d0d71d818c
At a basic level, remove assumptions about the underlying algorithm (such as output block size and reseeding requirements) from the algorithm-independent logic in randomdev.c. Chacha20 does not have many of the restrictions that AES-ICM does as a PRF (Pseudo-Random Function), because it has a cipher block size of 512 bits. The motivation is that by generalizing the API, Chacha is not penalized by the limitations of AES. In READ_RANDOM_UIO, first attempt to NOWAIT allocate a large enough buffer for the entire user request, or the maximal input we'll accept between signal checking, whichever is smaller. The idea is that the implementation of any randomdev algorithm is then free to divide up large requests in whatever fashion it sees fit. As part of this, two responsibilities from the "algorithm-generic" randomdev code are pushed down into the Fortuna ra_read implementation (and any other future or out-of-tree ra_read implementations): 1. If an algorithm needs to rekey every N bytes, it is responsible for handling that in ra_read(). (I.e., Fortuna's 1MB rekey interval for AES block generation.) 2. If an algorithm uses a block cipher that doesn't tolerate partial-block requests (again, e.g., AES), it is also responsible for handling that in ra_read(). Several APIs are changed from u_int buffer length to the more canonical size_t. Several APIs are changed from taking a blockcount to a bytecount, to permit PRFs like Chacha20 to directly generate quantities of output that are not multiples of RANDOM_BLOCKSIZE (AES block size). The Fortuna algorithm is changed to NOT rekey every 1MiB when in Chacha20 mode (kern.random.use_chacha20_cipher="1"). This is explicitly supported by the math in FS&K §9.4 (Ferguson, Schneier, and Kohno; "Cryptography Engineering"), as well as by their conclusion: "If we had a block cipher with a 256-bit [or greater] block size, then the collisions would not have been an issue at all." For now, continue to break up reads into PAGE_SIZE chunks, as they were before. So, no functional change, mostly. Reviewed by: markm Approved by: secteam(delphij) Differential Revision: https://reviews.freebsd.org/D20312
137 lines
4.5 KiB
C
137 lines
4.5 KiB
C
/*-
|
|
* Copyright (c) 2000-2015 Mark R V Murray
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer
|
|
* in this position and unchanged.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
|
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
|
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
|
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
|
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
*
|
|
* $FreeBSD$
|
|
*/
|
|
|
|
#ifndef SYS_DEV_RANDOM_RANDOMDEV_H_INCLUDED
|
|
#define SYS_DEV_RANDOM_RANDOMDEV_H_INCLUDED
|
|
|
|
#ifdef _KERNEL
|
|
|
|
/* This header contains only those definitions that are global
|
|
* and non algorithm-specific for the entropy processor
|
|
*/
|
|
|
|
#ifdef SYSCTL_DECL /* from sysctl.h */
|
|
SYSCTL_DECL(_kern_random);
|
|
SYSCTL_DECL(_kern_random_initial_seeding);
|
|
|
|
#define RANDOM_CHECK_UINT(name, min, max) \
|
|
static int \
|
|
random_check_uint_##name(SYSCTL_HANDLER_ARGS) \
|
|
{ \
|
|
if (oidp->oid_arg1 != NULL) { \
|
|
if (*(u_int *)(oidp->oid_arg1) <= (min)) \
|
|
*(u_int *)(oidp->oid_arg1) = (min); \
|
|
else if (*(u_int *)(oidp->oid_arg1) > (max)) \
|
|
*(u_int *)(oidp->oid_arg1) = (max); \
|
|
} \
|
|
return (sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, \
|
|
req)); \
|
|
}
|
|
#endif /* SYSCTL_DECL */
|
|
|
|
MALLOC_DECLARE(M_ENTROPY);
|
|
|
|
extern bool random_bypass_before_seeding;
|
|
extern bool read_random_bypassed_before_seeding;
|
|
extern bool arc4random_bypassed_before_seeding;
|
|
extern bool random_bypass_disable_warnings;
|
|
|
|
#endif /* _KERNEL */
|
|
|
|
struct harvest_event;
|
|
|
|
typedef void random_alg_init_t(void *);
|
|
typedef void random_alg_deinit_t(void *);
|
|
typedef void random_alg_pre_read_t(void);
|
|
typedef void random_alg_read_t(uint8_t *, size_t);
|
|
typedef bool random_alg_seeded_t(void);
|
|
typedef void random_alg_reseed_t(void);
|
|
typedef void random_alg_eventprocessor_t(struct harvest_event *);
|
|
|
|
typedef u_int random_source_read_t(void *, u_int);
|
|
|
|
/*
|
|
* Random Algorithm is a processor of randomness for the kernel
|
|
* and for userland.
|
|
*/
|
|
struct random_algorithm {
|
|
const char *ra_ident;
|
|
u_int ra_poolcount;
|
|
void (*ra_init_alg)(void *);
|
|
void (*ra_deinit_alg)(void *);
|
|
random_alg_pre_read_t *ra_pre_read;
|
|
random_alg_read_t *ra_read;
|
|
random_alg_seeded_t *ra_seeded;
|
|
random_alg_eventprocessor_t *ra_event_processor;
|
|
};
|
|
|
|
extern struct random_algorithm random_alg_context, *p_random_alg_context;
|
|
|
|
#ifdef _KERNEL
|
|
|
|
/*
|
|
* Random Source is a source of entropy that can provide
|
|
* specified or approximate amount of entropy immediately
|
|
* upon request.
|
|
*/
|
|
struct random_source {
|
|
const char *rs_ident;
|
|
enum random_entropy_source rs_source;
|
|
random_source_read_t *rs_read;
|
|
};
|
|
|
|
struct random_sources {
|
|
LIST_ENTRY(random_sources) rrs_entries;
|
|
struct random_source *rrs_source;
|
|
};
|
|
|
|
LIST_HEAD(sources_head, random_sources);
|
|
extern struct sources_head source_list;
|
|
|
|
void random_source_register(struct random_source *);
|
|
void random_source_deregister(struct random_source *);
|
|
|
|
#if defined(RANDOM_LOADABLE)
|
|
extern struct sx randomdev_config_lock;
|
|
#define RANDOM_CONFIG_INIT_LOCK(x) sx_init(&randomdev_config_lock, "configuration change lock")
|
|
#define RANDOM_CONFIG_X_LOCK(x) sx_xlock(&randomdev_config_lock)
|
|
#define RANDOM_CONFIG_X_UNLOCK(x) sx_xunlock(&randomdev_config_lock)
|
|
#define RANDOM_CONFIG_S_LOCK(x) sx_slock(&randomdev_config_lock)
|
|
#define RANDOM_CONFIG_S_UNLOCK(x) sx_sunlock(&randomdev_config_lock)
|
|
#define RANDOM_CONFIG_DEINIT_LOCK(x) sx_destroy(&randomdev_config_lock)
|
|
void random_infra_init(int (*)(struct uio *, bool), void (*)(void *, u_int),
|
|
bool (*)(void));
|
|
void random_infra_uninit(void);
|
|
#endif
|
|
|
|
#endif /* _KERNEL */
|
|
|
|
void randomdev_unblock(void);
|
|
|
|
#endif /* SYS_DEV_RANDOM_RANDOMDEV_H_INCLUDED */
|