Add hooks to override native arc4random_buf on FreeBSD.

The FreeBSD-native arc4random_buf implementation falls back to weak sources of
entropy if the sysctl fails. Remove these dangerous fallbacks by overriding
locally.

Unfortunately, pthread_atfork() is also broken on FreeBSD (at least 9 and 10)
if a program does not link to -lthr. Callbacks registered with pthread_atfork()
simply fail silently. So, it is not always possible to detect a PID wraparound.
I wish we could do better.

This improves arc4random_buf's safety compared to the native FreeBSD
implementation.

Tested on FreeBSD 9 and 10.

4 files changed, 298 insertions, 0 deletions

diff --git a/src/lib/libcrypto/arc4random/arc4random_freebsd.h b/src/lib/libcrypto/arc4random/arc4random_freebsd.h
new file mode 100644
index 0000000000..0231ff2d4c
--- /dev/null
+++ b/src/lib/libcrypto/arc4random/arc4random_freebsd.h
@@ -0,0 +1,85 @@
+/*      $OpenBSD: arc4random_freebsd.h,v 1.1 2014/11/03 06:23:30 bcook Exp $    */
+
+/*
+ * Copyright (c) 1996, David Mazieres <dm@uun.org>
+ * Copyright (c) 2008, Damien Miller <djm@openbsd.org>
+ * Copyright (c) 2013, Markus Friedl <markus@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Stub functions for portability.
+ */
+
+#include <sys/mman.h>
+
+#include <pthread.h>
+#include <signal.h>
+
+static pthread_mutex_t arc4random_mtx = PTHREAD_MUTEX_INITIALIZER;
+#define _ARC4_LOCK()   pthread_mutex_lock(&arc4random_mtx)
+#define _ARC4_UNLOCK() pthread_mutex_unlock(&arc4random_mtx)
+
+/*
+ * Unfortunately, pthread_atfork() is broken on FreeBSD (at least 9 and 10) if
+ * a program does not link to -lthr. Callbacks registered with pthread_atfork()
+ * appear to fail silently. So, it is not always possible to detect a PID
+ * wraparound.
+ */
+#define _ARC4_ATFORK(f) pthread_atfork(NULL, NULL, (f))
+
+static inline void
+_getentropy_fail(void)
+{
+        raise(SIGKILL);
+}
+
+static volatile sig_atomic_t _rs_forked;
+
+static inline void
+_rs_forkhandler(void)
+{
+        _rs_forked = 1;
+}
+
+static inline void
+_rs_forkdetect(void)
+{
+        static pid_t _rs_pid = 0;
+        pid_t pid = getpid();
+
+        if (_rs_pid == 0 || _rs_pid != pid || _rs_forked) {
+                _rs_pid = pid;
+                _rs_forked = 0;
+                if (rs)
+                        memset(rs, 0, sizeof(*rs));
+        }
+}
+
+static inline int
+_rs_allocate(struct _rs **rsp, struct _rsx **rsxp)
+{
+        if ((*rsp = mmap(NULL, sizeof(**rsp), PROT_READ|PROT_WRITE,
+            MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
+                return -1;
+
+        if ((*rsxp = mmap(NULL, sizeof(**rsxp), PROT_READ|PROT_WRITE,
+            MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED) {
+                munmap(*rsp, sizeof(**rsp));
+                return -1;
+        }
+
+        _ARC4_ATFORK(_rs_forkhandler);
+        return 0;
+}
diff --git a/src/lib/libcrypto/arc4random/getentropy_freebsd.c b/src/lib/libcrypto/arc4random/getentropy_freebsd.c
new file mode 100644
index 0000000000..ec760ae43d
--- /dev/null
+++ b/src/lib/libcrypto/arc4random/getentropy_freebsd.c
@@ -0,0 +1,64 @@
+/*      $OpenBSD: getentropy_freebsd.c,v 1.1 2014/11/03 06:23:30 bcook Exp $    */
+
+/*
+ * Copyright (c) 2014 Pawel Jakub Dawidek <pjd@FreeBSD.org>
+ * Copyright (c) 2014 Brent Cook <bcook@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * Emulation of getentropy(2) as documented at:
+ * http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/getentropy.2
+ */
+
+#include <sys/types.h>
+#include <sys/sysctl.h>
+
+#include <errno.h>
+#include <stddef.h>
+
+/*
+ * Derived from lib/libc/gen/arc4random.c from FreeBSD.
+ */
+static size_t
+getentropy_sysctl(u_char *buf, size_t size)
+{
+        int mib[2];
+        size_t len, done;
+
+        mib[0] = CTL_KERN;
+        mib[1] = KERN_ARND;
+        done = 0;
+
+        do {
+                len = size;
+                if (sysctl(mib, 2, buf, &len, NULL, 0) == -1)
+                        return (done);
+                done += len;
