CoCalc -- ktls

GitHub Repository: freebsd/freebsd-src
Path: blob/main/tests/sys/kern/ktls_test.c
³⁹⁵³⁶ views
1
/*-
2
 * SPDX-License-Identifier: BSD-2-Clause
3
 *
4
 * Copyright (c) 2021 Netflix Inc.
5
 * Written by: John Baldwin <[email protected]>
6
 *
7
 * Redistribution and use in source and binary forms, with or without
8
 * modification, are permitted provided that the following conditions
9
 * are met:
10
 * 1. Redistributions of source code must retain the above copyright
11
 *    notice, this list of conditions and the following disclaimer.
12
 * 2. Redistributions in binary form must reproduce the above copyright
13
 *    notice, this list of conditions and the following disclaimer in the
14
 *    documentation and/or other materials provided with the distribution.
15
 *
16
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26
 * SUCH DAMAGE.
27
 */
28

29
#include <sys/param.h>
30
#include <sys/endian.h>
31
#include <sys/event.h>
32
#include <sys/ktls.h>
33
#include <sys/socket.h>
34
#include <sys/sysctl.h>
35
#include <netinet/in.h>
36
#include <netinet/tcp.h>
37
#include <crypto/cryptodev.h>
38
#include <assert.h>
39
#include <err.h>
40
#include <fcntl.h>
41
#include <libutil.h>
42
#include <netdb.h>
43
#include <poll.h>
44
#include <stdbool.h>
45
#include <stdlib.h>
46
#include <atf-c.h>
47

48
#include <openssl/err.h>
49
#include <openssl/evp.h>
50
#include <openssl/hmac.h>
51

52
static void
53
require_ktls(void)
54
{
55
	size_t len;
56
	bool enable;
57

58
	len = sizeof(enable);
59
	if (sysctlbyname("kern.ipc.tls.enable", &enable, &len, NULL, 0) == -1) {
60
		if (errno == ENOENT)
61
			atf_tc_skip("kernel does not support TLS offload");
62
		atf_libc_error(errno, "Failed to read kern.ipc.tls.enable");
63
	}
64

65
	if (!enable)
66
		atf_tc_skip("Kernel TLS is disabled");
67
}
68

69
#define	ATF_REQUIRE_KTLS()	require_ktls()
70

71
static void
72
check_tls_mode(const atf_tc_t *tc, int s, int sockopt)
73
{
74
	if (atf_tc_get_config_var_as_bool_wd(tc, "ktls.require_ifnet", false)) {
75
		socklen_t len;
76
		int mode;
77

78
		len = sizeof(mode);
79
		if (getsockopt(s, IPPROTO_TCP, sockopt, &mode, &len) == -1)
80
			atf_libc_error(errno, "Failed to fetch TLS mode");
81

82
		if (mode != TCP_TLS_MODE_IFNET)
83
			atf_tc_skip("connection did not use ifnet TLS");
84
	}
85

86
	if (atf_tc_get_config_var_as_bool_wd(tc, "ktls.require_toe", false)) {
87
		socklen_t len;
88
		int mode;
89

90
		len = sizeof(mode);
91
		if (getsockopt(s, IPPROTO_TCP, sockopt, &mode, &len) == -1)
92
			atf_libc_error(errno, "Failed to fetch TLS mode");
93

94
		if (mode != TCP_TLS_MODE_TOE)
95
			atf_tc_skip("connection did not use TOE TLS");
96
	}
97
}
98

99
static void __printflike(2, 3)
100
debug(const atf_tc_t *tc, const char *fmt, ...)
101
{
102
	if (!atf_tc_get_config_var_as_bool_wd(tc, "ktls.debug", false))
103
		return;
104

105
	va_list ap;
106
	va_start(ap, fmt);
107
	vprintf(fmt, ap);
108
	va_end(ap);
109
}
110

111
static void
112
debug_hexdump(const atf_tc_t *tc, const void *buf, int length,
113
    const char *label)
114
{
115
	if (!atf_tc_get_config_var_as_bool_wd(tc, "ktls.debug", false))
116
		return;
117

118
	if (label != NULL)
119
		printf("%s:\n", label);
120
	hexdump(buf, length, NULL, 0);
121
}
122

123
static char
124
rdigit(void)
125
{
126
	/* ASCII printable values between 0x20 and 0x7e */
127
	return (0x20 + random() % (0x7f - 0x20));
128
}
129

130
static char *
131
alloc_buffer(size_t len)
132
{
133
	char *buf;
134
	size_t i;
135

136
	if (len == 0)
137
		return (NULL);
138
	buf = malloc(len);
139
	for (i = 0; i < len; i++)
140
		buf[i] = rdigit();
141
	return (buf);
142
}
143

144
static bool
145
socketpair_tcp(int sv[2])
146
{
147
	struct pollfd pfd;
148
	struct sockaddr_in sin;
149
	socklen_t len;
150
	int as, cs, ls;
151

152
	ls = socket(PF_INET, SOCK_STREAM, 0);
153
	if (ls == -1) {
154
		warn("socket() for listen");
155
		return (false);
156
	}
157

158
	memset(&sin, 0, sizeof(sin));
159
	sin.sin_len = sizeof(sin);
160
	sin.sin_family = AF_INET;
161
	sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
162
	if (bind(ls, (struct sockaddr *)&sin, sizeof(sin)) == -1) {
163
		warn("bind");
164
		close(ls);
165
		return (false);
166
	}
167

168
	if (listen(ls, 1) == -1) {
169
		warn("listen");
170
		close(ls);
171
		return (false);
172
	}
173

174
	len = sizeof(sin);
175
	if (getsockname(ls, (struct sockaddr *)&sin, &len) == -1) {
176
		warn("getsockname");
177
		close(ls);
178
		return (false);
179
	}
180

181
	cs = socket(PF_INET, SOCK_STREAM | SOCK_NONBLOCK, 0);
182
	if (cs == -1) {
183
		warn("socket() for connect");
184
		close(ls);
185
		return (false);
186
	}
187

188
	if (connect(cs, (struct sockaddr *)&sin, sizeof(sin)) == -1) {
189
		if (errno != EINPROGRESS) {
190
			warn("connect");
191
			close(ls);
192
			close(cs);
193
			return (false);
194
		}
195
	}
196

197
	as = accept4(ls, NULL, NULL, SOCK_NONBLOCK);
198
	if (as == -1) {
199
		warn("accept4");
200
		close(ls);
201
		close(cs);
202
		return (false);
203
	}
204

205
	close(ls);
206

207
	pfd.fd = cs;
208
	pfd.events = POLLOUT;
209
	pfd.revents = 0;
210
	ATF_REQUIRE_INTEQ(1, poll(&pfd, 1, INFTIM));
211
	ATF_REQUIRE_INTEQ(POLLOUT, pfd.revents);
212

213
	sv[0] = cs;
214
	sv[1] = as;
215
	return (true);
216
}
217

218
static bool
219
echo_socket(const atf_tc_t *tc, int sv[2])
220
{
221
	const char *cause, *host, *port;
222
	struct addrinfo hints, *ai, *tofree;
223
	int error, flags, s;
224

225
	host = atf_tc_get_config_var(tc, "ktls.host");
226
	port = atf_tc_get_config_var_wd(tc, "ktls.port", "echo");
227
	memset(&hints, 0, sizeof(hints));
228
	hints.ai_family = AF_UNSPEC;
229
	hints.ai_socktype = SOCK_STREAM;
230
	hints.ai_protocol = IPPROTO_TCP;
231
	error = getaddrinfo(host, port, &hints, &tofree);
232
	if (error != 0) {
233
		warnx("getaddrinfo(%s:%s) failed: %s", host, port,
234
		    gai_strerror(error));
235
		return (false);
236
	}
237

238
	cause = NULL;
239
	for (ai = tofree; ai != NULL; ai = ai->ai_next) {
240
		s = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
241
		if (s == -1) {
242
			cause = "socket";
243
			error = errno;
244
			continue;
245
		}
246

247
		if (connect(s, ai->ai_addr, ai->ai_addrlen) == -1) {
248
			cause = "connect";
249
			error = errno;
250
			close(s);
251
			continue;
252
		}
253

254
		freeaddrinfo(tofree);
255

256
		ATF_REQUIRE((flags = fcntl(s, F_GETFL)) != -1);
257
		flags |= O_NONBLOCK;
258
		ATF_REQUIRE(fcntl(s, F_SETFL, flags) != -1);
259

260
		sv[0] = s;
261
		sv[1] = s;
262
		return (true);
263
	}
264

265
	warnc(error, "%s", cause);
266
	freeaddrinfo(tofree);
267
	return (false);
268
}
269

270
static bool
271
open_sockets(const atf_tc_t *tc, int sv[2])
272
{
273
	if (atf_tc_has_config_var(tc, "ktls.host"))
274
		return (echo_socket(tc, sv));
275
	else
276
		return (socketpair_tcp(sv));
277
}
278

279
static void
280
close_sockets(int sv[2])
281
{
282
	if (sv[0] != sv[1])
283
		ATF_REQUIRE(close(sv[1]) == 0);
284
	ATF_REQUIRE(close(sv[0]) == 0);
285
}
286

287
static void
288
close_sockets_ignore_errors(int sv[2])
289
{
290
	if (sv[0] != sv[1])
291
		close(sv[1]);
292
	close(sv[0]);
293
}
294

295
static void
296
fd_set_blocking(int fd)
297
{
298
	int flags;
299

300
	ATF_REQUIRE((flags = fcntl(fd, F_GETFL)) != -1);
301
	flags &= ~O_NONBLOCK;
302
	ATF_REQUIRE(fcntl(fd, F_SETFL, flags) != -1);
303
}
304

305
static bool
306
cbc_crypt(const EVP_CIPHER *cipher, const char *key, const char *iv,
307
    const char *input, char *output, size_t size, int enc)
308
{
309
	EVP_CIPHER_CTX *ctx;
310
	int outl, total;
311

312
	ctx = EVP_CIPHER_CTX_new();
313
	if (ctx == NULL) {
314
		warnx("EVP_CIPHER_CTX_new failed: %s",
315
		    ERR_error_string(ERR_get_error(), NULL));
316
		return (false);
317
	}
318
	if (EVP_CipherInit_ex(ctx, cipher, NULL, (const u_char *)key,
319
	    (const u_char *)iv, enc) != 1) {
320
		warnx("EVP_CipherInit_ex failed: %s",
321
		    ERR_error_string(ERR_get_error(), NULL));
322
		EVP_CIPHER_CTX_free(ctx);
323
		return (false);
324
	}
325
	EVP_CIPHER_CTX_set_padding(ctx, 0);
326
	if (EVP_CipherUpdate(ctx, (u_char *)output, &outl,
327
	    (const u_char *)input, size) != 1) {
328
		warnx("EVP_CipherUpdate failed: %s",
329
		    ERR_error_string(ERR_get_error(), NULL));
330
		EVP_CIPHER_CTX_free(ctx);
331
		return (false);
332
	}
333
	total = outl;
334
	if (EVP_CipherFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) {
335
		warnx("EVP_CipherFinal_ex failed: %s",
336
		    ERR_error_string(ERR_get_error(), NULL));
337
		EVP_CIPHER_CTX_free(ctx);
338
		return (false);
339
	}
340
	total += outl;
341
	if ((size_t)total != size) {
342
		warnx("decrypt size mismatch: %zu vs %d", size, total);
343
		EVP_CIPHER_CTX_free(ctx);
344
		return (false);
345
	}
346
	EVP_CIPHER_CTX_free(ctx);
347
	return (true);
348
}
349

350
static bool
351
cbc_encrypt(const EVP_CIPHER *cipher, const char *key, const char *iv,
352
    const char *input, char *output, size_t size)
353
{
354
	return (cbc_crypt(cipher, key, iv, input, output, size, 1));
355
}
356

357
static bool
358
cbc_decrypt(const EVP_CIPHER *cipher, const char *key, const char *iv,
359
    const char *input, char *output, size_t size)
360
{
361
	return (cbc_crypt(cipher, key, iv, input, output, size, 0));
362
}
363

364
static bool
365
compute_hash(const EVP_MD *md, const void *key, size_t key_len, const void *aad,
366
    size_t aad_len, const void *buffer, size_t len, void *digest,
367
    u_int *digest_len)
368
{
369
	HMAC_CTX *ctx;
370

371
	ctx = HMAC_CTX_new();
372
	if (ctx == NULL) {
373
		warnx("HMAC_CTX_new failed: %s",
374
		    ERR_error_string(ERR_get_error(), NULL));
375
		return (false);
376
	}
377
	if (HMAC_Init_ex(ctx, key, key_len, md, NULL) != 1) {
378
		warnx("HMAC_Init_ex failed: %s",
379
		    ERR_error_string(ERR_get_error(), NULL));
380
		HMAC_CTX_free(ctx);
381
		return (false);
382
	}
383
	if (HMAC_Update(ctx, aad, aad_len) != 1) {
384
		warnx("HMAC_Update (aad) failed: %s",
385
		    ERR_error_string(ERR_get_error(), NULL));
386
		HMAC_CTX_free(ctx);
387
		return (false);
388
	}
389
	if (HMAC_Update(ctx, buffer, len) != 1) {
390
		warnx("HMAC_Update (payload) failed: %s",
391
		    ERR_error_string(ERR_get_error(), NULL));
392
		HMAC_CTX_free(ctx);
393
		return (false);
394
	}
395
	if (HMAC_Final(ctx, digest, digest_len) != 1) {
396
		warnx("HMAC_Final failed: %s",
397
		    ERR_error_string(ERR_get_error(), NULL));
398
		HMAC_CTX_free(ctx);
399
		return (false);
400
	}
401
	HMAC_CTX_free(ctx);
402
	return (true);
403
}
404

405
static bool
406
verify_hash(const EVP_MD *md, const void *key, size_t key_len, const void *aad,
407
    size_t aad_len, const void *buffer, size_t len, const void *digest)
408
{
409
	unsigned char digest2[EVP_MAX_MD_SIZE];
410
	u_int digest_len;
411

412
	if (!compute_hash(md, key, key_len, aad, aad_len, buffer, len, digest2,
413
	    &digest_len))
414
		return (false);
415
	if (memcmp(digest, digest2, digest_len) != 0) {
416
		warnx("HMAC mismatch");
417
		return (false);
418
	}
419
	return (true);
420
}
421

422
static bool
423
aead_encrypt(const EVP_CIPHER *cipher, const char *key, const char *nonce,
424
    const void *aad, size_t aad_len, const char *input, char *output,
425
    size_t size, char *tag, size_t tag_len)
426
{
427
	EVP_CIPHER_CTX *ctx;
428
	int outl, total;
429

