wrapper.c

   1 /*
   2  * Various trivial helper wrappers around standard functions
   3  */
   4 #include "cache.h"
   5 #include "abspath.h"
   6 #include "config.h"
   7 #include "gettext.h"
   8 #include "trace2.h"
   9 #include "wrapper.h"
  10
  11 static intmax_t count_fsync_writeout_only;
  12 static intmax_t count_fsync_hardware_flush;
  13
  14 #ifdef HAVE_RTLGENRANDOM
  15 /* This is required to get access to RtlGenRandom. */
  16 #define SystemFunction036 NTAPI SystemFunction036
  17 #include <NTSecAPI.h>
  18 #undef SystemFunction036
  19 #endif
  20
  21 static int memory_limit_check(size_t size, int gentle)
  22 {
  23         static size_t limit = 0;
  24         if (!limit) {
  25                 limit = git_env_ulong("GIT_ALLOC_LIMIT", 0);
  26                 if (!limit)
  27                         limit = SIZE_MAX;
  28         }
  29         if (size > limit) {
  30                 if (gentle) {
  31                         error("attempting to allocate %"PRIuMAX" over limit %"PRIuMAX,
  32                               (uintmax_t)size, (uintmax_t)limit);
  33                         return -1;
  34                 } else
  35                         die("attempting to allocate %"PRIuMAX" over limit %"PRIuMAX,
  36                             (uintmax_t)size, (uintmax_t)limit);
  37         }
  38         return 0;
  39 }
  40
  41 char *xstrdup(const char *str)
  42 {
  43         char *ret = strdup(str);
  44         if (!ret)
  45                 die("Out of memory, strdup failed");
  46         return ret;
  47 }
  48
  49 static void *do_xmalloc(size_t size, int gentle)
  50 {
  51         void *ret;
  52
  53         if (memory_limit_check(size, gentle))
  54                 return NULL;
  55         ret = malloc(size);
  56         if (!ret && !size)
  57                 ret = malloc(1);
  58         if (!ret) {
  59                 if (!gentle)
  60                         die("Out of memory, malloc failed (tried to allocate %lu bytes)",
  61                             (unsigned long)size);
  62                 else {
  63                         error("Out of memory, malloc failed (tried to allocate %lu bytes)",
  64                               (unsigned long)size);
  65                         return NULL;
  66                 }
  67         }
  68 #ifdef XMALLOC_POISON
  69         memset(ret, 0xA5, size);
  70 #endif
  71         return ret;
  72 }
  73
  74 void *xmalloc(size_t size)
  75 {
  76         return do_xmalloc(size, 0);
  77 }
  78
  79 static void *do_xmallocz(size_t size, int gentle)
  80 {
  81         void *ret;
  82         if (unsigned_add_overflows(size, 1)) {
  83                 if (gentle) {
  84                         error("Data too large to fit into virtual memory space.");
  85                         return NULL;
  86                 } else
  87                         die("Data too large to fit into virtual memory space.");
  88         }
  89         ret = do_xmalloc(size + 1, gentle);
  90         if (ret)
  91                 ((char*)ret)[size] = 0;
  92         return ret;
  93 }
  94
  95 void *xmallocz(size_t size)
  96 {
  97         return do_xmallocz(size, 0);
  98 }
  99
 100 void *xmallocz_gently(size_t size)
 101 {
 102         return do_xmallocz(size, 1);
 103 }
 104
 105 /*
 106  * xmemdupz() allocates (len + 1) bytes of memory, duplicates "len" bytes of
 107  * "data" to the allocated memory, zero terminates the allocated memory,
 108  * and returns a pointer to the allocated memory. If the allocation fails,
 109  * the program dies.
