New Tunable: kern.crypto.iimb.enable_aescbc on fresh install

luckman212

Noticed a new tunable that I haven't seen before

kern.crypto.iimb.enable_aescbc

On a stock 6100 25.07 RC install, this is being set to 0

Any more info on this?

provels

@luckman212
Docs
Maybe because QAT is faster? It's '1' on mine, but my proc doesn't have QAT.

tedquade

@luckman212 On my stock 6100MAX 25.07RC it is set to 1.

Ted

luckman212

@tedquade Guess when 25.07 officially releases I'll factory erase and check again.

mcury

SG-4100, 24.11, set to 0 here.
Weird, this is explicit set in my config file:

<sysctl>
<item>
<tunable>kern.crypto.iimb.enable_aescbc</tunable>
<value>0</value>
</item>
</sysctl>

Edit:
If you enable IPsec-MB, it will set kern.crypto.iimb.enable_aescbc to 0.
Since I`m running Wireguard only, that is what I want, in my SG-4100.
Just a FYI only, QAT is enabled but not in use.

dennypage

@luckman212 said in New Tunable: kern.crypto.iimb.enable_aescbc on fresh install:

Noticed a new tunable that I haven't seen before

kern.crypto.iimb.enable_aescbc
On a stock 6100 25.07 RC install, this is being set to 0

Any more info on this?

See documentation on Crypto here.

luckman212

@dennypage Yes thanks I saw that, so I assume that for the 6100 (which does have QAT) that 0 is the preferred value here? Or does it not even really matter much?

provels

@luckman212 No idea, just spitballing, but is it dependent on the type of VPN you choose? I use OpenVPN, not IPSec.

RobbieTT

@luckman212

kern.crypto.iimb.enable_aescbc
Enables handling of AES-CBC. IIMB can be slower than QAT for CBC so this is a toggle to disable handling for AES-CBC while accelerating other algorithms so IPsec-MB and QAT can coexist in such environments. Supported on x86-64 only.

Default is enabled (1). To disable, set a value of 0.

So I read that as 'set zero' when using both IPsec-MB and QAT. Well, that is what I have set it to on my Xeon system.

️

dennypage

@luckman212 said in New Tunable: kern.crypto.iimb.enable_aescbc on fresh install:

Yes thanks I saw that, so I assume that for the 6100 (which does have QAT) that 0 is the preferred value here? Or does it not even really matter much?

Mine shows as 1 in System / Advanced / System Tunables, however I do not see it actually being used by the kernel:

[25.07-RC][root@fw]/root: sysctl kern.crypto.iimb.enable_aescbc
sysctl: unknown oid 'kern.crypto.iimb.enable_aescbc'
[25.07-RC][root@fw]/root:

kldstat on my 6100 shows that iimb.ko isn't loaded, so this makes sense. Looking at /etc/inc/pfsense-utils.inc, the loading of iimb.ko is controlled by system/ipsec_mb.

Looking at /etc/inc/config.console.inc, it appears that system/ipsec_mb is set to true on the 6100, but only on initial install. This explicit setting of ipsec_mb on the 6100 appears to be new. Ditto for kern.crypto.iimb.enable_aescbc, which is now set to 0, but only on initial install. So now, you get the option of using iimb on the 6100.

Again looking /etc/inc/config.console.inc, on the 6100 system/crypto_hardware will be set to qat during install, so iimb may be an option, but qat is still the default.

So in summary, to answer your question, I don't think it matters at all.

mcury

@dennypage said in New Tunable: kern.crypto.iimb.enable_aescbc on fresh install:

So in summary, to answer your question, I don't think it matters at all.

Well, according to the documentation, ChaCha20-Poly1305 is accelerated by iimb, so if you are running only wireguard, you would benefit by enabling it.
If that is the case, kern.crypto.iimb.enable_aescbc will be 0.

Not sure if QAT enabled or disabled, will influence in that value.