aboutsummaryrefslogtreecommitdiff
path: root/sys/crypto
Commit message (Collapse)AuthorAgeFilesLines
* OpenSSL: Regen assembly files for OpenSSL 1.1.1jJung-uk Kim2021-02-171-4/+7
|
* armv8crypto: Extract GCM state into a structureMark Johnston2021-02-081-70/+65
| | | | | | | | | | | | | | This makes it easier to refactor the GCM code to operate on crypto_buffer_cursors rather than plain contiguous buffers, with the aim of minimizing the amount of copying and zeroing done today. No functional change intended. Reviewed by: jhb MFC after: 1 week Sponsored by: Ampere Computing Submitted by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D28500
* armv8crypto: Fix some edge cases in the AES-GCM implementationMark Johnston2021-02-081-18/+29
| | | | | | | | | | | | | | | | | | | | | - We were only hashing up to the first 16 bytes of the AAD. - When computing the digest during decryption, handle the case where len == trailer, i.e., len < AES_BLOCK_LEN, properly. While here: - trailer is always smaller than AES_BLOCK_LEN, so remove a pair of unnecessary modulus operations. - Replace some byte-by-byte loops with memcpy() and memset() calls. In particular, zero the full block before copying a partial block into it since we do that elsewhere and it means that the memset() length is known at compile time. Reviewed by: jhb Sponsored by: Ampere Computing Submitted by: Klara, Inc. MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D28501
* armv8crypto: add AES-GCM supportOleksandr Tymoshenko2021-01-223-74/+417
| | | | | | | | | Add support for AES-GCM using OpenSSL's accelerated routines. Reviewed by: jhb Differential Revision: https://reviews.freebsd.org/D27454 Sponsored by: Ampere Computing Submitted by: Klara, Inc.
* aesni: Ensure that key schedules are alignedMark Johnston2021-01-182-3/+12
| | | | | | | | | | | Rather than depending on malloc() returning 16-byte aligned chunks, allocate some extra pad bytes and ensure that key schedules are appropriately aligned. Reviewed by: kib MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC (Netgate) Differential Revision: https://reviews.freebsd.org/D28157
* armv8crypto: print a message on probe failureMitchell Horne2021-01-181-0/+3
| | | | | | | | | | Similar to the message printed by aesni(4), let the user know if the driver is unsupported by their CPU. PR: 252543 Reported by: gbe MFC after: 3 days Sponsored by: The FreeBSD Foundation
* armv8crypto: add AES-XTS supportMitchell Horne2021-01-073-11/+138
| | | | | | | | | | | A straightforward(ish) port from aesni(4). This implementation does not perform loop unrolling on the input blocks, so this is left as a future performance improvement. Submitted by: Greg V <greg AT unrelenting.technology> Looks good: jhb, jmg Tested by: mhorne Differential Revision: https://reviews.freebsd.org/D21017
* Revert r366943. It did not work as expected.Jung-uk Kim2020-12-111-1/+0
| | | | Notes: svn path=/head/; revision=368542
* Merge OpenSSL 1.1.1i.Jung-uk Kim2020-12-097-39/+56
| | | | Notes: svn path=/head/; revision=368472
* Add CFI start/end proc directives to arm64, i386, and ppcConrad Meyer2020-12-051-8/+4
| | | | | | | | | | | | | | Follow-up to r353959 and r368070: do the same for other architectures. arm32 already seems to use its own .fnstart/.fnend directives, which appear to be ARM-specific variants of the same thing. Likewise, MIPS uses .frame directives. Reviewed by: arichardson Differential Revision: https://reviews.freebsd.org/D27387 Notes: svn path=/head/; revision=368354
* ossl: port to arm64Mitchell Horne2020-12-042-0/+146
| | | | | | | | | | | | | | Enable in-kernel acceleration of SHA1 and SHA2 operations on arm64 by adding support for the ossl(4) crypto driver. This uses OpenSSL's assembly routines under the hood, which will detect and use SHA intrinsics if they are supported by the CPU. Reviewed by: jhb Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D27390 Notes: svn path=/head/; revision=368350
* ossl: split out x86 bits to x86/ossl_cpuid.cMitchell Horne2020-12-043-80/+120
| | | | | | | | | | | | Make room for adding arm64 support to this driver by moving the x86-specific feature parsing to a separate file. Reviewed by: jhb Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D27388 Notes: svn path=/head/; revision=368349
* Check cipher key lengths during probesession.John Baldwin2020-11-051-41/+39
| | | | | | | | | | | | | | | OCF drivers in general should perform as many session parameter checks as possible during probesession rather than when creating a new session. I got this wrong for aesni(4) in r359374. In addition, aesni(4) was performing the check for digest-only requests and failing to create digest-only sessions as a result. Reported by: jkim Tested by: jkim Sponsored by: Chelsio Communications Notes: svn path=/head/; revision=367406