 110  */
 111 void *xmemdupz(const void *data, size_t len)
 112 {
 113         return memcpy(xmallocz(len), data, len);
 114 }
 115
 116 char *xstrndup(const char *str, size_t len)
 117 {
 118         char *p = memchr(str, '\0', len);
 119         return xmemdupz(str, p ? p - str : len);
 120 }
 121
 122 int xstrncmpz(const char *s, const char *t, size_t len)
 123 {
 124         int res = strncmp(s, t, len);
 125         if (res)
 126                 return res;
 127         return s[len] == '\0' ? 0 : 1;
 128 }
 129
 130 void *xrealloc(void *ptr, size_t size)
 131 {
 132         void *ret;
 133
 134         if (!size) {
 135                 free(ptr);
 136                 return xmalloc(0);
 137         }
 138
 139         memory_limit_check(size, 0);
 140         ret = realloc(ptr, size);
 141         if (!ret)
 142                 die("Out of memory, realloc failed");
 143         return ret;
 144 }
 145
 146 void *xcalloc(size_t nmemb, size_t size)
 147 {
 148         void *ret;
 149
 150         if (unsigned_mult_overflows(nmemb, size))
 151                 die("data too large to fit into virtual memory space");
 152
 153         memory_limit_check(size * nmemb, 0);
 154         ret = calloc(nmemb, size);
 155         if (!ret && (!nmemb || !size))
 156                 ret = calloc(1, 1);
 157         if (!ret)
 158                 die("Out of memory, calloc failed");
 159         return ret;
 160 }
 161
 162 void xsetenv(const char *name, const char *value, int overwrite)
 163 {
 164         if (setenv(name, value, overwrite))
 165                 die_errno(_("could not setenv '%s'"), name ? name : "(null)");
 166 }
 167
 168 /**
 169  * xopen() is the same as open(), but it die()s if the open() fails.
 170  */
 171 int xopen(const char *path, int oflag, ...)
 172 {
 173         mode_t mode = 0;
 174         va_list ap;
 175
 176         /*
 177          * va_arg() will have undefined behavior if the specified type is not
 178          * compatible with the argument type. Since integers are promoted to
 179          * ints, we fetch the next argument as an int, and then cast it to a
 180          * mode_t to avoid undefined behavior.
 181          */
 182         va_start(ap, oflag);
 183         if (oflag & O_CREAT)
 184                 mode = va_arg(ap, int);
 185         va_end(ap);
 186
 187         for (;;) {
 188                 int fd = open(path, oflag, mode);
 189                 if (fd >= 0)
 190                         return fd;
 191                 if (errno == EINTR)
 192                         continue;
 193
 194                 if ((oflag & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL))
 195                         die_errno(_("unable to create '%s'"), path);
 196                 else if ((oflag & O_RDWR) == O_RDWR)
 197                         die_errno(_("could not open '%s' for reading and writing"), path);
 198                 else if ((oflag & O_WRONLY) == O_WRONLY)
 199                         die_errno(_("could not open '%s' for writing"), path);
 200                 else
 201                         die_errno(_("could not open '%s' for reading"), path);
 202         }
 203 }
 204
 205 static int handle_nonblock(int fd, short poll_events, int err)
 206 {
 207         struct pollfd pfd;
 208
 209         if (err != EAGAIN && err != EWOULDBLOCK)
 210                 return 0;
 211
 212         pfd.fd = fd;
 213         pfd.events = poll_events;
 214
 215         /*
 216          * no need to check for errors, here;
 217          * a subsequent read/write will detect unrecoverable errors
 218          */
 219         poll(&pfd, 1, -1);
 220         return 1;
 221 }
 222
 223 /*
 224  * xread() is the same a read(), but it automatically restarts read()
 225  * operations with a recoverable error (EAGAIN and EINTR). xread()
 226  * DOES NOT GUARANTEE that "len" bytes is read even if the data is available.