430
	ctx = EVP_CIPHER_CTX_new();
431
	if (ctx == NULL) {
432
		warnx("EVP_CIPHER_CTX_new failed: %s",
433
		    ERR_error_string(ERR_get_error(), NULL));
434
		return (false);
435
	}
436
	if (EVP_EncryptInit_ex(ctx, cipher, NULL, (const u_char *)key,
437
	    (const u_char *)nonce) != 1) {
438
		warnx("EVP_EncryptInit_ex failed: %s",
439
		    ERR_error_string(ERR_get_error(), NULL));
440
		EVP_CIPHER_CTX_free(ctx);
441
		return (false);
442
	}
443
	EVP_CIPHER_CTX_set_padding(ctx, 0);
444
	if (aad != NULL) {
445
		if (EVP_EncryptUpdate(ctx, NULL, &outl, (const u_char *)aad,
446
		    aad_len) != 1) {
447
			warnx("EVP_EncryptUpdate for AAD failed: %s",
448
			    ERR_error_string(ERR_get_error(), NULL));
449
			EVP_CIPHER_CTX_free(ctx);
450
			return (false);
451
		}
452
	}
453
	if (EVP_EncryptUpdate(ctx, (u_char *)output, &outl,
454
	    (const u_char *)input, size) != 1) {
455
		warnx("EVP_EncryptUpdate failed: %s",
456
		    ERR_error_string(ERR_get_error(), NULL));
457
		EVP_CIPHER_CTX_free(ctx);
458
		return (false);
459
	}
460
	total = outl;
461
	if (EVP_EncryptFinal_ex(ctx, (u_char *)output + outl, &outl) != 1) {
462
		warnx("EVP_EncryptFinal_ex failed: %s",
463
		    ERR_error_string(ERR_get_error(), NULL));
464
		EVP_CIPHER_CTX_free(ctx);
465
		return (false);
466
	}
467
	total += outl;
468
	if ((size_t)total != size) {
469
		warnx("encrypt size mismatch: %zu vs %d", size, total);
470
		EVP_CIPHER_CTX_free(ctx);
471
		return (false);
472
	}
473
	if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, tag_len, tag) !=
474
	    1) {
475
		warnx("EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_GET_TAG) failed: %s",
476
		    ERR_error_string(ERR_get_error(), NULL));
477
		EVP_CIPHER_CTX_free(ctx);
478
		return (false);
479
	}
480
	EVP_CIPHER_CTX_free(ctx);
481
	return (true);
482
}
483

484
static bool
485
aead_decrypt(const EVP_CIPHER *cipher, const char *key, const char *nonce,
486
    const void *aad, size_t aad_len, const char *input, char *output,
487
    size_t size, const char *tag, size_t tag_len)
488
{
489
	EVP_CIPHER_CTX *ctx;
490
	int outl, total;
491
	bool valid;
492

493
	ctx = EVP_CIPHER_CTX_new();
494
	if (ctx == NULL) {
495
		warnx("EVP_CIPHER_CTX_new failed: %s",
496
		    ERR_error_string(ERR_get_error(), NULL));
497
		return (false);
498
	}
499
	if (EVP_DecryptInit_ex(ctx, cipher, NULL, (const u_char *)key,
500
	    (const u_char *)nonce) != 1) {
501
		warnx("EVP_DecryptInit_ex failed: %s",
502
		    ERR_error_string(ERR_get_error(), NULL));
503
		EVP_CIPHER_CTX_free(ctx);
504
		return (false);
505
	}
506
	EVP_CIPHER_CTX_set_padding(ctx, 0);
507
	if (aad != NULL) {
508
		if (EVP_DecryptUpdate(ctx, NULL, &outl, (const u_char *)aad,
509
		    aad_len) != 1) {
510
			warnx("EVP_DecryptUpdate for AAD failed: %s",
511
			    ERR_error_string(ERR_get_error(), NULL));
512
			EVP_CIPHER_CTX_free(ctx);
513
			return (false);
514
		}
515
	}
516
	if (EVP_DecryptUpdate(ctx, (u_char *)output, &outl,
517
	    (const u_char *)input, size) != 1) {
518
		warnx("EVP_DecryptUpdate failed: %s",
519
		    ERR_error_string(ERR_get_error(), NULL));
520
		EVP_CIPHER_CTX_free(ctx);
521
		return (false);
522
	}
523
	total = outl;
524
	if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, tag_len,
525
	    __DECONST(char *, tag)) != 1) {
526
		warnx("EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_SET_TAG) failed: %s",
527
		    ERR_error_string(ERR_get_error(), NULL));
528
		EVP_CIPHER_CTX_free(ctx);
529
		return (false);
530
	}
531
	valid = (EVP_DecryptFinal_ex(ctx, (u_char *)output + outl, &outl) == 1);
532
	total += outl;
533
	if ((size_t)total != size) {
534
		warnx("decrypt size mismatch: %zu vs %d", size, total);
535
		EVP_CIPHER_CTX_free(ctx);
536
		return (false);
537
	}
538
	if (!valid)
539
		warnx("tag mismatch");
540
	EVP_CIPHER_CTX_free(ctx);
541
	return (valid);
542
}
543

544
static void
545
build_tls_enable(const atf_tc_t *tc, int cipher_alg, size_t cipher_key_len,
546
    int auth_alg, int minor, uint64_t seqno, struct tls_enable *en)
547
{
548
	u_int auth_key_len, iv_len;
549

550
	memset(en, 0, sizeof(*en));
551

552
	switch (cipher_alg) {
553
	case CRYPTO_AES_CBC:
554
		if (minor == TLS_MINOR_VER_ZERO)
555
			iv_len = AES_BLOCK_LEN;
556
		else
557
			iv_len = 0;
558
		break;
559
	case CRYPTO_AES_NIST_GCM_16:
560
		if (minor == TLS_MINOR_VER_TWO)
561
			iv_len = TLS_AEAD_GCM_LEN;
562
		else
563
			iv_len = TLS_1_3_GCM_IV_LEN;
564
		break;
565
	case CRYPTO_CHACHA20_POLY1305:
566
		iv_len = TLS_CHACHA20_IV_LEN;
567
		break;
568
	default:
569
		iv_len = 0;
570
		break;
571
	}
572
	switch (auth_alg) {
573
	case CRYPTO_SHA1_HMAC:
574
		auth_key_len = SHA1_HASH_LEN;
575
		break;
576
	case CRYPTO_SHA2_256_HMAC:
577
		auth_key_len = SHA2_256_HASH_LEN;
578
		break;
579
	case CRYPTO_SHA2_384_HMAC:
580
		auth_key_len = SHA2_384_HASH_LEN;
581
		break;
582
	default:
583
		auth_key_len = 0;
584
		break;
585
	}
586
	en->cipher_key = alloc_buffer(cipher_key_len);
587
	debug_hexdump(tc, en->cipher_key, cipher_key_len, "cipher key");
588
	en->iv = alloc_buffer(iv_len);
589
	if (iv_len != 0)
590
		debug_hexdump(tc, en->iv, iv_len, "iv");
591
	en->auth_key = alloc_buffer(auth_key_len);
592
	if (auth_key_len != 0)
593
		debug_hexdump(tc, en->auth_key, auth_key_len, "auth key");
594
	en->cipher_algorithm = cipher_alg;
595
	en->cipher_key_len = cipher_key_len;
596
	en->iv_len = iv_len;
597
	en->auth_algorithm = auth_alg;
598
	en->auth_key_len = auth_key_len;
599
	en->tls_vmajor = TLS_MAJOR_VER_ONE;
600
	en->tls_vminor = minor;
601
	be64enc(en->rec_seq, seqno);
602
	debug(tc, "seqno: %ju\n", (uintmax_t)seqno);
603
}
604

605
static void
606
free_tls_enable(struct tls_enable *en)
607
{
608
	free(__DECONST(void *, en->cipher_key));
609
	free(__DECONST(void *, en->iv));
610
	free(__DECONST(void *, en->auth_key));
611
}
612

613
static const EVP_CIPHER *
614
tls_EVP_CIPHER(const struct tls_enable *en)
615
{
616
	switch (en->cipher_algorithm) {
617
	case CRYPTO_AES_CBC:
618
		switch (en->cipher_key_len) {
619
		case 128 / 8:
620
			return (EVP_aes_128_cbc());
621
		case 256 / 8:
622
			return (EVP_aes_256_cbc());
623
		default:
624
			return (NULL);
625
		}
626
		break;
627
	case CRYPTO_AES_NIST_GCM_16:
628
		switch (en->cipher_key_len) {
629
		case 128 / 8:
630
			return (EVP_aes_128_gcm());
631
		case 256 / 8:
632
			return (EVP_aes_256_gcm());
633
		default:
634
			return (NULL);
635
		}
636
		break;
637
	case CRYPTO_CHACHA20_POLY1305:
638
		return (EVP_chacha20_poly1305());
639
	default:
640
		return (NULL);
641
	}
642
}
643

644
static const EVP_MD *
645
tls_EVP_MD(const struct tls_enable *en)
646
{
647
	switch (en->auth_algorithm) {
648
	case CRYPTO_SHA1_HMAC:
649
		return (EVP_sha1());
650
	case CRYPTO_SHA2_256_HMAC:
651
		return (EVP_sha256());
652
	case CRYPTO_SHA2_384_HMAC:
653
		return (EVP_sha384());
654
	default:
655
		return (NULL);
656
	}
657
}
658

659
static size_t
660
tls_header_len(struct tls_enable *en)
661
{
662
	size_t len;
663

664
	len = sizeof(struct tls_record_layer);
665
	switch (en->cipher_algorithm) {
666
	case CRYPTO_AES_CBC:
667
		if (en->tls_vminor != TLS_MINOR_VER_ZERO)
668
			len += AES_BLOCK_LEN;
669
		return (len);
670
	case CRYPTO_AES_NIST_GCM_16:
671
		if (en->tls_vminor == TLS_MINOR_VER_TWO)
672
			len += sizeof(uint64_t);
673
		return (len);
674
	case CRYPTO_CHACHA20_POLY1305:
675
		return (len);
676
	default:
677
		return (0);
678
	}
679
}
680

681
static size_t
682
tls_mac_len(struct tls_enable *en)
683
{
684
	switch (en->cipher_algorithm) {
685
	case CRYPTO_AES_CBC:
686
		switch (en->auth_algorithm) {
687
		case CRYPTO_SHA1_HMAC:
688
			return (SHA1_HASH_LEN);
689
		case CRYPTO_SHA2_256_HMAC:
690
			return (SHA2_256_HASH_LEN);
691
		case CRYPTO_SHA2_384_HMAC:
692
			return (SHA2_384_HASH_LEN);
693
		default:
694
			return (0);
695
		}
696
	case CRYPTO_AES_NIST_GCM_16:
697
		return (AES_GMAC_HASH_LEN);
698
	case CRYPTO_CHACHA20_POLY1305:
699
		return (POLY1305_HASH_LEN);
700
	default:
701
		return (0);
702
	}
703
}
704

705
/* Includes maximum padding for MTE. */
706
static size_t
707
tls_trailer_len(struct tls_enable *en)
708
{
709
	size_t len;
710

711
	len = tls_mac_len(en);
712
	if (en->cipher_algorithm == CRYPTO_AES_CBC)
713
		len += AES_BLOCK_LEN;
714
	if (en->tls_vminor == TLS_MINOR_VER_THREE)
715
		len++;
716
	return (len);
717
}
718

719
/* Minimum valid record payload size for a given cipher suite. */
720
static size_t
721
tls_minimum_record_payload(struct tls_enable *en)
722
{
723
	size_t len;
724

725
	len = tls_header_len(en);
726
	if (en->cipher_algorithm == CRYPTO_AES_CBC)
727
		len += roundup2(tls_mac_len(en) + 1, AES_BLOCK_LEN);
728
	else
729
		len += tls_mac_len(en);
730
	if (en->tls_vminor == TLS_MINOR_VER_THREE)
731
		len++;
732
	return (len - sizeof(struct tls_record_layer));
733
}
734

735
/* 'len' is the length of the payload application data. */
736
static void
737
tls_mte_aad(struct tls_enable *en, size_t len,
738
    const struct tls_record_layer *hdr, uint64_t seqno, struct tls_mac_data *ad)
739
{
740
	ad->seq = htobe64(seqno);
741
	ad->type = hdr->tls_type;
742
	ad->tls_vmajor = hdr->tls_vmajor;
743
	ad->tls_vminor = hdr->tls_vminor;
744
	ad->tls_length = htons(len);
745
}
746

747
static void
748
tls_12_aead_aad(struct tls_enable *en, size_t len,
749
    const struct tls_record_layer *hdr, uint64_t seqno,
750
    struct tls_aead_data *ad)
751
{
752
	ad->seq = htobe64(seqno);
753
	ad->type = hdr->tls_type;
754
	ad->tls_vmajor = hdr->tls_vmajor;
755
	ad->tls_vminor = hdr->tls_vminor;
756
	ad->tls_length = htons(len);
757
}
758

759
static void
760
tls_13_aad(struct tls_enable *en, const struct tls_record_layer *hdr,
761
    uint64_t seqno, struct tls_aead_data_13 *ad)
762
{
763
	ad->type = hdr->tls_type;
764
	ad->tls_vmajor = hdr->tls_vmajor;
765
	ad->tls_vminor = hdr->tls_vminor;
766
	ad->tls_length = hdr->tls_length;
767
}
768

769
static void
770
tls_12_gcm_nonce(struct tls_enable *en, const struct tls_record_layer *hdr,
771
    char *nonce)
772
{
773
	memcpy(nonce, en->iv, TLS_AEAD_GCM_LEN);
774
	memcpy(nonce + TLS_AEAD_GCM_LEN, hdr + 1, sizeof(uint64_t));
775
}
776

777
static void
778
tls_13_nonce(struct tls_enable *en, uint64_t seqno, char *nonce)
779
{
780
	static_assert(TLS_1_3_GCM_IV_LEN == TLS_CHACHA20_IV_LEN,
781
	    "TLS 1.3 nonce length mismatch");
782
	memcpy(nonce, en->iv, TLS_1_3_GCM_IV_LEN);
783
	*(uint64_t *)(nonce + 4) ^= htobe64(seqno);
784
}
785

786
/*
787
 * Decrypt a TLS record 'len' bytes long at 'src' and store the result at
788
 * 'dst'.  If the TLS record header length doesn't match or 'dst' doesn't
789
 * have sufficient room ('avail'), fail the test.
790
 */
791
static size_t
792
decrypt_tls_aes_cbc_mte(const atf_tc_t *tc, struct tls_enable *en,
793
    uint64_t seqno, const void *src, size_t len, void *dst, size_t avail,
794
    uint8_t *record_type)
795
{
796
	const struct tls_record_layer *hdr;
797
	struct tls_mac_data aad;
798
	const char *iv;
799
	char *buf;
800
	size_t hdr_len, mac_len, payload_len;
801
	int padding;
802

