Skip to content

Commit dd10306

Browse files
newpavlovnewpavlov
committed
Merge use_file code back, use sleep-based waiting on non-Linux targets
1 parent ebecd9c commit dd10306

File tree

3 files changed

+139
-168
lines changed

3 files changed

+139
-168
lines changed

‎src/lib.rs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -298,6 +298,7 @@ cfg_if! {
298298
),
299299
))] {
300300
mod util_libc;
301+
mod use_file;
301302
mod linux_android;
302303
#[path = "linux_android_with_fallback.rs"] mod imp;
303304
} else if #[cfg(any(target_os = "android", target_os = "linux"))] {

‎src/linux_android_with_fallback.rs

Lines changed: 9 additions & 140 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,20 @@
11
//! Implementation for Linux / Android with `/dev/urandom` fallback
2-
use crate::{
3-
lazy::LazyBool,
4-
linux_android,
5-
util_libc::{last_os_error, open_readonly, sys_fill_exact},
6-
Error,
7-
};
8-
use core::{
9-
mem::MaybeUninit,
10-
sync::atomic::{AtomicI32, Ordering},
11-
};
2+
use crate::{lazy::LazyBool, linux_android, use_file, util_libc::last_os_error, Error};
3+
use core::mem::MaybeUninit;
124

135
pub fn getrandom_inner(dest: &mut [MaybeUninit<u8>]) -> Result<(), Error> {
146
// getrandom(2) was introduced in Linux 3.17
157
static HAS_GETRANDOM: LazyBool = LazyBool::new();
168
if HAS_GETRANDOM.unsync_init(is_getrandom_available) {
179
linux_android::getrandom_inner(dest)
1810
} else {
19-
use_file(dest)
11+
// prevent inlining of the fallback implementation
12+
#[inline(never)]
13+
fn inner(dest: &mut [MaybeUninit<u8>]) -> Result<(), Error> {
14+
use_file::getrandom_inner(dest)
15+
}
16+
17+
inner(dest)
2018
}
2119
}
2220

