Browse code

Entropy cannot be saved

Remove non cryptographic randomness.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>

Justin Cormack authored on 2019/06/07 19:21:18
Showing 17 changed files
... ...
@@ -136,7 +136,7 @@ func (container *Container) CopyImagePathContent(v volume.Volume, destination st
136 136
 		return err
137 137
 	}
138 138
 
139
-	id := stringid.GenerateNonCryptoID()
139
+	id := stringid.GenerateRandomID()
140 140
 	path, err := v.Mount(id)
141 141
 	if err != nil {
142 142
 		return err
... ...
@@ -41,7 +41,7 @@ func (daemon *Daemon) createContainerOSSpecificSettings(container *container.Con
41 41
 	}
42 42
 
43 43
 	for spec := range config.Volumes {
44
-		name := stringid.GenerateNonCryptoID()
44
+		name := stringid.GenerateRandomID()
45 45
 		destination := filepath.Clean(spec)
46 46
 
47 47
 		// Skip volumes for which we already have something mounted on that
... ...
@@ -38,7 +38,7 @@ func (daemon *Daemon) createContainerOSSpecificSettings(container *container.Con
38 38
 
39 39
 		// If the mountpoint doesn't have a name, generate one.
40 40
 		if len(mp.Name) == 0 {
41
-			mp.Name = stringid.GenerateNonCryptoID()
41
+			mp.Name = stringid.GenerateRandomID()
42 42
 		}
43 43
 
44 44
 		// Skip volumes for which we already have something mounted on that
... ...
@@ -39,7 +39,7 @@ type Config struct {
39 39
 // NewConfig initializes the a new exec configuration
40 40
 func NewConfig() *Config {
41 41
 	return &Config{
42
-		ID:           stringid.GenerateNonCryptoID(),
42
+		ID:           stringid.GenerateRandomID(),
43 43
 		StreamConfig: stream.NewConfig(),
44 44
 		Started:      make(chan struct{}),
45 45
 	}
... ...
@@ -731,7 +731,7 @@ func BenchmarkConcurrentAccess(b *testing.B) {
731 731
 	// create a bunch of ids
732 732
 	var ids []string
733 733
 	for i := 0; i < numConcurrent; i++ {
734
-		ids = append(ids, stringid.GenerateNonCryptoID())
734
+		ids = append(ids, stringid.GenerateRandomID())
735 735
 	}
736 736
 
737 737
 	if err := d.Create(ids[0], "", nil); err != nil {
... ...
@@ -81,7 +81,7 @@ func makePluginCreator(name string, l logPlugin, scopePath func(s string) string
81 81
 			return nil, err
82 82
 		}
83 83
 
84
-		id := stringid.GenerateNonCryptoID()
84
+		id := stringid.GenerateRandomID()
85 85
 		a := &pluginAdapter{
86 86
 			driverName: name,
87 87
 			id:         id,
... ...
@@ -38,7 +38,7 @@ func (daemon *Daemon) registerName(container *container.Container) error {
38 38
 func (daemon *Daemon) generateIDAndName(name string) (string, string, error) {
39 39
 	var (
40 40
 		err error
41
-		id  = stringid.GenerateNonCryptoID()
41
+		id  = stringid.GenerateRandomID()
42 42
 	)
43 43
 
44 44
 	if name == "" {
... ...
@@ -558,7 +558,7 @@ func (s *DockerExternalVolumeSuite) TestExternalVolumeDriverCapabilities(c *chec
558 558
 }
559 559
 
560 560
 func (s *DockerExternalVolumeSuite) TestExternalVolumeDriverOutOfBandDelete(c *check.C) {
561
-	driverName := stringid.GenerateNonCryptoID()
561
+	driverName := stringid.GenerateRandomID()
562 562
 	p := newVolumePlugin(c, driverName)
563 563
 	defer p.Close()
564 564
 
... ...
@@ -61,7 +61,7 @@ func TestRenameStoppedContainer(t *testing.T) {
61 61
 	assert.NilError(t, err)
62 62
 	assert.Check(t, is.Equal("/"+oldName, inspect.Name))
63 63
 
64
-	newName := "new_name" + stringid.GenerateNonCryptoID()
64
+	newName := "new_name" + stringid.GenerateRandomID()
65 65
 	err = client.ContainerRename(ctx, oldName, newName)
66 66
 	assert.NilError(t, err)
67 67
 
... ...
@@ -79,7 +79,7 @@ func TestRenameRunningContainerAndReuse(t *testing.T) {
79 79
 	cID := container.Run(t, ctx, client, container.WithName(oldName))
80 80
 	poll.WaitOn(t, container.IsInState(ctx, client, cID, "running"), poll.WithDelay(100*time.Millisecond))
81 81
 
