Use ProcessPrng on Windows #415
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,60 +1,40 @@ | ||
| //! Implementation for Windows 10 and later | ||
| //! | ||
| //! On Windows 10 and later, ProcessPrng "is the primary interface to the | ||
| //! user-mode per-processer PRNGs" and only requires BCryptPrimitives.dll, | ||
| //! making it a better option than the other Windows RNG APIs: | ||
| //! - BCryptGenRandom: https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom | ||
| //! - Requires Bcrypt.dll (which loads BCryptPrimitives.dll anyway) | ||
| //! - Can cause crashes/hangs as BCrypt accesses the Windows Registry: | ||
| //! https://github.com/rust-lang/rust/issues/99341 | ||
| //! - Causes issues inside sandboxed code: | ||
| //! https://issues.chromium.org/issues/40277768 | ||
| //! - CryptGenRandom: https://learn.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptgenrandom | ||
| //! - Deprecated and not available on UWP targets | ||
| //! - Requires Advapi32.lib/Advapi32.dll | ||
| //! - Wrapper around ProcessPrng | ||
| //! - RtlGenRandom: https://learn.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-rtlgenrandom | ||
| //! - Deprecated and not available on UWP targets | ||
| //! - Requires Advapi32.dll (and using name "SystemFunction036") | ||
|
josephlr marked this conversation as resolved.
Outdated
|
||
| //! - Wrapper around ProcessPrng | ||
| //! For more information see the Windows RNG Whitepaper: https://aka.ms/win10rng | ||
| use crate::Error; | ||
| use core::mem::MaybeUninit; | ||
|
|
||
| // ProcessPrng lacks an import library, so we use the windows-targets crate to | ||
| // link to it. The following code was generated via windows-bindgen with APIs: | ||
| // Windows.Win32.Foundation.TRUE | ||
| // Windows.Win32.Security.Cryptography.ProcessPrng | ||
| windows_targets::link!("bcryptprimitives.dll" "system" fn ProcessPrng(pbdata: *mut u8, cbdata: usize) -> BOOL); | ||
| #[repr(transparent)] | ||
| #[derive(PartialEq, Eq)] | ||
| pub struct BOOL(pub i32); | ||
| pub const TRUE: BOOL = BOOL(1i32); | ||
|
Contributor
There was a problem hiding this comment. It's unfortunate to have this ugliness without the program that generated it to confirm that it actually created this ugliness. However, I also think it's fine because of how
Member
Author
There was a problem hiding this comment. I think this is a good point. For both APIs I didn't directly use the output of I think that referencing
Member
Author
There was a problem hiding this comment. For reference, here's the full output for running // Bindings generated by `windows-bindgen` 0.56.0
#![allow(
non_snake_case,
non_upper_case_globals,
non_camel_case_types,
dead_code,
clippy::all
)]
#[inline]
pub unsafe fn RtlGenRandom(
randombuffer: *mut core::ffi::c_void,
randombufferlength: u32,
) -> BOOLEAN {
windows_targets::link!("advapi32.dll" "system" "SystemFunction036" fn RtlGenRandom(randombuffer : *mut core::ffi::c_void, randombufferlength : u32) -> BOOLEAN);
RtlGenRandom(randombuffer, randombufferlength)
}
#[inline]
pub unsafe fn ProcessPrng(pbdata: &mut [u8]) -> BOOL {
windows_targets::link!("bcryptprimitives.dll" "system" fn ProcessPrng(pbdata : *mut u8, cbdata : usize) -> BOOL);
ProcessPrng(
core::mem::transmute(pbdata.as_ptr()),
pbdata.len().try_into().unwrap(),
)
}
#[repr(transparent)]
#[derive(PartialEq, Eq)]
