Commit Graph

196 Commits

Author SHA1 Message Date
Mark Murray
dcabe03158 Fix printf-like formats for KASSERT.
Submitted by:	jenkins
Approved by:	so (/dev/random blanket)
2015-10-05 10:45:52 +00:00
Mark Murray
0a9565c86e It appears that under some circumstances, like virtualisiation, the
'rdrand' instruction may occasionally not return random numbers, in
spite of looping attempts to do so. The reusult is a KASSERT/panic.

Reluctantly accept this state-of-affairs, but make a noise about it.
if this 'noise' spams the console, it may be time to discontinue
using that source.

This is written in a general way to account for /any/ source that
might not supply random numbers when required.

Submitted by:	jkh (report and slightly different fix)
Approved by:	so (/dev/random blanket)
2015-10-05 07:41:12 +00:00
Mark Murray
e866d8f05b Make the UMA harvesting go away completely if not wanted. Default to "not wanted".
Provide and document the RANDOM_ENABLE_UMA option.

Change RANDOM_FAST to RANDOM_UMA to clarify the harvesting.

Remove RANDOM_DEBUG option, replace with SDT probes. These will be of
use to folks measuring the harvesting effect when deciding whether to
use RANDOM_ENABLE_UMA.

Requested by:	scottl and others.
Approved by:	so (/dev/random blanket)
Differential Revision:    https://reviews.freebsd.org/D3197
2015-08-22 12:59:05 +00:00
Mark Murray
646041a89a Add DEV_RANDOM pseudo-option and use it to "include out" random(4)
if desired.

Retire randomdev_none.c and introduce random_infra.c for resident
infrastructure. Completely stub out random(4) calls in the "without
DEV_RANDOM" case.

Add RANDOM_LOADABLE option to allow loadable Yarrow/Fortuna/LocallyWritten
algorithm.  Add a skeleton "other" algorithm framework for folks
to add their own processing code. NIST, anyone?

Retire the RANDOM_DUMMY option.

Build modules for Yarrow, Fortuna and "other".

Use atomics for the live entropy rate-tracking.

Convert ints to bools for the 'seeded' logic.

Move _write() function from the algorithm-specific areas to randomdev.c

Get rid of reseed() function - it is unused.

Tidy up the opt_*.h includes.

Update documentation for random(4) modules.

Fix test program (reviewers, please leave this).

Differential Revision:    https://reviews.freebsd.org/D3354
Reviewed by:              wblock,delphij,jmg,bjk
Approved by:              so (/dev/random blanket)
2015-08-17 07:36:12 +00:00
Mark Murray
eda4aaeb3f Fix some untidy logic. I committed the wrong local fix; please pass the pointy hat.
Approved by:        so (/dev/random blanket)
2015-07-19 18:07:35 +00:00
Mark Murray
f703e79990 Remove out-of-date comments.
Approved by:        so (/dev/random blanket)
2015-07-19 16:05:34 +00:00
Mark Murray
dbefaadca8 Fix the read blocking so that it is interruptable and slow down the rate of console warning spamming while blocked.
Approved by:	so (/dev/random blanket)
2015-07-19 16:05:30 +00:00
Mark Murray
95b184a048 Optimise the buffer-size calculation. It was possible to get one block too many.
Approved by:	so (/dev/random blanket)
2015-07-19 16:05:23 +00:00
Ed Schouten
bc41a24735 Fix the build after breaking it in r285549.
I performed the commit on a different system as where I wrote the
change. After pulling in the change from Phabricator, I didn't notice
that a single chunk did not apply.

Approved by:	secteam (implicit, as intended change was approved)
Pointy hat to:	me
2015-07-14 20:45:24 +00:00
Ed Schouten
707d98fe2f Implement the CloudABI random_get() system call.
The random_get() system call works similar to getentropy()/getrandom()
on OpenBSD/Linux. It fills a buffer with random data.

This change introduces a new function, read_random_uio(), that is used
to implement read() on the random devices. We can call into this
function from within the CloudABI compatibility layer.

Approved by:	secteam
Reviewed by:	jmg, markm, wblock
Obtained from:	https://github.com/NuxiNL/freebsd
Differential Revision:	https://reviews.freebsd.org/D3053
2015-07-14 18:45:15 +00:00
Mark Murray
b712101cf7 Rework the read routines to keep the PRNG sources happy. These work
in units of crypto blocks, so must have adequate space to write.
This means needing to be careful about buffers and keeping track
of external read request length.

