Paths

Table of Contentst

Refactor driver and consumer interfaces for OCF (in-kernel crypto).
ClosedPublic
Actions

Authored by jhb on Feb 13 2020, 11:51 PM.

Details

Reviewers

cem
jhb

Commits

rS359374: Refactor driver and consumer interfaces for OCF (in-kernel crypto).

Summary

The linked list of cryptoini structures used in session initialization is replaced with a new flat structure: struct crypto_session_params. This session includes a new mode to define how the other fields should be interpreted. Available modes include:
- COMPRESS (for compression/decompression)
- CIPHER (for simply encryption/decryption)
- DIGEST (computing and verifying digests)
- AEAD (combined auth and encryption such as AES-GCM and AES-CCM)
- ETA (combined auth and encryption using encrypt-then-authenticate)
  
  Additional modes could be added in the future (e.g. if we wanted to support TLS MtE for AES-CBC in the kernel we could add a new mode for that. TLS modes might also affect how AAD is interpreted, etc.)
  
  The flat structure also includes the key lengths and algorithms as before. However, code doesn't have to walk the linked list and switch on the algorithm to determine which key is the auth key vs encryption key. The 'csp_auth_*' fields are always used for auth keys and settings and 'csp_cipher_*' for cipher. (Compression algorithms are stored in csp_cipher_alg.)

Drivers no longer register a list of supported algorithms. This doesn't quite work when you factor in modes (e.g. a driver might support both AES-CBC and SHA2-256-HMAC separately but not combined for ETA). Instead, a new 'crypto_probesession' method has been added to the kobj interface for symmteric crypto drivers. This method returns a negative value on success (similar to how device_probe works) and the crypto framework uses this value to pick the "best" driver. There are three constants for hardware (e.g. ccr), accelerated software (e.g. aesni), and plain software (cryptosoft) that give preference in that order. One effect of this is that if you request only hardware when creating a new session, you will no longer get a session using accelerated software. Another effect is that the default setting to disallow software crypto via /dev/crypto now disables accelerated software.

Once a driver is chosen, 'crypto_newsession' is invoked as before.

Crypto operations are now solely described by the flat 'cryptop' structure. The linked list of descriptors has been removed.

A separate enum has been added to describe the type of data buffer in use instead of using CRYPTO_F_* flags to make it easier to add more types in the future if needed (e.g. wired userspace buffers for zero-copy). It will also make it easier to re-introduce separate input and output buffers (in-kernel TLS would benefit from this).

Try to make the flags related to IV handling less insane:
- CRYPTO_F_IV_SEPARATE means that the IV is stored in the 'crp_iv' member of the operation structure. If this flag is not set, the IV is stored in the data buffer at the 'crp_iv_start' offset.
- CRYPTO_F_IV_GENERATE means that a random IV should be generated and stored into the data buffer. This cannot be used with CRYPTO_F_IV_SEPARATE.
  
  If a consumer wants to deal with explicit vs implicit IVs, etc. it can always generate the IV however it needs and store partial IVs in the buffer and the full IV/nonce in crp_iv and set CRYPTO_F_IV_SEPARATE.
  
  The layout of the buffer is now described via fields in cryptop. crp_aad_start and crp_aad_length define the boundaries of any AAD. Previously with GCM and CCM you defined an auth crd with this range, but for ETA your auth crd had to span both the AAD and plaintext (and they had to be adjacent).
  
  crp_payload_start and crp_payload_length define the boundaries of the plaintext/ciphertext. Modes that only do a single operation (COMPRESS, CIPHER, DIGEST) should only use this region and leave the AAD region empty.
  
  If a digest is present (or should be generated), it's starting location is marked by crp_digest_start.
  
  Instead of using the CRD_F_ENCRYPT flag to determine the direction of the operation, cryptop now includes an 'op' field defining the operation to perform. For digests I've added a new VERIFY digest mode which assumes a digest is present in the input and fails the request with EBADMSG if it doesn't match the internally-computed digest. GCM and CCM already assumed this, and the new AEAD mode requires this for decryption. However, ETA mode now supports doing a verify as well (so in this tree IPsec always requests that the crypto layer verify the digest instead of doing it in IPsec). Simple DIGEST operations can also do this, though there are no in-tree consumers.
  
  To eventually support some refcounting to close races, the session cookie is now passed to crypto_getop() and clients should no longer set crp_sesssion directly.

Assymteric crypto operation structures should be allocated via crypto_getkreq() and freed via crypto_freekreq(). This permits the crypto layer to track open asym requests and close races with a driver trying to unregister while asym requests are in flight.

crypto_copyback, crypto_copydata, crypto_apply, and crypto_contiguous_subsegment now accept the 'crp' object as the first parameter instead of individual members. This makes it easier to deal with different buffer types in the future as well as separate input and output buffers. It's also just simpler for driver writers to use.

bus_dmamap_load_crp() loads a DMA mapping for a crypto buffer. This understands the various types of buffers so that drivers that use dma do not have to be aware of different buffer types.

Helper routines now exist to build an auth context for HMAC IPAD and OPAD. This reduces some duplicated work among drivers.

Key buffers are now treated as const throughout the framework and in device drivers. However, session key buffers provided when a session is created are expected to remain alive for the duration of the session.

GCM and CCM sessions now only specify a cipher algorithm and a cipher key. The redundant auth information is not needed or used.

For cryptosoft, split up the code a bit such that the 'process' callback now invokes a function pointer in the session. This function pointer is set based on the mode (in effect) though it simplifies a few edge cases that would otherwise be in the switch in 'process'.

It does split up GCM vs CCM which I think is more readable even if there is some duplication.

I changed /dev/crypto to support GMAC requests using CRYPTO_AES_NIST_GMAC as an auth algorithm and updated cryptocheck to work with it.

Combined cipher and auth sessions via /dev/crypto now always use ETA mode. The COP_F_CIPHER_FIRST flag is now a no-op that is ignored. This was actually documented as being true in crypto(4) before, but the code had not implemented this before I added the CIPHER_FIRST flag.

