Generalize the Crypto hardware option and add GUI support for AES-NI.

6 files changed, 58 insertions, 28 deletions

diff --git a/etc/inc/globals.inc b/etc/inc/globals.inc
index 711d1f5..519f28c 100644
--- a/etc/inc/globals.inc
+++ b/etc/inc/globals.inc
@@ -77,7 +77,7 @@ $g = array(
 	"disablecrashreporter" => false,
 	"crashreporterurl" => "http://crashreporter.pfsense.org/crash_reporter.php",
 	"debug" => false,
-	"latest_config" => "8.7",
+	"latest_config" => "8.8",
 	"nopkg_platforms" => array("cdrom"),
 	"minimum_ram_warning" => "101",
 	"minimum_ram_warning_text" => "128 MB",
diff --git a/etc/inc/pfsense-utils.inc b/etc/inc/pfsense-utils.inc
index 9402eb7..ef2a4f8 100644
--- a/etc/inc/pfsense-utils.inc
+++ b/etc/inc/pfsense-utils.inc
@@ -1498,13 +1498,19 @@ function compare_hostname_to_dnscache($hostname) {
 }
 
 /*
- * load_glxsb() - Load the glxsb crypto module if enabled in config.
+ * load_crypto() - Load crypto modules if enabled in config.
  */
-function load_glxsb() {
+function load_crypto() {
 	global $config, $g;
-	$is_loaded = `/sbin/kldstat | /usr/bin/grep -c glxsb`;
-	if (isset($config['system']['glxsb_enable']) && ($is_loaded == 0)) {
-		mwexec("/sbin/kldload glxsb");
+	$crypto_modules = array('glxsb', 'aesni');
+
+	if (!in_array($config['system']['crypto_hardware'], $crypto_modules))
+		return false;
+
+	$is_loaded = `/sbin/kldstat | /usr/bin/grep -c {$config['system']['crypto_hardware']}`;
+	if (!empty($config['system']['crypto_hardware']) && ($is_loaded == 0)) {
+		log_error("Loading {$config['system']['crypto_hardware']} cryptographic accelerator module.");
+		mwexec("/sbin/kldload {$config['system']['crypto_hardware']}");
 	}
 }
 
diff --git a/etc/inc/upgrade_config.inc b/etc/inc/upgrade_config.inc
index 04b6a71..b8bb978 100644
--- a/etc/inc/upgrade_config.inc
+++ b/etc/inc/upgrade_config.inc
@@ -2876,5 +2876,11 @@ function upgrade_086_to_087() {
 		}
 	}
 }
-
+function upgrade_087_to_088() {
+	global $config;
+	if (isset($config['system']['glxsb_enable'])) {
+		unset($config['system']['glxsb_enable']);
+		$config['system']['crypto_hardware'] = "glxsb";
+	}
+}
 ?>
diff --git a/etc/rc.bootup b/etc/rc.bootup
index 8b78866..a4479ab 100755
--- a/etc/rc.bootup
+++ b/etc/rc.bootup
@@ -215,8 +215,8 @@ echo "Setting up extended sysctls...";
 system_setup_sysctl();
 echo "done.\n";
 
-/* enable glxsb if wanted */
-load_glxsb();
+/* enable optional crypto modules */
+load_crypto();
 
 /* run any early shell commands specified in config.xml */
 system_do_shell_commands(1);
diff --git a/usr/local/www/index.php b/usr/local/www/index.php
index c9efd0c..9b19a48 100755
--- a/usr/local/www/index.php
+++ b/usr/local/www/index.php
@@ -197,7 +197,13 @@ EOF;
 	if ($fd) {
 		while (!feof($fd)) {
 			$dmesgl = fgets($fd);
-			if (preg_match("/^hifn.: (.*?),/", $dmesgl, $matches) or preg_match("/.*(VIA Padlock)/", $dmesgl, $matches) or preg_match("/^safe.: (\w.*)/", $dmesgl, $matches) or preg_match("/^ubsec.: (.*?),/", $dmesgl, $matches) or preg_match("/^padlock.: <(.*?)>,/", $dmesgl, $matches) or preg_match("/^glxsb.: (.*?),/", $dmesgl, $matches)) {
+			if (preg_match("/^hifn.: (.*?),/", $dmesgl, $matches)
+				or preg_match("/.*(VIA Padlock)/", $dmesgl, $matches)
+				or preg_match("/^safe.: (\w.*)/", $dmesgl, $matches)
+				or preg_match("/^ubsec.: (.*?),/", $dmesgl, $matches)
+				or preg_match("/^padlock.: <(.*?)>,/", $dmesgl, $matches)
+				or preg_match("/^glxsb.: (.*?),/", $dmesgl, $matches)
+				or preg_match("/^aesni.: (.*?),/", $dmesgl, $matches)) {
 				$hwcrypto = $matches[1];
 				break;
 			}
diff --git a/usr/local/www/system_advanced_misc.php b/usr/local/www/system_advanced_misc.php
index 45c956a..8d3da66 100644
--- a/usr/local/www/system_advanced_misc.php
+++ b/usr/local/www/system_advanced_misc.php
@@ -64,7 +64,7 @@ $pconfig['racoondebug_enable'] = isset($config['ipsec']['racoondebug']);
 $pconfig['maxmss_enable'] = isset($config['system']['maxmss_enable']);
 $pconfig['maxmss'] = $config['system']['maxmss'];
 $pconfig['powerd_enable'] = isset($config['system']['powerd_enable']);
-$pconfig['glxsb_enable'] = isset($config['system']['glxsb_enable']);
+$pconfig['crypto_hardware'] = $config['system']['crypto_hardware'];
 $pconfig['schedule_states'] = isset($config['system']['schedule_states']);
 $pconfig['kill_states'] = isset($config['system']['kill_states']);
 
