1/* 2 * Copyright (C) 2004-2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC") 3 * Copyright (C) 2000-2003 Internet Software Consortium. 4 * 5 * Permission to use, copy, modify, and/or distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 10 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 11 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 12 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 13 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 14 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 15 * PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18/* $Id: entropy.c,v 1.22 2010/08/10 23:48:19 tbox Exp $ */ 19 20/*! \file 21 * \brief 22 * This is the system independent part of the entropy module. It is 23 * compiled via inclusion from the relevant OS source file, ie, 24 * \link unix/entropy.c unix/entropy.c \endlink or win32/entropy.c. 25 * 26 * \author Much of this code is modeled after the NetBSD /dev/random implementation, 27 * written by Michael Graff <explorer@netbsd.org>. 28 */ 29 30#include <errno.h> 31#include <fcntl.h> 32#include <stdio.h> 33 34#include <isc/buffer.h> 35#include <isc/entropy.h> 36#include <isc/keyboard.h> 37#include <isc/list.h> 38#include <isc/magic.h> 39#include <isc/mem.h> 40#include <isc/msgs.h> 41#include <isc/mutex.h> 42#include <isc/platform.h> 43#include <isc/region.h> 44#include <isc/sha1.h> 45#include <isc/string.h> 46#include <isc/time.h> 47#include <isc/util.h> 48 49 50#define ENTROPY_MAGIC ISC_MAGIC('E', 'n', 't', 'e') 51#define SOURCE_MAGIC ISC_MAGIC('E', 'n', 't', 's') 52 53#define VALID_ENTROPY(e) ISC_MAGIC_VALID(e, ENTROPY_MAGIC) 54#define VALID_SOURCE(s) ISC_MAGIC_VALID(s, SOURCE_MAGIC) 55 56/*** 57 *** "constants." Do not change these unless you _really_ know what 58 *** you are doing. 59 ***/ 60 61/*% 62 * Size of entropy pool in 32-bit words. This _MUST_ be a power of 2. 63 */ 64#define RND_POOLWORDS 128 65/*% Pool in bytes. */ 66#define RND_POOLBYTES (RND_POOLWORDS * 4) 67/*% Pool in bits. */ 68#define RND_POOLBITS (RND_POOLWORDS * 32) 69 70/*% 71 * Number of bytes returned per hash. This must be true: 72 * threshold * 2 <= digest_size_in_bytes 73 */ 74#define RND_ENTROPY_THRESHOLD 10 75#define THRESHOLD_BITS (RND_ENTROPY_THRESHOLD * 8) 76 77/*% 78 * Size of the input event queue in samples. 79 */ 80#define RND_EVENTQSIZE 32 81 82/*% 83 * The number of times we'll "reseed" for pseudorandom seeds. This is an 84 * extremely weak pseudorandom seed. If the caller is using lots of 85 * pseudorandom data and they cannot provide a stronger random source, 86 * there is little we can do other than hope they're smart enough to 87 * call _adddata() with something better than we can come up with. 88 */ 89#define RND_INITIALIZE 128 90 91/*% Entropy Pool */ 92typedef struct { 93 isc_uint32_t cursor; /*%< current add point in the pool */ 94 isc_uint32_t entropy; /*%< current entropy estimate in bits */ 95 isc_uint32_t pseudo; /*%< bits extracted in pseudorandom */ 96 isc_uint32_t rotate; /*%< how many bits to rotate by */ 97 isc_uint32_t pool[RND_POOLWORDS]; /*%< random pool data */ 98} isc_entropypool_t; 99 100struct isc_entropy { 101 unsigned int magic; 102 isc_mem_t *mctx; 103 isc_mutex_t lock; 104 unsigned int refcnt; 105 isc_uint32_t initialized; 106 isc_uint32_t initcount; 107 isc_entropypool_t pool; 108 unsigned int nsources; 109 isc_entropysource_t *nextsource; 110 ISC_LIST(isc_entropysource_t) sources; 111}; 112 113/*% Sample Queue */ 114typedef struct { 115 isc_uint32_t last_time; /*%< last time recorded */ 116 isc_uint32_t last_delta; /*%< last delta value */ 117 isc_uint32_t last_delta2; /*%< last delta2 value */ 118 isc_uint32_t nsamples; /*%< number of samples filled in */ 119 isc_uint32_t *samples; /*%< the samples */ 120 isc_uint32_t *extra; /*%< extra samples added in */ 121} sample_queue_t; 122 123typedef struct { 124 sample_queue_t samplequeue; 125} isc_entropysamplesource_t; 126 127typedef struct { 128 isc_boolean_t start_called; 129 isc_entropystart_t startfunc; 130 isc_entropyget_t getfunc; 131 isc_entropystop_t stopfunc; 132 void *arg; 