random: add WC_RNG_SEED_DEVICE to seed from a nominated device - #11216
Open
dgarske wants to merge 1 commit into
Open
random: add WC_RNG_SEED_DEVICE to seed from a nominated device#11216dgarske wants to merge 1 commit into
dgarske wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds an opt-in mechanism for seeding the wolfCrypt DRBG from a nominated device (e.g. /dev/hwrng) before the existing OS entropy fallback chain, and tightens up edge cases in the existing filesystem seeding path. This fits into wolfcrypt/src/random.c’s platform entropy acquisition (wc_GenerateSeed) and the build-system knobs that control it.
Changes:
- Add
WC_RNG_SEED_DEVICEsupport to attempt seeding from a configured device before the existing sources, with best-effort fallback. - Fix
wc_GenerateSeed()filesystem seeding edge cases (compile issue inWOLFSSL_KEEP_RNG_SEED_FD_OPEN+ avoid infinite loop onread()returning 0). - Add Autotools/CMake configuration switches and Linux CI configs to exercise both the device and fallback paths.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| wolfcrypt/src/random.c | Adds WC_RNG_SEED_DEVICE seeding attempt and fixes /dev/*random seeding loop/FD-open logic. |
| configure.ac | Introduces --with-rng-seed-device=PATH to define WC_RNG_SEED_DEVICE in Autotools builds. |
| CMakeLists.txt | Adds WOLFSSL_RNG_SEED_DEVICE cache option to emit -DWC_RNG_SEED_DEVICE=... for CMake builds. |
| cmake/options.h.in | Adds WC_RNG_SEED_DEVICE to generated options.h for CMake parity. |
| .github/configs/os-check-linux.json | Adds two Linux CI configurations to cover the device and fallback seeding paths. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+8764
to
+8766
| fi | ||
| AM_CFLAGS="$AM_CFLAGS -DWC_RNG_SEED_DEVICE=\\\"$RNG_SEED_DEVICE\\\"" | ||
| fi |
Comment on lines
+5989
to
+5991
| /* Nominated entropy source, usually a hardware RNG. Best effort: on | ||
| * any failure fall through to the default sources below. Reads use a | ||
| * scratch cursor so a partial read leaves output untouched. */ |
dgarske
force-pushed
the
rng_seed_device
branch
from
August 20, 2026 04:33
5824cb5 to
9fa0199
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
WC_RNG_SEED_DEVICE, an optional macro naming a device to seed the DRBG from before the default sources, for platforms that expose a hardware RNG such as/dev/hwrng(the NXP i.MX95 EdgeLock Secure Enclave, among others). Its value is a quoted string, set either by autotools--with-rng-seed-device=PATH, by CMake-DWOLFSSL_RNG_SEED_DEVICE=PATH, or directly as#define WC_RNG_SEED_DEVICE "/dev/hwrng"inuser_settings.h; the two build systems take an unquoted path and add the quoting for you. The device attempt is self-contained and strictly additive: any failure to open or fill it falls through to the untouchedgetrandom()->/dev/urandom->/dev/randomchain, so a default build is unchanged. Also fixes two pre-existing bugs inwc_GenerateSeed()(happy to split these out):WOLFSSL_KEEP_RNG_SEED_FD_OPENwithNO_DEV_URANDOMdoes not compile on master due to a danglingelse, and the seed read loop spins forever ifread()returns 0. Two newos-check-linuxCI configs cover the device and fallback paths.