@@ -35,132 +33,3 @@ fn is_getrandom_available() -> bool {
3533
true
3634
}
3735
}
38-
39-
// File descriptor is a "nonnegative integer" as per `open` man.
40-
const FD_UNINIT: libc::c_int = -1;
41-
const FD_ONGOING_INIT: libc::c_int = -2;
42-
43-
// See comment for `FD` in use_file.rs
44-
static FD: AtomicI32 = AtomicI32::new(FD_UNINIT);
45-
46-
pub fn use_file(dest: &mut [MaybeUninit<u8>]) -> Result<(), Error> {
47-
let mut fd = FD.load(Ordering::Acquire);
48-
if fd == FD_UNINIT || fd == FD_ONGOING_INIT {
49-
fd = open_or_wait()?;
50-
}
51-
sys_fill_exact(dest, |buf| unsafe {
52-
libc::read(fd, buf.as_mut_ptr().cast(), buf.len())
53-
})
54-
}
55-
56-
#[cold]
57-
pub(super) fn open_or_wait() -> Result<libc::c_int, Error> {
58-
loop {
59-
match FD.load(Ordering::Acquire) {
60-
FD_UNINIT => {
61-
let res = FD.compare_exchange_weak(
62-
FD_UNINIT,
63-
FD_ONGOING_INIT,
64-
Ordering::AcqRel,
65-
Ordering::Relaxed,
66-
);
67-
if res.is_ok() {
68-
break;
69-
}
70-
}
71-
FD_ONGOING_INIT => futex_wait(),
72-
fd => return Ok(fd),
73-
}
74-
}
75-
76-
let res = open_fd();
77-
let val = match res {
78-
Ok(fd) => fd,
79-
Err(_) => FD_UNINIT,
80-
};
81-
FD.store(val, Ordering::Release);
82-
futex_wake();
83-
res
84-
}
85-
86-
fn futex_wait() {
87-
let op = libc::FUTEX_WAIT | libc::FUTEX_PRIVATE_FLAG;
88-
let timeout_ptr = core::ptr::null::<libc::timespec>();
89-
let ret = unsafe { libc::syscall(libc::SYS_futex, &FD, op, FD_ONGOING_INIT, timeout_ptr) };
90-
// FUTEX_WAIT should return either 0 or EAGAIN error
91-
debug_assert!({
92-
match ret {
93-
0 => true,
94-
-1 => last_os_error().raw_os_error() == Some(libc::EAGAIN),
95-
_ => false,
96-
}
97-
});
98-
}
99-
100-
fn futex_wake() {
101-
let op = libc::FUTEX_WAKE | libc::FUTEX_PRIVATE_FLAG;
102-
let ret = unsafe { libc::syscall(libc::SYS_futex, &FD, op, libc::INT_MAX) };
103-
debug_assert!(ret >= 0);
104-
}
105-
106-
fn open_fd() -> Result<libc::c_int, Error> {
107-
wait_until_rng_ready()?;
108-
// "/dev/urandom is preferred and sufficient in all use cases"
109-
let fd = open_readonly(b"/dev/urandom\0")?;
110-
debug_assert!(fd >= 0);
111-
Ok(fd)
112-
}
113-
114-
// Polls /dev/random to make sure it is ok to read from /dev/urandom.
115-
//
116-
// Polling avoids draining the estimated entropy from /dev/random;
117-
// short-lived processes reading even a single byte from /dev/random could
118-
// be problematic if they are being executed faster than entropy is being
119-
// collected.
120-
//
121-
// OTOH, reading a byte instead of polling is more compatible with
122-
// sandboxes that disallow `poll()` but which allow reading /dev/random,
123-
// e.g. sandboxes that assume that `poll()` is for network I/O. This way,
124-
// fewer applications will have to insert pre-sandbox-initialization logic.
125-
// Often (blocking) file I/O is not allowed in such early phases of an
126-
// application for performance and/or security reasons.
127-
//
128-
// It is hard to write a sandbox policy to support `libc::poll()` because
129-
// it may invoke the `poll`, `ppoll`, `ppoll_time64` (since Linux 5.1, with
130-
// newer versions of glibc), and/or (rarely, and probably only on ancient
131-
// systems) `select`. depending on the libc implementation (e.g. glibc vs
132-
// musl), libc version, potentially the kernel version at runtime, and/or
133-
// the target architecture.
134-
//
135-
// BoringSSL and libstd don't try to protect against insecure output from
136-
// `/dev/urandom'; they don't open `/dev/random` at all.
137-
//
138-
// OpenSSL uses `libc::select()` unless the `dev/random` file descriptor
139-
// is too large; if it is too large then it does what we do here.
140-
//
141-
// libsodium uses `libc::poll` similarly to this.
142-
fn wait_until_rng_ready() -> Result<(), Error> {
143-
let fd = open_readonly(b"/dev/random\0")?;
144-
let mut pfd = libc::pollfd {
145-
fd,
146-
events: libc::POLLIN,
147-
revents: 0,
148-
};
149-
150-
let res = loop {
151-
// A negative timeout means an infinite timeout.
152-
let res = unsafe { libc::poll(&mut pfd, 1, -1) };
153-
if res >= 0 {
154-
// We only used one fd, and cannot timeout.
155-
debug_assert_eq!(res, 1);
156-
break Ok(());
157-
}
158-
let err = last_os_error();
159-
match err.raw_os_error() {
160-
Some(libc::EINTR) | Some(libc::EAGAIN) => continue,
161-
_ => break Err(err),
162-
}
163-
};
164-
unsafe { libc::close(fd) };
165-
res
166-
}

‎src/use_file.rs

Lines changed: 129 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -4,21 +4,22 @@ use crate::{
44
Error,
55
};
66
use core::{
7-
cell::UnsafeCell,
87
ffi::c_void,
98
mem::MaybeUninit,
109
sync::atomic::{AtomicI32, Ordering},
1110
};
1211

1312
/// For all platforms, we use `/dev/urandom` rather than `/dev/random`.
1413
/// For more information see the linked man pages in lib.rs.
14+
/// - On Linux, "/dev/urandom is preferred and sufficient in all use cases".
1515
/// - On Redox, only /dev/urandom is provided.
1616
/// - On AIX, /dev/urandom will "provide cryptographically secure output".
1717
/// - On Haiku and QNX Neutrino they are identical.
1818
const FILE_PATH: &[u8] = b"/dev/urandom\0";
1919

