1 /*-
2  * THE BEER-WARE LICENSE
3  *
4  * <dan@FreeBSD.ORG> wrote this file.  As long as you retain this notice you
5  * can do whatever you want with this stuff.  If we meet some day, and you
6  * think this stuff is worth it, you can buy me a beer in return.
7  *
8  * Dan Moschuk
9  */
10 #if !defined(SOLARIS2) && !defined(__osf__)
11 # include <sys/cdefs.h>
12 #endif
13 
14 #include <sys/types.h>
15 #include <sys/param.h>
16 #ifdef __FreeBSD__
17 # include <sys/kernel.h>
18 #endif
19 #if !defined(__osf__)
20 # include <sys/random.h>
21 #endif
22 #ifdef __FreeBSD__
23 # include <sys/libkern.h>
24 #endif
25 #include <sys/lock.h>
26 #ifndef __osf__
27 # include <sys/mutex.h>
28 #endif
29 #include <sys/time.h>
30 
31 #if defined(SOLARIS2) && (SOLARIS2 < 9)
32 # include <netinet/in_systm.h>
33 #endif
34 #include <sys/socket.h>
35 #include <net/if.h>
36 #ifdef __osf__
37 # include <net/route.h>
38 #endif
39 #include <netinet/in.h>
40 #include <netinet/ip.h>
41 #include "netinet/ip_compat.h"
42 #ifdef HAS_SYS_MD5_H
43 # include <sys/md5.h>
44 #else
45 # include "md5.h"
46 #endif
47 
48 #ifdef NEED_LOCAL_RAND
49 #if !defined(__GNUC__)
50 # define __inline
51 #endif
52 
53 #define	ARC4_RESEED_BYTES 65536
54 #define	ARC4_RESEED_SECONDS 300
55 #define	ARC4_KEYBYTES (256 / 8)
56 
57 static u_int8_t arc4_i, arc4_j;
58 static int arc4_numruns = 0;
59 static u_int8_t arc4_sbox[256];
60 static time_t arc4_t_reseed;
61 static ipfmutex_t arc4_mtx;
62 static MD5_CTX md5ctx;
63 
64 static u_int8_t arc4_randbyte(void);
65 static int ipf_read_random(void *dest, int length);
66 
67 static __inline void
arc4_swap(u_int8_t * a,u_int8_t * b)68 arc4_swap(u_int8_t *a, u_int8_t *b)
69 {
70 	u_int8_t c;
71 
72 	c = *a;
73 	*a = *b;
74 	*b = c;
75 }
76 
77 /*
78  * Stir our S-box.
79  */
80 static void
arc4_randomstir(void)81 arc4_randomstir (void)
82 {
83 	u_int8_t key[256];
84 	int r, n;
85 	struct timeval tv_now;
86 
87 	/*
88 	 * XXX read_random() returns unsafe numbers if the entropy
89 	 * device is not loaded -- MarkM.
90 	 */
91 	r = ipf_read_random(key, ARC4_KEYBYTES);
92 	GETKTIME(&tv_now);
93 	MUTEX_ENTER(&arc4_mtx);
94 	/* If r == 0 || -1, just use what was on the stack. */
95 	if (r > 0) {
96 		for (n = r; n < sizeof(key); n++)
97 			key[n] = key[n % r];
98 	}
99 
100 	for (n = 0; n < 256; n++) {
101 		arc4_j = (arc4_j + arc4_sbox[n] + key[n]) % 256;
102 		arc4_swap(&arc4_sbox[n], &arc4_sbox[arc4_j]);
103 	}
104 
105 	/* Reset for next reseed cycle. */
106 	arc4_t_reseed = tv_now.tv_sec + ARC4_RESEED_SECONDS;
107 	arc4_numruns = 0;
108 
109 	/*
110 	 * Throw away the first N words of output, as suggested in the
111 	 * paper "Weaknesses in the Key Scheduling Algorithm of RC4"
112 	 * by Fluher, Mantin, and Shamir.  (N = 768 in our case.)
113 	 */
114 	for (n = 0; n < 768*4; n++)
115 		arc4_randbyte();
116 	MUTEX_EXIT(&arc4_mtx);
117 }
118 
119 /*
120  * Initialize our S-box to its beginning defaults.
121  */
122 static void
arc4_init(void)123 arc4_init(void)
124 {
125 	int n;
126 
127 	MD5Init(&md5ctx);
128 
129 	MUTEX_INIT(&arc4_mtx, "arc4_mtx");
130 	arc4_i = arc4_j = 0;
131 	for (n = 0; n < 256; n++)
132 		arc4_sbox[n] = (u_int8_t) n;
133 
134 	arc4_t_reseed = 0;
135 }
136 
137 
138 /*
139  * Generate a random byte.
