wrapper: add a helper to generate numbers from a CSPRNG

There are many situations in which having access to a cryptographically
secure pseudorandom number generator (CSPRNG) is helpful.  In the
future, we'll encounter one of these when dealing with temporary files.
To make this possible, let's add a function which reads from a system
CSPRNG and returns some bytes.

We know that all systems will have such an interface.  A CSPRNG is
required for a secure TLS or SSH implementation and a Git implementation
which provided neither would be of little practical use.  In addition,
POSIX is set to standardize getentropy(2) in the next version, so in the
(potentially distant) future we can rely on that.

For systems which lack one of the other interfaces, we provide the
ability to use OpenSSL's CSPRNG.  OpenSSL is highly portable and
functions on practically every known OS, and we know it will have access
to some source of cryptographically secure randomness.  We also provide
support for the arc4random in libbsd for folks who would prefer to use
that.

Because this is a security sensitive interface, we take some
precautions.  We either succeed by filling the buffer completely as we
requested, or we fail.  We don't return partial data because the caller
will almost never find that to be a useful behavior.

Specify a makefile knob which users can use to specify one or more
suitable CSPRNGs, and turn the multiple string options into a set of
defines, since we cannot match on strings in the preprocessor.  We allow
multiple options to make the job of handling this in autoconf easier.

The order of options is important here.  On systems with arc4random,
which is most of the BSDs, we use that, since, except on MirBSD and
macOS, it uses ChaCha20, which is extremely fast, and sits entirely in
userspace, avoiding a system call.  We then prefer getrandom over
getentropy, because the former has been available longer on Linux, and
then OpenSSL. Finally, if none of those are available, we use
/dev/urandom, because most Unix-like operating systems provide that API.
We prefer options that don't involve device files when possible because
those work in some restricted environments where device files may not be
available.

Set the configuration variables appropriately for Linux and the BSDs,
including macOS, as well as Windows and NonStop.  We specifically only
consider versions which receive publicly available security support
here.  For the same reason, we don't specify getrandom(2) on Linux,
because CentOS 7 doesn't support it in glibc (although its kernel does)
and we don't want to resort to making syscalls.

Finally, add a test helper to allow this to be tested by hand and in
tests.  We don't add any tests, since invoking the CSPRNG is not likely
to produce interesting, reproducible results.

Signed-off-by: brian m. carlson <sandals@crustytoothpaste.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/Makefile b/Makefile
index 75ed168adbc7033d6ff18ebbec3faf2476b21b71..198b759e760f649737764758b8b702e96f5c839d 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -234,6 +234,14 @@ all::
 # Define NO_TRUSTABLE_FILEMODE if your filesystem may claim to support
 # the executable mode bit, but doesn't really do so.
 #
+# Define CSPRNG_METHOD to "arc4random" if your system has arc4random and
+# arc4random_buf, "libbsd" if your system has those functions from libbsd,
+# "getrandom" if your system has getrandom, "getentropy" if your system has
+# getentropy, "rtlgenrandom" for RtlGenRandom (Windows only), or "openssl" if
+# you'd want to use the OpenSSL CSPRNG.  You may set multiple options with
+# spaces, in which case a suitable option will be chosen.  If unset or set to
+# anything else, defaults to using "/dev/urandom".
+#
 # Define NEEDS_MODE_TRANSLATION if your OS strays from the typical file type
 # bits in mode values (e.g. z/OS defines I_SFMT to 0xFF000000 as opposed to the
 # usual 0xF000).
@@ -693,6 +701,7 @@ TEST_BUILTINS_OBJS += test-bloom.o
 TEST_BUILTINS_OBJS += test-chmtime.o
 TEST_BUILTINS_OBJS += test-config.o
 TEST_BUILTINS_OBJS += test-crontab.o
+TEST_BUILTINS_OBJS += test-csprng.o
 TEST_BUILTINS_OBJS += test-ctype.o
 TEST_BUILTINS_OBJS += test-date.o
 TEST_BUILTINS_OBJS += test-delta.o
@@ -1908,6 +1917,31 @@ ifdef HAVE_GETDELIM
        BASIC_CFLAGS += -DHAVE_GETDELIM
 endif
 
