aboutsummaryrefslogtreecommitdiff
path: root/sys/netipsec
diff options
context:
space:
mode:
authorConrad Meyer <cem@FreeBSD.org>2018-07-18 00:56:25 +0000
committerConrad Meyer <cem@FreeBSD.org>2018-07-18 00:56:25 +0000
commit1b0909d51a8aa8b5ec5a61c2dc1a69642976a732 (patch)
treeb9c915e7d2ca9312b6f83308f05040a78875b6d7 /sys/netipsec
parent38b42191fb8cbdf348508c72b504e0dc3da1b53c (diff)
downloadsrc-1b0909d51a8aa8b5ec5a61c2dc1a69642976a732.tar.gz
src-1b0909d51a8aa8b5ec5a61c2dc1a69642976a732.zip
OpenCrypto: Convert sessions to opaque handles instead of integers
Track session objects in the framework, and pass handles between the framework (OCF), consumers, and drivers. Avoid redundancy and complexity in individual drivers by allocating session memory in the framework and providing it to drivers in ::newsession(). Session handles are no longer integers with information encoded in various high bits. Use of the CRYPTO_SESID2FOO() macros should be replaced with the appropriate crypto_ses2foo() function on the opaque session handle. Convert OCF drivers (in particular, cryptosoft, as well as myriad others) to the opaque handle interface. Discard existing session tracking as much as possible (quick pass). There may be additional code ripe for deletion. Convert OCF consumers (ipsec, geom_eli, krb5, cryptodev) to handle-style interface. The conversion is largely mechnical. The change is documented in crypto.9. Inspired by https://lists.freebsd.org/pipermail/freebsd-arch/2018-January/018835.html . No objection from: ae (ipsec portion) Reported by: jhb
Notes
Notes: svn path=/head/; revision=336439
Diffstat (limited to 'sys/netipsec')
-rw-r--r--sys/netipsec/ipsec.c4
-rw-r--r--sys/netipsec/xform_ah.c19
-rw-r--r--sys/netipsec/xform_esp.c12
-rw-r--r--sys/netipsec/xform_ipcomp.c19
4 files changed, 26 insertions, 28 deletions
diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c
index 70485894c521..6267a23c6648 100644
--- a/sys/netipsec/ipsec.c
+++ b/sys/netipsec/ipsec.c
@@ -1351,8 +1351,8 @@ ipsec_updateid(struct secasvar *sav, crypto_session_t *new,
* XXXAE: check this more carefully.
*/
KEYDBG(IPSEC_STAMP,
- printf("%s: SA(%p) moves cryptoid %jd -> %jd\n",
- __func__, sav, (uintmax_t)(*old), (uintmax_t)(*new)));
+ printf("%s: SA(%p) moves cryptoid %p -> %p\n",
+ __func__, sav, *old, *new));
KEYDBG(IPSEC_DATA, kdebug_secasv(sav));
SECASVAR_LOCK(sav);
if (sav->tdb_cryptoid != *old) {
diff --git a/sys/netipsec/xform_ah.c b/sys/netipsec/xform_ah.c
index 2e7ce26c5b05..a6cc773b0e0c 100644
--- a/sys/netipsec/xform_ah.c
+++ b/sys/netipsec/xform_ah.c
@@ -245,16 +245,15 @@ ah_init(struct secasvar *sav, struct xformsw *xsp)
int
ah_zeroize(struct secasvar *sav)
{
- int err;
if (sav->key_auth)
bzero(sav->key_auth->key_data, _KEYLEN(sav->key_auth));
- err = crypto_freesession(sav->tdb_cryptoid);
- sav->tdb_cryptoid = 0;
+ crypto_freesession(sav->tdb_cryptoid);
+ sav->tdb_cryptoid = NULL;
sav->tdb_authalgxform = NULL;
sav->tdb_xform = NULL;
- return err;
+ return 0;
}
/*
@@ -669,7 +668,7 @@ ah_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff)
crp->crp_flags |= CRYPTO_F_ASYNC | CRYPTO_F_ASYNC_KEEPORDER;
crp->crp_buf = (caddr_t) m;
crp->crp_callback = ah_input_cb;
- crp->crp_sid = cryptoid;
+ crp->crp_session = cryptoid;
crp->crp_opaque = (caddr_t) xd;
/* These are passed as-is to the callback. */
@@ -720,9 +719,9 @@ ah_input_cb(struct cryptop *crp)
if (crp->crp_etype) {
if (crp->crp_etype == EAGAIN) {
/* Reset the session ID */
- if (ipsec_updateid(sav, &crp->crp_sid, &cryptoid) != 0)
+ if (ipsec_updateid(sav, &crp->crp_session, &cryptoid) != 0)
crypto_freesession(cryptoid);
- xd->cryptoid = crp->crp_sid;
+ xd->cryptoid = crp->crp_session;
CURVNET_RESTORE();
return (crypto_dispatch(crp));
}
@@ -1052,7 +1051,7 @@ ah_output(struct mbuf *m, struct secpolicy *sp, struct secasvar *sav,
crp->crp_flags |= CRYPTO_F_ASYNC | CRYPTO_F_ASYNC_KEEPORDER;
crp->crp_buf = (caddr_t) m;
crp->crp_callback = ah_output_cb;
- crp->crp_sid = cryptoid;
