libc++: add NaCl and PNaCl support for std::random_device

[jfb]

Summary

The NaCl sandbox doesn't allow opening files under /dev, but it offers an API which provides the same capabilities. This is the same random device emulation that nacl_io performs for POSIX support, but nacl_io is an optional library so libc++ can't assume that device emulation will be performed. Note that NaCl only supports /dev/urandom, not /dev/random.

This patch also cleans up some of the preprocessor #endif, and fixes the test for Win32 (it accepts any token, and would therefore never throw regardless of the token provided).

[majnemer]

The purpose of the token is to permit different sources of randomness. Seeing as how you don't allow anything other than nacl_secure_random_init, perhaps you should just make the default token be the empty string in the <random> header.

Checking for an invalid token would just be a simple !__token.empty().

src/random.cpp

79

This read a little funny to me, maybe:

random_device failed to obtain enough bytes

[jfb]

The purpose of the token is to permit different sources of randomness. Seeing as how you don't allow anything other than nacl_secure_random_init, perhaps you should just make the default token be the empty string in the <random> header.

That would be a breaking change if we do decide to support other sources of
randomness. What we have now emulates the token it accepts (its POSIX
meaning), so it's the right thing IMO.

[mclow.lists]

I'd really prefer a different identifier other than __native_client__.
IMHO, that's too "generic".

Something that mentioned NaCl and/or PNaCl.
_LIBCPP_USING_NACL_RANDOM, maybe?

[jfb]

Rephrase error message.

[jfb]

Add _LIBCPP_USING_NACL_RANDOM to __config, and use that instead of __native_client__.

[jfb]

In D6442#9, @mclow.lists wrote:

I'd really prefer a different identifier other than __native_client__.
IMHO, that's too "generic".

Something that mentioned NaCl and/or PNaCl.
_LIBCPP_USING_NACL_RANDOM, maybe?

Done, let me know if what I implemented was what you were suggesting.

src/random.cpp

79

Changed.

[jfb]

Fix missing parens.

[mclow.lists]

Your changes look good; but now I'm wondering if you want to accept both "/dev/random" and "/dev/urandom" as valid tokens.

Now I'm wondering what bozo checked in the windows implementation w/o noticing that it broke this test on Windows. Oh - that was me.

Should the windows implementation also accept only "/dev/random" and "/dev/urandom" as valid tokens?

That would enable us to make the test portable; and help people to write cross-platform code.

include/__config

118

I don't think you need to actually set _LIBCPP_USING_NACL_RANDOM to a value.

#define _LIBCPP_USING_NACL_RANDOM

is sufficient.

test/numerics/rand/rand.device/ctor.pass.cpp

34

I don't really like this; it's leaking implementation information into the test framework.

[jfb]

Define macro without setting a value.

[jfb]

In D6442#17, @mclow.lists wrote:

Your changes look good; but now I'm wondering if you want to accept both "/dev/random" and "/dev/urandom" as valid tokens.

I don't want /dev/random because the NaCl interface I'm using doesn't guarantee "very high quality randomness" and doesn't block when such randomness isn't available. User code that expects such randomness should hard-fail (and fall back as makes sense for them), instead of getting lower quality randomness. NaCl has, for example, SSH clients that rely on similar (non-C++) random device interfaces, and knowing that the source of randomness is bad is pretty important to them (not that OpenSSL and friends have a great track record).

Should the windows implementation also accept only "/dev/random" and "/dev/urandom" as valid tokens?

I wouldn't offer /dev/random unless the implementation actually meets the expectations of users.

That would enable us to make the test portable; and help people to write cross-platform code.

I think the lack of platform portability should go back to WG21 LEWG ;-)

Agreed that the test is now ugly... but hey it's correct!

include/__config

118

Done.

[jfb]

Return ENOENT instead of ENODEV as suggested by @majnemer.

