aboutsummaryrefslogtreecommitdiff
path: root/tools/tools
Commit message (Collapse)AuthorAgeFilesLines
* gc pmtimer and apmWarner Losh2020-08-316-30/+0
| | | | | | | | | pmtimer was removed from base some time ago. apm hasn't been relevant for these devices in a long time (and was commented out). Remove them both from these config files. Notes: svn path=/head/; revision=365006
* - Update to Unicode CLDR v35 (Unicode 12.0).Hiroki Sato2020-08-158-112/+819
| | | | | | | | | | | | | | | | | | | | | | | | | | | - Update tools/tools/locale to add make targets to automatically generate locale source files. With this change, just typing "make obj && make -j4" will rebuild them. Check README for more details. - Fix issues in ja_JP ctypedef and range specification support in utf8-rollup.pl. - Add a temporary patch for UnicodeData.txt to fix code ranges of CJK Ideograph Extension A and Extension B. - tools/cldr2def.pl: Use eucJP for ja_JP ctypedef because eucJP is not compatible with UTF-8. - tools/convert_map.pl: Add a verbose error message. - tools/utf8-rollup.pl: Normalize entries to use Unicode, not UTF-8. Reviewed by: bapt Differential Revision: https://reviews.freebsd.org/D25503 Notes: svn path=/head/; revision=364245
* add script to help figure out what man pages need MLINKS updated...John-Mark Gurney2020-07-163-0/+59
| | | | Notes: svn path=/head/; revision=363265
* Move font related data structured to sys/font.c and update vtfontcvtToomas Soome2020-06-141-34/+20
| | | | | | | | | | | | | | | Prepare support to be able to handle font data in loader, consolidate data structures to sys/font.h and update vtfontcvt. vtfontcvt update is about to output set of glyphs in form of C source, the implementation does allow to output compressed or uncompressed font bitmaps. Reviewed by: bcr Differential Revision: https://reviews.freebsd.org/D24189 Notes: svn path=/head/; revision=362172
* [wlanstats] Add the per-node amsdu hardware decap'ed receive stats.Adrian Chadd2020-06-122-2/+10
| | | | | | | | | | | | | This is useful for tracking hardware provided AMSDU frames to see when we're (a) seeing them, and (b) seeing the split between intermediary and final frames. Tested: * QCA9880 (athp) - AP mode Notes: svn path=/head/; revision=362085
* Expand coverage of different buffer sizes.John Baldwin2020-05-251-79/+156
| | | | | | | | | | | | | | | | | | | | | | | | | | - When -z is used, include small buffers from 1 to 32 bytes to test stream ciphers. Note that while AES-XTS claims to support a block size of 1 in OpenSSL, it does require a minimum of 1 block of cipher text as it is not a stream cipher but depends on CTS to pad out the final partial block. - Permit multiple AAD sizes to be set via multiple -A options, or via -z. When -z is set, use small buffers from 0 to 32 bytes followed by powers of 2 up to 256. When multiple sizes are specified, the ETA and AEAD algorithms perform the full matrix of AAD sizes by payload sizes. - Only warn on unchanged ciphertext instead of erroring. The currently generated plaintext and key for a couple of AES-CTR tests with a buffer size of 1 results in ciphertext that matches the plaintext. Reviewed by: cem Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D25006 Notes: svn path=/head/; revision=361487
* [ath] Flip athratestats to use two columns for now.Adrian Chadd2020-05-161-1/+11
| | | | | | | Yeah I have too many rates on the screen now... Notes: svn path=/head/; revision=361115
* [ath] ok ok, fix the indenting now that I have 5 column packet sizes.Adrian Chadd2020-05-161-2/+2
| | | | | | | | Now things line up nicely again. There's a lot of them, and I don't have a long enough screen right now, but they at least line up right. Notes: svn path=/head/; revision=361107
* Remove the ubsecstats tool since ubsec(4) has been removed.John Baldwin2020-05-152-76/+1
| | | | | | | Reported by: markj Notes: svn path=/head/; revision=361091
* [ath] Extend the colours to 4, not 2.Adrian Chadd2020-05-141-10/+9
| | | | | | | | There's 8 bins in the upcoming changeset to ath/ath_rate, so I need more colours. Yeah, I know. Notes: svn path=/head/; revision=361025
* [ath] Prepare for .. more sample rate control entriesAdrian Chadd2020-05-131-7/+5
