strongswan.git
4 years agoike-init: Fix error handling if nonceg can't be created
Tobias Brunner [Tue, 5 May 2015 07:39:11 +0000 (09:39 +0200)]
ike-init: Fix error handling if nonceg can't be created

Returning FAILED in the constructor is wrong, but returning NULL doesn't work
either as it's currently assumed tasks always can be created.
Therefore, delay this check until we actually try to allocate a nonce.

4 years agoike-init: Fix compiler warning
Tobias Brunner [Tue, 5 May 2015 07:37:42 +0000 (09:37 +0200)]
ike-init: Fix compiler warning

4 years agoswanctl: Fix --uri option
Martin Willi [Tue, 5 May 2015 08:37:34 +0000 (10:37 +0200)]
swanctl: Fix --uri option

As we now pass the vici connection to the command dispatcher callback, we can't
parse the --uri option to create the connection from the same callback. Instead
pre-process the common command options in a separate loop, and ignore the same
options while processing the actual command.

4 years agoMerge branch 'tkm-fixes'
Tobias Brunner [Mon, 4 May 2015 16:19:13 +0000 (18:19 +0200)]
Merge branch 'tkm-fixes'

This fixes several issues with charon-tkm (e.g. nonce context ID leaks during
rekey collisions).

4 years agocharon-tkm: Also store local SPI in SAD
Adrian-Ken Rueegsegger [Tue, 21 Apr 2015 14:34:06 +0000 (16:34 +0200)]
charon-tkm: Also store local SPI in SAD

4 years agoike-init: Make nonceg a member of ike_init struct
Reto Buerki [Thu, 23 Apr 2015 09:19:24 +0000 (11:19 +0200)]
ike-init: Make nonceg a member of ike_init struct

This allows to control the life-cycle of a nonce in the context of the
ike init task. In the TKM use-case the nonce generator cannot be
destroyed before the ike init task is finalized, otherwise the created
nonce is detected as stale.

4 years agochild-create: Make nonceg a member of child_create struct
Reto Buerki [Thu, 23 Apr 2015 06:46:18 +0000 (08:46 +0200)]
child-create: Make nonceg a member of child_create struct

This allows to control the life-cycle of a nonce in the context of the
child create task. In the TKM use-case, it is required to reset the
nonce context if the created nonce is not consumed. This happens if the
child SA negotiation fails and it is detected before the SA is
established via the TKM kernel plugin (i.e. rekey collision).

4 years agocharon-tkm: Reset stale nonce contexts
Reto Buerki [Thu, 23 Apr 2015 07:41:12 +0000 (09:41 +0200)]
charon-tkm: Reset stale nonce contexts

If the nonce generator detects a stale nonce upon destroy(), it resets
the context in the TKM and releases associated resources in the ID
manager and chunk map.

Also, do not acquire the nonce context ID in tkm_nonceg_create function
but rather when the nonce is actually created by get_nonce().

The nonces created with get_nonce must also be registered in the chunk map.

4 years agocharon-tkm: Drop unneeded nonceg get_id function
Reto Buerki [Thu, 23 Apr 2015 08:06:49 +0000 (10:06 +0200)]
charon-tkm: Drop unneeded nonceg get_id function

4 years agocharon-tkm: Remove ESA nonce mappings from chunk map
Adrian-Ken Rueegsegger [Wed, 22 Apr 2015 14:37:23 +0000 (16:37 +0200)]
charon-tkm: Remove ESA nonce mappings from chunk map

4 years agocharon-tkm: Drop obsolete TKM_LIMIT define
Reto Buerki [Wed, 22 Apr 2015 13:52:43 +0000 (15:52 +0200)]
charon-tkm: Drop obsolete TKM_LIMIT define

4 years agocharon-tkm: Select other ESA if any is present upon deletion
Adrian-Ken Rueegsegger [Wed, 8 Apr 2015 16:56:23 +0000 (18:56 +0200)]
charon-tkm: Select other ESA if any is present upon deletion

In the case that multiple ESAs exist (e.g. rekey collision) for a
security policy, make sure to select one of the remaining ESAs.

