{"push_id":2401034116,"size":8,"distinct_size":1,"ref":"refs/heads/hardened/current/master","head":"611b3d7ad04886ab97bfde4091f1a8e31010f32d","before":"9d13e25d81855319cc11cd2a14e6132f96d73105","commits":[{"sha":"9af12fb91a7556fb9b9bba3a1bb990e1fefc64c1","author":{"name":"glebius","email":"80e534fe7e1b330136d3a302de2261cd031ee58f@FreeBSD.org"},"message":"Fix typo that misteriously passes compilation.","distinct":false,"url":"https://api.github.com/repos/HardenedBSD/hardenedBSD/commits/9af12fb91a7556fb9b9bba3a1bb990e1fefc64c1"},{"sha":"0688d78f09a6d2476ed6c03f1a738da635868429","author":{"name":"jhb","email":"c563ff913af6c995f30a82a6a1957ec496a32a59@FreeBSD.org"},"message":"Support for TLS offload of TOE connections on T6 adapters.\n\nThe TOE engine in Chelsio T6 adapters supports offloading of TLS\nencryption and TCP segmentation for offloaded connections.  Sockets\nusing TLS are required to use a set of custom socket options to upload\nRX and TX keys to the NIC and to enable RX processing.  Currently\nthese socket options are implemented as TCP options in the vendor\nspecific range.  A patched OpenSSL library will be made available in a\nport / package for use with the TLS TOE support.\n\nTOE sockets can either offload both transmit and reception of TLS\nrecords or just transmit.  TLS offload (both RX and TX) is enabled by\nsetting the dev.t6nex.<x>.tls sysctl to 1 and requires TOE to be\nenabled on the relevant interface.  Transmit offload can be used on\nany \"normal\" or TLS TOE socket by using the custom socket option to\nprogram a transmit key.  This permits most TOE sockets to\ntransparently offload TLS when applications use a patched SSL library\n(e.g. using LD_LIBRARY_PATH to request use of a patched OpenSSL\nlibrary).  Receive offload can only be used with TOE sockets using the\nTLS mode.  The dev.t6nex.0.toe.tls_rx_ports sysctl can be set to a\nlist of TCP port numbers.  Any connection with either a local or\nremote port number in that list will be created as a TLS socket rather\nthan a plain TOE socket.  Note that although this sysctl accepts an\narbitrary list of port numbers, the sysctl(8) tool is only able to set\nsysctl nodes to a single value.  A TLS socket will hang without\nreceiving data if used by an application that is not using a patched\nSSL library.  Thus, the tls_rx_ports node should be used with care.\nFor a server mostly concerned with offloading TLS transmit, this node\nis not needed as plain TOE sockets will fall back to software crypto\nwhen using an unpatched SSL library.\n\nNew per-interface statistics nodes are added giving counts of TLS\npackets and payload bytes (payload bytes do not include TLS headers or\nauthentication tags/MACs) offloaded via the TOE engine, e.g.:\n\ndev.cc.0.stats.rx_tls_octets: 149\ndev.cc.0.stats.rx_tls_records: 13\ndev.cc.0.stats.tx_tls_octets: 26501823\ndev.cc.0.stats.tx_tls_records: 1620\n\nTLS transmit work requests are constructed by a new variant of\nt4_push_frames() called t4_push_tls_records() in tom/t4_tls.c.\n\nTLS transmit work requests require a buffer containing IVs.  If the\nIVs are too large to fit into the work request, a separate buffer is\nallocated when constructing a work request.  This buffer is associated\nwith the transmit descriptor and freed when the descriptor is ACKed by\nthe adapter.\n\nReceived TLS frames use two new CPL messages.  The first message is a\nCPL_TLS_DATA containing the decryped payload of a single TLS record.\nThe handler places the mbuf containing the received payload on an\nmbufq in the TOE pcb.  The second message is a CPL_RX_TLS_CMP message\nwhich includes a copy of the TLS header and indicates if there were\nany errors.  The handler for this message places the TLS header into\nthe socket buffer followed by the saved mbuf with the payload data.\nBoth of these handlers are contained in tom/t4_tls.c.\n\nA few routines were exposed from t4_cpl_io.c for use by t4_tls.c\nincluding send_rx_credits(), a new send_rx_modulate(), and\nt4_close_conn().\n\nTLS keys for both transmit and receive are stored in onboard memory\nin the NIC in the \"TLS keys\" memory region.\n\nIn some cases a TLS socket can hang with pending data available in the\nNIC that is not delivered to the host.  As a workaround, TLS sockets\nare more aggressive about sending CPL_RX_DATA_ACK messages anytime that\nany data is read from a TLS socket.  In addition, a fallback timer will\nperiodically send CPL_RX_DATA_ACK messages to the NIC for connections\nthat are still in the handshake phase.  Once the connection has\nfinished the handshake and programmed RX keys via the socket option,\nthe timer is stopped.\n\nA new function select_ulp_mode() is used to determine what sub-mode a\ngiven TOE socket should use (plain TOE, DDP, or TLS).  