| | | | | | | | | | | | | This is in preparation for me bumping how many size buckets are used for ath_rate_sample statistics. * Bump buffer size to 64k * Don't waste 4 lines per bucket size, condense it to two * Alternate colours; my logic made everything after the first two just be black. Oops. Notes: svn path=/head/; revision=361009
* [ar9300] Fix up this tool after test compiling it with LLVM. Le oops.Adrian Chadd2020-05-121-7/+7
| | | | Notes: svn path=/head/; revision=360951
* [ar9300] Update the ar9300 eeprom dump utility to include target power and CTL.Adrian Chadd2020-05-121-0/+278
| | | | | | | | | | This lets me easily see what the EEPROM target power and regulatory compliance table limits are. (Yeah, should've done this in 2013..) Notes: svn path=/head/; revision=360950
* Refactor driver and consumer interfaces for OCF (in-kernel crypto).John Baldwin2020-03-271-32/+164
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - The linked list of cryptoini structures used in session initialization is replaced with a new flat structure: struct crypto_session_params. This session includes a new mode to define how the other fields should be interpreted. Available modes include: - COMPRESS (for compression/decompression) - CIPHER (for simply encryption/decryption) - DIGEST (computing and verifying digests) - AEAD (combined auth and encryption such as AES-GCM and AES-CCM) - ETA (combined auth and encryption using encrypt-then-authenticate) Additional modes could be added in the future (e.g. if we wanted to support TLS MtE for AES-CBC in the kernel we could add a new mode for that. TLS modes might also affect how AAD is interpreted, etc.) The flat structure also includes the key lengths and algorithms as before. However, code doesn't have to walk the linked list and switch on the algorithm to determine which key is the auth key vs encryption key. The 'csp_auth_*' fields are always used for auth keys and settings and 'csp_cipher_*' for cipher. (Compression algorithms are stored in csp_cipher_alg.) - Drivers no longer register a list of supported algorithms. This doesn't quite work when you factor in modes (e.g. a driver might support both AES-CBC and SHA2-256-HMAC separately but not combined for ETA). Instead, a new 'crypto_probesession' method has been added to the kobj interface for symmteric crypto drivers. This method returns a negative value on success (similar to how device_probe works) and the crypto framework uses this value to pick the "best" driver. There are three constants for hardware (e.g. ccr), accelerated software (e.g. aesni), and plain software (cryptosoft) that give preference in that order. One effect of this is that if you request only hardware when creating a new session, you will no longer get a session using accelerated software. Another effect is that the default setting to disallow software crypto via /dev/crypto now disables accelerated software. Once a driver is chosen, 'crypto_newsession' is invoked as before. - Crypto operations are now solely described by the flat 'cryptop' structure. The linked list of descriptors has been removed. A separate enum has been added to describe the type of data buffer in use instead of using CRYPTO_F_* flags to make it easier to add more types in the future if needed (e.g. wired userspace buffers for zero-copy). It will also make it easier to re-introduce separate input and output buffers (in-kernel TLS would benefit from this). Try to make the flags related to IV handling less insane: - CRYPTO_F_IV_SEPARATE means that the IV is stored in the 'crp_iv' member of the operation structure. If this flag is not set, the IV is stored in the data buffer at the 'crp_iv_start' offset. - CRYPTO_F_IV_GENERATE means that a random IV should be generated and stored into the data buffer. This cannot be used with CRYPTO_F_IV_SEPARATE. If a consumer wants to deal with explicit vs implicit IVs, etc. it can always generate the IV however it needs and store partial IVs in the buffer and the full IV/nonce in crp_iv and set CRYPTO_F_IV_SEPARATE. The layout of the buffer is now described via fields in cryptop. crp_aad_start and crp_aad_length define the boundaries of any AAD. Previously with GCM and CCM you defined an auth crd with this range, but for ETA your auth crd had to span both the AAD and plaintext (and they had to be adjacent). crp_payload_start and crp_payload_length define the boundaries of the plaintext/ciphertext. Modes that only do a single operation (COMPRESS, CIPHER, DIGEST) should only use this region and leave the AAD region empty. If a digest is present (or should be generated), it's starting location is marked by crp_digest_start. Instead of using the CRD_F_ENCRYPT flag to determine the direction of the operation, cryptop now includes an 'op' field defining the operation to perform. For digests I've added a new VERIFY digest mode which assumes a digest is present in the input and fails the request with EBADMSG if it doesn't match the internally-computed digest. GCM and CCM already assumed this, and the new AEAD mode requires this for decryption. The new ETA mode now also requires this for decryption, so IPsec and GELI no longer do their own authentication verification. Simple DIGEST operations can also do this, though there are no in-tree consumers. To eventually support some refcounting to close races, the session cookie is now passed to crypto_getop() and clients should no longer set crp_sesssion directly. - Assymteric crypto operation structures should be allocated via crypto_getkreq() and freed via crypto_freekreq(). This permits the crypto layer to track open asym requests and close races with a driver trying to unregister while asym requests are in flight. - crypto_copyback, crypto_copydata, crypto_apply, and crypto_contiguous_subsegment now accept the 'crp' object as the first parameter instead of individual members. This makes it easier to deal with different buffer types in the future as well as separate input and output buffers. It's also simpler for driver writers to use. - bus_dmamap_load_crp() loads a DMA mapping for a crypto buffer. This understands the various types of buffers so that drivers that use DMA do not have to be aware of different buffer types. - Helper routines now exist to build an auth context for HMAC IPAD and OPAD. This reduces some duplicated work among drivers. - Key buffers are now treated as const throughout the framework and in device drivers. However, session key buffers provided when a session is created are expected to remain alive for the duration of the session. - GCM and CCM sessions now only specify a cipher algorithm and a cipher key. The redundant auth information is not needed or used. - For cryptosoft, split up the code a bit such that the 'process' callback now invokes a function pointer in the session. This function pointer is set based on the mode (in effect) though it simplifies a few edge cases that would otherwise be in the switch in 'process'. It does split up GCM vs CCM which I think is more readable even if there is some duplication. - I changed /dev/crypto to support GMAC requests using CRYPTO_AES_NIST_GMAC as an auth algorithm and updated cryptocheck to work with it. - Combined cipher and auth sessions via /dev/crypto now always use ETA mode. The COP_F_CIPHER_FIRST flag is now a no-op that is ignored. This was actually documented as being true in crypto(4) before, but the code had not implemented this before I added the CIPHER_FIRST flag. - I have not yet updated /dev/crypto to be aware of explicit modes for sessions. I will probably do that at some point in the future as well as teach it about IV/nonce and tag lengths for AEAD so we can support all of the NIST KAT tests for GCM and CCM. - I've split up the exising crypto.9 manpage into several pages of which many are written from scratch. - I have converted all drivers and consumers in the tree and verified that they compile, but I have not tested all of them. I have tested the following drivers: - cryptosoft - aesni (AES only) - blake2 - ccr and the following consumers: - cryptodev - IPsec - ktls_ocf - GELI (lightly) I have not tested the following: - ccp - aesni with sha - hifn - kgssapi_krb5 - ubsec - padlock - safe - armv8_crypto (aarch64) - glxsb (i386) - sec (ppc) - cesa (armv7) - cryptocteon (mips64) - nlmsec (mips64) Discussed with: cem Relnotes: yes Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D23677 Notes: svn path=/head/; revision=359374
* Add extremely useful calendar(1) application to FreeBSDConrad Meyer2020-03-032-0/+2
