Page MenuHomeFreeBSD
Differential D46938

pf: convert DIOCGETRULESET to netlink
ClosedPublic
Actions

Authored by kp on Oct 4 2024, 12:45 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Mar 22, 3:37 AM
Unknown Object (File)
Sun, Mar 9, 5:03 PM
Unknown Object (File)
Tue, Mar 4, 12:19 PM
Unknown Object (File)
Mon, Mar 3, 6:22 PM
Unknown Object (File)
Fri, Feb 28, 9:07 AM
Unknown Object (File)
Feb 20 2025, 7:36 AM
Unknown Object (File)
Feb 17 2025, 4:06 AM
Unknown Object (File)
Feb 16 2025, 3:34 PM
View All 38 Files
Subscribers
ae
farrokhi
glebius
imp
melifaro
vegeta_tuxpowered.net

Details

Reviewers
None
Group Reviewers
network
pfsense
Commits
rG48f5bf8be6fa: pf: convert DIOCGETRULESET to netlink
Summary

Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Revision Contents
Changeset List

PathSize
lib/
libpfctl/
1 line
36 lines
sbin/
pfctl/
18 lines
sys/
net/
1 line
netpfil/
pf/
72 lines
2 lines
42 lines

Diff 144588

View Options

lib/libpfctl/libpfctl.h

  • This file was added.
The goal of this branch is to simplify the data structures used to describe
session and crypto op parameters.
jhbAuthorUnsubmitted
Done
Inline Actions

I won't commit this file, but it lives in the branch and ended up in the review as a result.