4 years agocharon-tkm: Add get_other_esa_id function to TKM kernel SAD
Adrian-Ken Rueegsegger [Wed, 8 Apr 2015 16:54:54 +0000 (18:54 +0200)]
charon-tkm: Add get_other_esa_id function to TKM kernel SAD

The function gets the ESA id for another entry associated with the same
security policy as the specified ESA.

4 years agocharon-tkm: Only skip creation of first child SA
Adrian-Ken Rueegsegger [Wed, 8 Apr 2015 16:11:20 +0000 (18:11 +0200)]
charon-tkm: Only skip creation of first child SA

Use the new is_first boolean parameter of the
ALERT_KEEP_ON_CHILD_SA_FAILURE alert to determine if the failure was
caused by the first CHILD SA.

4 years agoAdd bool param to ALERT_KEEP_ON_CHILD_SA_FAILURE alert
Adrian-Ken Rueegsegger [Wed, 8 Apr 2015 16:06:51 +0000 (18:06 +0200)]
Add bool param to ALERT_KEEP_ON_CHILD_SA_FAILURE alert

The parameter indicates if the alert is raised upon failure to establish
the first CHILD SA of an IKE SA.

4 years agocharon-tkm: Fix SAD insertion when adding ESA
Adrian-Ken Rueegsegger [Wed, 8 Apr 2015 17:52:44 +0000 (19:52 +0200)]
charon-tkm: Fix SAD insertion when adding ESA

Commit f5fc592 added the reqid to the SAD. The insert call swapped the
order of the esa_id and reqid parameters.

4 years agovici: Default to certificate subject for identity
Timo Teräs [Wed, 29 Apr 2015 15:13:19 +0000 (18:13 +0300)]
vici: Default to certificate subject for identity

If id is not specified and certificate authentication is used, use the
certificate subject name as identity. Simplifies configuration as in most cases
this is the right thing to do.

Signed-off-by: Timo Teräs <timo.teras@iki.fi>
4 years agoswanctl: Implement monitoring of IKE_SA and CHILD_SA changes
Timo Teräs [Wed, 29 Apr 2015 15:13:18 +0000 (18:13 +0300)]
swanctl: Implement monitoring of IKE_SA and CHILD_SA changes

Signed-off-by: Timo Teräs <timo.teras@iki.fi>
4 years agovici: Add support for ike_sa and child_sa updown notifications
Timo Teräs [Wed, 29 Apr 2015 15:13:17 +0000 (18:13 +0300)]
vici: Add support for ike_sa and child_sa updown notifications

Useful for monitoring and management purposes.

Signed-off-by: Timo Teräs <timo.teras@iki.fi>
4 years agovici: Add function to test if an event should be generated
Timo Teräs [Wed, 29 Apr 2015 15:13:16 +0000 (18:13 +0300)]
vici: Add function to test if an event should be generated

Useful to avoid generating vici messages if they are not needed and their
generation is heavy operation.

Signed-off-by: Timo Teräs <timo.teras@iki.fi>
4 years agoswanctl: Add missing unit in install-time log
Romain Francoise [Sat, 2 May 2015 19:10:56 +0000 (21:10 +0200)]
swanctl: Add missing unit in install-time log

4 years agoinit: Don't build/install legacy systemd service if charon isn't built
Romain Francoise [Fri, 1 May 2015 20:24:38 +0000 (22:24 +0200)]
init: Don't build/install legacy systemd service if charon isn't built

If the user configures the build to only include charon-systemd the
"legacy" systemd service isn't useful, so skip its generation and
installation.

4 years agocrypt-burn: free() associated data after test
Martin Willi [Mon, 4 May 2015 11:24:33 +0000 (13:24 +0200)]
crypt-burn: free() associated data after test

4 years agotesting: Updated carol's certificate from research CA and dave's certificate from... 5.3.1dr1
Andreas Steffen [Sun, 26 Apr 2015 14:52:06 +0000 (16:52 +0200)]
testing: Updated carol's certificate from research CA and dave's certificate from sales CA

4 years agotesting: Wait for DH crypto tests to complete
Andreas Steffen [Sun, 26 Apr 2015 09:51:49 +0000 (11:51 +0200)]
testing: Wait for DH crypto tests to complete

4 years agoimv_policy_manager: Added capability to execute an allow or block shell command string
Andreas Steffen [Sun, 26 Apr 2015 08:55:24 +0000 (10:55 +0200)]
imv_policy_manager: Added capability to execute an allow or block shell command string

