openssl
/
openssl
mirror of https://github.com/openssl/openssl
1
0
Fork 0
Code Issues Releases Wiki Activity

KTLS: Enable KTLS for receiving as well in TLS 1.3 

This removes a guard condition that prevents KTLS being enabled for
receiving in TLS 1.3.  Use the correct sequence number and BIO for
receive vs transmit offload.

Co-authored-by: John Baldwin <jhb@FreeBSD.org>
Signed-off-by: Daiki Ueno <dueno@redhat.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17942)
This commit is contained in:
Daiki Ueno 2021-10-10 09:14:06 +02:00 committed by Tomas Mraz
parent a5fb960532
commit 7c78932b9a
3 changed files with 26 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES.md
View File

@ -24,6 +24,10 @@ OpenSSL 3.1
### Changes between 3.0 and 3.1 [xx XXX xxxx]
* Extended Kernel TLS (KTLS) to support TLS 1.3 receive offload.
*Daiki Ueno, John Baldwin and Dmitry Podgorny*
* Add support for TCP Fast Open (RFC7413) to macOS, Linux, and FreeBSD where
supported and enabled.

32
ssl/tls13_enc.c
View File

@ -434,6 +434,7 @@ int tls13_change_cipher_state(SSL *s, int which)
const EVP_CIPHER *cipher = NULL;
#if !defined(OPENSSL_NO_KTLS) && defined(OPENSSL_KTLS_TLS13)
ktls_crypto_info_t crypto_info;
void *rl_sequence;
BIO *bio;
#endif
@ -688,8 +689,7 @@ int tls13_change_cipher_state(SSL *s, int which)
s->statem.enc_write_state = ENC_WRITE_STATE_VALID;
#ifndef OPENSSL_NO_KTLS
# if defined(OPENSSL_KTLS_TLS13)
if (!(which & SSL3_CC_WRITE)
|| !(which & SSL3_CC_APPLICATION)
if (!(which & SSL3_CC_APPLICATION)
|| (s->options & SSL_OP_ENABLE_KTLS) == 0)
goto skip_ktls;
@ -705,7 +705,10 @@ int tls13_change_cipher_state(SSL *s, int which)
if (!ktls_check_supported_cipher(s, cipher, ciph_ctx))
goto skip_ktls;
bio = s->wbio;
if (which & SSL3_CC_WRITE)
bio = s->wbio;
else
bio = s->rbio;
if (!ossl_assert(bio != NULL)) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
@ -713,19 +716,26 @@ int tls13_change_cipher_state(SSL *s, int which)
}
/* All future data will get encrypted by ktls. Flush the BIO or skip ktls */
if (BIO_flush(bio) <= 0)
goto skip_ktls;
if (which & SSL3_CC_WRITE) {
if (BIO_flush(bio) <= 0)
goto skip_ktls;
}
/* configure kernel crypto structure */
if (!ktls_configure_crypto(s, cipher, ciph_ctx,
RECORD_LAYER_get_write_sequence(&s->rlayer),
&crypto_info, which & SSL3_CC_WRITE, iv, key,
NULL, 0))
if (which & SSL3_CC_WRITE)
rl_sequence = RECORD_LAYER_get_write_sequence(&s->rlayer);
else
rl_sequence = RECORD_LAYER_get_read_sequence(&s->rlayer);
if (!ktls_configure_crypto(s, cipher, ciph_ctx, rl_sequence, &crypto_info,
which & SSL3_CC_WRITE, iv, key, NULL, 0))
goto skip_ktls;
/* ktls works with user provided buffers directly */
if (BIO_set_ktls(bio, &crypto_info, which & SSL3_CC_WRITE))
ssl3_release_write_buffer(s);
if (BIO_set_ktls(bio, &crypto_info, which & SSL3_CC_WRITE)) {
if (which & SSL3_CC_WRITE)
ssl3_release_write_buffer(s);
}
skip_ktls:
# endif
#endif

2
test/sslapitest.c
View File

@ -1242,7 +1242,7 @@ static int execute_test_ktls(int cis_ktls, int sis_ktls,
#if defined(OPENSSL_NO_KTLS_RX)
rx_supported = 0;
#else
rx_supported = (tls_version != TLS1_3_VERSION);
rx_supported = 1;
#endif
if (!cis_ktls || !rx_supported) {
if (!TEST_false(BIO_get_ktls_recv(clientssl->rbio)))