src/random.cpp

   1 // Copyright (c) 2009-2010 Satoshi Nakamoto
   2 // Copyright (c) 2009-2016 The Bitcoin Core developers
   3 // Distributed under the MIT software license, see the accompanying
   4 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
   5
   6 #include "random.h"
   7
   8 #include "crypto/sha512.h"
   9 #include "support/cleanse.h"
  10 #ifdef WIN32
  11 #include "compat.h" // for Windows API
  12 #include <wincrypt.h>
  13 #endif
  14 #include "util.h"             // for LogPrint()
  15 #include "utilstrencodings.h" // for GetTime()
  16
  17 #include <stdlib.h>
  18 #include <limits>
  19
  20 #ifndef WIN32
  21 #include <sys/time.h>
  22 #endif
  23
  24 #ifdef HAVE_SYS_GETRANDOM
  25 #include <sys/syscall.h>
  26 #include <linux/random.h>
  27 #endif
  28 #ifdef HAVE_GETENTROPY
  29 #include <unistd.h>
  30 #endif
  31 #ifdef HAVE_SYSCTL_ARND
  32 #include <sys/sysctl.h>
  33 #endif
  34
  35 #include <openssl/err.h>
  36 #include <openssl/rand.h>
  37
  38 static void RandFailure()
  39 {
  40     LogPrintf("Failed to read randomness, aborting\n");
  41     abort();
  42 }
  43
  44 static inline int64_t GetPerformanceCounter()
  45 {
  46     int64_t nCounter = 0;
  47 #ifdef WIN32
  48     QueryPerformanceCounter((LARGE_INTEGER*)&nCounter);
  49 #else
  50     timeval t;
  51     gettimeofday(&t, NULL);
  52     nCounter = (int64_t)(t.tv_sec * 1000000 + t.tv_usec);
  53 #endif
  54     return nCounter;
  55 }
  56
  57 void RandAddSeed()
  58 {
  59     // Seed with CPU performance counter
  60     int64_t nCounter = GetPerformanceCounter();
  61     RAND_add(&nCounter, sizeof(nCounter), 1.5);
  62     memory_cleanse((void*)&nCounter, sizeof(nCounter));
  63 }
  64
  65 static void RandAddSeedPerfmon()
  66 {
  67     RandAddSeed();
  68
  69 #ifdef WIN32
  70     // Don't need this on Linux, OpenSSL automatically uses /dev/urandom
  71     // Seed with the entire set of perfmon data
  72
  73     // This can take up to 2 seconds, so only do it every 10 minutes
  74     static int64_t nLastPerfmon;
  75     if (GetTime() < nLastPerfmon + 10 * 60)
  76         return;
  77     nLastPerfmon = GetTime();
  78
  79     std::vector<unsigned char> vData(250000, 0);
  80     long ret = 0;
  81     unsigned long nSize = 0;
  82     const size_t nMaxSize = 10000000; // Bail out at more than 10MB of performance data
  83     while (true) {
  84         nSize = vData.size();
  85         ret = RegQueryValueExA(HKEY_PERFORMANCE_DATA, "Global", NULL, NULL, vData.data(), &nSize);
  86         if (ret != ERROR_MORE_DATA || vData.size() >= nMaxSize)
  87             break;
  88         vData.resize(std::max((vData.size() * 3) / 2, nMaxSize)); // Grow size of buffer exponentially
  89     }
  90     RegCloseKey(HKEY_PERFORMANCE_DATA);
  91     if (ret == ERROR_SUCCESS) {
  92         RAND_add(vData.data(), nSize, nSize / 100.0);
  93         memory_cleanse(vData.data(), nSize);
  94         LogPrint(BCLog::RAND, "%s: %lu bytes\n", __func__, nSize);
  95     } else {
  96         static bool warned = false; // Warn only once
  97         if (!warned) {
  98             LogPrintf("%s: Warning: RegQueryValueExA(HKEY_PERFORMANCE_DATA) failed with code %i\n", __func__, ret);
  99             warned = true;
 100         }
 101     }
 102 #endif
 103 }
 104
 105 #ifndef WIN32
 106 /** Fallback: get 32 bytes of system entropy from /dev/urandom. The most
 107  * compatible way to get cryptographic randomness on UNIX-ish platforms.
 108  */
 109 void GetDevURandom(unsigned char *ent32)
 110 {
 111     int f = open("/dev/urandom", O_RDONLY);
 112     if (f == -1) {
 113         RandFailure();
 114     }
 115     int have = 0;
 116     do {
 117         ssize_t n = read(f, ent32 + have, NUM_OS_RANDOM_BYTES - have);
 118         if (n <= 0 || n + have > NUM_OS_RANDOM_BYTES) {
 119             RandFailure();
 120         }
 121         have += n;
 122     } while (have < NUM_OS_RANDOM_BYTES);
 123     close(f);
 124 }
 125 #endif
 126
 127 /** Get 32 bytes of system entropy. */
 128 void GetOSRand(unsigned char *ent32)
 129 {
 130 #if defined(WIN32)
 131     HCRYPTPROV hProvider;
 132     int ret = CryptAcquireContextW(&hProvider, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT);
 133     if (!ret) {
 134         RandFailure();
 135     }
 136     ret = CryptGenRandom(hProvider, NUM_OS_RANDOM_BYTES, ent32);
 137     if (!ret) {
 138         RandFailure();
 139     }
 140     CryptReleaseContext(hProvider, 0);
 141 #elif defined(HAVE_SYS_GETRANDOM)
 142     /* Linux. From the getrandom(2) man page:
 143      * "If the urandom source has been initialized, reads of up to 256 bytes
 144      * will always return as many bytes as requested and will not be
 145      * interrupted by signals."