pub struct BOOL(pub i32);
impl Default for BOOL {
fn default() -> Self {
unsafe { core::mem::zeroed() }
}
}
impl Clone for BOOL {
fn clone(&self) -> Self {
*self
}
}
impl Copy for BOOL {}
impl core::fmt::Debug for BOOL {
fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
f.debug_tuple("BOOL").field(&self.0).finish()
}
}
impl windows_core::TypeKind for BOOL {
type TypeKind = windows_core::CopyType;
}
#[repr(transparent)]
#[derive(PartialEq, Eq)]
pub struct BOOLEAN(pub u8);
impl Default for BOOLEAN {
fn default() -> Self {
unsafe { core::mem::zeroed() }
}
}
impl Clone for BOOLEAN {
fn clone(&self) -> Self {
*self
}
}
impl Copy for BOOLEAN {}
impl core::fmt::Debug for BOOLEAN {
fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
f.debug_tuple("BOOLEAN").field(&self.0).finish()
}
}
impl windows_core::TypeKind for BOOLEAN {
type TypeKind = windows_core::CopyType;
}
pub const TRUE: BOOL = BOOL(1i32); |
||
|
|
||
| pub fn getrandom_inner(dest: &mut [MaybeUninit<u8>]) -> Result<(), Error> { | ||
| // ProcessPrng should always return TRUE, but we check just in case. | ||
| match unsafe { ProcessPrng(dest.as_mut_ptr().cast::<u8>(), dest.len()) } { | ||
| TRUE => Ok(()), | ||
| _ => Err(Error::WINDOWS_PROCESS_PRNG), | ||
|
josephlr marked this conversation as resolved.
josephlr marked this conversation as resolved.
|
||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| //! Implementation for Windows 7 and 8 | ||
|
josephlr marked this conversation as resolved.
Outdated
|
||
| //! | ||
| //! For targets where we cannot use ProcessPrng (added in Windows 10), we use | ||
| //! RtlGenRandom. See windows.rs for a more detailed discussion of the Windows | ||
| //! RNG APIs (and why we don't use BCryptGenRandom). On versions prior to | ||
| //! Windows 10, this implementation works, while on Windows 10 and later, this | ||
| //! is a thin wrapper around ProcessPrng. | ||
|
josephlr marked this conversation as resolved.
Outdated
|
||
| //! | ||
| //! This implementation will not work on UWP targets, but those targets require | ||
| //! Windows 10 regardless, so can use the ProcessPrng implementation. | ||
| use crate::Error; | ||
| use core::{ffi::c_void, mem::MaybeUninit}; | ||
|
|
||
| // This code is based on that produced by windows-bindgen with the APIs: | ||
| // Windows.Win32.Foundation.TRUE | ||
| // Windows.Win32.Security.Authentication.Identity.RtlGenRandom | ||
| // but we avoid using windows-targets as it doesn't support older Windows. | ||
| #[link(name = "advapi32")] | ||
| extern "system" { | ||
| #[link_name = "SystemFunction036"] | ||
| fn RtlGenRandom(randombuffer: *mut c_void, randombufferlength: u32) -> BOOLEAN; | ||
| } | ||
| #[repr(transparent)] | ||
| #[derive(PartialEq, Eq)] | ||
| pub struct BOOLEAN(pub u8); | ||
| pub const TRUE: BOOLEAN = BOOLEAN(1u8); | ||
|
josephlr marked this conversation as resolved.
Outdated
|
||
|
|
||
| pub fn getrandom_inner(dest: &mut [MaybeUninit<u8>]) -> Result<(), Error> { | ||
| // Prevent overflow of u32 | ||
| for chunk in dest.chunks_mut(u32::max_value() as usize) { | ||
| let ret = unsafe { RtlGenRandom(chunk.as_mut_ptr().cast::<c_void>(), chunk.len() as u32) }; | ||
| if ret != TRUE { | ||
| return Err(Error::WINDOWS_RTL_GEN_RANDOM); | ||
| } | ||
| } | ||
| Ok(()) | ||
| } | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.