Page MenuHomeFreeBSD

ktls: Fix assertion for TLS 1.0 CBC when using non-zero starting seqno.
ClosedPublic

Authored by jhb on Oct 26 2021, 11:31 PM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Jan 17, 2:47 PM
Unknown Object (File)
Dec 20 2024, 1:56 AM
Unknown Object (File)
Dec 14 2024, 2:14 PM
Unknown Object (File)
Dec 9 2024, 8:22 AM
Unknown Object (File)
Nov 12 2024, 6:22 AM
Unknown Object (File)
Oct 13 2024, 2:00 AM
Unknown Object (File)
Oct 6 2024, 5:45 PM
Unknown Object (File)
Oct 4 2024, 2:21 AM
Subscribers

Details

Summary

The starting sequence number used to verify that TLS 1.0 CBC records
are encrypted in-order in the OCF layer was always set to 0 and not to
the initial sequence number from the struct tls_enable.

In practice, OpenSSL always starts TLS transmit offload with a
sequence number of zero, so this only matters for tests that use a
random starting sequence number.

Sponsored by: Netflix

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
No Lint Coverage
Unit
No Test Coverage
Build Status
Buildable 42387
Build 39275: arc lint + arc unit