random_bytes_dev_urandom.php 4.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150
  1. <?php
  2. /**
  3. * Random_* Compatibility Library
  4. * for using the new PHP 7 random_* API in PHP 5 projects
  5. *
  6. * The MIT License (MIT)
  7. *
  8. * Copyright (c) 2015 Paragon Initiative Enterprises
  9. *
  10. * Permission is hereby granted, free of charge, to any person obtaining a copy
  11. * of this software and associated documentation files (the "Software"), to deal
  12. * in the Software without restriction, including without limitation the rights
  13. * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  14. * copies of the Software, and to permit persons to whom the Software is
  15. * furnished to do so, subject to the following conditions:
  16. *
  17. * The above copyright notice and this permission notice shall be included in
  18. * all copies or substantial portions of the Software.
  19. *
  20. * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  21. * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  22. * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  23. * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  24. * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  25. * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  26. * SOFTWARE.
  27. */
  28. if (!defined('RANDOM_COMPAT_READ_BUFFER')) {
  29. define('RANDOM_COMPAT_READ_BUFFER', 8);
  30. }
  31. if (!is_callable('random_bytes')) {
  32. /**
  33. * Unless open_basedir is enabled, use /dev/urandom for
  34. * random numbers in accordance with best practices
  35. *
  36. * Why we use /dev/urandom and not /dev/random
  37. * @ref http://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers
  38. *
  39. * @param int $bytes
  40. *
  41. * @throws Exception
  42. *
  43. * @return string
  44. */
  45. function random_bytes($bytes)
  46. {
  47. static $fp = null;
  48. /**
  49. * This block should only be run once
  50. */
  51. if (empty($fp)) {
  52. /**
  53. * We use /dev/urandom if it is a char device.
  54. * We never fall back to /dev/random
  55. */
  56. $fp = fopen('/dev/urandom', 'rb');
  57. if (!empty($fp)) {
  58. $st = fstat($fp);
  59. if (($st['mode'] & 0170000) !== 020000) {
  60. fclose($fp);
  61. $fp = false;
  62. }
  63. }
  64. if (!empty($fp)) {
  65. /**
  66. * stream_set_read_buffer() does not exist in HHVM
  67. *
  68. * If we don't set the stream's read buffer to 0, PHP will
  69. * internally buffer 8192 bytes, which can waste entropy
  70. *
  71. * stream_set_read_buffer returns 0 on success
  72. */
  73. if (function_exists('stream_set_read_buffer')) {
  74. stream_set_read_buffer($fp, RANDOM_COMPAT_READ_BUFFER);
  75. }
  76. if (function_exists('stream_set_chunk_size')) {
  77. stream_set_chunk_size($fp, RANDOM_COMPAT_READ_BUFFER);
  78. }
  79. }
  80. }
  81. try {
  82. $bytes = RandomCompat_intval($bytes);
  83. } catch (TypeError $ex) {
  84. throw new TypeError(
  85. 'random_bytes(): $bytes must be an integer'
  86. );
  87. }
  88. if ($bytes < 1) {
  89. throw new Error(
  90. 'Length must be greater than 0'
  91. );
  92. }
  93. /**
  94. * This if() block only runs if we managed to open a file handle
  95. *
  96. * It does not belong in an else {} block, because the above
  97. * if (empty($fp)) line is logic that should only be run once per
  98. * page load.
  99. */
  100. if (!empty($fp)) {
  101. $remaining = $bytes;
  102. $buf = '';
  103. /**
  104. * We use fread() in a loop to protect against partial reads
  105. */
  106. do {
  107. $read = fread($fp, $remaining);
  108. if ($read === false) {
  109. /**
  110. * We cannot safely read from the file. Exit the
  111. * do-while loop and trigger the exception condition
  112. */
  113. $buf = false;
  114. break;
  115. }
  116. /**
  117. * Decrease the number of bytes returned from remaining
  118. */
  119. $remaining -= RandomCompat_strlen($read);
  120. $buf .= $read;
  121. } while ($remaining > 0);
  122. /**
  123. * Is our result valid?
  124. */
  125. if ($buf !== false) {
  126. if (RandomCompat_strlen($buf) === $bytes) {
  127. /**
  128. * Return our random entropy buffer here:
  129. */
  130. return $buf;
  131. }
  132. }
  133. }
  134. /**
  135. * If we reach here, PHP has failed us.
  136. */
  137. throw new Exception(
  138. 'Error reading from source device'
  139. );
  140. }
  141. }