summaryrefslogtreecommitdiff
path: root/src/lib
diff options
context:
space:
mode:
authorbcook <>2015-03-30 11:29:48 +0000
committerbcook <>2015-03-30 11:29:48 +0000
commit9f9909654ade9ba11a37c45f75c146ac91419bca (patch)
tree333b3747141f26ddb47094867942475d5b24ceed /src/lib
parent87dfb52384d6fa9cdb7418cfc6f81f1a121e862b (diff)
downloadopenbsd-9f9909654ade9ba11a37c45f75c146ac91419bca.tar.gz
openbsd-9f9909654ade9ba11a37c45f75c146ac91419bca.tar.bz2
openbsd-9f9909654ade9ba11a37c45f75c146ac91419bca.zip
add initial AIX getentropy/arc4random files. Thanks to Michael Felt.
Diffstat (limited to 'src/lib')
-rw-r--r--src/lib/libcrypto/arc4random/arc4random_aix.h80
-rw-r--r--src/lib/libcrypto/arc4random/getentropy_aix.c421
-rw-r--r--src/lib/libcrypto/crypto/arc4random_aix.h80
-rw-r--r--src/lib/libcrypto/crypto/getentropy_aix.c421
4 files changed, 1002 insertions, 0 deletions
diff --git a/src/lib/libcrypto/arc4random/arc4random_aix.h b/src/lib/libcrypto/arc4random/arc4random_aix.h
new file mode 100644
index 0000000000..e76c8cb598
--- /dev/null
+++ b/src/lib/libcrypto/arc4random/arc4random_aix.h
@@ -0,0 +1,80 @@
1/* $OpenBSD: arc4random_aix.h,v 1.1 2015/03/30 11:29:48 bcook Exp $ */
2
3/*
4 * Copyright (c) 1996, David Mazieres <dm@uun.org>
5 * Copyright (c) 2008, Damien Miller <djm@openbsd.org>
6 * Copyright (c) 2013, Markus Friedl <markus@openbsd.org>
7 * Copyright (c) 2014, Theo de Raadt <deraadt@openbsd.org>
8 *
9 * Permission to use, copy, modify, and distribute this software for any
10 * purpose with or without fee is hereby granted, provided that the above
11 * copyright notice and this permission notice appear in all copies.
12 *
13 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
14 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
15 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
16 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
17 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 */
21
22/*
23 * Stub functions for portability.
24 */
25
26#include <sys/mman.h>
27
28#include <pthread.h>
29#include <signal.h>
30
31static pthread_mutex_t arc4random_mtx = PTHREAD_MUTEX_INITIALIZER;
32#define _ARC4_LOCK() pthread_mutex_lock(&arc4random_mtx)
33#define _ARC4_UNLOCK() pthread_mutex_unlock(&arc4random_mtx)
34
35#define _ARC4_ATFORK(f) pthread_atfork(NULL, NULL, (f))
36
37static inline void
38_getentropy_fail(void)
39{
40 raise(SIGKILL);
41}
42
43static volatile sig_atomic_t _rs_forked;
44
45static inline void
46_rs_forkhandler(void)
47{
48 _rs_forked = 1;
49}
50
51static inline void
52_rs_forkdetect(void)
53{
54 static pid_t _rs_pid = 0;
55 pid_t pid = getpid();
56
57 if (_rs_pid == 0 || _rs_pid != pid || _rs_forked) {
58 _rs_pid = pid;
59 _rs_forked = 0;
60 if (rs)
61 memset(rs, 0, sizeof(*rs));
62 }
63}
64
65static inline int
66_rs_allocate(struct _rs **rsp, struct _rsx **rsxp)
67{
68 if ((*rsp = mmap(NULL, sizeof(**rsp), PROT_READ|PROT_WRITE,
69 MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
70 return (-1);
71
72 if ((*rsxp = mmap(NULL, sizeof(**rsxp), PROT_READ|PROT_WRITE,
73 MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED) {
74 munmap(*rsp, sizeof(**rsp));
75 return (-1);
76 }
77
78 _ARC4_ATFORK(_rs_forkhandler);
79 return (0);
80}
diff --git a/src/lib/libcrypto/arc4random/getentropy_aix.c b/src/lib/libcrypto/arc4random/getentropy_aix.c
new file mode 100644
index 0000000000..644a32a909
--- /dev/null
+++ b/src/lib/libcrypto/arc4random/getentropy_aix.c
@@ -0,0 +1,421 @@
1/* $OpenBSD: getentropy_aix.c,v 1.1 2015/03/30 11:29:48 bcook Exp $ */
2
3/*
4 * Copyright (c) 2015 Michael Felt <aixtools@gmail.com>
5 * Copyright (c) 2014 Theo de Raadt <deraadt@openbsd.org>
6 * Copyright (c) 2014 Bob Beck <beck@obtuse.com>
7 *
8 * Permission to use, copy, modify, and distribute this software for any
9 * purpose with or without fee is hereby granted, provided that the above
10 * copyright notice and this permission notice appear in all copies.