Approved by:	so (/dev/random blanket)
2015-07-13 08:38:21 +00:00
Mark Murray
3aa77530ca * Address review (and add a bit myself).
- Tweek man page.
 - Remove all mention of RANDOM_FORTUNA. If the system owner wants YARROW or DUMMY, they ask for it, otherwise they get FORTUNA.
 - Tidy up headers a bit.
 - Tidy up declarations a bit.
 - Make static in a couple of places where needed.
 - Move Yarrow/Fortuna SYSINIT/SYSUNINIT to randomdev.c, moving us towards a single file where the algorithm context is used.
 - Get rid of random_*_process_buffer() functions. They were only used in one place each, and are better subsumed into those places.
 - Remove *_post_read() functions as they are stubs everywhere.
 - Assert against buffer size illegalities.
 - Clean up some silly code in the randomdev_read() routine.
 - Make the harvesting more consistent.
 - Make some requested argument name changes.
 - Tidy up and clarify a few comments.
 - Make some requested comment changes.
 - Make some requested macro changes.

* NOTE: the thing calling itself a 'unit test' is not yet a proper
  unit test, but it helps me ensure things work. It may be a proper
  unit test at some time in the future, but for now please don't make
  any assumptions or hold any expectations.

Differential Revision:	https://reviews.freebsd.org/D2025
Approved by:	so (/dev/random blanket)
2015-07-12 18:14:38 +00:00
Mark Murray
d1b06863fb Huge cleanup of random(4) code.
* GENERAL
- Update copyright.
- Make kernel options for RANDOM_YARROW and RANDOM_DUMMY. Set
  neither to ON, which means we want Fortuna
- If there is no 'device random' in the kernel, there will be NO
  random(4) device in the kernel, and the KERN_ARND sysctl will
  return nothing. With RANDOM_DUMMY there will be a random(4) that
  always blocks.
- Repair kern.arandom (KERN_ARND sysctl). The old version went
  through arc4random(9) and was a bit weird.
- Adjust arc4random stirring a bit - the existing code looks a little
  suspect.
- Fix the nasty pre- and post-read overloading by providing explictit
  functions to do these tasks.
- Redo read_random(9) so as to duplicate random(4)'s read internals.
  This makes it a first-class citizen rather than a hack.
- Move stuff out of locked regions when it does not need to be
  there.
- Trim RANDOM_DEBUG printfs. Some are excess to requirement, some
  behind boot verbose.
- Use SYSINIT to sequence the startup.
- Fix init/deinit sysctl stuff.
- Make relevant sysctls also tunables.
- Add different harvesting "styles" to allow for different requirements
  (direct, queue, fast).
- Add harvesting of FFS atime events. This needs to be checked for
  weighing down the FS code.
- Add harvesting of slab allocator events. This needs to be checked for
  weighing down the allocator code.
- Fix the random(9) manpage.
- Loadable modules are not present for now. These will be re-engineered
  when the dust settles.
- Use macros for locks.
- Fix comments.

* src/share/man/...
- Update the man pages.

* src/etc/...
- The startup/shutdown work is done in D2924.

* src/UPDATING
- Add UPDATING announcement.

* src/sys/dev/random/build.sh
- Add copyright.
- Add libz for unit tests.

* src/sys/dev/random/dummy.c
- Remove; no longer needed. Functionality incorporated into randomdev.*.

* live_entropy_sources.c live_entropy_sources.h
- Remove; content moved.
- move content to randomdev.[ch] and optimise.

* src/sys/dev/random/random_adaptors.c src/sys/dev/random/random_adaptors.h
- Remove; plugability is no longer used. Compile-time algorithm
  selection is the way to go.

* src/sys/dev/random/random_harvestq.c src/sys/dev/random/random_harvestq.h
- Add early (re)boot-time randomness caching.

* src/sys/dev/random/randomdev_soft.c src/sys/dev/random/randomdev_soft.h
- Remove; no longer needed.

* src/sys/dev/random/uint128.h
- Provide a fake uint128_t; if a real one ever arrived, we can use
  that instead. All that is needed here is N=0, N++, N==0, and some
  localised trickery is used to manufacture a 128-bit 0ULLL.

* src/sys/dev/random/unit_test.c src/sys/dev/random/unit_test.h
- Improve unit tests; previously the testing human needed clairvoyance;
  now the test will do a basic check of compressibility. Clairvoyant
  talent is still a good idea.
- This is still a long way off a proper unit test.