803
	hdr = src;
804
	hdr_len = tls_header_len(en);
805
	mac_len = tls_mac_len(en);
806
	ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor);
807
	ATF_REQUIRE_INTEQ(en->tls_vminor, hdr->tls_vminor);
808
	debug(tc, "decrypting MTE record seqno %ju:\n", (uintmax_t)seqno);
809
	debug_hexdump(tc, src, len, NULL);
810

811
	/* First, decrypt the outer payload into a temporary buffer. */
812
	payload_len = len - hdr_len;
813
	buf = malloc(payload_len);
814
	if (en->tls_vminor == TLS_MINOR_VER_ZERO)
815
		iv = en->iv;
816
	else
817
		iv = (void *)(hdr + 1);
818
	debug_hexdump(tc, iv, AES_BLOCK_LEN, "iv");
819
	ATF_REQUIRE(cbc_decrypt(tls_EVP_CIPHER(en), en->cipher_key, iv,
820
	    (const u_char *)src + hdr_len, buf, payload_len));
821
	debug_hexdump(tc, buf, payload_len, "decrypted buffer");
822

823
	/*
824
	 * Copy the last encrypted block to use as the IV for the next
825
	 * record for TLS 1.0.
826
	 */
827
	if (en->tls_vminor == TLS_MINOR_VER_ZERO)
828
		memcpy(__DECONST(uint8_t *, en->iv), (const u_char *)src +
829
		    (len - AES_BLOCK_LEN), AES_BLOCK_LEN);
830

831
	/*
832
	 * Verify trailing padding and strip.
833
	 *
834
	 * The kernel always generates the smallest amount of padding.
835
	 */
836
	padding = buf[payload_len - 1] + 1;
837
	ATF_REQUIRE_MSG(padding > 0 && padding <= AES_BLOCK_LEN,
838
	    "invalid padding %d", padding);
839
	ATF_REQUIRE_MSG(payload_len >= mac_len + padding,
840
	    "payload_len (%zu) < mac_len (%zu) + padding (%d)", payload_len,
841
	    mac_len, padding);
842
	payload_len -= padding;
843

844
	/* Verify HMAC. */
845
	payload_len -= mac_len;
846
	tls_mte_aad(en, payload_len, hdr, seqno, &aad);
847
	debug_hexdump(tc, &aad, sizeof(aad), "aad");
848
	ATF_REQUIRE(verify_hash(tls_EVP_MD(en), en->auth_key, en->auth_key_len,
849
	    &aad, sizeof(aad), buf, payload_len, buf + payload_len));
850

851
	ATF_REQUIRE_MSG(payload_len <= avail, "payload_len (%zu) < avail (%zu)",
852
	    payload_len, avail);
853
	memcpy(dst, buf, payload_len);
854
	*record_type = hdr->tls_type;
855
	return (payload_len);
856
}
857

858
static size_t
859
decrypt_tls_12_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno,
860
    const void *src, size_t len, void *dst, uint8_t *record_type)
861
{
862
	const struct tls_record_layer *hdr;
863
	struct tls_aead_data aad;
864
	char nonce[12];
865
	size_t hdr_len, mac_len, payload_len;
866

867
	hdr = src;
868

869
	hdr_len = tls_header_len(en);
870
	mac_len = tls_mac_len(en);
871
	payload_len = len - (hdr_len + mac_len);
872
	ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor);
873
	ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, hdr->tls_vminor);
874
	debug(tc, "decrypting TLS 1.2 record seqno %ju:\n", (uintmax_t)seqno);
875
	debug_hexdump(tc, src, len, NULL);
876

877
	tls_12_aead_aad(en, payload_len, hdr, seqno, &aad);
878
	debug_hexdump(tc, &aad, sizeof(aad), "aad");
879
	if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16)
880
		tls_12_gcm_nonce(en, hdr, nonce);
881
	else
882
		tls_13_nonce(en, seqno, nonce);
883
	debug_hexdump(tc, nonce, sizeof(nonce), "nonce");
884

885
	ATF_REQUIRE(aead_decrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce,
886
	    &aad, sizeof(aad), (const char *)src + hdr_len, dst, payload_len,
887
	    (const char *)src + hdr_len + payload_len, mac_len));
888

889
	*record_type = hdr->tls_type;
890
	return (payload_len);
891
}
892

893
static size_t
894
decrypt_tls_13_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno,
895
    const void *src, size_t len, void *dst, uint8_t *record_type)
896
{
897
	const struct tls_record_layer *hdr;
898
	struct tls_aead_data_13 aad;
899
	char nonce[12];
900
	char *buf;
901
	size_t hdr_len, mac_len, payload_len;
902

903
	hdr = src;
904

905
	hdr_len = tls_header_len(en);
906
	mac_len = tls_mac_len(en);
907
	payload_len = len - (hdr_len + mac_len);
908
	ATF_REQUIRE_MSG(payload_len >= 1,
909
	    "payload_len (%zu) too short: len %zu hdr_len %zu mac_len %zu",
910
	    payload_len, len, hdr_len, mac_len);
911
	ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, hdr->tls_type);
912
	ATF_REQUIRE_INTEQ(TLS_MAJOR_VER_ONE, hdr->tls_vmajor);
913
	ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, hdr->tls_vminor);
914
	debug(tc, "decrypting TLS 1.3 record seqno %ju:\n", (uintmax_t)seqno);
915
	debug_hexdump(tc, src, len, NULL);
916

917
	tls_13_aad(en, hdr, seqno, &aad);
918
	debug_hexdump(tc, &aad, sizeof(aad), "aad");
919
	tls_13_nonce(en, seqno, nonce);
920
	debug_hexdump(tc, nonce, sizeof(nonce), "nonce");
921

922
	/*
923
	 * Have to use a temporary buffer for the output due to the
924
	 * record type as the last byte of the trailer.
925
	 */
926
	buf = malloc(payload_len);
927

928
	ATF_REQUIRE(aead_decrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce,
929
	    &aad, sizeof(aad), (const char *)src + hdr_len, buf, payload_len,
930
	    (const char *)src + hdr_len + payload_len, mac_len));
931
	debug_hexdump(tc, buf, payload_len, "decrypted buffer");
932

933
	/* Trim record type. */
934
	*record_type = buf[payload_len - 1];
935
	payload_len--;
936

937
	memcpy(dst, buf, payload_len);
938
	free(buf);
939

940
	return (payload_len);
941
}
942

943
static size_t
944
decrypt_tls_aead(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno,
945
    const void *src, size_t len, void *dst, size_t avail, uint8_t *record_type)
946
{
947
	const struct tls_record_layer *hdr;
948
	size_t payload_len;
949

950
	hdr = src;
951
	ATF_REQUIRE_INTEQ(len, ntohs(hdr->tls_length) + sizeof(*hdr));
952

953
	payload_len = len - (tls_header_len(en) + tls_trailer_len(en));
954
	ATF_REQUIRE_MSG(payload_len <= avail, "payload_len (%zu) > avail (%zu)",
955
	    payload_len, avail);
956

957
	if (en->tls_vminor == TLS_MINOR_VER_TWO) {
958
		ATF_REQUIRE_INTEQ(payload_len, decrypt_tls_12_aead(tc, en,
959
		    seqno, src, len, dst, record_type));
960
	} else {
961
		ATF_REQUIRE_INTEQ(payload_len, decrypt_tls_13_aead(tc, en,
962
		    seqno, src, len, dst, record_type));
963
	}
964

965
	return (payload_len);
966
}
967

968
static size_t
969
decrypt_tls_record(const atf_tc_t *tc, struct tls_enable *en, uint64_t seqno,
970
    const void *src, size_t len, void *dst, size_t avail, uint8_t *record_type)
971
{
972
	if (en->cipher_algorithm == CRYPTO_AES_CBC)
973
		return (decrypt_tls_aes_cbc_mte(tc, en, seqno, src, len, dst,
974
		    avail, record_type));
975
	else
976
		return (decrypt_tls_aead(tc, en, seqno, src, len, dst, avail,
977
		    record_type));
978
}
979

980
/*
981
 * Encrypt a TLS record of type 'record_type' with payload 'len' bytes
982
 * long at 'src' and store the result at 'dst'.  If 'dst' doesn't have
983
 * sufficient room ('avail'), fail the test.  'padding' is the amount
984
 * of additional padding to include beyond any amount mandated by the
985
 * cipher suite.
986
 */
987
static size_t
988
encrypt_tls_aes_cbc_mte(const atf_tc_t *tc, struct tls_enable *en,
989
    uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst,
990
    size_t avail, size_t padding)
991
{
992
	struct tls_record_layer *hdr;
993
	struct tls_mac_data aad;
994
	char *buf, *iv;
995
	size_t hdr_len, mac_len, record_len;
996
	u_int digest_len, i;
997

998
	ATF_REQUIRE_INTEQ(0, padding % 16);
999

1000
	hdr = dst;
1001
	buf = dst;
1002

1003
	debug(tc, "encrypting MTE record seqno %ju:\n", (uintmax_t)seqno);
1004
	hdr_len = tls_header_len(en);
1005
	mac_len = tls_mac_len(en);
1006
	padding += (AES_BLOCK_LEN - (len + mac_len) % AES_BLOCK_LEN);
1007
	ATF_REQUIRE_MSG(padding > 0 && padding <= 255, "invalid padding (%zu)",
1008
	    padding);
1009

1010
	record_len = hdr_len + len + mac_len + padding;
1011
	ATF_REQUIRE_MSG(record_len <= avail, "record_len (%zu) > avail (%zu): "
1012
	    "hdr_len %zu, len %zu, mac_len %zu, padding %zu", record_len,
1013
	    avail, hdr_len, len, mac_len, padding);
1014

1015
	hdr->tls_type = record_type;
1016
	hdr->tls_vmajor = TLS_MAJOR_VER_ONE;
1017
	hdr->tls_vminor = en->tls_vminor;
1018
	hdr->tls_length = htons(record_len - sizeof(*hdr));
1019
	iv = (char *)(hdr + 1);
1020
	for (i = 0; i < AES_BLOCK_LEN; i++)
1021
		iv[i] = rdigit();
1022
	debug_hexdump(tc, iv, AES_BLOCK_LEN, "explicit IV");
1023

1024
	/* Copy plaintext to ciphertext region. */
1025
	memcpy(buf + hdr_len, src, len);
1026

1027
	/* Compute HMAC. */
1028
	tls_mte_aad(en, len, hdr, seqno, &aad);
1029
	debug_hexdump(tc, &aad, sizeof(aad), "aad");
1030
	debug_hexdump(tc, src, len, "plaintext");
1031
	ATF_REQUIRE(compute_hash(tls_EVP_MD(en), en->auth_key, en->auth_key_len,
1032
	    &aad, sizeof(aad), src, len, buf + hdr_len + len, &digest_len));
1033
	ATF_REQUIRE_INTEQ(mac_len, digest_len);
1034

1035
	/* Store padding. */
1036
	for (i = 0; i < padding; i++)
1037
		buf[hdr_len + len + mac_len + i] = padding - 1;
1038
	debug_hexdump(tc, buf + hdr_len + len, mac_len + padding,
1039
	    "MAC and padding");
1040

1041
	/* Encrypt the record. */
1042
	ATF_REQUIRE(cbc_encrypt(tls_EVP_CIPHER(en), en->cipher_key, iv,
1043
	    buf + hdr_len, buf + hdr_len, len + mac_len + padding));
1044
	debug_hexdump(tc, dst, record_len, "encrypted record");
1045

1046
	return (record_len);
1047
}
1048

1049
static size_t
1050
encrypt_tls_12_aead(const atf_tc_t *tc, struct tls_enable *en,
1051
    uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst)
1052
{
1053
	struct tls_record_layer *hdr;
1054
	struct tls_aead_data aad;
1055
	char nonce[12];
1056
	size_t hdr_len, mac_len, record_len;
1057

1058
	hdr = dst;
1059

1060
	debug(tc, "encrypting TLS 1.2 record seqno %ju:\n", (uintmax_t)seqno);
1061
	hdr_len = tls_header_len(en);
1062
	mac_len = tls_mac_len(en);
1063
	record_len = hdr_len + len + mac_len;
1064

1065
	hdr->tls_type = record_type;
1066
	hdr->tls_vmajor = TLS_MAJOR_VER_ONE;
1067
	hdr->tls_vminor = TLS_MINOR_VER_TWO;
1068
	hdr->tls_length = htons(record_len - sizeof(*hdr));
1069
	if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16)
1070
		memcpy(hdr + 1, &seqno, sizeof(seqno));
1071

1072
	tls_12_aead_aad(en, len, hdr, seqno, &aad);
1073
	debug_hexdump(tc, &aad, sizeof(aad), "aad");
1074
	if (en->cipher_algorithm == CRYPTO_AES_NIST_GCM_16)
1075
		tls_12_gcm_nonce(en, hdr, nonce);
1076
	else
1077
		tls_13_nonce(en, seqno, nonce);
1078
	debug_hexdump(tc, nonce, sizeof(nonce), "nonce");
1079

1080
	debug_hexdump(tc, src, len, "plaintext");
1081
	ATF_REQUIRE(aead_encrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce,
1082
	    &aad, sizeof(aad), src, (char *)dst + hdr_len, len,
1083
	    (char *)dst + hdr_len + len, mac_len));
1084
	debug_hexdump(tc, dst, record_len, "encrypted record");
1085

1086
	return (record_len);
1087
}
1088

1089
static size_t
1090
encrypt_tls_13_aead(const atf_tc_t *tc, struct tls_enable *en,
1091
    uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst,
1092
    size_t padding)
1093
{
1094
	struct tls_record_layer *hdr;
1095
	struct tls_aead_data_13 aad;
1096
	char nonce[12];
1097
	char *buf;
1098
	size_t hdr_len, mac_len, record_len;
1099

1100
	hdr = dst;
1101

1102
	debug(tc, "encrypting TLS 1.3 record seqno %ju:\n", (uintmax_t)seqno);
1103
	hdr_len = tls_header_len(en);
1104
	mac_len = tls_mac_len(en);
1105
	record_len = hdr_len + len + 1 + padding + mac_len;
1106

1107
	hdr->tls_type = TLS_RLTYPE_APP;
1108
	hdr->tls_vmajor = TLS_MAJOR_VER_ONE;
1109
	hdr->tls_vminor = TLS_MINOR_VER_TWO;
1110
	hdr->tls_length = htons(record_len - sizeof(*hdr));
1111

1112
	tls_13_aad(en, hdr, seqno, &aad);
1113
	debug_hexdump(tc, &aad, sizeof(aad), "aad");
1114
	tls_13_nonce(en, seqno, nonce);
1115
	debug_hexdump(tc, nonce, sizeof(nonce), "nonce");
1116