 227  */
 228 ssize_t xread(int fd, void *buf, size_t len)
 229 {
 230         ssize_t nr;
 231         if (len > MAX_IO_SIZE)
 232                 len = MAX_IO_SIZE;
 233         while (1) {
 234                 nr = read(fd, buf, len);
 235                 if (nr < 0) {
 236                         if (errno == EINTR)
 237                                 continue;
 238                         if (handle_nonblock(fd, POLLIN, errno))
 239                                 continue;
 240                 }
 241                 return nr;
 242         }
 243 }
 244
 245 /*
 246  * xwrite() is the same a write(), but it automatically restarts write()
 247  * operations with a recoverable error (EAGAIN and EINTR). xwrite() DOES NOT
 248  * GUARANTEE that "len" bytes is written even if the operation is successful.
 249  */
 250 ssize_t xwrite(int fd, const void *buf, size_t len)
 251 {
 252         ssize_t nr;
 253         if (len > MAX_IO_SIZE)
 254                 len = MAX_IO_SIZE;
 255         while (1) {
 256                 nr = write(fd, buf, len);
 257                 if (nr < 0) {
 258                         if (errno == EINTR)
 259                                 continue;
 260                         if (handle_nonblock(fd, POLLOUT, errno))
 261                                 continue;
 262                 }
 263
 264                 return nr;
 265         }
 266 }
 267
 268 /*
 269  * xpread() is the same as pread(), but it automatically restarts pread()
 270  * operations with a recoverable error (EAGAIN and EINTR). xpread() DOES
 271  * NOT GUARANTEE that "len" bytes is read even if the data is available.
 272  */
 273 ssize_t xpread(int fd, void *buf, size_t len, off_t offset)
 274 {
 275         ssize_t nr;
 276         if (len > MAX_IO_SIZE)
 277                 len = MAX_IO_SIZE;
 278         while (1) {
 279                 nr = pread(fd, buf, len, offset);
 280                 if ((nr < 0) && (errno == EAGAIN || errno == EINTR))
 281                         continue;
 282                 return nr;
 283         }
 284 }
 285
 286 ssize_t read_in_full(int fd, void *buf, size_t count)
 287 {
 288         char *p = buf;
 289         ssize_t total = 0;
 290
 291         while (count > 0) {
 292                 ssize_t loaded = xread(fd, p, count);
 293                 if (loaded < 0)
 294                         return -1;
 295                 if (loaded == 0)
 296                         return total;
 297                 count -= loaded;
 298                 p += loaded;
 299                 total += loaded;
 300         }
 301
 302         return total;
 303 }
 304
 305 ssize_t write_in_full(int fd, const void *buf, size_t count)
 306 {
 307         const char *p = buf;
 308         ssize_t total = 0;
 309
 310         while (count > 0) {
 311                 ssize_t written = xwrite(fd, p, count);
 312                 if (written < 0)
 313                         return -1;
 314                 if (!written) {
 315                         errno = ENOSPC;
 316                         return -1;
 317                 }
 318                 count -= written;
 319                 p += written;
 320                 total += written;
 321         }
 322
 323         return total;
 324 }
 325
 326 ssize_t pread_in_full(int fd, void *buf, size_t count, off_t offset)
 327 {
 328         char *p = buf;
 329         ssize_t total = 0;
 330
 331         while (count > 0) {
 332                 ssize_t loaded = xpread(fd, p, count, offset);
 333                 if (loaded < 0)
 334                         return -1;
 335                 if (loaded == 0)
 336                         return total;
 337                 count -= loaded;
 338                 p += loaded;
 339                 total += loaded;
 340                 offset += loaded;
 341         }
 342
 343         return total;
 344 }
 345
 346 int xdup(int fd)
 347 {
 348         int ret = dup(fd);
 349         if (ret < 0)
 350                 die_errno("dup failed");
 351         return ret;
 352 }
 353
 354 /**
 355  * xfopen() is the same as fopen(), but it die()s if the fopen() fails.