11 *
12 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 *
20 * Intended to Emulate getentropy(2) as documented at:
21 * http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/getentropy.2
22 */
23/*
24 * -lperfstat is needed for the psuedo entropy data
25 */
26
27#include <sys/mman.h>
28#include <sys/procfs.h>
29#include <sys/protosw.h>
30#include <sys/resource.h>
31#include <sys/socket.h>
32#include <sys/stat.h>
33#include <sys/statvfs.h>
34#include <sys/timers.h>
35#include <errno.h>
36#include <fcntl.h>
37#include <signal.h>
38#include <stdio.h>
39#include <string.h>
40#include <termios.h>
41
42#include <openssl/sha.h>
43
44#include <libperfstat.h>
45
46#define REPEAT 5
47#define min(a, b) (((a) < (b)) ? (a) : (b))
48
49#define HX(a, b) \
50 do { \
51 if ((a)) \
52 HD(errno); \
53 else \
54 HD(b); \
55 } while (0)
56
57#define HR(x, l) (SHA512_Update(&ctx, (char *)(x), (l)))
58#define HD(x) (SHA512_Update(&ctx, (char *)&(x), sizeof (x)))
59#define HF(x) (SHA512_Update(&ctx, (char *)&(x), sizeof (void*)))
60
61int getentropy(void *buf, size_t len);
62
63static int gotdata(char *buf, size_t len);
64static int getentropy_urandom(void *buf, size_t len, const char *path,
65 int devfscheck);
66static int getentropy_fallback(void *buf, size_t len);
67
68int
69getentropy(void *buf, size_t len)
70{
71 int ret = -1;
72
73 if (len > 256) {
74 errno = EIO;
75 return -1;
76 }
77
78 /*
79 * Try to get entropy with /dev/urandom
80 */
81 ret = getentropy_urandom(buf, len, "/dev/urandom", 0);
82 if (ret != -1)
83 return (ret);
84
85 /*
86 * Entropy collection via /dev/urandom has failed.
87 *
88 * No other API exists for collecting entropy, and we have
89 * no failsafe way to get it on AIX that is not sensitive
90 * to resource exhaustion.
91 *
92 * We have very few options:
93 * - Even syslog_r is unsafe to call at this low level, so
94 * there is no way to alert the user or program.
95 * - Cannot call abort() because some systems have unsafe
96 * corefiles.
97 * - Could raise(SIGKILL) resulting in silent program termination.
98 * - Return EIO, to hint that arc4random's stir function
99 * should raise(SIGKILL)
100 * - Do the best under the circumstances....
101 *
102 * This code path exists to bring light to the issue that AIX
103 * does not provide a failsafe API for entropy collection.
104 *
105 * We hope this demonstrates that AIX should consider
106 * providing a new failsafe API which works in a chroot or
107 * when file descriptors are exhausted.
108 */
109#undef FAIL_INSTEAD_OF_TRYING_FALLBACK
110#ifdef FAIL_INSTEAD_OF_TRYING_FALLBACK
111 raise(SIGKILL);
112#endif
113 ret = getentropy_fallback(buf, len);
114 if (ret != -1)
115 return (ret);
116
117 errno = EIO;
118 return (ret);
119}
120
121/*
122 * Basic sanity checking; wish we could do better.
