[PATCH 00/18] random number generator improvements

[Stephen Hemminger <stephen@networkplumber.org>]

DPDK random number generator has some issues that are worth addressing
in this release. There are seeding related issues, and the current
random number generator is weak and seed could be derived.

The seeding issue is caused by build detection of getentropy()
not working; which results in use of TSC on many systems.
The fix is to always use getentropy().

The security sensitive values (RSS and Toeplitz hash keys,
the IPsec SAD hash seed, an IPsec salt and random MAC addresses)
were generated with rte_rand(), whose internal state can be recovered
from a handful of outputs. The fix is to introduce a DPDK
wrapper around the more secure kernel getrandom() API.

Also found that the sched RED was rolling its own very
simplistic PRNG. The fix is to just use existing rte_rand().
This does drop an inline function in header (rte_fast_rand)
which should never have been exposed.

For Windows build, shims for both getentropy() and getrandom()
are provided.

A couple of other improvements to rte_rand:
  - seeding uses the whole 64 bits passed to rte_srand().
  - helper function for when only 32 bits are needed rte_rand32().
  - test infrastructure now supports seeding for repeatability.
  - unit tests for rte_random_bytes() and rte_rand32().

Stephen Hemminger (18):
  eal/windows: add getentropy shim
  random: always use getentropy
  eal: add 32 bit random number function
  sched: fix data race in RED random number generation
  eal/windows: add getrandom shim
  eal: add function to get random bytes
  hash: use secure random for Toeplitz hash key
  pipeline: use secure random for IPsec salt
  net: use secure random for random MAC address
  ipsec: use secure random for SAD hash seed
  net/intel: use secure random for default RSS key
  random: use all 64 bits of the seed
  drivers/net: use secure random for RSS key
  drivers/net: use common random MAC address helper
  random: remove RDSEED fallback for initial seed
  test: allow setting random seed for tests
  test: add random number generator tests
  doc: recommend secure random for unpredictable values

 AGENTS.md                              |   6 +-
 app/test/meson.build                   |   1 +
 app/test/test.c                        |  48 ++++
 app/test/test_random.c                 | 297 +++++++++++++++++++++++++
 doc/guides/contributing/unit_test.rst  |  15 ++
 doc/guides/rel_notes/release_26_11.rst |  29 ++-
 drivers/net/axgbe/axgbe_dev.c          |  16 +-
 drivers/net/bnx2x/bnx2x.c              |  11 +-
 drivers/net/enetc/enetc4_vf.c          |  22 +-
 drivers/net/enetfec/enet_ethdev.c      |  16 +-
 drivers/net/intel/cpfl/cpfl_ethdev.c   |   5 +-
 drivers/net/intel/iavf/iavf_ethdev.c   |   8 +-
 drivers/net/intel/ice/ice_dcf.c        |  10 +-
 drivers/net/intel/ice/ice_ethdev.c     |  11 +-
 drivers/net/intel/idpf/idpf_ethdev.c   |   5 +-
 lib/eal/common/rte_random.c            | 148 +++++++-----
 lib/eal/include/rte_random.h           |  89 ++++++--
 lib/eal/meson.build                    |   3 -
 lib/eal/windows/include/rte_os_shim.h  |  64 ++++++
 lib/eal/windows/meson.build            |   6 +-
 lib/hash/rte_thash.c                   |  46 +++-
 lib/hash/rte_thash.h                   |   4 +-
 lib/ipsec/ipsec_sad.c                  |   7 +-
 lib/net/rte_ether.c                    |  13 +-
 lib/net/rte_ether.h                    |   5 +
 lib/pipeline/rte_swx_ipsec.c           |   3 +-
 lib/sched/rte_red.c                    |   9 +-
 lib/sched/rte_red.h                    |  26 +--
 28 files changed, 753 insertions(+), 170 deletions(-)
 create mode 100644 app/test/test_random.c

-- 
2.53.0