* Replace some K&R function definitions with ANSI C.John Baldwin2020-11-031-10/+4
| | | | | | | | | Reviewed by: markj Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D27062 Notes: svn path=/head/; revision=367310
* Consistently use C99 fixed-width types in the in-kernel crypto code.John Baldwin2020-11-038-90/+90
| | | | | | | | | Reviewed by: markj Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D27061 Notes: svn path=/head/; revision=367309
* Add a new CCP device ID found on my Ryzen 5 3600XT.Jung-uk Kim2020-10-221-0/+1
| | | | | | | MFC after: 1 week Notes: svn path=/head/; revision=366943
* [armv8crypto] Fix cryptodev probe logic in armv8cryptoOleksandr Tymoshenko2020-10-221-0/+1
| | | | | | | | | | | Add missing break to prevent falling through to the default case statement and returning EINVAL for all session configs. Sponsored by: Ampere Computing Submitted by: Klara, Inc. Notes: svn path=/head/; revision=366923
* Add a kernel crypto driver using assembly routines from OpenSSL.John Baldwin2020-10-207-0/+1090
| | | | | | | | | | | | | | | | | | Currently, this supports SHA1 and SHA2-{224,256,384,512} both as plain hashes and in HMAC mode on both amd64 and i386. It uses the SHA intrinsics when present similar to aesni(4), but uses SSE/AVX instructions when they are not. Note that some files from OpenSSL that normally wrap the assembly routines have been adapted to export methods usable by 'struct auth_xform' as is used by existing software crypto routines. Reviewed by: gallatin, jkim, delphij, gnn Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D26821 Notes: svn path=/head/; revision=366901
* Move generated OpenSSL assembly routines into the kernel sources.John Baldwin2020-10-2081-0/+204613
| | | | | | | Sponsored by: Netflix Notes: svn path=/head/; revision=366898
* Add support for ESN in AES-NI crypto driverMarcin Wojtas2020-10-161-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for IPsec ESN (Extended Sequence Numbers) in encrypt and authenticate mode (eg. AES-CBC and SHA256) and combined mode (eg. AES-GCM). For the encrypt and authenticate mode the ESN is stored in separate crp_esn buffer because the high-order 32 bits of the sequence number are appended after the Next Header (RFC 4303). For the combined modes the high-order 32 bits of the sequence number [e.g. RFC 4106, Chapter 5 AAD Construction] are part of crp_aad (prepared by netipsec layer in case of ESN support enabled), therefore non visible diff around combined modes. Submitted by: Grzegorz Jaszczyk <jaz@semihalf.com> Patryk Duda <pdk@semihalf.com> Reviewed by: jhb Differential revision: https://reviews.freebsd.org/D22365 Obtained from: Semihalf Sponsored by: Stormshield Notes: svn path=/head/; revision=366754
* [skein] Fix compile issue with unknown symbol SKEIN_ASM_UNROLL1024Adrian Chadd2020-10-141-22/+22
| | | | | | | | | | | | | | | | | | | Weirdly, I needed to sprinkle more parens here to get gcc-as in 6.4 to correctly generate things. Without them, I'd get an unknown variable reference to SKEIN_ASM_UNROLL1024. This at least links now, but I haven't run any test cases against it. It may be worthwhile doing it in case gcc-as demands we liberally sprinkle more brackets around variables in .if statements. Thanks to ed for the suggestion of just sprinkling more brackets to see if that helped. Reviewed by: emaste Notes: svn path=/head/; revision=366709
* [skein] Fix compilation on gnu assembler with gcc-6 and gcc-9Adrian Chadd2020-10-141-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For some reason I don't want to really understand, the following happens with gnu as. /home/adrian/git/freebsd/src/sys/crypto/skein/amd64/skein_block_asm.S: Assembler messages: /home/adrian/git/freebsd/src/sys/crypto/skein/amd64/skein_block_asm.S:466: Error: found '(', expected: ')' /home/adrian/git/freebsd/src/sys/crypto/skein/amd64/skein_block_asm.S:466: Error: junk at end of line, first unrecognized character is `(' /home/adrian/git/freebsd/src/sys/crypto/skein/amd64/skein_block_asm.S:795: Error: found '(', expected: ')' /home/adrian/git/freebsd/src/sys/crypto/skein/amd64/skein_block_asm.S:795: Error: junk at end of line, first unrecognized character is `(' /home/adrian/git/freebsd/src/sys/crypto/skein/amd64/skein_block_asm.S:885: Error: non-constant expression in ".if" statement /home/adrian/git/freebsd/src/sys/crypto/skein/amd64/skein_block_asm.S:885: Error: non-constant expression in ".if" statement /home/adrian/git/freebsd/src/sys/crypto/skein/amd64/skein_block_asm.S:885: Error: non-constant