalid_##name, tc) \
2175 struct tls_enable en; \
2178 ATF_REQUIRE_KTLS(); \
2180 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2182 test_ktls_invalid_transmit_cipher_suite(tc, &en); \
2183 free_tls_enable(&en); \
2186 #define ADD_INVALID_TRANSMIT_TEST(name, cipher_alg, key_size, auth_alg, \
2188 ATF_TP_ADD_TC(tp, ktls_transmit_invalid_##name);
2190 #define INVALID_CIPHER_SUITES(M) \
2191 M(aes128_cbc_1_0_sha256, CRYPTO_AES_CBC, 128 / 8, \
2192 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_ZERO) \
2193 M(aes128_cbc_1_0_sha384, CRYPTO_AES_CBC, 128 / 8, \
2194 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_ZERO) \
2195 M(aes128_gcm_1_0, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \
2196 TLS_MINOR_VER_ZERO) \
2197 M(chacha20_poly1305_1_0, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \
2198 TLS_MINOR_VER_ZERO) \
2199 M(aes128_cbc_1_1_sha256, CRYPTO_AES_CBC, 128 / 8, \
2200 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_ONE) \
2201 M(aes128_cbc_1_1_sha384, CRYPTO_AES_CBC, 128 / 8, \
2202 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_ONE) \
2203 M(aes128_gcm_1_1, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, \
2204 TLS_MINOR_VER_ONE) \
2205 M(chacha20_poly1305_1_1, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0, \
2206 TLS_MINOR_VER_ONE) \
2207 M(aes128_cbc_1_3_sha1, CRYPTO_AES_CBC, 128 / 8, \
2208 CRYPTO_SHA1_HMAC, TLS_MINOR_VER_THREE) \
2209 M(aes128_cbc_1_3_sha256, CRYPTO_AES_CBC, 128 / 8, \
2210 CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_THREE) \
2211 M(aes128_cbc_1_3_sha384, CRYPTO_AES_CBC, 128 / 8, \
2212 CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_THREE)
2215 * Ensure that invalid cipher suites are rejected for transmit.
2217 INVALID_CIPHER_SUITES(GEN_INVALID_TRANSMIT_TEST);
2219 #define GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2220 auth_alg, minor, name, len, padding) \
2221 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_##name); \
2222 ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \
2224 struct tls_enable en; \
2227 ATF_REQUIRE_KTLS(); \
2229 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2231 test_ktls_receive_app_data(tc, &en, seqno, len, padding); \
2232 free_tls_enable(&en); \
2235 #define ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2236 auth_alg, minor, name) \
2237 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name);
2239 #define GEN_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size, \
2240 auth_alg, minor, len) \
2241 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_data); \
2242 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_data, tc) \
2244 struct tls_enable en; \
2247 ATF_REQUIRE_KTLS(); \
2249 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2251 test_ktls_receive_corrupted_data(tc, &en, seqno, len); \
2252 free_tls_enable(&en); \
2255 #define ADD_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size, \
2257 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_data);
2259 #define GEN_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size, \
2260 auth_alg, minor, len) \
2261 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_mac); \
2262 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_mac, tc) \
2264 struct tls_enable en; \
2267 ATF_REQUIRE_KTLS(); \
2269 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2271 test_ktls_receive_corrupted_mac(tc, &en, seqno, len); \
2272 free_tls_enable(&en); \
2275 #define ADD_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size, \
2277 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_mac);
2279 #define GEN_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size, \
2280 auth_alg, minor, len) \
2281 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_truncated_record); \
2282 ATF_TC_BODY(ktls_receive_##cipher_name##_truncated_record, tc) \
2284 struct tls_enable en; \
2287 ATF_REQUIRE_KTLS(); \
2289 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2291 test_ktls_receive_truncated_record(tc, &en, seqno, len); \
2292 free_tls_enable(&en); \
2295 #define ADD_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size, \
2297 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_truncated_record);
2299 #define GEN_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size, \
2300 auth_alg, minor, len) \
2301 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_major); \
2302 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_major, tc) \
2304 struct tls_enable en; \
2307 ATF_REQUIRE_KTLS(); \
2309 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2311 test_ktls_receive_bad_major(tc, &en, seqno, len); \
2312 free_tls_enable(&en); \
2315 #define ADD_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size, \
2317 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_major);
2319 #define GEN_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size, \
2320 auth_alg, minor, len) \
2321 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_minor); \
2322 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_minor, tc) \
2324 struct tls_enable en; \
2327 ATF_REQUIRE_KTLS(); \
2329 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2331 test_ktls_receive_bad_minor(tc, &en, seqno, len); \
2332 free_tls_enable(&en); \
