subr_cprng.c revision 1.24.2.1.2.1
1 /* $NetBSD: subr_cprng.c,v 1.24.2.1.2.1 2019/09/03 12:30:46 martin Exp $ */ 2 3 /*- 4 * Copyright (c) 2011-2013 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Thor Lancelot Simon and Taylor R. Campbell. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __KERNEL_RCSID(0, "$NetBSD: subr_cprng.c,v 1.24.2.1.2.1 2019/09/03 12:30:46 martin Exp $"); 34 35 #include <sys/param.h> 36 #include <sys/types.h> 37 #include <sys/condvar.h> 38 #include <sys/cprng.h> 39 #include <sys/errno.h> 40 #include <sys/event.h> /* XXX struct knote */ 41 #include <sys/fcntl.h> /* XXX FNONBLOCK */ 42 #include <sys/kernel.h> 43 #include <sys/kmem.h> 44 #include <sys/lwp.h> 45 #include <sys/once.h> 46 #include <sys/percpu.h> 47 #include <sys/poll.h> /* XXX POLLIN/POLLOUT/&c. */ 48 #include <sys/select.h> 49 #include <sys/systm.h> 50 #include <sys/sysctl.h> 51 #include <sys/rnd.h> 52 #include <sys/rndsink.h> 53 #if DEBUG 54 #include <sys/rngtest.h> 55 #endif 56 57 #include <crypto/nist_hash_drbg/nist_hash_drbg.h> 58 59 #if defined(__HAVE_CPU_COUNTER) 60 #include <machine/cpu_counter.h> 61 #endif 62 63 static int sysctl_kern_urnd(SYSCTLFN_PROTO); 64 static int sysctl_kern_arnd(SYSCTLFN_PROTO); 65 66 static void cprng_strong_generate(struct cprng_strong *, void *, size_t); 67 static void cprng_strong_reseed(struct cprng_strong *); 68 static void cprng_strong_reseed_from(struct cprng_strong *, const void *, 69 size_t, bool); 70 #if DEBUG 71 static void cprng_strong_rngtest(struct cprng_strong *); 72 #endif 73 74 static rndsink_callback_t cprng_strong_rndsink_callback; 75 76 void 77 cprng_init(void) 78 { 79 static struct sysctllog *random_sysctllog; 80 81 if (nist_hash_drbg_initialize() != 0) 82 panic("NIST Hash_DRBG failed self-test"); 83 84 sysctl_createv(&random_sysctllog, 0, NULL, NULL, 85 CTLFLAG_PERMANENT, 86 CTLTYPE_INT, "urandom", 87 SYSCTL_DESCR("Random integer value"), 88 sysctl_kern_urnd, 0, NULL, 0, 89 CTL_KERN, KERN_URND, CTL_EOL); 90 sysctl_createv(&random_sysctllog, 0, NULL, NULL, 91 CTLFLAG_PERMANENT, 92 CTLTYPE_INT, "arandom", 93 SYSCTL_DESCR("n bytes of random data"), 94 sysctl_kern_arnd, 0, NULL, 0, 95 CTL_KERN, KERN_ARND, CTL_EOL); 96 } 97 98 static inline uint32_t 99 cprng_counter(void) 100 { 101 struct timeval tv; 102 103 #if defined(__HAVE_CPU_COUNTER) 104 if (cpu_hascounter()) 105 return cpu_counter32(); 106 #endif 107 if (__predict_false(cold)) { 108 static int ctr; 109 /* microtime unsafe if clock not running yet */ 110 return ctr++; 111 } 112 getmicrotime(&tv); 113 return (tv.tv_sec * 1000000 + tv.tv_usec); 114 } 115 116 struct cprng_strong { 117 char cs_name[16]; 118 int cs_flags; 119 kmutex_t cs_lock; 120 percpu_t *cs_percpu; 121 kcondvar_t cs_cv; 122 struct selinfo cs_selq; 123 struct rndsink *cs_rndsink; 124 bool cs_ready; 125 NIST_HASH_DRBG cs_drbg; 126 127 /* XXX Kludge for /dev/random `information-theoretic' properties. */ 128 unsigned int cs_remaining; 129 }; 130 131 struct cprng_strong * 132 cprng_strong_create(const char *name, int ipl, int flags) 133 { 134 const uint32_t cc = cprng_counter(); 135 struct cprng_strong *const cprng = kmem_alloc(sizeof(*cprng), 136 KM_SLEEP); 137 138 /* 139 * rndsink_request takes a spin lock at IPL_VM, so we can be no 140 * higher than that. 141 */ 142 KASSERT(ipl != IPL_SCHED && ipl != IPL_HIGH); 143 144 /* Initialize the easy fields. */ 145 (void)strlcpy(cprng->cs_name, name, sizeof(cprng->cs_name)); 146 cprng->cs_flags = flags; 147 mutex_init(&cprng->cs_lock, MUTEX_DEFAULT, ipl); 148 cv_init(&cprng->cs_cv, cprng->cs_name); 149 selinit(&cprng->cs_selq); 150 cprng->cs_rndsink = rndsink_create(NIST_HASH_DRBG_MIN_SEEDLEN_BYTES, 151 &cprng_strong_rndsink_callback, cprng); 152 153 /* Get some initial entropy. Record whether it is full entropy. */ 154 uint8_t seed[NIST_HASH_DRBG_MIN_SEEDLEN_BYTES]; 155 mutex_enter(&cprng->cs_lock); 156 cprng->cs_ready = rndsink_request(cprng->cs_rndsink, seed, 157 sizeof(seed)); 158 if (nist_hash_drbg_instantiate(&cprng->cs_drbg, seed, sizeof(seed), 159 &cc, sizeof(cc), cprng->cs_name, sizeof(cprng->cs_name))) 160 /* XXX Fix nist_hash_drbg API so this can't happen. */ 161 panic("cprng %s: NIST Hash_DRBG instantiation failed", 162 cprng->cs_name); 163 explicit_memset(seed, 0, sizeof(seed)); 164 165 if (ISSET(flags, CPRNG_HARD)) 166 cprng->cs_remaining = NIST_HASH_DRBG_MIN_SEEDLEN_BYTES; 167 else 168 cprng->cs_remaining = 0; 169 170 if (!cprng->cs_ready && !ISSET(flags, CPRNG_INIT_ANY)) 171 printf("cprng %s: creating with partial entropy\n", 172 cprng->cs_name); 173 mutex_exit(&cprng->cs_lock); 174 175 return cprng; 176 } 177 178 void 179 cprng_strong_destroy(struct cprng_strong *cprng) 180 { 181 182 /* 183 * Destroy the rndsink first to prevent calls to the callback. 184 */ 185 rndsink_destroy(cprng->cs_rndsink); 186 187 KASSERT(!cv_has_waiters(&cprng->cs_cv)); 188 #if 0 189 KASSERT(!select_has_waiters(&cprng->cs_selq)) /* XXX ? */ 190 #endif 191 192 nist_hash_drbg_destroy(&cprng->cs_drbg); 193 seldestroy(&cprng->cs_selq); 194 cv_destroy(&cprng->cs_cv); 195 mutex_destroy(&cprng->cs_lock); 196 197 explicit_memset(cprng, 0, sizeof(*cprng)); /* paranoia */ 198 kmem_free(cprng, sizeof(*cprng)); 199 } 200 201 /* 202 * Generate some data from cprng. Block or return zero bytes, 203 * depending on flags & FNONBLOCK, if cprng was created without 204 * CPRNG_REKEY_ANY. 205 */ 206 size_t 207 cprng_strong(struct cprng_strong *cprng, void *buffer, size_t bytes, int flags) 208 { 209 size_t result; 210 211 /* Caller must loop for more than CPRNG_MAX_LEN bytes. */ 212 bytes = MIN(bytes, CPRNG_MAX_LEN); 213 214 mutex_enter(&cprng->cs_lock); 215 216 if (ISSET(cprng->cs_flags, CPRNG_REKEY_ANY)) { 217 if (!cprng->cs_ready) 218 cprng_strong_reseed(cprng); 219 } else { 220 while (!cprng->cs_ready) { 221 if (ISSET(flags, FNONBLOCK) || 222 !ISSET(cprng->cs_flags, CPRNG_USE_CV) || 223 cv_wait_sig(&cprng->cs_cv, &cprng->cs_lock)) { 224 result = 0; 225 goto out; 226 } 227 } 228 } 229 230 /* 231 * Debit the entropy if requested. 232 * 233 * XXX Kludge for /dev/random `information-theoretic' properties. 