FreeBSD/Linux Kernel Cross Reference
sys/kern/subr_cprng.c

     /*      $NetBSD: subr_cprng.c,v 1.43 2022/05/13 09:40:25 riastradh Exp $        */
     
     /*-
      * Copyright (c) 2019 The NetBSD Foundation, Inc.
      * All rights reserved.
      *
      * This code is derived from software contributed to The NetBSD Foundation
      * by Taylor R. Campbell.
      *
     * Redistribution and use in source and binary forms, with or without
     * modification, are permitted provided that the following conditions
     * are met:
     * 1. Redistributions of source code must retain the above copyright
     *    notice, this list of conditions and the following disclaimer.
     * 2. Redistributions in binary form must reproduce the above copyright
     *    notice, this list of conditions and the following disclaimer in the
     *    documentation and/or other materials provided with the distribution.
     *
     * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     * POSSIBILITY OF SUCH DAMAGE.
     */
    
    /*
     * cprng_strong
     *
     *      Per-CPU NIST Hash_DRBG, reseeded automatically from the entropy
     *      pool when we transition to full entropy, never blocking.  This
     *      is slightly different from the old cprng_strong API, but the
     *      only users of the old one fell into three categories:
     *
     *      1. never-blocking, oughta-be-per-CPU (kern_cprng, sysctl_prng)
     *      2. never-blocking, used per-CPU anyway (/dev/urandom short reads)
     *      3. /dev/random
     *
     *      This code serves the first two categories without having extra
     *      logic for /dev/random.
     *
     *      kern_cprng - available at IPL_SOFTSERIAL or lower
     *      user_cprng - available only at IPL_NONE in thread context
     *
     *      The name kern_cprng is for hysterical raisins.  The name
     *      user_cprng serves only to contrast with kern_cprng.
     */
    
    #include <sys/cdefs.h>
    __KERNEL_RCSID(0, "$NetBSD: subr_cprng.c,v 1.43 2022/05/13 09:40:25 riastradh Exp $");
    
    #include <sys/param.h>
    #include <sys/types.h>
    #include <sys/cprng.h>
    #include <sys/cpu.h>
    #include <sys/entropy.h>
    #include <sys/errno.h>
    #include <sys/evcnt.h>
    #include <sys/intr.h>
    #include <sys/kmem.h>
    #include <sys/percpu.h>
    #include <sys/sysctl.h>
    #include <sys/systm.h>
    
    #include <crypto/nist_hash_drbg/nist_hash_drbg.h>
    
    /*
     * struct cprng_strong
     */
    struct cprng_strong {
            struct percpu           *cs_percpu; /* struct cprng_cpu */
            ipl_cookie_t            cs_iplcookie;
    };
    
    /*
     * struct cprng_cpu
     *
     *      Per-CPU state for a cprng_strong.  The DRBG and evcnt are
     *      allocated separately because percpu(9) sometimes moves per-CPU
     *      objects around without zeroing them.
     */
    struct cprng_cpu {
            struct nist_hash_drbg   *cc_drbg;
            struct {
                    struct evcnt    reseed;
            }                       *cc_evcnt;
            unsigned                cc_epoch;
    };
    
    static int      sysctl_kern_urandom(SYSCTLFN_ARGS);
    static int      sysctl_kern_arandom(SYSCTLFN_ARGS);
    static void     cprng_init_cpu(void *, void *, struct cpu_info *);
    static void     cprng_fini_cpu(void *, void *, struct cpu_info *);
    
   /* Well-known CPRNG instances */
   struct cprng_strong *kern_cprng __read_mostly; /* IPL_SOFTSERIAL */
   struct cprng_strong *user_cprng __read_mostly; /* IPL_NONE */
   
   static struct sysctllog *cprng_sysctllog __read_mostly;
   
   void
   cprng_init(void)
   {
   
           if (__predict_false(nist_hash_drbg_initialize() != 0))
                   panic("NIST Hash_DRBG failed self-test");
   
           /*
            * Create CPRNG instances at two IPLs: IPL_SOFTSERIAL for
            * kernel use that may occur inside soft interrupt handlers,
            * and IPL_NONE for userland use which need not block
            * interrupts.
            */
           kern_cprng = cprng_strong_create("kern", IPL_SOFTSERIAL, 0);
           user_cprng = cprng_strong_create("user", IPL_NONE, 0);
   
