From nobody Sun Nov 01 23:03:35 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jHr3q1rHJz6y6t6 for ; Sun, 01 Nov 2026 23:03:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jHr3q16kYz4sJ6 for ; Sun, 01 Nov 2026 23:03:35 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793574215; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8CZaGHfnNaMNDvIYMff82EAeDTlVKRlYykQW9c0Qp5s=; b=iBHZF46GtAFYJlnX+4TDRSyAsPeQn541NyMcurQdNFl7W1Vo688tUKYs3O0JlrKHn5/cez kWOK84z5OVrJmXLxhPGULMgafDXWlWs7rEdZHsPtXq01wt4c47ZWkwW/Jx09XKWnEjZdj1 loSuwQzQCSa5fkzp1oaowRNmox2zjof5+BCh9pdGPO/MHnp9YjzYZAP1luc+kH/RLhI7g8 WdNlqJ2CqQddFn61pu1EMEmA9X9fWM0ADBg7wvvmK5SvLCJMuMhRQD7APewZDl0n1UdZ5x vV+K6HMigewF/M52rN9nFYWeBlOQDNPdcYUFdrNOkwPoUuULkqa31d/AIxeKig== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793574215; b=t3I8YhV22vHPcKWY8T+Kel5jZQbUerXqKfnquQJTEL5y6LZeKOgs1i/twAvtchZiTvZVS9 l53ioF/4UiAeP8t6o4/D/7GaWl6aOxOIU0euy0eavaZJp1Miac+NsG+mP5jNEHeV+eOBzp KVophQ+4Z9BmBVkuZEvwWU+ot/QDTarr49uKAmA0HZxVZtPqYAcTL9lX+hk9LZO+UW+LZF L48QKA4SgvNNomfvUaptpT0LVWsK6PMn9JoumRRuXEOLGd/GoM9nPNpx31V0DwbIfUjsi0 9eFjl2tKZiK8iI1IvA1RktHo38p6h4a+EStot12zvJjMMgRTxvyP3/3CX4W0Sg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793574215; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8CZaGHfnNaMNDvIYMff82EAeDTlVKRlYykQW9c0Qp5s=; b=TMOgHeswUiaPYfs3hMx5ewq6GPEP+NGW202+DNK8mLRll3mRWp1uK3bIL8Wz0N9kb6vWPA f5sZpIjaX5g3JzRxbnAqV3E5q32n3sv+o+mirH+gQbd3f4wyNFaa8Tx2+7KOuup6hbGRFl pPs3aWDGmGpLDOnJ1KXVJF2XJOnX2I4JWr0SwlR290nMQO2kGY0tFS/tjrCXZZ3p4fLTvg dOB/6SknTLtNx5/qED7nWPaunqcFhMH0t1cowLNw/2aq7U7NWw3SIsnRvLOwgMxrtDpvBR oiaHBI61LM5qLotx/BruXejRBv+2QyC3RKezBYCRggClDhfKFsIUzikSdxvW3A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jHr3q0J3HzK42 for ; Sun, 01 Nov 2026 23:03:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 472df by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 01 Nov 2026 23:03:35 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Olivier Cochard Subject: git: bd4975e5fb05 - main - ktls: Check the record type message holds its byte List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: Commit messages for the main branch of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: olivier X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: bd4975e5fb051c2b2e8d5218940b7e8ef87b5bdf Auto-Submitted: auto-generated Date: Sun, 01 Nov 2026 23:03:35 +0000 Message-Id: <6ae7c547.472df.604f7c77@gitrepo.freebsd.org> The branch main has been updated by olivier: URL: https://cgit.FreeBSD.org/src/commit/?id=bd4975e5fb051c2b2e8d5218940b7e8ef87b5bdf commit bd4975e5fb051c2b2e8d5218940b7e8ef87b5bdf Author: Olivier Cochard AuthorDate: 2026-10-16 16:43:30 +0000 Commit: Olivier Cochard CommitDate: 2026-11-01 22:59:32 +0000 ktls: Check the record type message holds its byte sosend_generic() read the TLS record type past a TLS_SET_RECORD_TYPE control message holding only a cmsghdr, and sent that stale byte. Approved by: markj Fixes: b2e60773c6b0 ("Add kernel-side support for in-kernel TLS.") Sponsored by: Netflix --- sys/kern/uipc_socket.c | 2 +- tests/sys/kern/ktls_test.