6 #include "safe_memclear.h"
19 #include <openssl/rand.h>
21 #ifdef HAVE_LINUX_RANDOM_H
22 #include <sys/syscall.h>
23 #include <linux/random.h>
26 #include <sys/ioctl.h>
29 /* Take some reasonable steps to attempt to *seed* random number generators with
30 * cryptographically random data. Some of these initialization routines may
31 * block, and are intended to be called only at startup in lighttpd, or
32 * immediately after fork() to start lighttpd workers.
34 * Note: results from li_rand_pseudo_bytes() are not necessarily
35 * cryptographically random and must not be used for purposes such
36 * as key generation which require cryptographic randomness.
38 * https://wiki.openssl.org/index.php/Random_Numbers
39 * https://wiki.openssl.org/index.php/Random_fork-safety
41 * openssl random number generators are not thread-safe by default
42 * https://wiki.openssl.org/index.php/Manual:Threads(3)
44 * RFE: add more paranoid checks from the following to improve confidence:
45 * http://insanecoding.blogspot.co.uk/2014/05/a-good-idea-with-bad-usage-devurandom.html
47 * RFE: check RAND_status()
50 static int li_getentropy (void *buf
, size_t buflen
)
52 #ifdef HAVE_GETENTROPY
53 return getentropy(buf
, buflen
);
55 /*(see NOTES section in 'man getrandom' on Linux)*/
56 #if defined(HAVE_GETRANDOM) || defined(SYS_getrandom)
58 #ifdef HAVE_GETRANDOM /*(not implemented in glibc yet)*/
59 int num
= getrandom(buf
, buflen
, 0);
60 #elif defined(SYS_getrandom)
61 /* https://lwn.net/Articles/605828/ */
62 /* https://bbs.archlinux.org/viewtopic.php?id=200039 */
63 int num
= (int)syscall(SYS_getrandom
, buf
, buflen
, 0);
65 if (num
== (int)buflen
) return 0;
66 if (num
< 0) return num
; /* -1 */
77 static int li_rand_device_bytes (unsigned char *buf
, int num
)
79 /* randomness from these devices is cryptographically strong,
80 * unless /dev/urandom is low on entropy */
82 static const char * const devices
[] = {
90 /* device files might not be available in chroot environment,
91 * so prefer syscall, if available */
92 if (0 == li_getentropy(buf
, (size_t)num
)) return 1;
94 for (unsigned int u
= 0; u
< sizeof(devices
)/sizeof(devices
[0]); ++u
) {
95 /*(some systems might have symlink to another device; omit O_NOFOLLOW)*/
96 int fd
= fdevent_open_cloexec(devices
[u
], O_RDONLY
, 0);
101 if (0 == ioctl(fd
, RNDGETENTCNT
, &entropy
) && entropy
>= num
*8)
103 rd
= read(fd
, buf
, (size_t)num
);
114 static unsigned short xsubi
[3];
116 void li_rand_reseed (void)
118 /* (intended to be called at init and after fork() in order to re-seed PRNG
119 * so that forked children, grandchildren, etc do not share PRNG seed)
120 * https://github.com/ramsey/uuid/issues/80
121 * https://www.agwa.name/blog/post/libressls_prng_is_unsafe_on_linux
122 * (issue in early version of libressl has since been fixed)
123 * https://github.com/libressl-portable/portable/commit/32d9eeeecf4e951e1566d5f4a42b36ea37b60f35
126 if (1 == li_rand_device_bytes((unsigned char *)xsubi
, (int)sizeof(xsubi
))) {
127 u
= ((unsigned int)xsubi
[0] << 16) | xsubi
[1];
130 #ifdef HAVE_ARC4RANDOM_BUF
132 arc4random_buf(xsubi
, sizeof(xsubi
));
134 /* NOTE: not cryptographically random !!! */
135 srand((unsigned int)(time(NULL
) ^ getpid()));
136 for (u
= 0; u
< sizeof(unsigned short); ++u
)
137 /* coverity[dont_call : FALSE] */
138 xsubi
[u
] = (unsigned short)(rand() & 0xFFFF);
139 u
= ((unsigned int)xsubi
[0] << 16) | xsubi
[1];
142 srand(u
); /*(initialize just in case rand() used elsewhere)*/
144 srandom(u
); /*(initialize just in case random() used elsewhere)*/
148 RAND_seed(xsubi
, (int)sizeof(xsubi
));
152 int li_rand_pseudo_bytes (void)
154 /* randomness *is not* cryptographically strong */
155 /* (attempt to use better mechanisms to replace the more portable rand()) */
156 #ifdef USE_OPENSSL /* (RAND_pseudo_bytes() is deprecated in openssl 1.1.0) */
157 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
159 if (-1 != RAND_pseudo_bytes((unsigned char *)&i
, sizeof(i
))) return i
;
162 #ifdef HAVE_ARC4RANDOM_BUF
163 return (int)arc4random();
164 #elif defined(HAVE_SRANDOM)
165 /* coverity[dont_call : FALSE] */
166 return (int)random();
167 #elif defined(HAVE_JRAND48)
168 /*(FYI: jrand48() reentrant, but use of file-scoped static xsubi[] is not)*/
169 /* coverity[dont_call : FALSE] */
170 return (int)jrand48(xsubi
);
172 /* coverity[dont_call : FALSE] */
177 int li_rand_bytes (unsigned char *buf
, int num
)
180 int rc
= RAND_bytes(buf
, num
);
185 if (1 == li_rand_device_bytes(buf
, num
)) {
189 /* NOTE: not cryptographically random !!! */
190 for (int i
= 0; i
< num
; ++i
)
191 buf
[i
] = li_rand_pseudo_bytes() & 0xFF;
192 /*(openssl RAND_pseudo_bytes rc for non-cryptographically random data)*/
197 void li_rand_cleanup (void)
202 safe_memclear(xsubi
, sizeof(xsubi
));