expression in ".if" statement /home/adrian/git/freebsd/src/sys/crypto/skein/amd64/skein_block_asm.S:885: Error: non-constant expression in ".if" statement /home/adrian/git/freebsd/src/sys/crypto/skein/amd64/skein_block_asm.S:885: Error: non-constant expression in ".if" statement /home/adrian/git/freebsd/src/sys/crypto/skein/amd64/skein_block_asm.S:885: Error: non-constant expression in ".if" statement After an exhaustive search and experimentation at 11pm, I discovered that putting them in parentheses fixes the compilation. Ed pointed out that I could likely fix this in a bunch of other locations but I'd rather leave these alone until other options are enabled. Tested: * gcc-6, amd64 Reviewed by: emaste Notes: svn path=/head/; revision=366703
* Add a <machine/fpu.h> for i386 that includes <machine/npx.h>.John Baldwin2020-10-134-16/+0
| | | | | | | | | | | | arm64 has a similar wrapper. This permits defining <machine/fpu.h> as the standard header for fpu_kern_*. Reviewed by: kib Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D26753 Notes: svn path=/head/; revision=366672
* libmd: fix assembly optimized skein implementationEd Maste2020-10-011-9/+9
| | | | | | | | | | | | | The assembly implementation incorrectly used logical AND instead of bitwise AND. Fix, and re-enable in libmd. Submitted by: Yang Zhong <yzhong@freebsdfoundation.org> Reviewed by: cem (earlier) Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D26614 Notes: svn path=/head/; revision=366344
* Don't return errors from the cryptodev_process() method.John Baldwin2020-09-081-1/+1
| | | | | | | | | | | | | | | | | | | | The cryptodev_process() method should either return 0 if it has completed a request, or ERESTART to defer the request until later. If a request encounters an error, the error should be reported via crp_etype before completing the request via crypto_done(). Fix a few more drivers noticed by asomers@ similar to the fix in r365389. This is an old bug, but went unnoticed since crypto requests did not start failing as a normal part of operation until digest verification was introduced which can fail requests with EBADMSG. PR: 247986 Reported by: asomers Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D26361 Notes: svn path=/head/; revision=365478
* padlock(4): fix instapanics with geli authenticationAlan Somers2020-09-061-1/+1
| | | | | | | | | | | cryptodev_process implementations are supposed to return 0 PR: 247986 Submitted by: jhb MFC after: 1 week Notes: svn path=/head/; revision=365389
* crypto(9): add CRYPTO_BUF_VMPAGEAlan Somers2020-08-261-0/+4
| | | | | | | | | | | | | | | crypto(9) functions can now be used on buffers composed of an array of vm_page_t structures, such as those stored in an unmapped struct bio. It requires the running to kernel to support the direct memory map, so not all architectures can use it. Reviewed by: markj, kib, jhb, mjg, mat, bcr (manpages) MFC after: 1 week Sponsored by: Axcient Differential Revision: https://reviews.freebsd.org/D25671 Notes: svn path=/head/; revision=364799
* padlock: fix Via Padlock with 192-bit keysAlan Somers2020-07-201-1/+1
| | | | | | | | | | | | It's been broken since a typo in r359374 Reviewed by: jhb MFC after: 2 weeks Sponsored by: Axcient Differential Revision: https://reviews.freebsd.org/D25710 Notes: svn path=/head/; revision=363368
* Add domain policy allocation for amd64 fpu_kern_ctxConrad Meyer2020-07-032-2/+12
| | | | | | | | | | | | | | | | | | Like other types of allocation, fpu_kern_ctx are frequently allocated per-cpu. Provide the API and sketch some example consumers. fpu_kern_alloc_ctx_domain() preferentially allocates memory from the provided domain, and falls back to other domains if that one is empty (DOMAINSET_PREF(domain) policy). Maybe it makes more sense to just shove one of these in the DPCPU area sooner or later -- left for future work. Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D22053 Notes: svn path=/head/; revision=362913
* Use zfree() instead of bzero() and free().John Baldwin2020-06-252-10/+5
| | | | | | | | | | | These bzero's should have been explicit_bzero's. Reviewed by: cem, delphij Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D25437 Notes: svn path=/head/; revision=362626
* Use zfree() instead of explicit_bzero() and free().John Baldwin2020-06-252-14/+7
| | | | | | | | | | | | | | | In addition to reducing lines of code, this also ensures that the full allocation is always zeroed avoiding possible bugs with incorrect lengths passed to explicit_bzero(). Suggested by: cem Reviewed by: cem, delphij Approved by: csprng (cem) Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D25435 Notes: svn path=/head/; revision=362624