I have not yet updated /dev/crypto to be aware of explicit modes for sessions. I will probably do that at some point in the future as well as teach it about IV/nonce and tag lengths for AEAD so we can support all of the NIST KAT tests for GCM and CCM.

I've split up the exising crypto.9 manpage into several pages of which many are written from scratch.

I have converted all drivers and consumers in the tree and verified that they compile, but I have not tested all of them. I have tested the following drivers:
- cryptosoft
- aesni (AES only)
- blake2
- ccr
  
  and the following consumers:
- cryptodev
- IPsec
- ktls_ocf
- GELI (lightly)
  
  I have not tested the following:
- ccp
- aesni with sha
- hifn
- kgssapi_krb5
- ubsec
- padlock
- safe
- armv8_crypto (aarch64)
- glxsb (i386)
- sec (ppc)
- cesa (armv7)
- cryptocteon (mips64)
- nlmsec (mips64)

Test Plan

cryptocheck of tested drivers
have tested ktls_ocf using normal KTLS testing (nginx)
tested IPsec with pinging while over a tunnel for most of the supported algorithms in the tree (not able to test IPcomp since I couldn't get it to work in stock FreeBSD)
tested GELI using a memory disk with aesni0, software, and ccr0 as backing drivers
make tinderbox

Diff Detail

Lint

Lint Passed

Unit

No Test Coverage

Build Status

Buildable 29371
Build 27267: arc lint + arc unit

Event Timeline

jhb created this revision.Feb 13 2020, 11:51 PM

Herald added subscribers: ae, andrew. · View Herald TranscriptFeb 13 2020, 11:51 PM

Harbormaster completed remote builds in B29369: Diff 68293.Feb 13 2020, 11:51 PM

jhb added inline comments.Feb 14 2020, 12:33 AM

notes
2	I won't commit this file, but it lives in the branch and ended up in the review as a result.
share/man/man4/crypto.4
151	Will bump Dd on all affected manpages at time of commit.
sys/crypto/armv8/armv8_crypto.c
292–298	This applies r342024 to this driver which was copied from aesni,
sys/crypto/ccp/ccp_hardware.c
1702	Hmm, in ccr I ended up renaming 'authenc' to 'eta'. Might be prudent to do the same in this driver post-commit.
sys/dev/cxgbe/crypto/t4_crypto.c
1085–1086	ETA always requires checking the tag, so I can G/C this workaround now.
sys/dev/glxsb/glxsb.c
494	Need to fix the `accellerate` typo here and in padlock.
sys/dev/hifn/hifn7751.c
2709	The fact that hifn(4) wants to replace the mbuf pointer in the `crp` is pretty crappy. I think it might happen to work by accident with IPsec, but it doesn't seem like the right thing to me to be changing the pointer. I added an XXX for ubsec(4) which has copied and pasted all the craziness from hifn(4) here but then fails to actually update the mbuf pointer in `crp`. All of these shenanigans appear to be trying to avoid the second copy of the data back into the original mbuf when using normal bus_dma bounce buffers. I feel like the driver should just use bounce buffers if it has to.
sys/dev/ubsec/ubsec.c
1442	I guess the original version did actually update crp_mbuf. Sigh. I guess I can at least replicate what I did for hifn(4) here then.
sys/geom/eli/g_eli_privacy.c
251	I removed this "optimization" because we need to use `crypto_getreq` to get proper reference counting on sessions in the future. OTOH, we are at least only allocating a single `crp` and not the descriptors anymore.
sys/kgssapi/krb5/kcrypto_des3.c
51–52	This crypto consumer was "creative". It created a single session that had both DES and MAC entries when the session was created, but then would only send down requests for either DES or MAC, but not both. To make this work in the new (saner) world order, it now uses separate sessions for DES and MAC.

jhb added inline comments.Feb 14 2020, 1:34 AM

sys/dev/cxgbe/crypto/t4_crypto.c
1085–1086	Actually, GELI does send these requests still, but it probably shouldn't.

Remove OBE workaround from ccr_eta_done.
Don't permit DECRYPT | COMPUTE for ETA.
accellerate -> accelerate.
Let OCF verify HMACs for ETA.
Update crp_mbuf instead of leaking q_dst_m.

Harbormaster completed remote builds in B29371: Diff 68298.Feb 14 2020, 1:35 AM

Fix a couple of bugs in my geli ETA changes.
Tidy GELI auth failure logging.

Herald added a subscriber: melifaro. · View Herald TranscriptFeb 25 2020, 11:34 PM

Harbormaster completed remote builds in B29619: Diff 68828.Feb 25 2020, 11:34 PM

I've retested with GELI + AUTH after my changes to mandate verify for ETA and fixed a couple of bugs I had as a result. I also discovered a rather interesting behavior change. Currently, if data fails the authentication check, geli warns about it on the console, but returns the decrypted data (which may be garbage) to the reader instead of failing the I/O request. The version in this branch will instead fail I/O requests with EBADMSG if the authentication fails. For GELI I found that performance was slightly worse, I suspect because I've gone back to doing separate uma_zalloc calls for struct cryptop objects instead of pre-allocating them in the bio_driver2 block. However, I do hope that adding support for separate in vs out buffers (which can avoid the bcopy currently done) will more than offset this in the future.

So GELI is not quite as bad as I said above. If the authentication doesn't match, it doesn't return the output of the decryption operation to the caller. Instead, it leaves whatever happens to be in the caller-provided buffer unchanged. However, this seems possibly bogus as it's not clear if the caller-provided buffer is always sanitized (e.g. it might be better if the current GELI code were to explicitly zero the data that it isn't able to verify to avoid leaking random kernel heap memory). I think I'd prefer to stick with the new semantics (albeit substituting EINTEGRITY for EBADMSG as suggested by @cem). If someone really needs the old semantics it can be re-added.

I've not reviewed the entire patch, but I have converted a (not in-tree) crypto driver to this. It works, and greatly improves the open crypto API from the driver perspective.

Actually, I misread the code. On any corruption mismatch it sets bio_error to -1, and then converts that -1 to EINVAL. The -1 just a hack to avoid double-logging it seems.