           /* Create kern.urandom and kern.arandom sysctl nodes.  */
           sysctl_createv(&cprng_sysctllog, 0, NULL, NULL,
               CTLFLAG_PERMANENT|CTLFLAG_READONLY, CTLTYPE_INT, "urandom",
               SYSCTL_DESCR("Independent uniform random 32-bit integer"),
               sysctl_kern_urandom, 0, NULL, 0, CTL_KERN, KERN_URND, CTL_EOL);
           sysctl_createv(&cprng_sysctllog, 0, NULL, NULL,
               CTLFLAG_PERMANENT|CTLFLAG_READONLY, CTLTYPE_INT /*lie*/, "arandom",
               SYSCTL_DESCR("Independent uniform random bytes, up to 256 bytes"),
               sysctl_kern_arandom, 0, NULL, 0, CTL_KERN, KERN_ARND, CTL_EOL);
   }
   
   /*
    * sysctl kern.urandom
    *
    *      Independent uniform random 32-bit integer.  Read-only.
    */
   static int
   sysctl_kern_urandom(SYSCTLFN_ARGS)
   {
           struct sysctlnode node = *rnode;
           int v;
           int error;
   
           /* Generate an int's worth of data.  */
           cprng_strong(user_cprng, &v, sizeof v, 0);
   
           /* Do the sysctl dance.  */
           node.sysctl_data = &v;
           error = sysctl_lookup(SYSCTLFN_CALL(&node));
   
           /* Clear the buffer before returning the sysctl error.  */
           explicit_memset(&v, 0, sizeof v);
           return error;
   }
   
   /*
    * sysctl kern.arandom
    *
    *      Independent uniform random bytes, up to 256 bytes.  Read-only.
    */
   static int
   sysctl_kern_arandom(SYSCTLFN_ARGS)
   {
           struct sysctlnode node = *rnode;
           uint8_t buf[256];
           int error;
   
           /*
            * Clamp to a reasonably small size.  256 bytes is kind of
            * arbitrary; 32 would be more reasonable, but we used 256 in
            * the past, so let's not break compatibility.
            */
           if (*oldlenp > 256)     /* size_t, so never negative */
                   *oldlenp = 256;
   
           /* Generate data.  */
           cprng_strong(user_cprng, buf, *oldlenp, 0);
   
           /* Do the sysctl dance.  */
           node.sysctl_data = buf;
           node.sysctl_size = *oldlenp;
           error = sysctl_lookup(SYSCTLFN_CALL(&node));
   
           /* Clear the buffer before returning the sysctl error.  */
           explicit_memset(buf, 0, sizeof buf);
           return error;
   }
   
   struct cprng_strong *
   cprng_strong_create(const char *name, int ipl, int flags)
   {
           struct cprng_strong *cprng;
   
           cprng = kmem_alloc(sizeof(*cprng), KM_SLEEP);
           cprng->cs_iplcookie = makeiplcookie(ipl);
           cprng->cs_percpu = percpu_create(sizeof(struct cprng_cpu),
               cprng_init_cpu, cprng_fini_cpu, __UNCONST(name));
   
           return cprng;
   }
   
   void
   cprng_strong_destroy(struct cprng_strong *cprng)
   {
   
           percpu_free(cprng->cs_percpu, sizeof(struct cprng_cpu));
           kmem_free(cprng, sizeof(*cprng));
   }
   
   static void
   cprng_init_cpu(void *ptr, void *cookie, struct cpu_info *ci)
   {
           struct cprng_cpu *cc = ptr;
           const char *name = cookie;
           const char *cpuname;
           uint8_t zero[NIST_HASH_DRBG_SEEDLEN_BYTES] = {0};
           char namebuf[64];       /* XXX size? */
   
           /*
            * Format the name as, e.g., kern/8 if we're on cpu8.  This
            * doesn't get displayed anywhere; it just ensures that if
            * there were a bug causing us to use the same otherwise secure
            * seed on multiple CPUs, we would still get independent output
            * from the NIST Hash_DRBG.
            */
           snprintf(namebuf, sizeof namebuf, "%s/%u", name, cpu_index(ci));
   
           /*
            * Allocate the struct nist_hash_drbg and struct evcnt
            * separately, since percpu(9) may move objects around in
            * memory without zeroing.
            */
           cc->cc_drbg = kmem_zalloc(sizeof(*cc->cc_drbg), KM_SLEEP);
           cc->cc_evcnt = kmem_alloc(sizeof(*cc->cc_evcnt), KM_SLEEP);
   