123 */
124static int
125gotdata(char *buf, size_t len)
126{
127 char any_set = 0;
128 size_t i;
129
130 for (i = 0; i < len; ++i)
131 any_set |= buf[i];
132 if (any_set == 0)
133 return -1;
134 return 0;
135}
136
137static int
138getentropy_urandom(void *buf, size_t len, const char *path, int devfscheck)
139{
140 struct stat st;
141 size_t i;
142 int fd, flags;
143 int save_errno = errno;
144
145start:
146
147 flags = O_RDONLY;
148#ifdef O_NOFOLLOW
149 flags |= O_NOFOLLOW;
150#endif
151#ifdef O_CLOEXEC
152 flags |= O_CLOEXEC;
153#endif
154 fd = open(path, flags, 0);
155 if (fd == -1) {
156 if (errno == EINTR)
157 goto start;
158 goto nodevrandom;
159 }
160#ifndef O_CLOEXEC
161 fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
162#endif
163
164 /* Lightly verify that the device node looks sane */
165 if (fstat(fd, &st) == -1 || !S_ISCHR(st.st_mode)) {
166 close(fd);
167 goto nodevrandom;
168 }
169 for (i = 0; i < len; ) {
170 size_t wanted = len - i;
171 ssize_t ret = read(fd, (char *)buf + i, wanted);
172
173 if (ret == -1) {
174 if (errno == EAGAIN || errno == EINTR)
175 continue;
176 close(fd);
177 goto nodevrandom;
178 }
179 i += ret;
180 }
181 close(fd);
182 if (gotdata(buf, len) == 0) {
183 errno = save_errno;
184 return 0; /* satisfied */
185 }
186nodevrandom:
187 errno = EIO;
188 return -1;
189}
190
191static const int cl[] = {
192 CLOCK_REALTIME,
193#ifdef CLOCK_MONOTONIC
194 CLOCK_MONOTONIC,
195#endif
196#ifdef CLOCK_MONOTONIC_RAW
197 CLOCK_MONOTONIC_RAW,
198#endif
199#ifdef CLOCK_TAI
200 CLOCK_TAI,
201#endif
202#ifdef CLOCK_VIRTUAL
203 CLOCK_VIRTUAL,
204#endif
205#ifdef CLOCK_UPTIME
206 CLOCK_UPTIME,
207#endif
208#ifdef CLOCK_PROCESS_CPUTIME_ID
209 CLOCK_PROCESS_CPUTIME_ID,
210#endif
211#ifdef CLOCK_THREAD_CPUTIME_ID
212 CLOCK_THREAD_CPUTIME_ID,
213#endif
214};
215
216static int
217getentropy_fallback(void *buf, size_t len)
218{
219 uint8_t results[SHA512_DIGEST_LENGTH];
220 int save_errno = errno, e, pgs = sysconf(_SC_PAGESIZE), faster = 0, repeat;
221 static int cnt;
222 struct timespec ts;
223 struct timeval tv;
224 perfstat_cpu_total_t cpustats;
225 perfstat_cpu_total_wpar_t cpustats_wpar;
226 perfstat_partition_total_t lparstats;
227 perfstat_disk_total_t diskinfo;
228 perfstat_netinterface_total_t netinfo;
229 struct rusage ru;
230 sigset_t sigset;
231 struct stat st;
232 SHA512_CTX ctx;
233 static pid_t lastpid;
234 pid_t pid;
235 size_t i, ii, m;
236 char *p;
237
238 pid = getpid();
239 if (lastpid == pid) {
240 faster = 1;
241 repeat = 2;
242 } else {
243 faster = 0;
244 lastpid = pid;
245 repeat = REPEAT;
246 }
247 for (i = 0; i < len; ) {
248 int j;
249 SHA512_Init(&ctx);
250 for (j = 0; j < repeat; j++) {
251 HX((e = gettimeofday(&tv, NULL)) == -1, tv);
252 if (e != -1) {
253 cnt += (int)tv.tv_sec;
254 cnt += (int)tv.tv_usec;
255 }
256
257 HX(perfstat_cpu_total(NULL, &cpustats,
258 sizeof(cpustats), 1) == -1, cpustats);
259
260 HX(perfstat_cpu_total_wpar(NULL, &cpustats_wpar,
261 sizeof(cpustats_wpar), 1) == -1, cpustats_wpar);
262
263 HX(perfstat_partition_total(NULL, &lparstats,
264 sizeof(lparstats), 1) == -1, lparstats);
265
266 HX(perfstat_disk_total(NULL, &diskinfo,
267 sizeof(diskinfo), 1) == -1, diskinfo);
268
269 HX(perfstat_netinterface_total(NULL, &netinfo,
270 sizeof(netinfo), 1) == -1, netinfo);
271
272 for (ii = 0; ii < sizeof(cl)/sizeof(cl[0]); ii++)
273 HX(clock_gettime(cl[ii], &ts) == -1, ts);
274
275 HX((pid = getpid()) == -1, pid);
276 HX((pid = getsid(pid)) == -1, pid);
277 HX((pid = getppid()) == -1, pid);
278 HX((pid = getpgid(0)) == -1, pid);
279 HX((e = getpriority(0, 0)) == -1, e);
280
281 if (!faster) {
282 ts.tv_sec = 0;
283 ts.tv_nsec = 1;
284 (void) nanosleep(&ts, NULL);
285 }
286
287 HX(sigpending(&sigset) == -1, sigset);
288 HX(sigprocmask(SIG_BLOCK, NULL, &sigset) == -1,
289 sigset);
290
291 HF(getentropy); /* an addr in this library */
292 HF(printf); /* an addr in libc */
293 p = (char *)&p;
294 HD(p); /* an addr on stack */
295 p = (char *)&errno;
296 HD(p); /* the addr of errno */
297
298 if (i == 0) {
299 struct sockaddr_storage ss;
300 struct statvfs stvfs;
301 struct termios tios;
302 socklen_t ssl;
303 off_t off;
304
305 /*
306 * Prime-sized mappings encourage fragmentation;
307 * thus exposing some address entropy.
