Commit aebda156 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller

net: defer net_secret[] initialization

Instead of feeding net_secret[] at boot time, defer the init
at the point first socket is created.

This permits some platforms to use better entropy sources than
the ones available at boot time.
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2d177be8
...@@ -3,6 +3,7 @@ ...@@ -3,6 +3,7 @@
#include <linux/types.h> #include <linux/types.h>
extern void net_secret_init(void);
extern __u32 secure_ip_id(__be32 daddr); extern __u32 secure_ip_id(__be32 daddr);
extern __u32 secure_ipv6_id(const __be32 daddr[4]); extern __u32 secure_ipv6_id(const __be32 daddr[4]);
extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport); extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
......
...@@ -12,12 +12,10 @@ ...@@ -12,12 +12,10 @@
static u32 net_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned; static u32 net_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned;
static int __init net_secret_init(void) void net_secret_init(void)
{ {
get_random_bytes(net_secret, sizeof(net_secret)); get_random_bytes(net_secret, sizeof(net_secret));
return 0;
} }
late_initcall(net_secret_init);
#ifdef CONFIG_INET #ifdef CONFIG_INET
static u32 seq_scale(u32 seq) static u32 seq_scale(u32 seq)
......
...@@ -114,6 +114,7 @@ ...@@ -114,6 +114,7 @@
#include <net/inet_common.h> #include <net/inet_common.h>
#include <net/xfrm.h> #include <net/xfrm.h>
#include <net/net_namespace.h> #include <net/net_namespace.h>
#include <net/secure_seq.h>
#ifdef CONFIG_IP_MROUTE #ifdef CONFIG_IP_MROUTE
#include <linux/mroute.h> #include <linux/mroute.h>
#endif #endif
...@@ -262,8 +263,10 @@ void build_ehash_secret(void) ...@@ -262,8 +263,10 @@ void build_ehash_secret(void)
get_random_bytes(&rnd, sizeof(rnd)); get_random_bytes(&rnd, sizeof(rnd));
} while (rnd == 0); } while (rnd == 0);
if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0) if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0) {
get_random_bytes(&ipv6_hash_secret, sizeof(ipv6_hash_secret)); get_random_bytes(&ipv6_hash_secret, sizeof(ipv6_hash_secret));
net_secret_init();
}
} }
EXPORT_SYMBOL(build_ehash_secret); EXPORT_SYMBOL(build_ehash_secret);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment