1 /* Copyright (c) 2014, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #if !defined(_GNU_SOURCE)
16 #define _GNU_SOURCE // needed for syscall() on Linux.
17 #endif
18
19 #include <openssl/rand.h>
20
21 #if !defined(OPENSSL_WINDOWS) && !defined(OPENSSL_FUCHSIA) && \
22 !defined(BORINGSSL_UNSAFE_DETERMINISTIC_MODE) && !defined(OPENSSL_TRUSTY)
23
24 #include <assert.h>
25 #include <errno.h>
26 #include <fcntl.h>
27 #include <stdio.h>
28 #include <string.h>
29 #include <unistd.h>
30
31 #if defined(OPENSSL_LINUX)
32 #if defined(BORINGSSL_FIPS)
33 #include <linux/random.h>
34 #include <sys/ioctl.h>
35 #endif
36 #include <sys/syscall.h>
37 #endif
38
39 #include <openssl/thread.h>
40 #include <openssl/mem.h>
41
42 #include "internal.h"
43 #include "../delocate.h"
44 #include "../../internal.h"
45
46
47 #if defined(OPENSSL_LINUX)
48
49 #if defined(OPENSSL_X86_64)
50 #define EXPECTED_NR_getrandom 318
51 #elif defined(OPENSSL_X86)
52 #define EXPECTED_NR_getrandom 355
53 #elif defined(OPENSSL_AARCH64)
54 #define EXPECTED_NR_getrandom 278
55 #elif defined(OPENSSL_ARM)
56 #define EXPECTED_NR_getrandom 384
57 #elif defined(OPENSSL_PPC64LE)
58 #define EXPECTED_NR_getrandom 359
59 #endif
60
61 #if defined(EXPECTED_NR_getrandom)
62 #define USE_NR_getrandom
63
64 #if defined(__NR_getrandom)
65
66 #if __NR_getrandom != EXPECTED_NR_getrandom
67 #error "system call number for getrandom is not the expected value"
68 #endif
69
70 #else // __NR_getrandom
71
72 #define __NR_getrandom EXPECTED_NR_getrandom
73
74 #endif // __NR_getrandom
75
76 #endif // EXPECTED_NR_getrandom
77
78 #if !defined(GRND_NONBLOCK)
79 #define GRND_NONBLOCK 1
80 #endif
81
82 #endif // OPENSSL_LINUX
83
84 // rand_lock is used to protect the |*_requested| variables.
85 DEFINE_STATIC_MUTEX(rand_lock);
86
87 // The following constants are magic values of |urandom_fd|.
88 static const int kUnset = 0;
89 static const int kHaveGetrandom = -3;
90
91 // urandom_fd_requested is set by |RAND_set_urandom_fd|. It's protected by
92 // |rand_lock|.
93 DEFINE_BSS_GET(int, urandom_fd_requested);
94
95 // urandom_fd is a file descriptor to /dev/urandom. It's protected by |once|.
96 DEFINE_BSS_GET(int, urandom_fd);
97
98 DEFINE_STATIC_ONCE(rand_once);
99
100 #if defined(USE_NR_getrandom) || defined(BORINGSSL_FIPS)
101 // message writes |msg| to stderr. We use this because referencing |stderr|
102 // with |fprintf| generates relocations, which is a problem inside the FIPS
103 // module.
message(const char * msg)104 static void message(const char *msg) {
105 ssize_t r;
106 do {
107 r = write(2, msg, strlen(msg));
108 } while (r == -1 && errno == EINTR);
109 }
110 #endif
111
112 // init_once initializes the state of this module to values previously
113 // requested. This is the only function that modifies |urandom_fd| and
114 // |urandom_buffering|, whose values may be read safely after calling the
115 // once.
init_once(void)116 static void init_once(void) {
117 CRYPTO_STATIC_MUTEX_lock_read(rand_lock_bss_get());
118 int fd = *urandom_fd_requested_bss_get();
119 CRYPTO_STATIC_MUTEX_unlock_read(rand_lock_bss_get());
120
121 #if defined(USE_NR_getrandom)
122 uint8_t dummy;
123 long getrandom_ret =
124 syscall(__NR_getrandom, &dummy, sizeof(dummy), GRND_NONBLOCK);
125
126 if (getrandom_ret == 1) {
127 *urandom_fd_bss_get() = kHaveGetrandom;
128 return;
129 } else if (getrandom_ret == -1 && errno == EAGAIN) {
130 message(
131 "getrandom indicates that the entropy pool has not been initialized. "
132 "Rather than continue with poor entropy, this process will block until "
133 "entropy is available.\n");
134
135 do {
136 getrandom_ret =
137 syscall(__NR_getrandom, &dummy, sizeof(dummy), 0 /* no flags */);
138 } while (getrandom_ret == -1 && errno == EINTR);
139
140 if (getrandom_ret == 1) {
141 *urandom_fd_bss_get() = kHaveGetrandom;
142 return;
143 }
144 }
145 #endif // USE_NR_getrandom
146
147 if (fd == kUnset) {
148 do {
149 fd = open("/dev/urandom", O_RDONLY);
150 } while (fd == -1 && errno == EINTR);
151 }
152
153 if (fd < 0) {
154 abort();
155 }
156
157 assert(kUnset == 0);
158 if (fd == kUnset) {
159 // Because we want to keep |urandom_fd| in the BSS, we have to initialise
160 // it to zero. But zero is a valid file descriptor too. Thus if open
161 // returns zero for /dev/urandom, we dup it to get a non-zero number.
