
PfSense 2.5 and AES-NI - sashk
https://www.netgate.com/blog/pfsense-2-5-and-aes-ni.html
======
mrenouf2
This is quite obviously an attempt to cut out the flood of cheap embedded PCs
which are ideal for pfSense and steer more sales to their own hardware.
Systems such as "The vault" sold by protectli.com are completely adequate for
the home network (I am capable of pushing > 100Mbit/s over OpenVPN at ~35%
CPU). These run older celeron processors and are dirt cheap.

Hints:

1) The post implies this restriction will only be for the community (free)
edition. "pfSense Community Edition version 2.5 will include a requirement
that the CPU supports AES-NI"

2) There is zero reason to _require_ AES-NI, as running with a software
fallback will simply yield lower performance. Taking this option away makes no
sense unless you want to encourage those who don't pay for software support to
buy your hardware, while those already paying for support are free to use
their existing gear.

~~~
feld
Well, if you care about security AES-NI allegedly prevents a side channel
attack.

~~~
wtallis
Are you referring to timing attacks or something even more subtle?

~~~
dom0
Most/all software implementations of AES had various side channels in the
past. Considering AES-GCM, as far as I'm aware no software implementation is
considered "safe". Some libraries do not support AES-GCM without hardware
instructions that make it safe (e.g. libsodium choose that way).

This is mainly due to AES relying heavily on substitution boxes, i.e. small
arrays that are indexed with secrets, which is easy to implement safely in
hardware, but difficult in software that runs on a processor with caches and
such.

~~~
tptacek
In the GCM case, it's also because the polynomial hash in GHASH wants fast
polynomial multiplication, which PCLMULQDQ provides, and which you want
(unsafe) lookup tables for otherwise.

------
paws
TL, DR: If you are building a pfSense box with an x86 chip made in the past ~7
years [1], stop reading and carry on.

Those of you on a power budget, and want e.g. VPN support at closer to wire
speeds, you're being advised to select a CPU with AES-NI to get hardware
crypto offload. It's great we have software crypto in the first place, but
under load it's likely to put a cap on your max throughput.

Kudos to pfSense/Netgate announcing this ahead of time.

[1]
[https://en.wikipedia.org/wiki/AES_instruction_set#Supporting...](https://en.wikipedia.org/wiki/AES_instruction_set#Supporting_x86_CPUs)

~~~
niftich
AMD has shipped AES-NI in every processor family starting with Bulldozer in
2011.

Intel started in 2010 with Westmere, but kept it out of the lower-end models
like Pentium, Celeron, and i3 for several generations. Only since Skylake
(2015) is it included in every model produced from a supporting architecture.
At least for Intel processors, the generalization above, absent other
disclaimers, does not apply.

Actual lookup tables are linked in other posts like this one [1].

[1]
[https://news.ycombinator.com/item?id=14240007](https://news.ycombinator.com/item?id=14240007)

~~~
kop316
The immediate predecessor to the Netgate SG-2220 ( I forget the Model, but it
was based off of the the PC Engines apu1d [1]) does not support AES-NI. It has
the AMD G series T40E, which is based off of the Bobcat architecture [2] [3]).
I use pfsense as a home router, and while I am very happy with it, I will be
forced to upgrade that hardware, and I do not use any feature sets that
require the use of AES-NI.

In addition, the Netgate SG-2220 uses an Atom C2338, which was susceptible to
the LPC bus failure [4] [5]. So as of right now, I would also be extremely
hesitant to purchase the Netgate SG-2220 without some sort of assurance that
the router I got is not affected by it.

[1] [https://pcengines.ch/apu1d4.htm](https://pcengines.ch/apu1d4.htm)

[2]
[https://en.wikipedia.org/wiki/List_of_AMD_accelerated_proces...](https://en.wikipedia.org/wiki/List_of_AMD_accelerated_processing_unit_microprocessors)

[3]
[https://en.wikipedia.org/wiki/Bobcat_(microarchitecture)](https://en.wikipedia.org/wiki/Bobcat_\(microarchitecture\))

[4]
[https://www.netgate.com/products/sg-2220.html](https://www.netgate.com/products/sg-2220.html)

[5] [http://www.anandtech.com/show/11110/semi-critical-intel-
atom...](http://www.anandtech.com/show/11110/semi-critical-intel-
atom-c2000-flaw-discovered)

EDIT: Interestingly enough, someone from Netgate said that the PC Engines APU
is unaffected:
[https://www.reddit.com/r/PFSENSE/comments/68nd6y/pfsense_25_...](https://www.reddit.com/r/PFSENSE/comments/68nd6y/pfsense_25_and_aesni/dgzrsma/)
EDIT2: Seems they edited that, the APU1d won't be compatible.

