op public repos

Blame

Date:: Wed Aug 23 17:38:49 2023 UTC
Message:: bundle libtls gmid (like all other daemons that want to do privsep crypto) has a very close relationship with libtls and need to stay in sync with it. OpenBSD' libtls was recently changed to use OpenSSL' EC_KEY_METHOD instead of the older ECDSA_METHOD, on the gmid side we have to do the same otherwise failures happens at runtime. In a similar manner, privsep crypto is silently broken in the current libretls (next version should fix it.) The proper solution would be to complete the signer APIs so that applications don't need to dive into the library' internals, but that's a mid-term goal, for the immediate bundling the 'little' libtls is the lesser evil. The configure script has gained a new (undocumented for the time being) flag `--with-libtls=bundled|system' to control which libtls to use. It defaults to `bundled' except for OpenBSD where it uses the `system' one. Note that OpenBSD versions before 7.3 (inclusive) ought to use --with-libtls=bundled too since they still do ECDSA_METHOD.
Actions:: History | Blob | Raw File
  1 f9ab77a8 2023-08-23 op /*	$OpenBSD: arc4random.c,v 1.58 2022/07/31 13:41:45 tb Exp $	*/
  2 f9ab77a8 2023-08-23 op 
  3 f9ab77a8 2023-08-23 op /*
  4 f9ab77a8 2023-08-23 op  * Copyright (c) 1996, David Mazieres <dm@uun.org>
  5 f9ab77a8 2023-08-23 op  * Copyright (c) 2008, Damien Miller <djm@openbsd.org>
  6 f9ab77a8 2023-08-23 op  * Copyright (c) 2013, Markus Friedl <markus@openbsd.org>
  7 f9ab77a8 2023-08-23 op  * Copyright (c) 2014, Theo de Raadt <deraadt@openbsd.org>
  8 f9ab77a8 2023-08-23 op  *
  9 f9ab77a8 2023-08-23 op  * Permission to use, copy, modify, and distribute this software for any
 10 f9ab77a8 2023-08-23 op  * purpose with or without fee is hereby granted, provided that the above
 11 f9ab77a8 2023-08-23 op  * copyright notice and this permission notice appear in all copies.
 12 f9ab77a8 2023-08-23 op  *
 13 f9ab77a8 2023-08-23 op  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 14 f9ab77a8 2023-08-23 op  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 15 f9ab77a8 2023-08-23 op  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 16 f9ab77a8 2023-08-23 op  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 17 f9ab77a8 2023-08-23 op  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 18 f9ab77a8 2023-08-23 op  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 19 f9ab77a8 2023-08-23 op  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 20 f9ab77a8 2023-08-23 op  */
 21 f9ab77a8 2023-08-23 op 
 22 f9ab77a8 2023-08-23 op /*
 23 f9ab77a8 2023-08-23 op  * ChaCha based random number generator for OpenBSD.
 24 f9ab77a8 2023-08-23 op  */
 25 f9ab77a8 2023-08-23 op 
 26 f9ab77a8 2023-08-23 op /* OPENBSD ORIGINAL: lib/libc/crypt/arc4random.c */
 27 f9ab77a8 2023-08-23 op 
 28 f9ab77a8 2023-08-23 op #include "../config.h"
 29 f9ab77a8 2023-08-23 op 
 30 f9ab77a8 2023-08-23 op #include <sys/types.h>
 31 f9ab77a8 2023-08-23 op 
 32 f9ab77a8 2023-08-23 op #include <fcntl.h>
 33 f9ab77a8 2023-08-23 op #include <limits.h>
 34 f9ab77a8 2023-08-23 op #include <signal.h>
 35 f9ab77a8 2023-08-23 op #ifdef HAVE_STDINT_H
 36 f9ab77a8 2023-08-23 op #include <stdint.h>
 37 f9ab77a8 2023-08-23 op #endif
 38 f9ab77a8 2023-08-23 op #include <stdlib.h>
 39 f9ab77a8 2023-08-23 op #include <string.h>
 40 f9ab77a8 2023-08-23 op #include <unistd.h>
 41 f9ab77a8 2023-08-23 op #include <sys/types.h>
 42 f9ab77a8 2023-08-23 op #include <sys/time.h>
 43 f9ab77a8 2023-08-23 op 
 44 f9ab77a8 2023-08-23 op #ifndef HAVE_ARC4RANDOM
 45 f9ab77a8 2023-08-23 op 
 46 f9ab77a8 2023-08-23 op /*
 47 f9ab77a8 2023-08-23 op  * Always use the getentropy implementation from bsd-getentropy.c, which
 48 f9ab77a8 2023-08-23 op  * will call a native getentropy if available then fall back as required.