* src/sys/dev/random/fortuna.c src/sys/dev/random/fortuna.h
- Improve messy union to just uint128_t.
- Remove unneeded 'static struct fortuna_start_cache'.
- Tighten up up arithmetic.
- Provide a method to allow eternal junk to be introduced; harden
  it against blatant by compress/hashing.
- Assert that locks are held correctly.
- Fix the nasty pre- and post-read overloading by providing explictit
  functions to do these tasks.
- Turn into self-sufficient module (no longer requires randomdev_soft.[ch])

* src/sys/dev/random/yarrow.c src/sys/dev/random/yarrow.h
- Improve messy union to just uint128_t.
- Remove unneeded 'staic struct start_cache'.
- Tighten up up arithmetic.
- Provide a method to allow eternal junk to be introduced; harden
  it against blatant by compress/hashing.
- Assert that locks are held correctly.
- Fix the nasty pre- and post-read overloading by providing explictit
  functions to do these tasks.
- Turn into self-sufficient module (no longer requires randomdev_soft.[ch])
- Fix some magic numbers elsewhere used as FAST and SLOW.

Differential Revision: https://reviews.freebsd.org/D2025
Reviewed by: vsevolod,delphij,rwatson,trasz,jmg
Approved by: so (delphij)
2015-06-30 17:00:45 +00:00
Xin LI
8d45c8ab96 - fortuna.c: catch up with r278927 and fix a buffer overflow by using the
temporary buffer when remaining space is not enough to hold
	      a whole block.
 - yarrow.c:  add a comment that we intend to change the code and remove
	      memcpy's in the future. (*)

Requested by:	markm (*)
Reviewed by:	markm
Approved by:	so (self)
2015-02-18 08:21:51 +00:00
John-Mark Gurney
5da74e04ec Fix a bug where this function overflowed it's buffer... This was
causing ZFS panics on boot...

This is purely reviewed and tested by peter.

Reviewed by:	peter
Approved by:	so (implicit), peter
2015-02-17 23:14:26 +00:00
John-Mark Gurney
601e8bcdf4 When the new random adaptor code was brought it in r273872, a call to
randomdev_init_reader to change read_random over to the newly installed
adaptor was missed.  This means both read_random and arc4random (seeded
from read_random) were not returning very random data.  This also
effects userland arc4random as it is seeded from kernel arc4random.

The random devices are uneffected and have returned good randomness
since the change.

All keys generated with a kernel of r273872 must be regenerated with
a kernel with this patch.  Keys generated may be predictable.

Remove the warning as log is too early to print anything, and it would
always get printed due to early use of arc4random...

Reviewed by:	delphij, markm
Approved by:    so (delphij)
2015-02-17 17:37:00 +00:00
Konstantin Belousov
843c718fa7 Update comment.
Noted by:	dim
Approved by:	secteam (des)
MFC after:	4 days
2014-11-11 14:30:35 +00:00
Dag-Erling Smørgrav
133cdd9e13 Constify the AES code and propagate to consumers. This allows us to
update the Fortuna code to use SHAd-256 as defined in FS&K.

Approved by:	so (self)
2014-11-10 09:44:38 +00:00
Konstantin Belousov
48e279eaa7 Fix random.ko module.
- Remove duplicated sources between standard part of the kernel and
  module.  In particular, it caused duplicated lock initialization and
  sysctl registration, both having bad consequences.
- Add missed source files to module.
- Static part of the kernel provides randomdev module, not
  random_adaptors.  Correct dependencies.
- Use cdev modules declaration macros.

Approved by:	secteam (delphij)
Reviewed by:	markm
2014-11-07 20:23:43 +00:00
Konstantin Belousov
76c16ab94f Simplify assembler in ivy.c. Move the copying of the random bits into
buffer from asm to C, which reduces amount of arguments for inline asm
and simplifies constraints.  Use unsigned types consistently.

Submitted by:	bde
Approved by:	secteam (delphij)
Reviewed by:	markm
MFC after:	1 week
2014-11-07 20:10:09 +00:00
Dag-Erling Smørgrav
02cd12d6d6 When reseeding the DPRNG, we're supposed to hash the current key and
some accumulated entropy twice and use that as the new key.  Due to a
typo, we were using the output of the first hash round instead of the
second.  Correct this, but eliminate temp[] since we can reuse hash[].
Also add comments explaining what is going on and why.

