mirror of
https://github.com/opnsense/src.git
synced 2026-02-21 08:50:22 -05:00
3bca93e042
Replace the check for zero harvest_mask with new check for empty string. This allows one to specify harvest_mask="0" that disables harversting entropy from all but "pure" sources. Exact bit values for "pure" sources differ for stable/12 and later branches, so it is handy to use zero. The check for zero pre-dates introduction of "pure" non-maskable sources Use empty string to disable altering sysctl kern.random.harvest.mask. Note that notion of "pure" random sources is not documented in user level manual pages yet. Still, it helps to extend battery life for hardware with embedded "Intel Secure Key RNG" by disabling all other sources. Note that no defaults changed and default behaviour is not affected. Reported by: Dmitry Luhtionov
155 lines
2.9 KiB
Bash
Executable file
155 lines
2.9 KiB
Bash
Executable file
#!/bin/sh
|
|
#
|
|
# $FreeBSD$
|
|
#
|
|
|
|
# PROVIDE: random
|
|
# REQUIRE: FILESYSTEMS
|
|
# BEFORE: netif
|
|
# KEYWORD: nojail shutdown
|
|
|
|
. /etc/rc.subr
|
|
|
|
name="random"
|
|
desc="Harvest and save entropy for random device"
|
|
start_cmd="random_start"
|
|
stop_cmd="random_stop"
|
|
|
|
extra_commands="saveseed"
|
|
saveseed_cmd="${name}_stop"
|
|
|
|
save_dev_random()
|
|
{
|
|
oumask=`umask`
|
|
umask 077
|
|
for f ; do
|
|
debug "saving entropy to $f"
|
|
dd if=/dev/random of="$f" bs=4096 count=1 status=none &&
|
|
( chflags nodump "$f" 2>/dev/null || : ) &&
|
|
chmod 600 "$f" &&
|
|
fsync "$f" "$(dirname "$f")"
|
|
done
|
|
umask ${oumask}
|
|
}
|
|
|
|
feed_dev_random()
|
|
{
|
|
for f ; do
|
|
if [ -f "$f" -a -r "$f" -a -s "$f" ] ; then
|
|
if dd if="$f" of=/dev/random bs=4096 2>/dev/null ; then
|
|
debug "entropy read from $f"
|
|
rm -f "$f"
|
|
fi
|
|
fi
|
|
done
|
|
}
|
|
|
|
random_start()
|
|
{
|
|
|
|
if [ -n "${harvest_mask}" ]; then
|
|
echo -n 'Setting up harvesting: '
|
|
${SYSCTL} kern.random.harvest.mask=${harvest_mask} > /dev/null
|
|
${SYSCTL_N} kern.random.harvest.mask_symbolic
|
|
fi
|
|
|
|
echo -n 'Feeding entropy: '
|
|
|
|
if [ ! -w /dev/random ] ; then
|
|
warn "/dev/random is not writeable"
|
|
return 1
|
|
fi
|
|
|
|
# Reseed /dev/random with previously stored entropy.
|
|
case ${entropy_dir:=/var/db/entropy} in
|
|
[Nn][Oo])
|
|
;;
|
|
*)
|
|
if [ -d "${entropy_dir}" ] ; then
|
|
feed_dev_random "${entropy_dir}"/*
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
case ${entropy_file:=/entropy} in
|
|
[Nn][Oo])
|
|
;;
|
|
*)
|
|
feed_dev_random "${entropy_file}" /var/db/entropy-file
|
|
save_dev_random "${entropy_file}"
|
|
;;
|
|
esac
|
|
|
|
case ${entropy_boot_file:=/boot/entropy} in
|
|
[Nn][Oo])
|
|
;;
|
|
*)
|
|
save_dev_random "${entropy_boot_file}"
|
|
;;
|
|
esac
|
|
|
|
echo '.'
|
|
}
|
|
|
|
random_stop()
|
|
{
|
|
# Write some entropy so when the machine reboots /dev/random
|
|
# can be reseeded
|
|
#
|
|
case ${entropy_file:=/entropy} in
|
|
[Nn][Oo])
|
|
;;
|
|
*)
|
|
echo -n 'Writing entropy file: '
|
|
rm -f ${entropy_file} 2> /dev/null
|
|
oumask=`umask`
|
|
umask 077
|
|
if touch ${entropy_file} 2> /dev/null; then
|
|
entropy_file_confirmed="${entropy_file}"
|
|
else
|
|
# Try this as a reasonable alternative for read-only
|
|
# roots, diskless workstations, etc.
|
|
rm -f /var/db/entropy-file 2> /dev/null
|
|
if touch /var/db/entropy-file 2> /dev/null; then
|
|
entropy_file_confirmed=/var/db/entropy-file
|
|
fi
|
|
fi
|
|
case ${entropy_file_confirmed} in
|
|
'')
|
|
warn 'write failed (read-only fs?)'
|
|
;;
|
|
*)
|
|
save_dev_random "${entropy_file_confirmed}"
|
|
echo '.'
|
|
;;
|
|
esac
|
|
umask ${oumask}
|
|
;;
|
|
esac
|
|
case ${entropy_boot_file:=/boot/entropy} in
|
|
[Nn][Oo])
|
|
;;
|
|
*)
|
|
echo -n 'Writing early boot entropy file: '
|
|
rm -f ${entropy_boot_file} 2> /dev/null
|
|
oumask=`umask`
|
|
umask 077
|
|
if touch ${entropy_boot_file} 2> /dev/null; then
|
|
entropy_boot_file_confirmed="${entropy_boot_file}"
|
|
fi
|
|
case ${entropy_boot_file_confirmed} in
|
|
'')
|
|
warn 'write failed (read-only fs?)'
|
|
;;
|
|
*)
|
|
save_dev_random "${entropy_boot_file_confirmed}"
|
|
echo '.'
|
|
;;
|
|
esac
|
|
umask ${oumask}
|
|
;;
|
|
esac
|
|
}
|
|
|
|
load_rc_config $name
|
|
run_rc_command "$1"
|