308 */
309 struct mm {
310 size_t npg;
311 void *p;
312 } mm[] = {
313 { 17, MAP_FAILED }, { 3, MAP_FAILED },
314 { 11, MAP_FAILED }, { 2, MAP_FAILED },
315 { 5, MAP_FAILED }, { 3, MAP_FAILED },
316 { 7, MAP_FAILED }, { 1, MAP_FAILED },
317 { 57, MAP_FAILED }, { 3, MAP_FAILED },
318 { 131, MAP_FAILED }, { 1, MAP_FAILED },
319 };
320
321 for (m = 0; m < sizeof mm/sizeof(mm[0]); m++) {
322 HX(mm[m].p = mmap(NULL,
323 mm[m].npg * pgs,
324 PROT_READ|PROT_WRITE,
325 MAP_PRIVATE|MAP_ANON, -1,
326 (off_t)0), mm[m].p);
327 if (mm[m].p != MAP_FAILED) {
328 size_t mo;
329
330 /* Touch some memory... */
331 p = mm[m].p;
332 mo = cnt %
333 (mm[m].npg * pgs - 1);
334 p[mo] = 1;
335 cnt += (int)((long)(mm[m].p)
336 / pgs);
337 }
338
339 /* Check cnts and times... */
340 for (ii = 0; ii < sizeof(cl)/sizeof(cl[0]);
341 ii++) {
342 HX((e = clock_gettime(cl[ii],
343 &ts)) == -1, ts);
344 if (e != -1)
345 cnt += (int)ts.tv_nsec;
346 }
347
348 HX((e = getrusage(RUSAGE_SELF,
349 &ru)) == -1, ru);
350 if (e != -1) {
351 cnt += (int)ru.ru_utime.tv_sec;
352 cnt += (int)ru.ru_utime.tv_usec;
353 }
354 }
355
356 for (m = 0; m < sizeof mm/sizeof(mm[0]); m++) {
357 if (mm[m].p != MAP_FAILED)
358 munmap(mm[m].p, mm[m].npg * pgs);
359 mm[m].p = MAP_FAILED;
360 }
361
362 HX(stat(".", &st) == -1, st);
363 HX(statvfs(".", &stvfs) == -1, stvfs);
364
365 HX(stat("/", &st) == -1, st);
366 HX(statvfs("/", &stvfs) == -1, stvfs);
367
368 HX((e = fstat(0, &st)) == -1, st);
369 if (e == -1) {
370 if (S_ISREG(st.st_mode) ||
371 S_ISFIFO(st.st_mode) ||
372 S_ISSOCK(st.st_mode)) {
373 HX(fstatvfs(0, &stvfs) == -1,
374 stvfs);
375 HX((off = lseek(0, (off_t)0,
376 SEEK_CUR)) < 0, off);
377 }
378 if (S_ISCHR(st.st_mode)) {
379 HX(tcgetattr(0, &tios) == -1,
380 tios);
381 } else if (S_ISSOCK(st.st_mode)) {
382 memset(&ss, 0, sizeof ss);
383 ssl = sizeof(ss);
384 HX(getpeername(0,
385 (void *)&ss, &ssl) == -1,
386 ss);
387 }
388 }
389
390 HX((e = getrusage(RUSAGE_CHILDREN,
391 &ru)) == -1, ru);
392 if (e != -1) {
393 cnt += (int)ru.ru_utime.tv_sec;
394 cnt += (int)ru.ru_utime.tv_usec;
395 }
396 } else {
397 /* Subsequent hashes absorb previous result */
398 HD(results);
399 }
400
401 HX((e = gettimeofday(&tv, NULL)) == -1, tv);
402 if (e != -1) {
403 cnt += (int)tv.tv_sec;
404 cnt += (int)tv.tv_usec;
405 }
406
407 HD(cnt);
408 }
409 SHA512_Final(results, &ctx);
410 memcpy((char *)buf + i, results, min(sizeof(results), len - i));
411 i += min(sizeof(results), len - i);
412 }
413 explicit_bzero(&ctx, sizeof ctx);
414 explicit_bzero(results, sizeof results);
415 if (gotdata(buf, len) == 0) {
416 errno = save_errno;
417 return 0; /* satisfied */
418 }
419 errno = EIO;
420 return -1;
421}
diff --git a/src/lib/libcrypto/crypto/arc4random_aix.h b/src/lib/libcrypto/crypto/arc4random_aix.h
new file mode 100644
index 0000000000..e76c8cb598
--- /dev/null