* Add support for requests with separate AAD to aesni(4).John Baldwin2020-06-221-7/+19
| | | | | | | | Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D25289 Notes: svn path=/head/; revision=362518
* Fix AES-CCM requests with an AAD size smaller than a single block.John Baldwin2020-06-121-1/+1
| | | | | | | | | | | | | The amount to copy for the first block is the minimum of the size of the AAD region or the remaining space in the first block. Reported by: cryptocheck -z MFC after: 2 weeks Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D25140 Notes: svn path=/head/; revision=362123
* Adjust crypto_apply function callbacks for OCF.John Baldwin2020-06-105-28/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | - crypto_apply() is only used for reading a buffer to compute a digest, so change the data pointer to a const pointer. - To better match m_apply(), change the data pointer type to void * and the length from uint16_t to u_int. The length field in particular matters as none of the apply logic was splitting requests larger than UINT16_MAX. - Adjust the auth_xform Update callback to match the function prototype passed to crypto_apply() and crypto_apply_buf(). This removes the needs for casts when using the Update callback. - Change the Reinit and Setkey callbacks to also use a u_int length instead of uint16_t. - Update auth transforms for the changes. While here, use C99 initializers for auth_hash structures and avoid casts on callbacks. Reviewed by: cem Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D25171 Notes: svn path=/head/; revision=362028
* Add a crypto capability flag for accelerated software drivers.John Baldwin2020-06-094-4/+7
| | | | | | | | | | | | | | | | | | Use this in GELI to print out a different message when accelerated software such as AESNI is used vs plain software crypto. While here, simplify the logic in GELI a bit for determing which type of crypto driver was chosen the first time by examining the capabilities of the matched driver after a single call to crypto_newsession rather than making separate calls with different flags. Reviewed by: delphij Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D25126 Notes: svn path=/head/; revision=361991
* Mark padlock(4) and cryptocteon(4) as software drivers.John Baldwin2020-06-091-1/+1
| | | | | | | | | | | Both already return the accelerated software priority from cryptodev_probesession. Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D25125 Notes: svn path=/head/; revision=361990
* Rename skein_block_asm.s to .S and assemble using Clang IASEd Maste2020-06-061-0/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Comparing the object files produced by GNU as 2.17.50 and Clang IAS shows many immaterial changes in strtab etc., and one material change in .text: 1bac: 4c 8b 4f 18 mov 0x18(%rdi),%r9 1bb0: eb 0e jmp 1bc0 <Skein1024_block_loop> - 1bb2: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1) - 1bb9: 00 00 00 00 - 1bbd: 0f 1f 00 nopl (%rax) + 1bb2: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1) + 1bb9: 00 00 00 + 1bbc: 0f 1f 40 00 nopl 0x0(%rax) 0000000000001bc0 <Skein1024_block_loop>: Skein1024_block_loop(): 1bc0: 4c 8b 47 10 mov 0x10(%rdi),%r8 1bc4: 4c 03 85 c0 00 00 00 add 0xc0(%rbp),%r8 That is, GNU as and Clang's integrated assembler use different multi- byte NOPs for alignment (GNU as emits an 11 byte NOP + a 3 byte NOP, while Clang IAS emits a 10 byte NOP + a 4 byte NOP). Dependency cleanup hacks are not required, because we do not create .depend files from GNU as. Reviewed by: allanjude, arichardson, cem, tsoome Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D8434 Notes: svn path=/head/; revision=361853
* skein_block_asm.S: use #ifdef not .ifdef, for Clang IASEd Maste2020-06-051-6/+7
| | | | | | | | | | | | | | | | | | | | | | | | | Clang IAS does not support the --defsym argument, and .ifndef SKEIN_USE_ASM gets turned into .ifndef 1792 by the preprocessor, which results in error: expected identifier after '.ifdef' .ifndef 1792 ^ Use #ifdef instead, which still works with GNU as. Reviewed by: cem Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D25154 Notes: svn path=/head/; revision=361843
* Allow assembling skein_block_asm.s with clangAlex Richardson2020-06-051-59/+60
| | | | | | | | | | | | | | | GNU as seems to allow macro arguments without the '\' but clang is more strict in that regard. This change makes the source code compatible with LLVM's but does not yet change the build system or rename it to .S. The new code assembles identically with GNU as 2.17.50. Reviewed By: emaste Differential Revision: https://reviews.freebsd.org/D25143 Notes: svn path=/head/; revision=361833