+ crp->crp_session = cryptoid;
crp->crp_opaque = (caddr_t) xd;
/* These are passed as-is to the callback. */
@@ -1101,9 +1100,9 @@ ah_output_cb(struct cryptop *crp)
if (crp->crp_etype) {
if (crp->crp_etype == EAGAIN) {
/* Reset the session ID */
- if (ipsec_updateid(sav, &crp->crp_sid, &cryptoid) != 0)
+ if (ipsec_updateid(sav, &crp->crp_session, &cryptoid) != 0)
crypto_freesession(cryptoid);
- xd->cryptoid = crp->crp_sid;
+ xd->cryptoid = crp->crp_session;
CURVNET_RESTORE();
return (crypto_dispatch(crp));
}
diff --git a/sys/netipsec/xform_esp.c b/sys/netipsec/xform_esp.c
index 9e48311ddc0d..68fbf3fc3851 100644
--- a/sys/netipsec/xform_esp.c
+++ b/sys/netipsec/xform_esp.c
@@ -389,7 +389,7 @@ esp_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff)
crp->crp_flags |= CRYPTO_F_ASYNC | CRYPTO_F_ASYNC_KEEPORDER;
crp->crp_buf = (caddr_t) m;
crp->crp_callback = esp_input_cb;
- crp->crp_sid = cryptoid;
+ crp->crp_session = cryptoid;
crp->crp_opaque = (caddr_t) xd;
/* These are passed as-is to the callback */
@@ -468,9 +468,9 @@ esp_input_cb(struct cryptop *crp)
if (crp->crp_etype) {
if (crp->crp_etype == EAGAIN) {
/* Reset the session ID */
- if (ipsec_updateid(sav, &crp->crp_sid, &cryptoid) != 0)
+ if (ipsec_updateid(sav, &crp->crp_session, &cryptoid) != 0)
crypto_freesession(cryptoid);
- xd->cryptoid = crp->crp_sid;
+ xd->cryptoid = crp->crp_session;
CURVNET_RESTORE();
return (crypto_dispatch(crp));
}
@@ -853,7 +853,7 @@ esp_output(struct mbuf *m, struct secpolicy *sp, struct secasvar *sav,
crp->crp_buf = (caddr_t) m;
crp->crp_callback = esp_output_cb;
crp->crp_opaque = (caddr_t) xd;
- crp->crp_sid = cryptoid;
+ crp->crp_session = cryptoid;
if (esph) {
/* Authentication descriptor. */
@@ -900,9 +900,9 @@ esp_output_cb(struct cryptop *crp)
if (crp->crp_etype) {
if (crp->crp_etype == EAGAIN) {
/* Reset the session ID */
- if (ipsec_updateid(sav, &crp->crp_sid, &cryptoid) != 0)
+ if (ipsec_updateid(sav, &crp->crp_session, &cryptoid) != 0)
crypto_freesession(cryptoid);
- xd->cryptoid = crp->crp_sid;
+ xd->cryptoid = crp->crp_session;
CURVNET_RESTORE();
return (crypto_dispatch(crp));
}
diff --git a/sys/netipsec/xform_ipcomp.c b/sys/netipsec/xform_ipcomp.c
index 2b02091e9d81..df09eb36cfa3 100644
--- a/sys/netipsec/xform_ipcomp.c
+++ b/sys/netipsec/xform_ipcomp.c
@@ -178,11 +178,10 @@ ipcomp_init(struct secasvar *sav, struct xformsw *xsp)
static int
ipcomp_zeroize(struct secasvar *sav)
{
- int err;
- err = crypto_freesession(sav->tdb_cryptoid);
- sav->tdb_cryptoid = 0;
- return err;
+ crypto_freesession(sav->tdb_cryptoid);
+ sav->tdb_cryptoid = NULL;
+ return 0;
}
/*
@@ -258,7 +257,7 @@ ipcomp_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff)
xd->vnet = curvnet;
SECASVAR_LOCK(sav);
- crp->crp_sid = xd->cryptoid = sav->tdb_cryptoid;
+ crp->crp_session = xd->cryptoid = sav->tdb_cryptoid;
SECASVAR_UNLOCK(sav);
return crypto_dispatch(crp);
@@ -301,9 +300,9 @@ ipcomp_input_cb(struct cryptop *crp)
if (crp->crp_etype) {
if (crp->crp_etype == EAGAIN) {
/* Reset the session ID */
- if (ipsec_updateid(sav, &crp->crp_sid, &cryptoid) != 0)
+ if (ipsec_updateid(sav, &crp->crp_session, &cryptoid) != 0)
crypto_freesession(cryptoid);
- xd->cryptoid = crp->crp_sid;
+ xd->cryptoid = crp->crp_session;
CURVNET_RESTORE();
return (crypto_dispatch(crp));
}
@@ -508,7 +507,7 @@ ipcomp_output(struct mbuf *m, struct secpolicy *sp, struct secasvar *sav,
crp->crp_opaque = (caddr_t) xd;
SECASVAR_LOCK(sav);
- crp->crp_sid = xd->cryptoid = sav->tdb_cryptoid;
+ crp->crp_session = xd->cryptoid = sav->tdb_cryptoid;
SECASVAR_UNLOCK(sav);
return crypto_dispatch(crp);
@@ -549,9 +548,9 @@ ipcomp_output_cb(struct cryptop *crp)
if (crp->crp_etype) {
if (crp->crp_etype == EAGAIN) {
/* Reset the session ID */
- if (ipsec_updateid(sav, &crp->crp_sid, &cryptoid) != 0)
+ if (ipsec_updateid(sav, &crp->crp_session, &cryptoid) != 0)
crypto_freesession(cryptoid);
- xd->cryptoid = crp->crp_sid;
+ xd->cryptoid = crp->crp_session;
CURVNET_RESTORE();
return (crypto_dispatch(crp));
}