diff options
35 files changed, 64 insertions, 2676 deletions
@@ -389,26 +389,3 @@ Copyright 2001 by Stephen L. Moshier <moshier@na-net.ornl.gov> You should have received a copy of the GNU Lesser General Public License along with this library; if not, see <https://www.gnu.org/licenses/>. */ - -sysdeps/aarch64/chacha20-aarch64.S, sysdeps/x86_64/chacha20-amd64-sse2.S, -sysdeps/x86_64/chacha20-amd64-avx2.S, and -sysdeps/powerpc/powerpc64/power8/chacha20-ppc.c, and -sysdeps/s390/s390-64/chacha20-s390x.S imports code from libgcrypt, -with the following notices: - -Copyright (C) 2017-2019 Jussi Kivilinna <jussi.kivilinna@iki.fi> - -This file is part of Libgcrypt. - -Libgcrypt is free software; you can redistribute it and/or modify -it under the terms of the GNU Lesser General Public License as -published by the Free Software Foundation; either version 2.1 of -the License, or (at your option) any later version. - -Libgcrypt is distributed in the hope that it will be useful, -but WITHOUT ANY WARRANTY; without even the implied warranty of -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -GNU Lesser General Public License for more details. - -You should have received a copy of the GNU Lesser General Public -License along with this program; if not, see <https://www.gnu.org/licenses/>. @@ -61,8 +61,8 @@ Major new features: is not defined (if __cpp_char8_t is defined, then char8_t is a builtin type). * The functions arc4random, arc4random_buf, and arc4random_uniform have been - added. The functions use a pseudo-random number generator along with - entropy from the kernel. + added. The functions wrap getrandom and/or /dev/urandom to return high- + quality randomness from the kernel. * Support for LoongArch running on Linux has been added. This port requires as least binutils 2.38, GCC 12, and Linux 5.19. Currently only hard-float diff --git a/include/stdlib.h b/include/stdlib.h index cae7f7cdf8..db51f4a4f6 100644 --- a/include/stdlib.h +++ b/include/stdlib.h @@ -152,9 +152,6 @@ __typeof (arc4random_uniform) __arc4random_uniform; libc_hidden_proto (__arc4random_uniform); extern void __arc4random_buf_internal (void *buffer, size_t len) attribute_hidden; -/* Called from the fork function to reinitialize the internal cipher state - in child process. */ -extern void __arc4random_fork_subprocess (void) attribute_hidden; extern double __strtod_internal (const char *__restrict __nptr, char **__restrict __endptr, int __group) diff --git a/manual/math.texi b/manual/math.texi index 76132e9cd5..7f0499ab8d 100644 --- a/manual/math.texi +++ b/manual/math.texi @@ -1993,17 +1993,10 @@ This section describes the random number functions provided as a GNU extension, based on OpenBSD interfaces. @Theglibc{} uses kernel entropy obtained either through @code{getrandom} -or by reading @file{/dev/urandom} to seed and periodically re-seed the -internal state. A per-thread data pool is used, which allows fast output -generation. +or by reading @file{/dev/urandom} to seed. -Although these functions provide higher random quality than ISO, BSD, and -SVID functions, these still use a Pseudo-Random generator and should not -be used in cryptographic contexts. - -The internal state is cleared and reseeded with kernel entropy on @code{fork} -and @code{_Fork}. It is not cleared on either a direct @code{clone} syscall -or when using @theglibc{} @code{syscall} function. +These functions provide higher random quality than ISO, BSD, and SVID +functions, and may be used in cryptographic contexts. The prototypes for these functions are in @file{stdlib.h}. @pindex stdlib.h