summaryrefslogtreecommitdiffstats
path: root/sys/opencrypto
Commit message (Collapse)AuthorAgeFilesLines
* crypto(9) is called from ipsec in CRYPTO_F_CBIFSYNC mode. This is workingfabient2018-01-282-71/+262
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | fine when a lot of different flows to be ciphered/deciphered are involved. However, when a software crypto driver is used, there are situations where we could benefit from making crypto(9) multi threaded: - a single flow is to be ciphered: only one thread is used to cipher it, - a single ESP flow is to be deciphered: only one thread is used to decipher it. The idea here is to call crypto(9) using a new mode (CRYPTO_F_ASYNC) to dispatch the crypto jobs on multiple threads, if the underlying crypto driver is working in synchronous mode. Another flag is added (CRYPTO_F_ASYNC_KEEPORDER) to make crypto(9) dispatch the crypto jobs in the order they are received (an additional queue/thread is used), so that the packets are reinjected in the network using the same order they were posted. A new sysctl net.inet.ipsec.async_crypto can be used to activate this new behavior (disabled by default). Submitted by: Emeric Poupon <emeric.poupon@stormshield.eu> Reviewed by: ae, jmg, jhb Differential Revision: https://reviews.freebsd.org/D10680 Sponsored by: Stormshield (cherry picked from commit fbc9da5dbe50b72a335de7a27b6834fba8ee3cf0)
* MFC 316510: Don't leak a session and lock if a GMAC key has an invalid length.jhb2017-05-121-1/+4
|
* MFC r303650:bdrewery2016-08-081-1/+1
| | | | | | | opencrypto AES-ICM: Fix heap corruption typo PR: 204009 Approved by: re (kib)
* sys/opencrypto: minor spelling fixes.pfg2016-05-063-3/+3
| | | | | | No functional change. Reviewed by: jmg
* Break up opencrypto/xform.c so it can be reused piecemealallanjude2015-12-3023-968/+2115
| | | | | | | | | | | | | | Keep xform.c as a meta-file including the broken out bits existing code that includes xform.c continues to work as normal Individual algorithms can now be reused elsewhere, including outside of the kernel Reviewed by: bapt (previous version), gnn, delphij Approved by: secteam MFC after: 1 week Sponsored by: ScaleEngine Inc. Differential Revision: https://reviews.freebsd.org/D4674
* Replace sys/crypto/sha2/sha2.c with lib/libmd/sha512c.callanjude2015-12-271-1/+3
| | | | | | | | | | | | | | | | | | cperciva's libmd implementation is 5-30% faster The same was done for SHA256 previously in r263218 cperciva's implementation was lacking SHA-384 which I implemented, validated against OpenSSL and the NIST documentation Extend sbin/md5 to create sha384(1) Chase dependancies on sys/crypto/sha2/sha2.{c,h} and replace them with sha512{c.c,.h} Reviewed by: cperciva, des, delphij Approved by: secteam, bapt (mentor) MFC after: 2 weeks Sponsored by: ScaleEngine Inc. Differential Revision: https://reviews.freebsd.org/D3929
* Remove unneeded includes of opt_kdtrace.h.markj2015-11-221-1/+0
| | | | | As of r258541, KDTRACE_HOOKS is defined in opt_global.h, so opt_kdtrace.h is not needed when defining SDT(9) probes.
