Skip to content
This repository was archived by the owner on Oct 13, 2023. It is now read-only.

Commit 2df693e

Browse files
justincormackjustincormack
committed
Entropy cannot be saved
Remove non cryptographic randomness. Signed-off-by: Justin Cormack <[email protected]>
1 parent 1d5748d commit 2df693e

File tree

17 files changed

+34
-78
lines changed

17 files changed

+34
-78
lines changed

‎container/container_unix.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ func (container *Container) CopyImagePathContent(v volume.Volume, destination st
136136
return err
137137
}
138138

139-
id := stringid.GenerateNonCryptoID()
139+
id := stringid.GenerateRandomID()
140140
path, err := v.Mount(id)
141141
if err != nil {
142142
return err

‎daemon/create_unix.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ func (daemon *Daemon) createContainerOSSpecificSettings(container *container.Con
4141
}
4242

4343
for spec := range config.Volumes {
44-
name := stringid.GenerateNonCryptoID()
44+
name := stringid.GenerateRandomID()
4545
destination := filepath.Clean(spec)
4646

4747
// Skip volumes for which we already have something mounted on that

‎daemon/create_windows.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ func (daemon *Daemon) createContainerOSSpecificSettings(container *container.Con
3838

3939
// If the mountpoint doesn't have a name, generate one.
4040
if len(mp.Name) == 0 {
41-
mp.Name = stringid.GenerateNonCryptoID()
41+
mp.Name = stringid.GenerateRandomID()
4242
}
4343

4444
// Skip volumes for which we already have something mounted on that

‎daemon/exec/exec.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ type Config struct {
3939
// NewConfig initializes the a new exec configuration
4040
func NewConfig() *Config {
4141
return &Config{
42-
ID: stringid.GenerateNonCryptoID(),
42+
ID: stringid.GenerateRandomID(),
4343
StreamConfig: stream.NewConfig(),
4444
Started: make(chan struct{}),
4545
}

‎daemon/graphdriver/aufs/aufs_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -731,7 +731,7 @@ func BenchmarkConcurrentAccess(b *testing.B) {
731731
// create a bunch of ids
732732
var ids []string
733733
for i := 0; i < numConcurrent; i++ {
734-
ids = append(ids, stringid.GenerateNonCryptoID())
734+
ids = append(ids, stringid.GenerateRandomID())
735735
}
736736

737737
if err := d.Create(ids[0], "", nil); err != nil {

‎daemon/logger/plugin.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ func makePluginCreator(name string, l logPlugin, scopePath func(s string) string
8181
return nil, err
8282
}
8383

84-
id := stringid.GenerateNonCryptoID()
84+
id := stringid.GenerateRandomID()
8585
a := &pluginAdapter{
8686
driverName: name,
8787
id: id,

‎daemon/names.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ func (daemon *Daemon) registerName(container *container.Container) error {
3838
func (daemon *Daemon) generateIDAndName(name string) (string, string, error) {
3939
var (
4040
err error
41-
id = stringid.GenerateNonCryptoID()
41+
id = stringid.GenerateRandomID()
4242
)
4343

4444
if name == "" {

‎integration-cli/docker_cli_external_volume_driver_unix_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -558,7 +558,7 @@ func (s *DockerExternalVolumeSuite) TestExternalVolumeDriverCapabilities(c *chec
558558
}
559559

560560
func (s *DockerExternalVolumeSuite) TestExternalVolumeDriverOutOfBandDelete(c *check.C) {
561-
driverName := stringid.GenerateNonCryptoID()
561+
driverName := stringid.GenerateRandomID()
562562
p := newVolumePlugin(c, driverName)
563563
defer p.Close()
564564

‎integration/container/rename_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ func TestRenameStoppedContainer(t *testing.T) {
6161
assert.NilError(t, err)
6262
assert.Check(t, is.Equal("/"+oldName, inspect.Name))
6363

64-
newName := "new_name" + stringid.GenerateNonCryptoID()
64+
newName := "new_name" + stringid.GenerateRandomID()
6565
err = client.ContainerRename(ctx, oldName, newName)
6666
assert.NilError(t, err)
6767

@@ -79,7 +79,7 @@ func TestRenameRunningContainerAndReuse(t *testing.T) {
7979
cID := container.Run(t, ctx, client, container.WithName(oldName))
8080
poll.WaitOn(t, container.IsInState(ctx, client, cID, "running"), poll.WithDelay(100*time.Millisecond))
8181