Some perf numbers from geli.
Map EBADMSG to EINTEGRITY for GELI.
Allow other errors to supersede EINTEGRITY.
Coalesce auth errors.
Various fixes to previous.

Harbormaster completed remote builds in B29685: Diff 68980.Feb 29 2020, 12:27 AM

So GELI with auth now does the same exact logging as before. The only remaining difference is that the error returned is still EINTEGRITY rather than EINVAL.

jhb added a parent revision: D24131: Use the newer EINTEGRITY error when authentication fails..Mar 20 2020, 12:40 AM

Rebase

Harbormaster completed remote builds in B30113: Diff 69884.Mar 26 2020, 3:13 AM

val_packett.cool mentioned this in D21017: armv8crypto: add AES-XTS support.Mar 27 2020, 10:15 PM

hmm automation did not pick up that this has landed

jhb accepted this revision.Mar 28 2020, 1:05 AM

jhb added a commit: rS359374: Refactor driver and consumer interfaces for OCF (in-kernel crypto)..

This revision is now accepted and ready to land.Mar 28 2020, 1:06 AM

jhb closed this revision.Mar 28 2020, 1:06 AM

Revision Contents
Changeset List

Path

Size

ObsoleteFiles.inc

4 lines

notes

239 lines

share/

man/

man4/

crypto.4

20 lines

man7/

crypto.7

30 lines

man9/

45 lines

19 lines

749 lines

178 lines

392 lines

419 lines

245 lines

sys/

crypto/

aesni/

aesni.h

14 lines

aesni.c

852 lines

aesni_wrap.c

58 lines

armv8/

armv8_crypto.c

248 lines

blake2/

blake2_cryptodev.c

217 lines

ccp/

ccp.h

19 lines

ccp.c

472 lines

ccp_hardware.c

232 lines

via/

10 lines

146 lines

124 lines

118 lines

dev/

cesa/

cesa.h

5 lines

cesa.c

601 lines

cxgbe/

adapter.h

2 lines

crypto/

t4_crypto.c

1305 lines

t4_keyctx.c

40 lines

tom/

t4_tls.c

4 lines

glxsb/

glxsb.h

6 lines

glxsb.c

294 lines

glxsb_hash.c

100 lines

hifn/

hifn7751.c

624 lines

hifn7751var.h

15 lines

safe/

safe.c

921 lines

safevar.h

12 lines

sec/

sec.h

18 lines

sec.c

544 lines

ubsec/

ubsec.c

597 lines

ubsecvar.h

10 lines

geom/

eli/

20 lines

49 lines

46 lines

164 lines

85 lines

kern/

subr_bus_dma.c

51 lines

uipc_ktls.c

3 lines

kgssapi/

krb5/

kcrypto_aes.c

109 lines

kcrypto_des.c

57 lines

kcrypto_des3.c

108 lines

mips/

cavium/

cryptocteon/

cavium_crypto.c

180 lines

cryptocteon.c

453 lines

cryptocteonvar.h

12 lines

nlm/

dev/

sec/

16 lines

440 lines

22 lines

125 lines

hal/

nlmsaelib.h

4 lines

netipsec/

5 lines

78 lines

171 lines

79 lines

opencrypto/

85 lines

1317 lines

144 lines

559 lines

118 lines

1735 lines

95 lines

6 lines

sys/

bus_dma.h

8 lines

tests/

sys/

opencrypto/

cryptodev.py

5 lines

cryptodevh.py

3 lines

cryptotest.py

8 lines

tools/

crypto/

cryptocheck.c

196 lines

Commit	Tree	Parents	Author	Summary	Date
dfb6eb00df57	9808390bd855	1ce7907e01e5	John Baldwin	Update crp_mbuf instead of leaking q_dst_m. (Show More…)	Feb 14 2020, 1:32 AM
1ce7907e01e5	152af1f73ea7	81c4a06bac81	John Baldwin	Let OCF verify HMACs for ETA. (Show More…)	Feb 14 2020, 1:24 AM
81c4a06bac81	386f03620054	cdc0dcb44d7b	John Baldwin	accellerate -> accelerate.	Feb 14 2020, 1:20 AM
cdc0dcb44d7b	9d6e21df7aaa	669b35453a02	John Baldwin	Don't permit DECRYPT \| COMPUTE for ETA.	Feb 14 2020, 1:13 AM
669b35453a02	6c47ca74c6bc	2ff3bb06d6b5	John Baldwin	Remove OBE workaround from ccr_eta_done. (Show More…)	Feb 14 2020, 12:46 AM
2ff3bb06d6b5	d5c0569f58a5	924866a5b423	John Baldwin	Several it's -> its.	Feb 7 2020, 11:26 PM
924866a5b423	0da895074bf8	cbf2665d31b3	John Baldwin	Better table formatting.	Feb 7 2020, 2:40 AM
cbf2665d31b3	47510b71699e	23d28484f25f	John Baldwin	Rewrite crypto.9 in terms of the other pages. (Show More…)	Feb 7 2020, 2:28 AM
23d28484f25f	7b762bc77bac	17d239d62b2f	John Baldwin	Add a crypto_asym.9 manpage.	Feb 1 2020, 12:38 AM
17d239d62b2f	5df0e106b38a	f9f7c6d4e6a2	John Baldwin	Formatting nit.	Feb 1 2020, 12:38 AM
f9f7c6d4e6a2	79a95b78a5e0	1490fef6d942	John Baldwin	Various typos and fixes.	Feb 1 2020, 12:20 AM
1490fef6d942	7a2f1632d16d	b80fb34805bc	John Baldwin	Drop some unused prototypes.	Feb 1 2020, 12:05 AM