133 sample_queue_t samplequeue; 134} isc_cbsource_t; 135 136typedef struct { 137 FILESOURCE_HANDLE_TYPE handle; 138} isc_entropyfilesource_t; 139 140struct isc_entropysource { 141 unsigned int magic; 142 unsigned int type; 143 isc_entropy_t *ent; 144 isc_uint32_t total; /*%< entropy from this source */ 145 ISC_LINK(isc_entropysource_t) link; 146 char name[32]; 147 isc_boolean_t bad; 148 isc_boolean_t warn_keyboard; 149 isc_keyboard_t kbd; 150 union { 151 isc_entropysamplesource_t sample; 152 isc_entropyfilesource_t file; 153 isc_cbsource_t callback; 154 isc_entropyusocketsource_t usocket; 155 } sources; 156}; 157 158#define ENTROPY_SOURCETYPE_SAMPLE 1 /*%< Type is a sample source */ 159#define ENTROPY_SOURCETYPE_FILE 2 /*%< Type is a file source */ 160#define ENTROPY_SOURCETYPE_CALLBACK 3 /*%< Type is a callback source */ 161#define ENTROPY_SOURCETYPE_USOCKET 4 /*%< Type is a Unix socket source */ 162 163/*@{*/ 164/*% 165 * The random pool "taps" 166 */ 167#define TAP1 99 168#define TAP2 59 169#define TAP3 31 170#define TAP4 9 171#define TAP5 7 172/*@}*/ 173 174/*@{*/ 175/*% 176 * Declarations for function provided by the system dependent sources that 177 * include this file. 178 */ 179static void 180fillpool(isc_entropy_t *, unsigned int, isc_boolean_t); 181 182static int 183wait_for_sources(isc_entropy_t *); 184 185static void 186destroyfilesource(isc_entropyfilesource_t *source); 187 188static void 189destroyusocketsource(isc_entropyusocketsource_t *source); 190 191/*@}*/ 192 193static void 194samplequeue_release(isc_entropy_t *ent, sample_queue_t *sq) { 195 REQUIRE(sq->samples != NULL); 196 REQUIRE(sq->extra != NULL); 197 198 isc_mem_put(ent->mctx, sq->samples, RND_EVENTQSIZE * 4); 199 isc_mem_put(ent->mctx, sq->extra, RND_EVENTQSIZE * 4); 200 sq->samples = NULL; 201 sq->extra = NULL; 202} 203 204static isc_result_t 205samplesource_allocate(isc_entropy_t *ent, sample_queue_t *sq) { 206 sq->samples = isc_mem_get(ent->mctx, RND_EVENTQSIZE * 4); 207 if (sq->samples == NULL) 208 return (ISC_R_NOMEMORY); 209 210 sq->extra = isc_mem_get(ent->mctx, RND_EVENTQSIZE * 4); 211 if (sq->extra == NULL) { 212 isc_mem_put(ent->mctx, sq->samples, RND_EVENTQSIZE * 4); 213 sq->samples = NULL; 214 return (ISC_R_NOMEMORY); 215 } 216 217 sq->nsamples = 0; 218 219 return (ISC_R_SUCCESS); 220} 221 222/*% 223 * Add in entropy, even when the value we're adding in could be 224 * very large. 225 */ 226static inline void 227add_entropy(isc_entropy_t *ent, isc_uint32_t entropy) { 228 /* clamp input. Yes, this must be done. */ 229 entropy = ISC_MIN(entropy, RND_POOLBITS); 230 /* Add in the entropy we already have. */ 231 entropy += ent->pool.entropy; 232 /* Clamp. */ 233 ent->pool.entropy = ISC_MIN(entropy, RND_POOLBITS); 234} 235 236/*% 237 * Decrement the amount of entropy the pool has. 238 */ 239static inline void 240subtract_entropy(isc_entropy_t *ent, isc_uint32_t entropy) { 241 entropy = ISC_MIN(entropy, ent->pool.entropy); 242 ent->pool.entropy -= entropy; 243} 244 245/*! 246 * Add in entropy, even when the value we're adding in could be 247 * very large. 248 */ 249static inline void 250add_pseudo(isc_entropy_t *ent, isc_uint32_t pseudo) { 251 /* clamp input. Yes, this must be done. */ 252 pseudo = ISC_MIN(pseudo, RND_POOLBITS * 8); 253 /* Add in the pseudo we already have. */ 254 pseudo += ent->pool.pseudo; 255 /* Clamp. */ 256 ent->pool.pseudo = ISC_MIN(pseudo, RND_POOLBITS * 8); 257} 258 259/*! 260 * Decrement the amount of pseudo the pool has. 261 */ 262static inline void 263subtract_pseudo(isc_entropy_t *ent, isc_uint32_t pseudo) { 264 pseudo = ISC_MIN(pseudo, ent->pool.pseudo); 265 ent->pool.pseudo -= pseudo; 266} 267 268/*! 269 * Add one word to the pool, rotating the input as needed. 270 */ 271static inline void 272entropypool_add_word(isc_entropypool_t *rp, isc_uint32_t val) { 273 /* 274 * Steal some values out of the pool, and xor them into the 275 * word we were given. 