[onerng talk] OneRNG not working after reinstalling onerng_3.6-1_all.deb
mark.diamond at yahoo.co.uk
mark.diamond at yahoo.co.uk
Tue Feb 26 05:18:50 GMT 2019
I have discovered the source of the problem, thought why it should be the case, I have no idea ...
I edited OneRNG.sh to put in a whole lot of echo statements ...For the sake of completeness, I've copied it here.
#!/bin/sh -x
#
# Version 3.6
# UDEV doesn't allow us to start daemon's directly
# so we queue some thing to start the daemon a few secs
# after
#
touch "/home/mrd/Desktop/AAA-OneRNG.txt"
chmod 666 "/home/mrd/Desktop/AAA-OneRNG.txt"
if [ "$1" = "daemon" ]; then
echo Line 10 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
if [ ! -c /dev/$2 ]
then
echo Line 13 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
exit 1
fi
echo Line 15 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
ONERNG_URANDOM_RESEED="0"
echo Line 18 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
if [ -x /etc/onerng.conf ]
then
echo Line 21 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
. /etc/onerng.conf
else
echo Line 24 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
ONERNG_START_RNGD="1"
ONERNG_MODE_COMMAND="cmd0"
ONERNG_VERIFY_FIRMWARE="1"
ONERNG_AES_WHITEN="1"
echo Line 29 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
fi
#
# a user can override this default entropy value
# in /etc/onerng.conf
#
if [ -z "$ONERNG_ENTROPY" ]
then
echo Line 38 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
ONERNG_ENTROPY=".93750" # our default entropy value from onerng
echo Line 40 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
fi
echo Line 43 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
umask 0177
echo Line 45 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
# wait for udev to finish
sleep 1
echo Line 49 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
stty -F /dev/$2 raw -echo clocal -crtscts
echo Line 51 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
# make a temp file
t=`mktemp`
echo $$ >/var/lock/LCK..$2
echo Line 55 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
trap "rm -f -- '$t' '/var/lock/LCK..$2'" EXIT
echo Line 57 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
i=0
while [ $i -lt 200 ] # loop waiting for things to come up
do
truncate --size=0 "$t"
# off, produce nothing, flush
echo "cmd0" >/dev/$2 # standard noise
echo "cmdO" >/dev/$2 # turn it on
echo Line 67 : $i >> "/home/mrd/Desktop/AAA-OneRNG.txt"
dd if=/dev/$2 iflag=fullblock of=$t bs=1 &
pid=$!
stty -F /dev/$2 raw -echo clocal -crtscts
sleep 0.05
echo "cmdo" >/dev/$2 # turn it off
echo "cmd4" >/dev/$2 # turn off noise gathering
echo "cmdw" >/dev/$2 # flush entropy pool
kill $pid
if [ -s $t ] # if we got some data exit the loop
then
break
fi
i=`expr $i + 1`
done
echo Line 84 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
if [ "$ONERNG_VERIFY_FIRMWARE" = "1" ]
then
sleep 0.1
# read data into temp file
truncate --size=0 "$t"
dd if=/dev/$2 iflag=fullblock of=$t bs=4 &
pid=$!
sleep 0.02
echo "cmdO" >/dev/$2 # start it
echo "cmdX" >/dev/$2 # extract image
# wait a while, should be done, kill it
sleep 3.5
kill $pid
echo "cmdo" >/dev/$2 # turn it off
echo "cmdw" >/dev/$2 # flush entropy pool
# process the data, verify its signature, log any errors
python /sbin/onerng_verify.py $t
# res 1 err, 0 OK
res=$?
