mirror of
https://github.com/opnsense/src.git
synced 2026-02-16 09:08:51 -05:00
13774e8228
read_random() is/was used, mostly without error checking, in a lot of very sensitive places in the kernel -- including seeding the widely used arc4random(9). Most uses, especially arc4random(9), should block until the device is seeded rather than proceeding with a bogus or empty seed. I did not spy any obvious kernel consumers where blocking would be inappropriate (in the sense that lack of entropy would be ok -- I did not investigate locking angle thoroughly). In many instances, arc4random_buf(9) or that family of APIs would be more appropriate anyway; that work was done in r345865. A minor cleanup was made to the implementation of the READ_RANDOM function: instead of using a variable-length array on the stack to temporarily store all full random blocks sufficient to satisfy the requested 'len', only store a single block on the stack. This has some benefit in terms of reducing stack usage, reducing memcpy overhead and reducing devrandom output leakage via the stack. Additionally, the stack block is now safely zeroed if it was used. One caveat of this change is that the kern.arandom sysctl no longer returns zero bytes immediately if the random device is not seeded. This means that FreeBSD-specific userspace applications which attempted to handle an unseeded random device may be broken by this change. If such behavior is needed, it can be replaced by the more portable getrandom(2) GRND_NONBLOCK option. On any typical FreeBSD system, entropy is persisted on read/write media and used to seed the random device very early in boot, and blocking is never a problem. This change primarily impacts the behavior of /dev/random on embedded systems with read-only media that do not configure "nodevice random". We toggle the default from 'charge on blindly with no entropy' to 'block indefinitely.' This default is safer, but may cause frustration. Embedded system designers using FreeBSD have several options. The most obvious is to plan to have a small writable NVRAM or NAND to persist entropy, like larger systems. Early entropy can be fed from any loader, or by writing directly to /dev/random during boot. Some embedded SoCs now provide a fast hardware entropy source; this would also work for quickly seeding Fortuna. A 3rd option would be creating an embedded-specific, more simplistic random module, like that designed by DJB in [1] (this design still requires a small rewritable media for forward secrecy). Finally, the least preferred option might be "nodevice random", although I plan to remove this in a subsequent revision. To help developers emulate the behavior of these embedded systems on ordinary workstations, the tunable kern.random.block_seeded_status was added. When set to 1, it blocks the random device. I attempted to document this change in random.4 and random.9 and ran into a bunch of out-of-date or irrelevant or inaccurate content and ended up rototilling those documents more than I intended to. Sorry. I think they're in a better state now. PR: 230875 Reviewed by: delphij, markm (earlier version) Approved by: secteam(delphij), devrandom(markm) Relnotes: yes Differential Revision: https://reviews.freebsd.org/D19744
129 lines
4.3 KiB
C
129 lines
4.3 KiB
C
/*-
|
|
* Copyright (c) 2000-2015 Mark R V Murray
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer
|
|
* in this position and unchanged.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
|
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
|
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
|
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
|
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
*
|
|
* $FreeBSD$
|
|
*/
|
|
|
|
#ifndef SYS_DEV_RANDOM_RANDOMDEV_H_INCLUDED
|
|
#define SYS_DEV_RANDOM_RANDOMDEV_H_INCLUDED
|
|
|
|
#ifdef _KERNEL
|
|
|
|
/* This header contains only those definitions that are global
|
|
* and non algorithm-specific for the entropy processor
|
|
*/
|
|
|
|
#ifdef SYSCTL_DECL /* from sysctl.h */
|
|
SYSCTL_DECL(_kern_random);
|
|
|
|
#define RANDOM_CHECK_UINT(name, min, max) \
|
|
static int \
|
|
random_check_uint_##name(SYSCTL_HANDLER_ARGS) \
|
|
{ \
|
|
if (oidp->oid_arg1 != NULL) { \
|
|
if (*(u_int *)(oidp->oid_arg1) <= (min)) \
|
|
*(u_int *)(oidp->oid_arg1) = (min); \
|
|
else if (*(u_int *)(oidp->oid_arg1) > (max)) \
|
|
*(u_int *)(oidp->oid_arg1) = (max); \
|
|
} \
|
|
return (sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, \
|
|
req)); \
|
|
}
|
|
#endif /* SYSCTL_DECL */
|
|
|
|
MALLOC_DECLARE(M_ENTROPY);
|
|
|
|
#endif /* _KERNEL */
|
|
|
|
struct harvest_event;
|
|
|
|
typedef void random_alg_init_t(void *);
|
|
typedef void random_alg_deinit_t(void *);
|
|
typedef void random_alg_pre_read_t(void);
|
|
typedef void random_alg_read_t(uint8_t *, u_int);
|
|
typedef bool random_alg_seeded_t(void);
|
|
typedef void random_alg_reseed_t(void);
|
|
typedef void random_alg_eventprocessor_t(struct harvest_event *);
|
|
|
|
typedef u_int random_source_read_t(void *, u_int);
|
|
|
|
/*
|
|
* Random Algorithm is a processor of randomness for the kernel
|
|
* and for userland.
|
|
*/
|
|
struct random_algorithm {
|
|
const char *ra_ident;
|
|
u_int ra_poolcount;
|
|
void (*ra_init_alg)(void *);
|
|
void (*ra_deinit_alg)(void *);
|
|
random_alg_pre_read_t *ra_pre_read;
|
|
random_alg_read_t *ra_read;
|
|
random_alg_seeded_t *ra_seeded;
|
|
random_alg_eventprocessor_t *ra_event_processor;
|
|
};
|
|
|
|
extern struct random_algorithm random_alg_context, *p_random_alg_context;
|
|
|
|
#ifdef _KERNEL
|
|
|
|
/*
|
|
* Random Source is a source of entropy that can provide
|
|
* specified or approximate amount of entropy immediately
|
|
* upon request.
|
|
*/
|
|
struct random_source {
|
|
const char *rs_ident;
|
|
enum random_entropy_source rs_source;
|
|
random_source_read_t *rs_read;
|
|
};
|
|
|
|
struct random_sources {
|
|
LIST_ENTRY(random_sources) rrs_entries;
|
|
struct random_source *rrs_source;
|
|
};
|
|
|
|
LIST_HEAD(sources_head, random_sources);
|
|
extern struct sources_head source_list;
|
|
|
|
void random_source_register(struct random_source *);
|
|
void random_source_deregister(struct random_source *);
|
|
|
|
#if defined(RANDOM_LOADABLE)
|
|
extern struct sx randomdev_config_lock;
|
|
#define RANDOM_CONFIG_INIT_LOCK(x) sx_init(&randomdev_config_lock, "configuration change lock")
|
|
#define RANDOM_CONFIG_X_LOCK(x) sx_xlock(&randomdev_config_lock)
|
|
#define RANDOM_CONFIG_X_UNLOCK(x) sx_xunlock(&randomdev_config_lock)
|
|
#define RANDOM_CONFIG_S_LOCK(x) sx_slock(&randomdev_config_lock)
|
|
#define RANDOM_CONFIG_S_UNLOCK(x) sx_sunlock(&randomdev_config_lock)
|
|
#define RANDOM_CONFIG_DEINIT_LOCK(x) sx_destroy(&randomdev_config_lock)
|
|
void random_infra_init(int (*)(struct uio *, bool), void (*)(void *, u_int));
|
|
void random_infra_uninit(void);
|
|
#endif
|
|
|
|
#endif /* _KERNEL */
|
|
|
|
void randomdev_unblock(void);
|
|
|
|
#endif /* SYS_DEV_RANDOM_RANDOMDEV_H_INCLUDED */
|