+++ b/src/lib/libcrypto/crypto/arc4random_aix.h
@@ -0,0 +1,80 @@
1/* $OpenBSD: arc4random_aix.h,v 1.1 2015/03/30 11:29:48 bcook Exp $ */
2
3/*
4 * Copyright (c) 1996, David Mazieres <dm@uun.org>
5 * Copyright (c) 2008, Damien Miller <djm@openbsd.org>
6 * Copyright (c) 2013, Markus Friedl <markus@openbsd.org>
7 * Copyright (c) 2014, Theo de Raadt <deraadt@openbsd.org>
8 *
9 * Permission to use, copy, modify, and distribute this software for any
10 * purpose with or without fee is hereby granted, provided that the above
11 * copyright notice and this permission notice appear in all copies.
12 *
13 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
14 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
15 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
16 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
17 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 */
21
22/*
23 * Stub functions for portability.
24 */
25
26#include <sys/mman.h>
27
28#include <pthread.h>
29#include <signal.h>
30
31static pthread_mutex_t arc4random_mtx = PTHREAD_MUTEX_INITIALIZER;
32#define _ARC4_LOCK() pthread_mutex_lock(&arc4random_mtx)
33#define _ARC4_UNLOCK() pthread_mutex_unlock(&arc4random_mtx)
34
35#define _ARC4_ATFORK(f) pthread_atfork(NULL, NULL, (f))
36
37static inline void
38_getentropy_fail(void)
39{
40 raise(SIGKILL);
41}
42
43static volatile sig_atomic_t _rs_forked;
44
45static inline void
46_rs_forkhandler(void)
47{
48 _rs_forked = 1;
49}
50
51static inline void
52_rs_forkdetect(void)
53{
54 static pid_t _rs_pid = 0;
55 pid_t pid = getpid();
56
57 if (_rs_pid == 0 || _rs_pid != pid || _rs_forked) {
58 _rs_pid = pid;
59 _rs_forked = 0;
60 if (rs)
61 memset(rs, 0, sizeof(*rs));
62 }
63}
64
65static inline int
66_rs_allocate(struct _rs **rsp, struct _rsx **rsxp)
67{
68 if ((*rsp = mmap(NULL, sizeof(**rsp), PROT_READ|PROT_WRITE,
69 MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
70 return (-1);
71
72 if ((*rsxp = mmap(NULL, sizeof(**rsxp), PROT_READ|PROT_WRITE,
73 MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED) {
74 munmap(*rsp, sizeof(**rsp));
75 return (-1);
76 }
77
78 _ARC4_ATFORK(_rs_forkhandler);
79 return (0);
80}
diff --git a/src/lib/libcrypto/crypto/getentropy_aix.c b/src/lib/libcrypto/crypto/getentropy_aix.c
new file mode 100644
index 0000000000..644a32a909
--- /dev/null
+++ b/src/lib/libcrypto/crypto/getentropy_aix.c
@@ -0,0 +1,421 @@
1/* $OpenBSD: getentropy_aix.c,v 1.1 2015/03/30 11:29:48 bcook Exp $ */
2
3/*
4 * Copyright (c) 2015 Michael Felt <aixtools@gmail.com>
5 * Copyright (c) 2014 Theo de Raadt <deraadt@openbsd.org>
6 * Copyright (c) 2014 Bob Beck <beck@obtuse.com>
7 *
8 * Permission to use, copy, modify, and distribute this software for any
9 * purpose with or without fee is hereby granted, provided that the above
10 * copyright notice and this permission notice appear in all copies.
