diff options
author | markm <markm@FreeBSD.org> | 2015-06-30 17:00:45 +0000 |
---|---|---|
committer | markm <markm@FreeBSD.org> | 2015-06-30 17:00:45 +0000 |
commit | d5861655770012f2a69a575c40f59a3567351672 (patch) | |
tree | 82d243ed8a8d99736037cb5fd91f951a7c437dad /sys/libkern | |
parent | ad2d1e43ad54fd55f2a1247d1ef22653048a7bec (diff) | |
download | FreeBSD-src-d5861655770012f2a69a575c40f59a3567351672.zip FreeBSD-src-d5861655770012f2a69a575c40f59a3567351672.tar.gz |
Huge cleanup of random(4) code.
* GENERAL
- Update copyright.
- Make kernel options for RANDOM_YARROW and RANDOM_DUMMY. Set
neither to ON, which means we want Fortuna
- If there is no 'device random' in the kernel, there will be NO
random(4) device in the kernel, and the KERN_ARND sysctl will
return nothing. With RANDOM_DUMMY there will be a random(4) that
always blocks.
- Repair kern.arandom (KERN_ARND sysctl). The old version went
through arc4random(9) and was a bit weird.
- Adjust arc4random stirring a bit - the existing code looks a little
suspect.
- Fix the nasty pre- and post-read overloading by providing explictit
functions to do these tasks.
- Redo read_random(9) so as to duplicate random(4)'s read internals.
This makes it a first-class citizen rather than a hack.
- Move stuff out of locked regions when it does not need to be
there.
- Trim RANDOM_DEBUG printfs. Some are excess to requirement, some
behind boot verbose.
- Use SYSINIT to sequence the startup.
- Fix init/deinit sysctl stuff.
- Make relevant sysctls also tunables.
- Add different harvesting "styles" to allow for different requirements
(direct, queue, fast).
- Add harvesting of FFS atime events. This needs to be checked for
weighing down the FS code.
- Add harvesting of slab allocator events. This needs to be checked for
weighing down the allocator code.
- Fix the random(9) manpage.
- Loadable modules are not present for now. These will be re-engineered
when the dust settles.
- Use macros for locks.
- Fix comments.
* src/share/man/...
- Update the man pages.
* src/etc/...
- The startup/shutdown work is done in D2924.
* src/UPDATING
- Add UPDATING announcement.
* src/sys/dev/random/build.sh
- Add copyright.
- Add libz for unit tests.
* src/sys/dev/random/dummy.c
- Remove; no longer needed. Functionality incorporated into randomdev.*.
* live_entropy_sources.c live_entropy_sources.h
- Remove; content moved.
- move content to randomdev.[ch] and optimise.
* src/sys/dev/random/random_adaptors.c src/sys/dev/random/random_adaptors.h
- Remove; plugability is no longer used. Compile-time algorithm
selection is the way to go.
* src/sys/dev/random/random_harvestq.c src/sys/dev/random/random_harvestq.h
- Add early (re)boot-time randomness caching.
* src/sys/dev/random/randomdev_soft.c src/sys/dev/random/randomdev_soft.h
- Remove; no longer needed.
* src/sys/dev/random/uint128.h
- Provide a fake uint128_t; if a real one ever arrived, we can use
that instead. All that is needed here is N=0, N++, N==0, and some
localised trickery is used to manufacture a 128-bit 0ULLL.
* src/sys/dev/random/unit_test.c src/sys/dev/random/unit_test.h
- Improve unit tests; previously the testing human needed clairvoyance;
now the test will do a basic check of compressibility. Clairvoyant
talent is still a good idea.
- This is still a long way off a proper unit test.
* src/sys/dev/random/fortuna.c src/sys/dev/random/fortuna.h
- Improve messy union to just uint128_t.
- Remove unneeded 'static struct fortuna_start_cache'.
- Tighten up up arithmetic.
- Provide a method to allow eternal junk to be introduced; harden
it against blatant by compress/hashing.