# clean up temp file
rm -f -- "$t"
rm /var/lock/LCK..$2
trap - EXIT
# if we failed quit - it's a bad or compromised board
if [ "$res" = "1" ]
then
echo Line 117 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
exit 1
fi
else
echo Line 121 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
# clean up temp file
rm -f -- "$t"
rm /var/lock/LCK..$2
trap - EXIT
fi
if [ "$ONERNG_START_RNGD" = "1" ]
then
# waste some entropy
nohup dd if=/dev/$2 of=/dev/null bs=10k count=1 >/dev/null&
# start the device
echo "$ONERNG_MODE_COMMAND" >/dev/$2
echo "cmdO" >/dev/$2
sleep .5
# after dd is done start rngd
PATH=/sbin:/usr/sbin:$PATH
export PATH
#
# there are multiple versions of RNGD in the field with incompatible flags
#
# -n 1 -d 1 turn OFF default rngs if present
#
# --rng-entropy allows us to qualify the quality of our entropy source
#
RNGD_FLAGS=""
v=`rngd --help| grep no-tpm | wc -l `
if [ "$v" != "0" ]
then
RNGD_FLAGS="$RNGD_FLAGS -n 1"
fi
v=`rngd --help| grep no-drng | wc -l `
if [ "$v" != "0" ]
then
RNGD_FLAGS="$RNGD_FLAGS -d 1"
fi
v=`rngd --help| grep rng-entropy | wc -l`
if [ "$v" != "0" ]
then
# set the entropy to 7.5 bits/byte
RNGD_FLAGS="$RNGD_FLAGS --rng-entropy=$ONERNG_ENTROPY"
fi
#
# if the system has a default RNG running shut it down
#
v=`systemctl list-units 2>/dev/null | grep rng-tools | grep running | wc -l`
if [ "$v" = "1" ]
then
systemctl stop rng-tools
fi
#
# RNGD seems to do its random testing in a way that doesn't always tolerate
# randomness in the way that failures occur (in random strings false negatives happen - ie ranmdom
# data that looks like it might not be random occur in the real world), the tests RNGD does work
# on relatively small blocks so it finds them - failure rates of 1 in 1000 are acceptable,
# rngd gets worried if a bunch of these happen close to each other in time and shuts down, of
# course when these blocks occur in time is random too and eventually if we're running lots
# of data through rngd we seem to trigger this
#
# If ONERNG_AES_WHITEN is enabled (the default) we use openssl AES to 'whiten' the input stream
# by encrypting it with a random key obtained from the OneRNG
#
if [ "$ONERNG_AES_WHITEN" = "1" ]
then
nohup openssl enc -aes128 -nosalt -in /dev/$2 -pass file:/dev/$2 -out /dev/stdout 2>/dev/null | rngd -f $RNGD_FLAGS -r /dev/stdin >/dev/null 2>/dev/null &
echo $! > /var/lock/LCK..$2
else
rngd $RNGD_FLAGS -p /var/lock/LCK..$2 -r /dev/$2
fi
#
# if the urandom_min_reseed_secs parameter exists then allow
# us to override it - it's there to stop /dev/urandom from sucking
# up all the system entropy, but with onerng we have lots, so usually
# we set this to "0" which allows /dev/urandom to suck as much entropy
# as it wants (many systems have this set to 60 [secs])
#
if [ -e /proc/sys/kernel/random/urandom_min_reseed_secs ]
then
if [ -n "$ONERNG_URANDOM_RESEED" ]
then
echo "$ONERNG_URANDOM_RESEED" >/proc/sys/kernel/random/urandom_min_reseed_secs
fi
fi
else
echo "cmdo" >/dev/$2
fi
echo Line 212 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
exit 0
fi
#
# when something is removed kill the daemon
#
if [ "$1" = "kill" ]; then
if [ -e /var/lock/LCK..$2 ]
then
kill -9 `cat /var/lock/LCK..$2`
else
if [ -z "$DEVPATH" ]
then
echo "Missing DEVPATH variable, are you running from udev?"
echo Line 227 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
exit 1
fi
#
# some systems have a broken udev, udevd remove
# is seldom used and obviously not well tested
# %k in the udev rules doesn't give the same
# name you were given when the add occured
# the solution is to see if the current dev name
# matches one of the /sys/class/tty/ttyACM* files
# if so use that name's lock file to kill rngd
#
t1="`echo $DEVPATH | grep ttyACM | wc -l`"
if [ "$v" = "1" ]
then
t1="$DEVPATH"
else
t1="`ls -lt /sys/class/tty/ttyACM* | grep $DEVPATH`"
fi
t2=`basename "$t1"`
if [ -e /var/lock/LCK..$t2 ]
then
kill -9 `cat /var/lock/LCK..$t2`
rm /var/lock/LCK..$t2
fi
fi
#
# if there's a default rng-tools we can restart it
#
v=`which systemctl | grep "not found" | wc -l`
if [ $v != "1" ]
then
v=`systemctl list-units | grep rng-tools | grep running | wc -l`
if [ $v = "0" ]
then
systemctl start rng-tools >/dev/null 2>&1
fi
fi
echo Line 267 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
exit 0
fi
#
# normal case - start the daemon using at
#
if [ ! -c /dev/$1 ]
then
echo Line 275 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
exit 1
fi
echo "/sbin/onerng.sh daemon $1" | at -M NOW
echo Line 279 >> "/home/mrd/Desktop/AAA-OneRNG.txt"
exit 0
And now, when I plug OneRNG into the socket and check AAA-OneRNG.txt, I find:Line 275
Line 279
Line 10
Line 15
Line 18
Line 21
Line 43
Line 45
Line 49
Line 51
Line 55
Line 57
Line 67 : 0
Line 84
Line 117
... with Line 117 being at the point where the pre-existing comment says "# if we failed quit - it's a bad or compromised board". Why that should be the case, I have no idea. But it sounds like a death knell.
Cheers,Mark
On Friday, 22 February 2019, 22:15:20 GMT+11, Paul Campbell <paul at taniwha.com> wrote:
|
|
| OneRNG |
|
|
|
|
|
| |
| OneRNG not working after reinstalling onerng_3.6-1_all.deb |
| by Paul Campbell |
| in OneRNG Talk |
|
| |
| On Friday, 22 February 2019 2:05:21 PM NZDT mark.diamond at yahoo.co.uk wrote:
> One of the difficulties in trying to figure out what might be wrong is that
> I can't find a clear description of the logic of what is being installed
> and what it does. I know I've received a very generous response to my
> query, but it is very piecemeal and leaves me mostly in the dark. I'm an
> experienced programmer but I'm not a kernel device writer or anything like
> that. When I read the replies I've received about dmesg, udev, etc. I'm
> reminded of just how difficult it is for an expert in something to remember
> what it is like to be ignorant.
>
> What I've managed to *guess* (without really having a clue whether this is
> correct) from the responses is ...When OneRNG is plugged into a USB port,
> the OS needs to recognize the kind of device it is. It does that by having
> a set of rules (in the case of OneRNG, rules in a file called
> 79-onerng.rules ). The rules need to be in a general system folder that is
> usually called 'udev'.When the device is recognized by the OS, the rules
> say that a shell script 'onerng.sh' should be run to initiate a daemon that
> collects entropy from the device.When the device is removed, the rules also
> describe how the daemon is to be terminated. Am I even vaguely on the right
> track?
> Cheers,Mark
so here's how it works: the UDEV system (in the kernel) recognises events
from devices (like device insertion) and send them to the UDEV daemon (these
days it's become part of systemd) the UDEV daemon finds an appropriate file (in
this case 79-onerng.rules) and uses it to execute scripts it passing in
parameters describing what's happening (it's not quite this simple various
UDEV daemons are buggy in different ways, debian's systemd one is actually
better in most respects than what it replaced).
>From this point on it's onerng code in particular /etc/onerng.sh ....
essentially this code has to get around the main limitation placed on scripts
started by the UDEV daemon - that they can't create their own daemons that
persist (and that's exactly what we want to do - start an instance of rngd) -
so the problem is that we want to write code that works on as many different
linux systems as we can, ones with different init systems (this was coded pre
systemd) - so what we do in /etc/onerng.sh is we use the lowest common
denominator, we don't try and code in every init system on the planet, that
would be a maintenance nightmare, instead we use the 'at' command to schedule
another run of /etc/onerng.sh using "at now /etc/onerng.sh" so /etc/onerng.sh
is run again with either a parameter "daemon" to mean start a daemon, or
"remove" (when a device is removed) to stop the daemon
(the recent Ubuntu problems are because they mistakenly started running UDEVD
before the root filesystem was writeable - the at command couldn't access its
database, and our scripts couldn't create system lock files in /var/lock)
Starting a daemon essentially involves:
- checking the firmware integrity (there's a python script that does the heavy
lifting here)
- changing the OneRNG mode to the correct mode
- starting rngd (there are different versions of rngd out there so we have to
be a bit smart about how we do this)
you'll see a bunch of dd commands in there, they're either to read the firmware
image or to flush buffers as we change modes
Hopefully that's enough detail to understand the command flow
Paul
|
| |
| ⮪ Reply 🖂 New topic View topic… |
| Unsubscribe • Switch to a daily digest |
|
|
|
|
|
|
- Privacy
- Acceptable Use
- Terms of Service
|
|
|
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ourshack.com/pipermail/discuss/attachments/20190226/1be4f5c0/attachment.html>
More information about the Discuss
mailing list