netdev - Re: [PATCH net 2/2] selftests: tls: fix chacha+bidir tests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 18 Jun 2021 23:03:04 +0100
From:   Vadim Fedorenko <vfedorenko@...ek.ru>
To:     Jakub Kicinski <kuba@...nel.org>, davem@...emloft.net
Cc:     netdev@...r.kernel.org, linux-kselftest@...r.kernel.org,
        shuah@...nel.org
Subject: Re: [PATCH net 2/2] selftests: tls: fix chacha+bidir tests

On 18.06.2021 21:25, Jakub Kicinski wrote:
> ChaCha support did not adjust the bidirectional test.
> We need to set up KTLS in reverse direction correctly,
> otherwise these two cases will fail:
> 
>    tls.12_chacha.bidir
>    tls.13_chacha.bidir
> 
> Fixes: 4f336e88a870 ("selftests/tls: add CHACHA20-POLY1305 to tls selftests")
> Signed-off-by: Jakub Kicinski <kuba@...nel.org>
> ---
>   tools/testing/selftests/net/tls.c | 67 ++++++++++++++++++-------------
>   1 file changed, 39 insertions(+), 28 deletions(-)
> 
> diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c
> index 58fea6eb588d..112d41d01b12 100644
> --- a/tools/testing/selftests/net/tls.c
> +++ b/tools/testing/selftests/net/tls.c
> @@ -25,6 +25,35 @@
>   #define TLS_PAYLOAD_MAX_LEN 16384
>   #define SOL_TLS 282
>   
> +struct tls_crypto_info_keys {
> +	union {
> +		struct tls12_crypto_info_aes_gcm_128 aes128;
> +		struct tls12_crypto_info_chacha20_poly1305 chacha20;
> +	};
> +	size_t len;
> +};
> +
> +static void tls_crypto_info_init(uint16_t tls_version, uint16_t cipher_type,
> +				 struct tls_crypto_info_keys *tls12)
> +{
> +	memset(tls12, 0, sizeof(*tls12));
> +
> +	switch (cipher_type) {
> +	case TLS_CIPHER_CHACHA20_POLY1305:
> +		tls12->len = sizeof(struct tls12_crypto_info_chacha20_poly1305);
> +		tls12->chacha20.info.version = tls_version;
> +		tls12->chacha20.info.cipher_type = cipher_type;
> +		break;
> +	case TLS_CIPHER_AES_GCM_128:
> +		tls12->len = sizeof(struct tls12_crypto_info_aes_gcm_128);
> +		tls12->aes128.info.version = tls_version;
> +		tls12->aes128.info.cipher_type = cipher_type;
> +		break;
> +	default:
> +		break;
> +	}
> +}
> +
>   static void memrnd(void *s, size_t n)
>   {
>   	int *dword = s;
> @@ -145,33 +174,16 @@ FIXTURE_VARIANT_ADD(tls, 13_chacha)
>   
>   FIXTURE_SETUP(tls)
>   {
> -	union {
> -		struct tls12_crypto_info_aes_gcm_128 aes128;
> -		struct tls12_crypto_info_chacha20_poly1305 chacha20;
> -	} tls12;
> +	struct tls_crypto_info_keys tls12;
>   	struct sockaddr_in addr;
>   	socklen_t len;
>   	int sfd, ret;
> -	size_t tls12_sz;
>   
>   	self->notls = false;
>   	len = sizeof(addr);
>   
> -	memset(&tls12, 0, sizeof(tls12));
> -	switch (variant->cipher_type) {
> -	case TLS_CIPHER_CHACHA20_POLY1305:
> -		tls12_sz = sizeof(struct tls12_crypto_info_chacha20_poly1305);
> -		tls12.chacha20.info.version = variant->tls_version;
> -		tls12.chacha20.info.cipher_type = variant->cipher_type;
> -		break;
> -	case TLS_CIPHER_AES_GCM_128:
> -		tls12_sz = sizeof(struct tls12_crypto_info_aes_gcm_128);
> -		tls12.aes128.info.version = variant->tls_version;
> -		tls12.aes128.info.cipher_type = variant->cipher_type;
> -		break;
> -	default:
> -		tls12_sz = 0;
> -	}
> +	tls_crypto_info_init(variant->tls_version, variant->cipher_type,
> +			     &tls12);
>   
>   	addr.sin_family = AF_INET;
>   	addr.sin_addr.s_addr = htonl(INADDR_ANY);
> @@ -199,7 +211,7 @@ FIXTURE_SETUP(tls)
>   
>   	if (!self->notls) {
>   		ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12,
> -				 tls12_sz);
> +				 tls12.len);
>   		ASSERT_EQ(ret, 0);
>   	}
>   
> @@ -212,7 +224,7 @@ FIXTURE_SETUP(tls)
>   		ASSERT_EQ(ret, 0);
>   
>   		ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12,
> -				 tls12_sz);
> +				 tls12.len);
>   		ASSERT_EQ(ret, 0);
>   	}
>   
> @@ -854,18 +866,17 @@ TEST_F(tls, bidir)
>   	int ret;
>   
>   	if (!self->notls) {
> -		struct tls12_crypto_info_aes_gcm_128 tls12;
> +		struct tls_crypto_info_keys tls12;
>   
> -		memset(&tls12, 0, sizeof(tls12));
> -		tls12.info.version = variant->tls_version;
> -		tls12.info.cipher_type = TLS_CIPHER_AES_GCM_128;
> +		tls_crypto_info_init(variant->tls_version, variant->cipher_type,
> +				     &tls12);
>   
>   		ret = setsockopt(self->fd, SOL_TLS, TLS_RX, &tls12,
> -				 sizeof(tls12));
> +				 tls12.len);
>   		ASSERT_EQ(ret, 0);
>   
>   		ret = setsockopt(self->cfd, SOL_TLS, TLS_TX, &tls12,
> -				 sizeof(tls12));
> +				 tls12.len);
>   		ASSERT_EQ(ret, 0);
>   	}
>   
> 

Acked-by: Vadim Fedorenko <vfedorenko@...ek.ru>