George Spelvin c51f8f88d7 random32: make prandom_u32() output unpredictable ... Non-cryptographic PRNGs may have great statistical properties, but are usually trivially predictable to someone who knows the algorithm, given a small sample of their output. An LFSR like prandom_u32() is particularly simple, even if the sample is widely scattered bits. It turns out the network stack uses prandom_u32() for some things like random port numbers which it would prefer are *not* trivially predictable. Predictability led to a practical DNS spoofing attack. Oops. This patch replaces the LFSR with a homebrew cryptographic PRNG based on the SipHash round function, which is in turn seeded with 128 bits of strong random key. (The authors of SipHash have *not* been consulted about this abuse of their algorithm.) Speed is prioritized over security; attacks are rare, while performance is always wanted. Replacing all callers of prandom_u32() is the quick fix. Whether to reinstate a weaker PRNG for uses which can tolerate it is an open question. Commit f227e3ec3b ("random32: update the net random state on interrupt and activity") was an earlier attempt at a solution. This patch replaces it. Reported-by: Amit Klein <aksecurity@gmail.com> Cc: Willy Tarreau <w@1wt.eu> Cc: Eric Dumazet <edumazet@google.com> Cc: "Jason A. Donenfeld" <Jason@zx2c4.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Kees Cook <keescook@chromium.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: tytso@mit.edu Cc: Florian Westphal <fw@strlen.de> Cc: Marc Plumb <lkml.mplumb@gmail.com> Fixes: f227e3ec3b ("random32: update the net random state on interrupt and activity") Signed-off-by: George Spelvin <lkml@sdf.org> Link: https://lore.kernel.org/netdev/20200808152628.GA27941@SDF.ORG/ [ willy: partial reversal of f227e3ec3b5c; moved SIPROUND definitions to prandom.h for later use; merged George's prandom_seed() proposal; inlined siprand_u32(); replaced the net_rand_state[] array with 4 members to fix a build issue; cosmetic cleanups to make checkpatch happy; fixed RANDOM32_SELFTEST build ] Signed-off-by: Willy Tarreau <w@1wt.eu>		2020-10-24 20:21:57 +02:00
..
agp	agp: use semicolons rather than commas to separate statements	2020-09-28 06:06:52 +10:00
hw_random	Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2020-10-13 08:50:16 -07:00
ipmi	Bug fix pull for IPMI for 5.10	2020-10-14 15:00:20 -07:00
mwave	char/mwave: remove redundant initialization of variable bRC	2020-07-10 14:50:51 +02:00
pcmcia
tpm	tpm_tis: Add a check for invalid status	2020-10-02 00:21:03 +03:00
xilinx_hwicap
xillybus
adi.c
apm-emulation.c
applicom.c
applicom.h
bsr.c
ds1620.c
dsp56k.c
dtlk.c
hangcheck-timer.c
hpet.c
Kconfig	char: virtio: Select VIRTIO from VIRTIO_CONSOLE.	2020-09-07 14:32:40 +02:00
lp.c	Merge 5.9-rc3 into char-misc-next	2020-08-31 07:17:17 +02:00
Makefile
mem.c	/dev/zero: fixups for ->read	2020-09-07 10:46:35 +02:00
misc.c
mspec.c	char: mspec: Use kvzalloc() in mspec_mmap()	2020-08-28 12:10:04 +02:00
nsc_gpio.c
nvram.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
nwbutton.c
nwbutton.h
nwflash.c
pc8736x_gpio.c
powernv-op-panel.c
ppdev.c
ps3flash.c
random.c	random32: make prandom_u32() output unpredictable	2020-10-24 20:21:57 +02:00
raw.c	raw: don't keep unopened block device around	2020-09-23 10:43:19 -06:00
scx200_gpio.c
sonypi.c
tb0219.c
tlclk.c
toshiba.c
ttyprintk.c	ttyprintk: remove redundant initialization of variable ret	2020-07-10 14:50:51 +02:00
uv_mmtimer.c
virtio_console.c	Merge v5.8-rc6 into char-misc-next	2020-07-20 09:43:40 +02:00