Move ReseedingRng into a separate module

Author: newpavlov

thread-rng/src/lib.rs

@@ -13,77 +13,35 @@ use std::fmt;
 use std::rc::Rc;
 use std::thread_local;
 
-use rand_chacha::ChaCha12Rng;
-use rand_core::SeedableRng;
-
 pub use rand_core::{self, CryptoRng, RngCore};
 
-// Rationale for using `UnsafeCell` in `ThreadRng`:
-//
-// Previously we used a `RefCell`, with an overhead of ~15%. There will only
-// ever be one mutable reference to the interior of the `UnsafeCell`, because
-// we only have such a reference inside `next_u32`, `next_u64`, etc. Within a
-// single thread (which is the definition of `ThreadRng`), there will only ever
-// be one of these methods active at a time.
-//
-// A possible scenario where there could be multiple mutable references is if
-// `ThreadRng` is used inside `next_u32` and co. But the implementation is
-// completely under our control. We just have to ensure none of them use
-// `ThreadRng` internally, which is nonsensical anyway. We should also never run
-// `ThreadRng` in destructors of its implementation, which is also nonsensical.
-
-// Number of generated bytes after which to reseed `ThreadRng`.
-// According to benchmarks, reseeding has a noticeable impact with thresholds
-// of 32 kB and less. We choose 64 kB to avoid significant overhead.
-const THREAD_RNG_RESEED_THRESHOLD: isize = 1024 * 64;
-
-struct ReseedingRng {
-    rng: ChaCha12Rng,
-    bytes_until_reseed: isize,
-}
+mod reseeding_rng;
+use reseeding_rng::ReseedingRng;
 
-impl ReseedingRng {
-    #[inline(always)]
-    fn reseed_check(&mut self, n: isize) {
-        if self.bytes_until_reseed < 0 {
-            // If system RNG has failed for some reason, ignore the error
-            // and continue to work with the old RNG state.
-            let _ = self.reseed();
+thread_local!(
+    // We require Rc<..> to avoid premature freeing when ThreadRng is used
+    // within thread-local destructors. See https://github.com/rust-random/rand/issues/968.
+    //
+    // Rationale for using `UnsafeCell`:
+    //
+    // Previously we used a `RefCell`, with an overhead of ~15%. There will only
+    // ever be one mutable reference to the interior of the `UnsafeCell`, because
+    // we only have such a reference inside `next_u32`, `next_u64`, etc. Within a
+    // single thread (which is the definition of `ThreadRng`), there will only ever
+    // be one of these methods active at a time.
+    //
+    // A possible scenario where there could be multiple mutable references is if
+    // `ThreadRng` is used inside `next_u32` and co. But the implementation is
+    // completely under our control. We just have to ensure none of them use
+    // `ThreadRng` internally, which is nonsensical anyway. We should also never run
+    // `ThreadRng` in destructors of its implementation, which is also nonsensical.
+    static THREAD_RNG_KEY: Rc<UnsafeCell<ReseedingRng>> = {
+        match ReseedingRng::new() {
+            Ok(rng) => Rc::new(UnsafeCell::new(rng)),
+            Err(err) => panic!("could not initialize ThreadRng: {}", err),
         }
-        self.bytes_until_reseed -= n;
-    }
-
-    #[inline(always)]
-    fn reseed(&mut self) -> Result<(), rand_core::getrandom::Error> {
-        self.bytes_until_reseed = THREAD_RNG_RESEED_THRESHOLD;
-        self.rng = ChaCha12Rng::try_from_os_rng()?;
-        Ok(())
-    }
-}
-
-impl RngCore for ReseedingRng {
-    #[inline(always)]
-    fn next_u32(&mut self) -> u32 {
-        self.reseed_check(core::mem::size_of::<u32>() as isize);
-        self.rng.next_u32()
     }
-
-    #[inline(always)]
-    fn next_u64(&mut self) -> u64 {
-        self.reseed_check(core::mem::size_of::<u64>() as isize);
-        self.rng.next_u64()
-    }
-
-    #[inline(always)]
-    fn fill_bytes(&mut self, dest: &mut [u8]) {
-        // Valid allocation can not be bigger than `isize::MAX` bytes,
-        // so we can cast length to `isize` without issues.
-        self.reseed_check(dest.len() as isize);
-        self.rng.fill_bytes(dest)
-    }
-}
-
-impl CryptoRng for ReseedingRng {}
+);
 