82
-	newName := "new_name" + stringid.GenerateNonCryptoID()
82
+	newName := "new_name" + stringid.GenerateRandomID()
83 83
 	err := client.ContainerRename(ctx, oldName, newName)
84 84
 	assert.NilError(t, err)
85 85
 
... ...
@@ -2,17 +2,12 @@
2 2
 package stringid // import "github.com/docker/docker/pkg/stringid"
3 3
 
4 4
 import (
5
-	cryptorand "crypto/rand"
5
+	"crypto/rand"
6 6
 	"encoding/hex"
7 7
 	"fmt"
8
-	"io"
9
-	"math"
10
-	"math/big"
11
-	"math/rand"
12 8
 	"regexp"
13 9
 	"strconv"
14 10
 	"strings"
15
-	"time"
16 11
 )
17 12
 
18 13
 const shortLen = 12
... ...
@@ -41,10 +36,11 @@ func TruncateID(id string) string {
41 41
 	return id
42 42
 }
43 43
 
44
-func generateID(r io.Reader) string {
44
+// GenerateRandomID returns a unique id.
45
+func GenerateRandomID() string {
45 46
 	b := make([]byte, 32)
46 47
 	for {
47
-		if _, err := io.ReadFull(r, b); err != nil {
48
+		if _, err := rand.Read(b); err != nil {
48 49
 			panic(err) // This shouldn't happen
49 50
 		}
50 51
 		id := hex.EncodeToString(b)
... ...
@@ -58,18 +54,6 @@ func generateID(r io.Reader) string {
58 58
 	}
59 59
 }
60 60
 
61
-// GenerateRandomID returns a unique id.
62
-func GenerateRandomID() string {
63
-	return generateID(cryptorand.Reader)
64
-}
65
-
66
-// GenerateNonCryptoID generates unique id without using cryptographically
67
-// secure sources of random.
68
-// It helps you to save entropy.
69
-func GenerateNonCryptoID() string {
70
-	return generateID(readerFunc(rand.Read))
71
-}
72
-
73 61
 // ValidateID checks whether an ID string is a valid image ID.
74 62
 func ValidateID(id string) error {
75 63
 	if ok := validHex.MatchString(id); !ok {
... ...
@@ -77,23 +61,3 @@ func ValidateID(id string) error {
77 77
 	}
78 78
 	return nil
79 79
 }
80
-
81
-func init() {
82
-	// safely set the seed globally so we generate random ids. Tries to use a
83
-	// crypto seed before falling back to time.
84
-	var seed int64
85
-	if cryptoseed, err := cryptorand.Int(cryptorand.Reader, big.NewInt(math.MaxInt64)); err != nil {
86
-		// This should not happen, but worst-case fallback to time-based seed.
87
-		seed = time.Now().UnixNano()
88
-	} else {
89
-		seed = cryptoseed.Int64()
90
-	}
91
-
92
-	rand.Seed(seed)
93
-}
94
-
95
-type readerFunc func(p []byte) (int, error)
96
-
97
-func (fn readerFunc) Read(p []byte) (int, error) {
98
-	return fn(p)
99
-}
... ...
@@ -13,14 +13,6 @@ func TestGenerateRandomID(t *testing.T) {
13 13
 	}
14 14
 }
15 15
 