140  */
141 static u_int8_t
arc4_randbyte(void)142 arc4_randbyte(void)
143 {
144 	u_int8_t arc4_t;
145 
146 	arc4_i = (arc4_i + 1) % 256;
147 	arc4_j = (arc4_j + arc4_sbox[arc4_i]) % 256;
148 
149 	arc4_swap(&arc4_sbox[arc4_i], &arc4_sbox[arc4_j]);
150 
151 	arc4_t = (arc4_sbox[arc4_i] + arc4_sbox[arc4_j]) % 256;
152 	return arc4_sbox[arc4_t];
153 }
154 
155 /*
156  * MPSAFE
157  */
158 void
arc4rand(void * ptr,u_int len,int reseed)159 arc4rand(void *ptr, u_int len, int reseed)
160 {
161 	u_int8_t *p;
162 	struct timeval tv;
163 
164 	GETKTIME(&tv);
165 	if (reseed ||
166 	   (arc4_numruns > ARC4_RESEED_BYTES) ||
167 	   (tv.tv_sec > arc4_t_reseed))
168 		arc4_randomstir();
169 
170 	MUTEX_ENTER(&arc4_mtx);
171 	arc4_numruns += len;
172 	p = ptr;
173 	while (len--)
174 		*p++ = arc4_randbyte();
175 	MUTEX_EXIT(&arc4_mtx);
176 }
177 
178 uint32_t
ipf_random(void)179 ipf_random(void)
180 {
181 	uint32_t ret;
182 
183 	arc4rand(&ret, sizeof ret, 0);
184 	return ret;
185 }
186 
187 
188 static u_char pot[ARC4_RESEED_BYTES];
189 static u_char *pothead = pot, *pottail = pot;
190 static int inpot = 0;
191 
192 /*
193  * This is not very strong, and this is understood, but the aim isn't to
194  * be cryptographically strong - it is just to make up something that is
195  * pseudo random.
196  */
197 void
ipf_rand_push(void * src,int length)198 ipf_rand_push(void *src, int length)
199 {
200 	static int arc4_inited = 0;
201 	u_char *nsrc;
202 	int mylen;
203 
204 	if (arc4_inited == 0) {
205 		arc4_init();
206 		arc4_inited = 1;
207 	}
208 
209 	if (length < 64) {
210 		MD5Update(&md5ctx, src, length);
211 		return;
212 	}
213 
214 	nsrc = src;
215 	mylen = length;
216 
217 #if defined(_SYS_MD5_H) && defined(SOLARIS2)
218 # define	buf	buf_un.buf8
219 #endif
220 	MUTEX_ENTER(&arc4_mtx);
221 	while ((mylen > 64)  && (sizeof(pot) - inpot > sizeof(md5ctx.buf))) {
222 		MD5Update(&md5ctx, nsrc, 64);
223 		mylen -= 64;
224 		nsrc += 64;
225 		if (pottail + sizeof(md5ctx.buf) > pot + sizeof(pot)) {
226 			int left, numbytes;
227 
228 			numbytes = pot + sizeof(pot) - pottail;
229 			bcopy(md5ctx.buf, pottail, numbytes);
230 			left = sizeof(md5ctx.buf) - numbytes;
231 			pottail = pot;
232 			bcopy(md5ctx.buf + sizeof(md5ctx.buf) - left,
233 			      pottail, left);
234 			pottail += left;
235 		} else {
236 			bcopy(md5ctx.buf, pottail, sizeof(md5ctx.buf));
237 			pottail += sizeof(md5ctx.buf);
238 		}
239 		inpot += 64;
240 	}
241 	MUTEX_EXIT(&arc4_mtx);
242 #if defined(_SYS_MD5_H) && defined(SOLARIS2)
243 # undef buf
244 #endif
245 }
246 
247 
248 static int
ipf_read_random(void * dest,int length)249 ipf_read_random(void *dest, int length)
250 {
251 	if (length > inpot)
252 		return 0;
253 
254 	MUTEX_ENTER(&arc4_mtx);
255 	if (pothead + length > pot + sizeof(pot)) {
256 		int left, numbytes;
257 
258 		left = length;
259 		numbytes = pot + sizeof(pot) - pothead;
260 		bcopy(pothead, dest, numbytes);
261 		left -= numbytes;
262 		pothead = pot;
263 		bcopy(pothead, dest + length - left, left);
264 		pothead += left;
265 	} else {
266 		bcopy(pothead, dest, length);
267 		pothead += length;
268 	}
269 	inpot -= length;
270 	if (inpot == 0)
271 		pothead = pottail = pot;
272 	MUTEX_EXIT(&arc4_mtx);
273 
274 	return length;
275 }
276 
277 #endif /* NEED_LOCAL_RAND */
278