11 *
12 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 *
20 * Intended to Emulate getentropy(2) as documented at:
21 * http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/getentropy.2
22 */
23/*
24 * -lperfstat is needed for the psuedo entropy data
25 */
26
27#include <sys/mman.h>
28#include <sys/procfs.h>
29#include <sys/protosw.h>
30#include <sys/resource.h>
31#include <sys/socket.h>
32#include <sys/stat.h>
33#include <sys/statvfs.h>
34#include <sys/timers.h>
35#include <errno.h>
36#include <fcntl.h>
37#include <signal.h>
38#include <stdio.h>
39#include <string.h>
40#include <termios.h>
41
42#include <openssl/sha.h>
43
44#include <libperfstat.h>
45
46#define REPEAT 5
47#define min(a, b) (((a) < (b)) ? (a) : (b))
48
49#define HX(a, b) \
50 do { \
51 if ((a)) \
52 HD(errno); \
53 else \
54 HD(b); \
55 } while (0)
56
57#define HR(x, l) (SHA512_Update(&ctx, (char *)(x), (l)))
58#define HD(x) (SHA512_Update(&ctx, (char *)&(x), sizeof (x)))
59#define HF(x) (SHA512_Update(&ctx, (char *)&(x), sizeof (void*)))
60
61int getentropy(void *buf, size_t len);
62
63static int gotdata(char *buf, size_t len);
64static int getentropy_urandom(void *buf, size_t len, const char *path,
65 int devfscheck);
66static int getentropy_fallback(void *buf, size_t len);
67
68int
69getentropy(void *buf, size_t len)
70{
71 int ret = -1;
72
73 if (len > 256) {
74 errno = EIO;
75 return -1;
76 }
77
78 /*
79 * Try to get entropy with /dev/urandom
80 */
81 ret = getentropy_urandom(buf, len, "/dev/urandom", 0);
82 if (ret != -1)
83 return (ret);
84
85 /*
86 * Entropy collection via /dev/urandom has failed.
87 *
88 * No other API exists for collecting entropy, and we have
89 * no failsafe way to get it on AIX that is not sensitive
90 * to resource exhaustion.
91 *
92 * We have very few options:
93 * - Even syslog_r is unsafe to call at this low level, so
94 * there is no way to alert the user or program.
95 * - Cannot call abort() because some systems have unsafe
96 * corefiles.
97 * - Could raise(SIGKILL) resulting in silent program termination.
98 * - Return EIO, to hint that arc4random's stir function
99 * should raise(SIGKILL)
100 * - Do the best under the circumstances....
101 *
102 * This code path exists to bring light to the issue that AIX
103 * does not provide a failsafe API for entropy collection.
104 *
105 * We hope this demonstrates that AIX should consider
106 * providing a new failsafe API which works in a chroot or
107 * when file descriptors are exhausted.
108 */
109#undef FAIL_INSTEAD_OF_TRYING_FALLBACK
110#ifdef FAIL_INSTEAD_OF_TRYING_FALLBACK
111 raise(SIGKILL);
112#endif
113 ret = getentropy_fallback(buf, len);
114 if (ret != -1)
115 return (ret);
116
117 errno = EIO;
118 return (ret);
119}
120
121/*
122 * Basic sanity checking; wish we could do better.
123 */
124static int
125gotdata(char *buf, size_t len)
126{
127 char any_set = 0;
128 size_t i;
129
130 for (i = 0; i < len; ++i)
131 any_set |= buf[i];
132 if (any_set == 0)
133 return -1;
134 return 0;
135}
136
137static int
138getentropy_urandom(void *buf, size_t len, const char *path, int devfscheck)
139{
140 struct stat st;
141 size_t i;
142 int fd, flags;
143 int save_errno = errno;
144
145start:
146
147 flags = O_RDONLY;
148#ifdef O_NOFOLLOW
149 flags |= O_NOFOLLOW;
150#endif
151#ifdef O_CLOEXEC
152 flags |= O_CLOEXEC;
153#endif
154 fd = open(path, flags, 0);
155 if (fd == -1) {
156 if (errno == EINTR)
157 goto start;
158 goto nodevrandom;
159 }
160#ifndef O_CLOEXEC
161 fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