1117
	/*
1118
	 * Have to use a temporary buffer for the input so that the record
1119
	 * type can be appended.
1120
	 */
1121
	buf = malloc(len + 1 + padding);
1122
	memcpy(buf, src, len);
1123
	buf[len] = record_type;
1124
	memset(buf + len + 1, 0, padding);
1125
	debug_hexdump(tc, buf, len + 1 + padding, "plaintext + type + padding");
1126

1127
	ATF_REQUIRE(aead_encrypt(tls_EVP_CIPHER(en), en->cipher_key, nonce,
1128
	    &aad, sizeof(aad), buf, (char *)dst + hdr_len, len + 1 + padding,
1129
	    (char *)dst + hdr_len + len + 1 + padding, mac_len));
1130
	debug_hexdump(tc, dst, record_len, "encrypted record");
1131

1132
	free(buf);
1133

1134
	return (record_len);
1135
}
1136

1137
static size_t
1138
encrypt_tls_aead(const atf_tc_t *tc, struct tls_enable *en,
1139
    uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst,
1140
    size_t avail, size_t padding)
1141
{
1142
	size_t record_len;
1143

1144
	record_len = tls_header_len(en) + len + padding + tls_trailer_len(en);
1145
	ATF_REQUIRE_MSG(record_len <= avail, "record_len (%zu) > avail (%zu): "
1146
	    "header %zu len %zu padding %zu trailer %zu", record_len, avail,
1147
	    tls_header_len(en), len, padding, tls_trailer_len(en));
1148

1149
	if (en->tls_vminor == TLS_MINOR_VER_TWO) {
1150
		ATF_REQUIRE_INTEQ(0, padding);
1151
		ATF_REQUIRE_INTEQ(record_len, encrypt_tls_12_aead(tc, en,
1152
		    record_type, seqno, src, len, dst));
1153
	} else
1154
		ATF_REQUIRE_INTEQ(record_len, encrypt_tls_13_aead(tc, en,
1155
		    record_type, seqno, src, len, dst, padding));
1156

1157
	return (record_len);
1158
}
1159

1160
static size_t
1161
encrypt_tls_record(const atf_tc_t *tc, struct tls_enable *en,
1162
    uint8_t record_type, uint64_t seqno, const void *src, size_t len, void *dst,
1163
    size_t avail, size_t padding)
1164
{
1165
	if (en->cipher_algorithm == CRYPTO_AES_CBC)
1166
		return (encrypt_tls_aes_cbc_mte(tc, en, record_type, seqno, src,
1167
		    len, dst, avail, padding));
1168
	else
1169
		return (encrypt_tls_aead(tc, en, record_type, seqno, src, len,
1170
		    dst, avail, padding));
1171
}
1172

1173
static void
1174
test_ktls_transmit_app_data(const atf_tc_t *tc, struct tls_enable *en,
1175
    uint64_t seqno, size_t len)
1176
{
1177
	struct kevent ev;
1178
	struct tls_record_layer *hdr;
1179
	char *plaintext, *decrypted, *outbuf;
1180
	size_t decrypted_len, outbuf_len, outbuf_cap, record_len, written;
1181
	ssize_t rv;
1182
	int kq, sockets[2];
1183
	uint8_t record_type;
1184

1185
	plaintext = alloc_buffer(len);
1186
	debug_hexdump(tc, plaintext, len, "plaintext");
1187
	decrypted = malloc(len);
1188
	outbuf_cap = tls_header_len(en) + TLS_MAX_MSG_SIZE_V10_2 +
1189
	    tls_trailer_len(en);
1190
	outbuf = malloc(outbuf_cap);
1191
	hdr = (struct tls_record_layer *)outbuf;
1192

1193
	ATF_REQUIRE((kq = kqueue()) != -1);
1194

1195
	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1196

1197
	ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en,
1198
	    sizeof(*en)) == 0);
1199
	check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE);
1200

1201
	EV_SET(&ev, sockets[0], EVFILT_READ, EV_ADD, 0, 0, NULL);
1202
	ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0);
1203
	EV_SET(&ev, sockets[1], EVFILT_WRITE, EV_ADD, 0, 0, NULL);
1204
	ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0);
1205

1206
	decrypted_len = 0;
1207
	outbuf_len = 0;
1208
	written = 0;
1209

1210
	while (decrypted_len != len) {
1211
		ATF_REQUIRE(kevent(kq, NULL, 0, &ev, 1, NULL) == 1);
1212

1213
		switch (ev.filter) {
1214
		case EVFILT_WRITE:
1215
			/* Try to write any remaining data. */
1216
			rv = write(ev.ident, plaintext + written,
1217
			    len - written);
1218
			ATF_REQUIRE_MSG(rv > 0,
1219
			    "failed to write to socket");
1220
			written += rv;
1221
			if (written == len) {
1222
				ev.flags = EV_DISABLE;
1223
				ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0,
1224
				    NULL) == 0);
1225
			}
1226
			break;
1227

1228
		case EVFILT_READ:
1229
			ATF_REQUIRE((ev.flags & EV_EOF) == 0);
1230

1231
			/*
1232
			 * Try to read data for the next TLS record
1233
			 * into outbuf.  Start by reading the header
1234
			 * to determine how much additional data to
1235
			 * read.
1236
			 */
1237
			if (outbuf_len < sizeof(struct tls_record_layer)) {
1238
				rv = read(ev.ident, outbuf + outbuf_len,
1239
				    sizeof(struct tls_record_layer) -
1240
				    outbuf_len);
1241
				ATF_REQUIRE_MSG(rv > 0,
1242
				    "failed to read from socket");
1243
				outbuf_len += rv;
1244

1245
				if (outbuf_len ==
1246
				    sizeof(struct tls_record_layer)) {
1247
					debug(tc, "TLS header for seqno %ju:\n",
1248
					    (uintmax_t)seqno);
1249
					debug_hexdump(tc, outbuf, outbuf_len,
1250
					    NULL);
1251
				}
1252
			}
1253

1254
			if (outbuf_len < sizeof(struct tls_record_layer))
1255
				break;
1256

1257
			record_len = sizeof(struct tls_record_layer) +
1258
			    ntohs(hdr->tls_length);
1259
			debug(tc, "record_len %zu outbuf_cap %zu\n",
1260
			    record_len, outbuf_cap);
1261
			ATF_REQUIRE(record_len <= outbuf_cap);
1262
			ATF_REQUIRE(record_len > outbuf_len);
1263
			rv = read(ev.ident, outbuf + outbuf_len,
1264
			    record_len - outbuf_len);
1265
			if (rv == -1 && errno == EAGAIN)
1266
				break;
1267
			ATF_REQUIRE_MSG(rv > 0,
1268
			    "failed to read from socket: %s", strerror(errno));
1269

1270
			outbuf_len += rv;
1271
			if (outbuf_len == record_len) {
1272
				decrypted_len += decrypt_tls_record(tc, en,
1273
				    seqno, outbuf, outbuf_len,
1274
				    decrypted + decrypted_len,
1275
				    len - decrypted_len, &record_type);
1276
				ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, record_type);
1277

1278
				seqno++;
1279
				outbuf_len = 0;
1280
			}
1281
			break;
1282
		}
1283
	}
1284

1285
	ATF_REQUIRE_MSG(written == decrypted_len,
1286
	    "read %zu decrypted bytes, but wrote %zu", decrypted_len, written);
1287

1288
	ATF_REQUIRE(memcmp(plaintext, decrypted, len) == 0);
1289

1290
	free(outbuf);
1291
	free(decrypted);
1292
	free(plaintext);
1293

1294
	close_sockets(sockets);
1295
	ATF_REQUIRE(close(kq) == 0);
1296
}
1297

1298
static void
1299
ktls_send_control_message(int fd, uint8_t type, void *data, size_t len)
1300
{
1301
	struct msghdr msg;
1302
	struct cmsghdr *cmsg;
1303
	char cbuf[CMSG_SPACE(sizeof(type))];
1304
	struct iovec iov;
1305

1306
	memset(&msg, 0, sizeof(msg));
1307

1308
	msg.msg_control = cbuf;
1309
	msg.msg_controllen = sizeof(cbuf);
1310
	cmsg = CMSG_FIRSTHDR(&msg);
1311
	cmsg->cmsg_level = IPPROTO_TCP;
1312
	cmsg->cmsg_type = TLS_SET_RECORD_TYPE;
1313
	cmsg->cmsg_len = CMSG_LEN(sizeof(type));
1314
	*(uint8_t *)CMSG_DATA(cmsg) = type;
1315

1316
	iov.iov_base = data;
1317
	iov.iov_len = len;
1318
	msg.msg_iov = &iov;
1319
	msg.msg_iovlen = 1;
1320

1321
	ATF_REQUIRE_INTEQ((ssize_t)len, sendmsg(fd, &msg, 0));
1322
}
1323

1324
static void
1325
test_ktls_transmit_control(const atf_tc_t *tc, struct tls_enable *en,
1326
    uint64_t seqno, uint8_t type, size_t len)
1327
{
1328
	struct tls_record_layer *hdr;
1329
	char *plaintext, *decrypted, *outbuf;
1330
	size_t outbuf_cap, payload_len, record_len;
1331
	ssize_t rv;
1332
	int sockets[2];
1333
	uint8_t record_type;
1334

1335
	ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1336

1337
	plaintext = alloc_buffer(len);
1338
	decrypted = malloc(len);
1339
	outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1340
	outbuf = malloc(outbuf_cap);
1341
	hdr = (struct tls_record_layer *)outbuf;
1342

1343
	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1344

1345
	ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en,
1346
	    sizeof(*en)) == 0);
1347
	check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE);
1348

1349
	fd_set_blocking(sockets[0]);
1350
	fd_set_blocking(sockets[1]);
1351

1352
	ktls_send_control_message(sockets[1], type, plaintext, len);
1353

1354
	/*
1355
	 * First read the header to determine how much additional data
1356
	 * to read.
1357
	 */
1358
	rv = read(sockets[0], outbuf, sizeof(struct tls_record_layer));
1359
	ATF_REQUIRE_INTEQ(sizeof(struct tls_record_layer), rv);
1360
	payload_len = ntohs(hdr->tls_length);
1361
	record_len = payload_len + sizeof(struct tls_record_layer);
1362
	ATF_REQUIRE_MSG(record_len <= outbuf_cap,
1363
	    "record_len (%zu) > outbuf_cap (%zu)", record_len, outbuf_cap);
1364
	rv = read(sockets[0], outbuf + sizeof(struct tls_record_layer),
1365
	    payload_len);
1366
	ATF_REQUIRE_INTEQ((ssize_t)payload_len, rv);
1367

1368
	rv = decrypt_tls_record(tc, en, seqno, outbuf, record_len, decrypted,
1369
	    len, &record_type);
1370

1371
	ATF_REQUIRE_MSG((ssize_t)len == rv,
1372
	    "read %zd decrypted bytes, but wrote %zu", rv, len);
1373
	ATF_REQUIRE_INTEQ(type, record_type);
1374

1375
	ATF_REQUIRE(memcmp(plaintext, decrypted, len) == 0);
1376

1377
	free(outbuf);
1378
	free(decrypted);
1379
	free(plaintext);
1380

1381
	close_sockets(sockets);
1382
}
1383

1384
static void
1385
test_ktls_transmit_empty_fragment(const atf_tc_t *tc, struct tls_enable *en,
1386
    uint64_t seqno)
1387
{
1388
	struct tls_record_layer *hdr;
1389
	char *outbuf;
1390
	size_t outbuf_cap, payload_len, record_len;
1391
	ssize_t rv;
1392
	int sockets[2];
1393
	uint8_t record_type;
1394

1395
	outbuf_cap = tls_header_len(en) + tls_trailer_len(en);
1396
	outbuf = malloc(outbuf_cap);
1397
	hdr = (struct tls_record_layer *)outbuf;
1398

1399
	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1400

1401
	ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, en,
1402
	    sizeof(*en)) == 0);
1403
	check_tls_mode(tc, sockets[1], TCP_TXTLS_MODE);
1404

1405
	fd_set_blocking(sockets[0]);
1406
	fd_set_blocking(sockets[1]);
1407

1408
	/*
1409
	 * A write of zero bytes should send an empty fragment only for
1410
	 * TLS 1.0, otherwise an error should be raised.
1411
	 */
1412
	rv = write(sockets[1], NULL, 0);
1413
	if (rv == 0) {
1414
		ATF_REQUIRE_INTEQ(CRYPTO_AES_CBC, en->cipher_algorithm);
1415
		ATF_REQUIRE_INTEQ(TLS_MINOR_VER_ZERO, en->tls_vminor);
1416
	} else {
1417
		ATF_REQUIRE_INTEQ(-1, rv);
1418
		ATF_REQUIRE_ERRNO(EINVAL, true);
1419
		goto out;
1420
	}
1421

1422
	/*
1423
	 * First read the header to determine how much additional data
1424
	 * to read.
1425
	 */
1426
	rv = read(sockets[0], outbuf, sizeof(struct tls_record_layer));
1427
	ATF_REQUIRE_INTEQ(sizeof(struct tls_record_layer), rv);
1428
	payload_len = ntohs(hdr->tls_length);
1429
	record_len = payload_len + sizeof(struct tls_record_layer);
1430
	ATF_REQUIRE_MSG(record_len <= outbuf_cap,
1431
	    "record_len (%zu) > outbuf_cap (%zu)", record_len, outbuf_cap);
1432
	rv = read(sockets[0], outbuf + sizeof(struct tls_record_layer),
1433
	    payload_len);
1434
	ATF_REQUIRE_INTEQ((ssize_t)payload_len, rv);
1435

1436
	rv = decrypt_tls_record(tc, en, seqno, outbuf, record_len, NULL, 0,
1437
	    &record_type);
1438

1439
	ATF_REQUIRE_MSG(rv == 0,
1440
	    "read %zd decrypted bytes for an empty fragment", rv);
1441
	ATF_REQUIRE_INTEQ(TLS_RLTYPE_APP, record_type);
1442

1443
out:
1444
	free(outbuf);
1445

1446
	close_sockets(sockets);
1447
}
1448

1449
static size_t
1450
ktls_receive_tls_record(struct tls_enable *en, int fd, uint8_t record_type,
1451
    void *data, size_t len)
1452
{
1453
	struct msghdr msg;
1454
	struct cmsghdr *cmsg;
1455
	struct tls_get_record *tgr;
1456
	char cbuf[CMSG_SPACE(sizeof(*tgr))];
1457
	struct iovec iov;
1458
	ssize_t rv;
1459

1460
	memset(&msg, 0, sizeof(msg));
1461

1462
	msg.msg_control = cbuf;
1463
	msg.msg_controllen = sizeof(cbuf);
1464

1465
	iov.iov_base = data;
1466
	iov.iov_len = len;
1467
	msg.msg_iov = &iov;
1468
	msg.msg_iovlen = 1;
1469