------
Gamblore
Lots of bans going on over at /r/pfsense where users are asking
straightforward questions and the staff are just banning them. Read the edits
made to the posts there crazy....

Seeming more and more like this is a cash grab thing to get people to upgrade
to their hardware.

~~~
pfsense-ivork
You were banned because you violated rules. You were incredibly rude and then
even threatened us. If that wasn't enough you attempted to start a brand new
drama thread. "Cash grab thing" assertion proves we were right to ban you.

~~~
nalllar
You've just gone and accused Gamblore of being someone who they aren't.

You told me to "Chill for 30 days". Maybe you need to chill instead of
damaging your brand by lashing out at people?

~~~
pfsense-ivork
I think it's you who don't know who Gamblore is.

~~~
nalllar
Gamblore can't be i_mormon_stuff, since i_mormon_stuff also has an account
here under the same name and posted in this same thread.

Was there a third user you banned?

~~~
pfsense-ivork
Nope, just you and i_mormon_stuff. I still think it's him, but lets see if he
ever responds.

~~~
Gamblore
when you start a riot with your users you may get very paranoid like this guy.

~~~
pfsense-ivork
Apologies, considering your exaggerated remark "lot's of bans going on" I
assumed you were one of two (and only two) persons banned.

------
ktta
Isn't a linux headless box a great alternative to pfsense for non-commercial
use? The problem here seems to be that home users now have to shell out more.

If you're going to use OpenVPN and other common software, why not just move to
linux side of things? It seems that for home use you wouldn't need any
enterprise grade software which I feel is the big advantage of pfSense. Sure
pf is great but iptables isn't terrible either.

I find that the BSDs are becoming increasingly reluctant to any change that
goes against their principles which I sometimes find a tad misplaced.

~~~
stock_toaster

      > I find that the BSDs are becoming increasingly reluctant to  
      > any change that goes against their principles which I  
      > sometimes find a tad misplaced.
    

This seems a bit uncharitable. pfsense is an open source firewall product,
made/released by a company that sells support and services. I wouldn't call it
"one of the BSDs" any more than I would call say.. Sophos Firewall or
Smoothwall as linux distributions.

Running a properly configured, headless linux box as a firewall would indeed
be a fine choice for those technically capable, similarly so would a FreeBSD
or OpenBSD install.

~~~
ktta
I'm not calling it one of the BSDs, but you still have to consider who's
running the show. The FreeBSD part behind pfSense is as important as the
Debian beind VyOS (although I'm not suggesting VyOS here).

If things are completely same from a management/security perspective, then I'd
be wrong but it _does_ make a difference when it comes to management, updates,
and compatibility etc.

Your definition of technically capable is a bit vague. What can a technically
capable user do? It can vary from barely being able to use the cli and minimal
understanding of basic networking, to being able to compile/tune the kernel by
themselves and write drivers in case they are missing.

------
stumpylog
I have to say, the way that the pfense team is handling it, and the moderators
over on reddit, while I had been considering using it, I think I'll use
ubiquiti when I upgrade the network

~~~
nalllar
The angry pfSense team member just went through and deleted/removed all the
comments involved in the thread he was arguing in.

------
givemefive
Sounds like a move to sell more hardware. My pfsense barely does any crypto.
This will push me over to openbsd.

~~~
gonzo
If this was a move to sell more hardware, why wouldn't we make the decision
for 2.4 (which is imminent) rather than 2.5, which is based on FreeBSD 12,
when 12.0R isn't even scheduled?

~~~
givemefive
I don't know. What is your reasoning? I don't really understand why you'd want
to force people to upgrade HW when they don't need to.

~~~
tptacek
There is a difference between a design decision reasonable people can
disagree, even forcefully, about, and a design decision that is actually a
deceptive attempt to get people to buy new hardware.

------
deprave
If I had to guess, I'd say Netgate is working on an SD-WAN service of sorts.
Many players in this market are displacing the edge firewall, and offering a
built-in service of their own or in partnership with a third-party might be a
smart move.

