Bugzilla Bug 47107

On a server system without any hardware number generator it happens that
/dev/random blocks because of not enough entropy available. The entropy for it
is collected from keyboard mouse and/or device interrupts. But on a server
system with lots of memory and without any keyboard or mouse it happens that
not enough entropy is available and blocks the system if anyone tries to access
/dev/random.

As one solution the software can access /dev/urandom instead which is not so
much random than /dev/random but 1. it doesn't block and the randomness of
/dev/urandom is in most cases really enough. But to get all software using
/dev/urandom instead those software has been either patched or /dev/random
linked to /dev/urandom, which is of course not the best solution and also not
easily possibly with devfs installed.

As there are the "rng-tools" package for using hardware number generators such
as i8x0 or AMD hardware this package can be used to obtain enough entropy for
/dev/random - but unfortunatly most of the motherboards out there doesn't serve
these hardware components these days. 

Therefore the most decent solution for getting /dev/random non-blocking for non
hardware generator supported server systems is to use the rng-tools package
with a patche /etc/init.d/rngd start() function in which the rng-daemon is used
with /dev/urandom like this:

-- cut here --
start() {
        ebegin "Starting hardware RNG daemon"
        if [ -e /dev/hw_random ]; then
                start-stop-daemon --start --quiet --exec /usr/sbin/rngd -- -b
-r /dev/hw_random
                eend $? "Failed to start hardware RNG daemon"
        elif [ -e /dev/hwrandom ]; then
                start-stop-daemon --start --quiet --exec /usr/sbin/rngd -- -b
-r /dev/hwrandom
                eend $? "Failed to start hardware RNG daemon"
        elif [ -e /dev/i810_rng ]; then
                start-stop-daemon --start --quiet --exec /usr/sbin/rngd -- -b
-r /dev/i810_rng
                eend $? "Failed to start hardware RNG daemon"
        else
                einfo "No hardware RNG found, using /dev/urandom"
                start-stop-daemon --start --quiet --exec /usr/sbin/rngd -- -b
-r /dev/urandom
                eend $? "Failed to start hardware RNG daemon"
        fi
}
-- cut here --

This way /dev/random will be non-blocking on those systems and apache or/and
libsasl doesn't have any problem in using /dev/random anymore if necessary.

Reproducible: Always
Steps to Reproduce:
1. call "head -c 1024 /dev/random" several times and see it blocking if the
mouse/keyboard is not used
2. Imaging that you don't have a keyboard or mouse so that the entropy isn't
enough
3. use the "rng-tools" and use the other start() method to get /dev/urandom
used instead.
Actual Results:  
After the fix /dev/random is non blocking anymore and apache and/or libsasl
works like a charme 
without blocking in several other situations.

Expected Results:  
the rng-tools should start up the daemon with /dev/urandom as the input source
if no hardware 
random generator device is found and if course the "rng-tools" should be
considered as being the 
default on a standa gentoo installation or at least the documentation should
cover that blocking system 
and inform the user about the alternative in using the "rng-tools" package.

Please check apache and/or the MD5 routines in libsasl as they are using
/dev/random and are 
therefore blocking if the entropy is too low. And there are probably dozen
other tools/utilities/
programs out there using /dev/random and blocking if it doesn't have enough
random data left.

the kernel also collects entropy from disk/network timing, and in many cases
this provides more than enough entropy. however I do think using rngd to do a 
feedback input definetly has a place (/me recalls too many people reporting the
blocking for input bugs...)

in cvs now.

Just as an addition. IMHO This topic should also be raised in the Installation
Handbook of gentoo linux as configurating/using the RNG tools correctly is a
very important part of the installation as this could lead to many different
problems if one doesn't know that /dev/random is the cause for all his/her
hangs.

And please explain what you exactly changed in the cvs now concerning the
rng-tools? As I really think they should be included in each default
installation. Believe me, I have 2 servers here which ran out of entropy
because they have heaps of memory so lots of disk access is anyway cached. It
is really easy to reproduce that /dev/random blocks, so using a hardware random
generator or the rng daemon on gentoo is a mandatory thing.