Copy the iovec for the trailer from the proper place. This is the same
fix for CBC encryption from ff6a7e4ba6bf.
Reported by: gallatin
Fixes: 49f6925ca
Details
Details
- Reviewers
gallatin markj jmg - Commits
- rG3fa034210c75: ktls: Fix non-inplace TLS 1.3 encryption.
Diff Detail
Diff Detail
- Repository
- rS FreeBSD src repository - subversion
- Lint
No Lint Coverage - Unit
No Test Coverage - Build Status
Buildable 37724 Build 34613: arc lint + arc unit
Event Timeline
Comment Actions
Sample commands to test TLS 1.3 on a client against an nginx server:
# AES-GCM with TLS 1.2 openssl s_time -connect <host>:443 -www "/bigfile" -tls1_2 # CHACHA20 with TLS 1.2 openssl s_time -connect <host>:443 -www "/bigfile" -tls1_2 -cipher CHACHA20 # AES-GCM with TLS 1.3 openssl s_time -connect <host>:443 -www "/bigfile" -tls1_3 # CHACHA20 with TLS 1.3 openssl s_time -connect <host>:443 -www "/bigfile" -tls1_3 -ciphersuites TLS_CHACHA20_POLY1305_SHA256
For AES-CBC you need a noetm.conf file:
openssl_conf = openssl_init [openssl_init] ssl_conf = ssl_sect [ssl_sect] system_default = system_default_sect [system_default_sect] Options = -EncryptThenMac
and then you can test that this way:
env OPENSSL_CONF=noetm.cnf openssl s_time -connect <host>:443 -www "/bigfile" -tls1_2 -cipher AES256-SHA
Other ciphers you can use for AES-CBC are AES-SHA, AES-SHA256, and AES256-SHA256.
In my case "bigfile" is a 1GB file of junk in /usr/local/www/nginx.