234 */ 235 if (__predict_false(ISSET(cprng->cs_flags, CPRNG_HARD))) { 236 KASSERT(0 < cprng->cs_remaining); 237 KASSERT(cprng->cs_remaining <= 238 NIST_HASH_DRBG_MIN_SEEDLEN_BYTES); 239 if (bytes < cprng->cs_remaining) { 240 cprng->cs_remaining -= bytes; 241 } else { 242 bytes = cprng->cs_remaining; 243 cprng->cs_remaining = NIST_HASH_DRBG_MIN_SEEDLEN_BYTES; 244 cprng->cs_ready = false; 245 rndsink_schedule(cprng->cs_rndsink); 246 } 247 KASSERT(bytes <= NIST_HASH_DRBG_MIN_SEEDLEN_BYTES); 248 KASSERT(0 < cprng->cs_remaining); 249 KASSERT(cprng->cs_remaining <= 250 NIST_HASH_DRBG_MIN_SEEDLEN_BYTES); 251 } 252 253 cprng_strong_generate(cprng, buffer, bytes); 254 result = bytes; 255 256 out: mutex_exit(&cprng->cs_lock); 257 return result; 258 } 259 260 static void filt_cprng_detach(struct knote *); 261 static int filt_cprng_event(struct knote *, long); 262 263 static const struct filterops cprng_filtops = 264 { 1, NULL, filt_cprng_detach, filt_cprng_event }; 265 266 int 267 cprng_strong_kqfilter(struct cprng_strong *cprng, struct knote *kn) 268 { 269 270 switch (kn->kn_filter) { 271 case EVFILT_READ: 272 kn->kn_fop = &cprng_filtops; 273 kn->kn_hook = cprng; 274 mutex_enter(&cprng->cs_lock); 275 SLIST_INSERT_HEAD(&cprng->cs_selq.sel_klist, kn, kn_selnext); 276 mutex_exit(&cprng->cs_lock); 277 return 0; 278 279 case EVFILT_WRITE: 280 default: 281 return EINVAL; 282 } 283 } 284 285 static void 286 filt_cprng_detach(struct knote *kn) 287 { 288 struct cprng_strong *const cprng = kn->kn_hook; 289 290 mutex_enter(&cprng->cs_lock); 291 SLIST_REMOVE(&cprng->cs_selq.sel_klist, kn, knote, kn_selnext); 292 mutex_exit(&cprng->cs_lock); 293 } 294 295 static int 296 filt_cprng_event(struct knote *kn, long hint) 297 { 298 struct cprng_strong *const cprng = kn->kn_hook; 299 int ret; 300 301 if (hint == NOTE_SUBMIT) 302 KASSERT(mutex_owned(&cprng->cs_lock)); 303 else 304 mutex_enter(&cprng->cs_lock); 305 if (cprng->cs_ready) { 306 kn->kn_data = CPRNG_MAX_LEN; /* XXX Too large? */ 307 ret = 1; 308 } else { 309 ret = 0; 310 } 311 if (hint == NOTE_SUBMIT) 312 KASSERT(mutex_owned(&cprng->cs_lock)); 313 else 314 mutex_exit(&cprng->cs_lock); 315 316 return ret; 317 } 318 319 int 320 cprng_strong_poll(struct cprng_strong *cprng, int events) 321 { 322 int revents; 323 324 if (!ISSET(events, (POLLIN | POLLRDNORM))) 325 return 0; 326 327 mutex_enter(&cprng->cs_lock); 328 if (cprng->cs_ready) { 329 revents = (events & (POLLIN | POLLRDNORM)); 330 } else { 331 selrecord(curlwp, &cprng->cs_selq); 332 revents = 0; 333 } 334 mutex_exit(&cprng->cs_lock); 335 336 return revents; 337 } 338 339 /* 340 * XXX Move nist_hash_drbg_reseed_advised_p and 341 * nist_hash_drbg_reseed_needed_p into the nist_hash_drbg API and make 342 * the NIST_HASH_DRBG structure opaque. 343 */ 344 static bool 345 nist_hash_drbg_reseed_advised_p(NIST_HASH_DRBG *drbg) 346 { 347 348 return (drbg->reseed_counter > (NIST_HASH_DRBG_RESEED_INTERVAL / 2)); 349 } 350 351 static bool 352 nist_hash_drbg_reseed_needed_p(NIST_HASH_DRBG *drbg) 353 { 354 355 return (drbg->reseed_counter >= NIST_HASH_DRBG_RESEED_INTERVAL); 356 } 357 358 /* 359 * Generate some data from the underlying generator. 