9
9
10
10
` getrandom ` is a Rust library for retrieving random data from (operating) system sources.
11
11
12
- It is assumed that the system always provides high-quality cryptographically secure random
13
- data, ideally backed by hardware entropy sources. This crate derives its name
14
- from Linux's ` getrandom ` function, but is cross-platform, roughly supporting
15
- the same set of platforms as Rust's ` std ` lib .
12
+ It is assumed that the system always provides high-quality, cryptographically secure random
13
+ data, ideally backed by hardware entropy sources. This crate derives its name from
14
+ the Linux ` getrandom ` syscall but is cross-platform, roughly supporting the same set
15
+ of platforms as Rust's ` std ` library .
16
16
17
- This is a low-level API. Most users should prefer using high -level random-number
17
+ This is a low-level API. Most users should prefer using a higher -level random-number
18
18
library like [ ` rand ` ] .
19
19
20
20
[ `rand` ] : https://crates.io/crates/rand
@@ -73,31 +73,33 @@ Pull Requests that add support for new targets to `getrandom` are always welcome
73
73
74
74
### Opt-in backends
75
75
76
- ` getrandom ` also provides optional backends which can be enabled using ` getrandom_backend `
77
- configuration flag :
76
+ ` getrandom ` also provides optional (opt-in) backends, which allow users to customize the source
77
+ of randomness based on their specific needs :
78
78
79
79
| Backend name | Target | Target Triple | Implementation
80
80
| ----------------- | -------------------- | -------------------- | --------------
81
81
| ` linux_getrandom ` | Linux, Android | ` *‑linux‑* ` | [ ` getrandom ` ] [ 1 ] system call (without ` /dev/urandom ` fallback). Bumps minimum supported Linux kernel version to 3.17 and Android API level to 23 (Marshmallow).
82
82
| ` linux_rustix ` | Linux, Android | ` *‑linux‑* ` | Same as ` linux_getrandom ` , but uses [ ` rustix ` ] instead of ` libc ` .
83
83
| ` rdrand ` | x86, x86-64 | ` x86_64-* ` , ` i686-* ` | [ ` RDRAND ` ] instruction
84
84
| ` rndr ` | AArch64 | ` aarch64-* ` | [ ` RNDR ` ] register
85
- | ` esp_idf ` | ESP-IDF | ` *‑espidf ` | [ ` esp_fill_random ` ] . WARNING: can return low quality entropy without proper hardware configuration!
85
+ | ` esp_idf ` | ESP-IDF | ` *‑espidf ` | [ ` esp_fill_random ` ] . WARNING: can return low- quality entropy without proper hardware configuration!
86
86
| ` wasm_js ` | Web Browser, Node.js | ` wasm*‑*‑unknown ` | [ ` Crypto.getRandomValues ` ] if available, then [ ` crypto.randomFillSync ` ] if on Node.js (see [ WebAssembly support] )
87
87
| ` custom ` | All targets | ` * ` | User-provided custom implementation (see [ custom backend] )
88
88
89
- The configuration flag can be enabled either by specifying the ` rustflags ` field in
89
+ Opt-in backends can be enabled using the ` getrandom_backend ` configuration flag.
90
+ The flag can be set either by specifying the ` rustflags ` field in
90
91
[ ` .cargo/config.toml ` ] (note that it can be done on a per-target basis), or by using
91
- ` RUSTFLAGS ` environment variable:
92
+ the ` RUSTFLAGS ` environment variable:
92
93
93
94
``` sh
94
95
RUSTFLAGS=' --cfg getrandom_backend="linux_getrandom"' cargo build
95
96
```
96
97
97
- Enabling an opt-in backend will replace backend used by default. Doing it for a wrong target
98
- (e.g. using ` linux_getrandom ` while compiling for a Windows target) will result
99
- in a compilation error. Be extremely carefull while using opt-in backends, since incorrect
100
- configuration may result in vulnerable or in always panicking applications.
98
+ Enabling an opt-in backend will replace the backend used by default. Doing this for
99
+ an incorrect target (e.g. using ` linux_getrandom ` while compiling for a Windows target)
100
+ will result in a compilation error. Be extremely careful while using opt-in backends,
101
+ as incorrect configuration may result in vulnerable applications or applications
102
+ that always panic.
101
103
102
104
Note that using an opt-in backend in a library (e.g. for tests or benchmarks)
103
105
WILL NOT have any effect on its downstream users.
@@ -138,7 +140,7 @@ This crate will then use the provided `webcrypto` implementation.
138
140
139
141
### Custom backend
140
142
141
- If this crate does not support your target out of box or you have to use
143
+ If this crate does not support your target out of the box or you have to use
142
144
a non-default entropy source, then you can provide a custom implementation.
143
145
You need to enable the custom backend as described in the [ configuration flags]
144
146
section. Next, you need to define an ` extern ` function with the following
@@ -156,20 +158,20 @@ unsafe extern "Rust" fn __getrandom_v03_custom(
156
158
}
157
159
```
158
160
159
- This function ideally should be defined in the root crate of your project,
161
+ This function should, ideally, be defined in the root crate of your project,
160
162
e.g. in your ` main.rs ` . This function MUST be defined only once for your
161
163
project, i.e. upstream library crates SHOULD NOT define it outside of
162
164
tests and benchmarks. Improper configuration of this backend may result
163
165
in linking errors.
164
166
165
- The function accepts pointer to buffer which should be filled with random
166
- data and length in bytes. Note that the buffer MAY be uninitialized.
167
- On success the function should return 0 and fully fill the input buffer,
168
- every other return result will be interpreted as an error code .
