Could there be an error message on lack of entropy?

[Jason A. Donenfeld]

On Tue, Oct 30, 2018 at 10:49:30AM -0700, mike at farmwald.com wrote:
> I've been trying to use wireguard on OpenWRT (using a Turris Omnia without
> wireless.)
> 
> The wg interface would not send packets, but there was no indication of
> why. I've been trying to debug this (intermittently) since May. Someone on
> the OpenWRT mailing list today suggested that a lack of entropy might be
> the problem. Adding "haveged " fixed the problem and the interface now
> seems to work just fine.
> 
> It would be *very* helpful if wireguard reported in the system log that it
> can't come up due to a lack of entropy.

On the receiving end, we do this:

if (skb_queue_len(&wg->incoming_handshakes) > MAX_QUEUED_INCOMING_HANDSHAKES ||
    unlikely(!rng_is_initialized())) {
        net_dbg_skb_ratelimited("%s: Dropping handshake packet from %pISpfsc\n",
                                wg->dev->name, skb);
        goto err;
}

On the sending end, the packets queue up until the first handshake
completes, per usual. Meanwhile sending the handshake initiation packet
is blocked and is just waiting for the RNG to be initialized, and then
it sends, the handshake completes, and the queued up packets are
released. Arguably that blocking behavior is not ideal, though,
especially as it means removing a peer that is waiting for entropy will
wind up blocking rtnl. I'll take a look at this and see what can be
done.