276 * 277 * Mix the new value into the pool using xor. This will 278 * prevent the actual values from being known to the caller 279 * since the previous values are assumed to be unknown as well. 280 */ 281 val ^= rp->pool[(rp->cursor + TAP1) & (RND_POOLWORDS - 1)]; 282 val ^= rp->pool[(rp->cursor + TAP2) & (RND_POOLWORDS - 1)]; 283 val ^= rp->pool[(rp->cursor + TAP3) & (RND_POOLWORDS - 1)]; 284 val ^= rp->pool[(rp->cursor + TAP4) & (RND_POOLWORDS - 1)]; 285 val ^= rp->pool[(rp->cursor + TAP5) & (RND_POOLWORDS - 1)]; 286 if (rp->rotate == 0) 287 rp->pool[rp->cursor++] ^= val; 288 else 289 rp->pool[rp->cursor++] ^= 290 ((val << rp->rotate) | (val >> (32 - rp->rotate))); 291 292 /* 293 * If we have looped around the pool, increment the rotate 294 * variable so the next value will get xored in rotated to 295 * a different position. 296 * Increment by a value that is relatively prime to the word size 297 * to try to spread the bits throughout the pool quickly when the 298 * pool is empty. 299 */ 300 if (rp->cursor == RND_POOLWORDS) { 301 rp->cursor = 0; 302 rp->rotate = (rp->rotate + 7) & 31; 303 } 304} 305 306/*! 307 * Add a buffer's worth of data to the pool. 308 * 309 * Requires that the lock is held on the entropy pool. 310 */ 311static void 312entropypool_adddata(isc_entropy_t *ent, void *p, unsigned int len, 313 isc_uint32_t entropy) 314{ 315 isc_uint32_t val; 316 unsigned long addr; 317 isc_uint8_t *buf; 318 319 addr = (unsigned long)p; 320 buf = p; 321 322 if ((addr & 0x03U) != 0U) { 323 val = 0; 324 switch (len) { 325 case 3: 326 val = *buf++; 327 len--; 328 case 2: 329 val = val << 8 | *buf++; 330 len--; 331 case 1: 332 val = val << 8 | *buf++; 333 len--; 334 } 335 336 entropypool_add_word(&ent->pool, val); 337 } 338 339 for (; len > 3; len -= 4) { 340 val = *((isc_uint32_t *)buf); 341 342 entropypool_add_word(&ent->pool, val); 343 buf += 4; 344 } 345 346 if (len != 0) { 347 val = 0; 348 switch (len) { 349 case 3: 350 val = *buf++; 351 case 2: 352 val = val << 8 | *buf++; 353 case 1: 354 val = val << 8 | *buf++; 355 } 356 357 entropypool_add_word(&ent->pool, val); 358 } 359 360 add_entropy(ent, entropy); 361 subtract_pseudo(ent, entropy); 362} 363 364static inline void 365reseed(isc_entropy_t *ent) { 366 isc_time_t t; 367 pid_t pid; 368 369 if (ent->initcount == 0) { 370 pid = getpid(); 371 entropypool_adddata(ent, &pid, sizeof(pid), 0); 372 pid = getppid(); 373 entropypool_adddata(ent, &pid, sizeof(pid), 0); 374 } 375 376 /*! 377 * After we've reseeded 100 times, only add new timing info every 378 * 50 requests. This will keep us from using lots and lots of 379 * CPU just to return bad pseudorandom data anyway. 380 */ 381 if (ent->initcount > 100) 382 if ((ent->initcount % 50) != 0) 383 return; 384 385 TIME_NOW(&t); 386 entropypool_adddata(ent, &t, sizeof(t), 0); 387 ent->initcount++; 388} 389 390static inline unsigned int 391estimate_entropy(sample_queue_t *sq, isc_uint32_t t) { 392 isc_int32_t delta; 393 isc_int32_t delta2; 394 isc_int32_t delta3; 395 396 /*! 397 * If the time counter has overflowed, calculate the real difference. 398 * If it has not, it is simpler. 399 */ 400 if (t < sq->last_time) 401 delta = UINT_MAX - sq->last_time + t; 402 else 403 delta = sq->last_time - t; 404 405 if (delta < 0) 406 delta = -delta; 407 408 /* 409 * Calculate the second and third order differentials 410 */ 411 delta2 = sq->last_delta - delta; 412 if (delta2 < 0) 413 delta2 = -delta2; 414 415 delta3 = sq->last_delta2 - delta2; 416 if (delta3 < 0) 417 delta3 = -delta3; 418 419 sq->last_time = t; 420 sq->last_delta = delta; 421 sq->last_delta2 = delta2; 422 423 /* 424 * If any delta is 0, we got no entropy. If all are non-zero, we 425 * might have something. 426 */ 427 if (delta == 0 || delta2 == 0 || delta3 == 0) 428 return 0; 429 430 /* 431 * We could find the smallest delta and claim we got log2(delta) 432 * bits, but for now return that we found 1 bit. 433 */ 434 return 1; 435} 436 437static unsigned int 438crunchsamples(isc_entropy_t *ent, sample_queue_t *sq) { 439 unsigned int ns; 440 unsigned int added; 441 442 if (sq->nsamples < 6) 443 return (0); 444 445 added = 0; 446 sq->last_time = sq->samples[0]; 447 sq->last_delta = 0; 448 sq->last_delta2 = 0; 449 450 /* 451 * Prime the values by adding in the first 4 samples in. This 452 * should completely initialize the delta calculations. 