 146      */
 147     int rv = syscall(SYS_getrandom, ent32, NUM_OS_RANDOM_BYTES, 0);
 148     if (rv != NUM_OS_RANDOM_BYTES) {
 149         if (rv < 0 && errno == ENOSYS) {
 150             /* Fallback for kernel <3.17: the return value will be -1 and errno
 151              * ENOSYS if the syscall is not available, in that case fall back
 152              * to /dev/urandom.
 153              */
 154             GetDevURandom(ent32);
 155         } else {
 156             RandFailure();
 157         }
 158     }
 159 #elif defined(HAVE_GETENTROPY)
 160     /* On OpenBSD this can return up to 256 bytes of entropy, will return an
 161      * error if more are requested.
 162      * The call cannot return less than the requested number of bytes.
 163      */
 164     if (getentropy(ent32, NUM_OS_RANDOM_BYTES) != 0) {
 165         RandFailure();
 166     }
 167 #elif defined(HAVE_SYSCTL_ARND)
 168     /* FreeBSD and similar. It is possible for the call to return less
 169      * bytes than requested, so need to read in a loop.
 170      */
 171     static const int name[2] = {CTL_KERN, KERN_ARND};
 172     int have = 0;
 173     do {
 174         size_t len = NUM_OS_RANDOM_BYTES - have;
 175         if (sysctl(name, ARRAYLEN(name), ent32 + have, &len, NULL, 0) != 0) {
 176             RandFailure();
 177         }
 178         have += len;
 179     } while (have < NUM_OS_RANDOM_BYTES);
 180 #else
 181     /* Fall back to /dev/urandom if there is no specific method implemented to
 182      * get system entropy for this OS.
 183      */
 184     GetDevURandom(ent32);
 185 #endif
 186 }
 187
 188 void GetRandBytes(unsigned char* buf, int num)
 189 {
 190     if (RAND_bytes(buf, num) != 1) {
 191         RandFailure();
 192     }
 193 }
 194
 195 void GetStrongRandBytes(unsigned char* out, int num)
 196 {
 197     assert(num <= 32);
 198     CSHA512 hasher;
 199     unsigned char buf[64];
 200
 201     // First source: OpenSSL's RNG
 202     RandAddSeedPerfmon();
 203     GetRandBytes(buf, 32);
 204     hasher.Write(buf, 32);
 205
 206     // Second source: OS RNG
 207     GetOSRand(buf);
 208     hasher.Write(buf, 32);
 209
 210     // Produce output
 211     hasher.Finalize(buf);
 212     memcpy(out, buf, num);
 213     memory_cleanse(buf, 64);
 214 }
 215
 216 uint64_t GetRand(uint64_t nMax)
 217 {
 218     if (nMax == 0)
 219         return 0;
 220
 221     // The range of the random source must be a multiple of the modulus
 222     // to give every possible output value an equal possibility
 223     uint64_t nRange = (std::numeric_limits<uint64_t>::max() / nMax) * nMax;
 224     uint64_t nRand = 0;
 225     do {
 226         GetRandBytes((unsigned char*)&nRand, sizeof(nRand));
 227     } while (nRand >= nRange);
 228     return (nRand % nMax);
 229 }
 230
 231 int GetRandInt(int nMax)
 232 {
 233     return GetRand(nMax);
 234 }
 235
 236 uint256 GetRandHash()
 237 {
 238     uint256 hash;
 239     GetRandBytes((unsigned char*)&hash, sizeof(hash));
 240     return hash;
 241 }
 242
 243 void FastRandomContext::RandomSeed()
 244 {
 245     uint256 seed = GetRandHash();
 246     rng.SetKey(seed.begin(), 32);
 247     requires_seed = false;
 248 }
 249
 250 FastRandomContext::FastRandomContext(const uint256& seed) : requires_seed(false), bytebuf_size(0), bitbuf_size(0)
 251 {
 252     rng.SetKey(seed.begin(), 32);
 253 }
 254
 255 bool Random_SanityCheck()
 256 {
 257     /* This does not measure the quality of randomness, but it does test that
 258      * OSRandom() overwrites all 32 bytes of the output given a maximum
 259      * number of tries.
 260      */
 261     static const ssize_t MAX_TRIES = 1024;
 262     uint8_t data[NUM_OS_RANDOM_BYTES];
 263     bool overwritten[NUM_OS_RANDOM_BYTES] = {}; /* Tracks which bytes have been overwritten at least once */
 264     int num_overwritten;
 265     int tries = 0;
 266     /* Loop until all bytes have been overwritten at least once, or max number tries reached */
 267     do {
 268         memset(data, 0, NUM_OS_RANDOM_BYTES);
 269         GetOSRand(data);
 270         for (int x=0; x < NUM_OS_RANDOM_BYTES; ++x) {
 271             overwritten[x] |= (data[x] != 0);
 272         }
 273
 274         num_overwritten = 0;
 275         for (int x=0; x < NUM_OS_RANDOM_BYTES; ++x) {
 276             if (overwritten[x]) {
 277                 num_overwritten += 1;
 278             }
 279         }
 280
 281         tries += 1;
 282     } while (num_overwritten < NUM_OS_RANDOM_BYTES && tries < MAX_TRIES);
 283     return (num_overwritten == NUM_OS_RANDOM_BYTES); /* If this failed, bailed out after too many tries */
 284 }
 285
 286 FastRandomContext::FastRandomContext(bool fDeterministic) : requires_seed(!fDeterministic), bytebuf_size(0), bitbuf_size(0)
 287 {
 288     if (!fDeterministic) {
 289         return;
 290     }
 291     uint256 seed;
 292     rng.SetKey(seed.begin(), 32);
 293 }