Tracking issue: kTLS MVP

[toidiu]

The MVP will include ktls support for TLS1.2 AES_GCM_128. Since TLS1.3 key_update is not support in kTLS a kernel patch is required.

The kTLS feature will initially be released as unstable. kTLS POC:

• ak-ktls0_main
• ak-ktls0_main1

milestone 1

• tls 1.2 MVP (milestone 1)
  • [x] enums and some building blocks (s2n_ktls.h) https://github.com/aws/s2n-tls/pull/3797
  • [x] cipher suites indicate kTLS support (AES_GCM_128) https://github.com/aws/s2n-tls/pull/3806
    • struct s2n_cipher { bool supports_ktls; }
  • [x] rm config.ktls_request. instead enable per connection https://github.com/aws/s2n-tls/pull/3816
  • [x] feature probe https://github.com/aws/s2n-tls/pull/3869 https://github.com/aws/s2n-tls/pull/4071
    • [x] fix kTLS feature probe (linux doesnt expose uapi for kTLS) https://github.com/aws/s2n-tls/pull/4064
  • [x] enable kTLS (s2n_ktls.c)
    • [x] refactor prf https://github.com/aws/s2n-tls/pull/4047
      • [x] configure socket ULP/TLS_SW https://github.com/aws/s2n-tls/pull/4066
      • [x] configure connection and set tx/rx keys https://github.com/aws/s2n-tls/pull/4071
  • [x] cmsg
    • [x] mock IO send/recvmsg https://github.com/aws/s2n-tls/pull/4109
    • [x] get/set cmsghdr control data https://github.com/aws/s2n-tls/pull/4146
    • [x] sendmsg https://github.com/aws/s2n-tls/pull/4147
    • [x] recvmsg https://github.com/aws/s2n-tls/pull/4154
  • [x] ktls send
    • [x] app https://github.com/aws/s2n-tls/pull/4162
    • [x] #4167
  • [x] ktls recv
    • [x] #4168
    • [x] #4169
  • [ ] ktls + renegotiation: do we want to allow for enabling kTLS if reneg is enabled?
  • [x] self talk AF_INET testing
    • [x] self-talk inet socket https://github.com/aws/s2n-tls/pull/4075
    • [x] #4170
  • [x] enable ktls in CI
    • [ ] qemu docker image
    • [ ] large github hosts with KVM
      • [ ] self-talk inet socket /w kTLS
  • [x] expose API to users
  • [x] documentation
    • [ ] s2n_connection_get_wire_bytes_in/out are not usable once kTLS is enabled
  • [x] #4171

milestone 1.5

• support AES_GCM_256

milestone 2

• enable TLS1.3 support and ciphers
  • derive keys
  • ciphers
  • send post-handshake
• enable key update (milestone 2)
  • detect key_update kernel patch (feature detection)
  • detect KeyUpdate and rekey connection
  • send KeyUpdate and rekey connection

[toidiu]

notes on FreeBSD specific impl https://github.com/aws/s2n-tls/issues/4153