+ifneq ($(findstring arc4random,$(CSPRNG_METHOD)),)
+       BASIC_CFLAGS += -DHAVE_ARC4RANDOM
+endif
+
+ifneq ($(findstring libbsd,$(CSPRNG_METHOD)),)
+       BASIC_CFLAGS += -DHAVE_ARC4RANDOM_LIBBSD
+       EXTLIBS += -lbsd
+endif
+
+ifneq ($(findstring getrandom,$(CSPRNG_METHOD)),)
+       BASIC_CFLAGS += -DHAVE_GETRANDOM
+endif
+
+ifneq ($(findstring getentropy,$(CSPRNG_METHOD)),)
+       BASIC_CFLAGS += -DHAVE_GETENTROPY
+endif
+
+ifneq ($(findstring rtlgenrandom,$(CSPRNG_METHOD)),)
+       BASIC_CFLAGS += -DHAVE_RTLGENRANDOM
+endif
+
+ifneq ($(findstring openssl,$(CSPRNG_METHOD)),)
+       BASIC_CFLAGS += -DHAVE_OPENSSL_CSPRNG
+endif
+
 ifneq ($(PROCFS_EXECUTABLE_PATH),)
        procfs_executable_path_SQ = $(subst ','\'',$(PROCFS_EXECUTABLE_PATH))
        BASIC_CFLAGS += '-DPROCFS_EXECUTABLE_PATH="$(procfs_executable_path_SQ)"'

diff --git a/compat/winansi.c b/compat/winansi.c
index c27b20a79d91cf7877d795c96e64cbadafdad7fd..0e5a9cc82e5f310742ae13c7c022bb446915fcc3 100644 (file)
--- a/compat/winansi.c
+++ b/compat/winansi.c
@@ -3,6 +3,12 @@
  */
 
 #undef NOGDI
+
+/*
+ * Including the appropriate header file for RtlGenRandom causes MSVC to see a
+ * redefinition of types in an incompatible way when including headers below.
+ */
+#undef HAVE_RTLGENRANDOM
 #include "../git-compat-util.h"
 #include <wingdi.h>
 #include <winreg.h>

diff --git a/config.mak.uname b/config.mak.uname
index a3a779327f8d5f4a523bb7b9a0b9d8905151a996..ff0710a612eb4807233c0bcdedd08407a0a9768b 100644 (file)
--- a/config.mak.uname
+++ b/config.mak.uname
@@ -141,6 +141,7 @@ ifeq ($(uname_S),Darwin)
        HAVE_BSD_SYSCTL = YesPlease
        FREAD_READS_DIRECTORIES = UnfortunatelyYes
        HAVE_NS_GET_EXECUTABLE_PATH = YesPlease
+       CSPRNG_METHOD = arc4random
 
        # Workaround for `gettext` being keg-only and not even being linked via
        # `brew link --force gettext`, should be obsolete as of
@@ -256,6 +257,7 @@ ifeq ($(uname_S),FreeBSD)
        HAVE_PATHS_H = YesPlease
        HAVE_BSD_SYSCTL = YesPlease
        HAVE_BSD_KERN_PROC_SYSCTL = YesPlease
+       CSPRNG_METHOD = arc4random
        PAGER_ENV = LESS=FRX LV=-c MORE=FRX
        FREAD_READS_DIRECTORIES = UnfortunatelyYes
        FILENO_IS_A_MACRO = UnfortunatelyYes
@@ -274,6 +276,7 @@ ifeq ($(uname_S),OpenBSD)
        HAVE_PATHS_H = YesPlease
        HAVE_BSD_SYSCTL = YesPlease
        HAVE_BSD_KERN_PROC_SYSCTL = YesPlease
+       CSPRNG_METHOD = arc4random
        PROCFS_EXECUTABLE_PATH = /proc/curproc/file
        FREAD_READS_DIRECTORIES = UnfortunatelyYes
        FILENO_IS_A_MACRO = UnfortunatelyYes
@@ -285,6 +288,7 @@ ifeq ($(uname_S),MirBSD)
        NEEDS_LIBICONV = YesPlease
        HAVE_PATHS_H = YesPlease
        HAVE_BSD_SYSCTL = YesPlease
+       CSPRNG_METHOD = arc4random
 endif
 ifeq ($(uname_S),NetBSD)
        ifeq ($(shell expr "$(uname_R)" : '[01]\.'),2)
@@ -296,6 +300,7 @@ ifeq ($(uname_S),NetBSD)
        HAVE_PATHS_H = YesPlease
        HAVE_BSD_SYSCTL = YesPlease
        HAVE_BSD_KERN_PROC_SYSCTL = YesPlease
+       CSPRNG_METHOD = arc4random
        PROCFS_EXECUTABLE_PATH = /proc/curproc/exe
 endif
 ifeq ($(uname_S),AIX)
@@ -425,6 +430,7 @@ ifeq ($(uname_S),Windows)
        NO_STRTOUMAX = YesPlease
        NO_MKDTEMP = YesPlease
        NO_INTTYPES_H = YesPlease
+       CSPRNG_METHOD = rtlgenrandom
        # VS2015 with UCRT claims that snprintf and friends are C99 compliant,
        # so we don't need this:
        #
@@ -593,6 +599,7 @@ ifeq ($(uname_S),NONSTOP_KERNEL)
        NO_MMAP = YesPlease
        NO_POLL = YesPlease
        NO_INTPTR_T = UnfortunatelyYes
+       CSPRNG_METHOD = openssl
        SANE_TOOL_PATH = /usr/coreutils/bin:/usr/local/bin
        SHELL_PATH = /usr/coreutils/bin/bash
 endif
@@ -628,6 +635,7 @@ ifeq ($(uname_S),MINGW)
        NO_POSIX_GOODIES = UnfortunatelyYes
        DEFAULT_HELP_FORMAT = html
        HAVE_PLATFORM_PROCINFO = YesPlease
+       CSPRNG_METHOD = rtlgenrandom
        BASIC_LDFLAGS += -municode
        COMPAT_CFLAGS += -DNOGDI -Icompat -Icompat/win32
        COMPAT_CFLAGS += -DSTRIP_EXTENSION=\".exe\"

