mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 14:07:59 +00:00
Code Issues Releases Wiki Activity

initialize with at least THRESHOLD_BITS bits of entropy for pseudorandom case.

Browse Source
This commit is contained in:
Michael Graff
2000-06-12 22:28:05 +00:00
parent 6a3beb6f7e
commit c498b4be95
1 changed files with 28 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
lib/isc/unix/entropy.c
View File

@@ -52,7 +52,7 @@
/* /*
* size of entropy pool in 32-bit words. This _MUST_ be a power of 2. * size of entropy pool in 32-bit words. This _MUST_ be a power of 2.
*/ */
#define RND_POOLWORDS 512 #define RND_POOLWORDS 128
#define RND_POOLBITS (RND_POOLWORDS * 32) #define RND_POOLBITS (RND_POOLWORDS * 32)
/* /*
@@ -60,6 +60,7 @@
* threshold * 2 <= digest_size_in_bytes * threshold * 2 <= digest_size_in_bytes
*/ */
#define RND_ENTROPY_THRESHOLD 10 #define RND_ENTROPY_THRESHOLD 10
#define THRESHOLD_BITS (RND_ENTROPY_THRESHOLD * 8)
/* /*
* Size of the input event queue in samples. * Size of the input event queue in samples.
@@ -356,10 +357,10 @@ fillpool(isc_entropy_t *ent, unsigned int needed, isc_boolean_t blocking) {
if (ent->pool.entropy < RND_POOLBITS / 4) if (ent->pool.entropy < RND_POOLBITS / 4)
needed_ent = RND_POOLBITS / 4 - ent->pool.entropy; needed_ent = RND_POOLBITS / 4 - ent->pool.entropy;
if (ent->pool.pseudo > RND_POOLBITS / 4) if (ent->pool.pseudo > RND_POOLBITS / 4)
needed_ps = RND_ENTROPY_THRESHOLD * 8; needed_ps = THRESHOLD_BITS;
needed = ISC_MAX(needed_ent, needed_ps); needed = ISC_MAX(needed_ent, needed_ps);
} else { } else {
needed = ISC_MAX(needed, RND_ENTROPY_THRESHOLD * 8); needed = ISC_MAX(needed, THRESHOLD_BITS);
needed = ISC_MIN(needed, RND_POOLBITS); needed = ISC_MIN(needed, RND_POOLBITS);
} }
@@ -369,11 +370,12 @@ fillpool(isc_entropy_t *ent, unsigned int needed, isc_boolean_t blocking) {
needed = ISC_MIN(needed, RND_POOLBITS - ent->pool.entropy); needed = ISC_MIN(needed, RND_POOLBITS - ent->pool.entropy);
/* /*
* But wait! If we're not yet initialized, we need at least 20 * But wait! If we're not yet initialized, we need at least
* THRESHOLD_BITS
* bytes of randomness. * bytes of randomness.
*/ */
if (ent->initialized < 20) if (ent->initialized < THRESHOLD_BITS)
needed = ISC_MAX(needed, 20 - ent->initialized); needed = ISC_MAX(needed, THRESHOLD_BITS - ent->initialized);
/* /*
* Poll each file source to see if we can read anything useful from * Poll each file source to see if we can read anything useful from
@@ -423,7 +425,7 @@ fillpool(isc_entropy_t *ent, unsigned int needed, isc_boolean_t blocking) {
/* /*
* Mark as initialized if we've added enough data. * Mark as initialized if we've added enough data.
*/ */
if (ent->initialized < 20) if (ent->initialized < THRESHOLD_BITS)
ent->initialized += added; ent->initialized += added;
} }
@@ -507,7 +509,7 @@ isc_entropy_getdata(isc_entropy_t *ent, void *data, unsigned int length,
* To extract good data, we need to have at least * To extract good data, we need to have at least
* enough entropy to fill our digest. * enough entropy to fill our digest.
*/ */
if (ent->pool.entropy < RND_ENTROPY_THRESHOLD * 8) { if (ent->pool.entropy < THRESHOLD_BITS) {
UNLOCK(&ent->lock); UNLOCK(&ent->lock);
return (ISC_R_NOENTROPY); return (ISC_R_NOENTROPY);
} }
@@ -527,23 +529,31 @@ isc_entropy_getdata(isc_entropy_t *ent, void *data, unsigned int length,
*/ */
if (goodonly) { if (goodonly) {
unsigned int fillcount; unsigned int fillcount;
unsigned int needcount;
fillcount = ISC_MAX(remain * 8, count * 8); fillcount = ISC_MAX(remain * 8, count * 8);
needcount = RND_ENTROPY_THRESHOLD * 8;
fillpool(ent, fillcount, blocking); /*
* If, however, we have at least THRESHOLD_BITS
* of entropy in the pool, don't block here. It is
* better to drain the pool once in a while and
* then refill it than it is to constantly keep the
* pool full.
*/
if (ent->pool.entropy >= THRESHOLD_BITS)
fillpool(ent, fillcount, ISC_FALSE);
else
fillpool(ent, fillcount, blocking);
if (!partial) if (!partial)
if (ent->pool.entropy < needcount) if (ent->pool.entropy < THRESHOLD_BITS)
goto zeroize; goto zeroize;
} else { } else {
/* /*
* If we've extracted half our pool size in bits * If we've extracted half our pool size in bits
* since the last refresh, try to refresh here. * since the last refresh, try to refresh here.
*/ */
if (ent->initialized < 20) if (ent->initialized < THRESHOLD_BITS)
fillpool(ent, 20, blocking); fillpool(ent, THRESHOLD_BITS, blocking);
else else
fillpool(ent, 0, ISC_FALSE); fillpool(ent, 0, ISC_FALSE);
@@ -551,7 +561,7 @@ isc_entropy_getdata(isc_entropy_t *ent, void *data, unsigned int length,
* If we've not initialized with enough good random * If we've not initialized with enough good random
* data, fail. * data, fail.
*/ */
if (ent->initialized < 20) if (ent->initialized < THRESHOLD_BITS)
goto zeroize; goto zeroize;
} }
@@ -735,6 +745,9 @@ isc_entropy_createfilesource(isc_entropy_t *ent, const char *fname,
fd = open(fname, O_RDONLY | O_NONBLOCK, 0); fd = open(fname, O_RDONLY | O_NONBLOCK, 0);
if (fd < 0) { if (fd < 0) {
ret = ISC_R_IOERROR; ret = ISC_R_IOERROR;
UNEXPECTED_ERROR(__FILE__, __LINE__,
"open(%s, O_RDONLY | O_NONBLOCK, 0): %s",
fname, strerror(errno));
goto errout; goto errout;
} }