 356  */
 357 FILE *xfopen(const char *path, const char *mode)
 358 {
 359         for (;;) {
 360                 FILE *fp = fopen(path, mode);
 361                 if (fp)
 362                         return fp;
 363                 if (errno == EINTR)
 364                         continue;
 365
 366                 if (*mode && mode[1] == '+')
 367                         die_errno(_("could not open '%s' for reading and writing"), path);
 368                 else if (*mode == 'w' || *mode == 'a')
 369                         die_errno(_("could not open '%s' for writing"), path);
 370                 else
 371                         die_errno(_("could not open '%s' for reading"), path);
 372         }
 373 }
 374
 375 FILE *xfdopen(int fd, const char *mode)
 376 {
 377         FILE *stream = fdopen(fd, mode);
 378         if (!stream)
 379                 die_errno("Out of memory? fdopen failed");
 380         return stream;
 381 }
 382
 383 FILE *fopen_for_writing(const char *path)
 384 {
 385         FILE *ret = fopen(path, "w");
 386
 387         if (!ret && errno == EPERM) {
 388                 if (!unlink(path))
 389                         ret = fopen(path, "w");
 390                 else
 391                         errno = EPERM;
 392         }
 393         return ret;
 394 }
 395
 396 static void warn_on_inaccessible(const char *path)
 397 {
 398         warning_errno(_("unable to access '%s'"), path);
 399 }
 400
 401 int warn_on_fopen_errors(const char *path)
 402 {
 403         if (errno != ENOENT && errno != ENOTDIR) {
 404                 warn_on_inaccessible(path);
 405                 return -1;
 406         }
 407
 408         return 0;
 409 }
 410
 411 FILE *fopen_or_warn(const char *path, const char *mode)
 412 {
 413         FILE *fp = fopen(path, mode);
 414
 415         if (fp)
 416                 return fp;
 417
 418         warn_on_fopen_errors(path);
 419         return NULL;
 420 }
 421
 422 int xmkstemp(char *filename_template)
 423 {
 424         int fd;
 425         char origtemplate[PATH_MAX];
 426         strlcpy(origtemplate, filename_template, sizeof(origtemplate));
 427
 428         fd = mkstemp(filename_template);
 429         if (fd < 0) {
 430                 int saved_errno = errno;
 431                 const char *nonrelative_template;
 432
 433                 if (strlen(filename_template) != strlen(origtemplate))
 434                         filename_template = origtemplate;
 435
 436                 nonrelative_template = absolute_path(filename_template);
 437                 errno = saved_errno;
 438                 die_errno("Unable to create temporary file '%s'",
 439                         nonrelative_template);
 440         }
 441         return fd;
 442 }
 443
 444 /* Adapted from libiberty's mkstemp.c. */
 445
 446 #undef TMP_MAX
 447 #define TMP_MAX 16384
 448
 449 int git_mkstemps_mode(char *pattern, int suffix_len, int mode)
 450 {
 451         static const char letters[] =
 452                 "abcdefghijklmnopqrstuvwxyz"
 453                 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
 454                 "0123456789";
 455         static const int num_letters = ARRAY_SIZE(letters) - 1;
 456         static const char x_pattern[] = "XXXXXX";
 457         static const int num_x = ARRAY_SIZE(x_pattern) - 1;
 458         char *filename_template;
 459         size_t len;
 460         int fd, count;
 461
 462         len = strlen(pattern);
 463
 464         if (len < num_x + suffix_len) {
 465                 errno = EINVAL;
 466                 return -1;
 467         }
 468
 469         if (strncmp(&pattern[len - num_x - suffix_len], x_pattern, num_x)) {
 470                 errno = EINVAL;
 471                 return -1;
 472         }
 473
 474         /*
 475          * Replace pattern's XXXXXX characters with randomness.
 476          * Try TMP_MAX different filenames.