The existing\nset_tcpddp_ulp_mode() function has been renamed to set_ulp_mode() and\nhandles initialization of TLS-specific state when necessary in\naddition to DDP-specific state.\n\nSince TLS sockets do not receive individual TCP segments but always\nreceive full TLS records, they can receive more data than is available\nin the current window (e.g. if a 16k TLS record is received but the\nsocket buffer is itself 16k).  To cope with this, just drop the window\nto 0 when this happens, but track the overage and \"eat\" the overage as\nit is read from the socket buffer not opening the window (or adding\nrx_credits) for the overage bytes.\n\nReviewed by:\tnp (earlier version)\nSponsored by:\tChelsio Communications\nDifferential Revision:\thttps://reviews.freebsd.org/D14529","distinct":false,"url":"https://api.github.com/repos/HardenedBSD/hardenedBSD/commits/0688d78f09a6d2476ed6c03f1a738da635868429"},{"sha":"1814749084b10f8a864de3ca19fed5f9fa73811c","author":{"name":"imp","email":"32a826ad887304878d4647928de4878bf8ba40bc@FreeBSD.org"},"message":"We need opt_compat.h after r330819 and 330820.\n\nAdd opt_compat.h to fix the stand-alone build case.\n\nSponsored by: Netflix.","distinct":false,"url":"https://api.github.com/repos/HardenedBSD/hardenedBSD/commits/1814749084b10f8a864de3ca19fed5f9fa73811c"},{"sha":"21f393cb0d11dc8bc0a88b2b85cf92c0feac7ecb","author":{"name":"dteske","email":"4b010855a558d38227f8e98f2d6af41b874af2fa@FreeBSD.org"},"message":"Install files added in SVN's r295373, r295457, r295542\n\nReported by:\twoodsb02\nMFC after:\t3 days\nX-MFC to:\tstable/11","distinct":false,"url":"https://api.github.com/repos/HardenedBSD/hardenedBSD/commits/21f393cb0d11dc8bc0a88b2b85cf92c0feac7ecb"},{"sha":"58c4dda2a8bcfb16651a2722008210b7d7468ac7","author":{"name":"np","email":"1b95c54d4a72e6246d7f62779f36d8ce3f67cdb7@FreeBSD.org"},"message":"cxgbetool(8): Add the ability to decode hardware TCBs.\n\nObtained from:\tChelsio Communications\nMFC after:\t1 week\nSponsored by:\tChelsio Communications","distinct":false,"url":"https://api.github.com/repos/HardenedBSD/hardenedBSD/commits/58c4dda2a8bcfb16651a2722008210b7d7468ac7"},{"sha":"25d044a1b53c50df2d7f438174ea8c0b248b4608","author":{"name":"kevans","email":"278d6e3a23c4748286d474d60f658bcf2347b96e@FreeBSD.org"},"message":"ubldr: Bump heap size from 512K to 1M\n\nlualoader in itself only uses another ~200K, but there seems to be no reason\nnot to bump it a little higher to give us some more wiggle room.\n\nWith this, I can boot using a menu-enabled lualoader, no problem and\nreasonably fast. Some heap usage datapoints from the review:\n\nforthloader, no menus, kernel loaded:\nheap base at 0x1203d5b0, top at 0x1208e000, used 330320\n\nlualoader, no menus, kernel loaded:\nheap base at 0x42050028, top at 0x420ab000, used 372696\n\nlualoader, menus, kernel loaded:\nheap base at 0x42050028, top at 0x420d5000, used 544728\n\nSince then, the no menu case for lualoader should have decreased slightly as\nI've made some changes to make sure that it no longer loads any of th emenu\nbits with beastie disabled.\n\nWhile here, split heap size out into a HEAP_SIZE macro.\n\nReviewed by:\tian, imp\nMFC after:\t1 week\nDifferential Revision:\thttps://reviews.freebsd.org/D14471","distinct":false,"url":"https://api.github.com/repos/HardenedBSD/hardenedBSD/commits/25d044a1b53c50df2d7f438174ea8c0b248b4608"},{"sha":"739ad8682724dea47216d22cee8066b2a9dd57e8","author":{"name":"cem","email":"af7db0ed4336d177a834fba8f4630f263ff96ae4@FreeBSD.org"},"message":"Update to Zstandard 1.3.3\n\nIncludes patch to conditionalize use of __builtin_clz(ll) on __has_builtin().\nThe issue is tracked upstream at https://github.com/facebook/zstd/pull/884 .\nOtherwise, these are vanilla Zstandard 1.3.3 files.\n\nNote that the 1.3.4 release should be due out soon.\n\nSponsored by:\tDell EMC Isilon","distinct":false,"url":"https://api.github.com/repos/HardenedBSD/hardenedBSD/commits/739ad8682724dea47216d22cee8066b2a9dd57e8"},{"sha":"611b3d7ad04886ab97bfde4091f1a8e31010f32d","author":{"name":"Oliver Pinter +","email":"924fd90530ea0369cfaf1274bf61a797817afd0e@hardenedbsd.org"},"message":"Merge branch 'freebsd/current/master' into hardened/current/master\n\n* freebsd/current/master:\n  Update to Zstandard 1.3.3\n  ubldr: Bump heap size from 512K to 1M\n  cxgbetool(8): Add the ability to decode hardware TCBs.\n  Install files added in SVN's r295373, r295457, r295542\n  We need opt_compat.h after r330819 and 330820.\n  Support for TLS offload of TOE connections on T6 adapters.\n  Fix typo that misteriously passes compilation.","distinct":true,"url":"https://api.github.com/repos/HardenedBSD/hardenedBSD/commits/611b3d7ad04886ab97bfde4091f1a8e31010f32d"}]}
{"actor":{"display_login":"opntr-auto"}}