16
-func TestGenerateNonCryptoID(t *testing.T) {
17
-	id := GenerateNonCryptoID()
18
-
19
-	if len(id) != 64 {
20
-		t.Fatalf("Id returned is incorrect: %s", id)
21
-	}
22
-}
23
-
24 16
 func TestShortenId(t *testing.T) {
25 17
 	id := "90435eec5c4e124e741ef731e118be2fc799a68aba0466ec17717f24ce2ae6a2"
26 18
 	truncID := TruncateID(id)
... ...
@@ -158,7 +158,7 @@ func assertIndexGet(t *testing.T, index *TruncIndex, input, expectedResult strin
158 158
 func BenchmarkTruncIndexAdd100(b *testing.B) {
159 159
 	var testSet []string
160 160
 	for i := 0; i < 100; i++ {
161
-		testSet = append(testSet, stringid.GenerateNonCryptoID())
161
+		testSet = append(testSet, stringid.GenerateRandomID())
162 162
 	}
163 163
 	b.ResetTimer()
164 164
 	for i := 0; i < b.N; i++ {
... ...
@@ -174,7 +174,7 @@ func BenchmarkTruncIndexAdd100(b *testing.B) {
174 174
 func BenchmarkTruncIndexAdd250(b *testing.B) {
175 175
 	var testSet []string
176 176
 	for i := 0; i < 250; i++ {
177
-		testSet = append(testSet, stringid.GenerateNonCryptoID())
177
+		testSet = append(testSet, stringid.GenerateRandomID())
178 178
 	}
179 179
 	b.ResetTimer()
180 180
 	for i := 0; i < b.N; i++ {
... ...
@@ -190,7 +190,7 @@ func BenchmarkTruncIndexAdd250(b *testing.B) {
190 190
 func BenchmarkTruncIndexAdd500(b *testing.B) {
191 191
 	var testSet []string
192 192
 	for i := 0; i < 500; i++ {
193
-		testSet = append(testSet, stringid.GenerateNonCryptoID())
193
+		testSet = append(testSet, stringid.GenerateRandomID())
194 194
 	}
195 195
 	b.ResetTimer()
196 196
 	for i := 0; i < b.N; i++ {
... ...
@@ -207,7 +207,7 @@ func BenchmarkTruncIndexGet100(b *testing.B) {
207 207
 	var testSet []string
208 208
 	var testKeys []string
209 209
 	for i := 0; i < 100; i++ {
210
-		testSet = append(testSet, stringid.GenerateNonCryptoID())
210
+		testSet = append(testSet, stringid.GenerateRandomID())
211 211
 	}
212 212
 	index := NewTruncIndex([]string{})
213 213
 	for _, id := range testSet {
... ...
@@ -231,7 +231,7 @@ func BenchmarkTruncIndexGet250(b *testing.B) {
231 231
 	var testSet []string
232 232
 	var testKeys []string
233 233
 	for i := 0; i < 250; i++ {
234
-		testSet = append(testSet, stringid.GenerateNonCryptoID())
234
+		testSet = append(testSet, stringid.GenerateRandomID())
235 235
 	}
236 236
 	index := NewTruncIndex([]string{})
237 237
 	for _, id := range testSet {
... ...
@@ -255,7 +255,7 @@ func BenchmarkTruncIndexGet500(b *testing.B) {
255 255
 	var testSet []string
256 256
 	var testKeys []string
257 257
 	for i := 0; i < 500; i++ {
258
-		testSet = append(testSet, stringid.GenerateNonCryptoID())
258
+		testSet = append(testSet, stringid.GenerateRandomID())
259 259
 	}
260 260
 	index := NewTruncIndex([]string{})
261 261
 	for _, id := range testSet {
... ...
@@ -278,7 +278,7 @@ func BenchmarkTruncIndexGet500(b *testing.B) {
278 278
 func BenchmarkTruncIndexDelete100(b *testing.B) {
279 279
 	var testSet []string
280 280
 	for i := 0; i < 100; i++ {
281
-		testSet = append(testSet, stringid.GenerateNonCryptoID())
281
+		testSet = append(testSet, stringid.GenerateRandomID())
282 282
 	}
283 283
 	b.ResetTimer()
284 284
 	for i := 0; i < b.N; i++ {
... ...
@@ -301,7 +301,7 @@ func BenchmarkTruncIndexDelete100(b *testing.B) {
301 301
 func BenchmarkTruncIndexDelete250(b *testing.B) {
302 302
 	var testSet []string
303 303
 	for i := 0; i < 250; i++ {
304
-		testSet = append(testSet, stringid.GenerateNonCryptoID())
304
+		testSet = append(testSet, stringid.GenerateRandomID())
305 305
 	}
306 306
 	b.ResetTimer()
307 307
 	for i := 0; i < b.N; i++ {
... ...
@@ -324,7 +324,7 @@ func BenchmarkTruncIndexDelete250(b *testing.B) {
324 324
 func BenchmarkTruncIndexDelete500(b *testing.B) {
325 325
 	var testSet []string
326 326
 	for i := 0; i < 500; i++ {
327
-		testSet = append(testSet, stringid.GenerateNonCryptoID())
327
+		testSet = append(testSet, stringid.GenerateRandomID())
328 328
 	}
329 329
 	b.ResetTimer()
330 330
 	for i := 0; i < b.N; i++ {
... ...
@@ -347,7 +347,7 @@ func BenchmarkTruncIndexDelete500(b *testing.B) {
347 347
 func BenchmarkTruncIndexNew100(b *testing.B) {
348 348
 	var testSet []string
349 349
 	for i := 0; i < 100; i++ {
350
-		testSet = append(testSet, stringid.GenerateNonCryptoID())
350
+		testSet = append(testSet, stringid.GenerateRandomID())
351 351
 	}
352 352
 	b.ResetTimer()
353 353
 	for i := 0; i < b.N; i++ {
... ...
@@ -358,7 +358,7 @@ func BenchmarkTruncIndexNew100(b *testing.B) {
358 358
 func BenchmarkTruncIndexNew250(b *testing.B) {
359 359
 	var testSet []string
360 360
 	for i := 0; i < 250; i++ {
361
-		testSet = append(testSet, stringid.GenerateNonCryptoID())
361
+		testSet = append(testSet, stringid.GenerateRandomID())
362 362
 	}
363 363
 	b.ResetTimer()
364 364
 	for i := 0; i < b.N; i++ {
... ...
@@ -369,7 +369,7 @@ func BenchmarkTruncIndexNew250(b *testing.B) {
369 369
 func BenchmarkTruncIndexNew500(b *testing.B) {
370 370
 	var testSet []string
371 371
 	for i := 0; i < 500; i++ {
372
-		testSet = append(testSet, stringid.GenerateNonCryptoID())
372
+		testSet = append(testSet, stringid.GenerateRandomID())
373 373
 	}
374 374
 	b.ResetTimer()
375 375
 	for i := 0; i < b.N; i++ {
... ...
@@ -381,7 +381,7 @@ func BenchmarkTruncIndexAddGet100(b *testing.B) {
381 381
 	var testSet []string
382 382
 	var testKeys []string
383 383
 	for i := 0; i < 500; i++ {
384
-		id := stringid.GenerateNonCryptoID()
384
+		id := stringid.GenerateRandomID()
385 385
 		testSet = append(testSet, id)
386 386
 		l := rand.Intn(12) + 12
387 387
 		testKeys = append(testKeys, id[:l])
... ...
@@ -406,7 +406,7 @@ func BenchmarkTruncIndexAddGet250(b *testing.B) {
406 406
 	var testSet []string
407 407
 	var testKeys []string
408 408
 	for i := 0; i < 500; i++ {
409
-		id := stringid.GenerateNonCryptoID()
409
+		id := stringid.GenerateRandomID()
410 410
 		testSet = append(testSet, id)
411 411
 		l := rand.Intn(12) + 12
412 412
 		testKeys = append(testKeys, id[:l])
... ...
@@ -431,7 +431,7 @@ func BenchmarkTruncIndexAddGet500(b *testing.B) {
431 431
 	var testSet []string
432 432
 	var testKeys []string
433 433
 	for i := 0; i < 500; i++ {
434
-		id := stringid.GenerateNonCryptoID()
434
+		id := stringid.GenerateRandomID()
435 435
 		testSet = append(testSet, id)
436 436
 		l := rand.Intn(12) + 12
437 437
 		testKeys = append(testKeys, id[:l])
... ...
@@ -70,7 +70,7 @@ func TestManagerWithPluginMounts(t *testing.T) {
70 70
 }
71 71
 