2335 #define ADD_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size, \
2337 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_minor);
2339 #define GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2340 auth_alg, minor, name, len) \
2341 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_##name); \
2342 ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc) \
2344 struct tls_enable en; \
2347 ATF_REQUIRE_KTLS(); \
2349 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2351 test_ktls_receive_bad_size(tc, &en, seqno, (len)); \
2352 free_tls_enable(&en); \
2355 #define ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2356 auth_alg, minor, name) \
2357 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name);
2359 #define GEN_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \
2361 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2362 auth_alg, minor, short, 64, 0) \
2363 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2364 auth_alg, minor, long, 64 * 1024, 0) \
2365 GEN_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size, \
2366 auth_alg, minor, 64) \
2367 GEN_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size, \
2368 auth_alg, minor, 64) \
2369 GEN_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size, \
2370 auth_alg, minor, 64) \
2371 GEN_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size, \
2372 auth_alg, minor, 64) \
2373 GEN_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size, \
2374 auth_alg, minor, 64) \
2375 GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2376 auth_alg, minor, small_record, \
2377 tls_minimum_record_payload(&en) - 1) \
2378 GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2379 auth_alg, minor, oversized_record, \
2380 TLS_MAX_MSG_SIZE_V10_2 * 2)
2382 #define ADD_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg, \
2384 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2385 auth_alg, minor, short) \
2386 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2387 auth_alg, minor, long) \
2388 ADD_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size, \
2390 ADD_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size, \
2392 ADD_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size, \
2394 ADD_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size, \
2396 ADD_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size, \
2398 ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2399 auth_alg, minor, small_record) \
2400 ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2401 auth_alg, minor, oversized_record)
2404 * For each supported cipher suite, run several receive tests:
2406 * - a short test which sends 64 bytes of application data (likely as
2407 * a single TLS record)
2409 * - a long test which sends 64KB of application data (split across
2410 * multiple TLS records)
2412 * - a test with corrupted payload data in a single TLS record
2414 * - a test with a corrupted MAC in a single TLS record
2416 * - a test with a truncated TLS record
2418 * - tests with invalid TLS major and minor versions
2420 * - a tests with a record whose is one less than the smallest valid
2423 * - a test with an oversized TLS record
2425 AES_CBC_NONZERO_TESTS(GEN_RECEIVE_TESTS);
2426 AES_GCM_TESTS(GEN_RECEIVE_TESTS);
2427 CHACHA20_TESTS(GEN_RECEIVE_TESTS);
2429 #define GEN_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg, \
2430 key_size, auth_alg, minor) \
2431 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2432 auth_alg, minor, padding_1, 1, 0) \
2433 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2434 auth_alg, minor, padding_2, 2, 0) \
2435 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2436 auth_alg, minor, padding_3, 3, 0) \
2437 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2438 auth_alg, minor, padding_4, 4, 0) \
2439 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2440 auth_alg, minor, padding_5, 5, 0) \
2441 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2442 auth_alg, minor, padding_6, 6, 0) \
2443 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2444 auth_alg, minor, padding_7, 7, 0) \
2445 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2446 auth_alg, minor, padding_8, 8, 0) \
2447 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2448 auth_alg, minor, padding_9, 9, 0) \
2449 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2450 auth_alg, minor, padding_10, 10, 0) \
2451 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2452 auth_alg, minor, padding_11, 11, 0) \
2453 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2454 auth_alg, minor, padding_12, 12, 0) \
2455 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2456 auth_alg, minor, padding_13, 13, 0) \
2457 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2458 auth_alg, minor, padding_14, 14, 0) \
2459 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2460 auth_alg, minor, padding_15, 15, 0) \
2461 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2462 auth_alg, minor, padding_16, 16, 0) \
2463 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2464 auth_alg, minor, padding_16_extra, 16, 16) \
2465 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2466 auth_alg, minor, padding_32_extra, 16, 32)