diff --git a/stdlib/Makefile b/stdlib/Makefile index a900962685..f7b25c1981 100644 --- a/stdlib/Makefile +++ b/stdlib/Makefile @@ -246,7 +246,6 @@ tests := \ # tests tests-internal := \ - tst-arc4random-chacha20 \ tst-strtod1i \ tst-strtod3 \ tst-strtod4 \ @@ -256,7 +255,6 @@ tests-internal := \ # tests-internal tests-static := \ - tst-arc4random-chacha20 \ tst-secure-getenv \ # tests-static diff --git a/stdlib/arc4random.c b/stdlib/arc4random.c index 65547e79aa..e417ef624d 100644 --- a/stdlib/arc4random.c +++ b/stdlib/arc4random.c @@ -1,4 +1,4 @@ -/* Pseudo Random Number Generator based on ChaCha20. +/* Pseudo Random Number Generator Copyright (C) 2022 Free Software Foundation, Inc. This file is part of the GNU C Library. @@ -16,7 +16,6 @@ License along with the GNU C Library; if not, see <https://www.gnu.org/licenses/>. */ -#include <arc4random.h> #include <errno.h> #include <not-cancel.h> #include <stdio.h> @@ -24,53 +23,6 @@ #include <sys/mman.h> #include <sys/param.h> #include <sys/random.h> -#include <tls-internal.h> - -/* arc4random keeps two counters: 'have' is the current valid bytes not yet - consumed in 'buf' while 'count' is the maximum number of bytes until a - reseed. - - Both the initial seed and reseed try to obtain entropy from the kernel - and abort the process if none could be obtained. - - The state 'buf' improves the usage of the cipher calls, allowing to call - optimized implementations (if the architecture provides it) and minimize - function call overhead. */ - -#include <chacha20.c> - -/* Called from the fork function to reset the state. */ -void -__arc4random_fork_subprocess (void) -{ - struct arc4random_state_t *state = __glibc_tls_internal ()->rand_state; - if (state != NULL) - { - explicit_bzero (state, sizeof (*state)); - /* Force key init. */ - state->count = -1; - } -} - -/* Return the current thread random state or try to create one if there is - none available. In the case malloc can not allocate a state, arc4random - will try to get entropy with arc4random_getentropy. */ -static struct arc4random_state_t * -arc4random_get_state (void) -{ - struct arc4random_state_t *state = __glibc_tls_internal ()->rand_state; - if (state == NULL) - { - state = malloc (sizeof (struct arc4random_state_t)); - if (state != NULL) - { - /* Force key initialization on first call. */ - state->count = -1; - __glibc_tls_internal ()->rand_state = state; - } - } - return state; -} static void arc4random_getrandom_failure (void) @@ -78,106 +30,63 @@ arc4random_getrandom_failure (void) __libc_fatal ("Fatal glibc error: cannot get entropy for arc4random\n"); } -static void -arc4random_rekey (struct arc4random_state_t *state, uint8_t *rnd, size_t rndlen) +void +__arc4random_buf (void *p, size_t n) { - chacha20_crypt (state->ctx, state->buf, state->buf, sizeof state->buf); - - /* Mix optional user provided data. */ - if (rnd != NULL) - { - size_t m = MIN (rndlen, CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE); - for (size_t i = 0; i < m; i++) - state->buf[i] ^= rnd[i]; - } - - /* Immediately reinit for backtracking resistance. */ - chacha20_init (state->ctx, state->buf, state->buf + CHACHA20_KEY_SIZE); - explicit_bzero (state->buf, CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE); - state->have = sizeof (state->buf) - (CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE); -} + static int seen_initialized; + size_t l; + int fd; -static void -arc4random_getentropy (void *rnd, size_t len) -{ - if (__getrandom_nocancel (rnd, len, GRND_NONBLOCK) == len) + if (n == 0) return; - int fd = TEMP_FAILURE_RETRY (__open64_nocancel ("/dev/urandom", - O_RDONLY | O_CLOEXEC)); - if (fd != -1) + for (;;) { - uint8_t *p = rnd; - uint8_t *end = p + len; - do + l = TEMP_FAILURE_RETRY (__getrandom_nocancel (p, n, 0)); + if (l > 0) { - ssize_t ret = TEMP_FAILURE_RETRY (__read_nocancel (fd, p, end - p)); - if (ret <= 0) - arc4random_getrandom_failure (); - p += ret; + if ((size_t) l == n) + return; /* Done reading, success. */ + p = (uint8_t *) p + l; + n -= l; + continue; /* Interrupted by a signal; keep going. */ } - while (p < end); - - if (__close_nocancel (fd) == 0) - return; + else if (l < 0 && errno == ENOSYS) + break; /* No syscall, so fallback to /dev/urandom. */ + arc4random_getrandom_failure (); } - arc4random_getrandom_failure (); -} -/* Check if the thread context STATE should be reseed with kernel entropy - depending of requested LEN bytes. If there is less than requested, - the state is either initialized or reseeded, otherwise the internal - counter subtract the requested length. */ -static void -arc4random_check_stir (struct arc4random_state_t *state, size_t len) -{ - if (state->count <= len || state->count == -1) + if (atomic_load_relaxed (&seen_initialized) == 0) { - uint8_t rnd[CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE]; - arc4random_getentropy (rnd, sizeof rnd); - - if (state->count == -1) - chacha20_init (state->ctx, rnd, rnd + CHACHA20_KEY_SIZE); - else - arc4random_rekey (state, rnd, sizeof rnd); - - explicit_bzero (rnd, sizeof rnd); - - /* Invalidate the buf. */ - state->have = 0; - memset (state->buf, 0, sizeof state->buf); - state->count = CHACHA20_RESEED_SIZE; + /* Poll /dev/random as an approximation of RNG initialization. */ + struct pollfd pfd = { .events = POLLIN }; + pfd.fd = TEMP_FAILURE_RETRY ( + __open64_nocancel ("/dev/random", O_RDONLY | O_CLOEXEC | O_NOCTTY)); + if (pfd.fd < 0) + arc4random_getrandom_failure (); + if (TEMP_FAILURE_RETRY (__poll_infinity_nocancel (&pfd, 1)) < 0) + arc4random_getrandom_failure (); + if (__close_nocancel (pfd.fd) < 0) + arc4random_getrandom_failure (); + atomic_store_relaxed (&seen_initialized, 1); } - else - state->count -= len; -} -void -__arc4random_buf (void *buffer, size_t len) -{ - struct arc4random_state_t *state = arc4random_get_state (); - if (__glibc_unlikely (state == NULL)) - { - arc4random_getentropy (buffer, len); - return; - } - - arc4random_check_stir (state, len); - while (len > 0) + fd = TEMP_FAILURE_RETRY ( + __open64_nocancel ("/dev/urandom", O_RDONLY | O_CLOEXEC | O_NOCTTY)); + if (fd < 0) + arc4random_getrandom_failure (); + for (;;) { - if (state->have > 0) - { - size_t m = MIN (len, state->have); - uint8_t *ks = state->buf + sizeof (state->buf) - state->have; - memcpy (buffer, ks, m); - explicit_bzero (ks, m); - buffer += m; - len -= m; - state->have -= m; - } - if (state->have == 0) - arc4random_rekey (state, NULL, 0); + l = TEMP_FAILURE_RETRY (__read_nocancel (fd, p, n)); + if (l <= 0) + arc4random_getrandom_failure (); + if ((size_t) l == n) + break; /* Done reading, success. */ + p = (uint8_t *) p + l; + n -= l; } + if (__close_nocancel (fd) < 0) + arc4random_getrandom_failure (); } libc_hidden_def (__arc4random_buf) weak_alias (__arc4random_buf, arc4random_buf) @@ -186,22 +95,7 @@ uint32_t __arc4random (void) { uint32_t r; - - struct arc4random_state_t *state = arc4random_get_state (); - if (__glibc_unlikely (state == NULL)) - { - arc4random_getentropy (&r, sizeof (uint32_t)); - return r; - } - - arc4random_check_stir (state, sizeof (uint32_t)); - if (state->have < sizeof (uint32_t)) - arc4random_rekey (state, NULL, 