summaryrefslogtreecommitdiff
path: root/sys/kern/init_sysctl.c
diff options
context:
space:
mode:
authortls <tls@NetBSD.org>2011-11-20 01:09:14 +0000
committertls <tls@NetBSD.org>2011-11-20 01:09:14 +0000
commit091d1376dacb8eb611186630647323bf58a968fa (patch)
tree08fa1ee58995aa38d868a49f68c659df435db31d /sys/kern/init_sysctl.c
parentffba60ec72b36bd6231c6fac197e39c5193a1cd7 (diff)
An undocumented behavior of the sysctl kern.arandom node used to allow
sucking up to 8192 bytes out of the kernel arc4random() generator at a time. Supposedly some very old application code uses this to rekey other instances of RC4 in userspace (a truly great idea). Reduce the limit to 256 bytes -- and note that it will probably be reduced to sizeof(int) in the future, since this node is so documented.
Diffstat (limited to 'sys/kern/init_sysctl.c')
-rw-r--r--sys/kern/init_sysctl.c21
1 files changed, 18 insertions, 3 deletions
diff --git a/sys/kern/init_sysctl.c b/sys/kern/init_sysctl.c
index 94beb3ec0da..ea759a4d8fa 100644
--- a/sys/kern/init_sysctl.c
+++ b/sys/kern/init_sysctl.c
@@ -1,4 +1,4 @@
-/* $NetBSD: init_sysctl.c,v 1.184 2011/11/19 22:51:25 tls Exp $ */
+/* $NetBSD: init_sysctl.c,v 1.185 2011/11/20 01:09:14 tls Exp $ */
/*-
* Copyright (c) 2003, 2007, 2008, 2009 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: init_sysctl.c,v 1.184 2011/11/19 22:51:25 tls Exp $");
+__KERNEL_RCSID(0, "$NetBSD: init_sysctl.c,v 1.185 2011/11/20 01:09:14 tls Exp $");
#include "opt_sysv.h"
#include "opt_compat_netbsd.h"
@@ -1419,7 +1419,22 @@ sysctl_kern_arnd(SYSCTLFN_ARGS)
if (*oldlenp == 0)
return 0;
- if (*oldlenp > 8192)
+ /*
+ * This code used to allow sucking 8192 bytes at a time out
+ * of the kernel arc4random generator. Evidently there is some
+ * very old OpenBSD application code that may try to do this.
+ *
+ * Note that this node is documented as type "INT" -- 4 or 8
+ * bytes, not 8192.
+ *
+ * We continue to support this abuse of the "len" pointer here
+ * but only 256 bytes at a time, as, anecdotally, the actual
+ * application use here was to generate RC4 keys in userspace.
+ *
+ * Support for such large requests will probably be removed
+ * entirely in the future.
+ */
+ if (*oldlenp > 256)
return E2BIG;
v = kmem_alloc(*oldlenp, KM_SLEEP);