b80fb34805bc	9761b417e72f	f73a0b0a14f9	John Baldwin	Just use void as the return type for krp_callback. (Show More…)	Feb 1 2020, 12:04 AM
f73a0b0a14f9	0612bbe3ce6c	5be86f6386f6	John Baldwin	Add a crypto_driver for the symmetric driver interface.	Jan 31 2020, 11:24 PM
5be86f6386f6	d3b8f60972a8	e49a1ed9c64d	John Baldwin	Typos.	Jan 31 2020, 11:23 PM
e49a1ed9c64d	6bafcd482557	540f527b3e29	John Baldwin	Note a weird issue I saw.	Jan 31 2020, 11:22 PM
540f527b3e29	ec712c54ce2a	13aa4cd095c4	John Baldwin	Don't attempt to validate hash lengths. (Show More…)	Jan 31 2020, 5:57 PM
13aa4cd095c4	d81d0269ffd7	fff467dce005	John Baldwin	Rename authenc to eta.	Jan 30 2020, 10:33 PM
fff467dce005	ffa13c63a976	e5de6170abf5	John Baldwin	Add a new crypto_request(9) manpage.	Jan 18 2020, 12:49 AM
e5de6170abf5	89ce0f4c8931	c80fee8d5985	John Baldwin	Compare crp_olen against crp_payload_length directly.	Jan 18 2020, 12:43 AM
c80fee8d5985	394ba19080ca	f24c84f82d1a	John Baldwin	Don't use crp_olen for non-compression requests.	Jan 15 2020, 7:38 PM
f24c84f82d1a	ee1f24c7ecd9	2dc87c29e68f	John Baldwin	Fix a sign bug so we get an FPU context for aesni cipher setup.	Jan 15 2020, 1:01 AM
2dc87c29e68f	de2fc85a048b	269abe102afd	John Baldwin	Still need the GMAC key length constants for xform_gmac.c.	Jan 15 2020, 12:12 AM
269abe102afd	11ee8f96d288	c8d7f60cd00a	John Baldwin	Stop using the old GMAC constants in the python tests.	Jan 14 2020, 11:58 PM
c8d7f60cd00a	9088f4d084b1	ea3a2f6a94ef	John Baldwin	Updates to crypto(7).	Jan 14 2020, 11:21 PM
ea3a2f6a94ef	7959d74c7dc9	2de8c046aec1	John Baldwin	More forcefully retire the old GMAC constants. (Show More…)	Jan 14 2020, 11:17 PM
2de8c046aec1	ac10e0efe9d3	87dbea7b529b	John Baldwin	Add a crypto_session.9 manpage describing sessions. (Show More…)	Jan 14 2020, 10:59 PM
87dbea7b529b	6d83ae7fb21a	7c88670cad92	John Baldwin	Typo.	Jan 7 2020, 8:42 PM
7c88670cad92	e4c8ee07e5a8	e5f9706118e8	John Baldwin	Axe COP_F_CIPHER_FIRST since ETA is the session mode now. (Show More…)	Jan 7 2020, 8:41 PM
e5f9706118e8	3d8872e84ba7	e8b174346613	John Baldwin	Fix merge-o in GMAC.	Jan 7 2020, 8:36 PM
e8b174346613	a41d097375d1	5d1643eeb16a	John Baldwin	Update crypto.4.	Dec 28 2019, 1:05 AM
5d1643eeb16a	256c8dcaa465	f2e6e939efad	John Baldwin	Switch to verify digest on decrypt for ETA sessions.	Dec 27 2019, 8:06 PM
f2e6e939efad	dbdb68a3db36	536e200e8c52	John Baldwin	Various cleanups to cryptocheck. (Show More…)	Dec 27 2019, 7:46 PM
536e200e8c52	f0a2ad43c9f4	a56cb08b5cad	John Baldwin	Remove no-longer-used hmac_ipad/opad_buffer variables.	Dec 24 2019, 7:10 PM
a56cb08b5cad	21075909f3f8	13d149461524	John Baldwin	Trim some #if 0'd bits I missed.	Dec 24 2019, 7:08 PM
13d149461524	3f49378e9e0c	15597b16f724	John Baldwin	Update TLS 1.3 bits.	Dec 24 2019, 7:03 PM
15597b16f724	d1897235c757	dc47b58d2406	John Baldwin	Update.	Dec 17 2019, 10:59 PM
dc47b58d2406	7ca6102f36d4	49d552821303	John Baldwin	Use bus_dmamap_load_crp(). (Show More…)	Dec 17 2019, 10:58 PM
49d552821303	b3ff7776e82b	92ad8ef665c3	John Baldwin	Add a bus_dmamap_load_crp() wrapper function.	Dec 14 2019, 12:16 AM
92ad8ef665c3	290bd5095704	f4d4142c77be	John Baldwin	Update notes.	Nov 19 2019, 10:02 PM
f4d4142c77be	563734cc4d42	3322bf18bef8	John Baldwin	Compile fixes.	Nov 19 2019, 10:00 PM
3322bf18bef8	f91a59560e7c	8e8fcbd46d62	John Baldwin	Switch csp_*_klen to bytes instead of bits.	Nov 19 2019, 9:45 PM
8e8fcbd46d62	27623e40378b	53ad77925d4f	John Baldwin	Update notes.	Nov 19 2019, 8:32 PM
53ad77925d4f	717aaef7a263	4877ebe66e94	John Baldwin	Reject sessions with unsupported csp_flags to future proof.	Nov 19 2019, 7:52 PM
4877ebe66e94	887ac4625386	998747a7bb26	John Baldwin	Axe CSP_IV_VALID since it hasn't been used.	Nov 19 2019, 7:49 PM
998747a7bb26	d0008b57f56c	977643586bc8	John Baldwin	Update.	Nov 15 2019, 1:03 AM
977643586bc8	1627cd63406d	2f4cdb0233f2	John Baldwin	Move more checks for auth at least (mlen, etc.) into common code. (Show More…)	Nov 15 2019, 12:58 AM
2f4cdb0233f2	265c7bc97529	2140aabd25cd	John Baldwin	Fix mismerge.	Nov 14 2019, 11:29 PM
2140aabd25cd	ea223a453095	5bed4307bce1	John Baldwin	Update notes.	Nov 14 2019, 10:26 PM