20-
// std::os::fd::{BorrowedFd, OwnedFd} guarantee that -1 is not a valid file descriptor.
20+
// File descriptor is a "nonnegative integer", so we can safely use negative sentinel values.
2121
const FD_UNINIT: libc::c_int = -1;
22+
const FD_ONGOING_INIT: libc::c_int = -2;
2223

2324
// In theory `libc::c_int` could be something other than `i32`, but for the
2425
// targets we currently support that use `use_file`, it is always `i32`.
@@ -36,11 +37,9 @@ const FD_UNINIT: libc::c_int = -1;
3637
// `Ordering::Acquire` to synchronize with it.
3738
static FD: AtomicI32 = AtomicI32::new(FD_UNINIT);
3839

39-
static FD_MUTEX: Mutex = Mutex::new();
40-
4140
pub fn getrandom_inner(dest: &mut [MaybeUninit<u8>]) -> Result<(), Error> {
4241
let mut fd = FD.load(Ordering::Acquire);
43-
if fd == FD_UNINIT {
42+
if fd == FD_UNINIT || fd == FD_ONGOING_INIT {
4443
fd = open_or_wait()?;
4544
}
4645
sys_fill_exact(dest, |buf| unsafe {
@@ -50,40 +49,142 @@ pub fn getrandom_inner(dest: &mut [MaybeUninit<u8>]) -> Result<(), Error> {
5049

5150
#[cold]
5251
fn open_or_wait() -> Result<libc::c_int, Error> {
53-
let _guard = FD_MUTEX.lock();
54-
let fd = match FD.load(Ordering::Acquire) {
55-
FD_UNINIT => {
56-
let fd = open_readonly(FILE_PATH)?;
57-
FD.store(fd, Ordering::Release);
58-
fd
52+
loop {
53+
match FD.load(Ordering::Acquire) {
54+
FD_UNINIT => {
55+
let res = FD.compare_exchange_weak(
56+
FD_UNINIT,
57+
FD_ONGOING_INIT,
58+
Ordering::AcqRel,
59+
Ordering::Relaxed,
60+
);
61+
if res.is_ok() {
62+
break;
63+
}
64+
}
65+
FD_ONGOING_INIT => sync::wait(),
66+
fd => return Ok(fd),
5967
}
60-
fd => fd,
68+
}
69+
70+
let res = open_fd();
71+
let val = match res {
72+
Ok(fd) => fd,
73+
Err(_) => FD_UNINIT,
6174
};
75+
FD.store(val, Ordering::Release);
76+
sync::wake();
77+
res
78+
}
79+
80+
fn open_fd() -> Result<libc::c_int, Error> {
81+
#[cfg(any(target_os = "android", target_os = "linux"))]
82+
sync::wait_until_rng_ready()?;
83+
let fd = open_readonly(FILE_PATH)?;
6284
debug_assert!(fd >= 0);
6385
Ok(fd)
6486
}
6587

66-
struct Mutex(UnsafeCell<libc::pthread_mutex_t>);
67-
68-
impl Mutex {
69-
const fn new() -> Self {
70-
Self(UnsafeCell::new(libc::PTHREAD_MUTEX_INITIALIZER))
88+
#[cfg(not(any(target_os = "android", target_os = "linux")))]
89+
mod sync {
90+
// On non-Linux targets the critical section only opens file,
91+
// which should not block, so in the unlikely contended case,
92+
// we can sleep-wait for the opening operation to finish.
93+
pub(super) fn wait() {
94+
let rqtp = libc::timespec {
95+
tv_sec: 0,
96+
tv_nsec: 1_000_000,
97+
};
98+
let mut rmtp = libc::timespec {
99+
tv_sec: 0,
100+
tv_nsec: 0,
101+
};
102+
// We ignore return value since we do not care
103+
// if sleep is interrupted
104+
unsafe {
105+
libc::nanosleep(&rqtp, &mut rmtp);
106+
}
71107
}
72108

73-
fn lock(&self) -> MutexGuard<'_> {
74-
let r = unsafe { libc::pthread_mutex_lock(self.0.get()) };
75-
debug_assert_eq!(r, 0);
76-
MutexGuard(self)
77-
}
109+
pub(super) fn wake() {}
78110
}
79111

