Random: prioritise CCRandomGenerateBytes over getentropy on macOs.

It is recommended approach by Apple itself.

diff --git a/auto/getrandom b/auto/getrandom
index d8b26245b601a4ef1df2893cfdb525592823bd1e..5b5aa19829355be18bb6eb14901f71af0850bfeb 100644 (file)
--- a/auto/getrandom
+++ b/auto/getrandom
@@ -48,6 +48,28 @@ if [ $njs_found = no ]; then
 fi
 
 
+if [ $njs_found = no ]; then
+
+    # macOS 10.10.
+
+    njs_feature="CCRandomGenerateBytes() in CommonCrypto/CommonRandom.h"
+    njs_feature_name=NJS_HAVE_CCRANDOMGENERATEBYTES
+    njs_feature_test="#include <CommonCrypto/CommonCryptoError.h>
+                      #include <CommonCrypto/CommonRandom.h>
+
+                      int main(void) {
+                          char  buf[4];
+
+                          if (CCRandomGenerateBytes(buf, 4) != kCCSuccess) {
+                              return 1;
+                          }
+
+                          return 0;
+                      }"
+    . auto/feature
+fi
+
+
 if [ $njs_found = no ]; then
 
     # OpenBSD 5.6 lacks <sys/random.h>.
@@ -71,7 +93,7 @@ fi
 
 if [ $njs_found = no ]; then
 
-    # macOS 10.12.
+    # Solaris based systems.
 
     njs_feature="getentropy() in sys/random.h"
     njs_feature_name=NJS_HAVE_GETENTROPY_SYS_RANDOM

diff --git a/src/njs_random.c b/src/njs_random.c
index 806b4d166f48400752c8fbcd44ce3e4d72e0144f..1d9751f85764f9b53c63da803b8243a51f8f8a69 100644 (file)
--- a/src/njs_random.c
+++ b/src/njs_random.c
@@ -8,6 +8,9 @@
 #include <njs_main.h>
 #if (NJS_HAVE_GETRANDOM)
 #include <sys/random.h>
+#elif (NJS_HAVE_CCRANDOMGENERATEBYTES)
+#include <CommonCrypto/CommonCryptoError.h>
+#include <CommonCrypto/CommonRandom.h>
 #elif (NJS_HAVE_LINUX_SYS_GETRANDOM)
 #include <sys/syscall.h>
 #include <linux/random.h>
@@ -72,6 +75,16 @@ njs_random_stir(njs_random_t *r, njs_pid_t pid)
 
     n = syscall(SYS_getrandom, &key, NJS_RANDOM_KEY_SIZE, 0);
 
+#elif (NJS_HAVE_CCRANDOMGENERATEBYTES)
+
+    /* Apple discourages the use of getentropy. */
+
+    n = 0;
+
+    if (CCRandomGenerateBytes(&key, NJS_RANDOM_KEY_SIZE) == kCCSuccess) {
+        n = NJS_RANDOM_KEY_SIZE;
+    }
+
 #elif (NJS_HAVE_GETENTROPY || NJS_HAVE_GETENTROPY_SYS_RANDOM)
 
     n = 0;