src/basic/random-util.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2010 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <elf.h>
  21 #include <errno.h>
  22 #include <fcntl.h>
  23 #include <stdbool.h>
  24 #include <stdlib.h>
  25 #include <sys/time.h>
  26 #include <linux/random.h>
  27 #include <stdint.h>
  28
  29 #ifdef HAVE_SYS_AUXV_H
  30 #  include <sys/auxv.h>
  31 #endif
  32
  33 #ifdef USE_SYS_RANDOM_H
  34 #  include <sys/random.h>
  35 #else
  36 #  include <linux/random.h>
  37 #endif
  38
  39 #include "fd-util.h"
  40 #include "io-util.h"
  41 #include "missing.h"
  42 #include "random-util.h"
  43 #include "time-util.h"
  44
  45 int acquire_random_bytes(void *p, size_t n, bool high_quality_required) {
  46         static int have_syscall = -1;
  47
  48         _cleanup_close_ int fd = -1;
  49         unsigned already_done = 0;
  50         int r;
  51
  52         /* Gathers some randomness from the kernel. This call will never block. If
  53          * high_quality_required, it will always return some data from the kernel,
  54          * regardless of whether the random pool is fully initialized or not.
  55          * Otherwise, it will return success if at least some random bytes were
  56          * successfully acquired, and an error if the kernel has no entropy whatsover
  57          * for us. */
  58
  59         /* Use the getrandom() syscall unless we know we don't have it. */
  60         if (have_syscall != 0) {
  61                 r = getrandom(p, n, GRND_NONBLOCK);
  62                 if (r > 0) {
  63                         have_syscall = true;
  64                         if ((size_t) r == n)
  65                                 return 0;
  66                         if (!high_quality_required) {
  67                                 /* Fill in the remaining bytes using pseudorandom values */
  68                                 pseudorandom_bytes((uint8_t*) p + r, n - r);
  69                                 return 0;
  70                         }
  71
  72                         already_done = r;
  73                 } else if (errno == ENOSYS)
  74                           /* We lack the syscall, continue with reading from /dev/urandom. */
  75                           have_syscall = false;
  76                 else if (errno == EAGAIN) {
  77                         /* The kernel has no entropy whatsoever. Let's remember to
  78                          * use the syscall the next time again though.
  79                          *
  80                          * If high_quality_required is false, return an error so that
  81                          * random_bytes() can produce some pseudorandom
  82                          * bytes. Otherwise, fall back to /dev/urandom, which we know
  83                          * is empty, but the kernel will produce some bytes for us on
  84                          * a best-effort basis. */
  85                         have_syscall = true;
  86
  87                         if (!high_quality_required)
  88                                 return -ENODATA;
  89                 } else
  90                         return -errno;
  91         }
  92
  93         fd = open("/dev/urandom", O_RDONLY|O_CLOEXEC|O_NOCTTY);
  94         if (fd < 0)
  95                 return errno == ENOENT ? -ENOSYS : -errno;
  96
  97         return loop_read_exact(fd, (uint8_t*) p + already_done, n - already_done, true);
  98 }
  99
 100 void initialize_srand(void) {
 101         static bool srand_called = false;
 102         unsigned x;
 103 #ifdef HAVE_SYS_AUXV_H
 104         void *auxv;
 105 #endif
 106
 107         if (srand_called)
 108                 return;
 109
 110 #ifdef HAVE_SYS_AUXV_H
 111         /* The kernel provides us with 16 bytes of entropy in auxv, so let's
 112          * try to make use of that to seed the pseudo-random generator. It's
 113          * better than nothing... */
 114
 115         auxv = (void*) getauxval(AT_RANDOM);
 116         if (auxv) {
 117                 assert_cc(sizeof(x) <= 16);
 118                 memcpy(&x, auxv, sizeof(x));
 119         } else
 120 #endif
 121                 x = 0;
 122
 123
 124         x ^= (unsigned) now(CLOCK_REALTIME);
 125         x ^= (unsigned) gettid();
 126
 127         srand(x);
 128         srand_called = true;
 129 }
 130
 131 /* INT_MAX gives us only 31 bits, so use 24 out of that. */
 132 #if RAND_MAX >= INT_MAX
 133 #  define RAND_STEP 3
 134 #else
 135 /* SHORT_INT_MAX or lower gives at most 15 bits, we just just 8 out of that. */
 136 #  define RAND_STEP 1
 137 #endif
 138
 139 void pseudorandom_bytes(void *p, size_t n) {
 140         uint8_t *q;
 141
 142         initialize_srand();
 143
 144         for (q = p; q < (uint8_t*) p + n; q += RAND_STEP) {
 145                 unsigned rr;
 146
 147                 rr = (unsigned) rand();
 148
 149 #if RAND_STEP >= 3
 150                 if ((size_t) (q - (uint8_t*) p + 2) < n)
 151                         q[2] = rr >> 16;
 152 #endif
 153 #if RAND_STEP >= 2
 154                 if ((size_t) (q - (uint8_t*) p + 1) < n)
 155                         q[1] = rr >> 8;
 156 #endif
 157                 q[0] = rr;
 158         }
 159 }
 160
 161 void random_bytes(void *p, size_t n) {
 162         int r;
 163
 164         r = acquire_random_bytes(p, n, false);
 165         if (r >= 0)
 166                 return;
 167
 168         /* If some idiot made /dev/urandom unavailable to us, or the
 169          * kernel has no entropy, use a PRNG instead. */
 170         return pseudorandom_bytes(p, n);
 171 }