* [net-next 0/5] Add CHACHA20-POLY1305 cipher to Kernel TLS
@ 2020-11-22 1:57 Vadim Fedorenko
2020-11-22 1:57 ` [net-next 1/5] net/tls: make inline helpers protocol-aware Vadim Fedorenko
` (4 more replies)
0 siblings, 5 replies; 7+ messages in thread
From: Vadim Fedorenko @ 2020-11-22 1:57 UTC (permalink / raw)
To: Jakub Kicinski, Boris Pismenny, Aviad Yehezkel; +Cc: Vadim Fedorenko, netdev
RFC 7905 defines usage of ChaCha20-Poly1305 in TLS connections. This
cipher is widely used nowadays and it's good to have a support for it
in TLS connections in kernel
Vadim Fedorenko (5):
net/tls: make inline helpers protocol-aware
net/tls: add CHACHA20-POLY1305 specific defines and structures
net/tls: add CHACHA20-POLY1305 specific behavior
net/tls: add CHACHA20-POLY1305 configuration
selftests/tls: add CHACHA20-POLY1305 to tls selftests
include/net/tls.h | 32 ++++++++++++++++---------------
include/uapi/linux/tls.h | 15 +++++++++++++++
net/tls/tls_device.c | 2 +-
net/tls/tls_device_fallback.c | 13 +++++++------
net/tls/tls_main.c | 3 +++
net/tls/tls_sw.c | 36 ++++++++++++++++++++++++++---------
tools/testing/selftests/net/tls.c | 40 ++++++++++++++++++++++++++++++++-------
7 files changed, 103 insertions(+), 38 deletions(-)
--
1.8.3.1
^ permalink raw reply [flat|nested] 7+ messages in thread* [net-next 1/5] net/tls: make inline helpers protocol-aware 2020-11-22 1:57 [net-next 0/5] Add CHACHA20-POLY1305 cipher to Kernel TLS Vadim Fedorenko @ 2020-11-22 1:57 ` Vadim Fedorenko 2020-11-22 1:57 ` [net-next 2/5] net/tls: add CHACHA20-POLY1305 specific defines and structures Vadim Fedorenko ` (3 subsequent siblings) 4 siblings, 0 replies; 7+ messages in thread From: Vadim Fedorenko @ 2020-11-22 1:57 UTC (permalink / raw) To: Jakub Kicinski, Boris Pismenny, Aviad Yehezkel; +Cc: Vadim Fedorenko, netdev Inline functions defined in tls.h have a lot of AES-specific constants. Remove these constants and change argument to struct tls_prot_info to have an access to cipher type in later patches Signed-off-by: Vadim Fedorenko <vfedorenko@novek.ru> --- include/net/tls.h | 26 ++++++++++++-------------- net/tls/tls_device.c | 2 +- net/tls/tls_device_fallback.c | 13 +++++++------ net/tls/tls_sw.c | 12 +++++------- 4 files changed, 25 insertions(+), 28 deletions(-) diff --git a/include/net/tls.h b/include/net/tls.h index cf14730..d04ce73 100644 --- a/include/net/tls.h +++ b/include/net/tls.h @@ -502,31 +502,30 @@ static inline void tls_advance_record_sn(struct sock *sk, tls_err_abort(sk, EBADMSG); if (prot->version != TLS_1_3_VERSION) - tls_bigint_increment(ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE, + tls_bigint_increment(ctx->iv + prot->salt_size, prot->iv_size); } static inline void tls_fill_prepend(struct tls_context *ctx, char *buf, size_t plaintext_len, - unsigned char record_type, - int version) + unsigned char record_type) { struct tls_prot_info *prot = &ctx->prot_info; size_t pkt_len, iv_size = prot->iv_size; pkt_len = plaintext_len + prot->tag_size; - if (version != TLS_1_3_VERSION) { + if (prot->version != TLS_1_3_VERSION) { pkt_len += iv_size; memcpy(buf + TLS_NONCE_OFFSET, - ctx->tx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE, iv_size); + ctx->tx.iv + prot->salt_size, iv_size); } /* we cover nonce explicit here as well, so buf should be of * size KTLS_DTLS_HEADER_SIZE + KTLS_DTLS_NONCE_EXPLICIT_SIZE */ - buf[0] = version == TLS_1_3_VERSION ? + buf[0] = prot->version == TLS_1_3_VERSION ? TLS_RECORD_TYPE_DATA : record_type; /* Note that VERSION must be TLS_1_2 for both TLS1.2 and TLS1.3 */ buf[1] = TLS_1_2_VERSION_MINOR; @@ -539,18 +538,17 @@ static inline void tls_fill_prepend(struct tls_context *ctx, static inline void tls_make_aad(char *buf, size_t size, char *record_sequence, - int record_sequence_size, unsigned char record_type, - int version) + struct tls_prot_info *prot) { - if (version != TLS_1_3_VERSION) { - memcpy(buf, record_sequence, record_sequence_size); + if (prot->version != TLS_1_3_VERSION) { + memcpy(buf, record_sequence, prot->rec_seq_size); buf += 8; } else { - size += TLS_CIPHER_AES_GCM_128_TAG_SIZE; + size += prot->tag_size; } - buf[0] = version == TLS_1_3_VERSION ? + buf[0] = prot->version == TLS_1_3_VERSION ? TLS_RECORD_TYPE_DATA : record_type; buf[1] = TLS_1_2_VERSION_MAJOR; buf[2] = TLS_1_2_VERSION_MINOR; @@ -558,11 +556,11 @@ static inline void tls_make_aad(char *buf, buf[4] = size & 0xFF; } -static inline void xor_iv_with_seq(int version, char *iv, char *seq) +static inline void xor_iv_with_seq(struct tls_prot_info *prot, char *iv, char *seq) { int i; - if (version == TLS_1_3_VERSION) { + if (prot->version == TLS_1_3_VERSION) { for (i = 0; i < 8; i++) iv[i + 4] ^= seq[i]; } diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c index 54d3e16..6f93ad5 100644 --- a/net/tls/tls_device.c +++ b/net/tls/tls_device.c @@ -327,7 +327,7 @@ static int tls_device_record_close(struct sock *sk, /* fill prepend */ tls_fill_prepend(ctx, skb_frag_address(&record->frags[0]), record->len - prot->overhead_size, - record_type, prot->version); + record_type); return ret; } diff --git a/net/tls/tls_device_fallback.c b/net/tls/tls_device_fallback.c index 2889533..d946817 100644 --- a/net/tls/tls_device_fallback.c +++ b/net/tls/tls_device_fallback.c @@ -49,7 +49,8 @@ static int tls_enc_record(struct aead_request *aead_req, struct crypto_aead *aead, char *aad, char *iv, __be64 rcd_sn, struct scatter_walk *in, - struct scatter_walk *out, int *in_len) + struct scatter_walk *out, int *in_len, + struct tls_prot_info *prot) { unsigned char buf[TLS_HEADER_SIZE + TLS_CIPHER_AES_GCM_128_IV_SIZE]; struct scatterlist sg_in[3]; @@ -73,8 +74,7 @@ static int tls_enc_record(struct aead_request *aead_req, len -= TLS_CIPHER_AES_GCM_128_IV_SIZE; tls_make_aad(aad, len - TLS_CIPHER_AES_GCM_128_TAG_SIZE, - (char *)&rcd_sn, sizeof(rcd_sn), buf[0], - TLS_1_2_VERSION); + (char *)&rcd_sn, buf[0], prot); memcpy(iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE, buf + TLS_HEADER_SIZE, TLS_CIPHER_AES_GCM_128_IV_SIZE); @@ -140,7 +140,7 @@ static struct aead_request *tls_alloc_aead_request(struct crypto_aead *aead, static int tls_enc_records(struct aead_request *aead_req, struct crypto_aead *aead, struct scatterlist *sg_in, struct scatterlist *sg_out, char *aad, char *iv, - u64 