diff --git a/contrib/buildsystems/CMakeLists.txt b/contrib/buildsystems/CMakeLists.txt
index 5100f56bb37a41f82f895cb14f6311d5081a3482..e44232f85d36607b5be51ffa5b9659021ae63133 100644 (file)
--- a/contrib/buildsystems/CMakeLists.txt
+++ b/contrib/buildsystems/CMakeLists.txt
@@ -260,7 +260,7 @@ if(CMAKE_SYSTEM_NAME STREQUAL "Windows")
                                _CONSOLE DETECT_MSYS_TTY STRIP_EXTENSION=".exe"  NO_SYMLINK_HEAD UNRELIABLE_FSTAT
                                NOGDI OBJECT_CREATION_MODE=1 __USE_MINGW_ANSI_STDIO=0
                                USE_NED_ALLOCATOR OVERRIDE_STRDUP MMAP_PREVENTS_DELETE USE_WIN32_MMAP
-                               UNICODE _UNICODE HAVE_WPGMPTR ENSURE_MSYSTEM_IS_SET)
+                               UNICODE _UNICODE HAVE_WPGMPTR ENSURE_MSYSTEM_IS_SET HAVE_RTLGENRANDOM)
        list(APPEND compat_SOURCES compat/mingw.c compat/winansi.c compat/win32/path-utils.c
                compat/win32/pthread.c compat/win32mmap.c compat/win32/syslog.c
                compat/win32/trace2_win32_process_info.c compat/win32/dirent.c

diff --git a/git-compat-util.h b/git-compat-util.h
index 5fa54a7afe4bf9ef05d4fa400e677f4f5c94ea4a..50597c76be2d49a320b0d0a619b53152141272a2 100644 (file)
--- a/git-compat-util.h
+++ b/git-compat-util.h
@@ -188,6 +188,12 @@
 #endif
 #include <windows.h>
 #define GIT_WINDOWS_NATIVE
+#ifdef HAVE_RTLGENRANDOM
+/* This is required to get access to RtlGenRandom. */
+#define SystemFunction036 NTAPI SystemFunction036
+#include <NTSecAPI.h>
+#undef SystemFunction036
+#endif
 #endif
 
 #include <unistd.h>
@@ -258,6 +264,12 @@
 #else
 #include <stdint.h>
 #endif
+#ifdef HAVE_ARC4RANDOM_LIBBSD
+#include <bsd/stdlib.h>
+#endif
+#ifdef HAVE_GETRANDOM
+#include <sys/random.h>
+#endif
 #ifdef NO_INTPTR_T
 /*
  * On I16LP32, ILP32 and LP64 "long" is the safe bet, however
@@ -1421,4 +1433,11 @@ static inline void *container_of_or_null_offset(void *ptr, size_t offset)
 
 void sleep_millisec(int millisec);
 
