Changes in Makefile

5084c1b50f9863db4e36c6ec86538f91c324b1ac - Rewrite entropy subsystem.

Thu, 30 Apr 2020 03:28:18 +0000

Rewrite entropy subsystem.Primary goals:1. Use cryptography primitives designed and vetted by cryptographers.2. Be honest about entropy estimation.3. Propagate full entropy as soon as possible.4. Simplify the APIs.5. Reduce overhead of rnd_add_data and cprng_strong.6. Reduce side channels of HWRNG data and human input sources.7. Improve visibility of operation with sysctl and event counters.Caveat: rngtest is no longer used generically for RND_TYPE_RNGrndsources. Hardware RNG devices should have hardware-specifichealth tests. For example, checking for two repeated 256-bit outputsworks to detect AMD's 2019 RDRAND bug. Not all hardware RNGs arenecessarily designed to produce exactly uniform output.ENTROPY POOL- A Keccak sponge, with test vectors, replaces the old LFSR/SHA-1 kludge as the cryptographic primitive.- `Entropy depletion' is available for testing purposes with a sysctl knob kern.entropy.depletion; otherwise it is disabled, and once the system reaches full entropy it is assumed to stay there as far as modern cryptography is concerned.- No `entropy estimation' based on sample values. Such `entropy estimation' is a contradiction in terms, dishonest to users, and a potential source of side channels. It is the responsibility of the driver author to study the entropy of the process that generates the samples.- Per-CPU gathering pools avoid contention on a global queue.- Entropy is occasionally consolidated into global pool -- as soon as it's ready, if we've never reached full entropy, and with a rate limit afterward. Operators can force consolidation now by running sysctl -w kern.entropy.consolidate=1.- rndsink(9) API has been replaced by an epoch counter which changes whenever entropy is consolidated into the global pool. . Usage: Cache entropy_epoch() when you seed. If entropy_epoch() has changed when you're about to use whatever you seeded, reseed. . Epoch is never zero, so initialize cache to 0 if you want to reseed on first use. . Epoch is -1 iff we have never reached full entropy -- in other words, the old rnd_initial_entropy is (entropy_epoch() != -1) -- but it is better if you check for changes rather than for -1, so that if the system estimated its own entropy incorrectly, entropy consolidation has the opportunity to prevent future compromise.- Sysctls and event counters provide operator visibility into what's happening: . kern.entropy.needed - bits of entropy short of full entropy . kern.entropy.pending - bits known to be pending in per-CPU pools, can be consolidated with sysctl -w kern.entropy.consolidate=1 . kern.entropy.epoch - number of times consolidation has happened, never 0, and -1 iff we have never reached full entropyCPRNG_STRONG- A cprng_strong instance is now a collection of per-CPU NIST Hash_DRBGs. There are only two in the system: user_cprng for /dev/urandom and sysctl kern.?random, and kern_cprng for kernel users which may need to operate in interrupt context up to IPL_VM. (Calling cprng_strong in interrupt context does not strike me as a particularly good idea, so I added an event counter to see whether anything actually does.)- Event counters provide operator visibility into when reseeding happens.INTEL RDRAND/RDSEED, VIA C3 RNG (CPU_RNG)- Unwired for now; will be rewired in a subsequent commit. List of files: /netbsd-src/sys/rump/dev/lib/librnd/Makefile

6bb51422881aa32822c80737814503e72f496e36 - Put the kernelside rump kernel headers into instead of

Tue, 26 Jan 2016 23:12:14 +0000

Put the kernelside rump kernel headers into instead ofsprinkling them around the faction directories. Avoids havingto add a CPPFLAGS (or several) to pretty much every componentMakefile.Leave compat headers around in the old locations.The commit changes some autogenerated files, but I'll fix thegenerators shortly and regen. List of files: /netbsd-src/sys/rump/dev/lib/librnd/Makefile

b2b6f2602eb45dc7eb73534a35f96e8f34b0bc70 - Add a COMMENT describing what each component roughly does.

Mon, 19 Oct 2015 16:16:32 +0000

Add a COMMENT describing what each component roughly does."make describe" prints the comment.Requested/inspired by Vincent Schwarzer on rumpkernel-users List of files: /netbsd-src/sys/rump/dev/lib/librnd/Makefile

f2fa9ab00d59bf4ff536283308f839525a5ac169 - use ioconf files for pseudo-device attach prototypes

Thu, 20 Aug 2015 11:51:12 +0000

use ioconf files for pseudo-device attach prototypes List of files: /netbsd-src/sys/rump/dev/lib/librnd/Makefile

78c7cd3319801fe8bf73beba11bda5e1580a3612 - Fix rump build: rndpseudo_50.c now needed by kernel, not rnd device.

