linux/drivers/char
George Spelvin c51f8f88d7 random32: make prandom_u32() output unpredictable
Non-cryptographic PRNGs may have great statistical properties, but
are usually trivially predictable to someone who knows the algorithm,
given a small sample of their output.  An LFSR like prandom_u32() is
particularly simple, even if the sample is widely scattered bits.

It turns out the network stack uses prandom_u32() for some things like
random port numbers which it would prefer are *not* trivially predictable.
Predictability led to a practical DNS spoofing attack.  Oops.

This patch replaces the LFSR with a homebrew cryptographic PRNG based
on the SipHash round function, which is in turn seeded with 128 bits
of strong random key.  (The authors of SipHash have *not* been consulted
about this abuse of their algorithm.)  Speed is prioritized over security;
attacks are rare, while performance is always wanted.

Replacing all callers of prandom_u32() is the quick fix.
Whether to reinstate a weaker PRNG for uses which can tolerate it
is an open question.

Commit f227e3ec3b ("random32: update the net random state on interrupt
and activity") was an earlier attempt at a solution.  This patch replaces
it.

Reported-by: Amit Klein <aksecurity@gmail.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: Eric Dumazet <edumazet@google.com>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: tytso@mit.edu
Cc: Florian Westphal <fw@strlen.de>
Cc: Marc Plumb <lkml.mplumb@gmail.com>
Fixes: f227e3ec3b ("random32: update the net random state on interrupt and activity")
Signed-off-by: George Spelvin <lkml@sdf.org>
Link: https://lore.kernel.org/netdev/20200808152628.GA27941@SDF.ORG/
[ willy: partial reversal of f227e3ec3b5c; moved SIPROUND definitions
  to prandom.h for later use; merged George's prandom_seed() proposal;
  inlined siprand_u32(); replaced the net_rand_state[] array with 4
  members to fix a build issue; cosmetic cleanups to make checkpatch
  happy; fixed RANDOM32_SELFTEST build ]
Signed-off-by: Willy Tarreau <w@1wt.eu>
2020-10-24 20:21:57 +02:00
..
agp agp: use semicolons rather than commas to separate statements 2020-09-28 06:06:52 +10:00
hw_random Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2020-10-13 08:50:16 -07:00
ipmi Bug fix pull for IPMI for 5.10 2020-10-14 15:00:20 -07:00
mwave char/mwave: remove redundant initialization of variable bRC 2020-07-10 14:50:51 +02:00
pcmcia cm4000_cs.c cmm_ioctl(): get rid of pointless access_ok() 2020-05-29 11:04:56 -04:00
tpm tpm_tis: Add a check for invalid status 2020-10-02 00:21:03 +03:00
xilinx_hwicap treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
xillybus char: xillybus: use devm_platform_ioremap_resource() to simplify code 2019-11-05 18:29:21 +01:00
adi.c char: sparc64: Add privileged ADI driver 2018-06-05 11:24:55 -07:00
apm-emulation.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
applicom.c misc: cleanup minor number definitions in c file into miscdevice.h 2020-03-18 12:27:03 +01:00
applicom.h
bsr.c mm: don't include asm/pgtable.h if linux/mm.h is already included 2020-06-09 09:39:13 -07:00
ds1620.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
dsp56k.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
dtlk.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
hangcheck-timer.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 405 2019-06-05 17:37:13 +02:00
hpet.c char: hpet: Fix out-of-bounds read bug 2020-01-30 06:58:33 +01:00
Kconfig char: virtio: Select VIRTIO from VIRTIO_CONSOLE. 2020-09-07 14:32:40 +02:00
lp.c Merge 5.9-rc3 into char-misc-next 2020-08-31 07:17:17 +02:00
Makefile rtc/alpha: remove legacy rtc driver 2020-03-19 07:41:02 +01:00
mem.c /dev/zero: fixups for ->read 2020-09-07 10:46:35 +02:00
misc.c char: misc: Move EXPORT_SYMBOL immediately next to the functions/varibles 2019-05-24 18:00:41 +02:00
mspec.c char: mspec: Use kvzalloc() in mspec_mmap() 2020-08-28 12:10:04 +02:00
nsc_gpio.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
nvram.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
nwbutton.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
nwbutton.h misc: cleanup minor number definitions in c file into miscdevice.h 2020-03-18 12:27:03 +01:00
nwflash.c misc: move FLASH_MINOR into miscdevice.h and fix conflicts 2020-03-18 12:27:04 +01:00
pc8736x_gpio.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
powernv-op-panel.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ppdev.c ppdev: Distribute switch variables for initialization 2020-02-23 20:28:12 +01:00
ps3flash.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 164 2019-05-30 11:26:38 -07:00
random.c random32: make prandom_u32() output unpredictable 2020-10-24 20:21:57 +02:00
raw.c raw: don't keep unopened block device around 2020-09-23 10:43:19 -06:00
scx200_gpio.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
sonypi.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61 2019-05-24 17:36:45 +02:00
tb0219.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
tlclk.c drivers: char: tlclk.c: Avoid data race between init and interrupt handler 2020-04-23 16:55:24 +02:00
toshiba.c misc: cleanup minor number definitions in c file into miscdevice.h 2020-03-18 12:27:03 +01:00
ttyprintk.c ttyprintk: remove redundant initialization of variable ret 2020-07-10 14:50:51 +02:00
uv_mmtimer.c
virtio_console.c Merge v5.8-rc6 into char-misc-next 2020-07-20 09:43:40 +02:00