* Explicitly zero on-stack IVs, tags, and HMAC keys.John Baldwin2020-06-031-2/+9
| | | | | | | | | Reviewed by: delphij Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D25057 Notes: svn path=/head/; revision=361774
* Change return types of hash update functions in SHA-NIMarcin Wojtas2020-05-282-19/+16
| | | | | | | | | | | | | | | | | | | | | | | r359374 introduced crypto_apply function which takes as argument a function pointer that is expected to return an int, however aesni hash update functions return void. Because of that the function pointer passed was simply cast with its return value changed. This resulted in undefined behavior, in particular when mbuf is used, (ipsec) m_apply checks return value of function pointer passed to it and in our case bogusly fails after calculating hash of the first mbuf in chain. Fix it by changing signatures of sha update routines in aesni and dropping the casts. Submitted by: Kornel Duleba Reviewed by: jhb, cem Obtained from: Semihalf Sponsored by: Stormshield Differential Revision: https://reviews.freebsd.org/D25030 Notes: svn path=/head/; revision=361583
* Support separate output buffers for aesni(4).John Baldwin2020-05-251-24/+73
| | | | | | | | | | | | | | | | | The backend routines aesni(4) call for specific encryption modes all expect virtually contiguous input/output buffers. If the existing output buffer is virtually contiguous, always write to the output buffer directly from the mode-specific routines. If the output buffer is not contiguous, then a temporary buffer is allocated whose output is then copied to the output buffer. If the input buffer is not contiguous, then the existing buffer used to hold the input is also used to hold temporary output. Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D24545 Notes: svn path=/head/; revision=361485
* Add support for optional separate output buffers to in-kernel crypto.John Baldwin2020-05-251-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some crypto consumers such as GELI and KTLS for file-backed sendfile need to store their output in a separate buffer from the input. Currently these consumers copy the contents of the input buffer into the output buffer and queue an in-place crypto operation on the output buffer. Using a separate output buffer avoids this copy. - Create a new 'struct crypto_buffer' describing a crypto buffer containing a type and type-specific fields. crp_ilen is gone, instead buffers that use a flat kernel buffer have a cb_buf_len field for their length. The length of other buffer types is inferred from the backing store (e.g. uio_resid for a uio). Requests now have two such structures: crp_buf for the input buffer, and crp_obuf for the output buffer. - Consumers now use helper functions (crypto_use_*, e.g. crypto_use_mbuf()) to configure the input buffer. If an output buffer is not configured, the request still modifies the input buffer in-place. A consumer uses a second set of helper functions (crypto_use_output_*) to configure an output buffer. - Consumers must request support for separate output buffers when creating a crypto session via the CSP_F_SEPARATE_OUTPUT flag and are only permitted to queue a request with a separate output buffer on sessions with this flag set. Existing drivers already reject sessions with unknown flags, so this permits drivers to be modified to support this extension without requiring all drivers to change. - Several data-related functions now have matching versions that operate on an explicit buffer (e.g. crypto_apply_buf, crypto_contiguous_subsegment_buf, bus_dma_load_crp_buf). - Most of the existing data-related functions operate on the input buffer. However crypto_copyback always writes to the output buffer if a request uses a separate output buffer. - For the regions in input/output buffers, the following conventions are followed: - AAD and IV are always present in input only and their fields are offsets into the input buffer. - payload is always present in both buffers. If a request uses a separate output buffer, it must set a new crp_payload_start_output field to the offset of the payload in the output buffer. - digest is in the input buffer for verify operations, and in the output buffer for compute operations. crp_digest_start is relative to the appropriate buffer. - Add a crypto buffer cursor abstraction. This is a more general form of some bits in the cryptosoft driver that tried to always use uio's. However, compared to the original code, this avoids rewalking the uio iovec array for requests with multiple vectors. It also avoids allocate an iovec array for mbufs and populating it by instead walking the mbuf chain directly. - Update the cryptosoft(4) driver to support separate output buffers making use of the cursor abstraction. Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D24545 Notes: svn path=/head/; revision=361481