[jfb]

Closed by commit rL223068 (authored by @jfb).

include/__config

 #   define _LIBCPP_LITTLE_ENDIAN 1
 #   define _LIBCPP_BIG_ENDIAN    0
 # else
 #   define _LIBCPP_LITTLE_ENDIAN 0
 #   define _LIBCPP_BIG_ENDIAN    1
 # endif
 #endif // __sun__
 
+#if defined(__native_client__)
+  // NaCl's sandbox (which PNaCl also runs in) doesn't allow filesystem access,
+  // including accesses to the special files under /dev. C++11's
+  // std::random_device is instead exposed through a NaCl syscall.
+# define _LIBCPP_USING_NACL_RANDOM
+#endif // defined(__native_client__)
+
 #if !defined(_LIBCPP_LITTLE_ENDIAN) || !defined(_LIBCPP_BIG_ENDIAN)
 # include <endian.h>
 # if __BYTE_ORDER == __LITTLE_ENDIAN
 #  define _LIBCPP_LITTLE_ENDIAN 1
 #  define _LIBCPP_BIG_ENDIAN    0
 # elif __BYTE_ORDER == __BIG_ENDIAN
 #  define _LIBCPP_LITTLE_ENDIAN 0
 #  define _LIBCPP_BIG_ENDIAN    1

include/random

 }
 
 typedef shuffle_order_engine<minstd_rand0, 256>                         knuth_b;
 
 // random_device
 
 class _LIBCPP_TYPE_VIS random_device
 {
-#if !defined(_WIN32)
+#if !(defined(_WIN32) || defined(_LIBCPP_USING_NACL_RANDOM))
     int __f_;
-#endif // defined(_WIN32)
+#endif // !(defined(_WIN32) || defined(_LIBCPP_USING_NACL_RANDOM))
 public:
     // types
     typedef unsigned result_type;
 
     // generator characteristics
     static _LIBCPP_CONSTEXPR const result_type _Min = 0;
     static _LIBCPP_CONSTEXPR const result_type _Max = 0xFFFFFFFFu;
 

src/random.cpp

 //===-------------------------- random.cpp --------------------------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is dual licensed under the MIT and the University of Illinois Open
 // Source Licenses. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 
 #if defined(_WIN32)
 // Must be defined before including stdlib.h to enable rand_s().
 #define _CRT_RAND_S
 #include <stdio.h>
-#endif
+#endif // defined(_WIN32)
 
 #include "random"
 #include "system_error"
 
-#ifdef __sun__
+#if defined(__sun__)
 #define rename solaris_headers_are_broken
-#endif
+#endif // defined(__sun__)
 #if !defined(_WIN32)
 #include <fcntl.h>
 #include <unistd.h>
-#endif // defined(_WIN32)
+#endif // !defined(_WIN32)
 #include <errno.h>
+#if defined(_LIBCPP_USING_NACL_RANDOM)
+#include <nacl/nacl_random.h>
+#endif // defined(_LIBCPP_USING_NACL_RANDOM)
 
 _LIBCPP_BEGIN_NAMESPACE_STD
 
 #if defined(_WIN32)
+
 random_device::random_device(const string&)
 {
 }
 
 random_device::~random_device()
 {
 }
 
 unsigned
 random_device::operator()()
 {
     unsigned r;
     errno_t err = rand_s(&r);
     if (err)
         __throw_system_error(err, "random_device rand_s failed.");
     return r;
 }
-#else
+
+#elif defined(_LIBCPP_USING_NACL_RANDOM)
+
+random_device::random_device(const string& __token)
+{
+    if (__token != "/dev/urandom")
+        __throw_system_error(ENOENT, ("random device not supported " + __token).c_str());
+    int error = nacl_secure_random_init();
+    if (error)
+        __throw_system_error(error, ("random device failed to open " + __token).c_str());
+}
+
+random_device::~random_device()
+{
+}
+
+unsigned
+random_device::operator()()
+{
+    unsigned r;
+    size_t n = sizeof(r);
+    char* p = reinterpret_cast<char*>(&r);
+    size_t bytes_written;
+    int error = nacl_secure_random(&r, n, &bytes_written);
+    if (error != 0)
+        __throw_system_error(error, "random_device failed getting bytes");
+    else if (bytes_written != n)
+        __throw_runtime_error("random_device failed to obtain enough bytes");
+    return r;
+}
+
+#else // !defined(_WIN32) && !defined(_LIBCPP_USING_NACL_RANDOM)
+
 random_device::random_device(const string& __token)
     : __f_(open(__token.c_str(), O_RDONLY))
 {
     if (__f_ < 0)
         __throw_system_error(errno, ("random_device failed to open " + __token).c_str());
 }
 