 49 f9ab77a8 2023-08-23 op  * We use a different name so that OpenSSL cannot call the wrong getentropy.
 50 f9ab77a8 2023-08-23 op  */
 51 f9ab77a8 2023-08-23 op int _ssh_compat_getentropy(void *, size_t);
 52 f9ab77a8 2023-08-23 op #ifdef getentropy
 53 f9ab77a8 2023-08-23 op # undef getentropy
 54 f9ab77a8 2023-08-23 op #endif
 55 f9ab77a8 2023-08-23 op #define getentropy(x, y) (_ssh_compat_getentropy((x), (y)))
 56 f9ab77a8 2023-08-23 op 
 57 f9ab77a8 2023-08-23 op #include "log.h"
 58 f9ab77a8 2023-08-23 op 
 59 f9ab77a8 2023-08-23 op #define KEYSTREAM_ONLY
 60 f9ab77a8 2023-08-23 op #include "chacha_private.h"
 61 f9ab77a8 2023-08-23 op 
 62 f9ab77a8 2023-08-23 op #define minimum(a, b) ((a) < (b) ? (a) : (b))
 63 f9ab77a8 2023-08-23 op 
 64 f9ab77a8 2023-08-23 op #if defined(__GNUC__) || defined(_MSC_VER)
 65 f9ab77a8 2023-08-23 op #define inline __inline
 66 f9ab77a8 2023-08-23 op #else				/* __GNUC__ || _MSC_VER */
 67 f9ab77a8 2023-08-23 op #define inline
 68 f9ab77a8 2023-08-23 op #endif				/* !__GNUC__ && !_MSC_VER */
 69 f9ab77a8 2023-08-23 op 
 70 f9ab77a8 2023-08-23 op #define KEYSZ	32
 71 f9ab77a8 2023-08-23 op #define IVSZ	8
 72 f9ab77a8 2023-08-23 op #define BLOCKSZ	64
 73 f9ab77a8 2023-08-23 op #define RSBUFSZ	(16*BLOCKSZ)
 74 f9ab77a8 2023-08-23 op 
 75 f9ab77a8 2023-08-23 op #define REKEY_BASE	(1024*1024) /* NB. should be a power of 2 */
 76 f9ab77a8 2023-08-23 op 
 77 f9ab77a8 2023-08-23 op /* Marked MAP_INHERIT_ZERO, so zero'd out in fork children. */
 78 f9ab77a8 2023-08-23 op static struct _rs {
 79 f9ab77a8 2023-08-23 op 	size_t		rs_have;	/* valid bytes at end of rs_buf */
 80 f9ab77a8 2023-08-23 op 	size_t		rs_count;	/* bytes till reseed */
 81 f9ab77a8 2023-08-23 op } *rs;
 82 f9ab77a8 2023-08-23 op 
 83 f9ab77a8 2023-08-23 op /* Maybe be preserved in fork children, if _rs_allocate() decides. */
 84 f9ab77a8 2023-08-23 op static struct _rsx {
 85 f9ab77a8 2023-08-23 op 	chacha_ctx	rs_chacha;	/* chacha context for random keystream */
 86 f9ab77a8 2023-08-23 op 	u_char		rs_buf[RSBUFSZ];	/* keystream blocks */
 87 f9ab77a8 2023-08-23 op } *rsx;
 88 f9ab77a8 2023-08-23 op 
 89 f9ab77a8 2023-08-23 op static inline int _rs_allocate(struct _rs **, struct _rsx **);
 90 f9ab77a8 2023-08-23 op static inline void _rs_forkdetect(void);
 91 f9ab77a8 2023-08-23 op #include "arc4random.h"
 92 f9ab77a8 2023-08-23 op 
 93 f9ab77a8 2023-08-23 op static inline void _rs_rekey(u_char *dat, size_t datlen);
 94 f9ab77a8 2023-08-23 op 
 95 f9ab77a8 2023-08-23 op static inline void