80-
unsafe impl Sync for Mutex {}
112+
#[cfg(any(target_os = "android", target_os = "linux"))]
113+
mod sync {
114+
use super::{Error, FD, FD_ONGOING_INIT};
115+
use crate::util_libc::{last_os_error, open_readonly};
116+
117+
pub(super) fn wait() {
118+
let op = libc::FUTEX_WAIT | libc::FUTEX_PRIVATE_FLAG;
119+
let timeout_ptr = core::ptr::null::<libc::timespec>();
120+
let ret = unsafe { libc::syscall(libc::SYS_futex, &FD, op, FD_ONGOING_INIT, timeout_ptr) };
121+
// FUTEX_WAIT should return either 0 or EAGAIN error
122+
debug_assert!({
123+
match ret {
124+
0 => true,
125+
-1 => last_os_error().raw_os_error() == Some(libc::EAGAIN),
126+
_ => false,
127+
}
128+
});
129+
}
130+
131+
pub(super) fn wake() {
132+
let op = libc::FUTEX_WAKE | libc::FUTEX_PRIVATE_FLAG;
133+
let ret = unsafe { libc::syscall(libc::SYS_futex, &FD, op, libc::INT_MAX) };
134+
debug_assert!(ret >= 0);
135+
}
81136

82-
struct MutexGuard<'a>(&'a Mutex);
137+
// Polls /dev/random to make sure it is ok to read from /dev/urandom.
138+
//
139+
// Polling avoids draining the estimated entropy from /dev/random;
140+
// short-lived processes reading even a single byte from /dev/random could
141+
// be problematic if they are being executed faster than entropy is being
142+
// collected.
143+
//
144+
// OTOH, reading a byte instead of polling is more compatible with
145+
// sandboxes that disallow `poll()` but which allow reading /dev/random,
146+
// e.g. sandboxes that assume that `poll()` is for network I/O. This way,
147+
// fewer applications will have to insert pre-sandbox-initialization logic.
148+
// Often (blocking) file I/O is not allowed in such early phases of an
149+
// application for performance and/or security reasons.
150+
//
151+
// It is hard to write a sandbox policy to support `libc::poll()` because
152+
// it may invoke the `poll`, `ppoll`, `ppoll_time64` (since Linux 5.1, with
153+
// newer versions of glibc), and/or (rarely, and probably only on ancient
154+
// systems) `select`. depending on the libc implementation (e.g. glibc vs
155+
// musl), libc version, potentially the kernel version at runtime, and/or
156+
// the target architecture.
157+
//
158+
// BoringSSL and libstd don't try to protect against insecure output from
159+
// `/dev/urandom'; they don't open `/dev/random` at all.
160+
//
161+
// OpenSSL uses `libc::select()` unless the `dev/random` file descriptor
162+
// is too large; if it is too large then it does what we do here.
163+
//
164+
// libsodium uses `libc::poll` similarly to this.
165+
pub(super) fn wait_until_rng_ready() -> Result<(), Error> {
166+
let fd = open_readonly(b"/dev/random\0")?;
167+
let mut pfd = libc::pollfd {
168+
fd,
169+
events: libc::POLLIN,
170+
revents: 0,
171+
};
83172

84-
impl<'a> Drop for MutexGuard<'a> {
85-
fn drop(&mut self) {
86-
let r = unsafe { libc::pthread_mutex_unlock(self.0 .0.get()) };
87-
debug_assert_eq!(r, 0);
173+
let res = loop {
174+
// A negative timeout means an infinite timeout.
175+
let res = unsafe { libc::poll(&mut pfd, 1, -1) };
176+
if res >= 0 {
177+
// We only used one fd, and cannot timeout.
178+
debug_assert_eq!(res, 1);
179+
break Ok(());
180+
}
181+
let err = last_os_error();
182+
match err.raw_os_error() {
183+
Some(libc::EINTR) | Some(libc::EAGAIN) => continue,
184+
_ => break Err(err),
185+
}
186+
};
187+
unsafe { libc::close(fd) };
188+
res
88189
}
89190
}

0 commit comments

Comments
 (0)