~~~
gonzo
What if we just added and SD-WAN implementation to pfSense?

~~~
deprave
I see pfSense playing two possible roles the SD-WAN. The first is customer-
centric, and will allow pfSense edge devices to connect to a third-party SD-
WAN service or one provided by Netgate itself. The other is vendor-centric,
and will allow SD-WAN vendors to use pfSense for their Point-of-Presence
software when building the geographically distributed network for SD-WAN
traffic optimization.

Both are smart strategies and well within your core competency. As long as
you're not building your own SD-WAN service you're golden.

~~~
gonzo
> As long as you're not building your own SD-WAN service you're golden.

Thanks! Running our own SD-WAN service seems a lot like opening a cute little
coffee shop: A fine way to spend a lot of money with no result.

There is a third option, which is also customer-centric: Allow the customer to
run their own SD-WAN.

------
itsoggy
I look after a pfsense box for a school on a 9 year old E2200 that is obsolete
by this.

On one hand I cannot complain because the server is 9 years old and lasted
well, but on the other hand, why not an option for those just needing a packet
filter to bypass this?

Am I missing something?

------
ChefDenominator
This is a real shame. I am going to have to find a different solution, as it
turns out that pfSense is one of those projects that happily moves on without
you, and I just can't understand why.

My Atom board has been perfect, but there is no hardware upgrade option.

I guess I'll have to find another project. And, yes, I used to recommend this
project to everyone I know, even donated. Oh, well.

------
gonzo
A further attempt at explanation. I'll probably clean this up and write
another blog post.

[https://www.reddit.com/r/PFSENSE/comments/68nd6y/pfsense_25_...](https://www.reddit.com/r/PFSENSE/comments/68nd6y/pfsense_25_and_aesni/dh0qi53/)

------
sharifm
This may be a good time to try a new relative open source product. OPNSense is
a fork of PFSense with some philosophical and practical differences. Here are
some notes on what and why
[https://docs.opnsense.org/fork/thefork.html](https://docs.opnsense.org/fork/thefork.html)

~~~
htilonom
Oh yes, OPNsense. Those sure are some philosophical and practical differences.
Differences as in:

\- code theft \- copyright abuse \- attempt to steal pfSense trademark in
Europe \- toxic project members who publicly attack anyone who dares to point
out issues (including assault on all major pfSense developers). \- hiding
serious vulnerabilities \- downplaying serious vulnerabilities

Oh yes, that's a very different project. I documented most of it here
[https://www.reddit.com/r/OPNscam/](https://www.reddit.com/r/OPNscam/)

~~~
s0ss
I think it would be healthy for you to 1) read about what copyright actually
is and 2) read about what various licenses permit. There seems to be a
disconnect between what is actually occurring and your understanding (and
subsequent nerd-rage).

------
nalllar
I was just banned from the pfSense subreddit for arguing about this change.
[https://i.imgur.com/1051KOl.png](https://i.imgur.com/1051KOl.png)

My comments are visible here:
[https://i.imgur.com/8oZVSJO.png](https://i.imgur.com/8oZVSJO.png)

Lovely. Due to this behaviour by pfSense employees I no longer want to use
pfSense. Had no issues with the software and was considering purchasing their
hardware.

Not any more.

archived view of the thread:
[https://archive.fo/pBoAY](https://archive.fo/pBoAY)

~~~
pfsense-ivork
No, you were incredibly rude to use and that's why you were banned. I suggest
you share full screenshots if you're going to create drama.

~~~
nalllar
I shared full screenshots of my own comments, except of the mod mail.

Here it is: [https://i.imgur.com/FlF8E1Q.png](https://i.imgur.com/FlF8E1Q.png)

You deleted your own posts. This is the archive of some of them:
[https://archive.fo/pBoAY](https://archive.fo/pBoAY)

I don't have an archive of the deeper posts, but they weren't particularly
pleasant.

~~~
Gamblore
He deleted all the posts. His own, yours, that other guys. The whole comment
chain. You may have to log out to see your own comments erased.