jhb: I won't commit this file, but it lives in the branch and ended up in the review as a result.
- replace linked/list of cryptoini for session init with a structure
- explicit IV length?
- replace linked/list of cryptodesc with members in struct cryptop
- maybe require data to always be laid out as
AAD || IV (if not sideband) || DATA || TAG/MAC
(had to scrap this due to IPsec AH and permit arbitrary IV and
digest offsets)
- generate IV if needed in common code, not drivers
- add flag for hash verify rather than hash compute
- change copyto/copyback to operate on the crp instead of the fields
- permit separate in/out buffers?
- need to ensure crypto_getreq() zeroes the crp (it does)
- change for AEAD:
- previously with AES+HMAC crda covered all of data to auth, now
need to hash AAD region + payload. If IV needs to be hashed,
AAD should cover IV.
- Notes on IVs:
- CRYPTO_F_IV_GENERATE (encrypt only)
- generate full IV and copy to crp_iv_start before encryption
- CRYPTO_F_IV_SEPARATE (both, cannot use with GENERATE)
- IV is in crp_iv, crp_iv_start should be ignored
- neither flag
- full IV is in data stream at crp_iv_start
- AES-GCM now uses CIPHER_MODE_AEAD which ignores most of csp_auth_*
except for csp_auth_mlen
- Eventually retire 3 separate GMAC algs and repurpose NIST_GMAC as a single
MAC?
- Maybe retire driver HIDs with 'struct cryptocap' pointers instead? We
could just use a TAILQ instead of an array
- Separate session operation to rekey instead of implicit rekeying?
Implicit klen is not really great for auth, for example
- XXX: Need to think about how to define GMAC in the new world order. I
think it should be CSP_MODE_DIGEST, but with csp_cipher_ivlen set?
- Yes, GMAC is CSP_MODE_DIGEST with payload area describing data to hash.
It uses csp_ivlen.
- Maybe change crp_cipher_key to not change session key but only the
specific operation?
- Need to figure out what to do about accelerated software vs plain
software
- maybe need "priority" and a "session probe/test" instead of just
"newsession"
- Add a reference count on sessions
- crypto_getop would take a session pointer and set crp_session along
with bumping refcount now
- Kill the UIO usage in cryptodev.c, it's silly (done)
- GCM IV length is kind of busted, perhaps need IV length as part of crp
instead of csp?
- Testing
+ cryptocheck
+ soft
+ ccr
- ipsec
- auth
- hmac-md5
- hmac-sha1
- keyed-md5
- keyed-sha1
- null
- hmac-sha2-256
- hmac-sha2-384
- hmac-sha2-512
- hmac-ripemd160
- aes-xcbc-mac
- tcp-md5
- encrypt
- des-cbc
- 3desc-cbc
- null
- blowfish-cbc
- cast128-cbc
- des-deriv
- des-32iv
- rijndael-cbc
- aes-ctr
- aes-gcm16
- camellia-cbc
- 3des-hmac-md5
+ soft
- aes-cbc-hmac-sha
+ soft
- aes-cbc
+ soft
- aes-ctr-hmac-sha2-512
+ soft
- aes-ctr
+ soft
- aes-gcm-256
+ soft
- aes-gcm
+ soft
- blowfish
+ soft
- camellia
+ soft
- cast128
+ soft
- des-32iv
+ soft
- des-deriv
+ soft
- hmac-sha1
+ soft
- hmac-sha2-256
+ soft
- hmac-sha2-384
+ soft
- hmac-sha2-512
+ soft
- ipcomp
- doesn't work with stock FreeBSD
- null-ipcomp
- doesn't work with stock FreeBSD
- null
+ soft
- rijndael-hmac-sha2-256
+ soft
- rijndael
+ soft
- tcp-md5
- needs kernel with TCP_SIGNATURE
- Tested with cryptocheck (re-check)
- cryptosoft
- aesni
- blake2
- ccr
- Needs testing:
- ccp
- aesni with sha
- hifn
- kgssapi_krb5
- ubsec
- padlock
- safe
- GELI
- armv8_crypto (aarch64)
- glxsb (i386)
- sec (ppc)
- cesa (armv7)
- cryptocteon (mips64)
- nlmsec (mips64)
- Benchmarks
- aes-gcm setup
- frodo
- kldload ipsec
- ifconfig cc0 inet 172.16.0.1/24 alias
- setkey -f /mnt/jhb/work/git/netperf/IPSEC/Configs/source-aes-gcm-256.conf
- netperf -H 172.16.0.2 -cC
- sam
- kldload ipsec
- ifconfig cc0 inet 172.16.0.2/24 alias
- setkey -f /mnt/jhb/work/git/netperf/IPSEC/Configs/dut-aes-gcm-256.conf
- netserver
- clean svn (r348883)
- no ipsec 44000 18% 25%
- null 5500 28% 28%
- aes-gcm
- cryptosoft 550 26% 17%
- aesni 3000 28% 26%
- ccr 4300 45% 45%
- ocf_rework (r348883)
- no ipsec 44000 18% 25%
- null 5800 28% 28%
- aes-gcm
- cryptosoft 580 26% 17%
- aesni 3000 28% 26%
- ccr 4300 45% 45%
- ktls using aes-gcm
- frodo
- ktls.sh
- kldload ktls_ocf
- service nginx start
- sam
- normal ktls client
- clean svn (r354096)
- cryptosoft 2.9 Gbps 76-80% CPU
- aesni 27 Gbps 63-66% CPU
- ccr 30 Gbps 46-44% CPU
- ocf_rework (r354096)
- cryptosoft 2.9 Gbps 100% CPU
- aesni 27 Gbps 63-66% CPU
- ccr 30 Gbps 40-44% CPU
- dd /dev/zero to 4g md geli using AES-XTS / HMAC/SHA256
- svn
- software 43.002561 secs (49938506 bytes/sec)
- ccr 17.595058 secs (122050390 bytes/sec)
- ocf_rework
- software 43.544508 secs (49316981 bytes/sec)
- ccr 19.096170 secs (112456250 bytes/sec)
- dd /dev/zero to 4g md geli using AES-XTS
- svn
- software 34.214655 secs (125530048 bytes/sec)
- aesni 10.575568 secs (406121652 bytes/sec)
- ccr 10.530135 secs (407873915 bytes/sec)
- ocf_rework
- software 34.942433 secs (122915518 bytes/sec)
- aesni 10.498557 secs (409100708 bytes/sec)
- ccr 11.955181 secs (359255745 bytes/sec)
- steps to convert a driver
- add probesession
- cri -> csp
- crd -> crp fields
- axe crypto_register
+ rename CRYPTO_BUF_IOV -> CRYPTO_BUF_UIO
+ make key pointers const in csp and crp
(keep drivers from XOR'ing keys with IPAD/OPAD)
+ kill klen in crp (assume they match session)
+ allow NULL keys during setup but require klen to be
set during probesession / newsession, also have to require a key
when processing
+ change klen to bytes?
- sysctl node to list crypto drivers
- update python test to use this
- update places for new sysctl names
+ csp_lookup_hash() returns auth_hash *?
+ csp_lookup_cipher() returns enc_xform *?
+ pull checks into crypto_newsession
+ checks on mlen
+ csp_auth_klen 0 vs !0
+ kill CSP_IV_VALID and update drivers to all bail for flags != 0 to
permit adding new flags in the future
- update crypto.9
+ bus_dmamap_load_crp()
+ hifn
+ sec (ppc)
+ safe
+ cesa (armv7)
+ ubsec
View Options

lib/libpfctl/libpfctl.c

  • This file was added.
The goal of this branch is to simplify the data structures used to describe
session and crypto op parameters.
jhbAuthorUnsubmitted
Done
Inline Actions

I won't commit this file, but it lives in the branch and ended up in the review as a result.

