/* $NetBSD: sys_getrandom.c,v 1.2 2021/12/28 13:22:43 riastradh Exp $ */ /*- * Copyright (c) 2020 The NetBSD Foundation, Inc. * All rights reserved. * * This code is derived from software contributed to The NetBSD Foundation * by Taylor R. Campbell. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ /* * getrandom() system call */ #include <sys/cdefs.h> __KERNEL_RCSID(0, "$NetBSD: sys_getrandom.c,v 1.2 2021/12/28 13:22:43 riastradh Exp $"); #include <sys/types.h> #include <sys/param.h> #include <sys/atomic.h> #include <sys/cprng.h> #include <sys/entropy.h> #include <sys/kmem.h> #include <sys/lwp.h> #include <sys/proc.h> #include <sys/random.h> #include <sys/sched.h> #include <sys/signalvar.h> #include <sys/syscallargs.h> #include <sys/uio.h> #include <crypto/nist_hash_drbg/nist_hash_drbg.h> #define RANDOM_BUFSIZE 512 int dogetrandom(struct uio *uio, unsigned int flags) { uint8_t seed[NIST_HASH_DRBG_SEEDLEN_BYTES] = {0}; struct nist_hash_drbg drbg; uint8_t *buf; int extractflags = 0; int error; KASSERT((flags & ~(GRND_RANDOM|GRND_INSECURE|GRND_NONBLOCK)) == 0); KASSERT((flags & (GRND_RANDOM|GRND_INSECURE)) != (GRND_RANDOM|GRND_INSECURE)); /* Get a buffer for transfers. */ buf = kmem_alloc(RANDOM_BUFSIZE, KM_SLEEP); /* * Fast path: for short reads other than from /dev/random, if * seeded or if INSECURE, just draw from per-CPU cprng_strong. */ if (uio->uio_resid <= RANDOM_BUFSIZE && !ISSET(flags, GRND_RANDOM) && (entropy_ready() || ISSET(flags, GRND_INSECURE))) { /* Generate data and transfer it out. */ cprng_strong(user_cprng, buf, uio->uio_resid, 0); error = uiomove(buf, uio->uio_resid, uio); goto out; } /* * Try to get a seed from the entropy pool. Fail if we would * block. If GRND_INSECURE, always return something even if it * is partial entropy; if !GRND_INSECURE, set ENTROPY_HARDFAIL * in order to tell entropy_extract not to bother drawing * anything from a partial pool if we can't get full entropy. */ if (!ISSET(flags, GRND_NONBLOCK) && !ISSET(flags, GRND_INSECURE)) extractflags |= ENTROPY_WAIT|ENTROPY_SIG; if (!ISSET(flags, GRND_INSECURE)) extractflags |= ENTROPY_HARDFAIL; error = entropy_extract(seed, sizeof seed, extractflags); if (error && !ISSET(flags, GRND_INSECURE)) goto out; /* Instantiate the DRBG. */ if (nist_hash_drbg_instantiate(&drbg, seed, sizeof seed, NULL, 0, NULL, 0)) panic("nist_hash_drbg_instantiate"); /* Promptly zero the seed. */ explicit_memset(seed, 0, sizeof seed); /* Generate data. */ error = 0; while (uio->uio_resid) { size_t n = MIN(uio->uio_resid, RANDOM_BUFSIZE); /* * Clamp /dev/random output to the entropy capacity and * seed size. Programs can't rely on long reads. */ if (ISSET(flags, GRND_RANDOM)) { n = MIN(n, ENTROPY_CAPACITY); n = MIN(n, sizeof seed); /* * Guarantee never to return more than one * buffer in this case to minimize bookkeeping. */ CTASSERT(ENTROPY_CAPACITY <= RANDOM_BUFSIZE); CTASSERT(sizeof seed <= RANDOM_BUFSIZE); } /* * Try to generate a block of data, but if we've hit * the DRBG reseed interval, reseed. */ if (nist_hash_drbg_generate(&drbg, buf, n, NULL, 0)) { /* * Get a fresh seed without blocking -- we have * already generated some output so it is not * useful to block. This can fail only if the * request is obscenely large, so it is OK for * either /dev/random or /dev/urandom to fail: * we make no promises about gigabyte-sized * reads happening all at once. */ error = entropy_extract(seed, sizeof seed, ENTROPY_HARDFAIL); if (error) break; /* Reseed and try again. */ if (nist_hash_drbg_reseed(&drbg, seed, sizeof seed, NULL, 0)) panic("nist_hash_drbg_reseed"); /* Promptly zero the seed. */ explicit_memset(seed, 0, sizeof seed); /* If it fails now, that's a bug. */ if (nist_hash_drbg_generate(&drbg, buf, n, NULL, 0)) panic("nist_hash_drbg_generate"); } /* Transfer n bytes out. */ error = uiomove(buf, n, uio); if (error) break; /* * If this is /dev/random, stop here, return what we * have, and force the next read to reseed. Programs * can't rely on /dev/random for long reads. */ if (ISSET(flags, GRND_RANDOM)) { error = 0; break; } /* Now's a good time to yield if needed. */ preempt_point(); /* Check for interruption after at least 256 bytes. */ CTASSERT(RANDOM_BUFSIZE >= 256); if (__predict_false(curlwp->l_flag & LW_PENDSIG) && sigispending(curlwp, 0)) { error = EINTR; break; } } out: /* Zero the buffer and free it. */ explicit_memset(buf, 0, RANDOM_BUFSIZE); kmem_free(buf, RANDOM_BUFSIZE); return error; } int sys_getrandom(struct lwp *l, const struct sys_getrandom_args *uap, register_t *retval) { /* { syscallarg(void *) buf; syscallarg(size_t) buflen; syscallarg(unsigned) flags; } */ void *buf = SCARG(uap, buf); size_t buflen = SCARG(uap, buflen); int flags = SCARG(uap, flags); int error; /* Set up an iov and uio to read into the user's buffer. */ struct iovec iov = { .iov_base = buf, .iov_len = buflen }; struct uio uio = { .uio_iov = &iov, .uio_iovcnt = 1, .uio_offset = 0, .uio_resid = buflen, .uio_rw = UIO_READ, .uio_vmspace = curproc->p_vmspace, }; /* Validate the flags. */ if (flags & ~(GRND_RANDOM|GRND_INSECURE|GRND_NONBLOCK)) { /* Unknown flags. */ error = EINVAL; goto out; } if ((flags & (GRND_RANDOM|GRND_INSECURE)) == (GRND_RANDOM|GRND_INSECURE)) { /* Nonsensical combination. */ error = EINVAL; goto out; } /* Do it. */ error = dogetrandom(&uio, flags); out: /* * If we transferred anything, return the number of bytes * transferred and suppress error; otherwise return the error. */ *retval = buflen - uio.uio_resid; if (*retval) error = 0; return error; }