 477          */
 478         filename_template = &pattern[len - num_x - suffix_len];
 479         for (count = 0; count < TMP_MAX; ++count) {
 480                 int i;
 481                 uint64_t v;
 482                 if (csprng_bytes(&v, sizeof(v)) < 0)
 483                         return error_errno("unable to get random bytes for temporary file");
 484
 485                 /* Fill in the random bits. */
 486                 for (i = 0; i < num_x; i++) {
 487                         filename_template[i] = letters[v % num_letters];
 488                         v /= num_letters;
 489                 }
 490
 491                 fd = open(pattern, O_CREAT | O_EXCL | O_RDWR, mode);
 492                 if (fd >= 0)
 493                         return fd;
 494                 /*
 495                  * Fatal error (EPERM, ENOSPC etc).
 496                  * It doesn't make sense to loop.
 497                  */
 498                 if (errno != EEXIST)
 499                         break;
 500         }
 501         /* We return the null string if we can't find a unique file name.  */
 502         pattern[0] = '\0';
 503         return -1;
 504 }
 505
 506 int git_mkstemp_mode(char *pattern, int mode)
 507 {
 508         /* mkstemp is just mkstemps with no suffix */
 509         return git_mkstemps_mode(pattern, 0, mode);
 510 }
 511
 512 int xmkstemp_mode(char *filename_template, int mode)
 513 {
 514         int fd;
 515         char origtemplate[PATH_MAX];
 516         strlcpy(origtemplate, filename_template, sizeof(origtemplate));
 517
 518         fd = git_mkstemp_mode(filename_template, mode);
 519         if (fd < 0) {
 520                 int saved_errno = errno;
 521                 const char *nonrelative_template;
 522
 523                 if (!filename_template[0])
 524                         filename_template = origtemplate;
 525
 526                 nonrelative_template = absolute_path(filename_template);
 527                 errno = saved_errno;
 528                 die_errno("Unable to create temporary file '%s'",
 529                         nonrelative_template);
 530         }
 531         return fd;
 532 }
 533
 534 /*
 535  * Some platforms return EINTR from fsync. Since fsync is invoked in some
 536  * cases by a wrapper that dies on failure, do not expose EINTR to callers.
 537  */
 538 static int fsync_loop(int fd)
 539 {
 540         int err;
 541
 542         do {
 543                 err = fsync(fd);
 544         } while (err < 0 && errno == EINTR);
 545         return err;
 546 }
 547
 548 int git_fsync(int fd, enum fsync_action action)
 549 {
 550         switch (action) {
 551         case FSYNC_WRITEOUT_ONLY:
 552                 count_fsync_writeout_only += 1;
 553
 554 #ifdef __APPLE__
 555                 /*
 556                  * On macOS, fsync just causes filesystem cache writeback but
 557                  * does not flush hardware caches.
 558                  */
 559                 return fsync_loop(fd);
 560 #endif
 561
 562 #ifdef HAVE_SYNC_FILE_RANGE
 563                 /*
 564                  * On linux 2.6.17 and above, sync_file_range is the way to
 565                  * issue a writeback without a hardware flush. An offset of
 566                  * 0 and size of 0 indicates writeout of the entire file and the
 567                  * wait flags ensure that all dirty data is written to the disk
 568                  * (potentially in a disk-side cache) before we continue.
 569                  */
 570
 571                 return sync_file_range(fd, 0, 0, SYNC_FILE_RANGE_WAIT_BEFORE |
 572                                                  SYNC_FILE_RANGE_WRITE |
 573                                                  SYNC_FILE_RANGE_WAIT_AFTER);
 574 #endif
 575
 576 #ifdef fsync_no_flush
 577                 return fsync_no_flush(fd);
 578 #endif
 579
 580                 errno = ENOSYS;
 581                 return -1;
 582
 583         case FSYNC_HARDWARE_FLUSH:
 584                 count_fsync_hardware_flush += 1;
 585
 586                 /*
 587                  * On macOS, a special fcntl is required to really flush the
 588                  * caches within the storage controller. As of this writing,
 589                  * this is a very expensive operation on Apple SSDs.
