diff options
| author | tls <tls@NetBSD.org> | 2011-11-20 01:09:14 +0000 |
|---|---|---|
| committer | tls <tls@NetBSD.org> | 2011-11-20 01:09:14 +0000 |
| commit | 091d1376dacb8eb611186630647323bf58a968fa (patch) | |
| tree | 08fa1ee58995aa38d868a49f68c659df435db31d /sys/kern/init_sysctl.c | |
| parent | ffba60ec72b36bd6231c6fac197e39c5193a1cd7 (diff) | |
An undocumented behavior of the sysctl kern.arandom node used to allow
sucking up to 8192 bytes out of the kernel arc4random() generator at a
time. Supposedly some very old application code uses this to rekey
other instances of RC4 in userspace (a truly great idea). Reduce the
limit to 256 bytes -- and note that it will probably be reduced to
sizeof(int) in the future, since this node is so documented.
Diffstat (limited to 'sys/kern/init_sysctl.c')
| -rw-r--r-- | sys/kern/init_sysctl.c | 21 |
1 files changed, 18 insertions, 3 deletions
diff --git a/sys/kern/init_sysctl.c b/sys/kern/init_sysctl.c index 94beb3ec0da..ea759a4d8fa 100644 --- a/sys/kern/init_sysctl.c +++ b/sys/kern/init_sysctl.c @@ -1,4 +1,4 @@ -/* $NetBSD: init_sysctl.c,v 1.184 2011/11/19 22:51:25 tls Exp $ */ +/* $NetBSD: init_sysctl.c,v 1.185 2011/11/20 01:09:14 tls Exp $ */ /*- * Copyright (c) 2003, 2007, 2008, 2009 The NetBSD Foundation, Inc. @@ -30,7 +30,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: init_sysctl.c,v 1.184 2011/11/19 22:51:25 tls Exp $"); +__KERNEL_RCSID(0, "$NetBSD: init_sysctl.c,v 1.185 2011/11/20 01:09:14 tls Exp $"); #include "opt_sysv.h" #include "opt_compat_netbsd.h" @@ -1419,7 +1419,22 @@ sysctl_kern_arnd(SYSCTLFN_ARGS) if (*oldlenp == 0) return 0; - if (*oldlenp > 8192) + /* + * This code used to allow sucking 8192 bytes at a time out + * of the kernel arc4random generator. Evidently there is some + * very old OpenBSD application code that may try to do this. + * + * Note that this node is documented as type "INT" -- 4 or 8 + * bytes, not 8192. + * + * We continue to support this abuse of the "len" pointer here + * but only 256 bytes at a time, as, anecdotally, the actual + * application use here was to generate RC4 keys in userspace. + * + * Support for such large requests will probably be removed + * entirely in the future. + */ + if (*oldlenp > 256) return E2BIG; v = kmem_alloc(*oldlenp, KM_SLEEP); |
