Re: svn commit: r251088 - head/crypto/openssh

2013-05-29 Thread Pawel Jakub Dawidek
On Wed, May 29, 2013 at 05:03:05PM +0200, Dag-Erling Smørgrav wrote: > Pawel Jakub Dawidek writes: > > AES-NI doesn't have to go through kernel at all and doing so is much > > slower. Not sure if our OpenSSL version already has native AES-NI > > support. If not it would be best to upgrade it. Thi

Re: svn commit: r251088 - head/crypto/openssh

2013-05-29 Thread Dag-Erling Smørgrav
Pawel Jakub Dawidek writes: > AES-NI doesn't have to go through kernel at all and doing so is much > slower. Not sure if our OpenSSL version already has native AES-NI > support. If not it would be best to upgrade it. This would fix AES-NI > at least. Other crypto HW that do need kernel driver wou

Re: svn commit: r251088 - head/crypto/openssh

2013-05-29 Thread Pawel Jakub Dawidek
On Wed, May 29, 2013 at 02:36:17PM +0200, Dag-Erling Smørgrav wrote: > Pawel Jakub Dawidek writes: > > Which library is needed for AES-NI? I don't see any engine in /usr/lib/ > > that implements AES-NI support. Could you be more specific? > > Ah, you're right. Bryan (cc:ed) did the analysis and

Re: svn commit: r251088 - head/crypto/openssh

2013-05-29 Thread Bryan Drewery
On 5/29/2013 7:36 AM, Dag-Erling Smørgrav wrote: > Pawel Jakub Dawidek writes: >> Which library is needed for AES-NI? I don't see any engine in /usr/lib/ >> that implements AES-NI support. Could you be more specific? > > Ah, you're right. Bryan (cc:ed) did the analysis and I misunderstood > his

Re: svn commit: r251088 - head/crypto/openssh

2013-05-29 Thread Dag-Erling Smørgrav
Pawel Jakub Dawidek writes: > Which library is needed for AES-NI? I don't see any engine in /usr/lib/ > that implements AES-NI support. Could you be more specific? Ah, you're right. Bryan (cc:ed) did the analysis and I misunderstood his report. I just ran through the steps to reproduce the issu

Re: svn commit: r251088 - head/crypto/openssh

2013-05-29 Thread Pawel Jakub Dawidek
On Wed, May 29, 2013 at 12:19:59AM +, Dag-Erling Smørgrav wrote: > Author: des > Date: Wed May 29 00:19:58 2013 > New Revision: 251088 > URL: http://svnweb.freebsd.org/changeset/base/251088 > > Log: > Revert a local change that sets the default for UsePrivilegeSeparation to > "sandbox" ins

svn commit: r251088 - head/crypto/openssh

2013-05-28 Thread Dag-Erling Smørgrav
Author: des Date: Wed May 29 00:19:58 2013 New Revision: 251088 URL: http://svnweb.freebsd.org/changeset/base/251088 Log: Revert a local change that sets the default for UsePrivilegeSeparation to "sandbox" instead of "yes". In sandbox mode, the privsep child is unable to load additional lib