1470
	ATF_REQUIRE((rv = recvmsg(fd, &msg, 0)) > 0);
1471

1472
	ATF_REQUIRE((msg.msg_flags & (MSG_EOR | MSG_CTRUNC)) == MSG_EOR);
1473

1474
	cmsg = CMSG_FIRSTHDR(&msg);
1475
	ATF_REQUIRE(cmsg != NULL);
1476
	ATF_REQUIRE_INTEQ(IPPROTO_TCP, cmsg->cmsg_level);
1477
	ATF_REQUIRE_INTEQ(TLS_GET_RECORD, cmsg->cmsg_type);
1478
	ATF_REQUIRE_INTEQ(CMSG_LEN(sizeof(*tgr)), cmsg->cmsg_len);
1479

1480
	tgr = (struct tls_get_record *)CMSG_DATA(cmsg);
1481
	ATF_REQUIRE_INTEQ(record_type, tgr->tls_type);
1482
	ATF_REQUIRE_INTEQ(en->tls_vmajor, tgr->tls_vmajor);
1483
	/* XXX: Not sure if this is what OpenSSL expects? */
1484
	if (en->tls_vminor == TLS_MINOR_VER_THREE)
1485
		ATF_REQUIRE_INTEQ(TLS_MINOR_VER_TWO, tgr->tls_vminor);
1486
	else
1487
		ATF_REQUIRE_INTEQ(en->tls_vminor, tgr->tls_vminor);
1488
	ATF_REQUIRE_INTEQ(htons(rv), tgr->tls_length);
1489

1490
	return (rv);
1491
}
1492

1493
static void
1494
test_ktls_receive_app_data(const atf_tc_t *tc, struct tls_enable *en,
1495
    uint64_t seqno, size_t len, size_t padding)
1496
{
1497
	struct kevent ev;
1498
	char *plaintext, *received, *outbuf;
1499
	size_t outbuf_cap, outbuf_len, outbuf_sent, received_len, todo, written;
1500
	ssize_t rv;
1501
	int kq, sockets[2];
1502

1503
	plaintext = alloc_buffer(len);
1504
	received = malloc(len);
1505
	outbuf_cap = tls_header_len(en) + TLS_MAX_MSG_SIZE_V10_2 +
1506
	    tls_trailer_len(en);
1507
	outbuf = malloc(outbuf_cap);
1508

1509
	ATF_REQUIRE((kq = kqueue()) != -1);
1510

1511
	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1512

1513
	ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1514
	    sizeof(*en)) == 0);
1515
	check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1516

1517
	EV_SET(&ev, sockets[0], EVFILT_READ, EV_ADD, 0, 0, NULL);
1518
	ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0);
1519
	EV_SET(&ev, sockets[1], EVFILT_WRITE, EV_ADD, 0, 0, NULL);
1520
	ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0, NULL) == 0);
1521

1522
	received_len = 0;
1523
	outbuf_len = 0;
1524
	written = 0;
1525

1526
	while (received_len != len) {
1527
		ATF_REQUIRE(kevent(kq, NULL, 0, &ev, 1, NULL) == 1);
1528

1529
		switch (ev.filter) {
1530
		case EVFILT_WRITE:
1531
			/*
1532
			 * Compose the next TLS record to send.
1533
			 */
1534
			if (outbuf_len == 0) {
1535
				ATF_REQUIRE(written < len);
1536
				todo = len - written;
1537
				if (todo > TLS_MAX_MSG_SIZE_V10_2 - padding)
1538
					todo = TLS_MAX_MSG_SIZE_V10_2 - padding;
1539
				outbuf_len = encrypt_tls_record(tc, en,
1540
				    TLS_RLTYPE_APP, seqno, plaintext + written,
1541
				    todo, outbuf, outbuf_cap, padding);
1542
				outbuf_sent = 0;
1543
				written += todo;
1544
				seqno++;
1545
			}
1546

1547
			/*
1548
			 * Try to write the remainder of the current
1549
			 * TLS record.
1550
			 */
1551
			rv = write(ev.ident, outbuf + outbuf_sent,
1552
			    outbuf_len - outbuf_sent);
1553
			ATF_REQUIRE_MSG(rv > 0,
1554
			    "failed to write to socket: %s", strerror(errno));
1555
			outbuf_sent += rv;
1556
			if (outbuf_sent == outbuf_len) {
1557
				outbuf_len = 0;
1558
				if (written == len) {
1559
					ev.flags = EV_DISABLE;
1560
					ATF_REQUIRE(kevent(kq, &ev, 1, NULL, 0,
1561
					    NULL) == 0);
1562
				}
1563
			}
1564
			break;
1565

1566
		case EVFILT_READ:
1567
			ATF_REQUIRE((ev.flags & EV_EOF) == 0);
1568

1569
			rv = ktls_receive_tls_record(en, ev.ident,
1570
			    TLS_RLTYPE_APP, received + received_len,
1571
			    len - received_len);
1572
			received_len += rv;
1573
			break;
1574
		}
1575
	}
1576

1577
	ATF_REQUIRE_MSG(written == received_len,
1578
	    "read %zu decrypted bytes, but wrote %zu", received_len, written);
1579

1580
	ATF_REQUIRE(memcmp(plaintext, received, len) == 0);
1581

1582
	free(outbuf);
1583
	free(received);
1584
	free(plaintext);
1585

1586
	close_sockets(sockets);
1587
	ATF_REQUIRE(close(kq) == 0);
1588
}
1589

1590
static void
1591
ktls_receive_tls_error(int fd, int expected_error)
1592
{
1593
	struct msghdr msg;
1594
	struct tls_get_record *tgr;
1595
	char cbuf[CMSG_SPACE(sizeof(*tgr))];
1596
	char buf[64];
1597
	struct iovec iov;
1598

1599
	memset(&msg, 0, sizeof(msg));
1600

1601
	msg.msg_control = cbuf;
1602
	msg.msg_controllen = sizeof(cbuf);
1603

1604
	iov.iov_base = buf;
1605
	iov.iov_len = sizeof(buf);
1606
	msg.msg_iov = &iov;
1607
	msg.msg_iovlen = 1;
1608

1609
	ATF_REQUIRE(recvmsg(fd, &msg, 0) == -1);
1610
	if (expected_error != 0)
1611
		ATF_REQUIRE_ERRNO(expected_error, true);
1612
}
1613

1614
static void
1615
test_ktls_receive_corrupted_record(const atf_tc_t *tc, struct tls_enable *en,
1616
    uint64_t seqno, size_t len, ssize_t offset)
1617
{
1618
	char *plaintext, *outbuf;
1619
	size_t outbuf_cap, outbuf_len;
1620
	ssize_t rv;
1621
	int sockets[2];
1622

1623
	ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1624

1625
	plaintext = alloc_buffer(len);
1626
	outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1627
	outbuf = malloc(outbuf_cap);
1628

1629
	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1630

1631
	ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1632
	    sizeof(*en)) == 0);
1633
	check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1634

1635
	fd_set_blocking(sockets[0]);
1636
	fd_set_blocking(sockets[1]);
1637

1638
	outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1639
	    plaintext, len, outbuf, outbuf_cap, 0);
1640

1641
	/* A negative offset is an offset from the end. */
1642
	if (offset < 0)
1643
		offset += outbuf_len;
1644
	outbuf[offset] ^= 0x01;
1645

1646
	rv = write(sockets[1], outbuf, outbuf_len);
1647
	ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1648

1649
	ktls_receive_tls_error(sockets[0], EBADMSG);
1650

1651
	free(outbuf);
1652
	free(plaintext);
1653

1654
	close_sockets_ignore_errors(sockets);
1655
}
1656

1657
static void
1658
test_ktls_receive_corrupted_iv(const atf_tc_t *tc, struct tls_enable *en,
1659
    uint64_t seqno, size_t len)
1660
{
1661
	ATF_REQUIRE(tls_header_len(en) > sizeof(struct tls_record_layer));
1662

1663
	/* Corrupt the first byte of the explicit IV after the header. */
1664
	test_ktls_receive_corrupted_record(tc, en, seqno, len,
1665
	    sizeof(struct tls_record_layer));
1666
}
1667

1668
static void
1669
test_ktls_receive_corrupted_data(const atf_tc_t *tc, struct tls_enable *en,
1670
    uint64_t seqno, size_t len)
1671
{
1672
	ATF_REQUIRE(len > 0);
1673

1674
	/* Corrupt the first ciphertext byte after the header. */
1675
	test_ktls_receive_corrupted_record(tc, en, seqno, len,
1676
	    tls_header_len(en));
1677
}
1678

1679
static void
1680
test_ktls_receive_corrupted_mac(const atf_tc_t *tc, struct tls_enable *en,
1681
    uint64_t seqno, size_t len)
1682
{
1683
	size_t offset;
1684

1685
	/* Corrupt the first byte of the MAC. */
1686
	if (en->cipher_algorithm == CRYPTO_AES_CBC)
1687
		offset = tls_header_len(en) + len;
1688
	else
1689
		offset = -tls_mac_len(en);
1690
	test_ktls_receive_corrupted_record(tc, en, seqno, len, offset);
1691
}
1692

1693
static void
1694
test_ktls_receive_corrupted_padding(const atf_tc_t *tc, struct tls_enable *en,
1695
    uint64_t seqno, size_t len)
1696
{
1697
	ATF_REQUIRE_INTEQ(CRYPTO_AES_CBC, en->cipher_algorithm);
1698

1699
	/* Corrupt the last byte of the padding. */
1700
	test_ktls_receive_corrupted_record(tc, en, seqno, len, -1);
1701
}
1702

1703
static void
1704
test_ktls_receive_truncated_record(const atf_tc_t *tc, struct tls_enable *en,
1705
    uint64_t seqno, size_t len)
1706
{
1707
	char *plaintext, *outbuf;
1708
	size_t outbuf_cap, outbuf_len;
1709
	ssize_t rv;
1710
	int sockets[2];
1711

1712
	ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1713

1714
	plaintext = alloc_buffer(len);
1715
	outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1716
	outbuf = malloc(outbuf_cap);
1717

1718
	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1719

1720
	ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1721
	    sizeof(*en)) == 0);
1722
	check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1723

1724
	fd_set_blocking(sockets[0]);
1725
	fd_set_blocking(sockets[1]);
1726

1727
	outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1728
	    plaintext, len, outbuf, outbuf_cap, 0);
1729

1730
	rv = write(sockets[1], outbuf, outbuf_len / 2);
1731
	ATF_REQUIRE_INTEQ((ssize_t)(outbuf_len / 2), rv);
1732

1733
	ATF_REQUIRE(shutdown(sockets[1], SHUT_WR) == 0);
1734

1735
	ktls_receive_tls_error(sockets[0], EMSGSIZE);
1736

1737
	free(outbuf);
1738
	free(plaintext);
1739

1740
	close_sockets_ignore_errors(sockets);
1741
}
1742

1743
static void
1744
test_ktls_receive_bad_major(const atf_tc_t *tc, struct tls_enable *en,
1745
    uint64_t seqno, size_t len)
1746
{
1747
	struct tls_record_layer *hdr;
1748
	char *plaintext, *outbuf;
1749
	size_t outbuf_cap, outbuf_len;
1750
	ssize_t rv;
1751
	int sockets[2];
1752

1753
	ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1754

1755
	plaintext = alloc_buffer(len);
1756
	outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1757
	outbuf = malloc(outbuf_cap);
1758

1759
	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1760

1761
	ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1762
	    sizeof(*en)) == 0);
1763
	check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1764

1765
	fd_set_blocking(sockets[0]);
1766
	fd_set_blocking(sockets[1]);
1767

1768
	outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1769
	    plaintext, len, outbuf, outbuf_cap, 0);
1770

1771
	hdr = (void *)outbuf;
1772
	hdr->tls_vmajor++;
1773

1774
	rv = write(sockets[1], outbuf, outbuf_len);
1775
	ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1776

1777
	ktls_receive_tls_error(sockets[0], EINVAL);
1778

1779
	free(outbuf);
1780
	free(plaintext);
1781

1782
	close_sockets_ignore_errors(sockets);
1783
}
1784

1785
static void
1786
test_ktls_receive_bad_minor(const atf_tc_t *tc, struct tls_enable *en,
1787
    uint64_t seqno, size_t len)
1788
{
1789
	struct tls_record_layer *hdr;
1790
	char *plaintext, *outbuf;
1791
	size_t outbuf_cap, outbuf_len;
1792
	ssize_t rv;
1793
	int sockets[2];
1794

1795
	ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1796

1797
	plaintext = alloc_buffer(len);
1798
	outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1799
	outbuf = malloc(outbuf_cap);
1800

1801
	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1802

1803
	ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1804
	    sizeof(*en)) == 0);
1805
	check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1806

1807
	fd_set_blocking(sockets[0]);
1808
	fd_set_blocking(sockets[1]);
1809

1810
	outbuf_len = encrypt_tls_record(tc, en, TLS_RLTYPE_APP, seqno,
1811
	    plaintext, len, outbuf, outbuf_cap, 0);
1812

1813
	hdr = (void *)outbuf;
1814
	hdr->tls_vminor++;
1815

1816
	rv = write(sockets[1], outbuf, outbuf_len);
1817
	ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1818

1819
	ktls_receive_tls_error(sockets[0], EINVAL);
1820

1821
	free(outbuf);
1822
	free(plaintext);
1823

1824
	close_sockets_ignore_errors(sockets);
1825
}
1826

1827
static void
1828
test_ktls_receive_bad_type(const atf_tc_t *tc, struct tls_enable *en,
1829
    uint64_t seqno, size_t len)
1830
{
1831
	struct tls_record_layer *hdr;
1832
	char *plaintext, *outbuf;
1833
	size_t outbuf_cap, outbuf_len;
1834
	ssize_t rv;
1835
	int sockets[2];
1836

1837
	ATF_REQUIRE(len <= TLS_MAX_MSG_SIZE_V10_2);
1838
	ATF_REQUIRE_INTEQ(TLS_MINOR_VER_THREE, en->tls_vminor);
1839

1840
	plaintext = alloc_buffer(len);
1841
	outbuf_cap = tls_header_len(en) + len + tls_trailer_len(en);
1842
	outbuf = malloc(outbuf_cap);
1843

1844
	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1845

1846
	ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1847
	    sizeof(*en)) == 0);
1848
	check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1849

1850
	fd_set_blocking(sockets[0]);
1851
	fd_set_blocking(sockets[1]);
1852

1853
	outbuf_len = encrypt_tls_record(tc, en, 0x21 /* Alert */, seqno,
1854
	    plaintext, len, outbuf, outbuf_cap, 0);
1855