| | | | | | | | | | | | It does extremely useful things like execute sendmail and spew dubiously accurate factoids. From the feedback, it seems like it is an essential utility in a modern unix and not at all a useless bikeshed. How do those Linux people live without it? Reverts r358561. Notes: svn path=/head/; revision=358562
* Fix typo in r278616Conrad Meyer2020-03-022-2/+0
| | | | | | | FreeBSD isn't an encyclopedia. Notes: svn path=/head/; revision=358561
* Move ELF feature note tool to usr.bin/elfctlEd Maste2020-03-023-500/+0
| | | | | | | | | | | | | | | elfctl is a tool for modifying the NT_FREEBSD_FEATURE_CTL ELF note, which contains a set of flags for enabling or disabling vulnerability mitigations and other features. Reviewed by: csjp, kib MFC after: 2 weeks Relnotes: Yes Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D23910 Notes: svn path=/head/; revision=358512
* controlelf: fix indentation for larger flagsEd Maste2020-03-011-2/+2
| | | | | | | Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=358498
* remove GCC 4.2.1 build infrastructureEd Maste2020-02-292-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | As described in Warner's email message[1] to the FreeBSD-arch mailing list we have reached GCC 4.2.1's retirement date. At this time all supported architectures either use in-tree Clang, or rely on external toolchain (i.e., a contemporary GCC version from ports). GCC 4.2.1 was released July 18, 2007 and was imported into FreeBSD later that year, in r171825. GCC has served us well, but version 4.2.1 is obsolete and not used by default on any architecture in FreeBSD. It does not support modern C and does not support arm64 or RISC-V. Thanks to everyone responsible for maintaining, updating, and testing GCC in the FreeBSD base system over the years. So long, and thanks for all the fish. [1] https://lists.freebsd.org/pipermail/freebsd-arch/2020-January/019823.html PR: 228919 Reviewed by: brooks, imp Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D23124 Notes: svn path=/head/; revision=358454
* nanobsd: add WITHOUT_LLVM_COV, akin to WITHOUT_GCOVEd Maste2020-02-191-0/+1
| | | | | | | Another case, missed in r358105 Notes: svn path=/head/; revision=358123
* nanobsd: add WITHOUT_LLVM_COV, akin to WITHOUT_GCOVEd Maste2020-02-191-0/+1
| | | | Notes: svn path=/head/; revision=358105
* Various cleanups to cryptocheck.John Baldwin2020-01-071-450/+344
| | | | | | | | | | | | | | | | | | | | | - Rename 'blkcipher' to 'cipher'. Some of the ciphers being tested are stream ciphers. - Rename 'authenc' to 'eta' as it is only testing ETA chained operations and not other combination modes. - Add a notion of an OCF session and some helper routines to try to reduce duplicated code. This also uses a single session for both encrypt and decrypt operations during a single test. - Add tests to ensure that AEAD algorithms fail decryption with EBADMSG when given a corrupted tag. - Remove the transitional hack for COP_F_CIPHER_FIRST. - Update block comment to mention plain hashes. Reviewed by: cem Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D22940 Notes: svn path=/head/; revision=356457
* Regularize my copyright noticeWarner Losh2019-12-0422-24/+24
| | | | | | | | | | | | o Remove All Rights Reserved from my notices o imp@FreeBSD.org everywhere o regularize punctiation, eliminate date ranges o Make sure that it's clear that I don't claim All Rights reserved by listing All Rights Reserved on same line as other copyright holders (but not me). Other such holders are also listed last where it's clear. Notes: svn path=/head/; revision=355394
* Update controlelf(1) to ahndle stack gap disable flag.Konstantin Belousov2019-11-171-1/+3
| | | | | | | | | | Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D22379 Notes: svn path=/head/; revision=354791
* If /usr/obj is a symlink, cpio(1) needs persuation to DTRT.Poul-Henning Kamp2019-11-021-4/+7
| | | | Notes: svn path=/head/; revision=354251
* Mention that ports/net-mgmt/libsmi is requiredPoul-Henning Kamp2019-11-021-0/+2
| | | | Notes: svn path=/head/; revision=354250
* add valectl to the system commandsVincenzo Maffione2019-10-315-453/+3