rcd_sn, int len) + u64 rcd_sn, int len, struct tls_prot_info *prot) { struct scatter_walk out, in; int rc; @@ -150,7 +150,7 @@ static int tls_enc_records(struct aead_request *aead_req, do { rc = tls_enc_record(aead_req, aead, aad, iv, - cpu_to_be64(rcd_sn), &in, &out, &len); + cpu_to_be64(rcd_sn), &in, &out, &len, prot); rcd_sn++; } while (rc == 0 && len); @@ -348,7 +348,8 @@ static struct sk_buff *tls_enc_skb(struct tls_context *tls_ctx, payload_len, sync_size, dummy_buf); if (tls_enc_records(aead_req, ctx->aead_send, sg_in, sg_out, aad, iv, - rcd_sn, sync_size + payload_len) < 0) + rcd_sn, sync_size + payload_len, + &tls_ctx->prot_info) < 0) goto free_nskb; complete_skb(nskb, skb, tcp_payload_offset); diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 2fe9e2c..6bc757a 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -505,7 +505,7 @@ static int tls_do_encryption(struct sock *sk, memcpy(&rec->iv_data[iv_offset], tls_ctx->tx.iv, prot->iv_size + prot->salt_size); - xor_iv_with_seq(prot->version, rec->iv_data, tls_ctx->tx.rec_seq); + xor_iv_with_seq(prot, rec->iv_data, tls_ctx->tx.rec_seq); sge->offset += prot->prepend_size; sge->length -= prot->prepend_size; @@ -748,14 +748,13 @@ static int tls_push_record(struct sock *sk, int flags, sg_chain(rec->sg_aead_out, 2, &msg_en->sg.data[i]); tls_make_aad(rec->aad_space, msg_pl->sg.size + prot->tail_size, - tls_ctx->tx.rec_seq, prot->rec_seq_size, - record_type, prot->version); + tls_ctx->tx.rec_seq, record_type, prot); tls_fill_prepend(tls_ctx, page_address(sg_page(&msg_en->sg.data[i])) + msg_en->sg.data[i].offset, msg_pl->sg.size + prot->tail_size, - record_type, prot->version); + record_type); tls_ctx->pending_open_record_frags = false; @@ -1471,13 +1470,12 @@ static int decrypt_internal(struct sock *sk, struct sk_buff *skb, else memcpy(iv + iv_offset, tls_ctx->rx.iv, prot->salt_size); - xor_iv_with_seq(prot->version, iv, tls_ctx->rx.rec_seq); + xor_iv_with_seq(prot, iv, tls_ctx->rx.rec_seq); /* Prepare AAD */ tls_make_aad(aad, rxm->full_len - prot->overhead_size + prot->tail_size, - tls_ctx->rx.rec_seq, prot->rec_seq_size, - ctx->control, prot->version); + tls_ctx->rx.rec_seq, ctx->control, prot); /* Prepare sgin */ sg_init_table(sgin, n_sgin); -- 1.8.3.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* [net-next 2/5] net/tls: add CHACHA20-POLY1305 specific defines and structures 2020-11-22 1:57 [net-next 0/5] Add CHACHA20-POLY1305 cipher to Kernel TLS Vadim Fedorenko 2020-11-22 1:57 ` [net-next 1/5] net/tls: make inline helpers protocol-aware Vadim Fedorenko @ 2020-11-22 1:57 ` Vadim Fedorenko 2020-11-22 1:57 ` [net-next 3/5] net/tls: add CHACHA20-POLY1305 specific behavior Vadim Fedorenko ` (2 subsequent siblings) 4 siblings, 0 replies; 7+ messages in thread From: Vadim Fedorenko @ 2020-11-22 1:57 UTC (permalink / raw) To: Jakub Kicinski, Boris Pismenny, Aviad Yehezkel; +Cc: Vadim Fedorenko, netdev To provide support for ChaCha-Poly cipher we need to define specific constants and structures. Signed-off-by: Vadim Fedorenko <vfedorenko@novek.ru> --- include/net/tls.h | 1 + include/uapi/linux/tls.h | 15 +++++++++++++++ 2 files