5bed4307bce1	d2b41da500ff	ace6905266ab	John Baldwin	Trim unused fields from cryptocteon.	Nov 14 2019, 10:25 PM
ace6905266ab	e92da3573fcb	6c5c1507c733	John Baldwin	Convert nlmsec(4).	Nov 14 2019, 10:22 PM
6c5c1507c733	289eec20a6d0	885ef7747d85	John Baldwin	Drop unused newsession hook from XLP RSA driver.	Nov 14 2019, 10:21 PM
885ef7747d85	e7e844af0949	f6769bac830e	John Baldwin	Update cesa to verify digests.	Nov 14 2019, 8:16 PM
f6769bac830e	65fbeeb33c0c	21e05ba7ff73	John Baldwin	Update sec(4) to verify digests and handle truncated digests.	Nov 14 2019, 8:12 PM
21e05ba7ff73	2743b96a2f1c	60e65b7b56ba	John Baldwin	Handle digest verify in glxsb(4).	Nov 14 2019, 7:44 PM
60e65b7b56ba	73ba6fc749e0	fbee8545707d	John Baldwin	Convert the cryptocteon driver.	Nov 14 2019, 7:33 PM
fbee8545707d	9baf577e466e	2369495b17e3	John Baldwin	Convert cesa(4).	Oct 30 2019, 12:34 AM
2369495b17e3	fd29247e45db	9d88ac211d4e	John Baldwin	Free OCF sessions.	Oct 30 2019, 12:31 AM
9d88ac211d4e	8d745aab711d	2a07689ce40c	John Baldwin	Fix KTLS OCF module to work again.	Oct 30 2019, 12:14 AM
2a07689ce40c	bd4eae3474ec	303f69887005	John Baldwin	klen is in bits, not bytes.	Oct 29 2019, 10:22 PM
303f69887005	e90039670d30	d0125691aea1	John Baldwin	Convert sec(4).	Oct 29 2019, 9:21 PM
d0125691aea1	8601330462c5	d70851f3ff61	John Baldwin	Fix a few more places in ccr(4) to check auth_klen.	Oct 29 2019, 7:16 PM
d70851f3ff61	e3d23539e1d1	e986fd5c1f83	John Baldwin	Update notes.	Oct 26 2019, 12:09 AM
e986fd5c1f83	e441a1ff7b9c	ee8c8538fdd0	John Baldwin	Update glxsb(4).	Oct 26 2019, 12:08 AM
ee8c8538fdd0	3607584b76a6	ac0e3f6fcba1	John Baldwin	Convert armv8 crypto.	Oct 25 2019, 11:14 PM
ac0e3f6fcba1	f8ea38ff7f77	4f38911f0047	John Baldwin	Update ktls_ocf.	Oct 25 2019, 10:43 PM
4f38911f0047	259aef52fb49	54a7b5aa4e02	John Baldwin	Update cryptodev_warn().	Oct 25 2019, 10:31 PM
54a7b5aa4e02	fd07cd60593c	bd07a4d3ef86	John Baldwin	Checkpoint notes.	Oct 25 2019, 9:47 PM
bd07a4d3ef86	d2e7f7eebdae	66eeef5a34f6	John Baldwin	Compile fixes.	Oct 18 2019, 12:18 AM
66eeef5a34f6	68147101fa50	6ae01ea20700	John Baldwin	Axe per-op key lengths. (Show More…)	Oct 17 2019, 10:24 PM
6ae01ea20700	8c4f48cc3d07	ab9ba9decffc	John Baldwin	Drop the kern.crypto.user node.	Aug 22 2019, 12:03 AM
ab9ba9decffc	09cf79a55a6d	b3f7f07a7626	John Baldwin	Use the right function to init the OPAD context.	Aug 21 2019, 11:59 PM
b3f7f07a7626	8e01fa26433f	cb88156ba95b	John Baldwin	Move crypto sysctls under kern.crypto. so they are easier to find. (Show More…)	Aug 21 2019, 11:44 PM
cb88156ba95b	ad9a88fdb293	3846766d85fc	John Baldwin	Use correct key.	Aug 20 2019, 7:45 PM
3846766d85fc	0032d2e024d9	ea7844dfcf01	John Baldwin	Add helper routines for initializing ipad/ipad auth_ctx for HMAC.	Aug 20 2019, 7:44 PM
ea7844dfcf01	9ca8c085c894	c6c0c2fa59ce	John Baldwin	Make keys passed in crp and csp const.	Aug 20 2019, 7:03 PM
c6c0c2fa59ce	ffd491aee87a	ad25474d8f9a	John Baldwin	Rename CRYPTO_BUF_IOV -> CRYPTO_BUF_UIO.	Aug 20 2019, 1:28 AM
ad25474d8f9a	c0f21c57f96a	0ba679e1d71e	John Baldwin	Convert geli(4).	Aug 20 2019, 1:19 AM
0ba679e1d71e	a5692e851e5e	2beb32aeb0ce	John Baldwin	Add a 'how' argument to crypto_getreq for M_WAITOK vs M_NOWAIT.	Aug 20 2019, 12:48 AM
2beb32aeb0ce	3759bd9b726a	01da8b61430e	John Baldwin	Convert safe(4). (Show More…)	Aug 19 2019, 11:40 PM
01da8b61430e	9911f9655399	3cba3a898d22	John Baldwin	Fix a typo.	Aug 19 2019, 11:40 PM
3cba3a898d22	7a536655904f	3a7601993835	John Baldwin	Convert padlock(4).	Aug 19 2019, 11:39 PM
3a7601993835	a5f6c4b92b42	d67bc54b5a78	John Baldwin	Convert ubsec(4). (Show More…)	Aug 19 2019, 9:31 PM
d67bc54b5a78	0c52791b0450	e2c6f15a25c5	John Baldwin	Convert kgssap_krb5. (Show More…)	Aug 19 2019, 6:50 PM
e2c6f15a25c5	a34cdd9b1840	b6a2dd554bb6	John Baldwin	Handle VERIFY_DIGEST for hash only requests in ccr.	Aug 14 2019, 9:16 PM
b6a2dd554bb6	d70d52dfed2a	9d8d65e000ce	John Baldwin	Convert hifn(4). (Show More…)	Aug 14 2019, 8:52 PM
9d8d65e000ce	8c0730107ab4	2bc0d432e06e	John Baldwin	Use crypto_session_params. (Show More…)	Aug 14 2019, 12:59 AM