           /*
            * Initialize the DRBG with no seed.  We do this in order to
            * defer reading from the entropy pool as long as possible.
            */
           if (__predict_false(nist_hash_drbg_instantiate(cc->cc_drbg,
                       zero, sizeof zero, NULL, 0, namebuf, strlen(namebuf))))
                   panic("nist_hash_drbg_instantiate");
   
           /* Attach the event counters.  */
           /* XXX ci_cpuname may not be initialized early enough.  */
           cpuname = ci->ci_cpuname[0] == '\0' ? "cpu0" : ci->ci_cpuname;
           evcnt_attach_dynamic(&cc->cc_evcnt->reseed, EVCNT_TYPE_MISC, NULL,
               cpuname, "cprng_strong reseed");
   
           /* Set the epoch uninitialized so we reseed on first use.  */
           cc->cc_epoch = 0;
   }
   
   static void
   cprng_fini_cpu(void *ptr, void *cookie, struct cpu_info *ci)
   {
           struct cprng_cpu *cc = ptr;
   
           evcnt_detach(&cc->cc_evcnt->reseed);
           if (__predict_false(nist_hash_drbg_destroy(cc->cc_drbg)))
                   panic("nist_hash_drbg_destroy");
   
           kmem_free(cc->cc_evcnt, sizeof(*cc->cc_evcnt));
           kmem_free(cc->cc_drbg, sizeof(*cc->cc_drbg));
   }
   
   size_t
   cprng_strong(struct cprng_strong *cprng, void *buf, size_t len, int flags)
   {
           uint8_t seed[NIST_HASH_DRBG_SEEDLEN_BYTES];
           struct cprng_cpu *cc;
           unsigned epoch;
           int s;
   
           /* Not allowed in hard interrupt context.  */
           KASSERT(!cpu_intr_p());
   
           /*
            * Verify maximum request length.  Caller should really limit
            * their requests to 32 bytes to avoid spending much time with
            * preemption disabled -- use the 32 bytes to seed a private
            * DRBG instance if you need more data.
            */
           KASSERT(len <= CPRNG_MAX_LEN);
   
           /* Verify legacy API use.  */
           KASSERT(flags == 0);
   
           /* Acquire per-CPU state and block interrupts.  */
           cc = percpu_getref(cprng->cs_percpu);
           s = splraiseipl(cprng->cs_iplcookie);
   
           /* If the entropy epoch has changed, (re)seed.  */
           epoch = entropy_epoch();
           if (__predict_false(epoch != cc->cc_epoch)) {
                   entropy_extract(seed, sizeof seed, 0);
                   cc->cc_evcnt->reseed.ev_count++;
                   if (__predict_false(nist_hash_drbg_reseed(cc->cc_drbg,
                               seed, sizeof seed, NULL, 0)))
                           panic("nist_hash_drbg_reseed");
                   explicit_memset(seed, 0, sizeof seed);
                   cc->cc_epoch = epoch;
           }
   
           /* Generate data.  Failure here means it's time to reseed.  */
           if (__predict_false(nist_hash_drbg_generate(cc->cc_drbg, buf, len,
                       NULL, 0))) {
                   entropy_extract(seed, sizeof seed, 0);
                   cc->cc_evcnt->reseed.ev_count++;
                   if (__predict_false(nist_hash_drbg_reseed(cc->cc_drbg,
                               seed, sizeof seed, NULL, 0)))
                           panic("nist_hash_drbg_reseed");
                   explicit_memset(seed, 0, sizeof seed);
                   if (__predict_false(nist_hash_drbg_generate(cc->cc_drbg,
                               buf, len, NULL, 0)))
                           panic("nist_hash_drbg_generate");
           }
   
           /* Release state and interrupts.  */
           splx(s);
           percpu_putref(cprng->cs_percpu);
   
           /* Return the number of bytes generated, for hysterical raisins.  */
           return len;
   }
   
   uint32_t
   cprng_strong32(void)
   {
           uint32_t r;
           cprng_strong(kern_cprng, &r, sizeof(r), 0);
           return r;
   }
   
   uint64_t
   cprng_strong64(void)
   {
           uint64_t r;
           cprng_strong(kern_cprng, &r, sizeof(r), 0);
           return r;
   }

Cache object: 10296abdcbbf7567dd06ae9dbb8e510f