162#endif
163
164 /* Lightly verify that the device node looks sane */
165 if (fstat(fd, &st) == -1 || !S_ISCHR(st.st_mode)) {
166 close(fd);
167 goto nodevrandom;
168 }
169 for (i = 0; i < len; ) {
170 size_t wanted = len - i;
171 ssize_t ret = read(fd, (char *)buf + i, wanted);
172
173 if (ret == -1) {
174 if (errno == EAGAIN || errno == EINTR)
175 continue;
176 close(fd);
177 goto nodevrandom;
178 }
179 i += ret;
180 }
181 close(fd);
182 if (gotdata(buf, len) == 0) {
183 errno = save_errno;
184 return 0; /* satisfied */
185 }
186nodevrandom:
187 errno = EIO;
188 return -1;
189}
190
191static const int cl[] = {
192 CLOCK_REALTIME,
193#ifdef CLOCK_MONOTONIC
194 CLOCK_MONOTONIC,
195#endif
196#ifdef CLOCK_MONOTONIC_RAW
197 CLOCK_MONOTONIC_RAW,
198#endif
199#ifdef CLOCK_TAI
200 CLOCK_TAI,
201#endif
202#ifdef CLOCK_VIRTUAL
203 CLOCK_VIRTUAL,
204#endif
205#ifdef CLOCK_UPTIME
206 CLOCK_UPTIME,
207#endif
208#ifdef CLOCK_PROCESS_CPUTIME_ID
209 CLOCK_PROCESS_CPUTIME_ID,
210#endif
211#ifdef CLOCK_THREAD_CPUTIME_ID
212 CLOCK_THREAD_CPUTIME_ID,
213#endif
214};
215
216static int
217getentropy_fallback(void *buf, size_t len)
218{
219 uint8_t results[SHA512_DIGEST_LENGTH];
220 int save_errno = errno, e, pgs = sysconf(_SC_PAGESIZE), faster = 0, repeat;
221 static int cnt;
222 struct timespec ts;
223 struct timeval tv;
224 perfstat_cpu_total_t cpustats;
225 perfstat_cpu_total_wpar_t cpustats_wpar;
226 perfstat_partition_total_t lparstats;
227 perfstat_disk_total_t diskinfo;
228 perfstat_netinterface_total_t netinfo;
229 struct rusage ru;
230 sigset_t sigset;
231 struct stat st;
232 SHA512_CTX ctx;
233 static pid_t lastpid;
234 pid_t pid;
235 size_t i, ii, m;
236 char *p;
237
238 pid = getpid();
239 if (lastpid == pid) {
240 faster = 1;
241 repeat = 2;
242 } else {
243 faster = 0;
244 lastpid = pid;
245 repeat = REPEAT;
246 }
247 for (i = 0; i < len; ) {
248 int j;
249 SHA512_Init(&ctx);
250 for (j = 0; j < repeat; j++) {
251 HX((e = gettimeofday(&tv, NULL)) == -1, tv);
252 if (e != -1) {
253 cnt += (int)tv.tv_sec;
254 cnt += (int)tv.tv_usec;
255 }
256
257 HX(perfstat_cpu_total(NULL, &cpustats,
258 sizeof(cpustats), 1) == -1, cpustats);
259
260 HX(perfstat_cpu_total_wpar(NULL, &cpustats_wpar,
261 sizeof(cpustats_wpar), 1) == -1, cpustats_wpar);
262
263 HX(perfstat_partition_total(NULL, &lparstats,
264 sizeof(lparstats), 1) == -1, lparstats);
265
266 HX(perfstat_disk_total(NULL, &diskinfo,
267 sizeof(diskinfo), 1) == -1, diskinfo);
268
269 HX(perfstat_netinterface_total(NULL, &netinfo,
270 sizeof(netinfo), 1) == -1, netinfo);
271
272 for (ii = 0; ii < sizeof(cl)/sizeof(cl[0]); ii++)
273 HX(clock_gettime(cl[ii], &ts) == -1, ts);
274
275 HX((pid = getpid()) == -1, pid);
276 HX((pid = getsid(pid)) == -1, pid);
277 HX((pid = getppid()) == -1, pid);
278 HX((pid = getpgid(0)) == -1, pid);
279 HX((e = getpriority(0, 0)) == -1, e);
280
281 if (!faster) {
282 ts.tv_sec = 0;
283 ts.tv_nsec = 1;
284 (void) nanosleep(&ts, NULL);
285 }
286
287 HX(sigpending(&sigset) == -1, sigset);
288 HX(sigprocmask(SIG_BLOCK, NULL, &sigset) == -1,
289 sigset);
290
291 HF(getentropy); /* an addr in this library */
292 HF(printf); /* an addr in libc */
293 p = (char *)&p;
294 HD(p); /* an addr on stack */
295 p = (char *)&errno;
296 HD(p); /* the addr of errno */
297
298 if (i == 0) {
299 struct sockaddr_storage ss;
300 struct statvfs stvfs;
301 struct termios tios;
302 socklen_t ssl;
303 off_t off;
304
305 /*
306 * Prime-sized mappings encourage fragmentation;
307 * thus exposing some address entropy.