2468 #define ADD_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg, \
2469 key_size, auth_alg, minor) \
2470 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2471 auth_alg, minor, padding_1) \
2472 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2473 auth_alg, minor, padding_2) \
2474 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2475 auth_alg, minor, padding_3) \
2476 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2477 auth_alg, minor, padding_4) \
2478 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2479 auth_alg, minor, padding_5) \
2480 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2481 auth_alg, minor, padding_6) \
2482 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2483 auth_alg, minor, padding_7) \
2484 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2485 auth_alg, minor, padding_8) \
2486 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2487 auth_alg, minor, padding_9) \
2488 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2489 auth_alg, minor, padding_10) \
2490 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2491 auth_alg, minor, padding_11) \
2492 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2493 auth_alg, minor, padding_12) \
2494 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2495 auth_alg, minor, padding_13) \
2496 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2497 auth_alg, minor, padding_14) \
2498 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2499 auth_alg, minor, padding_15) \
2500 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2501 auth_alg, minor, padding_16) \
2502 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2503 auth_alg, minor, padding_16_extra) \
2504 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2505 auth_alg, minor, padding_32_extra)
2507 #define GEN_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size, \
2508 auth_alg, minor, len) \
2509 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_padding); \
2510 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_padding, tc) \
2512 struct tls_enable en; \
2515 ATF_REQUIRE_KTLS(); \
2517 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2519 test_ktls_receive_corrupted_padding(tc, &en, seqno, len); \
2520 free_tls_enable(&en); \
2523 #define ADD_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size, \
2525 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_padding);
2527 #define GEN_RECEIVE_MTE_TESTS(cipher_name, cipher_alg, key_size, \
2529 GEN_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg, \
2530 key_size, auth_alg, minor) \
2531 GEN_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size, \
2532 auth_alg, minor, 64) \
2533 GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2534 auth_alg, minor, non_block_size, \
2535 tls_minimum_record_payload(&en) + 1)
2537 #define ADD_RECEIVE_MTE_TESTS(cipher_name, cipher_alg, key_size, \
2539 ADD_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg, \
2540 key_size, auth_alg, minor) \
2541 ADD_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size, \
2543 ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2544 auth_alg, minor, non_block_size)
2547 * For AES-CBC MTE cipher suites using padding, add tests of messages
2548 * with each possible padding size. Note that the padding_<N> tests
2549 * do not necessarily test <N> bytes of padding as the padding is a
2550 * function of the cipher suite's MAC length. However, cycling
2551 * through all of the payload sizes from 1 to 16 should exercise all
2552 * of the possible padding lengths for each suite.
2554 * Two additional tests check for additional padding with an extra
2555 * 16 or 32 bytes beyond the normal padding.
2557 * Another test checks for corrupted padding.
2559 * Another test checks for a record whose payload is not a multiple of
2560 * the AES block size.
2562 AES_CBC_NONZERO_TESTS(GEN_RECEIVE_MTE_TESTS);
2564 #define GEN_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size, \
2566 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_iv); \
2567 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_iv, tc) \
2569 struct tls_enable en; \
2572 ATF_REQUIRE_KTLS(); \
2574 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2576 test_ktls_receive_corrupted_iv(tc, &en, seqno, 64); \
2577 free_tls_enable(&en); \
2580 #define ADD_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size, \
2582 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_iv);
2584 #define GEN_RECEIVE_EXPLICIT_IV_TESTS(cipher_name, cipher_alg, \
2585 key_size, auth_alg, minor) \
2586 GEN_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size, \
2588 GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2589 auth_alg, minor, short_header, \
2590 sizeof(struct tls_record_layer) + 1)
2592 #define ADD_RECEIVE_EXPLICIT_IV_TESTS(cipher_name, cipher_alg, \
2593 key_size, auth_alg, minor) \
2594 ADD_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size, \
2596 ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size, \
2597 auth_alg, minor, short_header)
2600 * For cipher suites with an explicit IV, run a receive test where the
2601 * explicit IV has been corrupted. Also run a receive test that sends
2602 * a short record without a complete IV.
