Branch data Line data Source code
1 : : /* crypto/rand/md_rand.c */
2 : : /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 : : * All rights reserved.
4 : : *
5 : : * This package is an SSL implementation written
6 : : * by Eric Young (eay@cryptsoft.com).
7 : : * The implementation was written so as to conform with Netscapes SSL.
8 : : *
9 : : * This library is free for commercial and non-commercial use as long as
10 : : * the following conditions are aheared to. The following conditions
11 : : * apply to all code found in this distribution, be it the RC4, RSA,
12 : : * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 : : * included with this distribution is covered by the same copyright terms
14 : : * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 : : *
16 : : * Copyright remains Eric Young's, and as such any Copyright notices in
17 : : * the code are not to be removed.
18 : : * If this package is used in a product, Eric Young should be given attribution
19 : : * as the author of the parts of the library used.
20 : : * This can be in the form of a textual message at program startup or
21 : : * in documentation (online or textual) provided with the package.
22 : : *
23 : : * Redistribution and use in source and binary forms, with or without
24 : : * modification, are permitted provided that the following conditions
25 : : * are met:
26 : : * 1. Redistributions of source code must retain the copyright
27 : : * notice, this list of conditions and the following disclaimer.
28 : : * 2. Redistributions in binary form must reproduce the above copyright
29 : : * notice, this list of conditions and the following disclaimer in the
30 : : * documentation and/or other materials provided with the distribution.
31 : : * 3. All advertising materials mentioning features or use of this software
32 : : * must display the following acknowledgement:
33 : : * "This product includes cryptographic software written by
34 : : * Eric Young (eay@cryptsoft.com)"
35 : : * The word 'cryptographic' can be left out if the rouines from the library
36 : : * being used are not cryptographic related :-).
37 : : * 4. If you include any Windows specific code (or a derivative thereof) from
38 : : * the apps directory (application code) you must include an acknowledgement:
39 : : * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 : : *
41 : : * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 : : * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 : : * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 : : * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 : : * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 : : * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 : : * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 : : * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 : : * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 : : * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 : : * SUCH DAMAGE.
52 : : *
53 : : * The licence and distribution terms for any publically available version or
54 : : * derivative of this code cannot be changed. i.e. this code cannot simply be
55 : : * copied and put under another distribution licence
56 : : * [including the GNU Public Licence.]
57 : : */
58 : : /* ====================================================================
59 : : * Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved.
60 : : *
61 : : * Redistribution and use in source and binary forms, with or without
62 : : * modification, are permitted provided that the following conditions
63 : : * are met:
64 : : *
65 : : * 1. Redistributions of source code must retain the above copyright
66 : : * notice, this list of conditions and the following disclaimer.
67 : : *
68 : : * 2. Redistributions in binary form must reproduce the above copyright
69 : : * notice, this list of conditions and the following disclaimer in
70 : : * the documentation and/or other materials provided with the
71 : : * distribution.
72 : : *
73 : : * 3. All advertising materials mentioning features or use of this
74 : : * software must display the following acknowledgment:
75 : : * "This product includes software developed by the OpenSSL Project
76 : : * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77 : : *
78 : : * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 : : * endorse or promote products derived from this software without
80 : : * prior written permission. For written permission, please contact
81 : : * openssl-core@openssl.org.
82 : : *
83 : : * 5. Products derived from this software may not be called "OpenSSL"
84 : : * nor may "OpenSSL" appear in their names without prior written
85 : : * permission of the OpenSSL Project.
86 : : *
87 : : * 6. Redistributions of any form whatsoever must retain the following
88 : : * acknowledgment:
89 : : * "This product includes software developed by the OpenSSL Project
90 : : * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91 : : *
92 : : * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 : : * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 : : * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 : : * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 : : * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 : : * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 : : * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 : : * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 : : * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 : : * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 : : * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 : : * OF THE POSSIBILITY OF SUCH DAMAGE.
104 : : * ====================================================================
105 : : *
106 : : * This product includes cryptographic software written by Eric Young
107 : : * (eay@cryptsoft.com). This product includes software written by Tim
108 : : * Hudson (tjh@cryptsoft.com).