* Use explicitly specified ivsize instead of blocksize when we mean IV size.ae2015-11-161-1/+1
| | | | | | | | Set zero ivsize for enc_xform_null and remove special handling from xform_esp.c. Reviewed by: gnn Differential Revision: https://reviews.freebsd.org/D1503
* Make IPsec work with AES-GCM and AES-ICM (aka CTR) in OCF... IPsecjmg2015-08-043-13/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | defines the keys differently than NIST does, so we have to muck with key lengths and nonce/IVs to be standard compliant... Remove the iv from secasvar as it was unused... Add a counter protected by a mutex to ensure that the counter for GCM and ICM will never be repeated.. This is a requirement for security.. I would use atomics, but we don't have a 64bit one on all platforms.. Fix a bug where IPsec was depending upon the OCF to ensure that the blocksize was always at least 4 bytes to maintain alignment... Move this logic into IPsec so changes to OCF won't break IPsec... In one place, espx was always non-NULL, so don't test that it's non-NULL before doing work.. minor style cleanups... drop setting key and klen as they were not used... Enforce that OCF won't pass invalid key lengths to AES that would panic the machine... This was has been tested by others too... I tested this against NetBSD 6.1.5 using mini-test suite in https://github.com/jmgurney/ipseccfgs and the only things that don't pass are keyed md5 and sha1, and 3des-deriv (setkey syntax error), all other modes listed in setkey's man page... The nice thing is that NetBSD uses setkey, so same config files were used on both... Reviewed by: gnn
* Fix XTS, and name things a bit better...jmg2015-07-142-12/+10
| | | | | | | | | | | | | | | | Though confusing, GCM using ICM_BLOCK_LEN, but ICM does not is correct... GCM is built on ICM, but uses a function other than swcr_encdec... swcr_encdec cannot handle partial blocks which is why it must still use AES_BLOCK_LEN and is why XTS was broken by the commit... Thanks to the tests for helping sure I didn't break GCM w/ an earlier patch... I did run the tests w/o this patch, and need to figure out why they did not fail, clearly more tests are needed... Prodded by: peter
* Add support for AES modes to IPSec. These modes work both in software onlygnn2015-07-092-41/+100
| | | | | | | | mode and with hardware support on systems that have AESNI instructions. Differential Revision: D2936 Reviewed by: jmg, eri, cognet Sponsored by: Rubicon Communications (Netgate)
* we may get here w/ non-sleepable locks held, so switch to _NOWAIT whenjmg2015-07-073-4/+9
| | | | | | doing this memory allocation... Reviewed by: ae
* change the KASSERT so it is meaningful, var is unsigned, so evenjmg2015-06-191-1/+1
| | | | | | | when it wraps, it's still >= 0... Reported by: Coverity CID: 1017564
* Use the correct number of arguments for themarkj2015-05-251-8/+8
| | | | | | | opencrypto:deflate:deflate_global:bad DTrace probe, which is defined to have MFC after: 1 week
* Move zlib.c from net to libkern.rodrigc2015-04-222-3/+3
| | | | | | | | | | | | It is not network-specific code and would be better as part of libkern instead. Move zlib.h and zutil.h from net/ to sys/ Update includes to use sys/zlib.h and sys/zutil.h instead of net/ Submitted by: Steve Kiernan stevek@juniper.net Obtained from: Juniper Networks, Inc. GitHub Pull Request: https://github.com/freebsd/freebsd/pull/28 Relnotes: yes
* add the define to properly guard this header..jmg2015-04-071-0/+1
| | | | Sponsored by: Netflix, Inc.
