[Python-checkins] cpython (2.7): use getentropy when available (backport of 75ede5bec8db) (closes #23115)

[benjamin.peterson]

https://hg.python.org/cpython/rev/9cd2641765dc
changeset:   93971:9cd2641765dc
branch:      2.7
parent:      93966:b058a904c630
user:        Benjamin Peterson <benjamin at python.org>
date:        Fri Dec 26 11:09:00 2014 -0600
summary:
  use getentropy when available (backport of 75ede5bec8db) (closes #23115)

files:
  Lib/test/test_os.py |   7 +++++
  Misc/NEWS           |   3 ++
  Python/random.c     |  41 ++++++++++++++++++++++++++++----
  configure           |   3 +-
  configure.ac        |   1 +
  pyconfig.h.in       |   3 ++
  6 files changed, 51 insertions(+), 7 deletions(-)


diff --git a/Lib/test/test_os.py b/Lib/test/test_os.py
--- a/Lib/test/test_os.py
+++ b/Lib/test/test_os.py
@@ -9,6 +9,7 @@
 import sys
 import signal
 import subprocess
+import sysconfig
 import time
 try:
     import resource
@@ -567,6 +568,12 @@
         data2 = self.get_urandom_subprocess(16)
         self.assertNotEqual(data1, data2)
 
+
+HAVE_GETENTROPY = (sysconfig.get_config_var('HAVE_GETENTROPY') == 1)
+
+ at unittest.skipIf(HAVE_GETENTROPY,
+                 "getentropy() does not use a file descriptor")
+class URandomFDTests(unittest.TestCase):
     @unittest.skipUnless(resource, "test requires the resource module")
     def test_urandom_failure(self):
         # Check urandom() failing when it is not able to open /dev/random.
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -18,6 +18,9 @@
 - Issue #23112: Fix SimpleHTTPServer to correctly carry the query string and
   fragment when it redirects to add a trailing slash.
 
+- Issue #22585: On OpenBSD 5.6 and newer, os.urandom() now calls getentropy(),
+  instead of reading /dev/urandom, to get pseudo-random bytes.
+
 - Issue #23093: In the io, module allow more operations to work on detached
   streams.
 
diff --git a/Python/random.c b/Python/random.c
--- a/Python/random.c
+++ b/Python/random.c
@@ -92,8 +92,33 @@
     }
     return 0;
 }
-#endif /* MS_WINDOWS */
 
+#elif HAVE_GETENTROPY
+/* Fill buffer with size pseudo-random bytes generated by getentropy().
+   Return 0 on success, or raise an exception and return -1 on error.
+   If fatal is nonzero, call Py_FatalError() instead of raising an exception
+   on error. */
+static int
+py_getentropy(unsigned char *buffer, Py_ssize_t size, int fatal)
+{
+    while (size > 0) {
+        Py_ssize_t len = Py_MIN(size, 256);
+        int res = getentropy(buffer, len);
+        if (res < 0) {
+            if (fatal) {
+                Py_FatalError("getentropy() failed");
+            }
+            else {
+                PyErr_SetFromErrno(PyExc_OSError);
+                return -1;
+            }
+        }
+        buffer += len;
+        size -= len;
+    }
+    return 0;
+}
+#endif
 
 #ifdef __VMS
 /* Use openssl random routine */
@@ -291,6 +316,8 @@
 
 #ifdef MS_WINDOWS
     return win32_urandom((unsigned char *)buffer, size, 1);
+#elif HAVE_GETENTROPY
+    return py_getentropy(buffer, size, 0);
 #else
 # ifdef __VMS
     return vms_urandom((unsigned char *)buffer, size, 1);
@@ -350,12 +377,12 @@
     else {
 #ifdef MS_WINDOWS
         (void)win32_urandom((unsigned char *)secret, secret_size, 0);
-#else /* #ifdef MS_WINDOWS */
-# ifdef __VMS
+#elif __VMS
         vms_urandom((unsigned char *)secret, secret_size, 0);
-# else
-        dev_urandom_noraise((unsigned char*)secret, secret_size);
-# endif
+#elif HAVE_GETENTROPY
+        (void)py_getentropy(secret, secret_size, 1);
+#else
+        dev_urandom_noraise(secret, secret_size);
 #endif
     }
 }
@@ -368,6 +395,8 @@
         CryptReleaseContext(hCryptProv, 0);
         hCryptProv = 0;
     }
+#elif HAVE_GETENTROPY
+    /* nothing to clean */
 #else
     dev_urandom_close();
 #endif
diff --git a/configure b/configure
--- a/configure
+++ b/configure
@@ -10196,7 +10196,8 @@
 # checks for library functions
 for ac_func in alarm setitimer getitimer bind_textdomain_codeset chown \
  clock confstr ctermid execv fchmod fchown fork fpathconf ftime ftruncate \
- gai_strerror getgroups getlogin getloadavg getpeername getpgid getpid \
+ gai_strerror getentropy getgroups getlogin getloadavg getpeername getpgid \
+ getpid \
  getpriority getresuid getresgid getpwent getspnam getspent getsid getwd \
  initgroups kill killpg lchmod lchown lstat mkfifo mknod mktime mmap \
  mremap nice pathconf pause plock poll pthread_init \
diff --git a/configure.ac b/configure.ac
--- a/configure.ac
+++ b/configure.ac
@@ -2913,6 +2913,7 @@
 AC_CHECK_FUNCS(alarm setitimer getitimer bind_textdomain_codeset chown \
  clock confstr ctermid execv fchmod fchown fork fpathconf ftime ftruncate \
  gai_strerror getgroups getlogin getloadavg getpeername getpgid getpid \
+ getentropy \
  getpriority getresuid getresgid getpwent getspnam getspent getsid getwd \
  initgroups kill killpg lchmod lchown lstat mkfifo mknod mktime mmap \
  mremap nice pathconf pause plock poll pthread_init \
diff --git a/pyconfig.h.in b/pyconfig.h.in
--- a/pyconfig.h.in
+++ b/pyconfig.h.in
@@ -280,6 +280,9 @@
 /* Define this if you have flockfile(), getc_unlocked(), and funlockfile() */
 #undef HAVE_GETC_UNLOCKED
 
+/* Define to 1 if you have the `getentropy' function. */
+#undef HAVE_GETENTROPY
+
 /* Define to 1 if you have the `getgroups' function. */
 #undef HAVE_GETGROUPS
 

-- 
Repository URL: https://hg.python.org/cpython