Tue, 14 Apr 2015 13:32:34 +0000

Fix rump build: rndpseudo_50.c now needed by kernel, not rnd device. List of files: /netbsd-src/sys/rump/dev/lib/librnd/Makefile

0e3e572aea2dcc51d37135b8501558e17db5fa3c - rename component.c -> rnd_component.c

Thu, 13 Mar 2014 01:52:37 +0000

rename component.c -> rnd_component.c List of files: /netbsd-src/sys/rump/dev/lib/librnd/Makefile

7b0b7dedd94505901b8eb5d7dda67bd9de11d172 - Entropy-pool implementation move and cleanup.

Thu, 02 Feb 2012 19:42:57 +0000

Entropy-pool implementation move and cleanup.1) Move core entropy-pool code and source/sink/sample management code to sys/kern from sys/dev.2) Remove use of NRND as test for presence of entropy-pool code throughout source tree.3) Remove use of RND_ENABLED in device drivers as microoptimization to avoid expensive operations on disabled entropy sources; make the rnd_add calls do this directly so all callers benefit.4) Fix bug in recent rnd_add_data()/rnd_add_uint32() changes that might have lead to slight entropy overestimation for some sources.5) Add new source types for environmental sensors, power sensors, VM system events, and skew between clocks, with a sample implementation for each.ok releng to go in before the branch due to the difficulty of laterpullup (widespread #ifdef removal and moved files). Tested with releasebuilds on amd64 and evbarm and live testing on amd64. List of files: /netbsd-src/sys/rump/dev/lib/librnd/Makefile

4309071985d4b8ec01e5c6062c0b1d2ba8dfb3e9 - Put the path to the compat/common directory in a .PATH line, not in

Tue, 20 Dec 2011 17:09:04 +0000

Put the path to the compat/common directory in a .PATH line, not inan element of the SRCS list. This should fix a problem in which buildproducts were created in the source tree.Also add a comment about where COMPAT_50 is defined. List of files: /netbsd-src/sys/rump/dev/lib/librnd/Makefile

e48fd3a0e7ebafbaf2d221282d570d7cfc8da7e0 - SRCS += ${.CURDIR}/../../../../compat/common/rndpseudo_50.c

Mon, 19 Dec 2011 21:56:18 +0000

SRCS += ${.CURDIR}/../../../../compat/common/rndpseudo_50.cto fix build errors like this:DESTDIR/usr/lib/librumpdev_rnd.so: undefined reference to`rumpns_compat_50_rnd_ioctl' List of files: /netbsd-src/sys/rump/dev/lib/librnd/Makefile

6e1dd068e96db64905d676c8e9bc24cc95b3e158 - Separate /dev/random pseudodevice implemenation from kernel entropy pool

Sat, 17 Dec 2011 20:05:38 +0000

Separate /dev/random pseudodevice implemenation from kernel entropy poolimplementation. Rewrite pseudodevice code to use cprng_strong(9).The new pseudodevice is cloning, so each caller gets bits from a streamgenerated with its own key. Users of /dev/urandom get their generatorskeyed on a "best effort" basis -- the kernel will rekey generatorswhenever the entropy pool hits the high water mark -- while users of/dev/random get their generators rekeyed every time key-length bitsare output.The underlying cprng_strong API can use AES-256 or AES-128, but we useAES-128 because of concerns about related-key attacks on AES-256. Thisimproves performance (and reduces entropy pool depletion) significantlyfor users of /dev/urandom but does cause users of /dev/random to rekeytwice as often.Also fixes various bugs (including some missing locking and a reseed-counteroverflow in the CTR_DRBG code) found while testing this.For long reads, this generator is approximately 20 times as fast as theold generator (dd with bs=64K yields 53MB/sec on 2Ghz Core2 instead of2.5MB/sec) and also uses a separate mutex per instance so concurrencyis greatly improved. For reads of typical key sizes for moderncryptosystems (16-32 bytes) performance is about the same as the oldcode: a little better for 32 bytes, a little worse for 16 bytes. List of files: /netbsd-src/sys/rump/dev/lib/librnd/Makefile

643ba90bf04cee748e233e05593d2d6d9ff57f36 - Globally define -Wno-pointer-sign, as it has become a pointless

Tue, 16 Feb 2010 20:42:44 +0000

Globally define -Wno-pointer-sign, as it has become a pointlessexercise of "add it to every Makefile individually".XXX: should autosynchronize with the rest of the kernel buildflagsin sys/conf/Makefile.kern.inc. List of files: /netbsd-src/sys/rump/dev/lib/librnd/Makefile

293b1ff86daeab981b4362dd59c6dcf93f714bbc - add rump rnd device component

Tue, 08 Sep 2009 20:12:52 +0000

add rump rnd device component List of files: /netbsd-src/sys/rump/dev/lib/librnd/Makefile