jhb: I won't commit this file, but it lives in the branch and ended up in the review as a result.
- replace linked/list of cryptoini for session init with a structure
- explicit IV length?
- replace linked/list of cryptodesc with members in struct cryptop
- maybe require data to always be laid out as
AAD || IV (if not sideband) || DATA || TAG/MAC
(had to scrap this due to IPsec AH and permit arbitrary IV and
digest offsets)
- generate IV if needed in common code, not drivers
- add flag for hash verify rather than hash compute
- change copyto/copyback to operate on the crp instead of the fields
- permit separate in/out buffers?
- need to ensure crypto_getreq() zeroes the crp (it does)
- change for AEAD:
- previously with AES+HMAC crda covered all of data to auth, now
need to hash AAD region + payload. If IV needs to be hashed,
AAD should cover IV.
- Notes on IVs:
- CRYPTO_F_IV_GENERATE (encrypt only)
- generate full IV and copy to crp_iv_start before encryption
- CRYPTO_F_IV_SEPARATE (both, cannot use with GENERATE)
- IV is in crp_iv, crp_iv_start should be ignored
- neither flag
- full IV is in data stream at crp_iv_start
- AES-GCM now uses CIPHER_MODE_AEAD which ignores most of csp_auth_*
except for csp_auth_mlen
- Eventually retire 3 separate GMAC algs and repurpose NIST_GMAC as a single
MAC?
- Maybe retire driver HIDs with 'struct cryptocap' pointers instead? We
could just use a TAILQ instead of an array
- Separate session operation to rekey instead of implicit rekeying?
Implicit klen is not really great for auth, for example
- XXX: Need to think about how to define GMAC in the new world order. I
think it should be CSP_MODE_DIGEST, but with csp_cipher_ivlen set?
- Yes, GMAC is CSP_MODE_DIGEST with payload area describing data to hash.
It uses csp_ivlen.
- Maybe change crp_cipher_key to not change session key but only the
specific operation?
- Need to figure out what to do about accelerated software vs plain
software
- maybe need "priority" and a "session probe/test" instead of just
"newsession"
- Add a reference count on sessions
- crypto_getop would take a session pointer and set crp_session along
with bumping refcount now
- Kill the UIO usage in cryptodev.c, it's silly (done)
- GCM IV length is kind of busted, perhaps need IV length as part of crp
instead of csp?
- Testing
+ cryptocheck
+ soft
+ ccr
- ipsec
- auth
- hmac-md5
- hmac-sha1
- keyed-md5
- keyed-sha1
- null
- hmac-sha2-256
- hmac-sha2-384
- hmac-sha2-512
- hmac-ripemd160
- aes-xcbc-mac
- tcp-md5
- encrypt
- des-cbc
- 3desc-cbc
- null
- blowfish-cbc
- cast128-cbc
- des-deriv
- des-32iv
- rijndael-cbc
- aes-ctr
- aes-gcm16
- camellia-cbc
- 3des-hmac-md5
+ soft
- aes-cbc-hmac-sha
+ soft
- aes-cbc
+ soft
- aes-ctr-hmac-sha2-512
+ soft
- aes-ctr
+ soft
- aes-gcm-256
+ soft
- aes-gcm
+ soft
- blowfish
+ soft
- camellia
+ soft
- cast128
+ soft
- des-32iv
+ soft
- des-deriv
+ soft
- hmac-sha1
+ soft
- hmac-sha2-256
+ soft
- hmac-sha2-384
+ soft
- hmac-sha2-512
+ soft
- ipcomp
- doesn't work with stock FreeBSD
- null-ipcomp
- doesn't work with stock FreeBSD
- null
+ soft
- rijndael-hmac-sha2-256
+ soft
- rijndael
+ soft
- tcp-md5
- needs kernel with TCP_SIGNATURE
- Tested with cryptocheck (re-check)
- cryptosoft
- aesni
- blake2
- ccr
- Needs testing:
- ccp
- aesni with sha
- hifn
- kgssapi_krb5
- ubsec
- padlock
- safe
- GELI
- armv8_crypto (aarch64)
- glxsb (i386)
- sec (ppc)
- cesa (armv7)
- cryptocteon (mips64)
- nlmsec (mips64)
- Benchmarks
- aes-gcm setup
- frodo
- kldload ipsec
- ifconfig cc0 inet 172.16.0.1/24 alias
- setkey -f /mnt/jhb/work/git/netperf/IPSEC/Configs/source-aes-gcm-256.conf
- netperf -H 172.16.0.2 -cC
- sam
- kldload ipsec
- ifconfig cc0 inet 172.16.0.2/24 alias
- setkey -f /mnt/jhb/work/git/netperf/IPSEC/Configs/dut-aes-gcm-256.conf
- netserver
- clean svn (r348883)
- no ipsec 44000 18% 25%
- null 5500 28% 28%
- aes-gcm
- cryptosoft 550 26% 17%
- aesni 3000 28% 26%
- ccr 4300 45% 45%
- ocf_rework (r348883)
- no ipsec 44000 18% 25%
- null 5800 28% 28%
- aes-gcm
- cryptosoft 580 26% 17%
- aesni 3000 28% 26%
- ccr 4300 45% 45%
- ktls using aes-gcm
- frodo
- ktls.sh
- kldload ktls_ocf
- service nginx start
- sam
- normal ktls client
- clean svn (r354096)
- cryptosoft 2.9 Gbps 76-80% CPU
- aesni 27 Gbps 63-66% CPU
- ccr 30 Gbps 46-44% CPU
- ocf_rework (r354096)
- cryptosoft 2.9 Gbps 100% CPU
- aesni 27 Gbps 63-66% CPU
- ccr 30 Gbps 40-44% CPU
- dd /dev/zero to 4g md geli using AES-XTS / HMAC/SHA256
- svn
- software 43.002561 secs (49938506 bytes/sec)
- ccr 17.595058 secs (122050390 bytes/sec)
- ocf_rework
- software 43.544508 secs (49316981 bytes/sec)
- ccr 19.096170 secs (112456250 bytes/sec)
- dd /dev/zero to 4g md geli using AES-XTS
- svn
- software 34.214655 secs (125530048 bytes/sec)
- aesni 10.575568 secs (406121652 bytes/sec)
- ccr 10.530135 secs (407873915 bytes/sec)
- ocf_rework
- software 34.942433 secs (122915518 bytes/sec)
- aesni 10.498557 secs (409100708 bytes/sec)
- ccr 11.955181 secs (359255745 bytes/sec)
- steps to convert a driver
- add probesession
- cri -> csp
- crd -> crp fields
- axe crypto_register
+ rename CRYPTO_BUF_IOV -> CRYPTO_BUF_UIO
+ make key pointers const in csp and crp
(keep drivers from XOR'ing keys with IPAD/OPAD)
+ kill klen in crp (assume they match session)
+ allow NULL keys during setup but require klen to be
set during probesession / newsession, also have to require a key
when processing
+ change klen to bytes?
- sysctl node to list crypto drivers
- update python test to use this
- update places for new sysctl names
+ csp_lookup_hash() returns auth_hash *?
+ csp_lookup_cipher() returns enc_xform *?
+ pull checks into crypto_newsession
+ checks on mlen
+ csp_auth_klen 0 vs !0
+ kill CSP_IV_VALID and update drivers to all bail for flags != 0 to
permit adding new flags in the future
- update crypto.9
+ bus_dmamap_load_crp()
+ hifn
+ sec (ppc)
+ safe
+ cesa (armv7)
+ ubsec
View Options

