upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-05-28 04:12:45 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Limit the amount of "fast" entropy. We don't need nearly as much

Browse source 
for security, and the excess just slows things down badly.

PR:             230808
Submitted by:   rwmaillists@googlemail.com, but tweeked by me
Reported by:    Danilo Egea Gondolfo <danilo@FreeBSD.org>
Reviewed by:	cem,delphij
Approved by:	re(rgrimes)
Approved by:	so(delphij)
MFC after:      1 Month
Differential Revision:	https://reviews.freebsd.org/D16873
This commit is contained in:
Mark Murray 2018-08-24 14:53:46 +00:00
parent 27064b30f2
commit 29f9b2a93e
1 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
sys/dev/random/random_harvestq.c
View file

@ -57,6 +57,10 @@ __FBSDID("$FreeBSD$");
#include <machine/atomic.h>
#include <machine/cpu.h>
#include <crypto/rijndael/rijndael-api-fst.h>
#include <crypto/sha2/sha256.h>
#include <dev/random/hash.h>
#include <dev/random/randomdev.h>
#include <dev/random/random_harvestq.h>
@ -213,8 +217,12 @@ random_sources_feed(void)
/* It's an indenting error. Yeah, Yeah. */
#endif
local_read_rate = atomic_readandclear_32(&read_rate);
/* Perform at least one read per round */
local_read_rate = MAX(local_read_rate, 1);
/* But not exceeding RANDOM_KEYSIZE_WORDS */
local_read_rate = MIN(local_read_rate, RANDOM_KEYSIZE_WORDS);
LIST_FOREACH(rrs, &source_list, rrs_entries) {
for (i = 0; i < p_random_alg_context->ra_poolcount*(local_read_rate + 1); i++) {
for (i = 0; i < p_random_alg_context->ra_poolcount*local_read_rate; i++) {
n = rrs->rrs_source->rs_read(entropy, sizeof(entropy));
KASSERT((n <= sizeof(entropy)), ("%s: rs_read returned too much data (%u > %zu)", __func__, n, sizeof(entropy)));
/* It would appear that in some circumstances (e.g. virtualisation),