d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
8e1031086d
freebsd-dev/stand/libsa/geli/Makefile.inc

43 lines
768 B
PHP
Raw Normal View History

Implement GELI (AES-XTS and AES-CBC only) in gptboot and gptzfsboot Allows booting from a GELI encrypted root file system, via UFS or ZFS Reviewed by: gnn, smh (previous version), delphij (previous version) Relnotes: yes Sponsored by: ScaleEngine Inc. Differential Revision: https://reviews.freebsd.org/D4593
2016-03-16 23:12:19 +00:00
# $FreeBSD$
stand: move libgeliboot into libsa. Reduce by 1 the number of crazy libraries we need in stand by moving geli into libsa (where architecturally it belonged all along). This just moves things around without any code changes.
2018-06-18 16:24:42 +00:00
# Extra stuff for GELI
Implement GELI (AES-XTS and AES-CBC only) in gptboot and gptzfsboot Allows booting from a GELI encrypted root file system, via UFS or ZFS Reviewed by: gnn, smh (previous version), delphij (previous version) Relnotes: yes Sponsored by: ScaleEngine Inc. Differential Revision: https://reviews.freebsd.org/D4593
2016-03-16 23:12:19 +00:00
stand: move libgeliboot into libsa. Reduce by 1 the number of crazy libraries we need in stand by moving geli into libsa (where architecturally it belonged all along). This just moves things around without any code changes.
2018-06-18 16:24:42 +00:00
.PATH: ${SASRC}/geli
Implement GELI (AES-XTS and AES-CBC only) in gptboot and gptzfsboot Allows booting from a GELI encrypted root file system, via UFS or ZFS Reviewed by: gnn, smh (previous version), delphij (previous version) Relnotes: yes Sponsored by: ScaleEngine Inc. Differential Revision: https://reviews.freebsd.org/D4593
2016-03-16 23:12:19 +00:00
stand: move libgeliboot into libsa. Reduce by 1 the number of crazy libraries we need in stand by moving geli into libsa (where architecturally it belonged all along). This just moves things around without any code changes.
2018-06-18 16:24:42 +00:00
CFLAGS+= -I${LDRSRC}
Implement GELI (AES-XTS and AES-CBC only) in gptboot and gptzfsboot Allows booting from a GELI encrypted root file system, via UFS or ZFS Reviewed by: gnn, smh (previous version), delphij (previous version) Relnotes: yes Sponsored by: ScaleEngine Inc. Differential Revision: https://reviews.freebsd.org/D4593
2016-03-16 23:12:19 +00:00
# Our password input method
SRCS+= pwgets.c
# sha256 and sha512 from sys/crypto
Use SYSDIR instead of ${.CURDIR}/../..<etc>/sys. Sponsored by: Netflix
2017-10-22 22:50:28 +00:00
.PATH: ${SYSDIR}/crypto/sha2
Implement GELI (AES-XTS and AES-CBC only) in gptboot and gptzfsboot Allows booting from a GELI encrypted root file system, via UFS or ZFS Reviewed by: gnn, smh (previous version), delphij (previous version) Relnotes: yes Sponsored by: ScaleEngine Inc. Differential Revision: https://reviews.freebsd.org/D4593
2016-03-16 23:12:19 +00:00
CFLAGS+= -DWEAK_REFS
SRCS+= sha256c.c sha512c.c
# md5 from libmd
Standardize paths on SRCTOP instead of .CURDIR-relative paths MFC after: 1 week
2017-08-01 05:39:40 +00:00
.PATH: ${SRCTOP}/lib/libmd
Implement GELI (AES-XTS and AES-CBC only) in gptboot and gptzfsboot Allows booting from a GELI encrypted root file system, via UFS or ZFS Reviewed by: gnn, smh (previous version), delphij (previous version) Relnotes: yes Sponsored by: ScaleEngine Inc. Differential Revision: https://reviews.freebsd.org/D4593
2016-03-16 23:12:19 +00:00
SRCS+= md5c.c
# AES implementation from sys/crypto
Use SYSDIR instead of ${.CURDIR}/../..<etc>/sys. Sponsored by: Netflix
2017-10-22 22:50:28 +00:00
.PATH: ${SYSDIR}/crypto/rijndael
stand: move libgeliboot into libsa. Reduce by 1 the number of crazy libraries we need in stand by moving geli into libsa (where architecturally it belonged all along). This just moves things around without any code changes.
2018-06-18 16:24:42 +00:00
.for i in rijndael-alg-fst.c rijndael-api-fst.c rijndael-api.c
# Remove asserts XXX BAD
CFLAGS.${i}+= -DNDEBUG
SRCS+= ${i}
.endfor
Implement GELI (AES-XTS and AES-CBC only) in gptboot and gptzfsboot Allows booting from a GELI encrypted root file system, via UFS or ZFS Reviewed by: gnn, smh (previous version), delphij (previous version) Relnotes: yes Sponsored by: ScaleEngine Inc. Differential Revision: https://reviews.freebsd.org/D4593
2016-03-16 23:12:19 +00:00
# local GELI Implementation
Use SYSDIR instead of ${.CURDIR}/../..<etc>/sys. Sponsored by: Netflix
2017-10-22 22:50:28 +00:00
.PATH: ${SYSDIR}/geom/eli
Extend loader(8) geli support to all architectures and all disk-like devices. This moves the bulk of the geli support from lib386/biosdisk.c into a new geli/gelidev.c which implements a devsw-type device whose dv_strategy() function handles geli decryption. Support for all arches comes from moving the taste-and-attach code to the devopen() function in libsa. After opening any DEVT_DISK device, devopen() calls the new function geli_probe_and_attach(), which will "attach" the geli code to the open_file struct by creating a geli_devdesc instance to replace the disk_devdesc instance in the open_file. That routes all IO for the device through the geli code. A new public geli_add_key() function is added, to allow arch/vendor-specific code to add keys obtained from custom hardware or other sources. With these changes, geli support will be compiled into all variations of loader(8) on all arches because the default is WITH_LOADER_GELI. Relnotes: yes Sponsored by: Microchip Technology Inc Differential Revision: https://reviews.freebsd.org/D15743
2018-07-13 17:50:25 +00:00
SRCS+= \
geliboot.c \
geliboot_crypto.c \
gelidev.c \
geli_metadata.c \
g_eli_hmac.c \
g_eli_key.c \
g_eli_key_cache.c \
pkcs5v2.c \
Implement GELI (AES-XTS and AES-CBC only) in gptboot and gptzfsboot Allows booting from a GELI encrypted root file system, via UFS or ZFS Reviewed by: gnn, smh (previous version), delphij (previous version) Relnotes: yes Sponsored by: ScaleEngine Inc. Differential Revision: https://reviews.freebsd.org/D4593
2016-03-16 23:12:19 +00:00
Move LOADER_{NO,}_GELI_SUPPORT to MK_LOADER_GELI Transition to WITH/WITHOUT_LOADER_GELI to flag support or not of GELI in the boot loaders. Add HAVE_GELI so components can flag they need support (since it's too large to include everywhere). Add temporary warnings for the old forms to ease transition. Also, update test script to build without GELI on x86. Sponsored by: Netflix
2017-11-10 23:54:48 +00:00
# aes
.PATH: ${SYSDIR}/opencrypto
SRCS+= xform_aes_xts.c
Reference in New Issue Copy Permalink