]> git.ipfire.org Git - thirdparty/rng-tools.git/blame - rngd.c
Release version 5.
[thirdparty/rng-tools.git] / rngd.c
CommitLineData
61af3de3
JG
1/*
2 * rngd.c -- Random Number Generator daemon
3 *
4 * rngd reads data from a hardware random number generator, verifies it
5 * looks like random data, and adds it to /dev/random's entropy store.
d1b4c504 6 *
61af3de3
JG
7 * In theory, this should allow you to read very quickly from
8 * /dev/random; rngd also adds bytes to the entropy store periodically
9 * when it's full, which makes predicting the entropy store's contents
10 * harder.
11 *
12 * Copyright (C) 2001 Philipp Rumpf
13 *
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
d1b4c504 18 *
61af3de3
JG
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
23 *
24 * You should have received a copy of the GNU General Public License
25 * along with this program; if not, write to the Free Software
d32709d1 26 * Foundation, Inc., 51 Franklin Street, Suite 500, Boston, MA 02110-1335 USA
61af3de3
JG
27 */
28
29#define _GNU_SOURCE
30
31#ifndef HAVE_CONFIG_H
32#error Invalid or missing autoconf build environment
33#endif
34
35#include "rng-tools-config.h"
36
37#include <unistd.h>
38#include <stdint.h>
39#include <stdio.h>
40#include <stdlib.h>
41#include <sys/types.h>
42#include <sys/stat.h>
43#include <fcntl.h>
44#include <errno.h>
45#include <string.h>
46#include <argp.h>
47#include <syslog.h>
c192b4cf 48#include <signal.h>
61af3de3
JG
49
50#include "rngd.h"
51#include "fips.h"
52#include "exits.h"
53#include "rngd_entsource.h"
54#include "rngd_linux.h"
55
56/*
57 * Globals
58 */
59
60/* Background/daemon mode */
ca6941f8 61bool am_daemon; /* True if we went daemon */
61af3de3 62
c192b4cf
JG
63bool server_running = true; /* set to false, to stop daemon */
64
61af3de3 65/* Command line arguments and processing */
d1b4c504 66const char *argp_program_version =
61af3de3
JG
67 "rngd " VERSION "\n"
68 "Copyright 2001-2004 Jeff Garzik\n"
69 "Copyright (c) 2001 by Philipp Rumpf\n"
70 "This is free software; see the source for copying conditions. There is NO "
71 "warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.";
72
73const char *argp_program_bug_address = PACKAGE_BUGREPORT;
74
75static char doc[] =
76 "Check and feed random data from hardware device to kernel entropy pool.\n";
77
78static struct argp_option options[] = {
79 { "foreground", 'f', 0, 0, "Do not fork and become a daemon" },
80
81 { "background", 'b', 0, 0, "Become a daemon (default)" },
82
83 { "random-device", 'o', "file", 0,
84 "Kernel device used for random number output (default: /dev/random)" },
85
86 { "rng-device", 'r', "file", 0,
47c3d388 87 "Kernel device used for random number input (default: /dev/hwrng)" },
61af3de3 88
c192b4cf
JG
89 { "pid-file", 'p', "file", 0,
90 "File used for recording daemon PID, and multiple exclusion (default: /var/run/rngd.pid)" },
91
61af3de3
JG
92 { "random-step", 's', "nnn", 0,
93 "Number of bytes written to random-device at a time (default: 64)" },
94
95 { "fill-watermark", 'W', "n", 0,
96 "Do not stop feeding entropy to random-device until at least n bits of entropy are available in the pool (default: 2048), 0 <= n <= 4096" },
97
e42da63c
BH
98 { "quiet", 'q', 0, 0, "Suppress error messages" },
99
100 { "verbose" ,'v', 0, 0, "Report available entropy sources" },
101
2a014536
BH
102 { "no-drng", 'd', "1|0", 0,
103 "Do not use drng as a source of random number input (default: 0)" },
104
d1b4c504 105 { "no-tpm", 'n', "1|0", 0,
2a014536 106 "Do not use tpm as a source of random number input (default: 0)" },