+/*
+ * Generate len bytes from the system cryptographically secure PRNG.
+ * Returns 0 on success and -1 on error, setting errno.  The inability to
+ * satisfy the full request is an error.
+ */
+int csprng_bytes(void *buf, size_t len);
+
 #endif

diff --git a/t/helper/test-csprng.c b/t/helper/test-csprng.c
new file mode 100644 (file)
index 0000000..65d1497
--- /dev/null
+++ b/t/helper/test-csprng.c
@@ -0,0 +1,29 @@
+#include "test-tool.h"
+#include "git-compat-util.h"
+
+
+int cmd__csprng(int argc, const char **argv)
+{
+       unsigned long count;
+       unsigned char buf[1024];
+
+       if (argc > 2) {
+               fprintf(stderr, "usage: %s [<size>]\n", argv[0]);
+               return 2;
+       }
+
+       count = (argc == 2) ? strtoul(argv[1], NULL, 0) : -1L;
+
+       while (count) {
+               unsigned long chunk = count < sizeof(buf) ? count : sizeof(buf);
+               if (csprng_bytes(buf, chunk) < 0) {
+                       perror("failed to read");
+                       return 5;
+               }
+               if (fwrite(buf, chunk, 1, stdout) != chunk)
+                       return 1;
+               count -= chunk;
+       }
+
+       return 0;
+}

diff --git a/t/helper/test-tool.c b/t/helper/test-tool.c
index 338a57b104d689a843df92b8adc0d6d0381252be..e6ec69cf326a3babac7bac7df9a03026b0c16d5a 100644 (file)
--- a/t/helper/test-tool.c
+++ b/t/helper/test-tool.c
@@ -20,6 +20,7 @@ static struct test_cmd cmds[] = {
        { "chmtime", cmd__chmtime },
        { "config", cmd__config },
        { "crontab", cmd__crontab },
+       { "csprng", cmd__csprng },
        { "ctype", cmd__ctype },
        { "date", cmd__date },
        { "delta", cmd__delta },

diff --git a/t/helper/test-tool.h b/t/helper/test-tool.h
index 48cee1f4a2d9855e10897289b08191905f208730..20756eefddac8394b9e9f2625909f1833b2fec02 100644 (file)
--- a/t/helper/test-tool.h
+++ b/t/helper/test-tool.h
@@ -10,6 +10,7 @@ int cmd__bloom(int argc, const char **argv);
 int cmd__chmtime(int argc, const char **argv);
 int cmd__config(int argc, const char **argv);
 int cmd__crontab(int argc, const char **argv);
+int cmd__csprng(int argc, const char **argv);
 int cmd__ctype(int argc, const char **argv);
 int cmd__date(int argc, const char **argv);
 int cmd__delta(int argc, const char **argv);

diff --git a/wrapper.c b/wrapper.c
index 36e12119d76556a710dbc8da2953a4710e630fdb..105235670328b36c9454c6915c8a4d0ed3d6c117 100644 (file)
--- a/wrapper.c
+++ b/wrapper.c
@@ -702,3 +702,69 @@ int open_nofollow(const char *path, int flags)
        return open(path, flags);
 #endif
 }
+
+int csprng_bytes(void *buf, size_t len)
+{
+#if defined(HAVE_ARC4RANDOM) || defined(HAVE_ARC4RANDOM_LIBBSD)
+       /* This function never returns an error. */
+       arc4random_buf(buf, len);
+       return 0;
+#elif defined(HAVE_GETRANDOM)
+       ssize_t res;
+       char *p = buf;
+       while (len) {
+               res = getrandom(p, len, 0);
+               if (res < 0)
+                       return -1;
+               len -= res;
+               p += res;
+       }
+       return 0;
+#elif defined(HAVE_GETENTROPY)
+       int res;
+       char *p = buf;
+       while (len) {
+               /* getentropy has a maximum size of 256 bytes. */
+               size_t chunk = len < 256 ? len : 256;
+               res = getentropy(p, chunk);
+               if (res < 0)
+                       return -1;
+               len -= chunk;
+               p += chunk;
+       }
+       return 0;
+#elif defined(HAVE_RTLGENRANDOM)
+       if (!RtlGenRandom(buf, len))
+               return -1;
+       return 0;
+#elif defined(HAVE_OPENSSL_CSPRNG)
+       int res = RAND_bytes(buf, len);
+       if (res == 1)
+               return 0;
+       if (res == -1)
+               errno = ENOTSUP;
+       else
+               errno = EIO;
+       return -1;
+#else
+       ssize_t res;
+       char *p = buf;
+       int fd, err;
+       fd = open("/dev/urandom", O_RDONLY);
+       if (fd < 0)
+               return -1;
+       while (len) {
+               res = xread(fd, p, len);
+               if (res < 0) {
+                       err = errno;
+                       close(fd);
+                       errno = err;
+                       return -1;
+               }
+               len -= res;
+               p += res;
+       }
+       close(fd);
+       return 0;
+#endif
+}