453 */ 454 for (ns = 0; ns < 4; ns++) 455 (void)estimate_entropy(sq, sq->samples[ns]); 456 457 for (ns = 4; ns < sq->nsamples; ns++) 458 added += estimate_entropy(sq, sq->samples[ns]); 459 460 entropypool_adddata(ent, sq->samples, sq->nsamples * 4, added); 461 entropypool_adddata(ent, sq->extra, sq->nsamples * 4, 0); 462 463 /* 464 * Move the last 4 samples into the first 4 positions, and start 465 * adding new samples from that point. 466 */ 467 for (ns = 0; ns < 4; ns++) { 468 sq->samples[ns] = sq->samples[sq->nsamples - 4 + ns]; 469 sq->extra[ns] = sq->extra[sq->nsamples - 4 + ns]; 470 } 471 472 sq->nsamples = 4; 473 474 return (added); 475} 476 477static unsigned int 478get_from_callback(isc_entropysource_t *source, unsigned int desired, 479 isc_boolean_t blocking) 480{ 481 isc_entropy_t *ent = source->ent; 482 isc_cbsource_t *cbs = &source->sources.callback; 483 unsigned int added; 484 unsigned int got; 485 isc_result_t result; 486 487 if (desired == 0) 488 return (0); 489 490 if (source->bad) 491 return (0); 492 493 if (!cbs->start_called && cbs->startfunc != NULL) { 494 result = cbs->startfunc(source, cbs->arg, blocking); 495 if (result != ISC_R_SUCCESS) 496 return (0); 497 cbs->start_called = ISC_TRUE; 498 } 499 500 added = 0; 501 result = ISC_R_SUCCESS; 502 while (desired > 0 && result == ISC_R_SUCCESS) { 503 result = cbs->getfunc(source, cbs->arg, blocking); 504 if (result == ISC_R_QUEUEFULL) { 505 got = crunchsamples(ent, &cbs->samplequeue); 506 added += got; 507 desired -= ISC_MIN(got, desired); 508 result = ISC_R_SUCCESS; 509 } else if (result != ISC_R_SUCCESS && 510 result != ISC_R_NOTBLOCKING) 511 source->bad = ISC_TRUE; 512 513 } 514 515 return (added); 516} 517 518/* 519 * Extract some number of bytes from the random pool, decreasing the 520 * estimate of randomness as each byte is extracted. 521 * 522 * Do this by stiring the pool and returning a part of hash as randomness. 523 * Note that no secrets are given away here since parts of the hash are 524 * xored together before returned. 525 * 526 * Honor the request from the caller to only return good data, any data, 527 * etc. 528 */ 529isc_result_t 530isc_entropy_getdata(isc_entropy_t *ent, void *data, unsigned int length, 531 unsigned int *returned, unsigned int flags) 532{ 533 unsigned int i; 534 isc_sha1_t hash; 535 unsigned char digest[ISC_SHA1_DIGESTLENGTH]; 536 isc_uint32_t remain, deltae, count, total; 537 isc_uint8_t *buf; 538 isc_boolean_t goodonly, partial, blocking; 539 540 REQUIRE(VALID_ENTROPY(ent)); 541 REQUIRE(data != NULL); 542 REQUIRE(length > 0); 543 544 goodonly = ISC_TF((flags & ISC_ENTROPY_GOODONLY) != 0); 545 partial = ISC_TF((flags & ISC_ENTROPY_PARTIAL) != 0); 546 blocking = ISC_TF((flags & ISC_ENTROPY_BLOCKING) != 0); 547 548 REQUIRE(!partial || returned != NULL); 549 550 LOCK(&ent->lock); 551 552 remain = length; 553 buf = data; 554 total = 0; 555 while (remain != 0) { 556 count = ISC_MIN(remain, RND_ENTROPY_THRESHOLD); 557 558 /* 559 * If we are extracting good data only, make certain we 560 * have enough data in our pool for this pass. If we don't, 561 * get some, and fail if we can't, and partial returns 562 * are not ok. 563 */ 564 if (goodonly) { 565 unsigned int fillcount; 566 567 fillcount = ISC_MAX(remain * 8, count * 8); 568 569 /* 570 * If, however, we have at least THRESHOLD_BITS 571 * of entropy in the pool, don't block here. It is 572 * better to drain the pool once in a while and 573 * then refill it than it is to constantly keep the 574 * pool full. 575 */ 576 if (ent->pool.entropy >= THRESHOLD_BITS) 577 fillpool(ent, fillcount, ISC_FALSE); 578 else 579 fillpool(ent, fillcount, blocking); 580 581 /* 582 * Verify that we got enough entropy to do one 583 * extraction. If we didn't, bail. 584 */ 585 if (ent->pool.entropy < THRESHOLD_BITS) { 586 if (!partial) 587 goto zeroize; 588 else 589 goto partial_output; 590 } 591 } else { 592 /* 593 * If we've extracted half our pool size in bits 594 * since the last refresh, try to refresh here. 595 */ 596 if (ent->initialized < THRESHOLD_BITS) 597 fillpool(ent, THRESHOLD_BITS, blocking); 598 else 599 fillpool(ent, 0, ISC_FALSE); 600 601 /* 602 * If we've not initialized with enough good random 603 * data, seed with our crappy code. 604 */ 605 if (ent->initialized < THRESHOLD_BITS) 606 reseed(ent); 607 } 608 609 isc_sha1_init(&hash); 610 isc_sha1_update(&hash, (void *)(ent->pool.pool), 611 RND_POOLBYTES); 612 isc_sha1_final(&hash, digest); 613 614 /* 615 * Stir the extracted data (all of it) back into the pool. 616 */ 617 entropypool_adddata(ent, digest, ISC_SHA1_DIGESTLENGTH, 0); 618 619 for (i = 0; i < count; i++) 620 buf[i] = digest[i] ^ digest[i + RND_ENTROPY_THRESHOLD]; 621 622 buf += count; 623 remain -= count; 624 625 deltae = count * 8; 626 deltae = ISC_MIN(deltae, ent->pool.entropy); 627 total += deltae; 628 subtract_entropy(ent, deltae); 629 add_pseudo(ent, count * 8); 630 } 631 632 partial_output: 633 memset(digest, 0, sizeof(digest)); 634 635 if (returned != NULL) 636 *returned = (length - remain); 637 638 UNLOCK(&ent->lock); 639 640 return (ISC_R_SUCCESS); 641 642 zeroize: 643 /* put the entropy we almost extracted back */ 644 add_entropy(ent, total); 645 memset(data, 0, length); 646 memset(digest, 0, sizeof(digest)); 647 if (returned != NULL) 648 *returned = 0; 649 650 UNLOCK(&ent->lock); 651 652 return (ISC_R_NOENTROPY); 653} 654 655static void 656isc_entropypool_init(isc_entropypool_t *pool) { 657 pool->cursor = RND_POOLWORDS - 1; 658 pool->entropy = 0; 659 pool->pseudo = 0; 660 pool->rotate = 0; 661 memset(pool->pool, 0, RND_POOLBYTES); 662} 663 664static void 665isc_entropypool_invalidate(isc_entropypool_t *pool) { 666 pool->cursor = 0; 667 pool->entropy = 0; 668 pool->pseudo = 0; 669 pool->rotate = 0; 670 memset(pool->pool, 0, RND_POOLBYTES); 671} 672 673isc_result_t 674isc_entropy_create(isc_mem_t *mctx, isc_entropy_t **entp) { 675 isc_result_t result; 676 isc_entropy_t *ent; 677 678 REQUIRE(mctx != NULL); 679 REQUIRE(entp != NULL && *entp == NULL); 680 681 ent = isc_mem_get(mctx, sizeof(isc_entropy_t)); 682 if (ent == NULL) 683 return (ISC_R_NOMEMORY); 684 685 /* 686 * We need a lock. 687 */ 688 result = isc_mutex_init(&ent->lock); 689 if (result != ISC_R_SUCCESS) 690 goto errout; 691 692 /* 693 * From here down, no failures will/can occur. 694 */ 695 ISC_LIST_INIT(ent->sources); 696 ent->nextsource = NULL; 697 ent->nsources = 0; 698 ent->mctx = NULL; 699 isc_mem_attach(mctx, &ent->mctx); 700 ent->refcnt = 1; 701 ent->initialized = 0; 702 ent->initcount = 0; 703 ent->magic = ENTROPY_MAGIC; 704 705 isc_entropypool_init(&ent->pool); 706 707 *entp = ent; 708 return (ISC_R_SUCCESS); 709 710 errout: 711 isc_mem_put(mctx, ent, sizeof(isc_entropy_t)); 712 713 return (result); 714} 715 716/*! 717 * Requires "ent" be locked. 718 */ 719static void 720destroysource(isc_entropysource_t **sourcep) { 721 isc_entropysource_t *source; 722 isc_entropy_t *ent; 723 isc_cbsource_t *cbs; 724 725 source = *sourcep; 726 *sourcep = NULL; 727 ent = source->ent; 728 729 ISC_LIST_UNLINK(ent->sources, source, link); 730 ent->nextsource = NULL; 731 REQUIRE(ent->nsources > 0); 732 ent->nsources--; 733 734 switch (source->type) { 735 case ENTROPY_SOURCETYPE_FILE: 736 if (! source->bad) 737 destroyfilesource(&source->sources.file); 738 break; 739 case ENTROPY_SOURCETYPE_USOCKET: 740 if (! source->bad) 741 destroyusocketsource(&source->sources.usocket); 742 break; 743 case ENTROPY_SOURCETYPE_SAMPLE: 744 samplequeue_release(ent, &source->sources.sample.samplequeue); 745 break; 746 case ENTROPY_SOURCETYPE_CALLBACK: 747 cbs = &source->sources.callback; 748 if (cbs->start_called && cbs->stopfunc != NULL) { 749 cbs->stopfunc(source, cbs->arg); 750 cbs->start_called = ISC_FALSE; 751 } 752 samplequeue_release(ent, &cbs->samplequeue); 753 break; 754 } 755 756 memset(source, 0, sizeof(isc_entropysource_t)); 757 758 isc_mem_put(ent->mctx, source, sizeof(isc_entropysource_t)); 759} 760 761static inline isc_boolean_t 762destroy_check(isc_entropy_t *ent) { 763 isc_entropysource_t *source; 764 765 if (ent->refcnt > 0) 766 return (ISC_FALSE); 767 768 