6b3bb3d9ba
This changes the logging categories to boolean flags instead of strings. This simplifies the acceptance testing by avoiding accessing a scoped static thread local pointer to a thread local set of strings. It eliminates the only use of boost::thread_specific_ptr outside of lockorder debugging. This change allows log entries to be directed to multiple categories and makes it easy to change the logging flags at runtime (e.g. via an RPC, though that isn't done by this commit.) It also eliminates the fDebug global. Configuration of unknown logging categories now produces a warning.
290 lines
8 KiB
C++
290 lines
8 KiB
C++
// Copyright (c) 2009-2010 Satoshi Nakamoto
|
|
// Copyright (c) 2009-2016 The Bitcoin Core developers
|
|
// Distributed under the MIT software license, see the accompanying
|
|
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
|
|
|
|
#include "random.h"
|
|
|
|
#include "crypto/sha512.h"
|
|
#include "support/cleanse.h"
|
|
#ifdef WIN32
|
|
#include "compat.h" // for Windows API
|
|
#include <wincrypt.h>
|
|
#endif
|
|
#include "util.h" // for LogPrint()
|
|
#include "utilstrencodings.h" // for GetTime()
|
|
|
|
#include <stdlib.h>
|
|
#include <limits>
|
|
|
|
#ifndef WIN32
|
|
#include <sys/time.h>
|
|
#endif
|
|
|
|
#ifdef HAVE_SYS_GETRANDOM
|
|
#include <sys/syscall.h>
|
|
#include <linux/random.h>
|
|
#endif
|
|
#ifdef HAVE_GETENTROPY
|
|
#include <unistd.h>
|
|
#endif
|
|
#ifdef HAVE_SYSCTL_ARND
|
|
#include <sys/sysctl.h>
|
|
#endif
|
|
|
|
#include <openssl/err.h>
|
|
#include <openssl/rand.h>
|
|
|
|
static void RandFailure()
|
|
{
|
|
LogPrintf("Failed to read randomness, aborting\n");
|
|
abort();
|
|
}
|
|
|
|
static inline int64_t GetPerformanceCounter()
|
|
{
|
|
int64_t nCounter = 0;
|
|
#ifdef WIN32
|
|
QueryPerformanceCounter((LARGE_INTEGER*)&nCounter);
|
|
#else
|
|
timeval t;
|
|
gettimeofday(&t, NULL);
|
|
nCounter = (int64_t)(t.tv_sec * 1000000 + t.tv_usec);
|
|
#endif
|
|
return nCounter;
|
|
}
|
|
|
|
void RandAddSeed()
|
|
{
|
|
// Seed with CPU performance counter
|
|
int64_t nCounter = GetPerformanceCounter();
|
|
RAND_add(&nCounter, sizeof(nCounter), 1.5);
|
|
memory_cleanse((void*)&nCounter, sizeof(nCounter));
|
|
}
|
|
|
|
static void RandAddSeedPerfmon()
|
|
{
|
|
RandAddSeed();
|
|
|
|
#ifdef WIN32
|
|
// Don't need this on Linux, OpenSSL automatically uses /dev/urandom
|
|
// Seed with the entire set of perfmon data
|
|
|
|
// This can take up to 2 seconds, so only do it every 10 minutes
|
|
static int64_t nLastPerfmon;
|
|
if (GetTime() < nLastPerfmon + 10 * 60)
|
|
return;
|
|
nLastPerfmon = GetTime();
|
|
|
|
std::vector<unsigned char> vData(250000, 0);
|
|
long ret = 0;
|
|
unsigned long nSize = 0;
|
|
const size_t nMaxSize = 10000000; // Bail out at more than 10MB of performance data
|
|
while (true) {
|
|
nSize = vData.size();
|
|
ret = RegQueryValueExA(HKEY_PERFORMANCE_DATA, "Global", NULL, NULL, vData.data(), &nSize);
|
|
if (ret != ERROR_MORE_DATA || vData.size() >= nMaxSize)
|
|
break;
|
|
vData.resize(std::max((vData.size() * 3) / 2, nMaxSize)); // Grow size of buffer exponentially
|
|
}
|
|
RegCloseKey(HKEY_PERFORMANCE_DATA);
|
|
if (ret == ERROR_SUCCESS) {
|
|
RAND_add(vData.data(), nSize, nSize / 100.0);
|
|
memory_cleanse(vData.data(), nSize);
|
|
LogPrint(BCLog::RAND, "%s: %lu bytes\n", __func__, nSize);
|
|
} else {
|
|
static bool warned = false; // Warn only once
|
|
if (!warned) {
|
|
LogPrintf("%s: Warning: RegQueryValueExA(HKEY_PERFORMANCE_DATA) failed with code %i\n", __func__, ret);
|
|
warned = true;
|
|
}
|
|
}
|
|
#endif
|
|
}
|
|
|
|
#ifndef WIN32
|
|
/** Fallback: get 32 bytes of system entropy from /dev/urandom. The most
|
|
* compatible way to get cryptographic randomness on UNIX-ish platforms.
