Use arc4random for CSPRNG when available

Use arc4random on platforms where available.  arc4random() provides high
quality cryptographically-secure pseudo-random numbers and is generally
recommended for application use.

The uv_random() call unfortunately uses getentropy() on platforms like
MacOS, OpenBSD or NetBSD which is not recommended for application use.

(cherry picked from commit 4db9e5d90e290f77718f8e1e0a64c3e1a8fe34f9)

diff --git a/configure.ac b/configure.ac
index 34895e9b463d2d0386cdf3d33d64d75f0014c087..85c53a4d97d522a8c4ee0f3f8c134ab10225907c 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -653,7 +653,7 @@ AS_IF([test "$enable_pthread_rwlock" = "yes"],
       ])
 AM_CONDITIONAL([USE_ISC_RWLOCK], [test "$enable_pthread_rwlock" != "yes"])
 
-CRYPTO=OpenSSL
+AC_CHECK_FUNCS_ONCE([arc4random])
 
 #
 # OpenSSL/LibreSSL is mandatory

diff --git a/lib/isc/Makefile.am b/lib/isc/Makefile.am
index 1ea03acfb012cb7b3c76fc5411203a8c04b76d2b..c0769ec5276778b180e067e496546099ed35ded0 100644 (file)
--- a/lib/isc/Makefile.am
+++ b/lib/isc/Makefile.am
@@ -21,7 +21,6 @@ libisc_la_HEADERS =                   \
        include/isc/dir.h               \
        include/isc/dnsstream.h         \
        include/isc/endian.h            \
-       include/isc/entropy.h           \
        include/isc/errno.h             \
        include/isc/error.h             \
        include/isc/file.h              \
@@ -127,7 +126,6 @@ libisc_la_SOURCES =         \
        counter.c               \
        crc64.c                 \
        dir.c                   \
-       entropy.c               \
        errno.c                 \
        errno2result.c          \
        errno2result.h          \
@@ -165,7 +163,6 @@ libisc_la_SOURCES =         \
        net.c                   \
        netaddr.c               \
        netscope.c              \
-       nonce.c                 \
        openssl_shim.c          \
        openssl_shim.h          \
        os.c                    \

diff --git a/lib/isc/entropy.c b/lib/isc/entropy.c
deleted file mode 100644 (file)
index a037960..0000000
--- a/lib/isc/entropy.c
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <isc/entropy.h>
-#include <isc/types.h>
-#include <isc/util.h>
-#include <isc/uv.h>
-
-void
-isc_entropy_get(void *buf, size_t buflen) {
-       int r = uv_random(NULL, NULL, buf, buflen, 0, NULL);
-
-       UV_RUNTIME_CHECK(uv_random, r);
-}

diff --git a/lib/isc/hash.c b/lib/isc/hash.c
index 387e2373cd16e5af8a133d357185eb22b6d6cfc8..49b942ef5bc6db7e9841d64f78f1e35c504f0c0a 100644 (file)
--- a/lib/isc/hash.c
+++ b/lib/isc/hash.c
@@ -16,7 +16,6 @@
 #include <stddef.h>
 
 #include <isc/ascii.h>
-#include <isc/entropy.h>
 #include <isc/hash.h> /* IWYU pragma: keep */
 #include <isc/random.h>
 #include <isc/result.h>
@@ -35,7 +34,7 @@ isc__hash_initialize(void) {
         */
        uint8_t key[16] = { 1 };
 #if !FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
-       isc_entropy_get(key, sizeof(key));
+       isc_random_buf(key, sizeof(key));
 #endif /* if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */
        STATIC_ASSERT(sizeof(key) >= sizeof(isc_hash_key),
                      "sizeof(key) < sizeof(isc_hash_key)");

diff --git a/lib/isc/hashmap.c b/lib/isc/hashmap.c
index d8c2bd58ae7259f569bf51a7fb02f17ba5d4606e..87b1a3f21a3c7c42d119e754fe96fd67bda80eec 100644 (file)
--- a/lib/isc/hashmap.c
+++ b/lib/isc/hashmap.c
@@ -32,7 +32,6 @@
 
 #include <isc/ascii.h>
 #include <isc/atomic.h>
-#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/hashmap.h>
 #include <isc/magic.h>

diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
deleted file mode 100644 (file)
index 4e2dc5f..0000000
--- a/lib/isc/include/isc/entropy.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-#include <stdlib.h>
-
-#include <isc/lang.h>
-
-/*! \file isc/entropy.h
- * \brief Implements wrapper around CSPRNG cryptographic library calls
- * for getting cryptographically secure pseudo-random numbers.
- *
- * Uses synchronous version of uv_random().
- */
-
-ISC_LANG_BEGINDECLS
-
-void
-isc_entropy_get(void *buf, size_t buflen);
-/*!<
- * \brief Get cryptographically-secure pseudo-random data.
- */
-
-ISC_LANG_ENDDECLS

diff --git a/lib/isc/include/isc/nonce.h b/lib/isc/include/isc/nonce.h
index b593e41445626eaf78e68a684bc4404ca864e5bb..10fb8b10a01897058d9bff2327287c72f800f471 100644 (file)
--- a/lib/isc/include/isc/nonce.h
+++ b/lib/isc/include/isc/nonce.h
@@ -16,6 +16,7 @@
 #include <stdlib.h>
 
 #include <isc/lang.h>
+#include <isc/random.h>
 
 /*! \file isc/nonce.h
  * \brief Provides a function for generating an arbitrarily long nonce.
@@ -23,8 +24,10 @@
 
 ISC_LANG_BEGINDECLS
 
-void
-isc_nonce_buf(void *buf, size_t buflen);
+static inline void
+isc_nonce_buf(void *buf, size_t buflen) {
+       isc_random_buf(buf, buflen);
+}
 /*!<
  * Fill 'buf', up to 'buflen' bytes, with random data from the
  * crypto provider's random function.