 /// A reference to the thread-local generator.
 ///
@@ -165,17 +123,6 @@ impl fmt::Debug for ThreadRng {
     }
 }
 
-thread_local!(
-    // We require Rc<..> to avoid premature freeing when ThreadRng is used
-    // within thread-local destructors. See https://github.com/rust-random/rand/issues/968.
-    static THREAD_RNG_KEY: Rc<UnsafeCell<ReseedingRng>> = {
-        let rng = ChaCha12Rng::try_from_os_rng().unwrap_or_else(|err|
-                panic!("could not initialize ThreadRng: {}", err));
-        let reseeding_rng = ReseedingRng { rng, bytes_until_reseed: THREAD_RNG_RESEED_THRESHOLD };
-        Rc::new(UnsafeCell::new(reseeding_rng))
-    }
-);
-
 /// Access a fast, pre-initialized generator
 ///
 /// This is a handle to the local [`ThreadRng`].

thread-rng/src/reseeding_rng.rs

@@ -0,0 +1,62 @@
+use rand_chacha::ChaCha12Rng;
+use rand_core::{CryptoRng, RngCore, SeedableRng};
+
+// Number of generated bytes after which to reseed `ThreadRng`.
+// According to benchmarks, reseeding has a noticeable impact with thresholds
+// of 32 kB and less. We choose 64 kB to avoid significant overhead.
+const THREAD_RNG_RESEED_THRESHOLD: isize = 1024 * 64;
+
+pub(crate) struct ReseedingRng {
+    rng: ChaCha12Rng,
+    bytes_until_reseed: isize,
+}
+
+impl ReseedingRng {
+    pub fn new() -> Result<Self, rand_core::getrandom::Error> {
+        ChaCha12Rng::try_from_os_rng().map(|rng| Self {
+            rng,
+            bytes_until_reseed: THREAD_RNG_RESEED_THRESHOLD,
+        })
+    }
+
+    #[inline(always)]
+    pub fn reseed(&mut self) -> Result<(), rand_core::getrandom::Error> {
+        self.bytes_until_reseed = THREAD_RNG_RESEED_THRESHOLD;
+        self.rng = ChaCha12Rng::try_from_os_rng()?;
+        Ok(())
+    }
+
+    #[inline(always)]
+    fn reseed_check(&mut self, n: isize) {
+        if self.bytes_until_reseed < 0 {
+            // If system RNG has failed for some reason, ignore the error
+            // and continue to work with the old RNG state.
+            let _ = self.reseed();
+        }
+        self.bytes_until_reseed -= n;
+    }
+}
+
+impl RngCore for ReseedingRng {
+    #[inline(always)]
+    fn next_u32(&mut self) -> u32 {
+        self.reseed_check(core::mem::size_of::<u32>() as isize);
+        self.rng.next_u32()
+    }
+
+    #[inline(always)]
+    fn next_u64(&mut self) -> u64 {
+        self.reseed_check(core::mem::size_of::<u64>() as isize);
+        self.rng.next_u64()
+    }
+
+    #[inline(always)]
+    fn fill_bytes(&mut self, dest: &mut [u8]) {
+        // Valid allocation can not be bigger than `isize::MAX` bytes,
+        // so we can cast length to `isize` without issues.
+        self.reseed_check(dest.len() as isize);
+        self.rng.fill_bytes(dest)
+    }
+}
+
+impl CryptoRng for ReseedingRng {}