source = ISC_LIST_HEAD(ent->sources); 769 while (source != NULL) { 770 switch (source->type) { 771 case ENTROPY_SOURCETYPE_FILE: 772 case ENTROPY_SOURCETYPE_USOCKET: 773 break; 774 default: 775 return (ISC_FALSE); 776 } 777 source = ISC_LIST_NEXT(source, link); 778 } 779 780 return (ISC_TRUE); 781} 782 783static void 784destroy(isc_entropy_t **entp) { 785 isc_entropy_t *ent; 786 isc_entropysource_t *source; 787 isc_mem_t *mctx; 788 789 REQUIRE(entp != NULL && *entp != NULL); 790 ent = *entp; 791 *entp = NULL; 792 793 LOCK(&ent->lock); 794 795 REQUIRE(ent->refcnt == 0); 796 797 /* 798 * Here, detach non-sample sources. 799 */ 800 source = ISC_LIST_HEAD(ent->sources); 801 while (source != NULL) { 802 switch(source->type) { 803 case ENTROPY_SOURCETYPE_FILE: 804 case ENTROPY_SOURCETYPE_USOCKET: 805 destroysource(&source); 806 break; 807 } 808 source = ISC_LIST_HEAD(ent->sources); 809 } 810 811 /* 812 * If there are other types of sources, we've found a bug. 813 */ 814 REQUIRE(ISC_LIST_EMPTY(ent->sources)); 815 816 mctx = ent->mctx; 817 818 isc_entropypool_invalidate(&ent->pool); 819 820 UNLOCK(&ent->lock); 821 822 DESTROYLOCK(&ent->lock); 823 824 memset(ent, 0, sizeof(isc_entropy_t)); 825 isc_mem_put(mctx, ent, sizeof(isc_entropy_t)); 826 isc_mem_detach(&mctx); 827} 828 829void 830isc_entropy_destroysource(isc_entropysource_t **sourcep) { 831 isc_entropysource_t *source; 832 isc_entropy_t *ent; 833 isc_boolean_t killit; 834 835 REQUIRE(sourcep != NULL); 836 REQUIRE(VALID_SOURCE(*sourcep)); 837 838 source = *sourcep; 839 *sourcep = NULL; 840 841 ent = source->ent; 842 REQUIRE(VALID_ENTROPY(ent)); 843 844 LOCK(&ent->lock); 845 846 destroysource(&source); 847 848 killit = destroy_check(ent); 849 850 UNLOCK(&ent->lock); 851 852 if (killit) 853 destroy(&ent); 854} 855 856isc_result_t 857isc_entropy_createcallbacksource(isc_entropy_t *ent, 858 isc_entropystart_t start, 859 isc_entropyget_t get, 860 isc_entropystop_t stop, 861 void *arg, 862 isc_entropysource_t **sourcep) 863{ 864 isc_result_t result; 865 isc_entropysource_t *source; 866 isc_cbsource_t *cbs; 867 868 REQUIRE(VALID_ENTROPY(ent)); 869 REQUIRE(get != NULL); 870 REQUIRE(sourcep != NULL && *sourcep == NULL); 871 872 LOCK(&ent->lock); 873 874 source = isc_mem_get(ent->mctx, sizeof(isc_entropysource_t)); 875 if (source == NULL) { 876 result = ISC_R_NOMEMORY; 877 goto errout; 878 } 879 source->bad = ISC_FALSE; 880 881 cbs = &source->sources.callback; 882 883 result = samplesource_allocate(ent, &cbs->samplequeue); 884 if (result != ISC_R_SUCCESS) 885 goto errout; 886 887 cbs->start_called = ISC_FALSE; 888 cbs->startfunc = start; 889 cbs->getfunc = get; 890 cbs->stopfunc = stop; 891 cbs->arg = arg; 892 893 /* 894 * From here down, no failures can occur. 895 */ 896 source->magic = SOURCE_MAGIC; 897 source->type = ENTROPY_SOURCETYPE_CALLBACK; 898 source->ent = ent; 899 source->total = 0; 900 memset(source->name, 0, sizeof(source->name)); 901 ISC_LINK_INIT(source, link); 902 903 /* 904 * Hook it into the entropy system. 905 */ 906 ISC_LIST_APPEND(ent->sources, source, link); 907 ent->nsources++; 908 909 *sourcep = source; 910 911 UNLOCK(&ent->lock); 912 return (ISC_R_SUCCESS); 913 914 errout: 915 if (source != NULL) 916 isc_mem_put(ent->mctx, source, sizeof(isc_entropysource_t)); 917 918 UNLOCK(&ent->lock); 919 920 return (result); 921} 922 923void 924isc_entropy_stopcallbacksources(isc_entropy_t *ent) { 925 isc_entropysource_t *source; 926 isc_cbsource_t *cbs; 927 928 REQUIRE(VALID_ENTROPY(ent)); 929 930 LOCK(&ent->lock); 931 932 source = ISC_LIST_HEAD(ent->sources); 933 while (source != NULL) { 934 if (source->type == ENTROPY_SOURCETYPE_CALLBACK) { 935 cbs = &source->sources.callback; 936 if (cbs->start_called && cbs->stopfunc != NULL) { 937 cbs->stopfunc(source, cbs->arg); 938 cbs->start_called = ISC_FALSE; 939 } 940 } 941 942 source = ISC_LIST_NEXT(source, link); 943 } 944 945 UNLOCK(&ent->lock); 946} 947 948isc_result_t 949isc_entropy_createsamplesource(isc_entropy_t *ent, 950 isc_entropysource_t **sourcep) 951{ 952 isc_result_t result; 953 isc_entropysource_t *source; 954 sample_queue_t *sq; 955 956 REQUIRE(VALID_ENTROPY(ent)); 957 REQUIRE(sourcep != NULL && *sourcep == NULL); 958 959 LOCK(&ent->lock); 960 961 source = isc_mem_get(ent->mctx, sizeof(isc_entropysource_t)); 962 if (source == NULL) { 963 result = ISC_R_NOMEMORY; 964 goto errout; 965 } 966 967 sq = &source->sources.sample.samplequeue; 968 result = samplesource_allocate(ent, sq); 969 if (result != ISC_R_SUCCESS) 970 goto errout; 971 972 /* 973 * From here down, no failures can occur. 