 96 f9ab77a8 2023-08-23 op _rs_init(u_char *buf, size_t n)
 97 f9ab77a8 2023-08-23 op {
 98 f9ab77a8 2023-08-23 op 	if (n < KEYSZ + IVSZ)
 99 f9ab77a8 2023-08-23 op 		return;
100 f9ab77a8 2023-08-23 op 
101 f9ab77a8 2023-08-23 op 	if (rs == NULL) {
102 f9ab77a8 2023-08-23 op 		if (_rs_allocate(&rs, &rsx) == -1)
103 f9ab77a8 2023-08-23 op 			_exit(1);
104 f9ab77a8 2023-08-23 op 	}
105 f9ab77a8 2023-08-23 op 
106 f9ab77a8 2023-08-23 op 	chacha_keysetup(&rsx->rs_chacha, buf, KEYSZ * 8);
107 f9ab77a8 2023-08-23 op 	chacha_ivsetup(&rsx->rs_chacha, buf + KEYSZ);
108 f9ab77a8 2023-08-23 op }
109 f9ab77a8 2023-08-23 op 
110 f9ab77a8 2023-08-23 op static void
111 f9ab77a8 2023-08-23 op _rs_stir(void)
112 f9ab77a8 2023-08-23 op {
113 f9ab77a8 2023-08-23 op 	u_char rnd[KEYSZ + IVSZ];
114 f9ab77a8 2023-08-23 op 	uint32_t rekey_fuzz = 0;
115 f9ab77a8 2023-08-23 op 
116 f9ab77a8 2023-08-23 op 	if (getentropy(rnd, sizeof rnd) == -1)
117 f9ab77a8 2023-08-23 op 		_getentropy_fail();
118 f9ab77a8 2023-08-23 op 
119 f9ab77a8 2023-08-23 op 	if (!rs)
120 f9ab77a8 2023-08-23 op 		_rs_init(rnd, sizeof(rnd));
121 f9ab77a8 2023-08-23 op 	else
122 f9ab77a8 2023-08-23 op 		_rs_rekey(rnd, sizeof(rnd));
123 f9ab77a8 2023-08-23 op 	explicit_bzero(rnd, sizeof(rnd));	/* discard source seed */
124 f9ab77a8 2023-08-23 op 
125 f9ab77a8 2023-08-23 op 	/* invalidate rs_buf */
126 f9ab77a8 2023-08-23 op 	rs->rs_have = 0;
127 f9ab77a8 2023-08-23 op 	memset(rsx->rs_buf, 0, sizeof(rsx->rs_buf));
128 f9ab77a8 2023-08-23 op 
129 f9ab77a8 2023-08-23 op 	/* rekey interval should not be predictable */
130 f9ab77a8 2023-08-23 op 	chacha_encrypt_bytes(&rsx->rs_chacha, (uint8_t *)&rekey_fuzz,
131 f9ab77a8 2023-08-23 op 	    (uint8_t *)&rekey_fuzz, sizeof(rekey_fuzz));
132 f9ab77a8 2023-08-23 op 	rs->rs_count = REKEY_BASE + (rekey_fuzz % REKEY_BASE);
133 f9ab77a8 2023-08-23 op }
134 f9ab77a8 2023-08-23 op 
135 f9ab77a8 2023-08-23 op static inline void
136 f9ab77a8 2023-08-23 op _rs_stir_if_needed(size_t len)
137 f9ab77a8 2023-08-23 op {
138 f9ab77a8 2023-08-23 op 	_rs_forkdetect();
139 f9ab77a8 2023-08-23 op 	if (!rs || rs->rs_count <= len)
140 f9ab77a8 2023-08-23 op 		_rs_stir();
141 f9ab77a8 2023-08-23 op 	if (rs->rs_count <= len)
142 f9ab77a8 2023-08-23 op 		rs->rs_count = 0;
143 f9ab77a8 2023-08-23 op 	else
144 f9ab77a8 2023-08-23 op 		rs->rs_count -= len;
145 f9ab77a8 2023-08-23 op }
146 f9ab77a8 2023-08-23 op 
147 f9ab77a8 2023-08-23 op static inline void