4 years agotesting: Migration of KVM framework to Linux 4.x kernel
Andreas Steffen [Sat, 25 Apr 2015 16:05:00 +0000 (18:05 +0200)]
testing: Migration of KVM framework to Linux 4.x kernel

4 years agoVersion bump to 5.3.1dr1
Andreas Steffen [Fri, 24 Apr 2015 09:35:42 +0000 (11:35 +0200)]
Version bump to 5.3.1dr1

4 years agoFixed PB-TNC directionality debug message
Andreas Steffen [Fri, 24 Apr 2015 09:16:16 +0000 (11:16 +0200)]
Fixed PB-TNC directionality debug message

4 years agoike-vendor: Add some Microsoft vendor IDs
Tobias Brunner [Tue, 21 Apr 2015 13:29:46 +0000 (15:29 +0200)]
ike-vendor: Add some Microsoft vendor IDs

4 years agoapidoc: Fix rebuild in out-of-tree builds
Tobias Brunner [Mon, 20 Apr 2015 15:40:52 +0000 (17:40 +0200)]
apidoc: Fix rebuild in out-of-tree builds

4 years agoleak-detective: Use passed callback to report leaks
Tobias Brunner [Mon, 20 Apr 2015 09:19:52 +0000 (11:19 +0200)]
leak-detective: Use passed callback to report leaks

This prevented `stroke memusage` from reporting the leaks on the
console.  Instead, they were sent to the callbacks set up by libstrongswan.

Fixes a426851f6362 ("leak-detective: Use callback functions to report
leaks and usage information").

4 years agoopenssl: Don't refer to EVP_des_ecb() if OpenSSL is built without DES support
Tobias Brunner [Fri, 17 Apr 2015 15:34:22 +0000 (17:34 +0200)]
openssl: Don't refer to EVP_des_ecb() if OpenSSL is built without DES support

While DES-ECB is not registered by the plugin in this case (so the
function will never actually be called), the compiler still warns
about the implicitly declared function.

4 years agoapidoc: Fix make target dependency find precedence
Martin Willi [Thu, 16 Apr 2015 15:10:42 +0000 (17:10 +0200)]
apidoc: Fix make target dependency find precedence

4 years agoMerge branch 'utils-split'
Martin Willi [Thu, 16 Apr 2015 14:50:27 +0000 (16:50 +0200)]
Merge branch 'utils-split'

Split up the almighty utils.[ch] to separate files in the utils/utils subfolder.
These are not meant to include manually, but bring back some order to all
this functionality included through utils.h.

Additionally give some love to apidoc generation.

4 years agoapidoc: Conditionally run doxygen if any header/Markdown files have changed
Martin Willi [Thu, 16 Apr 2015 12:37:16 +0000 (14:37 +0200)]
apidoc: Conditionally run doxygen if any header/Markdown files have changed

4 years agoapidoc: Set QUIET to YES, suppressing any parsing/generating status output
Martin Willi [Thu, 16 Apr 2015 11:19:59 +0000 (13:19 +0200)]
apidoc: Set QUIET to YES, suppressing any parsing/generating status output

As WARNING messages still get printed, this makes spotting any warnings much
simpler.

4 years agoapidoc: Enable documentation of static functions
Martin Willi [Thu, 16 Apr 2015 11:14:06 +0000 (13:14 +0200)]
apidoc: Enable documentation of static functions

As we scan for header files only, this does not affect any local functions,
but documents any static inlines we define in header files.

4 years agostrerror: Move to its own Doxygen subgroup
Martin Willi [Wed, 15 Apr 2015 15:06:57 +0000 (17:06 +0200)]
strerror: Move to its own Doxygen subgroup

4 years agoutils: Clean up includes
Martin Willi [Wed, 15 Apr 2015 15:03:47 +0000 (17:03 +0200)]
utils: Clean up includes

4 years agoalign: Move min/max/padding/alignment functions to separate files
Martin Willi [Wed, 15 Apr 2015 14:59:25 +0000 (16:59 +0200)]
align: Move min/max/padding/alignment functions to separate files

4 years agotime: Move time related functions to separate files
Martin Willi [Wed, 15 Apr 2015 14:52:19 +0000 (16:52 +0200)]
time: Move time related functions to separate files