162 fd = dup(fd);
163 close(kUnset);
164
165 if (fd <= 0) {
166 abort();
167 }
168 }
169
170 #if defined(BORINGSSL_FIPS)
171 // In FIPS mode we ensure that the kernel has sufficient entropy before
172 // continuing. This is automatically handled by getrandom, which requires
173 // that the entropy pool has been initialised, but for urandom we have to
174 // poll.
175 for (;;) {
176 int entropy_bits;
177 if (ioctl(fd, RNDGETENTCNT, &entropy_bits)) {
178 message(
179 "RNDGETENTCNT on /dev/urandom failed. We cannot continue in this "
180 "case when in FIPS mode.\n");
181 abort();
182 }
183
184 static const int kBitsNeeded = 256;
185 if (entropy_bits >= kBitsNeeded) {
186 break;
187 }
188
189 usleep(250000);
190 }
191 #endif
192
193 int flags = fcntl(fd, F_GETFD);
194 if (flags == -1) {
195 // Native Client doesn't implement |fcntl|.
196 if (errno != ENOSYS) {
197 abort();
198 }
199 } else {
200 flags |= FD_CLOEXEC;
201 if (fcntl(fd, F_SETFD, flags) == -1) {
202 abort();
203 }
204 }
205 *urandom_fd_bss_get() = fd;
206 }
207
RAND_set_urandom_fd(int fd)208 void RAND_set_urandom_fd(int fd) {
209 fd = dup(fd);
210 if (fd < 0) {
211 abort();
212 }
213
214 assert(kUnset == 0);
215 if (fd == kUnset) {
216 // Because we want to keep |urandom_fd| in the BSS, we have to initialise
217 // it to zero. But zero is a valid file descriptor too. Thus if dup
218 // returned zero we dup it again to get a non-zero number.
219 fd = dup(fd);
220 close(kUnset);
221
222 if (fd <= 0) {
223 abort();
224 }
225 }
226
227 CRYPTO_STATIC_MUTEX_lock_write(rand_lock_bss_get());
228 *urandom_fd_requested_bss_get() = fd;
229 CRYPTO_STATIC_MUTEX_unlock_write(rand_lock_bss_get());
230
231 CRYPTO_once(rand_once_bss_get(), init_once);
232 if (*urandom_fd_bss_get() == kHaveGetrandom) {
233 close(fd);
234 } else if (*urandom_fd_bss_get() != fd) {
235 abort(); // Already initialized.
236 }
237 }
238
239 #if defined(USE_NR_getrandom) && defined(OPENSSL_MSAN)
240 void __msan_unpoison(void *, size_t);
241 #endif
242
243 // fill_with_entropy writes |len| bytes of entropy into |out|. It returns one
244 // on success and zero on error.
fill_with_entropy(uint8_t * out,size_t len)245 static char fill_with_entropy(uint8_t *out, size_t len) {
246 while (len > 0) {
247 ssize_t r;
248
249 if (*urandom_fd_bss_get() == kHaveGetrandom) {
250 #if defined(USE_NR_getrandom)
251 do {
252 r = syscall(__NR_getrandom, out, len, 0 /* no flags */);
253 } while (r == -1 && errno == EINTR);
254
255 #if defined(OPENSSL_MSAN)
256 if (r > 0) {
257 // MSAN doesn't recognise |syscall| and thus doesn't notice that we
258 // have initialised the output buffer.
259 __msan_unpoison(out, r);
260 }
261 #endif // OPENSSL_MSAN
262
263 #else // USE_NR_getrandom
264 abort();
265 #endif
266 } else {
267 do {
268 r = read(*urandom_fd_bss_get(), out, len);
269 } while (r == -1 && errno == EINTR);
270 }
271
272 if (r <= 0) {
273 return 0;
274 }
275 out += r;
276 len -= r;
277 }
278
279 return 1;
280 }
281
282 // CRYPTO_sysrand puts |requested| random bytes into |out|.
CRYPTO_sysrand(uint8_t * out,size_t requested)283 void CRYPTO_sysrand(uint8_t *out, size_t requested) {
284 if (requested == 0) {
285 return;
286 }
287
288 CRYPTO_once(rand_once_bss_get(), init_once);
289
290 if (!fill_with_entropy(out, requested)) {
291 abort();
292 }
293
294 #if defined(BORINGSSL_FIPS_BREAK_CRNG)
295 // This breaks the "continuous random number generator test" defined in FIPS
296 // 140-2, section 4.9.2, and implemented in rand_get_seed().
297 OPENSSL_memset(out, 0, requested);
298 #endif
299 }
300
301 #endif /* !OPENSSL_WINDOWS && !defined(OPENSSL_FUCHSIA) && \
302 !BORINGSSL_UNSAFE_DETERMINISTIC_MODE && !OPENSSL_TRUSTY */
303