* Add some new modes to OpenCrypto. These modes are AES-ICM (can be usedjmg2014-12-1211-446/+1607
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | for counter mode), and AES-GCM. Both of these modes have been added to the aesni module. Included is a set of tests to validate that the software and aesni module calculate the correct values. These use the NIST KAT test vectors. To run the test, you will need to install a soon to be committed port, nist-kat that will install the vectors. Using a port is necessary as the test vectors are around 25MB. All the man pages were updated. I have added a new man page, crypto.7, which includes a description of how to use each mode. All the new modes and some other AES modes are present. It would be good for someone else to go through and document the other modes. A new ioctl was added to support AEAD modes which AES-GCM is one of them. Without this ioctl, it is not possible to test AEAD modes from userland. Add a timing safe bcmp for use to compare MACs. Previously we were using bcmp which could leak timing info and result in the ability to forge messages. Add a minor optimization to the aesni module so that single segment mbufs don't get copied and instead are updated in place. The aesni module needs to be updated to support blocked IO so segmented mbufs don't have to be copied. We require that the IV be specified for all calls for both GCM and ICM. This is to ensure proper use of these functions. Obtained from: p4: //depot/projects/opencrypto Relnotes: yes Sponsored by: FreeBSD Foundation Sponsored by: NetGate
* Fix build for kernels without COMPAT_FREEBSD32.jhb2014-09-221-0/+1
|
* Add a new fo_fill_kinfo fileops method to add type-specific information tojhb2014-09-221-0/+11
| | | | | | | | | | | | | | struct kinfo_file. - Move the various fill_*_info() methods out of kern_descrip.c and into the various file type implementations. - Rework the support for kinfo_ofile to generate a suitable kinfo_file object for each file and then convert that to a kinfo_ofile structure rather than keeping a second, different set of code that directly manipulates type-specific file information. - Remove the shm_path() and ksem_info() layering violations. Differential Revision: https://reviews.freebsd.org/D775 Reviewed by: kib, glebius (earlier version)
* Fix various issues with invalid file operations:jhb2014-09-121-54/+5
| | | | | | | | | | | | | | | | | | - Add invfo_rdwr() (for read and write), invfo_ioctl(), invfo_poll(), and invfo_kqfilter() for use by file types that do not support the respective operations. Home-grown versions of invfo_poll() were universally broken (they returned an errno value, invfo_poll() uses poll_no_poll() to return an appropriate event mask). Home-grown ioctl routines also tended to return an incorrect errno (invfo_ioctl returns ENOTTY). - Use the invfo_*() functions instead of local versions for unsupported file operations. - Reorder fileops members to match the order in the structure definition to make it easier to spot missing members. - Add several missing methods to linuxfileops used by the OFED shim layer: fo_write(), fo_truncate(), fo_kqfilter(), and fo_stat(). Most of these used invfo_*(), but a dummy fo_stat() implementation was added.
* allow the kern.cryptodevallowsoft sysctl to enable symetric/hashes too...jmg2014-03-112-7/+10
| | | | | | | | This will allow us to more easily test the software versions of these routines... Considering that we've never had an software asymetric implmentation, it's doubtful anyone has this enabled...
* some minor clean up.. Always _ZERO memory so mtx_init won't panic...jmg2014-03-112-6/+1
| | | | | | | use the proper macro instead of hand rolling it... Reviewed by: jhb (only the malloc change) MFC after: 1 week
* Prevent races in accesses of the software crypto session array.benno2014-01-281-12/+55
| | | | | | | | | | | | swcr_newsession can change the pointer for swcr_sessions which races with swcr_process which is looking up entries in this array. Add a rwlock that protects changes to the array pointer so that swcr_newsession and swcr_process no longer race. Original patch by: Steve O'Hara-Smith <Steve.OHaraSmith@isilon.com> Reviewed by: jmg Sponsored by: EMC / Isilon Storage Division
* Fix build with 'crypto' and 'zfs' in the same kernel. This was the pathpeter2013-12-081-0/+0
| | | | of least pain I could find.