82-
newName := "new_name" + stringid.GenerateNonCryptoID()
82+
newName := "new_name" + stringid.GenerateRandomID()
8383
err := client.ContainerRename(ctx, oldName, newName)
8484
assert.NilError(t, err)
8585

‎pkg/stringid/stringid.go

+4-40
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,12 @@
22
package stringid // import "github.com/docker/docker/pkg/stringid"
33

44
import (
5-
cryptorand "crypto/rand"
5+
"crypto/rand"
66
"encoding/hex"
77
"fmt"
8-
"io"
9-
"math"
10-
"math/big"
11-
"math/rand"
128
"regexp"
139
"strconv"
1410
"strings"
15-
"time"
1611
)
1712

1813
const shortLen = 12
@@ -41,10 +36,11 @@ func TruncateID(id string) string {
4136
return id
4237
}
4338

44-
func generateID(r io.Reader) string {
39+
// GenerateRandomID returns a unique id.
40+
func GenerateRandomID() string {
4541
b := make([]byte, 32)
4642
for {
47-
if _, err := io.ReadFull(r, b); err != nil {
43+
if _, err := rand.Read(b); err != nil {
4844
panic(err) // This shouldn't happen
4945
}
5046
id := hex.EncodeToString(b)
@@ -58,42 +54,10 @@ func generateID(r io.Reader) string {
5854
}
5955
}
6056

61-
// GenerateRandomID returns a unique id.
62-
func GenerateRandomID() string {
63-
return generateID(cryptorand.Reader)
64-
}
65-
66-
// GenerateNonCryptoID generates unique id without using cryptographically
67-
// secure sources of random.
68-
// It helps you to save entropy.
69-
func GenerateNonCryptoID() string {
70-
return generateID(readerFunc(rand.Read))
71-
}
72-
7357
// ValidateID checks whether an ID string is a valid image ID.
7458
func ValidateID(id string) error {
7559
if ok := validHex.MatchString(id); !ok {
7660
return fmt.Errorf("image ID %q is invalid", id)
7761
}
7862
return nil
7963
}
80-
81-
func init() {
82-
// safely set the seed globally so we generate random ids. Tries to use a
83-
// crypto seed before falling back to time.
84-
var seed int64
85-
if cryptoseed, err := cryptorand.Int(cryptorand.Reader, big.NewInt(math.MaxInt64)); err != nil {
86-
// This should not happen, but worst-case fallback to time-based seed.
87-
seed = time.Now().UnixNano()
88-
} else {
89-
seed = cryptoseed.Int64()
90-
}
91-
92-
rand.Seed(seed)
93-
}
94-
95-
type readerFunc func(p []byte) (int, error)
96-
97-
func (fn readerFunc) Read(p []byte) (int, error) {
98-
return fn(p)
99-
}

‎pkg/stringid/stringid_test.go

-8
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,6 @@ func TestGenerateRandomID(t *testing.T) {
1313
}
1414
}
1515

16-
func TestGenerateNonCryptoID(t *testing.T) {
17-
id := GenerateNonCryptoID()
18-
19-
if len(id) != 64 {
20-
t.Fatalf("Id returned is incorrect: %s", id)
21-
}
22-
}
23-
2416
func TestShortenId(t *testing.T) {
2517
id := "90435eec5c4e124e741ef731e118be2fc799a68aba0466ec17717f24ce2ae6a2"
2618
truncID := TruncateID(id)