148 f9ab77a8 2023-08-23 op _rs_rekey(u_char *dat, size_t datlen)
149 f9ab77a8 2023-08-23 op {
150 f9ab77a8 2023-08-23 op #ifndef KEYSTREAM_ONLY
151 f9ab77a8 2023-08-23 op 	memset(rsx->rs_buf, 0, sizeof(rsx->rs_buf));
152 f9ab77a8 2023-08-23 op #endif
153 f9ab77a8 2023-08-23 op 	/* fill rs_buf with the keystream */
154 f9ab77a8 2023-08-23 op 	chacha_encrypt_bytes(&rsx->rs_chacha, rsx->rs_buf,
155 f9ab77a8 2023-08-23 op 	    rsx->rs_buf, sizeof(rsx->rs_buf));
156 f9ab77a8 2023-08-23 op 	/* mix in optional user provided data */
157 f9ab77a8 2023-08-23 op 	if (dat) {
158 f9ab77a8 2023-08-23 op 		size_t i, m;
159 f9ab77a8 2023-08-23 op 
160 f9ab77a8 2023-08-23 op 		m = minimum(datlen, KEYSZ + IVSZ);
161 f9ab77a8 2023-08-23 op 		for (i = 0; i < m; i++)
162 f9ab77a8 2023-08-23 op 			rsx->rs_buf[i] ^= dat[i];
163 f9ab77a8 2023-08-23 op 	}
164 f9ab77a8 2023-08-23 op 	/* immediately reinit for backtracking resistance */
165 f9ab77a8 2023-08-23 op 	_rs_init(rsx->rs_buf, KEYSZ + IVSZ);
166 f9ab77a8 2023-08-23 op 	memset(rsx->rs_buf, 0, KEYSZ + IVSZ);
167 f9ab77a8 2023-08-23 op 	rs->rs_have = sizeof(rsx->rs_buf) - KEYSZ - IVSZ;
168 f9ab77a8 2023-08-23 op }
169 f9ab77a8 2023-08-23 op 
170 f9ab77a8 2023-08-23 op static inline void
171 f9ab77a8 2023-08-23 op _rs_random_buf(void *_buf, size_t n)
172 f9ab77a8 2023-08-23 op {
173 f9ab77a8 2023-08-23 op 	u_char *buf = (u_char *)_buf;
174 f9ab77a8 2023-08-23 op 	u_char *keystream;
175 f9ab77a8 2023-08-23 op 	size_t m;
176 f9ab77a8 2023-08-23 op 
177 f9ab77a8 2023-08-23 op 	_rs_stir_if_needed(n);
178 f9ab77a8 2023-08-23 op 	while (n > 0) {
179 f9ab77a8 2023-08-23 op 		if (rs->rs_have > 0) {
180 f9ab77a8 2023-08-23 op 			m = minimum(n, rs->rs_have);
181 f9ab77a8 2023-08-23 op 			keystream = rsx->rs_buf + sizeof(rsx->rs_buf)
182 f9ab77a8 2023-08-23 op 			    - rs->rs_have;
183 f9ab77a8 2023-08-23 op 			memcpy(buf, keystream, m);
184 f9ab77a8 2023-08-23 op 			memset(keystream, 0, m);
185 f9ab77a8 2023-08-23 op 			buf += m;
186 f9ab77a8 2023-08-23 op 			n -= m;
187 f9ab77a8 2023-08-23 op 			rs->rs_have -= m;
188 f9ab77a8 2023-08-23 op 		}
189 f9ab77a8 2023-08-23 op 		if (rs->rs_have == 0)
190 f9ab77a8 2023-08-23 op 			_rs_rekey(NULL, 0);
191 f9ab77a8 2023-08-23 op 	}
192 f9ab77a8 2023-08-23 op }
193 f9ab77a8 2023-08-23 op 
194 f9ab77a8 2023-08-23 op static inline void
195 f9ab77a8 2023-08-23 op _rs_random_u32(uint32_t *val)
196 f9ab77a8 2023-08-23 op {
197 f9ab77a8 2023-08-23 op 	u_char *keystream;
198 f9ab77a8 2023-08-23 op 
199 f9ab77a8 2023-08-23 op 	_rs_stir_if_needed(sizeof(*val));