4 years agoobject: Move OO programming helper macros to a separate header file
Martin Willi [Wed, 15 Apr 2015 14:38:33 +0000 (16:38 +0200)]
object: Move OO programming helper macros to a separate header file

4 years agostatus: Move status_t type and functions to separate files
Martin Willi [Wed, 15 Apr 2015 14:34:23 +0000 (16:34 +0200)]
status: Move status_t type and functions to separate files

4 years agopath: Move path related utility functions to separate files
Martin Willi [Wed, 15 Apr 2015 14:29:18 +0000 (16:29 +0200)]
path: Move path related utility functions to separate files

4 years agotty: Move tty related functions to separate files
Martin Willi [Wed, 15 Apr 2015 14:20:29 +0000 (16:20 +0200)]
tty: Move tty related functions to separate files

4 years agomemory: Move memory manipulation related functions to separate files
Martin Willi [Wed, 15 Apr 2015 14:15:32 +0000 (16:15 +0200)]
memory: Move memory manipulation related functions to separate files

4 years agostring: Move string related utility functions to separate files
Martin Willi [Wed, 15 Apr 2015 14:05:54 +0000 (16:05 +0200)]
string: Move string related utility functions to separate files

4 years agobyteorder: Move byte order related functions to separate header file
Martin Willi [Wed, 15 Apr 2015 13:58:32 +0000 (15:58 +0200)]
byteorder: Move byte order related functions to separate header file

4 years agotypes: Use generic type definitions to separate header file
Martin Willi [Wed, 15 Apr 2015 13:55:33 +0000 (15:55 +0200)]
types: Use generic type definitions to separate header file

4 years agoatomics: Move atomics/recounting support to separate files
Martin Willi [Wed, 15 Apr 2015 13:48:17 +0000 (15:48 +0200)]
atomics: Move atomics/recounting support to separate files

4 years agounit-tests: Further increase the test vector testing timeout
Martin Willi [Thu, 16 Apr 2015 08:15:13 +0000 (10:15 +0200)]
unit-tests: Further increase the test vector testing timeout

Some build bots running make check seem to have longer for the DH testing.

4 years agotest-vectors: Define test vector symbols as extern
Martin Willi [Thu, 16 Apr 2015 07:38:14 +0000 (09:38 +0200)]
test-vectors: Define test vector symbols as extern

We don't actually define a vector, but only prototype the test vector
implemented in a different file. GCC uses the correct symbol during testing,
but clang correctly complains about duplicated symbols during linking.

4 years agoFix years in some copyright statements
Tobias Brunner [Thu, 16 Apr 2015 07:21:00 +0000 (09:21 +0200)]
Fix years in some copyright statements

4 years agoaesni: Fix doxygen groups
Martin Willi [Wed, 15 Apr 2015 15:29:56 +0000 (17:29 +0200)]
aesni: Fix doxygen groups

4 years agoMerge branch 'dh-test-vectors'
Martin Willi [Wed, 15 Apr 2015 12:44:33 +0000 (14:44 +0200)]
Merge branch 'dh-test-vectors'

Add a Diffie-Hellman backend test method, a set of test vectors and implement
testing of the gmp, openssl and gcrypt DH backend.

4 years agokernel-netlink: Don't mangle verbosity during test initialization
Martin Willi [Tue, 14 Apr 2015 07:34:09 +0000 (09:34 +0200)]
kernel-netlink: Don't mangle verbosity during test initialization

We now properly manage thread verbosity in the test framework, and don't need
to silence thread spawning messages.

4 years agounit-tests: Set test verbosity just after test suite loading
Martin Willi [Tue, 14 Apr 2015 07:26:17 +0000 (09:26 +0200)]
unit-tests: Set test verbosity just after test suite loading

We see any plugin startup messages during suite configuration, where
initialization is called once to query plugin features. No need to be verbose
and show these messages once again in the first test.

4 years agocrypto-factory: Remove obsolete transform testing functions
Martin Willi [Mon, 13 Apr 2015 16:25:27 +0000 (18:25 +0200)]
crypto-factory: Remove obsolete transform testing functions

4 years agounit-tests: Use progressive testing of transforms with test vectors
Martin Willi [Mon, 13 Apr 2015 16:23:58 +0000 (18:23 +0200)]
unit-tests: Use progressive testing of transforms with test vectors

This allows us to show which transform from which plugin failed. Also, we use
the new cleanup handler functionality that allows proper deinitialization on
failure or timeout.