+                buf += len;
+                size -= len;
+        } while (size > 0);
+
+        return (done);
+}
+
+int
+getentropy(void *buf, size_t len)
+{
+        if (len <= 256 &&
+                        getentropy_sysctl(buf, len) == len) {
+                return 0;
+        }
+
+        errno = EIO;
+        return -1;
+}
diff --git a/src/lib/libcrypto/crypto/arc4random_freebsd.h b/src/lib/libcrypto/crypto/arc4random_freebsd.h
new file mode 100644
index 0000000000..0231ff2d4c
--- /dev/null
+++ b/src/lib/libcrypto/crypto/arc4random_freebsd.h
@@ -0,0 +1,85 @@
+/*      $OpenBSD: arc4random_freebsd.h,v 1.1 2014/11/03 06:23:30 bcook Exp $    */
+
+/*
+ * Copyright (c) 1996, David Mazieres <dm@uun.org>
+ * Copyright (c) 2008, Damien Miller <djm@openbsd.org>
+ * Copyright (c) 2013, Markus Friedl <markus@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Stub functions for portability.
+ */
+
+#include <sys/mman.h>
+
+#include <pthread.h>
+#include <signal.h>
+
+static pthread_mutex_t arc4random_mtx = PTHREAD_MUTEX_INITIALIZER;
+#define _ARC4_LOCK()   pthread_mutex_lock(&arc4random_mtx)
+#define _ARC4_UNLOCK() pthread_mutex_unlock(&arc4random_mtx)
+
+/*
+ * Unfortunately, pthread_atfork() is broken on FreeBSD (at least 9 and 10) if
+ * a program does not link to -lthr. Callbacks registered with pthread_atfork()
+ * appear to fail silently. So, it is not always possible to detect a PID
+ * wraparound.
+ */
+#define _ARC4_ATFORK(f) pthread_atfork(NULL, NULL, (f))
+
+static inline void
+_getentropy_fail(void)
+{
+        raise(SIGKILL);
+}
+
+static volatile sig_atomic_t _rs_forked;
+
+static inline void
+_rs_forkhandler(void)
+{
+        _rs_forked = 1;
+}
+
+static inline void
+_rs_forkdetect(void)
+{
+        static pid_t _rs_pid = 0;
+        pid_t pid = getpid();
+
+        if (_rs_pid == 0 || _rs_pid != pid || _rs_forked) {
+                _rs_pid = pid;
+                _rs_forked = 0;
+                if (rs)
+                        memset(rs, 0, sizeof(*rs));
+        }
+}
+
+static inline int
+_rs_allocate(struct _rs **rsp, struct _rsx **rsxp)
+{
+        if ((*rsp = mmap(NULL, sizeof(**rsp), PROT_READ|PROT_WRITE,
+            MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED)
+                return -1;
+
+        if ((*rsxp = mmap(NULL, sizeof(**rsxp), PROT_READ|PROT_WRITE,
+            MAP_ANON|MAP_PRIVATE, -1, 0)) == MAP_FAILED) {
+                munmap(*rsp, sizeof(**rsp));
+                return -1;
+        }
+
+        _ARC4_ATFORK(_rs_forkhandler);
+        return 0;
+}
diff --git a/src/lib/libcrypto/crypto/getentropy_freebsd.c b/src/lib/libcrypto/crypto/getentropy_freebsd.c
new file mode 100644
index 0000000000..ec760ae43d
--- /dev/null
+++ b/src/lib/libcrypto/crypto/getentropy_freebsd.c
@@ -0,0 +1,64 @@
+/*      $OpenBSD: getentropy_freebsd.c,v 1.1 2014/11/03 06:23:30 bcook Exp $    */
+
+/*
+ * Copyright (c) 2014 Pawel Jakub Dawidek <pjd@FreeBSD.org>
+ * Copyright (c) 2014 Brent Cook <bcook@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * Emulation of getentropy(2) as documented at:
+ * http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/getentropy.2
+ */
+
+#include <sys/types.h>
+#include <sys/sysctl.h>
+
+#include <errno.h>
+#include <stddef.h>
+
+/*
+ * Derived from lib/libc/gen/arc4random.c from FreeBSD.
+ */
+static size_t
+getentropy_sysctl(u_char *buf, size_t size)
+{
+        int mib[2];
+        size_t len, done;
+
+        mib[0] = CTL_KERN;
+        mib[1] = KERN_ARND;
+        done = 0;
+
+        do {
+                len = size;
+                if (sysctl(mib, 2, buf, &len, NULL, 0) == -1)
+                        return (done);
+                done += len;
+                buf += len;
+                size -= len;
+        } while (size > 0);
+
+        return (done);
+}
+
+int
+getentropy(void *buf, size_t len)
+{
+        if (len <= 256 &&
+                        getentropy_sysctl(buf, len) == len) {
+                return 0;
+        }
+
+        errno = EIO;
+        return -1;
+}