 590                  */
 591 #ifdef __APPLE__
 592                 return fcntl(fd, F_FULLFSYNC);
 593 #else
 594                 return fsync_loop(fd);
 595 #endif
 596         default:
 597                 BUG("unexpected git_fsync(%d) call", action);
 598         }
 599 }
 600
 601 static void log_trace_fsync_if(const char *key, intmax_t value)
 602 {
 603         if (value)
 604                 trace2_data_intmax("fsync", the_repository, key, value);
 605 }
 606
 607 void trace_git_fsync_stats(void)
 608 {
 609         log_trace_fsync_if("fsync/writeout-only", count_fsync_writeout_only);
 610         log_trace_fsync_if("fsync/hardware-flush", count_fsync_hardware_flush);
 611 }
 612
 613 static int warn_if_unremovable(const char *op, const char *file, int rc)
 614 {
 615         int err;
 616         if (!rc || errno == ENOENT)
 617                 return 0;
 618         err = errno;
 619         warning_errno("unable to %s '%s'", op, file);
 620         errno = err;
 621         return rc;
 622 }
 623
 624 int unlink_or_msg(const char *file, struct strbuf *err)
 625 {
 626         int rc = unlink(file);
 627
 628         assert(err);
 629
 630         if (!rc || errno == ENOENT)
 631                 return 0;
 632
 633         strbuf_addf(err, "unable to unlink '%s': %s",
 634                     file, strerror(errno));
 635         return -1;
 636 }
 637
 638 int unlink_or_warn(const char *file)
 639 {
 640         return warn_if_unremovable("unlink", file, unlink(file));
 641 }
 642
 643 int rmdir_or_warn(const char *file)
 644 {
 645         return warn_if_unremovable("rmdir", file, rmdir(file));
 646 }
 647
 648 int remove_or_warn(unsigned int mode, const char *file)
 649 {
 650         return S_ISGITLINK(mode) ? rmdir_or_warn(file) : unlink_or_warn(file);
 651 }
 652
 653 static int access_error_is_ok(int err, unsigned flag)
 654 {
 655         return (is_missing_file_error(err) ||
 656                 ((flag & ACCESS_EACCES_OK) && err == EACCES));
 657 }
 658
 659 int access_or_warn(const char *path, int mode, unsigned flag)
 660 {
 661         int ret = access(path, mode);
 662         if (ret && !access_error_is_ok(errno, flag))
 663                 warn_on_inaccessible(path);
 664         return ret;
 665 }
 666
 667 int access_or_die(const char *path, int mode, unsigned flag)
 668 {
 669         int ret = access(path, mode);
 670         if (ret && !access_error_is_ok(errno, flag))
 671                 die_errno(_("unable to access '%s'"), path);
 672         return ret;
 673 }
 674
 675 char *xgetcwd(void)
 676 {
 677         struct strbuf sb = STRBUF_INIT;
 678         if (strbuf_getcwd(&sb))
 679                 die_errno(_("unable to get current working directory"));
 680         return strbuf_detach(&sb, NULL);
 681 }
 682
 683 int xsnprintf(char *dst, size_t max, const char *fmt, ...)
 684 {
 685         va_list ap;
 686         int len;
 687
 688         va_start(ap, fmt);
 689         len = vsnprintf(dst, max, fmt, ap);
 690         va_end(ap);
 691
 692         if (len < 0)
 693                 BUG("your snprintf is broken");
 694         if (len >= max)
 695                 BUG("attempt to snprintf into too-small buffer");
 696         return len;
 697 }
 698
 699 void write_file_buf(const char *path, const char *buf, size_t len)
 700 {
 701         int fd = xopen(path, O_WRONLY | O_CREAT | O_TRUNC, 0666);
 702         if (write_in_full(fd, buf, len) < 0)
 703                 die_errno(_("could not write to '%s'"), path);
 704         if (close(fd))
 705                 die_errno(_("could not close '%s'"), path);
 706 }
 707
 708 void write_file(const char *path, const char *fmt, ...)