974 */ 975 source->magic = SOURCE_MAGIC; 976 source->type = ENTROPY_SOURCETYPE_SAMPLE; 977 source->ent = ent; 978 source->total = 0; 979 memset(source->name, 0, sizeof(source->name)); 980 ISC_LINK_INIT(source, link); 981 982 /* 983 * Hook it into the entropy system. 984 */ 985 ISC_LIST_APPEND(ent->sources, source, link); 986 ent->nsources++; 987 988 *sourcep = source; 989 990 UNLOCK(&ent->lock); 991 return (ISC_R_SUCCESS); 992 993 errout: 994 if (source != NULL) 995 isc_mem_put(ent->mctx, source, sizeof(isc_entropysource_t)); 996 997 UNLOCK(&ent->lock); 998 999 return (result); 1000} 1001 1002/*! 1003 * Add a sample, and return ISC_R_SUCCESS if the queue has become full, 1004 * ISC_R_NOENTROPY if it has space remaining, and ISC_R_NOMORE if the 1005 * queue was full when this function was called. 1006 */ 1007static isc_result_t 1008addsample(sample_queue_t *sq, isc_uint32_t sample, isc_uint32_t extra) { 1009 if (sq->nsamples >= RND_EVENTQSIZE) 1010 return (ISC_R_NOMORE); 1011 1012 sq->samples[sq->nsamples] = sample; 1013 sq->extra[sq->nsamples] = extra; 1014 sq->nsamples++; 1015 1016 if (sq->nsamples >= RND_EVENTQSIZE) 1017 return (ISC_R_QUEUEFULL); 1018 1019 return (ISC_R_SUCCESS); 1020} 1021 1022isc_result_t 1023isc_entropy_addsample(isc_entropysource_t *source, isc_uint32_t sample, 1024 isc_uint32_t extra) 1025{ 1026 isc_entropy_t *ent; 1027 sample_queue_t *sq; 1028 unsigned int entropy; 1029 isc_result_t result; 1030 1031 REQUIRE(VALID_SOURCE(source)); 1032 1033 ent = source->ent; 1034 1035 LOCK(&ent->lock); 1036 1037 sq = &source->sources.sample.samplequeue; 1038 result = addsample(sq, sample, extra); 1039 if (result == ISC_R_QUEUEFULL) { 1040 entropy = crunchsamples(ent, sq); 1041 add_entropy(ent, entropy); 1042 } 1043 1044 UNLOCK(&ent->lock); 1045 1046 return (result); 1047} 1048 1049isc_result_t 1050isc_entropy_addcallbacksample(isc_entropysource_t *source, isc_uint32_t sample, 1051 isc_uint32_t extra) 1052{ 1053 sample_queue_t *sq; 1054 isc_result_t result; 1055 1056 REQUIRE(VALID_SOURCE(source)); 1057 REQUIRE(source->type == ENTROPY_SOURCETYPE_CALLBACK); 1058 1059 sq = &source->sources.callback.samplequeue; 1060 result = addsample(sq, sample, extra); 1061 1062 return (result); 1063} 1064 1065void 1066isc_entropy_putdata(isc_entropy_t *ent, void *data, unsigned int length, 1067 isc_uint32_t entropy) 1068{ 1069 REQUIRE(VALID_ENTROPY(ent)); 1070 1071 LOCK(&ent->lock); 1072 1073 entropypool_adddata(ent, data, length, entropy); 1074 1075 if (ent->initialized < THRESHOLD_BITS) 1076 ent->initialized = THRESHOLD_BITS; 1077 1078 UNLOCK(&ent->lock); 1079} 1080 1081static void 1082dumpstats(isc_entropy_t *ent, FILE *out) { 1083 fprintf(out, 1084 isc_msgcat_get(isc_msgcat, ISC_MSGSET_ENTROPY, 1085 ISC_MSG_ENTROPYSTATS, 1086 "Entropy pool %p: refcnt %u cursor %u," 1087 " rotate %u entropy %u pseudo %u nsources %u" 1088 " nextsource %p initialized %u initcount %u\n"), 1089 ent, ent->refcnt, 1090 ent->pool.cursor, ent->pool.rotate, 1091 ent->pool.entropy, ent->pool.pseudo, 1092 ent->nsources, ent->nextsource, ent->initialized, 1093 ent->initcount); 1094} 1095 1096/* 1097 * This function ignores locking. Use at your own risk. 1098 */ 1099void 1100isc_entropy_stats(isc_entropy_t *ent, FILE *out) { 1101 REQUIRE(VALID_ENTROPY(ent)); 1102 1103 LOCK(&ent->lock); 1104 dumpstats(ent, out); 1105 UNLOCK(&ent->lock); 1106} 1107 1108unsigned int 1109isc_entropy_status(isc_entropy_t *ent) { 1110 unsigned int estimate; 1111 1112 LOCK(&ent->lock); 1113 estimate = ent->pool.entropy; 1114 UNLOCK(&ent->lock); 1115 1116 return estimate; 1117} 1118 1119void 1120isc_entropy_attach(isc_entropy_t *ent, isc_entropy_t **entp) { 1121 REQUIRE(VALID_ENTROPY(ent)); 1122 REQUIRE(entp != NULL && *entp == NULL); 1123 1124 LOCK(&ent->lock); 1125 1126 ent->refcnt++; 1127 *entp = ent; 1128 1129 UNLOCK(&ent->lock); 1130} 1131 1132void 1133isc_entropy_detach(isc_entropy_t **entp) { 1134 isc_entropy_t *ent; 1135 isc_boolean_t killit; 1136 1137 REQUIRE(entp != NULL && VALID_ENTROPY(*entp)); 1138 ent = *entp; 1139 *entp = NULL; 1140 1141 LOCK(&ent->lock); 1142 1143 REQUIRE(ent->refcnt > 0); 1144 ent->refcnt--; 1145 1146 killit = destroy_check(ent); 1147 1148 UNLOCK(&ent->lock); 1149 1150 if (killit) 1151 destroy(&ent); 1152} 1153 1154static isc_result_t 1155kbdstart(isc_entropysource_t *source, void *arg, isc_boolean_t blocking) { 1156 /* 1157 * The intent of "first" is to provide a warning message only once 1158 * during the run of a program that might try to gather keyboard 1159 * entropy multiple times. 1160 */ 1161 static isc_boolean_t first = ISC_TRUE; 1162 1163 UNUSED(arg); 1164 1165 if (! blocking) 1166 return (ISC_R_NOENTROPY); 1167 1168 if (first) { 1169 if (source->warn_keyboard) 1170 fprintf(stderr, "You must use the keyboard to create " 1171 "entropy, since your system is lacking\n" 1172 "/dev/random (or equivalent)\n\n"); 1173 first = ISC_FALSE; 1174 } 1175 fprintf(stderr, "start typing:\n"); 1176 1177 return (isc_keyboard_open(&source->kbd)); 1178} 1179 1180static void 1181kbdstop(isc_entropysource_t *source, void *arg) { 1182 1183 UNUSED(arg); 1184 1185 if (! isc_keyboard_canceled(&source->kbd)) 1186 fprintf(stderr, "stop typing.\r\n"); 1187 1188 (void)isc_keyboard_close(&source->kbd, 3); 1189} 1190 1191static isc_result_t 1192kbdget(isc_entropysource_t *source, void *arg, isc_boolean_t blocking) { 1193 isc_result_t result; 1194 isc_time_t t; 1195 isc_uint32_t sample; 1196 isc_uint32_t extra; 1197 unsigned char c; 1198 1199 UNUSED(arg); 1200 1201 if (!blocking) 1202 return (ISC_R_NOTBLOCKING); 1203 1204 result = isc_keyboard_getchar(&source->kbd, &c); 1205 if (result != ISC_R_SUCCESS) 1206 return (result); 1207 1208 TIME_NOW(&t); 1209 1210 sample = isc_time_nanoseconds(&t); 1211 extra = c; 1212 1213 result = isc_entropy_addcallbacksample(source, sample, extra); 1214 if (result != ISC_R_SUCCESS) { 1215 fprintf(stderr, "\r\n"); 1216 return (result); 1217 } 1218 1219 fprintf(stderr, "."); 1220 fflush(stderr); 1221 1222 return (result); 1223} 1224 1225isc_result_t 1226isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source, 1227 const char *randomfile, int use_keyboard) 1228{ 1229 isc_result_t result; 1230 isc_result_t final_result = ISC_R_NOENTROPY; 1231 isc_boolean_t userfile = ISC_TRUE; 1232 1233 REQUIRE(VALID_ENTROPY(ectx)); 1234 REQUIRE(source != NULL && *source == NULL); 1235 REQUIRE(use_keyboard == ISC_ENTROPY_KEYBOARDYES || 1236 use_keyboard == ISC_ENTROPY_KEYBOARDNO || 1237 use_keyboard == ISC_ENTROPY_KEYBOARDMAYBE); 1238 1239#ifdef PATH_RANDOMDEV 1240 if (randomfile == NULL) { 1241 randomfile = PATH_RANDOMDEV; 1242 userfile = ISC_FALSE; 1243 } 1244#endif 1245 1246 if (randomfile != NULL && use_keyboard != ISC_ENTROPY_KEYBOARDYES) { 1247 result = isc_entropy_createfilesource(ectx, randomfile); 1248 if (result == ISC_R_SUCCESS && 1249 use_keyboard == ISC_ENTROPY_KEYBOARDMAYBE) 1250 use_keyboard = ISC_ENTROPY_KEYBOARDNO; 1251 if (result != ISC_R_SUCCESS && userfile) 1252 return (result); 1253 1254 final_result = result; 1255 } 1256 1257 if (use_keyboard != ISC_ENTROPY_KEYBOARDNO) { 1258 result = isc_entropy_createcallbacksource(ectx, kbdstart, 1259 kbdget, kbdstop, 1260 NULL, source); 1261 if (result == ISC_R_SUCCESS) 1262 (*source)->warn_keyboard = 1263 ISC_TF(use_keyboard == 1264 ISC_ENTROPY_KEYBOARDMAYBE); 1265 1266 if (final_result != ISC_R_SUCCESS) 1267 final_result = result; 1268 } 1269 1270 /* 1271 * final_result is ISC_R_SUCCESS if at least one source of entropy 1272 * could be started, otherwise it is the error from the most recently 1273 * failed operation (or ISC_R_NOENTROPY if PATH_RANDOMDEV is not 1274 * defined and use_keyboard is ISC_ENTROPY_KEYBOARDNO). 1275 */ 1276 return (final_result); 1277} 1278