2604 AES_CBC_NONZERO_TESTS(GEN_RECEIVE_EXPLICIT_IV_TESTS);
2605 AES_GCM_12_TESTS(GEN_RECEIVE_EXPLICIT_IV_TESTS);
2607 #define GEN_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size, \
2608 auth_alg, minor, len) \
2609 ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_type); \
2610 ATF_TC_BODY(ktls_receive_##cipher_name##_bad_type, tc) \
2612 struct tls_enable en; \
2615 ATF_REQUIRE_KTLS(); \
2617 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2619 test_ktls_receive_bad_type(tc, &en, seqno, len); \
2620 free_tls_enable(&en); \
2623 #define ADD_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size, \
2625 ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_type);
2627 #define GEN_RECEIVE_TLS13_TESTS(cipher_name, cipher_alg, key_size, \
2629 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2630 auth_alg, minor, short_padded, 64, 16) \
2631 GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2632 auth_alg, minor, long_padded, 64 * 1024, 15) \
2633 GEN_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size, \
2634 auth_alg, minor, 64)
2636 #define ADD_RECEIVE_TLS13_TESTS(cipher_name, cipher_alg, key_size, \
2638 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2639 auth_alg, minor, short_padded) \
2640 ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size, \
2641 auth_alg, minor, long_padded) \
2642 ADD_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size, \
2646 * For TLS 1.3 cipher suites, run two additional receive tests which
2647 * use add padding to each record. Also run a test that uses an
2648 * invalid "outer" record type.
2650 TLS_13_TESTS(GEN_RECEIVE_TLS13_TESTS);
2653 test_ktls_invalid_receive_cipher_suite(const atf_tc_t *tc,
2654 struct tls_enable *en)
2658 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
2660 ATF_REQUIRE_ERRNO(EINVAL, setsockopt(sockets[1], IPPROTO_TCP,
2661 TCP_RXTLS_ENABLE, en, sizeof(*en)) == -1);
2663 close_sockets(sockets);
2666 #define GEN_INVALID_RECEIVE_TEST(name, cipher_alg, key_size, auth_alg, \
2668 ATF_TC_WITHOUT_HEAD(ktls_receive_invalid_##name); \
2669 ATF_TC_BODY(ktls_receive_invalid_##name, tc) \
2671 struct tls_enable en; \
2674 ATF_REQUIRE_KTLS(); \
2676 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2678 test_ktls_invalid_receive_cipher_suite(tc, &en); \
2679 free_tls_enable(&en); \
2682 #define ADD_INVALID_RECEIVE_TEST(name, cipher_alg, key_size, auth_alg, \
2684 ATF_TP_ADD_TC(tp, ktls_receive_invalid_##name);
2687 * Ensure that invalid cipher suites are rejected for receive.
2689 INVALID_CIPHER_SUITES(GEN_INVALID_RECEIVE_TEST);
2692 test_ktls_unsupported_receive_cipher_suite(const atf_tc_t *tc,
2693 struct tls_enable *en)
2697 ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
2699 ATF_REQUIRE_ERRNO(EPROTONOSUPPORT, setsockopt(sockets[1], IPPROTO_TCP,
2700 TCP_RXTLS_ENABLE, en, sizeof(*en)) == -1);
2702 close_sockets(sockets);
2705 #define GEN_UNSUPPORTED_RECEIVE_TEST(name, cipher_alg, key_size, \
2707 ATF_TC_WITHOUT_HEAD(ktls_receive_unsupported_##name); \
2708 ATF_TC_BODY(ktls_receive_unsupported_##name, tc) \
2710 struct tls_enable en; \
2713 ATF_REQUIRE_KTLS(); \
2715 build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor, \
2717 test_ktls_unsupported_receive_cipher_suite(tc, &en); \
2718 free_tls_enable(&en); \
2721 #define ADD_UNSUPPORTED_RECEIVE_TEST(name, cipher_alg, key_size, \
2723 ATF_TP_ADD_TC(tp, ktls_receive_unsupported_##name);
2726 * Ensure that valid cipher suites not supported for receive are
2729 TLS_10_TESTS(GEN_UNSUPPORTED_RECEIVE_TEST);
2732 * Try to perform an invalid sendto(2) on a TXTLS-enabled socket, to exercise
2733 * KTLS error handling in the socket layer.
2735 ATF_TC_WITHOUT_HEAD(ktls_sendto_baddst);
2736 ATF_TC_BODY(ktls_sendto_baddst, tc)
2739 struct sockaddr_in dst;
2740 struct tls_enable en;
2746 s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
2747 ATF_REQUIRE(s >= 0);
2749 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
2750 TLS_MINOR_VER_THREE, (uint64_t)random(), &en);
2752 ATF_REQUIRE(setsockopt(s, IPPROTO_TCP, TCP_TXTLS_ENABLE, &en,
2755 memset(&dst, 0, sizeof(dst));
2756 dst.sin_family = AF_INET;
2757 dst.sin_len = sizeof(dst);
2758 dst.sin_addr.s_addr = htonl(INADDR_BROADCAST);
2759 dst.sin_port = htons(12345);
2761 memset(buf, 0, sizeof(buf));
2762 n = sendto(s, buf, sizeof(buf), 0, (struct sockaddr *)&dst,
2765 /* Can't transmit to the broadcast address over TCP. */
2766 ATF_REQUIRE_ERRNO(EACCES, n == -1);
2767 ATF_REQUIRE(close(s) == 0);
2771 * Make sure that listen(2) returns an error for KTLS-enabled sockets, and
2772 * verify that an attempt to enable KTLS on a listening socket fails.
