rng: split initialization in preinit and init

This makes gnutls to initialize its random generator on the
first call to gnutls_rnd(). That prevents blocking due to
getrandom() on a constructor; that change allows to use gnutls-linked
applications even in early boot in systems where getrandom() blocks
waiting for entropy.
1 parent bb894c17
......@@ -189,6 +189,7 @@ AM_SUBST_NOTMAKE([DEFINE_IOVEC_T])
dnl Need netinet/tcp.h for TCP_FASTOPEN
AC_CHECK_HEADERS([netinet/tcp.h])
AC_CHECK_HEADERS([stdatomic.h])
AC_ARG_ENABLE(padlock,
AS_HELP_STRING([--disable-padlock], [unconditionally disable padlock acceleration]),
......
......@@ -73,8 +73,7 @@ typedef struct {
} gnutls_crypto_digest_st;
typedef struct gnutls_crypto_rnd {
int (*init) (void **ctx);
int (*check) (void **ctx);
int (*init) (void **ctx); /* called prior to first usage of randomness */
int (*rnd) (void *ctx, int level, void *data, size_t datasize);
void (*rnd_refresh) (void *ctx);
void (*deinit) (void *ctx);
......
......@@ -303,7 +303,7 @@ static int _gnutls_global_init(unsigned constructor)
}
/* Initialize the random generator */
ret = _gnutls_rnd_init();
ret = _gnutls_rnd_preinit();
if (ret < 0) {
gnutls_assert();
goto out;
......
......@@ -27,6 +27,10 @@
#include "gnutls_int.h"
#include <system.h>
#ifdef HAVE_STDATOMIC_H
# include <stdatomic.h>
#endif
extern mutex_init_func gnutls_mutex_init;
extern mutex_deinit_func gnutls_mutex_deinit;
extern mutex_lock_func gnutls_mutex_lock;
......
......@@ -43,12 +43,12 @@ libcrypto_la_SOURCES = pk.c mpi.c mac.c cipher.c init.c \
int/dsa-fips.h int/dsa-keygen-fips186.c int/dsa-validate.c
if WINDOWS
libcrypto_la_SOURCES += rnd-windows.c
libcrypto_la_SOURCES += sysrnd-windows.c
else
if HAVE_GETENTROPY
libcrypto_la_SOURCES += rnd-getentropy.c
libcrypto_la_SOURCES += sysrnd-getentropy.c
else
libcrypto_la_SOURCES += rnd-linux.c
libcrypto_la_SOURCES += sysrnd-linux.c
endif
endif
......
......@@ -172,10 +172,6 @@ static int _rngfips_init(void **_ctx)
struct fips_ctx *ctx;
int ret;
ret = _rnd_system_entropy_init();
if (ret < 0)
return gnutls_assert_val(ret);
ctx = gnutls_calloc(1, sizeof(*ctx));
if (ctx == NULL)
return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
......@@ -226,15 +222,6 @@ static void _rngfips_deinit(void *_ctx)
free(ctx);
}
/* This is called when gnutls_global_init() is called for second time.
* It must check whether any resources are still available.
* The particular problem it solves is to verify that the urandom fd is still
* open (for applications that for some reason closed all fds */
static int _rndfips_check(void **ctx)
{
return _rnd_system_entropy_check();
}
static void _rngfips_refresh(void *_ctx)
{
/* this is predictable RNG. Don't refresh */
......@@ -260,7 +247,6 @@ static int selftest_kat(void)
gnutls_crypto_rnd_st _gnutls_fips_rnd_ops = {
.init = _rngfips_init,
.check = _rndfips_check,
.deinit = _rngfips_deinit,
.rnd = _rngfips_rnd,
.rnd_refresh = _rngfips_refresh,
......
......@@ -218,12 +218,6 @@ static int wrap_nettle_rnd_init(void **ctx)
return ret;
}
ret = _rnd_system_entropy_init();
if (ret < 0) {
gnutls_assert();
return ret;
}
/* initialize the main RNG */
yarrow256_init(&rnd_ctx.yctx, SOURCES, rnd_ctx.ysources);
......@@ -257,15 +251,6 @@ static int wrap_nettle_rnd_init(void **ctx)
return 0;
}
/* This is called when gnutls_global_init() is called for second time.
* It must check whether any resources are still available.
* The particular problem it solves is to verify that the urandom fd is still
* open (for applications that for some reason closed all fds */
static int wrap_nettle_rnd_check(void **ctx)
{
return _rnd_system_entropy_check();
}
static int
wrap_nettle_rnd_nonce(void *_ctx, void *data, size_t datasize)
{
......@@ -373,7 +358,6 @@ int crypto_rnd_prio = INT_MAX;
gnutls_crypto_rnd_st _gnutls_rnd_ops = {
.init = wrap_nettle_rnd_init,
.check = wrap_nettle_rnd_check,
.deinit = wrap_nettle_rnd_deinit,
.rnd = wrap_nettle_rnd,
.rnd_refresh = wrap_nettle_rnd_refresh,
......
......@@ -146,6 +146,10 @@ static int _rnd_get_system_entropy_urandom(void* _rnd, size_t size)
return 0;
}
/* This is called when gnutls_global_init() is called for second time.
* It must check whether any resources are still available.
* The particular problem it solves is to verify that the urandom fd is still
* open (for applications that for some reason closed all fds */
int _rnd_system_entropy_check(void)
{
int ret;
......