 709 {
 710         va_list params;
 711         struct strbuf sb = STRBUF_INIT;
 712
 713         va_start(params, fmt);
 714         strbuf_vaddf(&sb, fmt, params);
 715         va_end(params);
 716
 717         strbuf_complete_line(&sb);
 718
 719         write_file_buf(path, sb.buf, sb.len);
 720         strbuf_release(&sb);
 721 }
 722
 723 void sleep_millisec(int millisec)
 724 {
 725         poll(NULL, 0, millisec);
 726 }
 727
 728 int xgethostname(char *buf, size_t len)
 729 {
 730         /*
 731          * If the full hostname doesn't fit in buf, POSIX does not
 732          * specify whether the buffer will be null-terminated, so to
 733          * be safe, do it ourselves.
 734          */
 735         int ret = gethostname(buf, len);
 736         if (!ret)
 737                 buf[len - 1] = 0;
 738         return ret;
 739 }
 740
 741 int is_empty_or_missing_file(const char *filename)
 742 {
 743         struct stat st;
 744
 745         if (stat(filename, &st) < 0) {
 746                 if (errno == ENOENT)
 747                         return 1;
 748                 die_errno(_("could not stat %s"), filename);
 749         }
 750
 751         return !st.st_size;
 752 }
 753
 754 int open_nofollow(const char *path, int flags)
 755 {
 756 #ifdef O_NOFOLLOW
 757         return open(path, flags | O_NOFOLLOW);
 758 #else
 759         struct stat st;
 760         if (lstat(path, &st) < 0)
 761                 return -1;
 762         if (S_ISLNK(st.st_mode)) {
 763                 errno = ELOOP;
 764                 return -1;
 765         }
 766         return open(path, flags);
 767 #endif
 768 }
 769
 770 int csprng_bytes(void *buf, size_t len)
 771 {
 772 #if defined(HAVE_ARC4RANDOM) || defined(HAVE_ARC4RANDOM_LIBBSD)
 773         /* This function never returns an error. */
 774         arc4random_buf(buf, len);
 775         return 0;
 776 #elif defined(HAVE_GETRANDOM)
 777         ssize_t res;
 778         char *p = buf;
 779         while (len) {
 780                 res = getrandom(p, len, 0);
 781                 if (res < 0)
 782                         return -1;
 783                 len -= res;
 784                 p += res;
 785         }
 786         return 0;
 787 #elif defined(HAVE_GETENTROPY)
 788         int res;
 789         char *p = buf;
 790         while (len) {
 791                 /* getentropy has a maximum size of 256 bytes. */
 792                 size_t chunk = len < 256 ? len : 256;
 793                 res = getentropy(p, chunk);
 794                 if (res < 0)
 795                         return -1;
 796                 len -= chunk;
 797                 p += chunk;
 798         }
 799         return 0;
 800 #elif defined(HAVE_RTLGENRANDOM)
 801         if (!RtlGenRandom(buf, len))
 802                 return -1;
 803         return 0;
 804 #elif defined(HAVE_OPENSSL_CSPRNG)
 805         int res = RAND_bytes(buf, len);
 806         if (res == 1)
 807                 return 0;
 808         if (res == -1)
 809                 errno = ENOTSUP;
 810         else
 811                 errno = EIO;
 812         return -1;
 813 #else
 814         ssize_t res;
 815         char *p = buf;
 816         int fd, err;
 817         fd = open("/dev/urandom", O_RDONLY);
 818         if (fd < 0)
 819                 return -1;
 820         while (len) {
 821                 res = xread(fd, p, len);
 822                 if (res < 0) {
 823                         err = errno;
 824                         close(fd);
 825                         errno = err;
 826                         return -1;
 827                 }
 828                 len -= res;
 829                 p += res;
 830         }
 831         close(fd);
 832         return 0;
 833 #endif
 834 }