* dtrace sdt: remove the ugly sname parameter of SDT_PROBE_DEFINEavg2013-11-261-4/+4
| | | | | | | | In its stead use the Solaris / illumos approach of emulating '-' (dash) in probe names with '__' (two consecutive underscores). Reviewed by: markj MFC after: 3 weeks
* - For kernel compiled only with KDTRACE_HOOKS and not any lock debuggingattilio2013-11-252-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | option, unbreak the lock tracing release semantic by embedding calls to LOCKSTAT_PROFILE_RELEASE_LOCK() direclty in the inlined version of the releasing functions for mutex, rwlock and sxlock. Failing to do so skips the lockstat_probe_func invokation for unlocking. - As part of the LOCKSTAT support is inlined in mutex operation, for kernel compiled without lock debugging options, potentially every consumer must be compiled including opt_kdtrace.h. Fix this by moving KDTRACE_HOOKS into opt_global.h and remove the dependency by opt_kdtrace.h for all files, as now only KDTRACE_FRAMES is linked there and it is only used as a compile-time stub [0]. [0] immediately shows some new bug as DTRACE-derived support for debug in sfxge is broken and it was never really tested. As it was not including correctly opt_kdtrace.h before it was never enabled so it was kept broken for a while. Fix this by using a protection stub, leaving sfxge driver authors the responsibility for fixing it appropriately [1]. Sponsored by: EMC / Isilon storage division Discussed with: rstone [0] Reported by: rstone [1] Discussed with: philip
* Make sendfile() a method in the struct fileops. Currently onlyglebius2013-08-151-0/+1
| | | | | | | | vnode backed file descriptors have this method implemented. Reviewed by: kib Sponsored by: Nginx, Inc. Sponsored by: Netflix
* When porting XTS-related code from OpenBSD I forgot to update copyright (onlypjd2013-02-201-2/+7
| | | | | | | OpenBSD was credited in one of two commits). Fix it. Reported by: Theo de Raadt <deraadt@cvs.openbsd.org> Reviewed by: Damien Miller <djm@mindrot.org>
* Revert previous commit...kevlo2012-10-101-1/+1
| | | | Pointyhat to: kevlo (myself)
* Prefer NULL over 0 for pointerskevlo2012-10-091-1/+1
|
* Add the fo_chown and fo_chmod methods to struct fileops and use themkib2011-08-161-1/+3
| | | | | | | | | | to implement fchown(2) and fchmod(2) support for several file types that previously lacked it. Add MAC entries for chown/chmod done on posix shared memory and (old) in-kernel posix semaphores. Based on the submission by: glebius Reviewed by: rwatson Approved by: re (bz)
* After the r219999 is merged to stable/8, rename fallocf(9) to falloc(9)kib2011-04-011-1/+1
| | | | | | | | and remove the falloc() version that lacks flag argument. This is done to reduce the KPI bloat. Requested by: jhb X-MFC-note: do not
* fixed size of AH_ALEN_MAX, which is 64 bytes for SHA-512.vanhu2011-02-251-1/+2
| | | | | Obtained from: Matthias Drochner <M.Drochner@fz-juelich.de> MFC after: 3d
* Let cryptosoft(4) add its pseudo-device with a specific unit number and itsmarius2010-11-141-2/+2
| | | | | | | | | | | probe method return BUS_PROBE_NOWILDCARD so it doesn't get attached to real devices hanging off of nexus(4) with no specific devclass set. Actually, the more desirable fix for this would be to get rid of the newbus interface of cryptosoft(4) altogether but apparently crypto(9) was written with support for cryptographic hardware in mind so that approach would require some KPI breaking changes which don't seem worth it. MFC after: 1 week
* Add support for AES-XTS.pjd2010-09-235-15/+203
| | | | | Obtained from: OpenBSD MFC after: 1 week
* Remove redundant space.pjd2010-09-231-1/+1
| | | | MFC after: 1 week
* Add an extra comment to the SDT probes definition. This allows us to getrpaulo2010-08-221-4/+4
| | | | | | | | | use '-' in probe names, matching the probe names in Solaris.[1] Add userland SDT probes definitions to sys/sdt.h. Sponsored by: The FreeBSD Foundation Discussed with: rwaston [1]
* Fix typo in comment.jhb2010-08-111-1/+1
|
* Add compat32 shims for opencrypto(4).kib2010-07-291-7/+266
| | | | | Reviewed by: bz MFC after: 3 weeks