diff --git a/lib/isc/include/isc/random.h b/lib/isc/include/isc/random.h
index 577cf530e60863f07a07f7a580b1ebe5348298c3..78035fbe9a1a399e3ebb8f8424916d2dc17e75cd 100644 (file)
--- a/lib/isc/include/isc/random.h
+++ b/lib/isc/include/isc/random.h
@@ -27,18 +27,11 @@
 
 ISC_LANG_BEGINDECLS
 
-uint8_t
-isc_random8(void);
-/*!<
- * \brief Returns a single 8-bit random value.
- */
-
-uint16_t
-isc_random16(void);
-/*!<
- * \brief Returns a single 16-bit random value.
- */
-
+#if HAVE_ARC4RANDOM && !defined(__linux__)
+#define isc_random32()                 arc4random()
+#define isc_random_buf(buf, buflen)    arc4random_buf(buf, buflen)
+#define isc_random_uniform(upper_bound) arc4random_uniform(upper_bound)
+#else /* HAVE_ARC4RANDOM && !defined(__linux__) */
 uint32_t
 isc_random32(void);
 /*!<
@@ -68,4 +61,21 @@ isc_random_uniform(uint32_t upper_bound);
  * when upper_bound is UINT32_MAX/2.
  */
 
+#endif /* HAVE_ARC4RANDOM && !defined(__linux__) */
+
+static inline uint8_t
+isc_random8(void) {
+       return (uint8_t)isc_random32();
+}
+/*!<
+ * \brief Returns a single 8-bit random value.
+ */
+
+static inline uint16_t
+isc_random16(void) {
+       return (uint16_t)isc_random32();
+}
+/*!<
+ * \brief Returns a single 16-bit random value.
+ */
 ISC_LANG_ENDDECLS

diff --git a/lib/isc/nonce.c b/lib/isc/nonce.c
deleted file mode 100644 (file)
index 316498a..0000000
--- a/lib/isc/nonce.c
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#include <isc/entropy.h>
-#include <isc/nonce.h>
-
-void
-isc_nonce_buf(void *buf, size_t buflen) {
-       isc_entropy_get(buf, buflen);
-}

diff --git a/lib/isc/random.c b/lib/isc/random.c
index 666975c119ee87dc19d7904895e64c6b8b7e7561..1367fd5a1217d20523fae9a04e9ed847ca4d6a2a 100644 (file)
--- a/lib/isc/random.c
+++ b/lib/isc/random.c
@@ -30,22 +30,24 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#if !HAVE_ARC4RANDOM || defined(__linux__)
+
 #include <inttypes.h>
 #include <stdio.h>
 
-#include <isc/entropy.h>
 #include <isc/os.h>
 #include <isc/random.h>
 #include <isc/thread.h>
 #include <isc/util.h>
+#include <isc/uv.h>
 
 #define ISC_RANDOM_BUFSIZE (ISC_OS_CACHELINE_SIZE / sizeof(uint32_t))
 
 thread_local static uint32_t isc__random_pool[ISC_RANDOM_BUFSIZE];
 thread_local static size_t isc__random_pos = ISC_RANDOM_BUFSIZE;
 
-static uint32_t
-random_u32(void) {
+uint32_t
+isc_random32(void) {
 #if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
        /*
         * A fixed stream of numbers helps with problem reproduction when
@@ -56,28 +58,13 @@ random_u32(void) {
 #endif /* if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */
 
        if (isc__random_pos == ISC_RANDOM_BUFSIZE) {
-               isc_entropy_get(isc__random_pool, sizeof(isc__random_pool));
+               isc_random_buf(isc__random_pool, sizeof(isc__random_pool));
                isc__random_pos = 0;
        }
 
        return isc__random_pool[isc__random_pos++];
 }
 
-uint8_t
-isc_random8(void) {
-       return (uint8_t)random_u32();
-}
-
-uint16_t
-isc_random16(void) {
-       return (uint16_t)random_u32();
-}
-
-uint32_t
-isc_random32(void) {
-       return random_u32();
-}
-
 void
 isc_random_buf(void *buf, size_t buflen) {
        REQUIRE(buflen == 0 || buf != NULL);
@@ -86,7 +73,8 @@ isc_random_buf(void *buf, size_t buflen) {
                return;
        }
 
-       isc_entropy_get(buf, buflen);
+       int r = uv_random(NULL, NULL, buf, buflen, 0, NULL);
+       UV_RUNTIME_CHECK(uv_random, r);
 }
 
 uint32_t
@@ -102,7 +90,7 @@ isc_random_uniform(uint32_t limit) {
         * integer part (upper 32 bits), and we will use the fraction part
         * (lower 32 bits) to determine whether or not we need to resample.
         */
-       uint64_t num = (uint64_t)random_u32() * (uint64_t)limit;
+       uint64_t num = (uint64_t)isc_random32() * (uint64_t)limit;
        /*
         * In the fast path, we avoid doing a division in most cases by
         * comparing the fraction part of `num` with the limit, which is
@@ -154,7 +142,7 @@ isc_random_uniform(uint32_t limit) {
                 * our valid range, it is superfluous, and we resample.
                 */
                while ((uint32_t)(num) < residue) {
-                       num = (uint64_t)random_u32() * (uint64_t)limit;
+                       num = (uint64_t)isc_random32() * (uint64_t)limit;
                }
        }
        /*
@@ -162,3 +150,5 @@ isc_random_uniform(uint32_t limit) {
         */
        return (uint32_t)(num >> 32);
 }
+
+#endif /* HAVE_ARC4RANDOM && !defined(__linux__) */