167
+ The function accepts a pointer to a buffer that should be filled with random
168
+ data and its length in bytes. Note that the buffer MAY be uninitialized.
169
+ On success, the function should return ` Ok(()) ` and fully fill the input buffer;
170
+ otherwise, it should return an error value .
169
171
170
172
If you are confident that ` getrandom ` is not used in your project, but
171
173
it gets pulled nevertheless by one of your dependencies, then you can
172
- use the following custom backend which always returns "unsupported" error:
174
+ use the following custom backend, which always returns the "unsupported" error:
173
175
``` rust
174
176
use getrandom :: Error ;
175
177
@@ -183,29 +185,30 @@ unsafe extern "Rust" fn __getrandom_v03_custom(
183
185
```
184
186
185
187
### Platform Support
188
+
186
189
This crate generally supports the same operating system and platform versions
187
190
that the Rust standard library does. Additional targets may be supported using
188
- pluggable custom implementations .
191
+ the opt-in custom backend .
189
192
190
193
This means that as Rust drops support for old versions of operating systems
191
- (such as old Linux kernel versions, Android API levels, etc) in stable releases,
192
- ` getrandom ` may create new patch releases ( ` 0.N.x ` ) that remove support for
194
+ (such as old Linux kernel versions, Android API levels, etc. ) in stable releases,
195
+ ` getrandom ` may create new patch releases that remove support for
193
196
outdated platform versions.
194
197
195
198
### ` /dev/urandom ` fallback on Linux and Android
196
199
197
- On Linux targets the fallback is present only if either ` target_env ` is ` musl ` ,
198
- or ` target_arch ` is one of the following: ` aarch64 ` , ` arm ` , ` powerpc ` , ` powerpc64 ` ,
199
- ` s390x ` , ` x86 ` , ` x86_64 ` . Other supported targets [ require] [ platform-support ]
200
- kernel versions which support ` getrandom ` system call, so fallback is not needed.
200
+ On Linux targets, the ` /dev/urandom ` fallback is present only if either ` target_env `
201
+ is ` musl ` , or ` target_arch ` is one of the following: ` aarch64 ` , ` arm ` , ` powerpc ` ,
202
+ ` powerpc64 ` , ` s390x ` , ` x86 ` , ` x86_64 ` . Other supported targets [ require] [ platform-support ]
203
+ kernel versions that support the ` getrandom ` system call, so the fallback is not needed.
201
204
202
205
On Android targets the fallback is present only for the following ` target_arch ` es:
203
206
` aarch64 ` , ` arm ` , ` x86 ` , ` x86_64 ` . Other ` target_arch ` es (e.g. RISC-V) require
204
207
sufficiently high API levels.
205
208
206
209
The fallback can be disabled by enabling the ` linux_getrandom ` opt-in backend.
207
- Note that doing so will bump minimum supported Linux kernel version to 3.17 and
208
- Android API level to 23 (Marshmallow).
210
+ Note that doing so will bump minimum supported Linux kernel version to 3.17
211
+ and Android API level to 23 (Marshmallow).
209
212
210
213
### Early boot
211
214
@@ -234,28 +237,29 @@ with few sources of entropy.
234
237
235
238
## Error handling
236
239
237
- We always choose failure over returning known insecure "random" bytes. In
238
- general , on supported platforms, failure is highly unlikely, though not
239
- impossible. If an error does occur, then it is likely that it will occur
240
- on every call to ` getrandom ` , hence after the first successful call one
241
- can be reasonably confident that no errors will occur.
240
+ We always prioritize failure over returning known insecure "random" bytes.
241
+ Generally , on supported platforms, failure is highly unlikely, though not
242
+ impossible. If an error does occur, it is likely that it will occur
243
+ on every call to ` getrandom ` . Therefore, after the first successful call,
244
+ one can be reasonably confident that no errors will occur.
242
245
243
246
## Panic handling
244
247
245
- We strive to eliminate all potential panics from our implementation .
246
- In other words, when compiled with enabled optimizations, generated
247
- binary code for ` getrandom ` functions should not contain any panic
248
- branches. Even if platform misbiheaves and returns an unexpected
249
- result, our code should correctly handle it and return an error like
248
+ We strive to eliminate all potential panics from our backend implementations .
249
+ In other words, when compiled with optimizations enabled, the generated
250
+ binary code for ` getrandom ` functions should not contain any panic branches.
251
+ Even if the platform misbehaves and returns an unexpected result,
252
+ our code should correctly handle it and return an error, e.g.
250
253
[ ` Error::UNEXPECTED ` ] .
251
254
252
255
## Sanitizer support
253
256
254
- If your code uses [ ` fill_uninit ` ] and you use memory sanitizer
255
- (i.e. ` -Zsanitizer=memory ` ), then you need to pass ` getrandom_sanitize `
256
- configuration flag for ` fill_uninit ` to unpoison destination buffer.
257
+ If your code uses [ ` fill_uninit ` ] and you enable memory sanitization
258
+ (i.e. ` -Zsanitizer=memory ` ), you need to pass the ` getrandom_sanitize `
259
+ configuration flag to enable unpoisoning of the destination buffer
260
+ filled by ` fill_uninit ` .
257
261
258
- For example, it can be done like this (requires Nightly compiler):
262
+ For example, this can be done as follows (requires a Nightly compiler):
259
263
``` sh
260
264
RUSTFLAGS=" -Zsanitizer=memory --cfg getrandom_sanitize" \
261
265
cargo test -Zbuild-std --target=x86_64-unknown-linux-gnu
0 commit comments