random(4): Block read_random(9) on initial seeding

read_random() is/was used, mostly without error checking, in a lot of
very sensitive places in the kernel -- including seeding the widely used
arc4random(9).

Most uses, especially arc4random(9), should block until the device is seeded
rather than proceeding with a bogus or empty seed.  I did not spy any
obvious kernel consumers where blocking would be inappropriate (in the
sense that lack of entropy would be ok -- I did not investigate locking
angle thoroughly).  In many instances, arc4random_buf(9) or that family
of APIs would be more appropriate anyway; that work was done in r345865.

A minor cleanup was made to the implementation of the READ_RANDOM function:
instead of using a variable-length array on the stack to temporarily store
all full random blocks sufficient to satisfy the requested 'len', only store
a single block on the stack.  This has some benefit in terms of reducing
stack usage, reducing memcpy overhead and reducing devrandom output leakage
via the stack.  Additionally, the stack block is now safely zeroed if it was
used.

One caveat of this change is that the kern.arandom sysctl no longer returns
zero bytes immediately if the random device is not seeded.  This means that
FreeBSD-specific userspace applications which attempted to handle an
unseeded random device may be broken by this change.  If such behavior is
needed, it can be replaced by the more portable getrandom(2) GRND_NONBLOCK
option.

On any typical FreeBSD system, entropy is persisted on read/write media and
used to seed the random device very early in boot, and blocking is never a
problem.

This change primarily impacts the behavior of /dev/random on embedded
systems with read-only media that do not configure "nodevice random".  We
toggle the default from 'charge on blindly with no entropy' to 'block
indefinitely.'  This default is safer, but may cause frustration.  Embedded
system designers using FreeBSD have several options.  The most obvious is to
plan to have a small writable NVRAM or NAND to persist entropy, like larger
systems.  Early entropy can be fed from any loader, or by writing directly
to /dev/random during boot.  Some embedded SoCs now provide a fast hardware
entropy source; this would also work for quickly seeding Fortuna.  A 3rd
option would be creating an embedded-specific, more simplistic random
module, like that designed by DJB in [1] (this design still requires a small
rewritable media for forward secrecy).  Finally, the least preferred option
might be "nodevice random", although I plan to remove this in a subsequent
revision.

To help developers emulate the behavior of these embedded systems on
ordinary workstations, the tunable kern.random.block_seeded_status was
added.  When set to 1, it blocks the random device.

I attempted to document this change in random.4 and random.9 and ran into a
bunch of out-of-date or irrelevant or inaccurate content and ended up
rototilling those documents more than I intended to.  Sorry.  I think
they're in a better state now.

PR:		230875
Reviewed by:	delphij, markm (earlier version)
Approved by:	secteam(delphij), devrandom(markm)
Relnotes:	yes
Differential Revision:	https://reviews.freebsd.org/D19744

1 files changed, 6 insertions, 26 deletions

diff --git a/sys/libkern/arc4random.c b/sys/libkern/arc4random.c
index ad4c6b057e4a..cdc303e9d309 100644
--- a/sys/libkern/arc4random.c
+++ b/sys/libkern/arc4random.c
@@ -56,7 +56,6 @@ MALLOC_DEFINE(M_CHACHA20RANDOM, "chacha20random", "chacha20random structures");
 struct chacha20_s {
 	struct mtx mtx;
 	int numbytes;
-	int first_time_done;
 	time_t t_reseed;
 	u_int8_t m_buffer[CHACHA20_BUFFER_SIZE];
 	struct chacha_ctx ctx;
@@ -73,35 +72,17 @@ static struct chacha20_s *chacha20inst = NULL;
  * Mix up the current context.
  */
 static void
-chacha20_randomstir(struct chacha20_s* chacha20)
+chacha20_randomstir(struct chacha20_s *chacha20)
 {
 	struct timeval tv_now;
-	size_t n, size;
-	u_int8_t key[CHACHA20_KEYBYTES], *data;
-	caddr_t keyfile;
+	u_int8_t key[CHACHA20_KEYBYTES];
 
 	/*
-	 * This is making the best of what may be an insecure
-	 * Situation. If the loader(8) did not have an entropy
-	 * stash from the previous shutdown to load, then we will
-	 * be improperly seeded. The answer is to make sure there
-	 * is an entropy stash at shutdown time.
+	 * If the loader(8) did not have an entropy stash from the previous
+	 * shutdown to load, then we will block.  The answer is to make sure
+	 * there is an entropy stash at shutdown time.
 	 */
-	(void)read_random(key, CHACHA20_KEYBYTES);
-	if (!chacha20->first_time_done) {
-		keyfile = preload_search_by_type(RANDOM_CACHED_BOOT_ENTROPY_MODULE);
-		if (keyfile != NULL) {
-			data = preload_fetch_addr(keyfile);
-			size = MIN(preload_fetch_size(keyfile), CHACHA20_KEYBYTES);
-			for (n = 0; n < size; n++)
-				key[n] ^= data[n];
-			explicit_bzero(data, size);
-			if (bootverbose)
-				printf("arc4random: read %zu bytes from preloaded cache\n", size);
-		} else
-			printf("arc4random: no preloaded entropy cache\n");
-		chacha20->first_time_done = 1;
-	}
+	read_random(key, CHACHA20_KEYBYTES);
 	getmicrouptime(&tv_now);
 	mtx_lock(&chacha20->mtx);
 	chacha_keysetup(&chacha20->ctx, key, CHACHA20_KEYBYTES*8);
@@ -128,7 +109,6 @@ chacha20_init(void)
 		mtx_init(&chacha20->mtx, "chacha20_mtx", NULL, MTX_DEF);
 		chacha20->t_reseed = -1;
 		chacha20->numbytes = 0;
-		chacha20->first_time_done = 0;
 		explicit_bzero(chacha20->m_buffer, CHACHA20_BUFFER_SIZE);
 		explicit_bzero(&chacha20->ctx, sizeof(chacha20->ctx));
 	}