changed, 16 insertions(+) diff --git a/include/net/tls.h b/include/net/tls.h index d04ce73..e4e9c2a 100644 --- a/include/net/tls.h +++ b/include/net/tls.h @@ -211,6 +211,7 @@ struct cipher_context { union { struct tls12_crypto_info_aes_gcm_128 aes_gcm_128; struct tls12_crypto_info_aes_gcm_256 aes_gcm_256; + struct tls12_crypto_info_chacha20_poly1305 chacha20_poly1305; }; }; diff --git a/include/uapi/linux/tls.h b/include/uapi/linux/tls.h index bcd2869..0d54bae 100644 --- a/include/uapi/linux/tls.h +++ b/include/uapi/linux/tls.h @@ -77,6 +77,13 @@ #define TLS_CIPHER_AES_CCM_128_TAG_SIZE 16 #define TLS_CIPHER_AES_CCM_128_REC_SEQ_SIZE 8 +#define TLS_CIPHER_CHACHA20_POLY1305 54 +#define TLS_CIPHER_CHACHA20_POLY1305_IV_SIZE 12 +#define TLS_CIPHER_CHACHA20_POLY1305_KEY_SIZE 32 +#define TLS_CIPHER_CHACHA20_POLY1305_SALT_SIZE 0 +#define TLS_CIPHER_CHACHA20_POLY1305_TAG_SIZE 16 +#define TLS_CIPHER_CHACHA20_POLY1305_REC_SEQ_SIZE 8 + #define TLS_SET_RECORD_TYPE 1 #define TLS_GET_RECORD_TYPE 2 @@ -109,6 +116,14 @@ struct tls12_crypto_info_aes_ccm_128 { unsigned char rec_seq[TLS_CIPHER_AES_CCM_128_REC_SEQ_SIZE]; }; +struct tls12_crypto_info_chacha20_poly1305 { + struct tls_crypto_info info; + unsigned char iv[TLS_CIPHER_CHACHA20_POLY1305_IV_SIZE]; + unsigned char key[TLS_CIPHER_CHACHA20_POLY1305_KEY_SIZE]; + unsigned char salt[TLS_CIPHER_CHACHA20_POLY1305_SALT_SIZE]; + unsigned char rec_seq[TLS_CIPHER_CHACHA20_POLY1305_REC_SEQ_SIZE]; +}; + enum { TLS_INFO_UNSPEC, TLS_INFO_VERSION, -- 1.8.3.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* [net-next 3/5] net/tls: add CHACHA20-POLY1305 specific behavior 2020-11-22 1:57 [net-next 0/5] Add CHACHA20-POLY1305 cipher to Kernel TLS Vadim Fedorenko 2020-11-22 1:57 ` [net-next 1/5] net/tls: make inline helpers protocol-aware Vadim Fedorenko 2020-11-22 1:57 ` [net-next 2/5] net/tls: add CHACHA20-POLY1305 specific defines and structures Vadim Fedorenko @ 2020-11-22 1:57 ` Vadim Fedorenko 2020-11-22 1:57 ` [net-next 4/5] net/tls: add CHACHA20-POLY1305 configuration Vadim Fedorenko 2020-11-22 1:57 ` [net-next 5/5] selftests/tls: add CHACHA20-POLY1305 to tls selftests Vadim Fedorenko 4 siblings, 0 replies; 7+ messages in thread From: Vadim Fedorenko @ 2020-11-22 1:57 UTC (permalink / raw) To: Jakub Kicinski, Boris Pismenny, Aviad Yehezkel; +Cc: Vadim Fedorenko, netdev RFC 7905 defines special behavior for ChaCha-Poly TLS sessions. The differences are in the calculation of nonce and the absence of explicit IV. This behavior is like TLSv1.3 partly. Signed-off-by: Vadim Fedorenko <vfedorenko@novek.ru> --- include/net/tls.h | 9 ++++++--- net/tls/tls_sw.c | 6 ++++-- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/include/net/tls.h b/include/net/tls.h index e4e9c2a..b2637ed 100644 --- a/include/net/tls.h +++ b/include/net/tls.h @@ -502,7 +502,8 @@ static inline void tls_advance_record_sn(struct sock *sk, if (tls_bigint_increment(ctx->rec_seq, prot->rec_seq_size)) tls_err_abort(sk, EBADMSG); - if (prot->version != TLS_1_3_VERSION) + if (prot->version != TLS_1_3_VERSION && + prot->cipher_type != TLS_CIPHER_CHACHA20_POLY1305) tls_bigint_increment(ctx->iv + prot->salt_size, prot->iv_size); } @@ -516,7 +517,8 @@ static inline void tls_fill_prepend(struct tls_context *ctx, size_t pkt_len, iv_size = prot->iv_size; pkt_len = plaintext_len + prot->tag_size; - if (prot->version != TLS_1_3_VERSION) { + if (prot->version != TLS_1_3_VERSION && + prot->cipher_type != TLS_CIPHER_CHACHA20_POLY1305) { pkt_len += iv_size; memcpy(buf + TLS_NONCE_OFFSET, @@ -561,7 +563,8 @@ static inline void xor_iv_with_seq(struct tls_prot_info *prot, char *iv, char *s { int i; - if (prot->version == TLS_1_3_VERSION) { + if (prot->version == TLS_1_3_VERSION || + prot->cipher_type == TLS_CIPHER_CHACHA20_POLY1305) { for (i = 0; i < 8; i++) iv[i + 4] ^= seq[i]; } diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 6bc757a..b4eefdb 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -1464,7 +1464,8 @@ static int decrypt_internal(struct sock *sk, struct sk_buff *skb, kfree(mem); return err; } - if (prot->version == TLS_1_3_VERSION) + if (prot->version == TLS_1_3_VERSION || + prot->cipher_type == TLS_CIPHER_CHACHA20_POLY1305) memcpy(iv + iv_offset, tls_ctx->rx.iv, crypto_aead_ivsize(ctx->aead_recv)); else @@ -2068,7 +2069,8 @@ static int tls_read_size(struct strparser *strp, struct sk_buff *skb) data_len = ((header[4] & 0xFF) | (header[3] << 8)); cipher_overhead = prot->tag_size; - if (prot->version != TLS_1_3_VERSION) + if (prot->version != TLS_1_3_VERSION && + prot->cipher_type != TLS_CIPHER_CHACHA20_POLY1305) cipher_overhead += prot->iv_size; if (data_len > TLS_MAX_PAYLOAD_SIZE + cipher_overhead + -- 1.8.3.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* [net-next 4/5] net/tls: add CHACHA20-POLY1305 configuration 2020-11-22 1:57 [net-next 0/5] Add CHACHA20-POLY1305 cipher to Kernel TLS Vadim Fedorenko ` (2 preceding siblings ...) 2020-11-22 1:57 ` [net-next 3/5] net/tls: add CHACHA20-POLY1305 specific behavior Vadim Fedorenko @ 2020-11-22 1:57 ` Vadim Fedorenko 2020-11-24 2:12 ` Jakub Kicinski 2020-11-22 1:57 ` [net-next 5/5] selftests/tls: add CHACHA20-POLY1305 to tls selftests Vadim Fedorenko 4 siblings, 1 reply; 7+ messages in thread From: Vadim Fedorenko @ 2020-11-22 1:57 UTC (permalink / raw) To: Jakub Kicinski, Boris Pismenny, Aviad Yehezkel; +Cc: Vadim Fedorenko, netdev Add ChaCha-Poly specific configuration code. Signed-off-by: Vadim Fedorenko <vfedorenko@novek.ru> --- net/tls/tls_main.c | 3 +++ net/tls/tls_sw.c | 18 ++++++++++++++++++ 2 files changed, 21 insertions(+) diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c index 8d93cea..47b7c53 100644 --- a/net/tls/tls_main.c +++ b/net/tls/tls_main.c @@ -521,6 +521,9 @@ static int do_tls_setsockopt_conf(struct sock *sk, sockptr_t optval, case TLS_CIPHER_AES_CCM_128: optsize = sizeof(struct tls12_crypto_info_aes_ccm_128); break; + case TLS_CIPHER_CHACHA20_POLY1305: + optsize = sizeof(struct tls12_crypto_info_chacha20_poly1305); + break; default: rc = -EINVAL; goto err_crypto_info; diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index b4eefdb..6bb33d5 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -2290,6 +2290,7 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx) struct