src/rand/sysrng.c

/*
 * Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
 *
 * Permission is hereby granted, free of charge, to any person obtaining
 * a copy of this software and associated documentation files (the
 * "Software"), to deal in the Software without restriction, including
 * without limitation the rights to use, copy, modify, merge, publish,
 * distribute, sublicense, and/or sell copies of the Software, and to
 * permit persons to whom the Software is furnished to do so, subject to
 * the following conditions:
 *
 * The above copyright notice and this permission notice shall be
 * included in all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 * SOFTWARE.
 */

#define BR_ENABLE_INTRINSICS   1
#include "inner.h"

#if BR_USE_GETENTROPY
#include <unistd.h>
#endif

#if BR_USE_URANDOM
#include <sys/types.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#endif

#if BR_USE_WIN32_RAND
#include <windows.h>
#include <wincrypt.h>
#pragma comment(lib, "advapi32")
#endif

/*
 * Seeder that uses the RDRAND opcodes (on x86 CPU).
 */
#if BR_RDRAND
BR_TARGETS_X86_UP
BR_TARGET("rdrnd")
static int
seeder_rdrand(const br_prng_class **ctx)
{
	unsigned char tmp[32];
	size_t u;

	for (u = 0; u < sizeof tmp; u += sizeof(uint32_t)) {
		int j;
		uint32_t x;

		/*
		 * We use the 32-bit intrinsic so that code is compatible
		 * with both 32-bit and 64-bit architectures.
		 *
		 * Intel recommends trying at least 10 times in case of
		 * failure.
		 *
		 * AMD bug: there are reports that some AMD processors
		 * have a bug that makes them fail silently after a
		 * suspend/resume cycle, in which case RDRAND will report
		 * a success but always return 0xFFFFFFFF.
		 * see: https://bugzilla.kernel.org/show_bug.cgi?id=85911
		 *
		 * As a mitigation, if the 32-bit value is 0 or -1, then
		 * it is considered a failure and tried again. This should
		 * reliably detect the buggy case, at least. This also
		 * implies that the selected seed values can never be
		 * 0x00000000 or 0xFFFFFFFF, which is not a problem since
		 * we are generating a seed for a PRNG, and we overdo it
		 * a bit (we generate 32 bytes of randomness, and 256 bits
		 * of entropy are really overkill).
		 */
		for (j = 0; j < 10; j ++) {
			if (_rdrand32_step(&x) && x != 0 && x != (uint32_t)-1) {
				goto next_word;
			}
		}
		return 0;
	next_word:
		br_enc32le(tmp + u, x);
	}
	(*ctx)->update(ctx, tmp, sizeof tmp);
	return 1;
}
BR_TARGETS_X86_DOWN

static int
rdrand_supported(void)
{
	/*
	 * The RDRND support is bit 30 of ECX, as returned by CPUID.
	 */
	return br_cpuid(0, 0, 0x40000000, 0);
}
#endif

/*
 * Seeder that uses /dev/urandom (on Unix-like systems).
 */
#if BR_USE_URANDOM
static int
seeder_urandom(const br_prng_class **ctx)
{
	int f;

	f = open("/dev/urandom", O_RDONLY);
	if (f >= 0) {
		unsigned char tmp[32];
		size_t u;

		for (u = 0; u < sizeof tmp;) {
			ssize_t len;

			len = read(f, tmp + u, (sizeof tmp) - u);
			if (len < 0) {
				if (errno == EINTR) {
					continue;
				}
				break;
			}
			u += (size_t)len;
		}
		close(f);
		if (u == sizeof tmp) {
			(*ctx)->update(ctx, tmp, sizeof tmp);
			return 1;
		}
	}
	return 0;
}
#endif

/*
 * Seeder that uses getentropy() (backed by getrandom() on some systems,
 * e.g. Linux). On failure, it will use the /dev/urandom seeder (if
 * enabled).
 */
#if BR_USE_GETENTROPY
static int
seeder_getentropy(const br_prng_class **ctx)
{
	unsigned char tmp[32];

	if (getentropy(tmp, sizeof tmp) == 0) {
		(*ctx)->update(ctx, tmp, sizeof tmp);
		return 1;
	}
#if BR_USE_URANDOM
	return seeder_urandom(ctx);
#else
	return 0;
#endif
}
#endif

/*
 * Seeder that uses CryptGenRandom() (on Windows).
 */
#if BR_USE_WIN32_RAND
static int
seeder_win32(const br_prng_class **ctx)
{
	HCRYPTPROV hp;

	if (CryptAcquireContext(&hp, 0, 0, PROV_RSA_FULL,
		CRYPT_VERIFYCONTEXT | CRYPT_SILENT))
	{
		BYTE buf[32];
		BOOL r;

		r = CryptGenRandom(hp, sizeof buf, buf);
		CryptReleaseContext(hp, 0);
		if (r) {
			(*ctx)->update(ctx, buf, sizeof buf);
			return 1;
		}
	}
	return 0;
}
#endif

/*
 * An aggregate seeder that uses RDRAND, and falls back to an OS-provided
 * source if RDRAND fails.
 */
#if BR_RDRAND && (BR_USE_GETENTROPY || BR_USE_URANDOM || BR_USE_WIN32_RAND)
static int
seeder_rdrand_with_fallback(const br_prng_class **ctx)
{
	if (!seeder_rdrand(ctx)) {
#if BR_USE_GETENTROPY
		return seeder_getentropy(ctx);
#elif BR_USE_URANDOM
		return seeder_urandom(ctx);
#elif BR_USE_WIN32_RAND
		return seeder_win32(ctx);
#else
#error "macro selection has gone wrong"
#endif
	}
	return 1;
}
#endif

/* see bearssl_rand.h */
br_prng_seeder
br_prng_seeder_system(const char **name)
{
#if BR_RDRAND
	if (rdrand_supported()) {
		if (name != NULL) {
			*name = "rdrand";
		}
#if BR_USE_GETENTROPY || BR_USE_URANDOM || BR_USE_WIN32_RAND
		return &seeder_rdrand_with_fallback;
#else
		return &seeder_rdrand;
#endif
	}
#endif
#if BR_USE_GETENTROPY
	if (name != NULL) {
		*name = "getentropy";
	}
	return &seeder_getentropy;
#elif BR_USE_URANDOM
	if (name != NULL) {
		*name = "urandom";
	}
	return &seeder_urandom;
#elif BR_USE_WIN32_RAND
	if (name != NULL) {
		*name = "win32";
	}
	return &seeder_win32;
#else
	if (name != NULL) {
		*name = "none";
	}
	return 0;
#endif
}