Noticed by:	Sami Farin <sami.farin@gmail.com>
Reviewed by:	markm@
Approved by:	so (des)
2014-11-04 23:02:19 +00:00
Xin LI
1077321975 Don't assert random_adaptors_lock in random_adaptor_read_rate().
Reported by:	many
Pointy hat to:	delphij (for not testing the commit with WITNESS)
Approved by:	so
2014-11-03 04:41:29 +00:00
Xin LI
57cd52ca4c - Make sure random_adaptor accesses happen only when
random_adaptors_lock is held.
 - Use sx_sleep instead of tsleep in read and write path to allow
   another thread that registers a new random adapter when waiting.
   Assert that random_adaptor is not NULL after reacquiring the lock.
 - Capture EINTR/ERESTART from sx_sleep to allow the blocking cycle be
   stopped when user requests so, while there also make short
   read/write's return 0.
 - Move M_WAITOK allocations out of lock scope.

In collobration with:	kib, markm, ian, jilles
Reviewed by:	kib, markm
Approved by:	so
2014-11-02 23:30:50 +00:00
Dag-Erling Smørgrav
8c9ba8414c Restore the auto-reseed logic, but move it to a much later point,
immediately before kick_init.

Approved by:	so (self)
2014-11-02 02:01:55 +00:00
Mark Murray
10cb24248a This is the much-discussed major upgrade to the random(4) device, known to you all as /dev/random.
This code has had an extensive rewrite and a good series of reviews, both by the author and other parties. This means a lot of code has been simplified. Pluggable structures for high-rate entropy generators are available, and it is most definitely not the case that /dev/random can be driven by only a hardware souce any more. This has been designed out of the device. Hardware sources are stirred into the CSPRNG (Yarrow, Fortuna) like any other entropy source. Pluggable modules may be written by third parties for additional sources.

The harvesting structures and consequently the locking have been simplified. Entropy harvesting is done in a more general way (the documentation for this will follow). There is some GREAT entropy to be had in the UMA allocator, but it is disabled for now as messing with that is likely to annoy many people.

The venerable (but effective) Yarrow algorithm, which is no longer supported by its authors now has an alternative, Fortuna. For now, Yarrow is retained as the default algorithm, but this may be changed using a kernel option. It is intended to make Fortuna the default algorithm for 11.0. Interested parties are encouraged to read ISBN 978-0-470-47424-2 "Cryptography Engineering" By Ferguson, Schneier and Kohno for Fortuna's gory details. Heck, read it anyway.

Many thanks to Arthur Mesh who did early grunt work, and who got caught in the crossfire rather more than he deserved to.

My thanks also to folks who helped me thresh this out on whiteboards and in the odd "Hallway track", or otherwise.

My Nomex pants are on. Let the feedback commence!

Reviewed by:	trasz,des(partial),imp(partial?),rwatson(partial?)
Approved by:	so(des)
2014-10-30 21:21:53 +00:00
Navdeep Parhar
3f52cae506 Make sure correct object code is generated at -O0.
Submitted by:	grehan@
Approved by:	so@ (des)
MFC after:	1 month
2014-10-13 06:50:08 +00:00
Xin LI
d2f1b8f4d2 Use Intel's official name (Secure Key) per Intel® Digital Random Number
Generator (DRNG) Software Implementation Guide.

Reviewed by:	kib
Approved by:	so
MFC after:	2 weeks
2014-06-27 21:33:15 +00:00
Mark Murray
169050a030 Correctly set the sysctl format to Alphanumeric, rather than letting it default.
Approved by: security-officer(des)
2014-04-26 13:21:28 +00:00
Adrian Chadd
a09968c479 Convert the random entropy harvesting code to use a const void * pointer
rather than just void *.

Then, as part of this, convert a couple of mbuf m->m_data accesses
to mtod(m, const void *).

Reviewed by:	markm
Approved by:	security-officer (delphij)
Sponsored by:	Netflix, Inc.
2013-11-01 20:53:49 +00:00
Konstantin Belousov
7c3547bacd Utilize the stronger guarantees on the call arguments from the
harvester, which now always calls hwrngs with the buffer length
multiple of the word size.  This allows to remove the excessive memory
accesses to temporary buffer when saving the entropy word.

Streamline the assembly and unify it between i386 and amd64.

Reviewed by:	markm, des
Approved by:	so (des)
Sponsored by:	The FreeBSD Foundation
MFC after:	2 weeks
2013-10-17 07:57:58 +00:00
Mark Murray
4024528a27 Make sure a vaiable is always initialised. 2013-10-12 23:19:01 +00:00
Mark Murray
63edd2efc3 Fix a problem where the priority order of yarrow,dummy can get reversed
to dummy,yarrow and break the usability of /dev/random.

Fix the name of the tunable to something logical that 'sysctl kern.random'
emits.

