1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2018 Conrad Meyer <cem@FreeBSD.org>
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29#include <sys/param.h>
30#include <sys/random.h>
31#include <sys/sysctl.h>
32
33#include <errno.h>
34#include <signal.h>
35#include <stdbool.h>
36#include <stdlib.h>
37#include <unistd.h>
38
39#include "libc_private.h"
40
41/* First __FreeBSD_version bump after introduction of getrandom(2) (r331279) */
42#define GETRANDOM_FIRST 1200061
43
44extern int __sysctl(int *, u_int, void *, size_t *, void *, size_t);
45
46static inline void
47_getentropy_fail(void)
48{
49	raise(SIGKILL);
50}
51
52static size_t
53arnd_sysctl(u_char *buf, size_t size)
54{
55	int mib[2];
56	size_t len, done;
57
58	mib[0] = CTL_KERN;
59	mib[1] = KERN_ARND;
60	done = 0;
61
62	do {
63		len = size;
64		if (__sysctl(mib, 2, buf, &len, NULL, 0) == -1)
65			return (done);
66		done += len;
67		buf += len;
68		size -= len;
69	} while (size > 0);
70
71	return (done);
72}
73
74/*
75 * If a newer libc is accidentally installed on an older kernel, provide high
76 * quality random data anyway.  The sysctl interface is not as fast and does
77 * not block by itself, but is provided by even very old kernels.
78 */
79static int
80getentropy_fallback(void *buf, size_t buflen)
81{
82	/*
83	 * oldp (buf) == NULL has a special meaning for sysctl that results in
84	 * no EFAULT.  For compatibility with the kernel getrandom(2), detect
85	 * this case and return the appropriate error.
86	 */
87	if (buf == NULL && buflen > 0) {
88		errno = EFAULT;
89		return (-1);
90	}
91	if (arnd_sysctl(buf, buflen) != buflen) {
92		if (errno == EFAULT)
93			return (-1);
94		/*
95		 * This cannot happen.  arnd_sysctl() spins until the random
96		 * device is seeded and then repeatedly reads until the full
97		 * request is satisfied.  The only way for this to return a zero
98		 * byte or short read is if sysctl(2) on the kern.arandom MIB
99		 * fails.  In this case, excepting the user-provided-a-bogus-
100		 * buffer EFAULT, give up (like for arc4random(3)'s arc4_stir).
101		 */
102		_getentropy_fail();
103	}
104	return (0);
105}
106
107int
108getentropy(void *buf, size_t buflen)
109{
110	ssize_t rd;
111	bool have_getrandom;
112
113	if (buflen > 256) {
114		errno = EIO;
115		return (-1);
116	}
117
118	have_getrandom = (__getosreldate() >= GETRANDOM_FIRST);
119
120	while (buflen > 0) {
121		if (have_getrandom) {
122			rd = getrandom(buf, buflen, 0);
123			if (rd == -1) {
124				switch (errno) {
125				case ECAPMODE:
126					/*
127					 * Kernel >= r331280 and < r337999
128					 * will return ECAPMODE when the
129					 * caller is already in capability
130					 * mode, fallback to traditional
131					 * method in this case.
132					 */
133					have_getrandom = false;
134					continue;
135				case EINTR:
136					continue;
137				case EFAULT:
138					return (-1);
139				default:
140					_getentropy_fail();
141				}
142			}
143		} else {
144			return (getentropy_fallback(buf, buflen));
145		}
146
147		/* This cannot happen. */
148		if (rd == 0)
149			_getentropy_fail();
150
151		buf = (char *)buf + rd;
152		buflen -= rd;
153	}
154
155	return (0);
156}
157