[tls] Formalise notions of fixed and record initialisation vectors

TLS block ciphers always use CBC (as per RFC 5246 section 6.2.3.2)
with a record initialisation vector length that is equal to the cipher
block size, and no fixed initialisation vector.

The initialisation vector for AEAD ciphers such as GCM is less
straightforward, and requires both a fixed and per-record component.

Extend the definition of a cipher suite to include fixed and record
initialisation vector lengths, and generate the fixed portion (if any)
as part of key expansion.

Do not add explicit calls to cipher_setiv() in tls_assemble_block()
and tls_split_block(), since the constraints imposed by RFC 5246 are
specifically chosen to allow implementations to avoid doing so.
(Instead, add a sanity check that the record initialisation vector
length is equal to the cipher block size.)

Signed-off-by: Michael Brown <mcb30@ipxe.org>

src/include/ipxe/tls.h

@@ -169,10 +169,14 @@ struct tls_cipher_suite {
 	struct cipher_algorithm *cipher;
 	/** MAC digest algorithm */
 	struct digest_algorithm *digest;
-	/** Key length */
-	uint16_t key_len;
 	/** Numeric code (in network-endian order) */
 	uint16_t code;
+	/** Key length */
+	uint8_t key_len;
+	/** Fixed initialisation vector length */
+	uint8_t fixed_iv_len;
+	/** Record initialisation vector length */
+	uint8_t record_iv_len;
 };
 
 /** TLS cipher suite table */
@@ -195,6 +199,8 @@ struct tls_cipherspec {
 	void *cipher_ctx;
 	/** MAC secret */
 	void *mac_secret;
+	/** Fixed initialisation vector */
+	void *fixed_iv;
 };
 
 /** A TLS signature and hash algorithm identifier */