4 years agotransform: Add a getter for the enum_names for a specific transform type
Martin Willi [Mon, 13 Apr 2015 16:23:25 +0000 (18:23 +0200)]
transform: Add a getter for the enum_names for a specific transform type

4 years agoenum-names: Fail gracefully when passing a NULL value as enum names
Martin Willi [Mon, 13 Apr 2015 16:22:49 +0000 (18:22 +0200)]
enum-names: Fail gracefully when passing a NULL value as enum names

4 years agocrypto-factory: Add enumerator method to support individual transform testing
Martin Willi [Mon, 13 Apr 2015 16:21:53 +0000 (18:21 +0200)]
crypto-factory: Add enumerator method to support individual transform testing

4 years agounit-tests: Invoke all registered thread cleanup handlers on test failure
Martin Willi [Tue, 14 Apr 2015 06:59:58 +0000 (08:59 +0200)]
unit-tests: Invoke all registered thread cleanup handlers on test failure

If a test fails in a timeout or a test failure, longjmp() is used to restore
the thread context and handle test failure. However, there might be unreleased
resources, namely locks, which prevent the library to clean up properly after
finishing the test.

By using thread cleanup handlers, we can release any test subject internal or
test specific external resources on test failure. We do so by calling all
registered cleanup handlers.

4 years agothread: Add a function to pop and call all registered cleanup handlers
Martin Willi [Tue, 14 Apr 2015 06:59:01 +0000 (08:59 +0200)]
thread: Add a function to pop and call all registered cleanup handlers

4 years agothread: Don't acquire lock for thread_cleanup_push/pop
Martin Willi [Wed, 15 Apr 2015 08:53:27 +0000 (10:53 +0200)]
thread: Don't acquire lock for thread_cleanup_push/pop

This is called only by the thread for its own thread_t, and does not need
synchronization.

4 years agotravis: Run a gcrypt test with leak-detective
Martin Willi [Mon, 13 Apr 2015 10:13:56 +0000 (12:13 +0200)]
travis: Run a gcrypt test with leak-detective

And also enable gcrypt in the all tests with leak-detective enabled.

4 years agogcrypt: Explicitly initialize RNG backend to allocate static data
Martin Willi [Mon, 13 Apr 2015 15:12:49 +0000 (17:12 +0200)]
gcrypt: Explicitly initialize RNG backend to allocate static data

The libgcrypt RNG implementation uses static buffer allocation which it does
not free. There is no symbol we can catch in leak-detective, hence we explicitly
initialize the RNG during the whitelisted gcrypt_plugin_create() function.

4 years agoleak-detective: Whitelist gcrypt_plugin_create()
Martin Willi [Mon, 13 Apr 2015 10:02:07 +0000 (12:02 +0200)]
leak-detective: Whitelist gcrypt_plugin_create()

gcry_check_version() does not free statically allocated resources. However,
we can't whitelist it in some versions, as it is not a resolvable symbol name.
Instead, whitelist our own plugin constructor function.

4 years agounit-tests: Add a TESTS_PLUGINS environment variable
Martin Willi [Mon, 13 Apr 2015 09:36:05 +0000 (11:36 +0200)]
unit-tests: Add a TESTS_PLUGINS environment variable

This is often more convenient than specifying plugins in a configuration file.

4 years agounit-tests: Use a larger timeout for test vector testing
Martin Willi [Mon, 13 Apr 2015 10:27:35 +0000 (12:27 +0200)]
unit-tests: Use a larger timeout for test vector testing

As we test DH calculations this now takes more time. If multiple DH backends
are enabled, we likely hit the default test timeout.