......@@ -26,30 +26,80 @@
#include "gnutls_int.h"
#include "errors.h"
#include <random.h>
#include "locks.h"
#include <fips.h>
void *gnutls_rnd_ctx;
GNUTLS_STATIC_MUTEX(gnutls_rnd_init_mutex);
int _gnutls_rnd_init(void)
#ifdef HAVE_STDATOMIC_H
static atomic_uint rnd_initialized = 0;
inline static int _gnutls_rnd_init(void)
{
if (unlikely(!rnd_initialized)) {
if (_gnutls_rnd_ops.init == NULL) {
rnd_initialized = 1;
return 0;
}
GNUTLS_STATIC_MUTEX_LOCK(gnutls_rnd_init_mutex);
if (!rnd_initialized) {
if (_gnutls_rnd_ops.init(&gnutls_rnd_ctx) < 0) {
gnutls_assert();
GNUTLS_STATIC_MUTEX_UNLOCK(gnutls_rnd_init_mutex);
return GNUTLS_E_RANDOM_FAILED;
}
rnd_initialized = 1;
}
GNUTLS_STATIC_MUTEX_UNLOCK(gnutls_rnd_init_mutex);
}
return 0;
}
#else
static unsigned rnd_initialized = 0;
inline static int _gnutls_rnd_init(void)
{
GNUTLS_STATIC_MUTEX_LOCK(gnutls_rnd_init_mutex);
if (unlikely(!rnd_initialized)) {
if (_gnutls_rnd_ops.init == NULL) {
rnd_initialized = 1;
GNUTLS_STATIC_MUTEX_UNLOCK(gnutls_rnd_init_mutex);
return 0;
}
if (_gnutls_rnd_ops.init(&gnutls_rnd_ctx) < 0) {
gnutls_assert();
GNUTLS_STATIC_MUTEX_UNLOCK(gnutls_rnd_init_mutex);
return GNUTLS_E_RANDOM_FAILED;
}
rnd_initialized = 1;
}
GNUTLS_STATIC_MUTEX_UNLOCK(gnutls_rnd_init_mutex);
return 0;
}
#endif
int _gnutls_rnd_preinit(void)
{
int ret;
#ifdef ENABLE_FIPS140
/* The FIPS140 random generator is only enabled when we are compiled
* with FIPS support, _and_ the system requires FIPS140.
*/
if (_gnutls_fips_mode_enabled() == 1) {
int ret;
ret = gnutls_crypto_rnd_register(100, &_gnutls_fips_rnd_ops);
if (ret < 0)
return ret;
}
#endif
if (_gnutls_rnd_ops.init != NULL) {
if (_gnutls_rnd_ops.init(&gnutls_rnd_ctx) < 0) {
gnutls_assert();
return GNUTLS_E_RANDOM_FAILED;
}
ret = _rnd_system_entropy_init();
if (ret < 0) {
gnutls_assert();
return GNUTLS_E_RANDOM_FAILED;
}
return 0;
......@@ -57,9 +107,12 @@ int _gnutls_rnd_init(void)
void _gnutls_rnd_deinit(void)
{
if (_gnutls_rnd_ops.deinit != NULL) {
if (rnd_initialized && _gnutls_rnd_ops.deinit != NULL) {
_gnutls_rnd_ops.deinit(gnutls_rnd_ctx);
}
rnd_initialized = 0;
_rnd_system_entropy_deinit();
return;
}
......@@ -81,8 +134,17 @@ void _gnutls_rnd_deinit(void)
**/
int gnutls_rnd(gnutls_rnd_level_t level, void *data, size_t len)
{
int ret;
FAIL_IF_LIB_ERROR;
return _gnutls_rnd(level, data, len);
if (unlikely((ret=_gnutls_rnd_init()) < 0))
return gnutls_assert_val(ret);
if (likely(len > 0)) {
return _gnutls_rnd_ops.rnd(gnutls_rnd_ctx, level, data,
len);
}
return 0;
}
/**
......@@ -98,5 +160,6 @@ int gnutls_rnd(gnutls_rnd_level_t level, void *data, size_t len)
**/
void gnutls_rnd_refresh(void)
{
_gnutls_rnd_refresh();
if (rnd_initialized && _gnutls_rnd_ops.rnd_refresh)
_gnutls_rnd_ops.rnd_refresh(gnutls_rnd_ctx);
}
......@@ -30,34 +30,17 @@ extern int crypto_rnd_prio;
extern void *gnutls_rnd_ctx;
extern gnutls_crypto_rnd_st _gnutls_rnd_ops;
inline static int
_gnutls_rnd(gnutls_rnd_level_t level, void *data, size_t len)
{
if (len > 0) {
return _gnutls_rnd_ops.rnd(gnutls_rnd_ctx, level, data,
len);
}
return 0;
}
inline static void _gnutls_rnd_refresh(void)
{
_gnutls_rnd_ops.rnd_refresh(gnutls_rnd_ctx);
}
#define _gnutls_rnd gnutls_rnd
#define _gnutls_rnd_refresh gnutls_rnd_refresh
void _gnutls_rnd_deinit(void);
int _gnutls_rnd_init(void);
int _gnutls_rnd_preinit(void);
#include "nettle/rnd-common.h"
inline static int _gnutls_rnd_check(void)
{
if (_gnutls_rnd_ops.check)
return _gnutls_rnd_ops.check(gnutls_rnd_ctx);
else
return 0;
return _rnd_system_entropy_check();
}
#ifndef _WIN32
extern int _gnutls_urandom_fd;
#endif
#endif
......@@ -50,7 +50,7 @@ typedef int (*get_entropy_func)(void* rnd, size_t size);
get_entropy_func _rnd_get_system_entropy;
#define RND_NO_INCLUDES
#include "../lib/nettle/rnd-linux.c"
#include "../lib/nettle/sysrnd-linux.c"
static volatile int stop_loop = 0;
......
Markdown is supported
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!