git: bd4975e5fb05 - main - ktls: Check the record type message holds its byte

The branch main has been updated by olivier:

URL: https://cgit.FreeBSD.org/src/commit/?id=bd4975e5fb051c2b2e8d5218940b7e8ef87b5bdf

commit bd4975e5fb051c2b2e8d5218940b7e8ef87b5bdf
Author:     Olivier Cochard <olivier@FreeBSD.org>
AuthorDate: 2026-10-16 16:43:30 +0000
Commit:     Olivier Cochard <olivier@FreeBSD.org>
CommitDate: 2026-11-01 22:59:32 +0000

    ktls: Check the record type message holds its byte
    
    sosend_generic() read the TLS record type past a TLS_SET_RECORD_TYPE
    control message holding only a cmsghdr, and sent that stale byte.
    
    Approved by:    markj
    Fixes:          b2e60773c6b0 ("Add kernel-side support for in-kernel TLS.")
    Sponsored by:   Netflix
---
 sys/kern/uipc_socket.c     |  2 +-
 tests/sys/kern/ktls_test.c | 43 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c
index dc4db57c07e2..f4a31fff72c8 100644
--- a/sys/kern/uipc_socket.c
+++ b/sys/kern/uipc_socket.c
@@ -2420,7 +2420,7 @@ sosend_generic_locked(struct socket *so, struct sockaddr *addr, struct uio *uio,
 		if (control != NULL) {
 			struct cmsghdr *cm = mtod(control, struct cmsghdr *);
 
-			if (clen >= sizeof(*cm) &&
+			if (clen >= CMSG_LEN(sizeof(tls_rtype)) &&
 			    cm->cmsg_type == TLS_SET_RECORD_TYPE) {
 				tls_rtype = *((uint8_t *)CMSG_DATA(cm));
 				clen = 0;
diff --git a/tests/sys/kern/ktls_test.c b/tests/sys/kern/ktls_test.c
index 7e9334c10144..11275ffc9e49 100644
--- a/tests/sys/kern/ktls_test.c
+++ b/tests/sys/kern/ktls_test.c
@@ -2960,6 +2960,48 @@ ATF_TC_BODY(ktls_sendto_baddst, tc)
 	ATF_REQUIRE(close(s) == 0);
 }
 
+/*
+ * A TLS_SET_RECORD_TYPE control message without its record type byte
+ * is refused.
+ */
+ATF_TC_WITHOUT_HEAD(ktls_transmit_short_record_type);
+ATF_TC_BODY(ktls_transmit_short_record_type, tc)
+{
+	struct tls_enable en;
+	struct msghdr msg;
+	struct cmsghdr *cmsg;
+	struct iovec iov;
+	char cbuf[CMSG_SPACE(0)];
+	char data;
+	int sockets[2];
+
+	ATF_REQUIRE_KTLS();
+	build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0,
+	    TLS_MINOR_VER_TWO, (uint64_t)random(), &en);
+	ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets");
+	ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, &en,
+	    sizeof(en)) == 0);
+	fd_set_blocking(sockets[1]);
+
+	memset(&msg, 0, sizeof(msg));
+	memset(cbuf, 0, sizeof(cbuf));
+	msg.msg_control = cbuf;
+	msg.msg_controllen = CMSG_LEN(0);
+	cmsg = CMSG_FIRSTHDR(&msg);
+	cmsg->cmsg_level = IPPROTO_TCP;
+	cmsg->cmsg_type = TLS_SET_RECORD_TYPE;
+	cmsg->cmsg_len = CMSG_LEN(0);
+	data = 0;
+	iov.iov_base = &data;
+	iov.iov_len = sizeof(data);
+	msg.msg_iov = &iov;
+	msg.msg_iovlen = 1;
+	ATF_REQUIRE_ERRNO(EINVAL, sendmsg(sockets[1], &msg, 0) == -1);
+
+	close_sockets(sockets);
+	free_tls_enable(&en);
+}
+
 /*
  * Make sure that listen(2) returns an error for KTLS-enabled sockets, and
  * verify that an attempt to enable KTLS on a listening socket fails.
@@ -3126,6 +3168,7 @@ ATF_TP_ADD_TCS(tp)
 
 	/* Miscellaneous */
 	ATF_TP_ADD_TC(tp, ktls_sendto_baddst);
+	ATF_TP_ADD_TC(tp, ktls_transmit_short_record_type);
 	ATF_TP_ADD_TC(tp, ktls_listening_socket_tx);
 	ATF_TP_ADD_TC(tp, ktls_listening_socket_rx);
 	ATF_TP_ADD_TC(tp, ktls_receive_loopback_sendfile);