random/rndgetentropy.c - master - githubmirror/libgcrypt

random/rndgetentropy.c
126 строк4 KB
NIIBE Yutaka
random: Use getrandom only when it's appropriate.
10 апр 2023, 05:45
10 апр 2023, 05:45fa21ddc
/* rndgetentropy.c  -  raw random number for OSes by getentropy function.
 * Copyright (C) 1998, 2001, 2002, 2003, 2007,
 *               2009  Free Software Foundation, Inc.
 *
 * This file is part of Libgcrypt.
 *
 * Libgcrypt is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * Libgcrypt is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this program; if not, see <http://www.gnu.org/licenses/>.
 */


#include <config.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/types.h>
#include <string.h>
#include <unistd.h>
#ifdef HAVE_SYS_RANDOM_H
#include <sys/random.h>
#endif

#include "types.h"
#include "g10lib.h"
#include "rand-internal.h"

/* The function returns 0 on success or true on failure (in which case
 * the caller will signal a fatal error).  */
int
_gcry_rndgetentropy_gather_random (void (*add)(const void*, size_t,
                                               enum random_origins),
                                   enum random_origins origin,
                                   size_t length, int level)
{
  byte buffer[256];

  if (!add)
    {
      /* Special mode to release resouces.  */
      _gcry_rndjent_fini ();
      return 0;
    }

  /* When using a blocking random generator try to get some entropy
   * from the jitter based RNG.  In this case we take up to 50% of the
   * remaining requested bytes.  */
  if (level >= GCRY_VERY_STRONG_RANDOM)
    {
      size_t n;

      n = _gcry_rndjent_poll (add, origin, length/2);
      if (n > length/2)
        n = length/2;
      if (length > 1)
        length -= n;
    }

  /* Enter the loop.  */
  while (length)
    {
      int ret;
      size_t nbytes;

      /* For a modern operating system, we use the new getentropy
       * function.  That call guarantees that the kernel's RNG has
       * been properly seeded before returning any data.  This is
       * different from /dev/urandom which may, due to its
       * non-blocking semantics, return data even if the kernel has
       * not been properly seeded.  And it differs from /dev/random by
       * never blocking once the kernel is seeded.  */
      do
        {
          _gcry_pre_syscall ();
#ifdef GRND_RANDOM
          if (fips_mode ())
            {
              /* DRBG chaining defined in SP 800-90A (rev 1) specify
               * the upstream (kernel) DRBG needs to be reseeded for
               * initialization of downstream (libgcrypt) DRBG. For this
               * in RHEL, we repurposed the GRND_RANDOM flag of getrandom API.
               * The libgcrypt DRBG is initialized with 48B of entropy, but
               * the kernel can provide only 32B at a time after reseeding
               * so we need to limit our requests to 32B here.
               * This is clarified in IG 7.19 / IG D.K. for FIPS 140-2 / 3
               * and might not be applicable on other FIPS modules not running
               * RHEL kernel.
               */
              nbytes = length < 32 ? length : 32;
              ret = getrandom (buffer, nbytes, GRND_RANDOM);
            }
          else
#endif
            {
              nbytes = length < sizeof (buffer) ? length : sizeof (buffer);
              ret = getentropy (buffer, nbytes);
            }
          _gcry_post_syscall ();
        }
      while (ret == -1 && errno == EINTR);

      if (ret == -1 && errno == ENOSYS)
        log_fatal ("getentropy is not supported: %s\n", strerror (errno));
      else
        { /* getentropy is supported.  Some sanity checks.  */
          if (ret == -1)
            log_fatal ("unexpected error from getentropy: %s\n",
                       strerror (errno));

          (*add) (buffer, nbytes, origin);
          length -= nbytes;
        }
    }
  wipememory (buffer, sizeof buffer);

  return 0; /* success */
}