diff options
| -rw-r--r-- | src/compat/compat.h | 43 | ||||
| -rw-r--r-- | src/config.c | 5 |
2 files changed, 48 insertions, 0 deletions
diff --git a/src/compat/compat.h b/src/compat/compat.h index 6a5f33c..68d62b9 100644 --- a/src/compat/compat.h +++ b/src/compat/compat.h @@ -222,6 +222,49 @@ static const struct in6_addr our_in6addr_any = IN6ADDR_ANY_INIT; #define in6addr_any our_in6addr_any #endif +#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 13, 0) && LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0) +#include <linux/completion.h> +#include <linux/random.h> +#include <linux/errno.h> +struct rng_initializer { + struct completion done; + struct random_ready_callback cb; +}; +static inline void rng_initialized_callback(struct random_ready_callback *cb) +{ + complete(&container_of(cb, struct rng_initializer, cb)->done); +} +static inline int wait_for_random_bytes(void) +{ + static bool rng_is_initialized = false; + int ret; + if (unlikely(!rng_is_initialized)) { + struct rng_initializer rng = { + .done = COMPLETION_INITIALIZER(rng.done), + .cb = { .owner = THIS_MODULE, .func = rng_initialized_callback } + }; + ret = add_random_ready_callback(&rng.cb); + if (!ret) { + ret = wait_for_completion_interruptible(&rng.done); + if (ret) { + del_random_ready_callback(&rng.cb); + return ret; + } + } else if (ret != -EALREADY) + return ret; + rng_is_initialized = true; + } + return 0; +} +#elif LINUX_VERSION_CODE < KERNEL_VERSION(4, 2, 0) +/* This is a disaster. Without this API, we really have no way of + * knowing if it's initialized. We just return that it has and hope + * for the best... */ +static inline int wait_for_random_bytes(void) +{ + return 0; +} +#endif /* https://lkml.org/lkml/2015/6/12/415 */ #include <linux/netdevice.h> diff --git a/src/config.c b/src/config.c index d3b6611..286c874 100644 --- a/src/config.c +++ b/src/config.c @@ -8,6 +8,7 @@ #include "hashtables.h" #include "peer.h" #include "uapi.h" +#include <linux/random.h> static int set_device_port(struct wireguard_device *wg, u16 port) { @@ -134,6 +135,10 @@ int config_set_device(struct wireguard_device *wg, void __user *user_device) void __user *user_peer; bool modified_static_identity = false; + /* It's important that the Linux RNG is fully seeded before we let the user + * actually configure the device, so that we're assured to have good ephemerals. */ + wait_for_random_bytes(); + BUILD_BUG_ON(WG_KEY_LEN != NOISE_PUBLIC_KEY_LEN); BUILD_BUG_ON(WG_KEY_LEN != NOISE_SYMMETRIC_KEY_LEN); |