4 years agogcrypt: Support setting private value and testing of DH backend
Martin Willi [Mon, 13 Apr 2015 10:12:09 +0000 (12:12 +0200)]
gcrypt: Support setting private value and testing of DH backend

4 years agoopenssl: Support setting ECDH private values
Martin Willi [Thu, 9 Apr 2015 13:05:16 +0000 (15:05 +0200)]
openssl: Support setting ECDH private values

4 years agoopenssl: Support setting private Diffie-Hellman values
Martin Willi [Mon, 13 Apr 2015 12:48:23 +0000 (14:48 +0200)]
openssl: Support setting private Diffie-Hellman values

4 years agogmp: Support setting Diffie-Hellman private values
Martin Willi [Thu, 9 Apr 2015 12:59:04 +0000 (14:59 +0200)]
gmp: Support setting Diffie-Hellman private values

4 years agotest-vectors: Add DH vectors for Brainpool groups
Martin Willi [Thu, 9 Apr 2015 12:48:35 +0000 (14:48 +0200)]
test-vectors: Add DH vectors for Brainpool groups

4 years agotest-vectors: Add DH vectors for ECDH groups
Martin Willi [Thu, 9 Apr 2015 12:20:47 +0000 (14:20 +0200)]
test-vectors: Add DH vectors for ECDH groups

4 years agotest-vectors: Add DH vectors for subgroup MODP groups
Martin Willi [Thu, 9 Apr 2015 11:35:10 +0000 (13:35 +0200)]
test-vectors: Add DH vectors for subgroup MODP groups

4 years agotest-vectors: Add DH vectors for normal MODP groups
Martin Willi [Thu, 9 Apr 2015 10:17:13 +0000 (12:17 +0200)]
test-vectors: Add DH vectors for normal MODP groups

4 years agotest-vectors: Support testing DH groups
Martin Willi [Thu, 9 Apr 2015 10:16:25 +0000 (12:16 +0200)]
test-vectors: Support testing DH groups

4 years agocrypto-tester: Support testing DH groups using DH test vectors
Martin Willi [Thu, 9 Apr 2015 08:47:03 +0000 (10:47 +0200)]
crypto-tester: Support testing DH groups using DH test vectors

4 years agodiffie-hellman: Introduce an optional setter for the private value
Martin Willi [Thu, 9 Apr 2015 08:02:24 +0000 (10:02 +0200)]
diffie-hellman: Introduce an optional setter for the private value

This allows us to work with deterministic values for testing purposes.

4 years agoMerge branch 'aesni'
Martin Willi [Wed, 15 Apr 2015 12:33:45 +0000 (14:33 +0200)]
Merge branch 'aesni'

Add an aesni plugin providing CBC, CTR, XCBC, CMAC, CCM and GCM modes for
for AES-128/192/256 based on AES-NI/PCLMULQDQ intrinsics.

4 years agoNEWS: Add aesni plugin news
Martin Willi [Tue, 31 Mar 2015 16:09:22 +0000 (18:09 +0200)]
NEWS: Add aesni plugin news

4 years agoaesni: Avoid loading AES/GHASH round keys into local variables
Martin Willi [Tue, 14 Apr 2015 10:38:18 +0000 (12:38 +0200)]
aesni: Avoid loading AES/GHASH round keys into local variables

The performance impact is not measurable, as the compiler loads these variables
in xmm registers in unrolled loops anyway.

However, we avoid loading these sensitive keys onto the stack. This happens for
larger key schedules, where the register count is insufficient. If that key
material is not on the stack, we can avoid to wipe it explicitly after
crypto operations.

4 years agoaesni: Align all class instances to 16 byte boundaries
Martin Willi [Tue, 31 Mar 2015 15:28:12 +0000 (17:28 +0200)]
aesni: Align all class instances to 16 byte boundaries

While the required members are aligned in the struct as required, on 32-bit
platforms the allocator aligns the structures itself to 8 bytes only. This
results in non-aligned struct members, and invalid memory accesses.

4 years agoutils: Provide aligning variants of INIT/INIT_EXTRA macros
Martin Willi [Tue, 31 Mar 2015 15:27:30 +0000 (17:27 +0200)]
utils: Provide aligning variants of INIT/INIT_EXTRA macros

4 years agounit-tests: Pass stringyfied assertion statement as non-format string argument
Martin Willi [Wed, 15 Apr 2015 10:02:45 +0000 (12:02 +0200)]
unit-tests: Pass stringyfied assertion statement as non-format string argument

If the assertion contains a modulo (%) operation, test_fail_msg() handles
this as printf() format specifier. Pass the assertion string as argument for
an explicit "%s" in the format string, instead.