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+), 1 deletion(-) diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index dc4db57c07e2..f4a31fff72c8 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -2420,7 +2420,7 @@ sosend_generic_locked(struct socket *so, struct sockaddr *addr, struct uio *uio, if (control != NULL) { struct cmsghdr *cm = mtod(control, struct cmsghdr *); - if (clen >= sizeof(*cm) && + if (clen >= CMSG_LEN(sizeof(tls_rtype)) && cm->cmsg_type == TLS_SET_RECORD_TYPE) { tls_rtype = *((uint8_t *)CMSG_DATA(cm)); clen = 0; diff --git a/tests/sys/kern/ktls_test.c b/tests/sys/kern/ktls_test.c index 7e9334c10144..11275ffc9e49 100644 --- a/tests/sys/kern/ktls_test.c +++ b/tests/sys/kern/ktls_test.c @@ -2960,6 +2960,48 @@ ATF_TC_BODY(ktls_sendto_baddst, tc) ATF_REQUIRE(close(s) == 0); } +/* + * A TLS_SET_RECORD_TYPE control message without its record type byte + * is refused. + */ +ATF_TC_WITHOUT_HEAD(ktls_transmit_short_record_type); +ATF_TC_BODY(ktls_transmit_short_record_type, tc) +{ + struct tls_enable en; + struct msghdr msg; + struct cmsghdr *cmsg; + struct iovec iov; + char cbuf[CMSG_SPACE(0)]; + char data; + int sockets[2]; + + ATF_REQUIRE_KTLS(); + build_tls_enable(tc, CRYPTO_AES_NIST_GCM_16, 128 / 8, 0, + TLS_MINOR_VER_TWO, (uint64_t)random(), &en); + ATF_REQUIRE_MSG(open_sockets(tc, sockets), "failed to create sockets"); + ATF_REQUIRE(setsockopt(sockets[1], IPPROTO_TCP, TCP_TXTLS_ENABLE, &en, + sizeof(en)) == 0); + fd_set_blocking(sockets[1]); + + memset(&msg, 0, sizeof(msg)); + memset(cbuf, 0, sizeof(cbuf)); + msg.msg_control = cbuf; + msg.msg_controllen = CMSG_LEN(0); + cmsg = CMSG_FIRSTHDR(&msg); + cmsg->cmsg_level = IPPROTO_TCP; + cmsg->cmsg_type = TLS_SET_RECORD_TYPE; + cmsg->cmsg_len = CMSG_LEN(0); + data = 0; + iov.iov_base = &data; + iov.iov_len = sizeof(data); + msg.msg_iov = &iov; + msg.msg_iovlen = 1; + ATF_REQUIRE_ERRNO(EINVAL, sendmsg(sockets[1], &msg, 0) == -1); + + close_sockets(sockets); + free_tls_enable(&en); +} + /* * Make sure that listen(2) returns an error for KTLS-enabled sockets, and * verify that an attempt to enable KTLS on a listening socket fails. @@ -3126,6 +3168,7 @@ ATF_TP_ADD_TCS(tp) /* Miscellaneous */ ATF_TP_ADD_TC(tp, ktls_sendto_baddst); + ATF_TP_ADD_TC(tp, ktls_transmit_short_record_type); ATF_TP_ADD_TC(tp, ktls_listening_socket_tx); ATF_TP_ADD_TC(tp, ktls_listening_socket_rx); ATF_TP_ADD_TC(tp, ktls_receive_loopback_sendfile);