‎pkg/truncindex/truncindex_test.go

+15-15
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,7 @@ func assertIndexGet(t *testing.T, index *TruncIndex, input, expectedResult strin
158158
func BenchmarkTruncIndexAdd100(b *testing.B) {
159159
var testSet []string
160160
for i := 0; i < 100; i++ {
161-
testSet = append(testSet, stringid.GenerateNonCryptoID())
161+
testSet = append(testSet, stringid.GenerateRandomID())
162162
}
163163
b.ResetTimer()
164164
for i := 0; i < b.N; i++ {
@@ -174,7 +174,7 @@ func BenchmarkTruncIndexAdd100(b *testing.B) {
174174
func BenchmarkTruncIndexAdd250(b *testing.B) {
175175
var testSet []string
176176
for i := 0; i < 250; i++ {
177-
testSet = append(testSet, stringid.GenerateNonCryptoID())
177+
testSet = append(testSet, stringid.GenerateRandomID())
178178
}
179179
b.ResetTimer()
180180
for i := 0; i < b.N; i++ {
@@ -190,7 +190,7 @@ func BenchmarkTruncIndexAdd250(b *testing.B) {
190190
func BenchmarkTruncIndexAdd500(b *testing.B) {
191191
var testSet []string
192192
for i := 0; i < 500; i++ {
193-
testSet = append(testSet, stringid.GenerateNonCryptoID())
193+
testSet = append(testSet, stringid.GenerateRandomID())
194194
}
195195
b.ResetTimer()
196196
for i := 0; i < b.N; i++ {
@@ -207,7 +207,7 @@ func BenchmarkTruncIndexGet100(b *testing.B) {
207207
var testSet []string
208208
var testKeys []string
209209
for i := 0; i < 100; i++ {
210-
testSet = append(testSet, stringid.GenerateNonCryptoID())
210+
testSet = append(testSet, stringid.GenerateRandomID())
211211
}
212212
index := NewTruncIndex([]string{})
213213
for _, id := range testSet {
@@ -231,7 +231,7 @@ func BenchmarkTruncIndexGet250(b *testing.B) {
231231
var testSet []string
232232
var testKeys []string
233233
for i := 0; i < 250; i++ {
234-
testSet = append(testSet, stringid.GenerateNonCryptoID())
234+
testSet = append(testSet, stringid.GenerateRandomID())
235235
}
236236
index := NewTruncIndex([]string{})
237237
for _, id := range testSet {
@@ -255,7 +255,7 @@ func BenchmarkTruncIndexGet500(b *testing.B) {
255255
var testSet []string
256256
var testKeys []string
257257
for i := 0; i < 500; i++ {
258-
testSet = append(testSet, stringid.GenerateNonCryptoID())
258+
testSet = append(testSet, stringid.GenerateRandomID())
259259
}
260260
index := NewTruncIndex([]string{})
261261
for _, id := range testSet {
@@ -278,7 +278,7 @@ func BenchmarkTruncIndexGet500(b *testing.B) {
278278
func BenchmarkTruncIndexDelete100(b *testing.B) {
279279
var testSet []string
280280
for i := 0; i < 100; i++ {
281-
testSet = append(testSet, stringid.GenerateNonCryptoID())
281+
testSet = append(testSet, stringid.GenerateRandomID())
282282
}
283283
b.ResetTimer()
284284
for i := 0; i < b.N; i++ {
@@ -301,7 +301,7 @@ func BenchmarkTruncIndexDelete100(b *testing.B) {
301301
func BenchmarkTruncIndexDelete250(b *testing.B) {
302302
var testSet []string
303303
for i := 0; i < 250; i++ {
304-
testSet = append(testSet, stringid.GenerateNonCryptoID())
304+
testSet = append(testSet, stringid.GenerateRandomID())
305305
}
306306
b.ResetTimer()
307307
for i := 0; i < b.N; i++ {
@@ -324,7 +324,7 @@ func BenchmarkTruncIndexDelete250(b *testing.B) {
324324
func BenchmarkTruncIndexDelete500(b *testing.B) {
325325
var testSet []string
326326
for i := 0; i < 500; i++ {
327-
testSet = append(testSet, stringid.GenerateNonCryptoID())
327+
testSet = append(testSet, stringid.GenerateRandomID())
328328
}
329329
b.ResetTimer()
330330
for i := 0; i < b.N; i++ {
@@ -347,7 +347,7 @@ func BenchmarkTruncIndexDelete500(b *testing.B) {
347347
func BenchmarkTruncIndexNew100(b *testing.B) {
348348
var testSet []string
349349
for i := 0; i < 100; i++ {
350-
testSet = append(testSet, stringid.GenerateNonCryptoID())
350+
testSet = append(testSet, stringid.GenerateRandomID())
351351
}
352352
b.ResetTimer()
353353
for i := 0; i < b.N; i++ {
@@ -358,7 +358,7 @@ func BenchmarkTruncIndexNew100(b *testing.B) {
358358
func BenchmarkTruncIndexNew250(b *testing.B) {
359359
var testSet []string
360360
for i := 0; i < 250; i++ {
361-
testSet = append(testSet, stringid.GenerateNonCryptoID())
361+
testSet = append(testSet, stringid.GenerateRandomID())
362362
}
363363
b.ResetTimer()
364364
for i := 0; i < b.N; i++ {
@@ -369,7 +369,7 @@ func BenchmarkTruncIndexNew250(b *testing.B) {
369369
func BenchmarkTruncIndexNew500(b *testing.B) {
370370
var testSet []string
371371
for i := 0; i < 500; i++ {
372-
testSet = append(testSet, stringid.GenerateNonCryptoID())
372+
testSet = append(testSet, stringid.GenerateRandomID())
373373
}
374374
b.ResetTimer()
375375
for i := 0; i < b.N; i++ {
@@ -381,7 +381,7 @@ func BenchmarkTruncIndexAddGet100(b *testing.B) {
381381
var testSet []string
382382
var testKeys []string
383383
for i := 0; i < 500; i++ {
384-
id := stringid.GenerateNonCryptoID()
384+
id := stringid.GenerateRandomID()
385385
testSet = append(testSet, id)
386386
l := rand.Intn(12) + 12
387387
testKeys = append(testKeys, id[:l])
@@ -406,7 +406,7 @@ func BenchmarkTruncIndexAddGet250(b *testing.B) {
406406
var testSet []string
407407
var testKeys []string
408408
for i := 0; i < 500; i++ {
409-
id := stringid.GenerateNonCryptoID()
409+
id := stringid.GenerateRandomID()
410410
testSet = append(testSet, id)
411411
l := rand.Intn(12) + 12
412412
testKeys = append(testKeys, id[:l])
@@ -431,7 +431,7 @@ func BenchmarkTruncIndexAddGet500(b *testing.B) {
431431
var testSet []string
432432
var testKeys []string
433433
for i := 0; i < 500; i++ {
434-
id := stringid.GenerateNonCryptoID()
434+
id := stringid.GenerateRandomID()
435435
testSet = append(testSet, id)
436436
l := rand.Intn(12) + 12
437437
testKeys = append(testKeys, id[:l])