sbin/pfctl/pfctl.c

  • This file was added.
The goal of this branch is to simplify the data structures used to describe
session and crypto op parameters.
jhbAuthorUnsubmitted
Done
Inline Actions

I won't commit this file, but it lives in the branch and ended up in the review as a result.

jhb: I won't commit this file, but it lives in the branch and ended up in the review as a result.
- replace linked/list of cryptoini for session init with a structure
- explicit IV length?
- replace linked/list of cryptodesc with members in struct cryptop
- maybe require data to always be laid out as
AAD || IV (if not sideband) || DATA || TAG/MAC
(had to scrap this due to IPsec AH and permit arbitrary IV and
digest offsets)
- generate IV if needed in common code, not drivers
- add flag for hash verify rather than hash compute
- change copyto/copyback to operate on the crp instead of the fields
- permit separate in/out buffers?
- need to ensure crypto_getreq() zeroes the crp (it does)
- change for AEAD:
- previously with AES+HMAC crda covered all of data to auth, now
need to hash AAD region + payload. If IV needs to be hashed,
AAD should cover IV.
- Notes on IVs:
- CRYPTO_F_IV_GENERATE (encrypt only)
- generate full IV and copy to crp_iv_start before encryption
- CRYPTO_F_IV_SEPARATE (both, cannot use with GENERATE)
- IV is in crp_iv, crp_iv_start should be ignored
- neither flag
- full IV is in data stream at crp_iv_start
- AES-GCM now uses CIPHER_MODE_AEAD which ignores most of csp_auth_*
except for csp_auth_mlen
- Eventually retire 3 separate GMAC algs and repurpose NIST_GMAC as a single
MAC?
- Maybe retire driver HIDs with 'struct cryptocap' pointers instead? We
could just use a TAILQ instead of an array
- Separate session operation to rekey instead of implicit rekeying?
Implicit klen is not really great for auth, for example
- XXX: Need to think about how to define GMAC in the new world order. I
think it should be CSP_MODE_DIGEST, but with csp_cipher_ivlen set?
- Yes, GMAC is CSP_MODE_DIGEST with payload area describing data to hash.
It uses csp_ivlen.
- Maybe change crp_cipher_key to not change session key but only the
specific operation?
- Need to figure out what to do about accelerated software vs plain
software
- maybe need "priority" and a "session probe/test" instead of just
"newsession"
- Add a reference count on sessions
- crypto_getop would take a session pointer and set crp_session along
with bumping refcount now
- Kill the UIO usage in cryptodev.c, it's silly (done)
- GCM IV length is kind of busted, perhaps need IV length as part of crp
instead of csp?
- Testing
+ cryptocheck
+ soft
+ ccr
- ipsec
- auth
- hmac-md5
- hmac-sha1
- keyed-md5
- keyed-sha1
- null
- hmac-sha2-256
- hmac-sha2-384
- hmac-sha2-512
- hmac-ripemd160
- aes-xcbc-mac
- tcp-md5
- encrypt
- des-cbc
- 3desc-cbc
- null
- blowfish-cbc
- cast128-cbc
- des-deriv
- des-32iv
- rijndael-cbc
- aes-ctr
- aes-gcm16
- camellia-cbc
- 3des-hmac-md5
+ soft
- aes-cbc-hmac-sha
+ soft
- aes-cbc
+ soft
- aes-ctr-hmac-sha2-512
+ soft
- aes-ctr
+ soft
- aes-gcm-256
+ soft
- aes-gcm
+ soft
- blowfish
+ soft
- camellia
+ soft
- cast128
+ soft
- des-32iv
+ soft
- des-deriv
+ soft
- hmac-sha1
+ soft
- hmac-sha2-256
+ soft
- hmac-sha2-384
+ soft
