| 450 | |
| 451 | #if defined(INET) || defined(INET6) |
| 452 | static int |
| 453 | ktls_create_session(struct socket *so, struct tls_enable *en, |
| 454 | struct ktls_session **tlsp) |
| 455 | { |
| 456 | struct ktls_session *tls; |
| 457 | int error; |
| 458 | |
| 459 | /* Only TLS 1.0 - 1.3 are supported. */ |
| 460 | if (en->tls_vmajor != TLS_MAJOR_VER_ONE) |
| 461 | return (EINVAL); |
| 462 | if (en->tls_vminor < TLS_MINOR_VER_ZERO || |
| 463 | en->tls_vminor > TLS_MINOR_VER_THREE) |
| 464 | return (EINVAL); |
| 465 | |
| 466 | if (en->auth_key_len < 0 || en->auth_key_len > TLS_MAX_PARAM_SIZE) |
| 467 | return (EINVAL); |
| 468 | if (en->cipher_key_len < 0 || en->cipher_key_len > TLS_MAX_PARAM_SIZE) |
| 469 | return (EINVAL); |
| 470 | if (en->iv_len < 0 || en->iv_len > sizeof(tls->params.iv)) |
| 471 | return (EINVAL); |
| 472 | |
| 473 | /* All supported algorithms require a cipher key. */ |
| 474 | if (en->cipher_key_len == 0) |
| 475 | return (EINVAL); |
| 476 | |
| 477 | /* No flags are currently supported. */ |
| 478 | if (en->flags != 0) |
| 479 | return (EINVAL); |
| 480 | |
| 481 | /* Common checks for supported algorithms. */ |
| 482 | switch (en->cipher_algorithm) { |
| 483 | case CRYPTO_AES_NIST_GCM_16: |
| 484 | /* |
| 485 | * auth_algorithm isn't used, but permit GMAC values |
| 486 | * for compatibility. |
| 487 | */ |
| 488 | switch (en->auth_algorithm) { |
| 489 | case 0: |
| 490 | #ifdef COMPAT_FREEBSD12 |
| 491 | /* XXX: Really 13.0-current COMPAT. */ |
| 492 | case CRYPTO_AES_128_NIST_GMAC: |
| 493 | case CRYPTO_AES_192_NIST_GMAC: |
| 494 | case CRYPTO_AES_256_NIST_GMAC: |
| 495 | #endif |
| 496 | break; |
| 497 | default: |
| 498 | return (EINVAL); |
| 499 | } |
| 500 | if (en->auth_key_len != 0) |
| 501 | return (EINVAL); |
| 502 | if ((en->tls_vminor == TLS_MINOR_VER_TWO && |
| 503 | en->iv_len != TLS_AEAD_GCM_LEN) || |
| 504 | (en->tls_vminor == TLS_MINOR_VER_THREE && |
| 505 | en->iv_len != TLS_1_3_GCM_IV_LEN)) |
| 506 | return (EINVAL); |
| 507 | break; |
| 508 | case CRYPTO_AES_CBC: |
| 509 | switch (en->auth_algorithm) { |
no test coverage detected