61af3de3
JG
107
108 { 0 },
109};
110
111static struct arguments default_arguments = {
61af3de3 112 .random_name = "/dev/random",
c192b4cf 113 .pid_file = "/var/run/rngd.pid",
61af3de3 114 .random_step = 64,
ca6941f8 115 .daemon = true,
2a014536 116 .enable_drng = true,
ca6941f8
JG
117 .enable_tpm = true,
118 .quiet = false,
119 .verbose = false,
61af3de3
JG
120};
121struct arguments *arguments = &default_arguments;
122
d1b4c504 123static struct rng rng_default = {
47c3d388 124 .rng_name = "/dev/hwrng",
d1b4c504
JG
125 .rng_fd = -1,
126 .xread = xread,
d1b4c504
JG
127};
128
2a014536
BH
129static struct rng rng_drng = {
130 .rng_name = "drng",
131 .rng_fd = -1,
132 .xread = xread_drng,
133};
134
d1b4c504
JG
135static struct rng rng_tpm = {
136 .rng_name = "/dev/tpm0",
137 .rng_fd = -1,
138 .xread = xread_tpm,
d1b4c504
JG
139};
140
141struct rng *rng_list;
61af3de3
JG
142
143/*
144 * command line processing
145 */
146static error_t parse_opt (int key, char *arg, struct argp_state *state)
147{
61af3de3
JG
148 switch(key) {
149 case 'o':
150 arguments->random_name = arg;
151 break;
c192b4cf
JG
152 case 'p':
153 arguments->pid_file = arg;
154 break;
61af3de3 155 case 'r':
d1b4c504 156 rng_default.rng_name = arg;
61af3de3 157 break;
61af3de3 158 case 'f':
ca6941f8 159 arguments->daemon = false;
61af3de3
JG
160 break;
161 case 'b':
ca6941f8 162 arguments->daemon = true;
61af3de3
JG
163 break;
164 case 's':
165 if (sscanf(arg, "%i", &arguments->random_step) == 0)
166 argp_usage(state);
167 break;
168 case 'W': {
169 int n;
170 if ((sscanf(arg, "%i", &n) == 0) || (n < 0) || (n > 4096))
171 argp_usage(state);
172 else
173 arguments->fill_watermark = n;
174 break;
175 }
e42da63c 176 case 'q':
ca6941f8 177 arguments->quiet = true;
e42da63c
BH
178 break;
179 case 'v':
ca6941f8 180 arguments->verbose = true;
e42da63c 181 break;
2a014536
BH
182 case 'd': {
183 int n;
184 if ((sscanf(arg,"%i", &n) == 0) || ((n | 1)!=1))
185 argp_usage(state);
186 else
187 arguments->enable_drng = false;
188 break;
189 }
d1b4c504
JG
190 case 'n': {
191 int n;
192 if ((sscanf(arg,"%i", &n) == 0) || ((n | 1)!=1))
193 argp_usage(state);
194 else
ca6941f8 195 arguments->enable_tpm = false;
d1b4c504
JG
196 break;
197 }
61af3de3
JG
198
199 default:
200 return ARGP_ERR_UNKNOWN;
201 }
202
203 return 0;
204}
205
206static struct argp argp = { options, parse_opt, NULL, doc };
207
208
a9b9bb1d 209static int update_kernel_random(int random_step,
5db96329 210 unsigned char *buf, fips_ctx_t *fipsctx_in)
61af3de3 211{
61af3de3
JG
212 unsigned char *p;
213 int fips;
214
5db96329 215 fips = fips_run_rng_test(fipsctx_in, buf);
db508e37 216 if (fips)
d1b4c504 217 return 1;
61af3de3 218
d1b4c504
JG
219 for (p = buf; p + random_step <= &buf[FIPS_RNG_BUFFER_SIZE];
220 p += random_step) {
221 random_add_entropy(p, random_step);
a9b9bb1d 222 random_sleep();
d1b4c504
JG
223 }
224 return 0;
225}
61af3de3 226
a9b9bb1d 227static void do_loop(int random_step)
d1b4c504
JG
228{
229 unsigned char buf[FIPS_RNG_BUFFER_SIZE];
e42da63c 230 int retval = 0;
62838c65 231 int no_work = 0;
61af3de3 232
62838c65 233 while (no_work < 100) {
d1b4c504 234 struct rng *iter;
62838c65
JG
235 bool work_done;
236
237 work_done = false;
d1b4c504
JG
238 for (iter = rng_list; iter; iter = iter->next)
239 {
62838c65
JG
240 int rc;
241
c192b4cf
JG
242 if (!server_running)
243 return;
244
3b4a281b 245 retry_same:
62838c65
JG
246 if (iter->disabled)
247 continue; /* failed, no work */
248
d1b4c504 249 retval = iter->xread(buf, sizeof buf, iter);
62838c65
JG
250 if (retval)