308 */
309 struct mm {
310 size_t npg;
311 void *p;
312 } mm[] = {
313 { 17, MAP_FAILED }, { 3, MAP_FAILED },
314 { 11, MAP_FAILED }, { 2, MAP_FAILED },
315 { 5, MAP_FAILED }, { 3, MAP_FAILED },
316 { 7, MAP_FAILED }, { 1, MAP_FAILED },
317 { 57, MAP_FAILED }, { 3, MAP_FAILED },
318 { 131, MAP_FAILED }, { 1, MAP_FAILED },
319 };
320
321 for (m = 0; m < sizeof mm/sizeof(mm[0]); m++) {
322 HX(mm[m].p = mmap(NULL,
323 mm[m].npg * pgs,
324 PROT_READ|PROT_WRITE,
325 MAP_PRIVATE|MAP_ANON, -1,
326 (off_t)0), mm[m].p);
327 if (mm[m].p != MAP_FAILED) {
328 size_t mo;
329
330 /* Touch some memory... */
331 p = mm[m].p;
332 mo = cnt %
333 (mm[m].npg * pgs - 1);
334 p[mo] = 1;
335 cnt += (int)((long)(mm[m].p)
336 / pgs);
337 }
338
339 /* Check cnts and times... */
340 for (ii = 0; ii < sizeof(cl)/sizeof(cl[0]);
341 ii++) {
342 HX((e = clock_gettime(cl[ii],
343 &ts)) == -1, ts);
344 if (e != -1)
345 cnt += (int)ts.tv_nsec;
346 }
347
348 HX((e = getrusage(RUSAGE_SELF,
349 &ru)) == -1, ru);
350 if (e != -1) {
351 cnt += (int)ru.ru_utime.tv_sec;
352 cnt += (int)ru.ru_utime.tv_usec;
353 }
354 }
355
356 for (m = 0; m < sizeof mm/sizeof(mm[0]); m++) {
357 if (mm[m].p != MAP_FAILED)
358 munmap(mm[m].p, mm[m].npg * pgs);
359 mm[m].p = MAP_FAILED;
360 }
361
362 HX(stat(".", &st) == -1, st);
363 HX(statvfs(".", &stvfs) == -1, stvfs);
364
365 HX(stat("/", &st) == -1, st);
366 HX(statvfs("/", &stvfs) == -1, stvfs);
367
368 HX((e = fstat(0, &st)) == -1, st);
369 if (e == -1) {
370 if (S_ISREG(st.st_mode) ||
371 S_ISFIFO(st.st_mode) ||
372 S_ISSOCK(st.st_mode)) {
373 HX(fstatvfs(0, &stvfs) == -1,
374 stvfs);
375 HX((off = lseek(0, (off_t)0,
376 SEEK_CUR)) < 0, off);
377 }
378 if (S_ISCHR(st.st_mode)) {
379 HX(tcgetattr(0, &tios) == -1,
380 tios);
381 } else if (S_ISSOCK(st.st_mode)) {
382 memset(&ss, 0, sizeof ss);
383 ssl = sizeof(ss);
384 HX(getpeername(0,
385 (void *)&ss, &ssl) == -1,
386 ss);
387 }
388 }
389
390 HX((e = getrusage(RUSAGE_CHILDREN,
391 &ru)) == -1, ru);
392 if (e != -1) {
393 cnt += (int)ru.ru_utime.tv_sec;
394 cnt += (int)ru.ru_utime.tv_usec;
395 }
396 } else {
397 /* Subsequent hashes absorb previous result */
398 HD(results);
399 }
400
401 HX((e = gettimeofday(&tv, NULL)) == -1, tv);
402 if (e != -1) {
403 cnt += (int)tv.tv_sec;
404 cnt += (int)tv.tv_usec;
405 }
406
407 HD(cnt);
408 }
409 SHA512_Final(results, &ctx);
410 memcpy((char *)buf + i, results, min(sizeof(results), len - i));
411 i += min(sizeof(results), len - i);
412 }
413 explicit_bzero(&ctx, sizeof ctx);
414 explicit_bzero(results, sizeof results);
415 if (gotdata(buf, len) == 0) {
416 errno = save_errno;
417 return 0; /* satisfied */
418 }
419 errno = EIO;
420 return -1;
421}
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-26 02:14:20 +0000