1856
	hdr = (void *)outbuf;
1857
	hdr->tls_type = TLS_RLTYPE_APP + 1;
1858

1859
	rv = write(sockets[1], outbuf, outbuf_len);
1860
	ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1861

1862
	ktls_receive_tls_error(sockets[0], EINVAL);
1863

1864
	free(outbuf);
1865
	free(plaintext);
1866

1867
	close_sockets_ignore_errors(sockets);
1868
}
1869

1870
static void
1871
test_ktls_receive_bad_size(const atf_tc_t *tc, struct tls_enable *en,
1872
    uint64_t seqno, size_t len)
1873
{
1874
	struct tls_record_layer *hdr;
1875
	char *outbuf;
1876
	size_t outbuf_len;
1877
	ssize_t rv;
1878
	int sockets[2];
1879

1880
	outbuf_len = sizeof(*hdr) + len;
1881
	outbuf = calloc(1, outbuf_len);
1882

1883
	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
1884

1885
	ATF_REQUIRE(setsockopt(sockets[0], IPPROTO_TCP, TCP_RXTLS_ENABLE, en,
1886
	    sizeof(*en)) == 0);
1887
	check_tls_mode(tc, sockets[0], TCP_RXTLS_MODE);
1888

1889
	fd_set_blocking(sockets[0]);
1890
	fd_set_blocking(sockets[1]);
1891

1892
	hdr = (void *)outbuf;
1893
	hdr->tls_vmajor = en->tls_vmajor;
1894
	if (en->tls_vminor == TLS_MINOR_VER_THREE)
1895
		hdr->tls_vminor = TLS_MINOR_VER_TWO;
1896
	else
1897
		hdr->tls_vminor = en->tls_vminor;
1898
	hdr->tls_type = TLS_RLTYPE_APP;
1899
	hdr->tls_length = htons(len);
1900

1901
	rv = write(sockets[1], outbuf, outbuf_len);
1902
	ATF_REQUIRE_INTEQ((ssize_t)outbuf_len, rv);
1903

1904
	/*
1905
	 * The other end may notice the error and drop the connection
1906
	 * before this executes resulting in shutdown() failing with
1907
	 * either ENOTCONN or ECONNRESET.  Ignore this error if it
1908
	 * occurs.
1909
	 */
1910
	if (shutdown(sockets[1], SHUT_WR) != 0) {
1911
		ATF_REQUIRE_MSG(errno == ENOTCONN || errno == ECONNRESET,
1912
		    "shutdown() failed: %s", strerror(errno));
1913
	}
1914

1915
	ktls_receive_tls_error(sockets[0], EMSGSIZE);
1916

1917
	free(outbuf);
1918

1919
	close_sockets_ignore_errors(sockets);
1920
}
1921

1922
#define	TLS_10_TESTS(M)							\
1923
	M(aes128_cbc_1_0_sha1, CRYPTO_AES_CBC, 128 / 8,			\
1924
	    CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO)			\
1925
	M(aes256_cbc_1_0_sha1, CRYPTO_AES_CBC, 256 / 8,			\
1926
	    CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ZERO)
1927

1928
#define	TLS_13_TESTS(M)							\
1929
	M(aes128_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,		\
1930
	    TLS_MINOR_VER_THREE)					\
1931
	M(aes256_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0,		\
1932
	    TLS_MINOR_VER_THREE)					\
1933
	M(chacha20_poly1305_1_3, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0,	\
1934
	    TLS_MINOR_VER_THREE)
1935

1936
#define	AES_CBC_NONZERO_TESTS(M)					\
1937
	M(aes128_cbc_1_1_sha1, CRYPTO_AES_CBC, 128 / 8,			\
1938
	    CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ONE)			\
1939
	M(aes256_cbc_1_1_sha1, CRYPTO_AES_CBC, 256 / 8,			\
1940
	    CRYPTO_SHA1_HMAC, TLS_MINOR_VER_ONE)			\
1941
	M(aes128_cbc_1_2_sha1, CRYPTO_AES_CBC, 128 / 8,			\
1942
	    CRYPTO_SHA1_HMAC, TLS_MINOR_VER_TWO)			\
1943
	M(aes256_cbc_1_2_sha1, CRYPTO_AES_CBC, 256 / 8,			\
1944
	    CRYPTO_SHA1_HMAC, TLS_MINOR_VER_TWO)			\
1945
	M(aes128_cbc_1_2_sha256, CRYPTO_AES_CBC, 128 / 8,		\
1946
	    CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_TWO)			\
1947
	M(aes256_cbc_1_2_sha256, CRYPTO_AES_CBC, 256 / 8,		\
1948
	    CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_TWO)			\
1949
	M(aes128_cbc_1_2_sha384, CRYPTO_AES_CBC, 128 / 8,		\
1950
	    CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_TWO)			\
1951
	M(aes256_cbc_1_2_sha384, CRYPTO_AES_CBC, 256 / 8,		\
1952
	    CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_TWO)			\
1953

1954
#define	AES_CBC_TESTS(M)						\
1955
	TLS_10_TESTS(M)							\
1956
	AES_CBC_NONZERO_TESTS(M)
1957

1958
#define AES_GCM_12_TESTS(M)						\
1959
	M(aes128_gcm_1_2, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,		\
1960
	    TLS_MINOR_VER_TWO)						\
1961
	M(aes256_gcm_1_2, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0,		\
1962
	    TLS_MINOR_VER_TWO)
1963

1964
#define AES_GCM_TESTS(M)						\
1965
	AES_GCM_12_TESTS(M)						\
1966
	M(aes128_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,		\
1967
	    TLS_MINOR_VER_THREE)					\
1968
	M(aes256_gcm_1_3, CRYPTO_AES_NIST_GCM_16, 256 / 8, 0,		\
1969
	    TLS_MINOR_VER_THREE)
1970

1971
#define CHACHA20_TESTS(M)						\
1972
	M(chacha20_poly1305_1_2, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0,	\
1973
	    TLS_MINOR_VER_TWO)						\
1974
	M(chacha20_poly1305_1_3, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0,	\
1975
	    TLS_MINOR_VER_THREE)
1976

1977
#define GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
1978
	    auth_alg, minor, name, len)					\
1979
ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_##name);		\
1980
ATF_TC_BODY(ktls_transmit_##cipher_name##_##name, tc)			\
1981
{									\
1982
	struct tls_enable en;						\
1983
	uint64_t seqno;							\
1984
									\
1985
	ATF_REQUIRE_KTLS();						\
1986
	seqno = random();						\
1987
	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
1988
	    seqno, &en);						\
1989
	test_ktls_transmit_app_data(tc, &en, seqno, len);		\
1990
	free_tls_enable(&en);						\
1991
}
1992

1993
#define ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
1994
	    auth_alg, minor, name)					\
1995
	ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_##name);
1996

1997
#define GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
1998
	    auth_alg, minor, name, type, len)				\
1999
ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_##name);		\
2000
ATF_TC_BODY(ktls_transmit_##cipher_name##_##name, tc)			\
2001
{									\
2002
	struct tls_enable en;						\
2003
	uint64_t seqno;							\
2004
									\
2005
	ATF_REQUIRE_KTLS();						\
2006
	seqno = random();						\
2007
	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2008
	    seqno, &en);						\
2009
	test_ktls_transmit_control(tc, &en, seqno, type, len);		\
2010
	free_tls_enable(&en);						\
2011
}
2012

2013
#define ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2014
	    auth_alg, minor, name)					\
2015
	ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_##name);
2016

2017
#define GEN_TRANSMIT_EMPTY_FRAGMENT_TEST(cipher_name, cipher_alg,	\
2018
	    key_size, auth_alg, minor)					\
2019
ATF_TC_WITHOUT_HEAD(ktls_transmit_##cipher_name##_empty_fragment);	\
2020
ATF_TC_BODY(ktls_transmit_##cipher_name##_empty_fragment, tc)		\
2021
{									\
2022
	struct tls_enable en;						\
2023
	uint64_t seqno;							\
2024
									\
2025
	ATF_REQUIRE_KTLS();						\
2026
	seqno = random();						\
2027
	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2028
	    seqno, &en);						\
2029
	test_ktls_transmit_empty_fragment(tc, &en, seqno);		\
2030
	free_tls_enable(&en);						\
2031
}
2032

2033
#define ADD_TRANSMIT_EMPTY_FRAGMENT_TEST(cipher_name, cipher_alg,	\
2034
	    key_size, auth_alg, minor)					\
2035
	ATF_TP_ADD_TC(tp, ktls_transmit_##cipher_name##_empty_fragment);
2036

2037
#define GEN_TRANSMIT_TESTS(cipher_name, cipher_alg, key_size, auth_alg,	\
2038
	    minor)							\
2039
	GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2040
	    auth_alg, minor, short, 64)					\
2041
	GEN_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2042
	    auth_alg, minor, long, 64 * 1024)				\
2043
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2044
	    auth_alg, minor, control, 0x21 /* Alert */, 32)
2045

2046
#define ADD_TRANSMIT_TESTS(cipher_name, cipher_alg, key_size, auth_alg,	\
2047
	    minor)							\
2048
	ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2049
	    auth_alg, minor, short)					\
2050
	ADD_TRANSMIT_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2051
	    auth_alg, minor, long)					\
2052
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2053
	    auth_alg, minor, control)
2054

2055
/*
2056
 * For each supported cipher suite, run three transmit tests:
2057
 *
2058
 * - a short test which sends 64 bytes of application data (likely as
2059
 *   a single TLS record)
2060
 *
2061
 * - a long test which sends 64KB of application data (split across
2062
 *   multiple TLS records)
2063
 *
2064
 * - a control test which sends a single record with a specific
2065
 *   content type via sendmsg()
2066
 */
2067
AES_CBC_TESTS(GEN_TRANSMIT_TESTS);
2068
AES_GCM_TESTS(GEN_TRANSMIT_TESTS);
2069
CHACHA20_TESTS(GEN_TRANSMIT_TESTS);
2070

2071
#define GEN_TRANSMIT_PADDING_TESTS(cipher_name, cipher_alg, key_size,	\
2072
	    auth_alg, minor)						\
2073
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2074
	    auth_alg, minor, padding_1, 0x21 /* Alert */, 1)		\
2075
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2076
	    auth_alg, minor, padding_2, 0x21 /* Alert */, 2)		\
2077
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2078
	    auth_alg, minor, padding_3, 0x21 /* Alert */, 3)		\
2079
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2080
	    auth_alg, minor, padding_4, 0x21 /* Alert */, 4)		\
2081
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2082
	    auth_alg, minor, padding_5, 0x21 /* Alert */, 5)		\
2083
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2084
	    auth_alg, minor, padding_6, 0x21 /* Alert */, 6)		\
2085
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2086
	    auth_alg, minor, padding_7, 0x21 /* Alert */, 7)		\
2087
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2088
	    auth_alg, minor, padding_8, 0x21 /* Alert */, 8)		\
2089
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2090
	    auth_alg, minor, padding_9, 0x21 /* Alert */, 9)		\
2091
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2092
	    auth_alg, minor, padding_10, 0x21 /* Alert */, 10)		\
2093
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2094
	    auth_alg, minor, padding_11, 0x21 /* Alert */, 11)		\
2095
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2096
	    auth_alg, minor, padding_12, 0x21 /* Alert */, 12)		\
2097
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2098
	    auth_alg, minor, padding_13, 0x21 /* Alert */, 13)		\
2099
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2100
	    auth_alg, minor, padding_14, 0x21 /* Alert */, 14)		\
2101
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2102
	    auth_alg, minor, padding_15, 0x21 /* Alert */, 15)		\
2103
	GEN_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2104
	    auth_alg, minor, padding_16, 0x21 /* Alert */, 16)
2105

2106
#define ADD_TRANSMIT_PADDING_TESTS(cipher_name, cipher_alg, key_size,	\
2107
	    auth_alg, minor)						\
2108
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2109
	    auth_alg, minor, padding_1)					\
2110
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2111
	    auth_alg, minor, padding_2)					\
2112
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2113
	    auth_alg, minor, padding_3)					\
2114
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2115
	    auth_alg, minor, padding_4)					\
2116
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2117
	    auth_alg, minor, padding_5)					\
2118
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2119
	    auth_alg, minor, padding_6)					\
2120
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2121
	    auth_alg, minor, padding_7)					\
2122
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2123
	    auth_alg, minor, padding_8)					\
2124
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2125
	    auth_alg, minor, padding_9)					\
2126
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2127
	    auth_alg, minor, padding_10)				\
2128
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2129
	    auth_alg, minor, padding_11)				\
2130
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2131
	    auth_alg, minor, padding_12)				\
2132
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2133
	    auth_alg, minor, padding_13)				\
2134
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2135
	    auth_alg, minor, padding_14)				\
2136
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2137
	    auth_alg, minor, padding_15)				\
2138
	ADD_TRANSMIT_CONTROL_TEST(cipher_name, cipher_alg, key_size,	\
2139
	    auth_alg, minor, padding_16)
2140

2141
/*
2142
 * For AES-CBC MTE cipher suites using padding, add tests of messages
2143
 * with each possible padding size.  Note that the padding_<N> tests
2144
 * do not necessarily test <N> bytes of padding as the padding is a
2145
 * function of the cipher suite's MAC length.  However, cycling
2146
 * through all of the payload sizes from 1 to 16 should exercise all
2147
 * of the possible padding lengths for each suite.
2148
 */
2149
AES_CBC_TESTS(GEN_TRANSMIT_PADDING_TESTS);
2150

2151
/*
2152
 * Test "empty fragments" which are TLS records with no payload that
2153
 * OpenSSL can send for TLS 1.0 connections.
2154
 */
2155
AES_CBC_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST);
2156
AES_GCM_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST);
2157
CHACHA20_TESTS(GEN_TRANSMIT_EMPTY_FRAGMENT_TEST);
2158

2159
static void
2160
test_ktls_invalid_transmit_cipher_suite(const atf_tc_t *tc,
2161
    struct tls_enable *en)
2162
{
2163
	int sockets[2];
2164

2165
	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
2166

2167
	ATF_REQUIRE_ERRNO(EINVAL, setsockopt(sockets[1], IPPROTO_TCP,
2168
	    TCP_TXTLS_ENABLE, en, sizeof(*en)) == -1);
2169

2170
	close_sockets(sockets);
2171
}
2172

2173
#define GEN_INVALID_TRANSMIT_TEST(name, cipher_alg, key_size, auth_alg,	\
2174
	    minor)							\
2175
ATF_TC_WITHOUT_HEAD(ktls_transmit_invalid_##name);			\
2176
ATF_TC_BODY(ktls_transmit_invalid_##name, tc)				\
2177
{									\
2178
	struct tls_enable en;						\
2179
	uint64_t seqno;							\
2180
									\
2181
	ATF_REQUIRE_KTLS();						\
2182
	seqno = random();						\
2183
	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2184
	    seqno, &en);						\
2185
	test_ktls_invalid_transmit_cipher_suite(tc, &en);		\
2186
	free_tls_enable(&en);						\
2187
}
2188