2bc0d432e06e	e6325ef05ab4	2e048dbc1104	John Baldwin	Use crypto_session_params. (Show More…)	Aug 14 2019, 12:26 AM
2e048dbc1104	17dc22b654bc	bd6bfc4d9aa2	John Baldwin	Remove unused partial_digest_len.	Aug 14 2019, 12:13 AM
bd6bfc4d9aa2	33c7ec1d07af	20577c70d542	John Baldwin	Use crypto_get_params in place of some fields cached in the session struct. (Show More…)	Aug 14 2019, 12:10 AM
20577c70d542	9816976dacce	6078748d11c3	John Baldwin	Remove unused field.	Aug 13 2019, 11:51 PM
6078748d11c3	0347434cfe03	340354da358f	John Baldwin	Add a crypto_get_params() to return a const csp pointer from a session. (Show More…)	Aug 13 2019, 11:49 PM
340354da358f	20498cf14856	be158693ac46	John Baldwin	Cleanup a few things with hashes and mlen. (Show More…)	Aug 13 2019, 11:42 PM
be158693ac46	527d54a2425e	91cca11fbff6	John Baldwin	Convert ccp(4). (Show More…)	Aug 13 2019, 10:02 PM
91cca11fbff6	ddf2de03f87b	6d680b2151e2	John Baldwin	Trim an unused variable.	Aug 13 2019, 9:47 PM
6d680b2151e2	ec769501bf6d	a360c018afeb	John Baldwin	Convert blake2.	Aug 13 2019, 5:16 PM
a360c018afeb	be3d144a3c34	b4ce77ce4284	John Baldwin	Mark aesni as software in crypto_get_driverid.	Aug 13 2019, 5:00 PM
b4ce77ce4284	0dedd7a5de25	08ddcfe5a240	John Baldwin	Add a missing break to fix AEAD for ccr as well.	Aug 8 2019, 12:57 AM
08ddcfe5a240	095581ca79a1	096aa43b537b	John Baldwin	Add a missing break to fix AEAD for aesni(4).	Aug 8 2019, 12:12 AM
096aa43b537b	969ebf39dcc4	6ca44c64ac7e	John Baldwin	Fix build without INVARIANTS.	Aug 7 2019, 11:33 PM
6ca44c64ac7e	bcd75bffdf9d	a6b238edccf2	John Baldwin	Validate 'mlen' and store the final value in the session. (Show More…)	Aug 6 2019, 12:31 AM
a6b238edccf2	a64961db5bfa	15ed8d98a8d9	John Baldwin	Convert aesni(4). (Show More…)	Aug 6 2019, 12:26 AM
15ed8d98a8d9	2cc706f62f72	7332f90b77d0	John Baldwin	Update a few comments.	Aug 2 2019, 6:28 PM
7332f90b77d0	4e296917b856	fa3b1523a496	John Baldwin	Remove #include and use void * for contexts.	Aug 2 2019, 6:27 PM
fa3b1523a496	f1ab3a94027b	c43055aa1855	John Baldwin	Need to always init 'csp' in a session. (Show More…)	Aug 2 2019, 6:19 PM
c43055aa1855	f38c024f7464	1edda1141306	John Baldwin	Move the IPAD and OPAD constant arrays to the crypto.c.	Aug 2 2019, 5:59 PM
1edda1141306	ee93a714086f	d3cb65157d8e	John Baldwin	Move the cryptosoft structures to the C file.	Aug 2 2019, 5:39 PM
d3cb65157d8e	46ecc43dffbf	31b179f3f135	John Baldwin	Purge cruft from cryptodev.h.	Aug 2 2019, 5:35 PM
31b179f3f135	d6d5be974768	afd5de1588e9	John Baldwin	Change crypto_getreq() to accept a session pointer. (Show More…)	Aug 2 2019, 5:30 PM
afd5de1588e9	af341508ecf3	b823b4b7d873	John Baldwin	Trim an unused include that's marked with an XXX.	Jun 28 2019, 5:56 PM
b823b4b7d873	8c964fdfac57	dba68c2996b0	John Baldwin	Add another todo.	Jun 28 2019, 12:59 AM
dba68c2996b0	ada1b2bf0fca	95ec7c3bae75	John Baldwin	Update ccr(4) for probesession.	Jun 28 2019, 12:59 AM
95ec7c3bae75	736e4af77799	beacdfa9952a	John Baldwin	Update for the probesession changes.	Jun 28 2019, 12:20 AM
beacdfa9952a	8553395216b0	36a8b47bab51	John Baldwin	Disable modules not yet converted for now.	Jun 28 2019, 12:19 AM
36a8b47bab51	4e87e6eb0eb7	f4213ecae08d	John Baldwin	crypto_register doesn't exist anymore.	Jun 27 2019, 11:40 PM
f4213ecae08d	4333736bfd34	d9f2f28cbaa9	John Baldwin	Various compile fixes.	Jun 27 2019, 11:40 PM
d9f2f28cbaa9	2c601d1f68cd	5e1517208feb	John Baldwin	Some more cleanups.	Jun 12 2019, 7:45 PM
5e1517208feb	026abd7fb96b	f0ff5013333e	John Baldwin	Finish first pass of crypto_drivers stuff. (Show More…)	Jun 12 2019, 7:34 PM
f0ff5013333e	f1ef2a2f22ad	a7cb318b70ae	John Baldwin	Checkpoint reworking crypto_drivers. (Show More…)	Jun 12 2019, 1:13 AM
a7cb318b70ae	d7ad19bda434	64694ce75bbd	John Baldwin	Retire an unused constant.	Jun 12 2019, 12:08 AM
64694ce75bbd	36514c38287f	6a958696d072	John Baldwin	Be clear that sessions are only for sym crypto.	Jun 12 2019, 12:01 AM
6a958696d072	b79e79f4cc25	a35681ff4317	John Baldwin	Flesh out docs for cryptodev_if.m methods.	Jun 12 2019, 12:00 AM
a35681ff4317	2ca08bddab43	4fa65d1b52f7	John Baldwin	Start on probesession.	Jun 11 2019, 12:15 AM