tls12_crypto_info_aes_gcm_128 *gcm_128_info; struct tls12_crypto_info_aes_gcm_256 *gcm_256_info; struct tls12_crypto_info_aes_ccm_128 *ccm_128_info; + struct tls12_crypto_info_chacha20_poly1305 *chacha20_poly1305_info; struct tls_sw_context_tx *sw_ctx_tx = NULL; struct tls_sw_context_rx *sw_ctx_rx = NULL; struct cipher_context *cctx; @@ -2402,6 +2403,23 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx) cipher_name = "ccm(aes)"; break; } + case TLS_CIPHER_CHACHA20_POLY1305: { + nonce_size = 0; + tag_size = TLS_CIPHER_CHACHA20_POLY1305_TAG_SIZE; + iv_size = TLS_CIPHER_CHACHA20_POLY1305_IV_SIZE; + iv = ((struct tls12_crypto_info_chacha20_poly1305 *)crypto_info)->iv; + rec_seq_size = TLS_CIPHER_CHACHA20_POLY1305_REC_SEQ_SIZE; + rec_seq = + ((struct tls12_crypto_info_chacha20_poly1305 *)crypto_info)->rec_seq; + chacha20_poly1305_info = + (struct tls12_crypto_info_chacha20_poly1305 *)crypto_info; + keysize = TLS_CIPHER_CHACHA20_POLY1305_KEY_SIZE; + key = chacha20_poly1305_info->key; + salt = chacha20_poly1305_info->salt; + salt_size = TLS_CIPHER_CHACHA20_POLY1305_SALT_SIZE; + cipher_name = "rfc7539(chacha20,poly1305)"; + break; + } default: rc = -EINVAL; goto free_priv; -- 1.8.3.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [net-next 4/5] net/tls: add CHACHA20-POLY1305 configuration 2020-11-22 1:57 ` [net-next 4/5] net/tls: add CHACHA20-POLY1305 configuration Vadim Fedorenko @ 2020-11-24 2:12 ` Jakub Kicinski 0 siblings, 0 replies; 7+ messages in thread From: Jakub Kicinski @ 2020-11-24 2:12 UTC (permalink / raw) To: Vadim Fedorenko; +Cc: Boris Pismenny, Aviad Yehezkel, netdev The series LGTM, great to see chacha support! One nit here, and when you post v2 would you mind ccing crypto? From TLS perspective I think this code is ready to be merged, but my crypto knowledge is close to none, so best if we give crypto folks a chance to take a look. On Sun, 22 Nov 2020 04:57:44 +0300 Vadim Fedorenko wrote: > + case TLS_CIPHER_CHACHA20_POLY1305: { > + nonce_size = 0; > + tag_size = TLS_CIPHER_CHACHA20_POLY1305_TAG_SIZE; > + iv_size = TLS_CIPHER_CHACHA20_POLY1305_IV_SIZE; > + iv = ((struct tls12_crypto_info_chacha20_poly1305 *)crypto_info)->iv; [1] > + rec_seq_size = TLS_CIPHER_CHACHA20_POLY1305_REC_SEQ_SIZE; > + rec_seq = > + ((struct tls12_crypto_info_chacha20_poly1305 *)crypto_info)->rec_seq; [2] > + chacha20_poly1305_info = > + (struct tls12_crypto_info_chacha20_poly1305 *)crypto_info; Move this line up, and use it in [1] and [2]. You can also make it: chacha20_poly1305_info = (void *)crypto_info; > + keysize = TLS_CIPHER_CHACHA20_POLY1305_KEY_SIZE; > + key = chacha20_poly1305_info->key; > + salt = chacha20_poly1305_info->salt; > + salt_size = TLS_CIPHER_CHACHA20_POLY1305_SALT_SIZE; > + cipher_name = "rfc7539(chacha20,poly1305)"; > + break; > + } ^ permalink raw reply [flat|nested] 7+ messages in thread