2189
#define ADD_INVALID_TRANSMIT_TEST(name, cipher_alg, key_size, auth_alg, \
2190
	    minor)							\
2191
	ATF_TP_ADD_TC(tp, ktls_transmit_invalid_##name);
2192

2193
#define	INVALID_CIPHER_SUITES(M)					\
2194
	M(aes128_cbc_1_0_sha256, CRYPTO_AES_CBC, 128 / 8,		\
2195
	    CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_ZERO)			\
2196
	M(aes128_cbc_1_0_sha384, CRYPTO_AES_CBC, 128 / 8,		\
2197
	    CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_ZERO)			\
2198
	M(aes128_gcm_1_0, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,		\
2199
	    TLS_MINOR_VER_ZERO)						\
2200
	M(chacha20_poly1305_1_0, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0,	\
2201
	    TLS_MINOR_VER_ZERO)						\
2202
	M(aes128_cbc_1_1_sha256, CRYPTO_AES_CBC, 128 / 8,		\
2203
	    CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_ONE)			\
2204
	M(aes128_cbc_1_1_sha384, CRYPTO_AES_CBC, 128 / 8,		\
2205
	    CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_ONE)			\
2206
	M(aes128_gcm_1_1, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,		\
2207
	    TLS_MINOR_VER_ONE)						\
2208
	M(chacha20_poly1305_1_1, CRYPTO_CHACHA20_POLY1305, 256 / 8, 0,	\
2209
	    TLS_MINOR_VER_ONE)						\
2210
	M(aes128_cbc_1_3_sha1, CRYPTO_AES_CBC, 128 / 8,			\
2211
	    CRYPTO_SHA1_HMAC, TLS_MINOR_VER_THREE)			\
2212
	M(aes128_cbc_1_3_sha256, CRYPTO_AES_CBC, 128 / 8,		\
2213
	    CRYPTO_SHA2_256_HMAC, TLS_MINOR_VER_THREE)			\
2214
	M(aes128_cbc_1_3_sha384, CRYPTO_AES_CBC, 128 / 8,		\
2215
	    CRYPTO_SHA2_384_HMAC, TLS_MINOR_VER_THREE)
2216

2217
/*
2218
 * Ensure that invalid cipher suites are rejected for transmit.
2219
 */
2220
INVALID_CIPHER_SUITES(GEN_INVALID_TRANSMIT_TEST);
2221

2222
#define GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2223
	    auth_alg, minor, name, len, padding)			\
2224
ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_##name);		\
2225
ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc)			\
2226
{									\
2227
	struct tls_enable en;						\
2228
	uint64_t seqno;							\
2229
									\
2230
	ATF_REQUIRE_KTLS();						\
2231
	seqno = random();						\
2232
	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2233
	    seqno, &en);						\
2234
	test_ktls_receive_app_data(tc, &en, seqno, len, padding);	\
2235
	free_tls_enable(&en);						\
2236
}
2237

2238
#define ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2239
	    auth_alg, minor, name)					\
2240
	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name);
2241

2242
#define GEN_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2243
	    auth_alg, minor, len)					\
2244
ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_data);		\
2245
ATF_TC_BODY(ktls_receive_##cipher_name##_bad_data, tc)			\
2246
{									\
2247
	struct tls_enable en;						\
2248
	uint64_t seqno;							\
2249
									\
2250
	ATF_REQUIRE_KTLS();						\
2251
	seqno = random();						\
2252
	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2253
	    seqno, &en);						\
2254
	test_ktls_receive_corrupted_data(tc, &en, seqno, len);		\
2255
	free_tls_enable(&en);						\
2256
}
2257

2258
#define ADD_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2259
	    auth_alg, minor)						\
2260
	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_data);
2261

2262
#define GEN_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size,	\
2263
	    auth_alg, minor, len)					\
2264
ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_mac);		\
2265
ATF_TC_BODY(ktls_receive_##cipher_name##_bad_mac, tc)			\
2266
{									\
2267
	struct tls_enable en;						\
2268
	uint64_t seqno;							\
2269
									\
2270
	ATF_REQUIRE_KTLS();						\
2271
	seqno = random();						\
2272
	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2273
	    seqno, &en);						\
2274
	test_ktls_receive_corrupted_mac(tc, &en, seqno, len);		\
2275
	free_tls_enable(&en);						\
2276
}
2277

2278
#define ADD_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size,	\
2279
	    auth_alg, minor)						\
2280
	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_mac);
2281

2282
#define GEN_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size,	\
2283
	    auth_alg, minor, len)					\
2284
ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_truncated_record);	\
2285
ATF_TC_BODY(ktls_receive_##cipher_name##_truncated_record, tc)		\
2286
{									\
2287
	struct tls_enable en;						\
2288
	uint64_t seqno;							\
2289
									\
2290
	ATF_REQUIRE_KTLS();						\
2291
	seqno = random();						\
2292
	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2293
	    seqno, &en);						\
2294
	test_ktls_receive_truncated_record(tc, &en, seqno, len);	\
2295
	free_tls_enable(&en);						\
2296
}
2297

2298
#define ADD_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size,	\
2299
	    auth_alg, minor)						\
2300
	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_truncated_record);
2301

2302
#define GEN_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size,	\
2303
	    auth_alg, minor, len)					\
2304
ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_major);		\
2305
ATF_TC_BODY(ktls_receive_##cipher_name##_bad_major, tc)			\
2306
{									\
2307
	struct tls_enable en;						\
2308
	uint64_t seqno;							\
2309
									\
2310
	ATF_REQUIRE_KTLS();						\
2311
	seqno = random();						\
2312
	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2313
	    seqno, &en);						\
2314
	test_ktls_receive_bad_major(tc, &en, seqno, len);		\
2315
	free_tls_enable(&en);						\
2316
}
2317

2318
#define ADD_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size,	\
2319
	    auth_alg, minor)						\
2320
	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_major);
2321

2322
#define GEN_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size,	\
2323
	    auth_alg, minor, len)					\
2324
ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_minor);		\
2325
ATF_TC_BODY(ktls_receive_##cipher_name##_bad_minor, tc)			\
2326
{									\
2327
	struct tls_enable en;						\
2328
	uint64_t seqno;							\
2329
									\
2330
	ATF_REQUIRE_KTLS();						\
2331
	seqno = random();						\
2332
	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2333
	    seqno, &en);						\
2334
	test_ktls_receive_bad_minor(tc, &en, seqno, len);		\
2335
	free_tls_enable(&en);						\
2336
}
2337

2338
#define ADD_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size,	\
2339
	    auth_alg, minor)						\
2340
	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_minor);
2341

2342
#define GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2343
	    auth_alg, minor, name, len)					\
2344
ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_##name);		\
2345
ATF_TC_BODY(ktls_receive_##cipher_name##_##name, tc)			\
2346
{									\
2347
	struct tls_enable en;						\
2348
	uint64_t seqno;							\
2349
									\
2350
	ATF_REQUIRE_KTLS();						\
2351
	seqno = random();						\
2352
	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2353
	    seqno, &en);						\
2354
	test_ktls_receive_bad_size(tc, &en, seqno, (len));		\
2355
	free_tls_enable(&en);						\
2356
}
2357

2358
#define ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2359
	    auth_alg, minor, name)					\
2360
	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_##name);
2361

2362
#define GEN_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg,	\
2363
	    minor)							\
2364
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2365
	    auth_alg, minor, short, 64, 0)				\
2366
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2367
	    auth_alg, minor, long, 64 * 1024, 0)			\
2368
	GEN_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2369
	    auth_alg, minor, 64)					\
2370
	GEN_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size,	\
2371
	    auth_alg, minor, 64)					\
2372
	GEN_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size,	\
2373
	    auth_alg, minor, 64)					\
2374
	GEN_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size,	\
2375
	    auth_alg, minor, 64)					\
2376
	GEN_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size,	\
2377
	    auth_alg, minor, 64)					\
2378
	GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2379
	    auth_alg, minor, small_record,				\
2380
	    tls_minimum_record_payload(&en) - 1)			\
2381
	GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2382
	    auth_alg, minor, oversized_record,				\
2383
	    TLS_MAX_MSG_SIZE_V10_2 * 2)
2384

2385
#define ADD_RECEIVE_TESTS(cipher_name, cipher_alg, key_size, auth_alg,	\
2386
	    minor)							\
2387
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2388
	    auth_alg, minor, short)					\
2389
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2390
	    auth_alg, minor, long)					\
2391
	ADD_RECEIVE_BAD_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2392
	    auth_alg, minor)						\
2393
	ADD_RECEIVE_BAD_MAC_TEST(cipher_name, cipher_alg, key_size,	\
2394
	    auth_alg, minor)						\
2395
	ADD_RECEIVE_TRUNCATED_TEST(cipher_name, cipher_alg, key_size,	\
2396
	    auth_alg, minor)						\
2397
	ADD_RECEIVE_BAD_MAJOR_TEST(cipher_name, cipher_alg, key_size,	\
2398
	    auth_alg, minor)						\
2399
	ADD_RECEIVE_BAD_MINOR_TEST(cipher_name, cipher_alg, key_size,	\
2400
	    auth_alg, minor)						\
2401
	ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2402
	    auth_alg, minor, small_record)				\
2403
	ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2404
	    auth_alg, minor, oversized_record)
2405

2406
/*
2407
 * For each supported cipher suite, run several receive tests:
2408
 *
2409
 * - a short test which sends 64 bytes of application data (likely as
2410
 *   a single TLS record)
2411
 *
2412
 * - a long test which sends 64KB of application data (split across
2413
 *   multiple TLS records)
2414
 *
2415
 * - a test with corrupted payload data in a single TLS record
2416
 *
2417
 * - a test with a corrupted MAC in a single TLS record
2418
 *
2419
 * - a test with a truncated TLS record
2420
 *
2421
 * - tests with invalid TLS major and minor versions
2422
 *
2423
 * - a tests with a record whose is one less than the smallest valid
2424
 *   size
2425
 *
2426
 * - a test with an oversized TLS record
2427
 */
2428
AES_CBC_NONZERO_TESTS(GEN_RECEIVE_TESTS);
2429
AES_GCM_TESTS(GEN_RECEIVE_TESTS);
2430
CHACHA20_TESTS(GEN_RECEIVE_TESTS);
2431

2432
#define	GEN_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg,		\
2433
	    key_size, auth_alg, minor)					\
2434
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2435
	    auth_alg, minor, padding_1, 1, 0)				\
2436
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2437
	    auth_alg, minor, padding_2, 2, 0)				\
2438
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2439
	    auth_alg, minor, padding_3, 3, 0)				\
2440
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2441
	    auth_alg, minor, padding_4, 4, 0)				\
2442
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2443
	    auth_alg, minor, padding_5, 5, 0)				\
2444
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2445
	    auth_alg, minor, padding_6, 6, 0)				\
2446
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2447
	    auth_alg, minor, padding_7, 7, 0)				\
2448
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2449
	    auth_alg, minor, padding_8, 8, 0)				\
2450
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2451
	    auth_alg, minor, padding_9, 9, 0)				\
2452
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2453
	    auth_alg, minor, padding_10, 10, 0)				\
2454
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2455
	    auth_alg, minor, padding_11, 11, 0)				\
2456
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2457
	    auth_alg, minor, padding_12, 12, 0)				\
2458
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2459
	    auth_alg, minor, padding_13, 13, 0)				\
2460
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2461
	    auth_alg, minor, padding_14, 14, 0)				\
2462
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2463
	    auth_alg, minor, padding_15, 15, 0)				\
2464
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2465
	    auth_alg, minor, padding_16, 16, 0)				\
2466
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2467
	    auth_alg, minor, padding_16_extra, 16, 16)			\
2468
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2469
	    auth_alg, minor, padding_32_extra, 16, 32)
2470

2471
#define ADD_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg,		\
2472
	    key_size, auth_alg, minor)					\
2473
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2474
	    auth_alg, minor, padding_1)					\
2475
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2476
	    auth_alg, minor, padding_2)					\
2477
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2478
	    auth_alg, minor, padding_3)					\
2479
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2480
	    auth_alg, minor, padding_4)					\
2481
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2482
	    auth_alg, minor, padding_5)					\
2483
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2484
	    auth_alg, minor, padding_6)					\
2485
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2486
	    auth_alg, minor, padding_7)					\
2487
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2488
	    auth_alg, minor, padding_8)					\
2489
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2490
	    auth_alg, minor, padding_9)					\
2491
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2492
	    auth_alg, minor, padding_10)				\
2493
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2494
	    auth_alg, minor, padding_11)				\
2495
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2496
	    auth_alg, minor, padding_12)				\
2497
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2498
	    auth_alg, minor, padding_13)				\
2499
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2500
	    auth_alg, minor, padding_14)				\
2501
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2502
	    auth_alg, minor, padding_15)				\
2503
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2504
	    auth_alg, minor, padding_16)				\
2505
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2506
	    auth_alg, minor, padding_16_extra)				\
2507
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2508
	    auth_alg, minor, padding_32_extra)
2509

2510
#define GEN_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size,	\
2511
	    auth_alg, minor, len)					\
2512
ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_padding);		\
2513
ATF_TC_BODY(ktls_receive_##cipher_name##_bad_padding, tc)		\
2514
{									\
2515
	struct tls_enable en;						\
2516
	uint64_t seqno;							\
2517
									\
2518
	ATF_REQUIRE_KTLS();						\
2519
	seqno = random();						\
2520
	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2521
	    seqno, &en);						\
2522
	test_ktls_receive_corrupted_padding(tc, &en, seqno, len);	\
2523
	free_tls_enable(&en);						\
2524
}
2525

2526
#define ADD_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size,	\
2527
	    auth_alg, minor)						\
2528
	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_padding);
2529

2530
#define	GEN_RECEIVE_MTE_TESTS(cipher_name, cipher_alg, key_size,	\
2531
	    auth_alg, minor)						\
2532
	GEN_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg,		\
2533
	    key_size, auth_alg, minor)					\
2534
	GEN_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size,	\
2535
	    auth_alg, minor, 64)					\
2536
	GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2537
	    auth_alg, minor, non_block_size,				\
2538
	    tls_minimum_record_payload(&en) + 1)
2539

2540
#define	ADD_RECEIVE_MTE_TESTS(cipher_name, cipher_alg, key_size,	\
2541
	    auth_alg, minor)						\
2542
	ADD_RECEIVE_MTE_PADDING_TESTS(cipher_name, cipher_alg,		\
2543
	    key_size, auth_alg, minor)					\
2544
	ADD_RECEIVE_BAD_PADDING_TEST(cipher_name, cipher_alg, key_size,	\
2545
	    auth_alg, minor)						\
2546
	ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2547
	    auth_alg, minor, non_block_size)
2548