2774 ATF_TC_WITHOUT_HEAD(ktls_listening_socket);
2775 ATF_TC_BODY(ktls_listening_socket, tc)
2777 struct tls_enable en;
2778 struct sockaddr_in sin;
2783 s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
2784 ATF_REQUIRE(s >= 0);
2785 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
2786 TLS_MINOR_VER_THREE, (uint64_t)random(), &en);
2787 ATF_REQUIRE(setsockopt(s, IPPROTO_TCP, TCP_TXTLS_ENABLE, &en,
2789 ATF_REQUIRE_ERRNO(EINVAL, listen(s, 1) == -1);
2790 ATF_REQUIRE(close(s) == 0);
2792 s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
2793 ATF_REQUIRE(s >= 0);
2794 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
2795 TLS_MINOR_VER_THREE, (uint64_t)random(), &en);
2796 ATF_REQUIRE(setsockopt(s, IPPROTO_TCP, TCP_RXTLS_ENABLE, &en,
2798 ATF_REQUIRE_ERRNO(EINVAL, listen(s, 1) == -1);
2799 ATF_REQUIRE(close(s) == 0);
2801 s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
2802 ATF_REQUIRE(s >= 0);
2803 memset(&sin, 0, sizeof(sin));
2804 sin.sin_family = AF_INET;
2805 sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
2806 ATF_REQUIRE(bind(s, (struct sockaddr *)&sin, sizeof(sin)) == 0);
2807 ATF_REQUIRE(listen(s, 1) == 0);
2808 build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
2809 TLS_MINOR_VER_THREE, (uint64_t)random(), &en);
2810 ATF_REQUIRE_ERRNO(ENOTCONN,
2811 setsockopt(s, IPPROTO_TCP, TCP_TXTLS_ENABLE, &en, sizeof(en)) != 0);
2812 ATF_REQUIRE_ERRNO(EINVAL,
2813 setsockopt(s, IPPROTO_TCP, TCP_RXTLS_ENABLE, &en, sizeof(en)) != 0);
2814 ATF_REQUIRE(close(s) == 0);
2819 /* Transmit tests */
2820 AES_CBC_TESTS(ADD_TRANSMIT_TESTS);
2821 AES_GCM_TESTS(ADD_TRANSMIT_TESTS);
2822 CHACHA20_TESTS(ADD_TRANSMIT_TESTS);
2823 AES_CBC_TESTS(ADD_TRANSMIT_PADDING_TESTS);
2824 AES_CBC_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST);
2825 AES_GCM_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST);
2826 CHACHA20_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST);
2827 INVALID_CIPHER_SUITES(ADD_INVALID_TRANSMIT_TEST);
2830 TLS_10_TESTS(ADD_UNSUPPORTED_RECEIVE_TEST);
2831 AES_CBC_NONZERO_TESTS(ADD_RECEIVE_TESTS);
2832 AES_GCM_TESTS(ADD_RECEIVE_TESTS);
2833 CHACHA20_TESTS(ADD_RECEIVE_TESTS);
2834 AES_CBC_NONZERO_TESTS(ADD_RECEIVE_MTE_TESTS);
2835 AES_CBC_NONZERO_TESTS(ADD_RECEIVE_EXPLICIT_IV_TESTS);
2836 AES_GCM_12_TESTS(ADD_RECEIVE_EXPLICIT_IV_TESTS);
2837 TLS_13_TESTS(ADD_RECEIVE_TLS13_TESTS);
2838 INVALID_CIPHER_SUITES(ADD_INVALID_RECEIVE_TEST);
2841 ATF_TP_ADD_TC(tp, ktls_sendto_baddst);
2842 ATF_TP_ADD_TC(tp, ktls_listening_socket);
2844 return (atf_no_error());