* Remove a workaround for GCM requests with an empty payload.John Baldwin2020-05-221-66/+0
| | | | | | | | | | | This was copied from ccr(4) (which does require the workaround), but is reportedly not needed for ccp(4). Discussed with: cem Sponsored by: Netflix Notes: svn path=/head/; revision=361404
* Improve support for stream ciphers in the software encryption interface.John Baldwin2020-05-221-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a 'native_blocksize' member to 'struct enc_xform' that ciphers can use if they support a partial final block. This is particular useful for stream ciphers, but can also apply to other ciphers. cryptosoft will only pass in native blocks to the encrypt and decrypt hooks. For the final partial block, 'struct enc_xform' now has new encrypt_last/decrypt_last hooks which accept the length of the final block. The multi_block methods are also retired. Mark AES-ICM (AES-CTR) as a stream cipher. This has some interesting effects on IPsec in that FreeBSD can now properly receive all packets sent by Linux when using AES-CTR, but FreeBSD can no longer interoperate with OpenBSD and older verisons of FreeBSD which assume AES-CTR packets have a payload padded to a 16-byte boundary. Kornel has offered to work on a patch to add a compatiblity sysctl to enforce additional padding for AES-CTR in esp_output to permit compatibility with OpenBSD and older versions of FreeBSD. AES-XTS continues to use a block size of a single AES block length. It is possible to adjust it to support partial final blocks by implementing cipher text stealing via encrypt_last/decrypt_last hooks, but I have not done so. Reviewed by: cem (earlier version) Tested by: Kornel Dulęba <mindal@semihalf.com> (AES-CTR with IPsec) Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D24906 Notes: svn path=/head/; revision=361390
* Various cleanups to the software encryption transform interface.John Baldwin2020-05-201-30/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Consistently use 'void *' for key schedules / key contexts instead of a mix of 'caddr_t', 'uint8_t *', and 'void *'. - Add a ctxsize member to enc_xform similar to what auth transforms use and require callers to malloc/zfree the context. The setkey callback now supplies the caller-allocated context pointer and the zerokey callback is removed. Callers now always use zfree() to ensure key contexts are zeroed. - Consistently use C99 initializers for all statically-initialized instances of 'struct enc_xform'. - Change the encrypt and decrypt functions to accept separate in and out buffer pointers. Almost all of the backend crypto functions already supported separate input and output buffers and this makes it simpler to support separate buffers in OCF. - Remove xform_userland.h shim to permit transforms to be compiled in userland. Transforms no longer call malloc/free directly. Reviewed by: cem (earlier version) Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D24855 Notes: svn path=/head/; revision=361298
* Remove MD5 HMAC from OCF.John Baldwin2020-05-111-3/+0
| | | | | | | | | | | | There are no in-kernel consumers. Reviewed by: cem Relnotes: yes Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D24775 Notes: svn path=/head/; revision=360936
* Remove support for the Blowfish algorithm from OCF.John Baldwin2020-05-119-2528/+0
| | | | | | | | | | | | It no longer has any in-kernel consumers. Reviewed by: cem Relnotes: yes Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D24772 Notes: svn path=/head/; revision=360931
* ccp: add a new hardware ID, found on AMD Ryzen 3 3200UAndriy Gapon2020-04-241-0/+1
| | | | | | | | | | | | | | pciconf reports the device as: Family 17h (Models 10h-1fh) Platform Security Processor dmesg: ccp0: <AMD CCP-5a> mem 0xfe500000-0xfe5fffff,0xfe68c000-0xfe68dfff at device 0.2 on pci4 crypto: assign ccp0 driver id 1, flags 0x1000000 MFC after: 1 week Notes: svn path=/head/; revision=360248
* Retire the CRYPTO_F_IV_GENERATE flag.John Baldwin2020-04-204-30/+4
| | | | | | | | | | | | | | The sole in-tree user of this flag has been retired, so remove this complexity from all drivers. While here, add a helper routine drivers can use to read the current request's IV into a local buffer. Use this routine to replace duplicated code in nearly all drivers. Reviewed by: cem Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D24450 Notes: svn path=/head/; revision=360136
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-23 18:05:31 +0000