| | | | | | | | | | | | | | The valectl(4) program is used to manage vale(4) switches. Add it to the system commands so that it can be used right away. This program was previously called vale-ctl, and stored in tools/tools/netmap Reviewed by: hrs, bcr, lwhsu, kevans MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D22146 Notes: svn path=/head/; revision=354229
* tools/tools/locale: allow POSIX target to be built in parallelYuri Pankov2019-10-211-21/+17
| | | | | | | | While it's rarely used target, more so a one not used during the buildworld, it helps when it's not taking hours (literally). Notes: svn path=/head/; revision=353791
* netmap: minor misc improvementsVincenzo Maffione2019-10-202-7/+8
| | | | | | | | | | | - use ring->head rather than ring->cur in lb(8) - use strlcat() rather than strncat() - fix bandwidth computation in pkt-gen(8) MFC after: 1 week Notes: svn path=/head/; revision=353775
* Add missing port to the list of needed tools in the README fileEugene Grosbein2019-10-141-0/+1
| | | | | | | | | describing locale rebuild process: devel/apache-ant Notes: svn path=/head/; revision=353491
* Mark "private use area" characters as printable.Yuri Pankov2019-10-051-1/+2
| | | | | | | | | | | | | | | | At least some of the characters in E000-F8FF range are used by Powerline fonts, and having no attributes for these ranges in UnicodeData.txt other than "Other, Private Use" it should be safe to mark all of them as printable. Some actually were before r340491, so this fixes the regression introduced there as well. PR: 240911 Reviewed by: bapt Tested by: Daniel Ponte <amigan@gmail.com> Differential Revision: https://reviews.freebsd.org/D21850 Notes: svn path=/head/; revision=353130
* Pre-generate Big5 charmap from CLDR data.Yuri Pankov2019-10-052-13708/+13968
| | | | | | | | | | | | | The one used previously was missing the characters in 0-127 range, making various tools try to escape them in output. PR: 235100 Reviewed by: bapt Tested by: Ting-Wei Lan <lantw44@gmail.com> Differential Revision: https://reviews.freebsd.org/D21794 Notes: svn path=/head/; revision=353127
* Use set -o xtrace in preference to set -x for consistency withWarner Losh2019-09-271-4/+4
| | | | | | | the rest of nanobsd.sh. Notes: svn path=/head/; revision=352822
* Push and pop xtrace correctly for run_early_customizeWarner Losh2019-09-271-1/+5
| | | | | | | | | | | | | run_early_customize is run as a shell list, not as a subshell, so that the side effects of setting variables can affect later stages of the build (for better or worse, it's been like this since it was introduced). It therefore has the side effect of turning off xtrace always, which limits the usefulness of sh -x nanobsd.sh. Remember the old setting and only turn off tracing after the command if tracing was off before. All the other places where we do similar things we use a subshell, so we don't need to do this. Notes: svn path=/head/; revision=352821
* Remove workaround for building on FreeBSD hosts prior to FreeBSD 10.Warner Losh2019-09-271-20/+10
| | | | | | | | | | | rm -x was introduced in the FreeBSD 10 time frame. 4 years ago I added a function to cope with building nanobsd images on hosts as old FreeBSD 7 that lacked rm -x. The workaround is no longer needed as FreeBSD 9 hasn't been supported for almost 3 years. Eliminate the wrapper and use rm -x directly again. Notes: svn path=/head/; revision=352820
* controlelf: update man pageEd Maste2019-09-271-13/+15
| | | | | | | Some minor corrections, clarifications or rewording. Notes: svn path=/head/; revision=352815
* controlelf: exit with error if file endianness does not match hostEd Maste2019-09-271-0/+16
| | | | | | | | We need to add support for cross-endian operation, but until that's done just exit with an error rather than misbehaving. Notes: svn path=/head/; revision=352809
* controlelf: simplify feature string parsingEd Maste2019-09-271-24/+21
| | | | | | | Also add error handling on failure to seek/write updated value. Notes: svn path=/head/; revision=352808
* controlelf: tidy up option parsingEd Maste2019-09-271-10/+8
| | | | | | | Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=352806
* controlelf: add protmax controlEd Maste2019-09-271-0/+1
| | | | | | | Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=352805
* controlelf: some style(9) cleanupEd Maste2019-09-271-17/+21