360 */ 361 static void 362 cprng_strong_generate(struct cprng_strong *cprng, void *buffer, size_t bytes) 363 { 364 const uint32_t cc = cprng_counter(); 365 366 KASSERT(bytes <= CPRNG_MAX_LEN); 367 KASSERT(mutex_owned(&cprng->cs_lock)); 368 369 /* 370 * Generate some data from the NIST Hash_DRBG. Caller 371 * guarantees reseed if we're not ready, and if we exhaust the 372 * generator, we mark ourselves not ready. Consequently, this 373 * call to the Hash_DRBG should not fail. 374 */ 375 if (__predict_false(nist_hash_drbg_generate(&cprng->cs_drbg, buffer, 376 bytes, &cc, sizeof(cc)))) 377 panic("cprng %s: NIST Hash_DRBG failed", cprng->cs_name); 378 379 /* 380 * If we've been seeing a lot of use, ask for some fresh 381 * entropy soon. 382 */ 383 if (__predict_false(nist_hash_drbg_reseed_advised_p(&cprng->cs_drbg))) 384 rndsink_schedule(cprng->cs_rndsink); 385 386 /* 387 * If we just exhausted the generator, inform the next user 388 * that we need a reseed. 389 */ 390 if (__predict_false(nist_hash_drbg_reseed_needed_p(&cprng->cs_drbg))) { 391 cprng->cs_ready = false; 392 rndsink_schedule(cprng->cs_rndsink); /* paranoia */ 393 } 394 } 395 396 /* 397 * Reseed with whatever we can get from the system entropy pool right now. 398 */ 399 static void 400 cprng_strong_reseed(struct cprng_strong *cprng) 401 { 402 uint8_t seed[NIST_HASH_DRBG_MIN_SEEDLEN_BYTES]; 403 404 KASSERT(mutex_owned(&cprng->cs_lock)); 405 406 const bool full_entropy = rndsink_request(cprng->cs_rndsink, seed, 407 sizeof(seed)); 408 cprng_strong_reseed_from(cprng, seed, sizeof(seed), full_entropy); 409 explicit_memset(seed, 0, sizeof(seed)); 410 } 411 412 /* 413 * Reseed with the given seed. If we now have full entropy, notify waiters. 414 */ 415 static void 416 cprng_strong_reseed_from(struct cprng_strong *cprng, 417 const void *seed, size_t bytes, bool full_entropy) 418 { 419 const uint32_t cc = cprng_counter(); 420 421 KASSERT(bytes == NIST_HASH_DRBG_MIN_SEEDLEN_BYTES); 422 KASSERT(mutex_owned(&cprng->cs_lock)); 423 424 /* 425 * Notify anyone interested in the partiality of entropy in our 426 * seed -- anyone waiting for full entropy, or any system 427 * operators interested in knowing when the entropy pool is 428 * running on fumes. 429 */ 430 if (full_entropy) { 431 if (!cprng->cs_ready) { 432 cprng->cs_ready = true; 433 cv_broadcast(&cprng->cs_cv); 434 selnotify(&cprng->cs_selq, (POLLIN | POLLRDNORM), 435 NOTE_SUBMIT); 436 } 437 } else { 438 /* 439 * XXX Is there is any harm in reseeding with partial 440 * entropy when we had full entropy before? If so, 441 * remove the conditional on this message. 442 */ 443 if (!cprng->cs_ready && 444 !ISSET(cprng->cs_flags, CPRNG_REKEY_ANY)) 445 printf("cprng %s: reseeding with partial entropy\n", 446 cprng->cs_name); 447 } 448 449 if (nist_hash_drbg_reseed(&cprng->cs_drbg, seed, bytes, &cc, 450 sizeof(cc))) 451 /* XXX Fix nist_hash_drbg API so this can't happen. */ 452 panic("cprng %s: NIST Hash_DRBG reseed failed", 453 cprng->cs_name); 454 455 #if DEBUG 456 cprng_strong_rngtest(cprng); 457 #endif 458 } 459 460 #if DEBUG 461 /* 462 * Generate some output and apply a statistical RNG test to it. 463 */ 464 static void 465 cprng_strong_rngtest(struct cprng_strong *cprng) 466 { 467 468 KASSERT(mutex_owned(&cprng->cs_lock)); 469 470 /* XXX Switch to a pool cache instead? */ 471 rngtest_t *const rt = kmem_intr_alloc(sizeof(*rt), KM_NOSLEEP); 472 if (rt == NULL) 473 /* XXX Warn? */ 474 return; 475 476 (void)strlcpy(rt->rt_name, cprng->cs_name, sizeof(rt->rt_name)); 477 478 if (nist_hash_drbg_generate(&cprng->cs_drbg, rt->rt_b, 479 sizeof(rt->rt_b), NULL, 0)) 480 panic("cprng %s: NIST Hash_DRBG failed after reseed", 481 cprng->cs_name); 482 483 if (rngtest(rt)) { 484 printf("cprng %s: failed statistical RNG test\n", 485 cprng->cs_name); 486 /* XXX Not clear that this does any good... */ 487 cprng->cs_ready = false; 488 rndsink_schedule(cprng->cs_rndsink); 489 } 490 491 explicit_memset(rt, 0, sizeof(*rt)); /* paranoia */ 492 kmem_intr_free(rt, sizeof(*rt)); 493 } 494 #endif 495 496 /* 497 * Feed entropy from an rndsink request into the CPRNG for which the 498 * request was issued. 499 */ 500 static void 501 cprng_strong_rndsink_callback(void *context, const void *seed, size_t bytes) 502 { 503 struct cprng_strong *const cprng = context; 504 505 mutex_enter(&cprng->cs_lock); 506 /* Assume that rndsinks provide only full-entropy output. */ 507 cprng_strong_reseed_from(cprng, seed, bytes, true); 508 mutex_exit(&cprng->cs_lock); 509 } 510 511 static cprng_strong_t *sysctl_prng; 512 513 static int 514 makeprng(void) 515 { 516 517 /* can't create in cprng_init(), too early */ 518 sysctl_prng = cprng_strong_create("sysctl", IPL_NONE, 519 CPRNG_INIT_ANY|CPRNG_REKEY_ANY); 520 return 0; 521 } 522 523 /* 524 * sysctl helper routine for kern.urandom node. Picks a random number 525 * for you. 526 */ 527 static int 528 sysctl_kern_urnd(SYSCTLFN_ARGS) 529 { 530 static ONCE_DECL(control); 531 int v, rv; 532 533 RUN_ONCE(&control, makeprng); 534 rv = cprng_strong(sysctl_prng, &v, sizeof(v), 0); 535 if (rv == sizeof(v)) { 536 struct sysctlnode node = *rnode; 537 node.sysctl_data = &v; 538 return (sysctl_lookup(SYSCTLFN_CALL(&node))); 539 } 540 else 541 return (EIO); /*XXX*/ 542 } 543 544 /* 545 * sysctl helper routine for kern.arandom node. Fills the supplied 546 * structure with random data for you. 547 * 548 * This node was originally declared as type "int" but its implementation 549 * in OpenBSD, whence it came, would happily return up to 8K of data if 550 * requested. Evidently this was used to key RC4 in userspace. 551 * 552 * In NetBSD, the libc stack-smash-protection code reads 64 bytes 553 * from here at every program startup. So though it would be nice 554 * to make this node return only 32 or 64 bits, we can't. Too bad! 555 */ 556 static int 557 sysctl_kern_arnd(SYSCTLFN_ARGS) 558 { 559 int error; 560 void *v; 561 struct sysctlnode node = *rnode; 562 563 switch (*oldlenp) { 564 case 0: 565 return 0; 566 default: 567 if (*oldlenp > 256) { 568 return E2BIG; 569 } 570 v = kmem_alloc(*oldlenp, KM_SLEEP); 571 cprng_fast(v, *oldlenp); 572 node.sysctl_data = v; 573 node.sysctl_size = *oldlenp; 574 error = sysctl_lookup(SYSCTLFN_CALL(&node)); 575 kmem_free(v, *oldlenp); 576 return error; 577 } 578 } 579
Indexes created Tue Sep 30 11:09:46 GMT 2025