- Assert that locks are held correctly.
- Fix the nasty pre- and post-read overloading by providing explictit
functions to do these tasks.
- Turn into self-sufficient module (no longer requires randomdev_soft.[ch])
* src/sys/dev/random/yarrow.c src/sys/dev/random/yarrow.h
- Improve messy union to just uint128_t.
- Remove unneeded 'staic struct start_cache'.
- Tighten up up arithmetic.
- Provide a method to allow eternal junk to be introduced; harden
it against blatant by compress/hashing.
- Assert that locks are held correctly.
- Fix the nasty pre- and post-read overloading by providing explictit
functions to do these tasks.
- Turn into self-sufficient module (no longer requires randomdev_soft.[ch])
- Fix some magic numbers elsewhere used as FAST and SLOW.
Differential Revision: https://reviews.freebsd.org/D2025
Reviewed by: vsevolod,delphij,rwatson,trasz,jmg
Approved by: so (delphij)
Diffstat (limited to 'sys/libkern')
-rw-r--r-- | sys/libkern/arc4random.c | 24 | ||||
-rw-r--r-- | sys/libkern/random.c | 2 |
2 files changed, 10 insertions, 16 deletions
diff --git a/sys/libkern/arc4random.c b/sys/libkern/arc4random.c index 62ace2c..9de5a84 100644 --- a/sys/libkern/arc4random.c +++ b/sys/libkern/arc4random.c @@ -22,7 +22,7 @@ __FBSDID("$FreeBSD$"); #define ARC4_RESEED_BYTES 65536 #define ARC4_RESEED_SECONDS 300 -#define ARC4_KEYBYTES (256 / 8) +#define ARC4_KEYBYTES 256 int arc4rand_iniseed_state = ARC4_ENTR_NONE; @@ -48,39 +48,33 @@ arc4_swap(u_int8_t *a, u_int8_t *b) * Stir our S-box. */ static void -arc4_randomstir (void) +arc4_randomstir(void) { - u_int8_t key[256]; - int r, n; + u_int8_t key[ARC4_KEYBYTES]; + int n; struct timeval tv_now; /* - * XXX read_random() returns unsafe numbers if the entropy - * device is not loaded -- MarkM. + * XXX: FIX!! This isn't brilliant. Need more confidence. + * This returns zero entropy before random(4) is seeded. */ - r = read_random(key, ARC4_KEYBYTES); + (void)read_random(key, ARC4_KEYBYTES); getmicrouptime(&tv_now); mtx_lock(&arc4_mtx); - /* If r == 0 || -1, just use what was on the stack. */ - if (r > 0) { - for (n = r; n < sizeof(key); n++) - key[n] = key[n % r]; - } - for (n = 0; n < 256; n++) { arc4_j = (arc4_j + arc4_sbox[n] + key[n]) % 256; arc4_swap(&arc4_sbox[n], &arc4_sbox[arc4_j]); } arc4_i = arc4_j = 0; - /* Reset for next reseed cycle. */ arc4_t_reseed = tv_now.tv_sec + ARC4_RESEED_SECONDS; arc4_numruns = 0; - /* * Throw away the first N words of output, as suggested in the * paper "Weaknesses in the Key Scheduling Algorithm of RC4" * by Fluher, Mantin, and Shamir. (N = 256 in our case.) + * + * http://dl.acm.org/citation.cfm?id=646557.694759 */ for (n = 0; n < 256*4; n++) arc4_randbyte(); diff --git a/sys/libkern/random.c b/sys/libkern/random.c index 360ff81..3ad75bf 100644 --- a/sys/libkern/random.c +++ b/sys/libkern/random.c @@ -50,7 +50,7 @@ srandom(seed) } /* - * Pseudo-random number generator for randomizing the profiling clock, + * Pseudo-random number generator for perturbing the profiling clock, * and whatever else we might use it for. The result is uniform on * [0, 2^31 - 1]. */ |