| | | | | | | Submitted by: clang-format Notes: svn path=/head/; revision=352803
* controlelf: install standard BSD 2 clause licenseEd Maste2019-09-271-14/+14
| | | | | | | | Reported by: kaktus Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=352801
* controlelf: clean up warningsEd Maste2019-09-271-9/+9
| | | | | | | | | | | - use explicit ELF note name when not found - no trailing . on warnings - no \n Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=352799
* Add tool to modify ELF binary feature control bitsEd Maste2019-09-273-0/+480
| | | | | | | | | | | | | | | This will allow feature control bits (e.g. for ASLR, PROT_MAX) to be inspected or modified. Some clean-up and additional work is likely still required, but we can iterate on this in the tree. Submitted by: Bora Özarslan <borako.ozarslan@gmail.com> Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D19290 Notes: svn path=/head/; revision=352797
* Insert proper copyright/license headersBaptiste Daroussin2019-09-135-0/+129
| | | | | | | | | | | | | | | Those scripts are without copyright and license assignement since their creation After grabbing information from The various authors and contributors assign proper license header and copyrights. This has been reported by yuripv in his work on integrating those in Illumos! Reported by: yuripv Discussed with: marino, edwin MFC after: 3 days Notes: svn path=/head/; revision=352274
* Remove obsolete WITHOUT names that are no longer in the system.Warner Losh2019-09-092-30/+0
| | | | | | | Noticed by: swills@ Notes: svn path=/head/; revision=352100
* These should have been removed when we removed atmel port before 12.Warner Losh2019-09-092-70/+0
| | | | Notes: svn path=/head/; revision=352099
* Add kernel-side support for in-kernel TLS.John Baldwin2019-08-272-0/+387
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | KTLS adds support for in-kernel framing and encryption of Transport Layer Security (1.0-1.2) data on TCP sockets. KTLS only supports offload of TLS for transmitted data. Key negotation must still be performed in userland. Once completed, transmit session keys for a connection are provided to the kernel via a new TCP_TXTLS_ENABLE socket option. All subsequent data transmitted on the socket is placed into TLS frames and encrypted using the supplied keys. Any data written to a KTLS-enabled socket via write(2), aio_write(2), or sendfile(2) is assumed to be application data and is encoded in TLS frames with an application data type. Individual records can be sent with a custom type (e.g. handshake messages) via sendmsg(2) with a new control message (TLS_SET_RECORD_TYPE) specifying the record type. At present, rekeying is not supported though the in-kernel framework should support rekeying. KTLS makes use of the recently added unmapped mbufs to store TLS frames in the socket buffer. Each TLS frame is described by a single ext_pgs mbuf. The ext_pgs structure contains the header of the TLS record (and trailer for encrypted records) as well as references to the associated TLS session. KTLS supports two primary methods of encrypting TLS frames: software TLS and ifnet TLS. Software TLS marks mbufs holding socket data as not ready via M_NOTREADY similar to sendfile(2) when TLS framing information is added to an unmapped mbuf in ktls_frame(). ktls_enqueue() is then called to schedule TLS frames for encryption. In the case of sendfile_iodone() calls ktls_enqueue() instead of pru_ready() leaving the mbufs marked M_NOTREADY until encryption is completed. For other writes (vn_sendfile when pages are available, write(2), etc.), the PRUS_NOTREADY is set when invoking pru_send() along with invoking ktls_enqueue(). A pool of worker threads (the "KTLS" kernel process) encrypts TLS frames queued via ktls_enqueue(). Each TLS frame is temporarily mapped using the direct map and passed to a software encryption backend to perform the actual encryption. (Note: The use of PHYS_TO_DMAP could be replaced with sf_bufs if someone wished to make this work on architectures without a direct map.) KTLS supports pluggable software encryption backends. Internally, Netflix uses proprietary pure-software backends. This commit includes a simple backend in a new ktls_ocf.ko module that uses the kernel's OpenCrypto framework to provide AES-GCM encryption