|
|
*/
|
|
void GetDevURandom(unsigned char *ent32)
|
|
{
|
|
int f = open("/dev/urandom", O_RDONLY);
|
|
if (f == -1) {
|
|
RandFailure();
|
|
}
|
|
int have = 0;
|
|
do {
|
|
ssize_t n = read(f, ent32 + have, NUM_OS_RANDOM_BYTES - have);
|
|
if (n <= 0 || n + have > NUM_OS_RANDOM_BYTES) {
|
|
RandFailure();
|
|
}
|
|
have += n;
|
|
} while (have < NUM_OS_RANDOM_BYTES);
|
|
close(f);
|
|
}
|
|
#endif
|
|
|
|
/** Get 32 bytes of system entropy. */
|
|
void GetOSRand(unsigned char *ent32)
|
|
{
|
|
#if defined(WIN32)
|
|
HCRYPTPROV hProvider;
|
|
int ret = CryptAcquireContextW(&hProvider, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT);
|
|
if (!ret) {
|
|
RandFailure();
|
|
}
|
|
ret = CryptGenRandom(hProvider, NUM_OS_RANDOM_BYTES, ent32);
|
|
if (!ret) {
|
|
RandFailure();
|
|
}
|
|
CryptReleaseContext(hProvider, 0);
|
|
#elif defined(HAVE_SYS_GETRANDOM)
|
|
/* Linux. From the getrandom(2) man page:
|
|
* "If the urandom source has been initialized, reads of up to 256 bytes
|
|
* will always return as many bytes as requested and will not be
|
|
* interrupted by signals."
|
|
*/
|
|
int rv = syscall(SYS_getrandom, ent32, NUM_OS_RANDOM_BYTES, 0);
|
|
if (rv != NUM_OS_RANDOM_BYTES) {
|
|
if (rv < 0 && errno == ENOSYS) {
|
|
/* Fallback for kernel <3.17: the return value will be -1 and errno
|
|
* ENOSYS if the syscall is not available, in that case fall back
|
|
* to /dev/urandom.
|
|
*/
|
|
GetDevURandom(ent32);
|
|
} else {
|
|
RandFailure();
|
|
}
|
|
}
|
|
#elif defined(HAVE_GETENTROPY)
|
|
/* On OpenBSD this can return up to 256 bytes of entropy, will return an
|
|
* error if more are requested.
|
|
* The call cannot return less than the requested number of bytes.
|
|
*/
|
|
if (getentropy(ent32, NUM_OS_RANDOM_BYTES) != 0) {
|
|
RandFailure();
|
|
}
|
|
#elif defined(HAVE_SYSCTL_ARND)
|
|
/* FreeBSD and similar. It is possible for the call to return less
|
|
* bytes than requested, so need to read in a loop.
|
|
*/
|
|
static const int name[2] = {CTL_KERN, KERN_ARND};
|
|
int have = 0;
|
|
do {
|
|
size_t len = NUM_OS_RANDOM_BYTES - have;
|
|
if (sysctl(name, ARRAYLEN(name), ent32 + have, &len, NULL, 0) != 0) {
|
|
RandFailure();
|
|
}
|
|
have += len;
|
|
} while (have < NUM_OS_RANDOM_BYTES);
|
|
#else
|
|
/* Fall back to /dev/urandom if there is no specific method implemented to
|
|
* get system entropy for this OS.
