History

tls: rx: use a define for tag length

TLS 1.3 has to strip padding, and it starts out 16 bytes from the end of the record. Make it clear this is because of the auth tag.

Jakub Kicinski committed 4 years ago

Commit a8340cc1 parent 863533e2 files · +3 −2Browse files

Unified · Split

2 files
  1. include/net/tls.h +1 −0
  2. net/tls/tls_sw.c +2 −2
include/net/tls.h+1−0
@@ -64,6 +64,7 @@ · 63 unmodified lines
64#define TLS_AAD_SPACE_SIZE 1364#define TLS_AAD_SPACE_SIZE 13
65 65
66#define MAX_IV_SIZE 1666#define MAX_IV_SIZE 16
67#define TLS_TAG_SIZE 16
67#define TLS_MAX_REC_SEQ_SIZE 868#define TLS_MAX_REC_SEQ_SIZE 8
68 69
69/* For CCM mode, the full 16-bytes of IV is made of '4' fields of given sizes.70/* For CCM mode, the full 16-bytes of IV is made of '4' fields of given sizes.
net/tls/tls_sw.c+2−2
@@ -136,9 +136,9 @@ static int padding_length(struct tls_prot_info *prot, struct sk_buff *skb) · 135 unmodified lines
136 136
137 /* Determine zero-padding length */137 /* Determine zero-padding length */
138 if (prot->version == TLS_1_3_VERSION) {138 if (prot->version == TLS_1_3_VERSION) {
139 int back = TLS_TAG_SIZE + 1;
139 char content_type = 0;140 char content_type = 0;
140 int err;141 int err;
141 int back = 17;
142 142
143 while (content_type == 0) {143 while (content_type == 0) {
144 if (back > rxm->full_len - prot->prepend_size)144 if (back > rxm->full_len - prot->prepend_size)
@@ -2496,7 +2496,7 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx) · 2351 unmodified lines
2496 2496
2497 /* Sanity-check the sizes for stack allocations. */2497 /* Sanity-check the sizes for stack allocations. */
2498 if (iv_size > MAX_IV_SIZE || nonce_size > MAX_IV_SIZE ||2498 if (iv_size > MAX_IV_SIZE || nonce_size > MAX_IV_SIZE ||
2499 rec_seq_size > TLS_MAX_REC_SEQ_SIZE) {2499 rec_seq_size > TLS_MAX_REC_SEQ_SIZE || tag_size != TLS_TAG_SIZE) {
2500 rc = -EINVAL;2500 rc = -EINVAL;
2501 goto free_priv;2501 goto free_priv;
2502 }2502 }