of TLS frames. As a result, software TLS is now a bit of a misnomer as it can make use of hardware crypto accelerators. Once software encryption has finished, the TLS frame mbufs are marked ready via pru_ready(). At this point, the encrypted data appears as regular payload to the TCP stack stored in unmapped mbufs. ifnet TLS permits a NIC to offload the TLS encryption and TCP segmentation. In this mode, a new send tag type (IF_SND_TAG_TYPE_TLS) is allocated on the interface a socket is routed over and associated with a TLS session. TLS records for a TLS session using ifnet TLS are not marked M_NOTREADY but are passed down the stack unencrypted. The ip_output_send() and ip6_output_send() helper functions that apply send tags to outbound IP packets verify that the send tag of the TLS record matches the outbound interface. If so, the packet is tagged with the TLS send tag and sent to the interface. The NIC device driver must recognize packets with the TLS send tag and schedule them for TLS encryption and TCP segmentation. If the the outbound interface does not match the interface in the TLS send tag, the packet is dropped. In addition, a task is scheduled to refresh the TLS send tag for the TLS session. If a new TLS send tag cannot be allocated, the connection is dropped. If a new TLS send tag is allocated, however, subsequent packets will be tagged with the correct TLS send tag. (This latter case has been tested by configuring both ports of a Chelsio T6 in a lagg and failing over from one port to another. As the connections migrated to the new port, new TLS send tags were allocated for the new port and connections resumed without being dropped.) ifnet TLS can be enabled and disabled on supported network interfaces via new '[-]txtls[46]' options to ifconfig(8). ifnet TLS is supported across both vlan devices and lagg interfaces using failover, lacp with flowid enabled, or lacp with flowid enabled. Applications may request the current KTLS mode of a connection via a new TCP_TXTLS_MODE socket option. They can also use this socket option to toggle between software and ifnet TLS modes. In addition, a testing tool is available in tools/tools/switch_tls. This is modeled on tcpdrop and uses similar syntax. However, instead of dropping connections, -s is used to force KTLS connections to switch to software TLS and -i is used to switch to ifnet TLS. Various sysctls and counters are available under the kern.ipc.tls sysctl node. The kern.ipc.tls.enable node must be set to true to enable KTLS (it is off by default). The use of unmapped mbufs must also be enabled via kern.ipc.mb_use_ext_pgs to enable KTLS. KTLS is enabled via the KERN_TLS kernel option. This patch is the culmination of years of work by several folks including Scott Long and Randall Stewart for the original design and implementation; Drew Gallatin for several optimizations including the use of ext_pgs mbufs, the M_NOTREADY mechanism for TLS records awaiting software encryption, and pluggable software crypto backends; and John Baldwin for modifications to support hardware TLS offload. Reviewed by: gallatin, hselasky, rrs Obtained from: Netflix Sponsored by: Netflix, Chelsio Communications Differential Revision: https://reviews.freebsd.org/D21277 Notes: svn path=/head/; revision=351522
* tools/tools/crypto: cryptokeytest: Fix build with newer OpenSSLConrad Meyer2019-08-091-61/+47
| | | | | | | Also, drag into this decade. Notes: svn path=/head/; revision=350813
* Mount and unmount devfs around calls to add packages.Warner Losh2019-06-211-1/+3
| | | | | | | | | | | | | | | | | | | pkg now uses /dev/null for some of its operations. NanoBSD's packaging stuff didn't mount that for the chroot it ran in, so any config that added packages would see the error: pkg: Cannot open /dev/null:No such file or directory when trying to actually add those packages. It's easy enough for nanobsd to mount /dev and it won't hurt anything that was already working and may help things that weren't (like this). I moved the mount/unmount pair to be in the right push/pop order from the submitted patch. PR: 238727 Submitted by: mike tancsa Tested by: Karl Denninger Notes: svn path=/head/; revision=349261
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-18 22:14:50 +0000