4fa65d1b52f7	99b1fae6efea	1e457dbfc591	John Baldwin	Be more explicit about setting crp_op. (Show More…)	Apr 30 2019, 9:23 PM
1e457dbfc591	9d13f87e173e	9e04d99ba864	John Baldwin	Clear thash for CCM.	Apr 30 2019, 7:27 PM
9e04d99ba864	f0acbe287c11	3e98ea10d80f	John Baldwin	CCM-related compile fixes.	Apr 25 2019, 11:20 PM
3e98ea10d80f	9cb924c6f4f0	4630ef6a4d03	John Baldwin	Explicitly reject F_IV_GENERATE for GMAC/CBC_MAC digests. (Show More…)	Apr 25 2019, 11:00 PM
4630ef6a4d03	e5f19bc5fab7	067d0d4966c1	John Baldwin	Remove some impossible checks.	Apr 25 2019, 10:56 PM
067d0d4966c1	14dc249f6fd0	aabc511a4a8d	John Baldwin	More CCM cleanups.	Apr 25 2019, 10:53 PM
aabc511a4a8d	bc965f304112	9feab92e7981	John Baldwin	Minor cleanups for CCM.	Apr 25 2019, 10:45 PM
9feab92e7981	0209a0143ea1	9b60040a7f86	John Baldwin	Update with current testing on ipsec.	Apr 25 2019, 9:00 PM
9b60040a7f86	69a0586be510	5a3f1653aaec	John Baldwin	Drop old #if 0'd GMAC bits.	Mar 25 2019, 9:58 PM
5a3f1653aaec	e2c9b330e379	283f7175a166	John Baldwin	Use correct thash for GMAC with 192 and 256 bit keys.	Mar 25 2019, 9:57 PM
283f7175a166	a52e261c163f	ed7cc2cab6ba	John Baldwin	The existing /dev/crypto never supported GMAC. (Show More…)	Mar 25 2019, 9:10 PM
ed7cc2cab6ba	a79512fbc22e	bc94ed5d14d7	John Baldwin	Set csp_ivlen for GMAC requests. (Show More…)	Mar 25 2019, 9:05 PM
bc94ed5d14d7	3903c5f501aa	f3b7cc61dce2	John Baldwin	Don't save a copy of the digest/tag for esp_input. (Show More…)	Mar 22 2019, 5:11 PM
f3b7cc61dce2	c164122ff699	106086031305	John Baldwin	Add missing break for compression.	Mar 21 2019, 11:57 PM
106086031305	d931e06fe6ed	c0358589fbd7	John Baldwin	Don't set IV parameters for NULL cipher which has no IV.	Mar 21 2019, 10:45 PM
c0358589fbd7	f324eccbfdd2	b56a24d80799	John Baldwin	Trailing whitespace.	Mar 21 2019, 10:38 PM
b56a24d80799	a8aff7024fe0	b18b06fbebe4	John Baldwin	GCM shouldn't require a MAC algorithm anymore.	Mar 21 2019, 10:30 PM
b18b06fbebe4	22da4ec869ab	1c3e12ead3cf	John Baldwin	Add GMAC tests. (Show More…)	Mar 21 2019, 10:28 PM
1c3e12ead3cf	77274b3fdb1d	d6515a4a63ba	John Baldwin	Permit a zero length IV for the NULL cipher.	Mar 21 2019, 9:58 PM
d6515a4a63ba	1c68ddf189af	d6d55cf19466	John Baldwin	More updates for GMAC not using legacy algorithm constants.	Mar 21 2019, 9:57 PM
d6d55cf19466	62e4b3362812	57eac7b5eeb1	John Baldwin	The GMAC hash xforms now use CRYPTO_AES_NIST_GMAC.	Mar 6 2019, 12:32 AM
57eac7b5eeb1	c0f14f62ca67	a218740347b2	John Baldwin	Permit an IV size of 16 for AES-XTS for backwards compat.	Mar 5 2019, 11:13 PM
a218740347b2	b69562fcef01	4eb456f5a83b	John Baldwin	Fix AAD length in esp_output.	Mar 5 2019, 10:49 PM
4eb456f5a83b	04a27c74ce1f	88ee7d29c286	John Baldwin	Apply hash functions to AAD region before payload. (Show More…)	Mar 5 2019, 10:46 PM
88ee7d29c286	504672af427e	8d6ec611f0a6	John Baldwin	Require crp_digest_start of 0 for CSP_MODE_CIPHER.	Mar 5 2019, 10:46 PM
8d6ec611f0a6	f259a463808d	8b8751ef3691	John Baldwin	Compute digests for CSP_MODE_ETA for the aead ioctl. (Show More…)	Mar 5 2019, 10:44 PM
8b8751ef3691	21fc0d3096aa	45f4d4bb4302	John Baldwin	Fix AES-XTS for ccr. (Show More…)	Mar 4 2019, 10:45 PM
45f4d4bb4302	912799f5579c	534935d93d04	John Baldwin	Trim trailing whitespace.	Mar 4 2019, 10:08 PM
534935d93d04	1cd7bd3aeea5	62d93f3018fd	John Baldwin	Trivial fixes for ccr(4). (Show More…)	Feb 28 2019, 1:13 AM
62d93f3018fd	7d42db975d4f	094e13c36eac	John Baldwin	Fixes for sw crypto and hashes. (Show More…)	Feb 27 2019, 11:48 PM
094e13c36eac	68b04e169974	7ba7747e1a3c	John Baldwin	Don't fail driver_suitable when csp_cipher_alg is 0.	Feb 27 2019, 11:19 PM
7ba7747e1a3c	edc066194954	68e33bb6a322	John Baldwin	Switch algorithm constant for gmac thash's to remove use_gmac variable.	Feb 27 2019, 8:54 PM
68e33bb6a322	aa2c3e7c5abc	b2d9a23f818b	John Baldwin	Support GMAC requests via /dev/crypto. (Show More…)	Feb 14 2019, 8:34 PM
b2d9a23f818b	382787abbadb	29b57739a8ac	John Baldwin	Clear thash for GCM to avoid setting auth parameters.	Feb 14 2019, 7:59 PM
29b57739a8ac	7a09ed11823d	421498b820ee	John Baldwin	Set csp_ivlen.	Feb 14 2019, 1:00 AM
