00c0d4
commit f430293d842031f2afc3013f156e1018065e480e
00c0d4
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
00c0d4
Date:   Tue Jan 12 09:17:09 2021 -0300
00c0d4
00c0d4
    posix: consume less entropy on tempname
00c0d4
    
00c0d4
    The first getrandom is used only for __GT_NOCREATE, which is inherently
00c0d4
    insecure and can use the entropy as a small improvement.  On the
00c0d4
    second and later attempts it might help against DoS attacks.
00c0d4
    
00c0d4
    It sync with gnulib commit 854fbb81d91f7a0f2b463e7ace2499dee2f380f2.
00c0d4
    
00c0d4
    Checked on x86_64-linux-gnu.
00c0d4
00c0d4
diff --git a/sysdeps/posix/tempname.c b/sysdeps/posix/tempname.c
00c0d4
index fcab9b26364021e4..3435c4bf75a01f42 100644
00c0d4
--- a/sysdeps/posix/tempname.c
00c0d4
+++ b/sysdeps/posix/tempname.c
00c0d4
@@ -22,6 +22,7 @@
00c0d4
 
00c0d4
 #include <sys/types.h>
00c0d4
 #include <assert.h>
00c0d4
+#include <stdbool.h>
00c0d4
 
00c0d4
 #include <errno.h>
00c0d4
 
00c0d4
@@ -79,11 +80,11 @@ typedef uint_fast64_t random_value;
00c0d4
 #define BASE_62_POWER (62LL * 62 * 62 * 62 * 62 * 62 * 62 * 62 * 62 * 62)
00c0d4
 
00c0d4
 static random_value
00c0d4
-random_bits (random_value var)
00c0d4
+random_bits (random_value var, bool use_getrandom)
00c0d4
 {
00c0d4
   random_value r;
00c0d4
   /* Without GRND_NONBLOCK it can be blocked for minutes on some systems.  */
00c0d4
-  if (__getrandom (&r, sizeof r, GRND_NONBLOCK) == sizeof r)
00c0d4
+  if (use_getrandom && __getrandom (&r, sizeof r, GRND_NONBLOCK) == sizeof r)
00c0d4
     return r;
00c0d4
 #if _LIBC || (defined CLOCK_MONOTONIC && HAVE_CLOCK_GETTIME)
00c0d4
   /* Add entropy if getrandom did not work.  */
00c0d4
@@ -271,6 +272,13 @@ try_tempname_len (char *tmpl, int suffixlen, void *args,
00c0d4
   /* How many random base-62 digits can currently be extracted from V.  */
00c0d4
   int vdigits = 0;
00c0d4
 
00c0d4
+  /* Whether to consume entropy when acquiring random bits.  On the
00c0d4
+     first try it's worth the entropy cost with __GT_NOCREATE, which
00c0d4
+     is inherently insecure and can use the entropy to make it a bit
00c0d4
+     less secure.  On the (rare) second and later attempts it might
00c0d4
+     help against DoS attacks.  */
00c0d4
+  bool use_getrandom = tryfunc == try_nocreate;
00c0d4
+
00c0d4
   /* Least unfair value for V.  If V is less than this, V can generate
00c0d4
      BASE_62_DIGITS digits fairly.  Otherwise it might be biased.  */
00c0d4
   random_value const unfair_min
00c0d4
@@ -294,7 +302,10 @@ try_tempname_len (char *tmpl, int suffixlen, void *args,
00c0d4
           if (vdigits == 0)
00c0d4
             {
00c0d4
               do
00c0d4
-                v = random_bits (v);
00c0d4
+                {
00c0d4
+                  v = random_bits (v, use_getrandom);
00c0d4
+                  use_getrandom = true;
00c0d4
+                }
00c0d4
               while (unfair_min <= v);
00c0d4
 
00c0d4
               vdigits = BASE_62_DIGITS;