Submitted by:	des@ (the idea, code by me)
2013-10-12 23:15:06 +00:00
Mark Murray
9c9797f7c5 Fix for i386. 2013-10-11 20:53:25 +00:00
Mark Murray
663c239342 Fix a constant printf which is (int) on some architectures and (long int) on others. 2013-10-10 07:39:19 +00:00
Dag-Erling Smørgrav
997b0a641d Add a RANDOM_RWFILE option and hide the entropy cache code behind it.
Rename YARROW_RNG and FORTUNA_RNG to RANDOM_YARROW and RANDOM_FORTUNA.
Add the RANDOM_* options to LINT.
2013-10-09 20:14:16 +00:00
Mark Murray
1b24a3a73b Sigh. I can't even get a single #ifdef right. Who's got the hat? 2013-10-09 18:11:15 +00:00
Dag-Erling Smørgrav
1b277d38f6 staticize struct random_hardware_source 2013-10-09 17:51:38 +00:00
Mark Murray
6a7ba84834 Wrap some policy-rich code in 'if NOTYET' until we can thresh out what it really needs to do. 2013-10-09 17:50:36 +00:00
Dag-Erling Smørgrav
aa1c90971f Re-add /dev/urandom for compatibility purposes. 2013-10-09 09:13:12 +00:00
Dag-Erling Smørgrav
85bbc612af comment nit 2013-10-09 09:12:44 +00:00
Dag-Erling Smørgrav
3e8957ea85 Add missing include guards and move the existing ones out of the
implementation namespace.
2013-10-09 09:11:14 +00:00
Mark Murray
b9887f5053 Fix some just-noticed problems:
o Allow this to work with "nodevice random" by fixing where the MALLOC pool is defined.

o Fix the explicit reseed code. This was correct as submitted, but in the project branch doesn't need to set the "seeded" bit as this is done correctly in the "unblock" function.

o Remove some debug ifdeffing.

o Adjust comments.
2013-10-08 22:14:07 +00:00
Mark Murray
898f83f9eb MFC - tracking commit. 2013-10-08 19:07:48 +00:00
Mark Murray
623f70165f Time to eat crow for me.
I replaced the sx_* locks that Arthur used with regular mutexes; this turned out the be the wrong thing to do as the locks need to be sleepable. Revert this folly.

Submitted by:	Arthur Mesh <arthurmesh@gmail.com> (In original diff)
2013-10-08 18:48:11 +00:00
Dimitry Andric
e7ad54b2b4 Now our binutils's assembler supports the Intel Random Number Generator
extensions, we can change the .byte directives in sys/dev/random/ivy.c
to plain 'rdrand' mnemonics.  This already worked for clang users, but
now it will also work for gcc users.

Approved by:	re (kib)
Approved by:	so (des)
MFC after:	1 week
2013-10-08 17:26:28 +00:00
Dag-Erling Smørgrav
db3fcaf970 Add YARROW_RNG and FORTUNA_RNG to sys/conf/options.
Add a SYSINIT that forces a reseed during proc0 setup, which happens
fairly late in the boot process.

Add a RANDOM_DEBUG option which enables some debugging printf()s.

Add a new RANDOM_ATTACH entropy source which harvests entropy from the
get_cyclecount() delta across each call to a device attach method.
2013-10-08 11:05:26 +00:00
Mark Murray
6e818c871f Debugging. My attempt at EVENTHANDLER(multiuser) was a failure; use EVENTHANDLER(mountroot) instead.
This means we can't count on /var being present, so something will need to be done about harvesting /var/db/entropy/... .

Some policy now needs to be sorted out, and a pre-sync cache needs to be written, but apart from that we are now ready to go.

Over to review.
2013-10-08 06:54:52 +00:00
Mark Murray
1a3c1f06dd Snapshot.
Looking pretty good; this mostly works now. New code includes:

* Read cached entropy at startup, both from files and from loader(8) preloaded entropy. Failures are soft, but announced. Untested.

* Use EVENTHANDLER to do above just before we go multiuser. Untested.
2013-10-06 22:45:02 +00:00
Mark Murray
ad1f331196 Debug run. This now works, except that the "live" sources haven't
been tested. With all sources turned on, this unlocks itself in
a couple of seconds! That is no my box, and there is no guarantee
that this will be the case everywhere.

* Cut debug prints.

* Use the same locks/mutexes all the way through.

* Be a tad more conservative about entropy estimates.
2013-10-06 12:40:32 +00:00
Mark Murray
eee1352e67 Don't use the "real" assembler mnemonics; older compilers may not
understand them (like when building CURRENT on 9.x).

Submitted by:	Konstantin Belousov <kostikbel@gmail.com>
2013-10-06 12:35:29 +00:00