- hmac-sha2-512
+ soft
- ipcomp
- doesn't work with stock FreeBSD
- null-ipcomp
- doesn't work with stock FreeBSD
- null
+ soft
- rijndael-hmac-sha2-256
+ soft
- rijndael
+ soft
- tcp-md5
- needs kernel with TCP_SIGNATURE
- Tested with cryptocheck (re-check)
- cryptosoft
- aesni
- blake2
- ccr
- Needs testing:
- ccp
- aesni with sha
- hifn
- kgssapi_krb5
- ubsec
- padlock
- safe
- GELI
- armv8_crypto (aarch64)
- glxsb (i386)
- sec (ppc)
- cesa (armv7)
- cryptocteon (mips64)
- nlmsec (mips64)
- Benchmarks
- aes-gcm setup
- frodo
- kldload ipsec
- ifconfig cc0 inet 172.16.0.1/24 alias
- setkey -f /mnt/jhb/work/git/netperf/IPSEC/Configs/source-aes-gcm-256.conf
- netperf -H 172.16.0.2 -cC
- sam
- kldload ipsec
- ifconfig cc0 inet 172.16.0.2/24 alias
- setkey -f /mnt/jhb/work/git/netperf/IPSEC/Configs/dut-aes-gcm-256.conf
- netserver
- clean svn (r348883)
- no ipsec 44000 18% 25%
- null 5500 28% 28%
- aes-gcm
- cryptosoft 550 26% 17%
- aesni 3000 28% 26%
- ccr 4300 45% 45%
- ocf_rework (r348883)
- no ipsec 44000 18% 25%
- null 5800 28% 28%
- aes-gcm
- cryptosoft 580 26% 17%
- aesni 3000 28% 26%
- ccr 4300 45% 45%
- ktls using aes-gcm
- frodo
- ktls.sh
- kldload ktls_ocf
- service nginx start
- sam
- normal ktls client
- clean svn (r354096)
- cryptosoft 2.9 Gbps 76-80% CPU
- aesni 27 Gbps 63-66% CPU
- ccr 30 Gbps 46-44% CPU
- ocf_rework (r354096)
- cryptosoft 2.9 Gbps 100% CPU
- aesni 27 Gbps 63-66% CPU
- ccr 30 Gbps 40-44% CPU
- dd /dev/zero to 4g md geli using AES-XTS / HMAC/SHA256
- svn
- software 43.002561 secs (49938506 bytes/sec)
- ccr 17.595058 secs (122050390 bytes/sec)
- ocf_rework
- software 43.544508 secs (49316981 bytes/sec)
- ccr 19.096170 secs (112456250 bytes/sec)
- dd /dev/zero to 4g md geli using AES-XTS
- svn
- software 34.214655 secs (125530048 bytes/sec)
- aesni 10.575568 secs (406121652 bytes/sec)
- ccr 10.530135 secs (407873915 bytes/sec)
- ocf_rework
- software 34.942433 secs (122915518 bytes/sec)
- aesni 10.498557 secs (409100708 bytes/sec)
- ccr 11.955181 secs (359255745 bytes/sec)
- steps to convert a driver
- add probesession
- cri -> csp
- crd -> crp fields
- axe crypto_register
+ rename CRYPTO_BUF_IOV -> CRYPTO_BUF_UIO
+ make key pointers const in csp and crp
(keep drivers from XOR'ing keys with IPAD/OPAD)
+ kill klen in crp (assume they match session)
+ allow NULL keys during setup but require klen to be
set during probesession / newsession, also have to require a key
when processing
+ change klen to bytes?
- sysctl node to list crypto drivers
- update python test to use this
- update places for new sysctl names
+ csp_lookup_hash() returns auth_hash *?
+ csp_lookup_cipher() returns enc_xform *?
+ pull checks into crypto_newsession
+ checks on mlen
+ csp_auth_klen 0 vs !0
+ kill CSP_IV_VALID and update drivers to all bail for flags != 0 to
permit adding new flags in the future
- update crypto.9
+ bus_dmamap_load_crp()
+ hifn
+ sec (ppc)
+ safe
+ cesa (armv7)
+ ubsec
View Options

sys/net/pfvar.h

  • This file was added.
The goal of this branch is to simplify the data structures used to describe
session and crypto op parameters.
jhbAuthorUnsubmitted
Done
Inline Actions

I won't commit this file, but it lives in the branch and ended up in the review as a result.