421498b820ee	25c783e6a664	93514349c284	John Baldwin	Update crypto_contiguous_subsegment() to take the full crp.	Feb 14 2019, 12:36 AM
93514349c284	c5a5627ec21c	d4dbfa7f9d49	John Baldwin	Update for SCMD constant unification.	Feb 14 2019, 12:36 AM
d4dbfa7f9d49	99e08da257f7	fa43f7e23611	John Baldwin	Another note about IV lengths.	Oct 18 2018, 1:11 AM
fa43f7e23611	8aa370a3a549	2fa68f1163d8	John Baldwin	Update the ccr(4) driver for the flattened structures. (Show More…)	Oct 18 2018, 1:03 AM
2fa68f1163d8	d5761d7e2151	8a8e738216ff	John Baldwin	Add an assertion that GCM always uses an explicit IV.	Oct 18 2018, 12:58 AM
8a8e738216ff	86104ceaba2c	7750b22142f3	John Baldwin	More thoughts.	Oct 17 2018, 10:39 PM
7750b22142f3	1b28939f1d21	eceec958ab5f	John Baldwin	Use explicit key lengths for re-keys.	Oct 16 2018, 12:21 AM
eceec958ab5f	615a3ca2ff6b	e6aab4e7f842	John Baldwin	Drop csp_iv[].	Oct 15 2018, 11:59 PM
e6aab4e7f842	775178151acb	9ec35aadbd6b	John Baldwin	Use a plain buf instead of an iov/uio for /dev/crypto. (Show More…)	Oct 15 2018, 11:16 PM
9ec35aadbd6b	afcd9fa43dc6	c6216ff8d96d	John Baldwin	Update cryptodev for flattened session parameters and descriptors.	Oct 15 2018, 11:03 PM
c6216ff8d96d	336405890d60	6053aefc0dbf	John Baldwin	Implement EtA for cryptosoft.	Oct 15 2018, 9:10 PM
6053aefc0dbf	3066df2b0ca0	d5c4fd25e4e9	John Baldwin	Remove unused variables to fix build.	Oct 15 2018, 8:48 PM
d5c4fd25e4e9	edfecd3b2014	ddec0b20ad13	John Baldwin	Checkpoint WIP on updating cryptosoft. (Show More…)	Oct 13 2018, 12:20 AM
ddec0b20ad13	cb7b5e53477e	b4cd885a9eb0	John Baldwin	More note updates including GMAC in the new world order.	Oct 13 2018, 12:12 AM
b4cd885a9eb0	af0aa785736f	37bb661f2ee1	John Baldwin	Compile fix after csp_ivlen change.	Oct 13 2018, 12:11 AM
37bb661f2ee1	1d8269299921	41ba412efb4d	John Baldwin	Set csp_ivlen for IPsec ESP.	Oct 12 2018, 10:54 PM
41ba412efb4d	a2a6ec3d43b9	425708a8e694	John Baldwin	Rename csp_cipher_ivlen to csp_ivlen since it is also used for GMAC. (Show More…)	Oct 12 2018, 10:53 PM
425708a8e694	0af92b76b268	595a4044df55	John Baldwin	Add helpers for evaluating crp_op.	Oct 12 2018, 10:42 PM
595a4044df55	a44e2e18c006	62ef541c22e3	John Baldwin	Only permit VERIFY with DECRYPT for AEAD.	Oct 12 2018, 6:29 PM
62ef541c22e3	53010795c53c	8129095e6b40	John Baldwin	Get crypto.c to compile. (Show More…)	Oct 12 2018, 5:17 PM
8129095e6b40	1d7eba6bc54a	d343392339ae	John Baldwin	Add another TODO.	Oct 12 2018, 5:16 PM
d343392339ae	81d7f62f7b68	3894398d3556	John Baldwin	Change crypto_apply/copy* to take the 'crp' in place of buf and flags. (Show More…)	Oct 12 2018, 4:36 PM
3894398d3556	10dad837b835	ff75b68b2c97	John Baldwin	Update for IPsec compression for flattened structures.	Oct 12 2018, 12:12 AM
ff75b68b2c97	b5b5d7392e42	99ffc64e4322	John Baldwin	Add OP constants for compression. (Show More…)	Oct 12 2018, 12:06 AM
99ffc64e4322	6c38f437a0d5	ee03ed4a40ba	John Baldwin	Remember to set COMPUTE_DIGEST for ESP output with auth.	Oct 12 2018, 12:06 AM
ee03ed4a40ba	ab006d1a0cd0	e6af89c58c27	John Baldwin	Update IPsec ESP for the flattened structure changes.	Oct 11 2018, 11:47 PM
e6af89c58c27	eb275d7a92c5	400f5d7c45ff	John Baldwin	Added some basic sanity checks on csp's and crp's.	Oct 11 2018, 11:45 PM
400f5d7c45ff	a10e4abe9600	48f97b2e3fb6	John Baldwin	Checkpoint some more notes.	Oct 11 2018, 11:44 PM
48f97b2e3fb6	5363c045aea8	a4ef289b361e	John Baldwin	Add a compression mode and re-enable crp_ilen/olen.	Oct 11 2018, 11:42 PM
a4ef289b361e	9c02f1e6d877	89f85b40ffb4	John Baldwin	Note that GENERATE implies storing.	Oct 11 2018, 9:51 PM
89f85b40ffb4	580bec7d644d	1099df44e80f	John Baldwin	Turn compute vs verify into a flag. (Show More…)	Oct 11 2018, 8:58 PM
1099df44e80f	27ad2fcf8140	d82df95e4423	John Baldwin	Update IPsec AH for the flattened structure changes.	Oct 11 2018, 8:53 PM
d82df95e4423	34a0603a4aa9	7952595f405c	John Baldwin	Initial thoughts / TODOs.	Oct 11 2018, 8:52 PM
7952595f405c	35582e0c08e1	6e6ecd2aa11a	John Baldwin	First version of new structures for sessions and ops. (Show More…)	Oct 11 2018, 8:40 PM