2549
/*
2550
 * For AES-CBC MTE cipher suites using padding, add tests of messages
2551
 * with each possible padding size.  Note that the padding_<N> tests
2552
 * do not necessarily test <N> bytes of padding as the padding is a
2553
 * function of the cipher suite's MAC length.  However, cycling
2554
 * through all of the payload sizes from 1 to 16 should exercise all
2555
 * of the possible padding lengths for each suite.
2556
 *
2557
 * Two additional tests check for additional padding with an extra
2558
 * 16 or 32 bytes beyond the normal padding.
2559
 *
2560
 * Another test checks for corrupted padding.
2561
 *
2562
 * Another test checks for a record whose payload is not a multiple of
2563
 * the AES block size.
2564
 */
2565
AES_CBC_NONZERO_TESTS(GEN_RECEIVE_MTE_TESTS);
2566

2567
#define GEN_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size,	\
2568
	    auth_alg, minor)						\
2569
ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_iv);		\
2570
ATF_TC_BODY(ktls_receive_##cipher_name##_bad_iv, tc)			\
2571
{									\
2572
	struct tls_enable en;						\
2573
	uint64_t seqno;							\
2574
									\
2575
	ATF_REQUIRE_KTLS();						\
2576
	seqno = random();						\
2577
	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2578
	    seqno, &en);						\
2579
	test_ktls_receive_corrupted_iv(tc, &en, seqno, 64);		\
2580
	free_tls_enable(&en);						\
2581
}
2582

2583
#define ADD_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size,	\
2584
	    auth_alg, minor)						\
2585
	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_iv);
2586

2587
#define	GEN_RECEIVE_EXPLICIT_IV_TESTS(cipher_name, cipher_alg,		\
2588
	    key_size, auth_alg, minor)					\
2589
	GEN_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size,	\
2590
	    auth_alg, minor)						\
2591
	GEN_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2592
	    auth_alg, minor, short_header,				\
2593
	    sizeof(struct tls_record_layer) + 1)
2594

2595
#define	ADD_RECEIVE_EXPLICIT_IV_TESTS(cipher_name, cipher_alg,		\
2596
	    key_size, auth_alg, minor)					\
2597
	ADD_RECEIVE_BAD_IV_TEST(cipher_name, cipher_alg, key_size,	\
2598
	    auth_alg, minor)						\
2599
	ADD_RECEIVE_BAD_SIZE_TEST(cipher_name, cipher_alg, key_size,	\
2600
	    auth_alg, minor, short_header)
2601

2602
/*
2603
 * For cipher suites with an explicit IV, run a receive test where the
2604
 * explicit IV has been corrupted.  Also run a receive test that sends
2605
 * a short record without a complete IV.
2606
 */
2607
AES_CBC_NONZERO_TESTS(GEN_RECEIVE_EXPLICIT_IV_TESTS);
2608
AES_GCM_12_TESTS(GEN_RECEIVE_EXPLICIT_IV_TESTS);
2609

2610
#define GEN_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size,	\
2611
	    auth_alg, minor, len)					\
2612
ATF_TC_WITHOUT_HEAD(ktls_receive_##cipher_name##_bad_type);		\
2613
ATF_TC_BODY(ktls_receive_##cipher_name##_bad_type, tc)			\
2614
{									\
2615
	struct tls_enable en;						\
2616
	uint64_t seqno;							\
2617
									\
2618
	ATF_REQUIRE_KTLS();						\
2619
	seqno = random();						\
2620
	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2621
	    seqno, &en);						\
2622
	test_ktls_receive_bad_type(tc, &en, seqno, len);		\
2623
	free_tls_enable(&en);						\
2624
}
2625

2626
#define ADD_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size,	\
2627
	    auth_alg, minor)						\
2628
	ATF_TP_ADD_TC(tp, ktls_receive_##cipher_name##_bad_type);
2629

2630
#define GEN_RECEIVE_TLS13_TESTS(cipher_name, cipher_alg, key_size,	\
2631
	    auth_alg, minor)						\
2632
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2633
	    auth_alg, minor, short_padded, 64, 16)			\
2634
	GEN_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2635
	    auth_alg, minor, long_padded, 64 * 1024, 15)		\
2636
	GEN_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size,	\
2637
	    auth_alg, minor, 64)
2638

2639
#define ADD_RECEIVE_TLS13_TESTS(cipher_name, cipher_alg, key_size,	\
2640
	    auth_alg, minor)						\
2641
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2642
	    auth_alg, minor, short_padded)				\
2643
	ADD_RECEIVE_APP_DATA_TEST(cipher_name, cipher_alg, key_size,	\
2644
	    auth_alg, minor, long_padded)				\
2645
	ADD_RECEIVE_BAD_TYPE_TEST(cipher_name, cipher_alg, key_size,	\
2646
	    auth_alg, minor)
2647

2648
/*
2649
 * For TLS 1.3 cipher suites, run two additional receive tests which
2650
 * use add padding to each record.  Also run a test that uses an
2651
 * invalid "outer" record type.
2652
 */
2653
TLS_13_TESTS(GEN_RECEIVE_TLS13_TESTS);
2654

2655
static void
2656
test_ktls_invalid_receive_cipher_suite(const atf_tc_t *tc,
2657
    struct tls_enable *en)
2658
{
2659
	int sockets[2];
2660

2661
	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
2662

2663
	ATF_REQUIRE_ERRNO(EINVAL, setsockopt(sockets[1], IPPROTO_TCP,
2664
	    TCP_RXTLS_ENABLE, en, sizeof(*en)) == -1);
2665

2666
	close_sockets(sockets);
2667
}
2668

2669
#define GEN_INVALID_RECEIVE_TEST(name, cipher_alg, key_size, auth_alg,	\
2670
	    minor)							\
2671
ATF_TC_WITHOUT_HEAD(ktls_receive_invalid_##name);			\
2672
ATF_TC_BODY(ktls_receive_invalid_##name, tc)				\
2673
{									\
2674
	struct tls_enable en;						\
2675
	uint64_t seqno;							\
2676
									\
2677
	ATF_REQUIRE_KTLS();						\
2678
	seqno = random();						\
2679
	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2680
	    seqno, &en);						\
2681
	test_ktls_invalid_receive_cipher_suite(tc, &en);		\
2682
	free_tls_enable(&en);						\
2683
}
2684

2685
#define ADD_INVALID_RECEIVE_TEST(name, cipher_alg, key_size, auth_alg,	\
2686
	    minor)							\
2687
	ATF_TP_ADD_TC(tp, ktls_receive_invalid_##name);
2688

2689
/*
2690
 * Ensure that invalid cipher suites are rejected for receive.
2691
 */
2692
INVALID_CIPHER_SUITES(GEN_INVALID_RECEIVE_TEST);
2693

2694
static void
2695
test_ktls_unsupported_receive_cipher_suite(const atf_tc_t *tc,
2696
    struct tls_enable *en)
2697
{
2698
	int sockets[2];
2699

2700
	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
2701

2702
	ATF_REQUIRE_ERRNO(EPROTONOSUPPORT, setsockopt(sockets[1], IPPROTO_TCP,
2703
	    TCP_RXTLS_ENABLE, en, sizeof(*en)) == -1);
2704

2705
	close_sockets(sockets);
2706
}
2707

2708
#define GEN_UNSUPPORTED_RECEIVE_TEST(name, cipher_alg, key_size,	\
2709
	    auth_alg, minor)						\
2710
ATF_TC_WITHOUT_HEAD(ktls_receive_unsupported_##name);			\
2711
ATF_TC_BODY(ktls_receive_unsupported_##name, tc)			\
2712
{									\
2713
	struct tls_enable en;						\
2714
	uint64_t seqno;							\
2715
									\
2716
	ATF_REQUIRE_KTLS();						\
2717
	seqno = random();						\
2718
	build_tls_enable(tc, cipher_alg, key_size, auth_alg, minor,	\
2719
	    seqno, &en);						\
2720
	test_ktls_unsupported_receive_cipher_suite(tc, &en);		\
2721
	free_tls_enable(&en);						\
2722
}
2723

2724
#define ADD_UNSUPPORTED_RECEIVE_TEST(name, cipher_alg, key_size,	\
2725
	    auth_alg, minor)						\
2726
	ATF_TP_ADD_TC(tp, ktls_receive_unsupported_##name);
2727

2728
/*
2729
 * Ensure that valid cipher suites not supported for receive are
2730
 * rejected.
2731
 */
2732
TLS_10_TESTS(GEN_UNSUPPORTED_RECEIVE_TEST);
2733

2734
/*
2735
 * Try to perform an invalid sendto(2) on a TXTLS-enabled socket, to exercise
2736
 * KTLS error handling in the socket layer.
2737
 */
2738
ATF_TC_WITHOUT_HEAD(ktls_sendto_baddst);
2739
ATF_TC_BODY(ktls_sendto_baddst, tc)
2740
{
2741
	char buf[32];
2742
	struct sockaddr_in dst;
2743
	struct tls_enable en;
2744
	ssize_t n;
2745
	int s;
2746

2747
	ATF_REQUIRE_KTLS();
2748

2749
	s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
2750
	ATF_REQUIRE(s >= 0);
2751

2752
	build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
2753
	    TLS_MINOR_VER_THREE, (uint64_t)random(), &en);
2754

2755
	ATF_REQUIRE(setsockopt(s, IPPROTO_TCP, TCP_TXTLS_ENABLE, &en,
2756
	    sizeof(en)) == 0);
2757

2758
	memset(&dst, 0, sizeof(dst));
2759
	dst.sin_family = AF_INET;
2760
	dst.sin_len = sizeof(dst);
2761
	dst.sin_addr.s_addr = htonl(INADDR_BROADCAST);
2762
	dst.sin_port = htons(12345);
2763

2764
	memset(buf, 0, sizeof(buf));
2765
	n = sendto(s, buf, sizeof(buf), 0, (struct sockaddr *)&dst,
2766
	    sizeof(dst));
2767

2768
	/* Can't transmit to the broadcast address over TCP. */
2769
	ATF_REQUIRE_ERRNO(EACCES, n == -1);
2770
	ATF_REQUIRE(close(s) == 0);
2771
}
2772

2773
/*
2774
 * Make sure that listen(2) returns an error for KTLS-enabled sockets, and
2775
 * verify that an attempt to enable KTLS on a listening socket fails.
2776
 */
2777
ATF_TC_WITHOUT_HEAD(ktls_listening_socket);
2778
ATF_TC_BODY(ktls_listening_socket, tc)
2779
{
2780
	struct tls_enable en;
2781
	struct sockaddr_in sin;
2782
	int s;
2783

2784
	ATF_REQUIRE_KTLS();
2785

2786
	s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
2787
	ATF_REQUIRE(s >= 0);
2788
	build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
2789
	    TLS_MINOR_VER_THREE, (uint64_t)random(), &en);
2790
	ATF_REQUIRE(setsockopt(s, IPPROTO_TCP, TCP_TXTLS_ENABLE, &en,
2791
	    sizeof(en)) == 0);
2792
	ATF_REQUIRE_ERRNO(EINVAL, listen(s, 1) == -1);
2793
	ATF_REQUIRE(close(s) == 0);
2794

2795
	s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
2796
	ATF_REQUIRE(s >= 0);
2797
	build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
2798
	    TLS_MINOR_VER_THREE, (uint64_t)random(), &en);
2799
	ATF_REQUIRE(setsockopt(s, IPPROTO_TCP, TCP_RXTLS_ENABLE, &en,
2800
	    sizeof(en)) == 0);
2801
	ATF_REQUIRE_ERRNO(EINVAL, listen(s, 1) == -1);
2802
	ATF_REQUIRE(close(s) == 0);
2803

2804
	s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
2805
	ATF_REQUIRE(s >= 0);
2806
	memset(&sin, 0, sizeof(sin));
2807
	sin.sin_family = AF_INET;
2808
	sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
2809
	ATF_REQUIRE(bind(s, (struct sockaddr *)&sin, sizeof(sin)) == 0);
2810
	ATF_REQUIRE(listen(s, 1) == 0);
2811
	build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
2812
	    TLS_MINOR_VER_THREE, (uint64_t)random(), &en);
2813
	ATF_REQUIRE_ERRNO(ENOTCONN,
2814
	    setsockopt(s, IPPROTO_TCP, TCP_TXTLS_ENABLE, &en, sizeof(en)) != 0);
2815
	ATF_REQUIRE_ERRNO(ENOTCONN,
2816
	    setsockopt(s, IPPROTO_TCP, TCP_RXTLS_ENABLE, &en, sizeof(en)) != 0);
2817
	ATF_REQUIRE(close(s) == 0);
2818
}
2819

2820
ATF_TP_ADD_TCS(tp)
2821
{
2822
	/* Transmit tests */
2823
	AES_CBC_TESTS(ADD_TRANSMIT_TESTS);
2824
	AES_GCM_TESTS(ADD_TRANSMIT_TESTS);
2825
	CHACHA20_TESTS(ADD_TRANSMIT_TESTS);
2826
	AES_CBC_TESTS(ADD_TRANSMIT_PADDING_TESTS);
2827
	AES_CBC_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST);
2828
	AES_GCM_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST);
2829
	CHACHA20_TESTS(ADD_TRANSMIT_EMPTY_FRAGMENT_TEST);
2830
	INVALID_CIPHER_SUITES(ADD_INVALID_TRANSMIT_TEST);
2831

2832
	/* Receive tests */
2833
	TLS_10_TESTS(ADD_UNSUPPORTED_RECEIVE_TEST);
2834
	AES_CBC_NONZERO_TESTS(ADD_RECEIVE_TESTS);
2835
	AES_GCM_TESTS(ADD_RECEIVE_TESTS);
2836
	CHACHA20_TESTS(ADD_RECEIVE_TESTS);
2837
	AES_CBC_NONZERO_TESTS(ADD_RECEIVE_MTE_TESTS);
2838
	AES_CBC_NONZERO_TESTS(ADD_RECEIVE_EXPLICIT_IV_TESTS);
2839
	AES_GCM_12_TESTS(ADD_RECEIVE_EXPLICIT_IV_TESTS);
2840
	TLS_13_TESTS(ADD_RECEIVE_TLS13_TESTS);
2841
	INVALID_CIPHER_SUITES(ADD_INVALID_RECEIVE_TEST);
2842

2843
	/* Miscellaneous */
2844
	ATF_TP_ADD_TC(tp, ktls_sendto_baddst);
2845
	ATF_TP_ADD_TC(tp, ktls_listening_socket);
2846

2847
	return (atf_no_error());
2848
}
2849

2850
Product

Resources

Company