jhb: I won't commit this file, but it lives in the branch and ended up in the review as a result.
- replace linked/list of cryptoini for session init with a structure
- explicit IV length?
- replace linked/list of cryptodesc with members in struct cryptop
- maybe require data to always be laid out as
AAD || IV (if not sideband) || DATA || TAG/MAC
(had to scrap this due to IPsec AH and permit arbitrary IV and
digest offsets)
- generate IV if needed in common code, not drivers
- add flag for hash verify rather than hash compute
- change copyto/copyback to operate on the crp instead of the fields
- permit separate in/out buffers?
- need to ensure crypto_getreq() zeroes the crp (it does)
- change for AEAD:
- previously with AES+HMAC crda covered all of data to auth, now
need to hash AAD region + payload. If IV needs to be hashed,
AAD should cover IV.
- Notes on IVs:
- CRYPTO_F_IV_GENERATE (encrypt only)
- generate full IV and copy to crp_iv_start before encryption
- CRYPTO_F_IV_SEPARATE (both, cannot use with GENERATE)
- IV is in crp_iv, crp_iv_start should be ignored
- neither flag
- full IV is in data stream at crp_iv_start
- AES-GCM now uses CIPHER_MODE_AEAD which ignores most of csp_auth_*
except for csp_auth_mlen
- Eventually retire 3 separate GMAC algs and repurpose NIST_GMAC as a single
MAC?
- Maybe retire driver HIDs with 'struct cryptocap' pointers instead? We
could just use a TAILQ instead of an array
- Separate session operation to rekey instead of implicit rekeying?
Implicit klen is not really great for auth, for example
- XXX: Need to think about how to define GMAC in the new world order. I
think it should be CSP_MODE_DIGEST, but with csp_cipher_ivlen set?
- Yes, GMAC is CSP_MODE_DIGEST with payload area describing data to hash.
It uses csp_ivlen.
- Maybe change crp_cipher_key to not change session key but only the
specific operation?
- Need to figure out what to do about accelerated software vs plain
software
- maybe need "priority" and a "session probe/test" instead of just
"newsession"
- Add a reference count on sessions
- crypto_getop would take a session pointer and set crp_session along
with bumping refcount now
- Kill the UIO usage in cryptodev.c, it's silly (done)
- GCM IV length is kind of busted, perhaps need IV length as part of crp
instead of csp?
- Testing
+ cryptocheck
+ soft
+ ccr
- ipsec
- auth
- hmac-md5
- hmac-sha1
- keyed-md5
- keyed-sha1
- null
- hmac-sha2-256
- hmac-sha2-384
- hmac-sha2-512
- hmac-ripemd160
- aes-xcbc-mac
- tcp-md5
- encrypt
- des-cbc
- 3desc-cbc
- null
- blowfish-cbc
- cast128-cbc
- des-deriv
- des-32iv
- rijndael-cbc
- aes-ctr
- aes-gcm16
- camellia-cbc
- 3des-hmac-md5
+ soft
- aes-cbc-hmac-sha
+ soft
- aes-cbc
+ soft
- aes-ctr-hmac-sha2-512
+ soft
- aes-ctr
+ soft
- aes-gcm-256
+ soft
- aes-gcm
+ soft
- blowfish
+ soft
- camellia
+ soft
- cast128
+ soft
- des-32iv
+ soft
- des-deriv
+ soft
- hmac-sha1
+ soft
- hmac-sha2-256
+ soft
- hmac-sha2-384
+ soft
- hmac-sha2-512
+ soft
- ipcomp
- doesn't work with stock FreeBSD
- null-ipcomp
- doesn't work with stock FreeBSD
- null
+ soft
- rijndael-hmac-sha2-256
+ soft
- rijndael
+ soft
- tcp-md5
- needs kernel with TCP_SIGNATURE
- Tested with cryptocheck (re-check)
- cryptosoft
- aesni
- blake2
- ccr
- Needs testing:
- ccp
- aesni with sha
- hifn
- kgssapi_krb5
- ubsec
- padlock
- safe
- GELI
- armv8_crypto (aarch64)
- glxsb (i386)
- sec (ppc)
- cesa (armv7)
- cryptocteon (mips64)
- nlmsec (mips64)
- Benchmarks
- aes-gcm setup
- frodo
- kldload ipsec
- ifconfig cc0 inet 172.16.0.1/24 alias
- setkey -f /mnt/jhb/work/git/netperf/IPSEC/Configs/source-aes-gcm-256.conf
- netperf -H 172.16.0.2 -cC
- sam
- kldload ipsec
- ifconfig cc0 inet 172.16.0.2/24 alias
- setkey -f /mnt/jhb/work/git/netperf/IPSEC/Configs/dut-aes-gcm-256.conf
- netserver
- clean svn (r348883)
- no ipsec 44000 18% 25%
- null 5500 28% 28%
- aes-gcm
- cryptosoft 550 26% 17%
- aesni 3000 28% 26%
- ccr 4300 45% 45%
- ocf_rework (r348883)
- no ipsec 44000 18% 25%
- null 5800 28% 28%
- aes-gcm
- cryptosoft 580 26% 17%
- aesni 3000 28% 26%
- ccr 4300 45% 45%
- ktls using aes-gcm
- frodo
- ktls.sh
- kldload ktls_ocf
- service nginx start
- sam
- normal ktls client
- clean svn (r354096)
- cryptosoft 2.9 Gbps 76-80% CPU
- aesni 27 Gbps 63-66% CPU
- ccr 30 Gbps 46-44% CPU
- ocf_rework (r354096)
- cryptosoft 2.9 Gbps 100% CPU
- aesni 27 Gbps 63-66% CPU
- ccr 30 Gbps 40-44% CPU
- dd /dev/zero to 4g md geli using AES-XTS / HMAC/SHA256
- svn
- software 43.002561 secs (49938506 bytes/sec)
- ccr 17.595058 secs (122050390 bytes/sec)
- ocf_rework
- software 43.544508 secs (49316981 bytes/sec)
- ccr 19.096170 secs (112456250 bytes/sec)
- dd /dev/zero to 4g md geli using AES-XTS
- svn
- software 34.214655 secs (125530048 bytes/sec)
- aesni 10.575568 secs (406121652 bytes/sec)
- ccr 10.530135 secs (407873915 bytes/sec)
- ocf_rework
- software 34.942433 secs (122915518 bytes/sec)
- aesni 10.498557 secs (409100708 bytes/sec)
- ccr 11.955181 secs (359255745 bytes/sec)
- steps to convert a driver
- add probesession
- cri -> csp
- crd -> crp fields
- axe crypto_register
+ rename CRYPTO_BUF_IOV -> CRYPTO_BUF_UIO
+ make key pointers const in csp and crp
(keep drivers from XOR'ing keys with IPAD/OPAD)
+ kill klen in crp (assume they match session)
+ allow NULL keys during setup but require klen to be
set during probesession / newsession, also have to require a key
when processing
+ change klen to bytes?
- sysctl node to list crypto drivers
- update python test to use this
- update places for new sysctl names
+ csp_lookup_hash() returns auth_hash *?
+ csp_lookup_cipher() returns enc_xform *?
+ pull checks into crypto_newsession
+ checks on mlen
+ csp_auth_klen 0 vs !0
+ kill CSP_IV_VALID and update drivers to all bail for flags != 0 to
permit adding new flags in the future
- update crypto.9
+ bus_dmamap_load_crp()
+ hifn
+ sec (ppc)
+ safe
+ cesa (armv7)
+ ubsec
View Options