@@ -73,6 +73,9 @@ if (!empty($config['system']['powerd_mode']))
 else
 	$pconfig['powerd_mode'] = "hadp";
 
+$crypto_modules = array('glxsb' => gettext("AMD Geode LX Security Block"),
+			'aesni' => gettext("AES-NI CPU-based Acceleratation"));
+
 if ($_POST) {
 
     unset($input_errors);
@@ -81,6 +84,9 @@ if ($_POST) {
 	ob_flush();
 	flush();
 
+	if (!empty($_POST['crypto_hardware']) && !array_key_exists($_POST['crypto_hardware'], $crypto_modules))
+		$input_errors[] = gettext("Please select a valid Cryptographic Accelerator.");
+
 	if (!$input_errors) {
 
 		if($_POST['harddiskstandby'] <> "") {
@@ -160,11 +166,11 @@ if ($_POST) {
                         unset($config['system']['powerd_enable']);
 
 		$config['system']['powerd_mode'] = $_POST['powerd_mode'];
-						
-		if($_POST['glxsb_enable'] == "yes")
-                        $config['system']['glxsb_enable'] = true;
-                else
-                        unset($config['system']['glxsb_enable']);
+
+		if($_POST['crypto_hardware'])
+			$config['system']['crypto_hardware'] = $_POST['crypto_hardware'];
+		else
+			unset($config['system']['crypto_hardware']);
 
 		if($_POST['schedule_states'] == "yes")
                         $config['system']['schedule_states'] = true;
@@ -187,7 +193,7 @@ if ($_POST) {
 		    $savemsg = gettext($retval);
 		
 		activate_powerd();
-		load_glxsb();
+		load_crypto();
 		vpn_ipsec_configure_preferoldsa();
 		if ($need_racoon_restart)
 			vpn_ipsec_force_reload();
@@ -358,22 +364,28 @@ function maxmss_checked(obj) {
 								<td colspan="2" class="list" height="12">&nbsp;</td>
 							</tr>
 							<tr>
-								<td colspan="2" valign="top" class="listtopic"><?=gettext("glxsb Crypto Acceleration"); ?></td>
+								<td colspan="2" valign="top" class="listtopic"><?=gettext("Cryptographic Hardware Acceleration"); ?></td>
 							</tr>
 							<tr>
-								<td width="22%" valign="top" class="vncell"><?=gettext("glxsb"); ?></td>
+								<td width="22%" valign="top" class="vncell"><?=gettext("Cryptographic Hardware"); ?></td>
 								<td width="78%" class="vtable">
-									<input name="glxsb_enable" type="checkbox" id="glxsb_enable" value="yes" <?php if ($pconfig['glxsb_enable']) echo "checked"; ?> />
-									<strong><?=gettext("Use glxsb"); ?></strong><br/>
+									<select name="crypto_hardware" id="crypto_hardware">
+										<option value=""><?php echo gettext("None"); ?></option>
+										<?php foreach ($crypto_modules as $cryptomod_name => $cryptomod_descr): ?>
+											<option value="<?php echo $cryptomod_name; ?>" <?php if ($pconfig['crypto_hardware'] == $cryptomod_name) echo " selected"; ?>><?php echo "{$cryptomod_descr} ({$cryptomod_name})"; ?></option>
+										<?php endforeach; ?>
+									</select>
 									<br />
-								     <?=gettext("The AMD Geode LX Security Block will accelerate some cryptographic functions " .
-								     "on systems which have the chip. Do not enable this option if you have a " .
-								     "Hifn cryptographic acceleration card, as this will take precedence and the " .
-								     "Hifn card will not be used. Acceleration should be automatic for IPsec " .
-								     "when using Rijndael (AES). OpenVPN should be set for AES-128-CBC."); ?>
+								     <?=gettext("A cryptographic accelator module will use hardware support to speed up some " .
+										"cryptographic functions on systems which have the chip. Do not enable this " .
+										"option if you have a Hifn cryptographic acceleration card, as this will take " .
+										"precedence and the Hifn card will not be used. Acceleration should be automatic " .
+										"for IPsec when using a cipher supported by your chip, such as AES-128. OpenVPN " .
+										"should be set for AES-128-CBC and have cryptodev enabled for hardware " .
+										"acceleration."); ?>
 								     <br/><br/>
-								     <?=gettext("If you do not have a glxsb chip in your system, this option will have no " .
-								     "effect. To unload the module, uncheck this option and then reboot."); ?>
+								     <?=gettext("If you do not have a crypto chip in your system, this option will have no " .
+								     "effect. To unload the selected module, set this option to 'none' and then reboot."); ?>
 								</td>
 							</tr>
 							<tr>