There is an issue (not seen in our testing) where "yarrow" and

"dummy" switch priorities, and the users are left with no usable
/dev/random. The fix assigns priories to these and gives the users
what they want. The override tuneable has a stupid name (blame me!)
and this fixes it to be something that 'sysctl kern.random' emits
and is the right thing to set.

Approved by:	re (gjb)
Approved by:	secteam (cperciva)

4 files changed, 19 insertions, 7 deletions

diff --git a/sys/dev/random/dummy_rng.c b/sys/dev/random/dummy_rng.c
index a609da5..810a784 100644
--- a/sys/dev/random/dummy_rng.c
+++ b/sys/dev/random/dummy_rng.c
@@ -102,6 +102,7 @@ struct random_adaptor dummy_random = {
 	.read = (random_read_func_t *)random_null_func,
 	.reseed = (random_reseed_func_t *)random_null_func,
 	.seeded = 0, /* This device can never be seeded */
+	.priority = 1, /* Bottom priority, so goes to last position */
 };
 
 static int
diff --git a/sys/dev/random/random_adaptors.c b/sys/dev/random/random_adaptors.c
index e62b2c0..4f5ad2c 100644
--- a/sys/dev/random/random_adaptors.c
+++ b/sys/dev/random/random_adaptors.c
@@ -104,12 +104,13 @@ void
 random_adaptor_choose(struct random_adaptor **adaptor)
 {
 	char			 rngs[128], *token, *cp;
-	struct random_adaptors  *rpp;
+	struct random_adaptors	*rppi, *ramax;
+	unsigned		 primax;
 
 	KASSERT(adaptor != NULL, ("pre-conditions failed"));
 
 	*adaptor = NULL;
-	if (TUNABLE_STR_FETCH("rngs_want", rngs, sizeof(rngs))) {
+	if (TUNABLE_STR_FETCH("kern.random.active_adaptor", rngs, sizeof(rngs))) {
 		cp = rngs;
 
 		while ((token = strsep(&cp, ",")) != NULL)
@@ -120,16 +121,23 @@ random_adaptor_choose(struct random_adaptor **adaptor)
 				    " skipping\n", token);
 	}
 
+	primax = 0U;
 	if (*adaptor == NULL) {
 		/*
-		 * Fallback to the first thing that's on the list of
-		 * available RNGs.
+		 * Fall back to the highest priority item on the available
+		 * RNG list.
 		 */
 		sx_slock(&adaptors_lock);
 
-		rpp = LIST_FIRST(&adaptors);
-		if (rpp != NULL)
-			*adaptor = rpp->rsp;
+		ramax = NULL;
+		LIST_FOREACH(rppi, &adaptors, entries) {
+			if (rppi->rsp->priority >= primax) {
+				ramax = rppi;
+				primax = rppi->rsp->priority;
+			}
+		}
+		if (ramax != NULL)
+			*adaptor = ramax->rsp;
 
 		sx_sunlock(&adaptors_lock);
 
diff --git a/sys/dev/random/randomdev.h b/sys/dev/random/randomdev.h
index 5be595f..b87789f 100644
--- a/sys/dev/random/randomdev.h
+++ b/sys/dev/random/randomdev.h
@@ -44,6 +44,7 @@ struct random_adaptor {
 	struct selinfo		rsel;
 	const char		*ident;
 	int			seeded;
+	unsigned		priority;
 	random_init_func_t	*init;
 	random_deinit_func_t	*deinit;
 	random_block_func_t	*block;
diff --git a/sys/dev/random/randomdev_soft.c b/sys/dev/random/randomdev_soft.c
index db0b016..0929704 100644
--- a/sys/dev/random/randomdev_soft.c
+++ b/sys/dev/random/randomdev_soft.c
@@ -84,6 +84,7 @@ static struct random_adaptor random_context = {
 	.poll = randomdev_poll,
 	.reseed = randomdev_flush_reseed,
 	.seeded = 0, /* This will be seeded during entropy processing */
+	.priority = 90, /* High priority, so top of the list. Fortuna may still win. */
 };
 #define RANDOM_MODULE_NAME	yarrow
 #define RANDOM_CSPRNG_NAME	"yarrow"
@@ -99,6 +100,7 @@ static struct random_adaptor random_context = {
 	.poll = randomdev_poll,
 	.reseed = randomdev_flush_reseed,
 	.seeded = 0, /* This will be excplicitly seeded at startup when secured */
+	.priority = 100, /* High priority, so top of the list. Beat Yarrow. */
 };
 #define RANDOM_MODULE_NAME	fortuna
 #define RANDOM_CSPRNG_NAME	"fortuna"