sys/netpfil/pf/pf_ioctl.c

  • This file was added.
The goal of this branch is to simplify the data structures used to describe
session and crypto op parameters.
jhbAuthorUnsubmitted
Done
Inline Actions

I won't commit this file, but it lives in the branch and ended up in the review as a result.

jhb: I won't commit this file, but it lives in the branch and ended up in the review as a result.
- replace linked/list of cryptoini for session init with a structure
- explicit IV length?
- replace linked/list of cryptodesc with members in struct cryptop
- maybe require data to always be laid out as
AAD || IV (if not sideband) || DATA || TAG/MAC
(had to scrap this due to IPsec AH and permit arbitrary IV and
digest offsets)
- generate IV if needed in common code, not drivers
- add flag for hash verify rather than hash compute
- change copyto/copyback to operate on the crp instead of the fields
- permit separate in/out buffers?
- need to ensure crypto_getreq() zeroes the crp (it does)
- change for AEAD:
- previously with AES+HMAC crda covered all of data to auth, now
need to hash AAD region + payload. If IV needs to be hashed,
AAD should cover IV.
- Notes on IVs:
- CRYPTO_F_IV_GENERATE (encrypt only)
- generate full IV and copy to crp_iv_start before encryption
- CRYPTO_F_IV_SEPARATE (both, cannot use with GENERATE)
- IV is in crp_iv, crp_iv_start should be ignored
- neither flag
- full IV is in data stream at crp_iv_start
- AES-GCM now uses CIPHER_MODE_AEAD which ignores most of csp_auth_*
except for csp_auth_mlen
- Eventually retire 3 separate GMAC algs and repurpose NIST_GMAC as a single
MAC?
- Maybe retire driver HIDs with 'struct cryptocap' pointers instead? We
could just use a TAILQ instead of an array
- Separate session operation to rekey instead of implicit rekeying?
Implicit klen is not really great for auth, for example
- XXX: Need to think about how to define GMAC in the new world order. I
think it should be CSP_MODE_DIGEST, but with csp_cipher_ivlen set?
- Yes, GMAC is CSP_MODE_DIGEST with payload area describing data to hash.
It uses csp_ivlen.
- Maybe change crp_cipher_key to not change session key but only the
specific operation?
- Need to figure out what to do about accelerated software vs plain
software
- maybe need "priority" and a "session probe/test" instead of just
"newsession"
- Add a reference count on sessions
- crypto_getop would take a session pointer and set crp_session along
with bumping refcount now
- Kill the UIO usage in cryptodev.c, it's silly (done)
- GCM IV length is kind of busted, perhaps need IV length as part of crp
instead of csp?
- Testing
+ cryptocheck
+ soft
+ ccr
- ipsec
- auth
- hmac-md5
- hmac-sha1
- keyed-md5
- keyed-sha1
- null
- hmac-sha2-256
- hmac-sha2-384
- hmac-sha2-512
- hmac-ripemd160
- aes-xcbc-mac
- tcp-md5
- encrypt
- des-cbc
- 3desc-cbc
- null
- blowfish-cbc
- cast128-cbc
- des-deriv
- des-32iv
- rijndael-cbc
- aes-ctr
- aes-gcm16
- camellia-cbc
- 3des-hmac-md5
+ soft
- aes-cbc-hmac-sha
+ soft
- aes-cbc
+ soft
- aes-ctr-hmac-sha2-512
+ soft
- aes-ctr
+ soft
- aes-gcm-256
+ soft
- aes-gcm
+ soft
- blowfish
+ soft
- camellia
+ soft
- cast128