* Use the fpu_kern_enter() interface to properly separate usermode FPUkib2010-06-051-0/+8
| | | | | | | | | | | | | | context from in-kernel execution of padlock instructions and to handle spurious FPUDNA exceptions that sometime are raised when doing padlock calculations. Globally mark crypto(9) kthread as using FPU. Reviewed by: pjd Hardware provided by: Sentex Communications Tested by: pho PR: amd64/135014 MFC after: 1 month
* Add comments trying to explain what bad things happen here, i.e.bz2010-01-091-1/+18
| | | | | | | | | | | how hashed MD5/SHA are implemented, abusing Final() for padding and sw_octx to transport the key from the beginning to the end. Enlightened about what was going on here by: cperciva Reviewed by: cperciva MFC After: 3 days X-MFC with: r187826 PR: kern/126468
* In case the compression result is the same size as the orignal version,bz2009-11-291-1/+1
| | | | | | | | | | | | the compression was useless as well. Make sure to not update the data and return, else we would waste resources when decompressing. This also avoids the copyback() changing data other consumers like xform_ipcomp.c would have ignored because of no win and sent out without noting that compression was used, resulting in invalid packets at the receiver. MFC after: 5 days
* Add SDT iter probes forgotten in r199885.bz2009-11-291-0/+6
| | | | MFC after: 5 days
* Change memory managment from a fixed size array to a list.bz2009-11-282-60/+73
| | | | | | | | | | | | | | | | This is needed to avoid running into out of buffer situations where we cannot alloc a new buffer because we hit the array size limit (ZBUF). Use a combined allocation for the struct and the actual data buffer to not increase the number of malloc calls. [1] Defer initialization of zbuf until we actually need it. Make sure the output buffer will be large enough in all cases. Details discussed with: kib [1] Reviewed by: kib [1] MFC after: 6 days
* Z_PARTIAL_FLUSH is marked deprecated. Z_SYNC_FLUSH is the suggestedbz2009-11-281-6/+10
| | | | | | | | | | replacement but only use it for inflate. For deflate use Z_FINISH as Z_SYNC_FLUSH adds a trailing marker in some cases that inflate(), despite the comment in zlib, does npt seem to cope well with, resulting in errors when uncompressing exactly fills the outbut buffer without a Z_STREAM_END and a successive call returns an error. MFC after: 6 days
* Add SDT probes for opencrypto:deflate:deflate_gobal:*.bz2009-11-281-7/+61
| | | | | | They are not nice but they were helpful. MFC after: 6 days
* Define an SDT provider for "opencrypto".bz2009-11-281-0/+4
| | | | MFC after: 6 days
* If crypto operation is finished with EAGAIN, don't repeat operation frompjd2009-09-041-8/+9
| | | | | | | | the return context, but from the original context. Before repeating operation clear DONE flag and error. Reviewed by: sam Obtained from: Wheel Sp. z o.o. (http://www.wheel.pl)
* Fix cryptodev UIO creation.raj2009-05-231-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | Cryptodev uses UIO structure do get data from userspace and pass it to cryptographic engines. Initially UIO size is equal to size of data passed to engine, but if UIO is prepared for hash calculation an additional small space is created to hold result of operation. While creating space for the result, UIO I/O vector size is correctly extended, but uio_resid field in UIO structure is not modified. As bus_dma code uses uio_resid field to determine size of UIO DMA mapping, resulting mapping hasn't correct size. This leads to a crash if all the following conditions are met: 1. Hardware cryptographic accelerator writes result of hash operation using DMA. 2. Size of input data is less or equal than (n * PAGE_SIZE), 3. Size of input data plus size of hash result is grather than (n * PAGE_SIZE, where n is the same as in point 2. This patch fixes this problem by adding size of the extenstion to uio_resid field in UIO structure. Submitted by: Piotr Ziecik kosmo ! semihalf dot com Reviewed by: philip Obtained from: Semihalf
* Fix return type for detach routine (should be int)imp2009-02-051-2/+3
| | | | Fix first parameter for identify routine (should be driver_t *)
OpenPOWER on IntegriCloud