72 72
 func newTestPlugin(t *testing.T, name, cap, root string) *v2.Plugin {
73
-	id := stringid.GenerateNonCryptoID()
73
+	id := stringid.GenerateRandomID()
74 74
 	rootfs := filepath.Join(root, id)
75 75
 	if err := os.MkdirAll(rootfs, 0755); err != nil {
76 76
 		t.Fatal(err)
... ...
@@ -298,7 +298,7 @@ func (p *linuxParser) parseMountSpec(cfg mount.Mount, validateBindSourceExists b
298 298
 	switch cfg.Type {
299 299
 	case mount.TypeVolume:
300 300
 		if cfg.Source == "" {
301
-			mp.Name = stringid.GenerateNonCryptoID()
301
+			mp.Name = stringid.GenerateRandomID()
302 302
 		} else {
303 303
 			mp.Name = cfg.Source
304 304
 		}
... ...
@@ -125,7 +125,7 @@ func (m *MountPoint) Setup(mountLabel string, rootIDs idtools.Identity, checkFun
125 125
 	if m.Volume != nil {
126 126
 		id := m.ID
127 127
 		if id == "" {
128
-			id = stringid.GenerateNonCryptoID()
128
+			id = stringid.GenerateRandomID()
129 129
 		}
130 130
 		path, err := m.Volume.Mount(id)
131 131
 		if err != nil {
... ...
@@ -385,7 +385,7 @@ func (p *windowsParser) parseMountSpec(cfg mount.Mount, destRegex string, conver
385 385
 	switch cfg.Type {
386 386
 	case mount.TypeVolume:
387 387
 		if cfg.Source == "" {
388
-			mp.Name = stringid.GenerateNonCryptoID()
388
+			mp.Name = stringid.GenerateRandomID()
389 389
 		} else {
390 390
 			mp.Name = cfg.Source
391 391
 		}
... ...
@@ -63,7 +63,7 @@ func (s *VolumesService) GetDriverList() []string {
63 63
 // When whatever is going to reference this volume is removed the caller should defeference the volume by calling `Release`.
64 64
 func (s *VolumesService) Create(ctx context.Context, name, driverName string, opts ...opts.CreateOption) (*types.Volume, error) {
65 65
 	if name == "" {
66
-		name = stringid.GenerateNonCryptoID()
66
+		name = stringid.GenerateRandomID()
67 67
 	}
68 68
 	v, err := s.vs.Create(ctx, name, driverName, opts...)
69 69
 	if err != nil {