 random_device::~random_device()
while (n > 0)
                 __throw_system_error(errno, "random_device got an unexpected error");
             continue;
         }
         n -= static_cast<size_t>(s);
         p += static_cast<size_t>(s);
     }
     return r;
 }
-#endif // defined(_WIN32)
+
+#endif // defined(_WIN32) || defined(_LIBCPP_USING_NACL_RANDOM)
 
 double
 random_device::entropy() const _NOEXCEPT
 {
     return 0;
 }
 
 _LIBCPP_END_NAMESPACE_STD

test/numerics/rand/rand.device/ctor.pass.cpp

 //===----------------------------------------------------------------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is dual licensed under the MIT and the University of Illinois Open
 // Source Licenses. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 
 // <random>
 
 // class random_device;
 
-// explicit random_device(const string& token = "/dev/urandom");
+// explicit random_device(const string& token = implementation-defined);
+
+// For the following ctors, the standard states: "The semantics and default
+// value of the token parameter are implementation-defined". Implementations
+// therefore aren't required to accept any string, but the default shouldn't
+// throw.
 
 #include <random>
 #include <cassert>
 #include <unistd.h>
 
-int main()
-{
-    try
-    {
-        std::random_device r("wrong file");
-        assert(false);
-    }
-    catch (const std::system_error& e)
-    {
-    }
-    {
-        std::random_device r;
-    }
-    {
-        int ec;
-        ec = close(STDIN_FILENO);
-        assert(!ec);
-        ec = close(STDOUT_FILENO);
-        assert(!ec);
-        ec = close(STDERR_FILENO);
-        assert(!ec);
-        std::random_device r;
-    }
-    {
-        std::random_device r("/dev/urandom");;
-    }
-    {
-        std::random_device r("/dev/random");;
-    }
+bool is_valid_random_device(const std::string &token) {
+#if defined(_WIN32)
+  return true;
+#elif defined(_LIBCPP_USING_NACL_RANDOM)
+  return token == "/dev/urandom";
+#else  // !defined(_WIN32) && !defined(_LIBCPP_USING_NACL_RANDOM)
+  // Not an exhaustive list: they're the only tokens that are tested below.
+  return token == "/dev/urandom" || token == "/dev/random";
+#endif // defined(_WIN32) || defined(_LIBCPP_USING_NACL_RANDOM)
+
+void check_random_device_valid(const std::string &token) {
+  std::random_device r(token);
+}
+
+void check_random_device_invalid(const std::string &token) {
+  try {
+    std::random_device r(token);
+    assert(false);
+  } catch (const std::system_error &e) {
+
+int main() {
+  { std::random_device r; }
+
+
+    std::string token = "wrong file";
+    if (is_valid_random_device(token))
+      check_random_device_valid(token);
+    else
+      check_random_device_invalid(token);
+
+  {
+    std::string token = "/dev/urandom";
+    if (is_valid_random_device(token))
+      check_random_device_valid(token);
+    else
+      check_random_device_invalid(token);
+  }
+
+    std::string token = "/dev/random";
+    if (is_valid_random_device(token))
+      check_random_device_valid(token);
+    else
+      check_random_device_invalid(token);
 }