|
|
*/
|
|
GetDevURandom(ent32);
|
|
#endif
|
|
}
|
|
|
|
void GetRandBytes(unsigned char* buf, int num)
|
|
{
|
|
if (RAND_bytes(buf, num) != 1) {
|
|
RandFailure();
|
|
}
|
|
}
|
|
|
|
void GetStrongRandBytes(unsigned char* out, int num)
|
|
{
|
|
assert(num <= 32);
|
|
CSHA512 hasher;
|
|
unsigned char buf[64];
|
|
|
|
// First source: OpenSSL's RNG
|
|
RandAddSeedPerfmon();
|
|
GetRandBytes(buf, 32);
|
|
hasher.Write(buf, 32);
|
|
|
|
// Second source: OS RNG
|
|
GetOSRand(buf);
|
|
hasher.Write(buf, 32);
|
|
|
|
// Produce output
|
|
hasher.Finalize(buf);
|
|
memcpy(out, buf, num);
|
|
memory_cleanse(buf, 64);
|
|
}
|
|
|
|
uint64_t GetRand(uint64_t nMax)
|
|
{
|
|
if (nMax == 0)
|
|
return 0;
|
|
|
|
// The range of the random source must be a multiple of the modulus
|
|
// to give every possible output value an equal possibility
|
|
uint64_t nRange = (std::numeric_limits<uint64_t>::max() / nMax) * nMax;
|
|
uint64_t nRand = 0;
|
|
do {
|
|
GetRandBytes((unsigned char*)&nRand, sizeof(nRand));
|
|
} while (nRand >= nRange);
|
|
return (nRand % nMax);
|
|
}
|
|
|
|
int GetRandInt(int nMax)
|
|
{
|
|
return GetRand(nMax);
|
|
}
|
|
|
|
uint256 GetRandHash()
|
|
{
|
|
uint256 hash;
|
|
GetRandBytes((unsigned char*)&hash, sizeof(hash));
|
|
return hash;
|
|
}
|
|
|
|
FastRandomContext::FastRandomContext(bool fDeterministic)
|
|
{
|
|
// The seed values have some unlikely fixed points which we avoid.
|
|
if (fDeterministic) {
|
|
Rz = Rw = 11;
|
|
} else {
|
|
uint32_t tmp;
|
|
do {
|
|
GetRandBytes((unsigned char*)&tmp, 4);
|
|
} while (tmp == 0 || tmp == 0x9068ffffU);
|
|
Rz = tmp;
|
|
do {
|
|
GetRandBytes((unsigned char*)&tmp, 4);
|
|
} while (tmp == 0 || tmp == 0x464fffffU);
|
|
Rw = tmp;
|
|
}
|
|
}
|
|
|
|
bool Random_SanityCheck()
|
|
{
|
|
/* This does not measure the quality of randomness, but it does test that
|
|
* OSRandom() overwrites all 32 bytes of the output given a maximum
|
|
* number of tries.
|
|
*/
|
|
static const ssize_t MAX_TRIES = 1024;
|
|
uint8_t data[NUM_OS_RANDOM_BYTES];
|
|
bool overwritten[NUM_OS_RANDOM_BYTES] = {}; /* Tracks which bytes have been overwritten at least once */
|
|
int num_overwritten;
|
|
int tries = 0;
|
|
/* Loop until all bytes have been overwritten at least once, or max number tries reached */
|
|
do {
|
|
memset(data, 0, NUM_OS_RANDOM_BYTES);
|
|
GetOSRand(data);
|
|
for (int x=0; x < NUM_OS_RANDOM_BYTES; ++x) {
|
|
overwritten[x] |= (data[x] != 0);
|
|
}
|
|
|
|
num_overwritten = 0;
|
|
for (int x=0; x < NUM_OS_RANDOM_BYTES; ++x) {
|
|
if (overwritten[x]) {
|
|
num_overwritten += 1;
|
|
}
|
|
}
|
|
|
|
tries += 1;
|
|
} while (num_overwritten < NUM_OS_RANDOM_BYTES && tries < MAX_TRIES);
|
|
return (num_overwritten == NUM_OS_RANDOM_BYTES); /* If this failed, bailed out after too many tries */
|
|
}
|