251 continue; /* failed, no work */
252
253 work_done = true;
254
255 rc = update_kernel_random(random_step,
a9b9bb1d 256 buf, iter->fipsctx);
db508e37
PA
257 if (rc == 0) {
258 iter->success++;
259 if (iter->success >= RNG_OK_CREDIT) {
260 if (iter->failures)
261 iter->failures--;
262 iter->success = 0;
263 }
2a014536 264 break; /* succeeded, work done */
db508e37 265 }
62838c65
JG
266
267 iter->failures++;
3b4a281b
PA
268 if (iter->failures <= MAX_RNG_FAILURES/4) {
269 /* FIPS tests have false positives */
270 goto retry_same;
271 } else if (iter->failures >= MAX_RNG_FAILURES) {
e42da63c
BH
272 if (!arguments->quiet)
273 message(LOG_DAEMON|LOG_ERR,
62838c65
JG
274 "too many FIPS failures, disabling entropy source\n");
275 iter->disabled = true;
276 }
61af3de3 277 }
62838c65
JG
278
279 if (!work_done)
280 no_work++;
61af3de3 281 }
62838c65 282
e42da63c
BH
283 if (!arguments->quiet)
284 message(LOG_DAEMON|LOG_ERR,
62838c65 285 "No entropy sources working, exiting rngd\n");
61af3de3
JG
286}
287
c192b4cf
JG
288static void term_signal(int signo)
289{
290 server_running = false;
291}
292
61af3de3
JG
293int main(int argc, char **argv)
294{
2a014536
BH
295 int rc_rng = 1;
296 int rc_drng = 1;
297 int rc_tpm = 1;
c192b4cf 298 int pid_fd = -1;
e42da63c
BH
299
300 openlog("rngd", 0, LOG_DAEMON);
d1b4c504 301
870f0d5d
PA
302 /* Get the default watermark level for this platform */
303 arguments->fill_watermark = default_watermark();
304
d1b4c504 305 /* Parsing of commandline parameters */
61af3de3
JG
306 argp_parse(&argp, argc, argv, 0, 0, arguments);
307
d1b4c504 308 /* Init entropy sources, and open TRNG device */
2a014536
BH
309 if (arguments->enable_drng)
310 rc_drng = init_drng_entropy_source(&rng_drng);
0044517d 311 rc_rng = init_entropy_source(&rng_default);
9b1a3bbb 312 if (arguments->enable_tpm && rc_rng)
d1b4c504
JG
313 rc_tpm = init_tpm_entropy_source(&rng_tpm);
314
2a014536 315 if (rc_rng && rc_drng && rc_tpm) {
e42da63c
BH
316 if (!arguments->quiet) {
317 message(LOG_DAEMON|LOG_ERR,
9b1a3bbb 318 "can't open any entropy source");
e42da63c
BH
319 message(LOG_DAEMON|LOG_ERR,
320 "Maybe RNG device modules are not loaded\n");
321 }
322 return 1;
323 }
c192b4cf 324
e42da63c
BH
325 if (arguments->verbose) {
326 printf("Available entropy sources:\n");
327 if (!rc_rng)
328 printf("\tIntel/AMD hardware rng\n");
2a014536
BH
329 if (!rc_drng)
330 printf("\tDRNG\n");
e42da63c
BH
331 if (!rc_tpm)
332 printf("\tTPM\n");
333 }
334
c192b4cf 335 if (rc_rng
2a014536 336 && (rc_drng || !arguments->enable_drng)
e42da63c
BH
337 && (rc_tpm || !arguments->enable_tpm)) {
338 if (!arguments->quiet)
339 message(LOG_DAEMON|LOG_ERR,
340 "No entropy source available, shutting down\n");
d1b4c504
JG
341 return 1;
342 }
61af3de3
JG
343
344 /* Init entropy sink and open random device */
345 init_kernel_rng(arguments->random_name);
346
347 if (arguments->daemon) {
ca6941f8 348 am_daemon = true;
61af3de3
JG
349
350 if (daemon(0, 0) < 0) {
e42da63c
BH
351 if(!arguments->quiet)
352 fprintf(stderr, "can't daemonize: %s\n",
61af3de3
JG
353 strerror(errno));
354 return 1;
355 }
c192b4cf
JG
356
357 /* require valid, locked PID file to proceed */
358 pid_fd = write_pid_file(arguments->pid_file);
359 if (pid_fd < 0)
360 return 1;
361
362 signal(SIGHUP, SIG_IGN);
363 signal(SIGPIPE, SIG_IGN);
364 signal(SIGINT, term_signal);
365 signal(SIGTERM, term_signal);
61af3de3
JG
366 }
367
a9b9bb1d 368 do_loop(arguments->random_step);
61af3de3 369
c192b4cf
JG
370 if (pid_fd >= 0)
371 unlink(arguments->pid_file);
372
61af3de3
JG
373 return 0;
374}