* [net-next 5/5] selftests/tls: add CHACHA20-POLY1305 to tls selftests 2020-11-22 1:57 [net-next 0/5] Add CHACHA20-POLY1305 cipher to Kernel TLS Vadim Fedorenko ` (3 preceding siblings ...) 2020-11-22 1:57 ` [net-next 4/5] net/tls: add CHACHA20-POLY1305 configuration Vadim Fedorenko @ 2020-11-22 1:57 ` Vadim Fedorenko 4 siblings, 0 replies; 7+ messages in thread From: Vadim Fedorenko @ 2020-11-22 1:57 UTC (permalink / raw) To: Jakub Kicinski, Boris Pismenny, Aviad Yehezkel; +Cc: Vadim Fedorenko, netdev Add new cipher as a variant of standart tls selftests Signed-off-by: Vadim Fedorenko <vfedorenko@novek.ru> --- tools/testing/selftests/net/tls.c | 40 ++++++++++++++++++++++++++++++++------- 1 file changed, 33 insertions(+), 7 deletions(-) diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c index b599f1f..49d8ade 100644 --- a/tools/testing/selftests/net/tls.c +++ b/tools/testing/selftests/net/tls.c @@ -103,32 +103,58 @@ FIXTURE_VARIANT(tls) { - unsigned int tls_version; + u16 tls_version; + u16 cipher_type; }; -FIXTURE_VARIANT_ADD(tls, 12) +FIXTURE_VARIANT_ADD(tls, 12_gcm) { .tls_version = TLS_1_2_VERSION, + .cipher_type = TLS_CIPHER_AES_GCM_128, }; -FIXTURE_VARIANT_ADD(tls, 13) +FIXTURE_VARIANT_ADD(tls, 13_gcm) { .tls_version = TLS_1_3_VERSION, + .cipher_type = TLS_CIPHER_AES_GCM_128, +}; + +FIXTURE_VARIANT_ADD(tls, 12_chacha) +{ + .tls_version = TLS_1_2_VERSION, + .cipher_type = TLS_CIPHER_CHACHA20_POLY1305, +}; + +FIXTURE_VARIANT_ADD(tls, 13_chacha) +{ + .tls_version = TLS_1_3_VERSION, + .cipher_type = TLS_CIPHER_CHACHA20_POLY1305, }; FIXTURE_SETUP(tls) { - struct tls12_crypto_info_aes_gcm_128 tls12; + union tls_crypto_context tls12; struct sockaddr_in addr; socklen_t len; int sfd, ret; + size_t tls12_sz; self->notls = false; len = sizeof(addr); memset(&tls12, 0, sizeof(tls12)); tls12.info.version = variant->tls_version; - tls12.info.cipher_type = TLS_CIPHER_AES_GCM_128; + tls12.info.cipher_type = variant->cipher_type; + switch(variant->cipher_type) { + case TLS_CIPHER_CHACHA20_POLY1305: + tls12_sz = sizeof(tls12_crypto_info_chacha20_poly1305); + break; + case TLS_CIPHER_AES_GCM_128: + tls12_sz = sizeof(tls12_crypto_info_aes_gcm_128); + break; + default: + tls12_sz = 0; + } addr.sin_family = AF_INET; addr.sin_addr.s_addr = htonl(INADDR_ANY); @@ -156,7 +182,7 @@ if (!self->notls) { ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, - sizeof(tls12)); + tls12_sz); ASSERT_EQ(ret, 0); } @@ -169,7 +195,7 @@ ASSERT_EQ(ret, 0); ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, - sizeof(tls12)); + tls12_sz); ASSERT_EQ(ret, 0); } -- 1.8.3.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
end of thread, other threads:[~2020-11-24 2:12 UTC | newest] Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2020-11-22 1:57 [net-next 0/5] Add CHACHA20-POLY1305 cipher to Kernel TLS Vadim Fedorenko 2020-11-22 1:57 ` [net-next 1/5] net/tls: make inline helpers protocol-aware Vadim Fedorenko 2020-11-22 1:57 ` [net-next 2/5] net/tls: add CHACHA20-POLY1305 specific defines and structures Vadim Fedorenko 2020-11-22 1:57 ` [net-next 3/5] net/tls: add CHACHA20-POLY1305 specific behavior Vadim Fedorenko 2020-11-22 1:57 ` [net-next 4/5] net/tls: add CHACHA20-POLY1305 configuration Vadim Fedorenko 2020-11-24 2:12 ` Jakub Kicinski 2020-11-22 1:57 ` [net-next 5/5] selftests/tls: add CHACHA20-POLY1305 to tls selftests Vadim Fedorenko
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.