0); - uint8_t *ks = state->buf + sizeof (state->buf) - state->have; - memcpy (&r, ks, sizeof (uint32_t)); - memset (ks, 0, sizeof (uint32_t)); - state->have -= sizeof (uint32_t); - + __arc4random_buf (&r, sizeof (r)); return r; } libc_hidden_def (__arc4random) diff --git a/stdlib/arc4random.h b/stdlib/arc4random.h deleted file mode 100644 index cd39389c19..0000000000 --- a/stdlib/arc4random.h +++ /dev/null @@ -1,48 +0,0 @@ -/* Arc4random definition used on TLS. - Copyright (C) 2022 Free Software Foundation, Inc. - This file is part of the GNU C Library. - - The GNU C Library is free software; you can redistribute it and/or - modify it under the terms of the GNU Lesser General Public - License as published by the Free Software Foundation; either - version 2.1 of the License, or (at your option) any later version. - - The GNU C Library is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - Lesser General Public License for more details. - - You should have received a copy of the GNU Lesser General Public - License along with the GNU C Library; if not, see - <https://www.gnu.org/licenses/>. */ - -#ifndef _CHACHA20_H -#define _CHACHA20_H - -#include <stddef.h> -#include <stdint.h> - -/* Internal ChaCha20 state. */ -#define CHACHA20_STATE_LEN 16 -#define CHACHA20_BLOCK_SIZE 64 - -/* Maximum number bytes until reseed (16 MB). */ -#define CHACHA20_RESEED_SIZE (16 * 1024 * 1024) - -/* Internal arc4random buffer, used on each feedback step so offer some - backtracking protection and to allow better used of vectorized - chacha20 implementations. */ -#define CHACHA20_BUFSIZE (8 * CHACHA20_BLOCK_SIZE) - -_Static_assert (CHACHA20_BUFSIZE >= CHACHA20_BLOCK_SIZE + CHACHA20_BLOCK_SIZE, - "CHACHA20_BUFSIZE < CHACHA20_BLOCK_SIZE + CHACHA20_BLOCK_SIZE"); - -struct arc4random_state_t -{ - uint32_t ctx[CHACHA20_STATE_LEN]; - size_t have; - size_t count; - uint8_t buf[CHACHA20_BUFSIZE]; -}; - -#endif diff --git a/stdlib/chacha20.c b/stdlib/chacha20.c deleted file mode 100644 index 2745a81315..0000000000 --- a/stdlib/chacha20.c +++ /dev/null @@ -1,191 +0,0 @@ -/* Generic ChaCha20 implementation (used on arc4random). - Copyright (C) 2022 Free Software Foundation, Inc. - This file is part of the GNU C Library. - - The GNU C Library is free software; you can redistribute it and/or - modify it under the terms of the GNU Lesser General Public - License as published by the Free Software Foundation; either - version 2.1 of the License, or (at your option) any later version. - - The GNU C Library is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - Lesser General Public License for more details. - - You should have received a copy of the GNU Lesser General Public - License along with the GNU C Library; if not, see - <https://www.gnu.org/licenses/>. */ - -#include <array_length.h> -#include <endian.h> -#include <stddef.h> -#include <stdint.h> -#include <string.h> - -/* 32-bit stream position, then 96-bit nonce. */ -#define CHACHA20_IV_SIZE 16 -#define CHACHA20_KEY_SIZE 32 - -#define CHACHA20_STATE_LEN 16 - -/* The ChaCha20 implementation is based on RFC8439 [1], omitting the final - XOR of the keystream with the plaintext because the plaintext is a - stream of zeros. */ - -enum chacha20_constants -{ - CHACHA20_CONSTANT_EXPA = 0x61707865U, - CHACHA20_CONSTANT_ND_3 = 0x3320646eU, - CHACHA20_CONSTANT_2_BY = 0x79622d32U, - CHACHA20_CONSTANT_TE_K = 0x6b206574U -}; - -static inline uint32_t -read_unaligned_32 (const uint8_t *p) -{ - uint32_t r; - memcpy (&r, p, sizeof (r)); - return r; -} - -static inline void -write_unaligned_32 (uint8_t *p, uint32_t v) -{ |