+ soft
- des-32iv
+ soft
- des-deriv
+ soft
- hmac-sha1
+ soft
- hmac-sha2-256
+ soft
- hmac-sha2-384
+ soft
- hmac-sha2-512
+ soft
- ipcomp
- doesn't work with stock FreeBSD
- null-ipcomp
- doesn't work with stock FreeBSD
- null
+ soft
- rijndael-hmac-sha2-256
+ soft
- rijndael
+ soft
- tcp-md5
- needs kernel with TCP_SIGNATURE
- Tested with cryptocheck (re-check)
- cryptosoft
- aesni
- blake2
- ccr
- Needs testing:
- ccp
- aesni with sha
- hifn
- kgssapi_krb5
- ubsec
- padlock
- safe
- GELI
- armv8_crypto (aarch64)
- glxsb (i386)
- sec (ppc)
- cesa (armv7)
- cryptocteon (mips64)
- nlmsec (mips64)
- Benchmarks
- aes-gcm setup
- frodo
- kldload ipsec
- ifconfig cc0 inet 172.16.0.1/24 alias
- setkey -f /mnt/jhb/work/git/netperf/IPSEC/Configs/source-aes-gcm-256.conf
- netperf -H 172.16.0.2 -cC
- sam
- kldload ipsec
- ifconfig cc0 inet 172.16.0.2/24 alias
- setkey -f /mnt/jhb/work/git/netperf/IPSEC/Configs/dut-aes-gcm-256.conf
- netserver
- clean svn (r348883)
- no ipsec 44000 18% 25%
- null 5500 28% 28%
- aes-gcm
- cryptosoft 550 26% 17%
- aesni 3000 28% 26%
- ccr 4300 45% 45%
- ocf_rework (r348883)
- no ipsec 44000 18% 25%
- null 5800 28% 28%
- aes-gcm
- cryptosoft 580 26% 17%
- aesni 3000 28% 26%
- ccr 4300 45% 45%
- ktls using aes-gcm
- frodo
- ktls.sh
- kldload ktls_ocf
- service nginx start
- sam
- normal ktls client
- clean svn (r354096)
- cryptosoft 2.9 Gbps 76-80% CPU
- aesni 27 Gbps 63-66% CPU
- ccr 30 Gbps 46-44% CPU
- ocf_rework (r354096)
- cryptosoft 2.9 Gbps 100% CPU
- aesni 27 Gbps 63-66% CPU
- ccr 30 Gbps 40-44% CPU
- dd /dev/zero to 4g md geli using AES-XTS / HMAC/SHA256
- svn
- software 43.002561 secs (49938506 bytes/sec)
- ccr 17.595058 secs (122050390 bytes/sec)
- ocf_rework
- software 43.544508 secs (49316981 bytes/sec)
- ccr 19.096170 secs (112456250 bytes/sec)
- dd /dev/zero to 4g md geli using AES-XTS
- svn
- software 34.214655 secs (125530048 bytes/sec)
- aesni 10.575568 secs (406121652 bytes/sec)
- ccr 10.530135 secs (407873915 bytes/sec)
- ocf_rework
- software 34.942433 secs (122915518 bytes/sec)
- aesni 10.498557 secs (409100708 bytes/sec)
- ccr 11.955181 secs (359255745 bytes/sec)
- steps to convert a driver
- add probesession
- cri -> csp
- crd -> crp fields
- axe crypto_register
+ rename CRYPTO_BUF_IOV -> CRYPTO_BUF_UIO
+ make key pointers const in csp and crp
(keep drivers from XOR'ing keys with IPAD/OPAD)
+ kill klen in crp (assume they match session)
+ allow NULL keys during setup but require klen to be
set during probesession / newsession, also have to require a key
when processing
+ change klen to bytes?
- sysctl node to list crypto drivers
- update python test to use this
- update places for new sysctl names
+ csp_lookup_hash() returns auth_hash *?
+ csp_lookup_cipher() returns enc_xform *?
+ pull checks into crypto_newsession
+ checks on mlen
+ csp_auth_klen 0 vs !0
+ kill CSP_IV_VALID and update drivers to all bail for flags != 0 to
permit adding new flags in the future
- update crypto.9
+ bus_dmamap_load_crp()
+ hifn
+ sec (ppc)
+ safe
+ cesa (armv7)
+ ubsec
View Options

sys/netpfil/pf/pf_nl.h

Loading...
View Options

sys/netpfil/pf/pf_nl.c

Loading...