4 years agoutils: Add malloc/free wrappers returning aligned data
Martin Willi [Tue, 31 Mar 2015 15:25:05 +0000 (17:25 +0200)]
utils: Add malloc/free wrappers returning aligned data

While we could use posix_memalign(3), that is not fully portable. Further, it
might be difficult on some platforms to properly catch it in leak-detective,
which results in invalid free()s when releasing such memory.

We instead use a simple wrapper, which allocates larger data, and saves the
padding size in the allocated header. This requires that memory is released
using a dedicated function.

To reduce the risk of invalid free() when working on corrupted data, we fill up
all the padding with the padding length, and verify it during free_align().

4 years agoaesni: Calculate GHASH for 4 blocks of associated data in parallel
Martin Willi [Tue, 31 Mar 2015 08:57:04 +0000 (10:57 +0200)]
aesni: Calculate GHASH for 4 blocks of associated data in parallel

While associated data is usually not that large, in some specific cases
this can bring a significant performance boost.

4 years agoaesni: Calculate GHASH for 4 blocks of encryption data in parallel
Martin Willi [Tue, 31 Mar 2015 08:00:33 +0000 (10:00 +0200)]
aesni: Calculate GHASH for 4 blocks of encryption data in parallel

Increases performance by another ~30%.

4 years agoaesni: Use 4-way parallel en/decryption in GCM
Martin Willi [Mon, 30 Mar 2015 16:55:36 +0000 (18:55 +0200)]
aesni: Use 4-way parallel en/decryption in GCM

Increases overall performance by ~25%.

4 years agoaesni: Use dedicated key size specific en-/decryption functions in GCM
Martin Willi [Mon, 30 Mar 2015 16:37:02 +0000 (18:37 +0200)]
aesni: Use dedicated key size specific en-/decryption functions in GCM

This gives not much more than ~5% increase in performance, but allows us to
improve further.

4 years agoaesni: Add a GCM AEAD based on the AES-NI key schedule
Martin Willi [Mon, 30 Mar 2015 15:58:29 +0000 (17:58 +0200)]
aesni: Add a GCM AEAD based on the AES-NI key schedule

4 years agoaesni: Implement CMAC mode to provide a signer/prf
Martin Willi [Fri, 27 Mar 2015 16:36:12 +0000 (17:36 +0100)]
aesni: Implement CMAC mode to provide a signer/prf

Compared to the cmac plugin using AESNI-CBC as backend, this improves
performance of AES-CMAC by ~45%.

4 years agoaesni: Implement XCBC mode to provide a signer/prf
Martin Willi [Fri, 27 Mar 2015 12:51:24 +0000 (13:51 +0100)]
aesni: Implement XCBC mode to provide a signer/prf

Compared to the xcbc plugin using AESNI-CBC as backend, this improves
performance of AES-XCBC by ~45%.

4 years agoaesni: Partially use separate code paths for different key sizes in CCM
Martin Willi [Thu, 26 Mar 2015 18:07:21 +0000 (19:07 +0100)]
aesni: Partially use separate code paths for different key sizes in CCM

Due to the serial nature of the CBC mac, this brings only a marginal speedup.

4 years agoaesni: Add a CCM AEAD reusing the key schedule
Martin Willi [Thu, 26 Mar 2015 16:43:50 +0000 (17:43 +0100)]
aesni: Add a CCM AEAD reusing the key schedule

4 years agoaesni: Use 4-way parallel AES-NI instructions for CTR en/decryption
Martin Willi [Thu, 26 Mar 2015 10:26:51 +0000 (11:26 +0100)]
aesni: Use 4-way parallel AES-NI instructions for CTR en/decryption

CTR can be parallelized, and we do so by queueing instructions to the processor
pipeline. While we have enough registers for 128-bit decryption, the register
count is insufficient to hold all variables with larger key sizes. Nonetheless
is 4-way parallelism faster, depending on key size between ~10% and ~25%.

4 years agoaesni: Use dedicated round count specific encryption functions in CTR mode
Martin Willi [Thu, 26 Mar 2015 09:58:04 +0000 (10:58 +0100)]
aesni: Use dedicated round count specific encryption functions in CTR mode

This allows us to unroll loops and hold the key schedule in local (register)
variables. This brings an impressive speedup of ~45%.