From nobody Wed May 4 20:33:56 2022 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id BC55E1AB500D; Wed, 4 May 2022 20:33:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4KtpT10Nn3z3nt6; Wed, 4 May 2022 20:33:56 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1651696437; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Tkk4/KiwNfJE7SY/5UAXDPJKJZnpiJIqJvcHwLqssB4=; b=pe6ZLlU5LqUG8w4hLlwzHMdgdtpJQGygwPDm1YhjzmFjdh3thwX+EHGAmRx0QKWEBPBzyA ji9CSoi1nTgdAdkCoP5Tbqlsaa5Z95BtDNlvYjF6l5qGSfDPbT/AsCZPsI7iaWPoNSzsap PkhmAw36eg0J2NnaWi+JdTxuJP+57cmK8OC345WEwyDBnSxBL+b+wA/gTXFR+4EgDt6Ths f1oPA8rjHnKYreYfUJgAht8VXlMZIc/0AgME/T5JkNojS0VBKfp2PQKLKm/2aWn0p8RKrC LtRlGuSjILxXScEKXwClg1vlYm//z6+7vrbi9lIJzPTMiFvPSNROifRv0N6qVQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 9D54719F26; Wed, 4 May 2022 20:33:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 244KXuD3053122; Wed, 4 May 2022 20:33:56 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 244KXuum053121; Wed, 4 May 2022 20:33:56 GMT (envelope-from git) Date: Wed, 4 May 2022 20:33:56 GMT Message-Id: <202205042033.244KXuum053121@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: John Baldwin Subject: git: 4f1f9c550227 - main - OpenSSL: KTLS: Add using_ktls helper variable in ssl3_get_record(). List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jhb X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 4f1f9c550227667efaad65e7f2a0034355d94dc8 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1651696437; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Tkk4/KiwNfJE7SY/5UAXDPJKJZnpiJIqJvcHwLqssB4=; b=AAtIYggsEwCJAIU5Ll632B/MCCdRbqFwoO2T/eaREjiGhB2v53z/+YewIvaqE+B/2cEBT+ qPr+Mv84fJ8xYipMj93FNtPpaV9mXAmT16oLvDNQ34QZ8xeiqMhfGLToeC4LDv8i264wBS wz7YDDWsKvauY1NTnrzQQiOn/E5F0BCgQdxLErbIs0cSiw6rXILeTccODQn9XCATdw/B7X VEYZ4WNDxYS9rnduv2gB9d8dSOV8XooemLlEcGZJPWrPyJw8Z97fkxtZu4JDC0ra79CxpR 8Yx7iWgxh4Ayt2i/EFYgXcebxnqLSmJoAyFJu7mr2AgndN9k5Cz+5JZ2s9Ixug== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1651696437; a=rsa-sha256; cv=none; b=MN4fwWRithjLJOFJx+PYgsMLZ5ZJP1SDp+4ko2t1sXesAWsuBBueDuD1XlANLHcTdv79oD 2Ob52RIDPIfAA0Kmx9yskAxFRNgvjc65UxWtorSqb2o2EnQVUJNHs67l/P0UXf3fAUdR8R RiVlRy0v7lONU8jjR6cNdkjtUznPPjRsTZmFqjFUZb7pktzidxV0FkqslqCK4pCxC6EJop P51dCDgouvZ9olcp5iY8rUE4ZL9kLEdrM8Cdu3piSXT1E5h39aVdvbrPlKC/BCaRUMuEhD sxNdtHUyWeaOhtXbGjTQ5O8EgclQbLeVeEudCD1ZRSbTtHZyMK1AQUyZqprWuA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by jhb: URL: https://cgit.FreeBSD.org/src/commit/?id=4f1f9c550227667efaad65e7f2a0034355d94dc8 commit 4f1f9c550227667efaad65e7f2a0034355d94dc8 Author: John Baldwin AuthorDate: 2022-05-04 20:08:17 +0000 Commit: John Baldwin CommitDate: 2022-05-04 20:08:17 +0000 OpenSSL: KTLS: Add using_ktls helper variable in ssl3_get_record(). When KTLS receive is enabled, pending data may still be present due to read ahead. This data must still be processed the same as records received without KTLS. To ease readability (especially in consideration of additional checks which will be added for TLS 1.3), add a helper variable 'using_ktls' that is true when the KTLS receive path is being used to receive a record. Approved by: jkim Obtained from: OpenSSL commit 031132c297e54cbc20404a0bf8de6ed863196399 MFC after: 1 week Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D34974 --- crypto/openssl/ssl/record/ssl3_record.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/crypto/openssl/ssl/record/ssl3_record.c b/crypto/openssl/ssl/record/ssl3_record.c index 4fd22019ee7b..5fa481de9dbe 100644 --- a/crypto/openssl/ssl/record/ssl3_record.c +++ b/crypto/openssl/ssl/record/ssl3_record.c @@ -186,16 +186,21 @@ int ssl3_get_record(SSL *s) size_t num_recs = 0, max_recs, j; PACKET pkt, sslv2pkt; size_t first_rec_len; - int is_ktls_left; + int using_ktls; rr = RECORD_LAYER_get_rrec(&s->rlayer); rbuf = RECORD_LAYER_get_rbuf(&s->rlayer); - is_ktls_left = (SSL3_BUFFER_get_left(rbuf) > 0); max_recs = s->max_pipelines; if (max_recs == 0) max_recs = 1; sess = s->session; + /* + * KTLS reads full records. If there is any data left, + * then it is from before enabling ktls. + */ + using_ktls = BIO_get_ktls_recv(s->rbio) && SSL3_BUFFER_get_left(rbuf) == 0; + do { thisrr = &rr[num_recs]; @@ -413,7 +418,7 @@ int ssl3_get_record(SSL *s) #endif /* KTLS may use all of the buffer */ - if (BIO_get_ktls_recv(s->rbio) && !is_ktls_left) + if (using_ktls) len = SSL3_BUFFER_get_left(rbuf); if (thisrr->length > len) { @@ -522,11 +527,7 @@ int ssl3_get_record(SSL *s) return 1; } - /* - * KTLS reads full records. If there is any data left, - * then it is from before enabling ktls - */ - if (BIO_get_ktls_recv(s->rbio) && !is_ktls_left) + if (using_ktls) goto skip_decryption; /* @@ -787,8 +788,7 @@ int ssl3_get_record(SSL *s) * Therefore we have to rely on KTLS to check the plaintext length * limit in the kernel. */ - if (thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH - && (!BIO_get_ktls_recv(s->rbio) || is_ktls_left)) { + if (thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH && !using_ktls) { SSLfatal(s, SSL_AD_RECORD_OVERFLOW, SSL_F_SSL3_GET_RECORD, SSL_R_DATA_LENGTH_TOO_LONG); return -1;