200 f9ab77a8 2023-08-23 op 	if (rs->rs_have < sizeof(*val))
201 f9ab77a8 2023-08-23 op 		_rs_rekey(NULL, 0);
202 f9ab77a8 2023-08-23 op 	keystream = rsx->rs_buf + sizeof(rsx->rs_buf) - rs->rs_have;
203 f9ab77a8 2023-08-23 op 	memcpy(val, keystream, sizeof(*val));
204 f9ab77a8 2023-08-23 op 	memset(keystream, 0, sizeof(*val));
205 f9ab77a8 2023-08-23 op 	rs->rs_have -= sizeof(*val);
206 f9ab77a8 2023-08-23 op }
207 f9ab77a8 2023-08-23 op 
208 f9ab77a8 2023-08-23 op uint32_t
209 f9ab77a8 2023-08-23 op arc4random(void)
210 f9ab77a8 2023-08-23 op {
211 f9ab77a8 2023-08-23 op 	uint32_t val;
212 f9ab77a8 2023-08-23 op 
213 f9ab77a8 2023-08-23 op 	_ARC4_LOCK();
214 f9ab77a8 2023-08-23 op 	_rs_random_u32(&val);
215 f9ab77a8 2023-08-23 op 	_ARC4_UNLOCK();
216 f9ab77a8 2023-08-23 op 	return val;
217 f9ab77a8 2023-08-23 op }
218 f9ab77a8 2023-08-23 op 
219 f9ab77a8 2023-08-23 op /*
220 f9ab77a8 2023-08-23 op  * If we are providing arc4random, then we can provide a more efficient
221 f9ab77a8 2023-08-23 op  * arc4random_buf().
222 f9ab77a8 2023-08-23 op  */
223 f9ab77a8 2023-08-23 op # ifndef HAVE_ARC4RANDOM_BUF
224 f9ab77a8 2023-08-23 op void
225 f9ab77a8 2023-08-23 op arc4random_buf(void *buf, size_t n)
226 f9ab77a8 2023-08-23 op {
227 f9ab77a8 2023-08-23 op 	_ARC4_LOCK();
228 f9ab77a8 2023-08-23 op 	_rs_random_buf(buf, n);
229 f9ab77a8 2023-08-23 op 	_ARC4_UNLOCK();
230 f9ab77a8 2023-08-23 op }
231 f9ab77a8 2023-08-23 op # endif /* !HAVE_ARC4RANDOM_BUF */
232 f9ab77a8 2023-08-23 op #endif /* !HAVE_ARC4RANDOM */
233 f9ab77a8 2023-08-23 op 
234 f9ab77a8 2023-08-23 op /* arc4random_buf() that uses platform arc4random() */
235 f9ab77a8 2023-08-23 op #if !defined(HAVE_ARC4RANDOM_BUF) && defined(HAVE_ARC4RANDOM)
236 f9ab77a8 2023-08-23 op void
237 f9ab77a8 2023-08-23 op arc4random_buf(void *_buf, size_t n)
238 f9ab77a8 2023-08-23 op {
239 f9ab77a8 2023-08-23 op 	size_t i;
240 f9ab77a8 2023-08-23 op 	u_int32_t r = 0;
241 f9ab77a8 2023-08-23 op 	char *buf = (char *)_buf;
242 f9ab77a8 2023-08-23 op 
243 f9ab77a8 2023-08-23 op 	for (i = 0; i < n; i++) {
244 f9ab77a8 2023-08-23 op 		if (i % 4 == 0)
245 f9ab77a8 2023-08-23 op 			r = arc4random();
246 f9ab77a8 2023-08-23 op 		buf[i] = r & 0xff;
247 f9ab77a8 2023-08-23 op 		r >>= 8;
248 f9ab77a8 2023-08-23 op 	}
249 f9ab77a8 2023-08-23 op 	explicit_bzero(&r, sizeof(r));
250 f9ab77a8 2023-08-23 op }
251 f9ab77a8 2023-08-23 op #endif /* !defined(HAVE_ARC4RANDOM_BUF) && defined(HAVE_ARC4RANDOM) */
252 f9ab77a8 2023-08-23 op