‎plugin/manager_linux_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ func TestManagerWithPluginMounts(t *testing.T) {
7070
}
7171

7272
func newTestPlugin(t *testing.T, name, cap, root string) *v2.Plugin {
73-
id := stringid.GenerateNonCryptoID()
73+
id := stringid.GenerateRandomID()
7474
rootfs := filepath.Join(root, id)
7575
if err := os.MkdirAll(rootfs, 0755); err != nil {
7676
t.Fatal(err)

‎volume/mounts/linux_parser.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -298,7 +298,7 @@ func (p *linuxParser) parseMountSpec(cfg mount.Mount, validateBindSourceExists b
298298
switch cfg.Type {
299299
case mount.TypeVolume:
300300
if cfg.Source == "" {
301-
mp.Name = stringid.GenerateNonCryptoID()
301+
mp.Name = stringid.GenerateRandomID()
302302
} else {
303303
mp.Name = cfg.Source
304304
}

‎volume/mounts/mounts.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ func (m *MountPoint) Setup(mountLabel string, rootIDs idtools.Identity, checkFun
125125
if m.Volume != nil {
126126
id := m.ID
127127
if id == "" {
128-
id = stringid.GenerateNonCryptoID()
128+
id = stringid.GenerateRandomID()
129129
}
130130
path, err := m.Volume.Mount(id)
131131
if err != nil {

‎volume/mounts/windows_parser.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -385,7 +385,7 @@ func (p *windowsParser) parseMountSpec(cfg mount.Mount, destRegex string, conver
385385
switch cfg.Type {
386386
case mount.TypeVolume:
387387
if cfg.Source == "" {
388-
mp.Name = stringid.GenerateNonCryptoID()
388+
mp.Name = stringid.GenerateRandomID()
389389
} else {
390390
mp.Name = cfg.Source
391391
}

‎volume/service/service.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ func (s *VolumesService) GetDriverList() []string {
6363
// When whatever is going to reference this volume is removed the caller should defeference the volume by calling `Release`.
6464
func (s *VolumesService) Create(ctx context.Context, name, driverName string, opts ...opts.CreateOption) (*types.Volume, error) {
6565
if name == "" {
66-
name = stringid.GenerateNonCryptoID()
66+
name = stringid.GenerateRandomID()
6767
}
6868
v, err := s.vs.Create(ctx, name, driverName, opts...)
6969
if err != nil {

0 commit comments

Comments
 (0)