109 : : *
110 : : */
111 : :
112 : : #define OPENSSL_FIPSAPI
113 : :
114 : : #ifdef MD_RAND_DEBUG
115 : : # ifndef NDEBUG
116 : : # define NDEBUG
117 : : # endif
118 : : #endif
119 : :
120 : : #include <assert.h>
121 : : #include <stdio.h>
122 : : #include <string.h>
123 : :
124 : : #include "e_os.h"
125 : :
126 : : #if !(defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYSNAME_DSPBIOS))
127 : : # include <sys/time.h>
128 : : #endif
129 : : #if defined(OPENSSL_SYS_VXWORKS)
130 : : # include <time.h>
131 : : #endif
132 : :
133 : : #include <openssl/crypto.h>
134 : : #include <openssl/rand.h>
135 : : #include "rand_lcl.h"
136 : :
137 : : #include <openssl/err.h>
138 : :
139 : : #ifdef OPENSSL_FIPS
140 : : #include <openssl/fips.h>
141 : : #endif
142 : :
143 : : #ifdef BN_DEBUG
144 : : # define PREDICT
145 : : #endif
146 : :
147 : : /* #define PREDICT 1 */
148 : :
149 : : #define STATE_SIZE 1023
150 : : static int state_num=0,state_index=0;
151 : : static unsigned char state[STATE_SIZE+MD_DIGEST_LENGTH];
152 : : static unsigned char md[MD_DIGEST_LENGTH];
153 : : static long md_count[2]={0,0};
154 : : static double entropy=0;
155 : : static int initialized=0;
156 : :
157 : : static unsigned int crypto_lock_rand = 0; /* may be set only when a thread
158 : : * holds CRYPTO_LOCK_RAND
159 : : * (to prevent double locking) */
160 : : /* access to lockin_thread is synchronized by CRYPTO_LOCK_RAND2 */
161 : : static CRYPTO_THREADID locking_threadid; /* valid iff crypto_lock_rand is set */
162 : :
163 : :
164 : : #ifdef PREDICT
165 : : int rand_predictable=0;
166 : : #endif
167 : :
168 : : const char RAND_version[]="RAND" OPENSSL_VERSION_PTEXT;
169 : :
170 : : static void rand_hw_seed(EVP_MD_CTX *ctx);
171 : :
172 : : static void ssleay_rand_cleanup(void);
173 : : static int ssleay_rand_seed(const void *buf, int num);
174 : : static int ssleay_rand_add(const void *buf, int num, double add_entropy);
175 : : static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo);
176 : : static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num);
177 : : static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num);
178 : : static int ssleay_rand_status(void);
179 : :
180 : : static RAND_METHOD rand_ssleay_meth={
181 : : ssleay_rand_seed,
182 : : ssleay_rand_nopseudo_bytes,
183 : : ssleay_rand_cleanup,
184 : : ssleay_rand_add,
185 : : ssleay_rand_pseudo_bytes,
186 : : ssleay_rand_status
187 : : };
188 : :
189 : 1883 : RAND_METHOD *RAND_SSLeay(void)
190 : : {
191 : 1883 : return(&rand_ssleay_meth);
192 : : }
193 : :
194 : 725 : static void ssleay_rand_cleanup(void)
195 : : {
196 : 725 : OPENSSL_cleanse(state,sizeof(state));
197 : 725 : state_num=0;
198 : 725 : state_index=0;
199 : 725 : OPENSSL_cleanse(md,MD_DIGEST_LENGTH);
200 : 725 : md_count[0]=0;
201 : 725 : md_count[1]=0;
202 : 725 : entropy=0;
203 : 725 : initialized=0;
204 : 725 : }
205 : :
206 : 181392 : static int ssleay_rand_add(const void *buf, int num, double add)
207 : : {
208 : : int i,j,k,st_idx;
209 : : long md_c[2];
210 : : unsigned char local_md[MD_DIGEST_LENGTH];
211 : : EVP_MD_CTX m;
212 : : int do_not_lock;
213 : 181392 : int rv = 0;
214 : :
215 [ + - ]: 181392 : if (!num)
216 : : return 1;
217 : :
218 : : /*
219 : : * (Based on the rand(3) manpage)
220 : : *
221 : : * The input is chopped up into units of 20 bytes (or less for
222 : : * the last block). Each of these blocks is run through the hash
223 : : * function as follows: The data passed to the hash function
224 : : * is the current 'md', the same number of bytes from the 'state'
225 : : * (the location determined by in incremented looping index) as
226 : : * the current 'block', the new key data 'block', and 'count'
227 : : * (which is incremented after each use).
228 : : * The result of this is kept in 'md' and also xored into the
229 : : * 'state' at the same locations that were used as input into the
230 : : * hash function.
231 : : */
232 : :
233 : 181392 : EVP_MD_CTX_init(&m);
234 : : /* check if we already have the lock */
235 [ + + ]: 181392 : if (crypto_lock_rand)
236 : : {
237 : : CRYPTO_THREADID cur;
238 : 64792 : CRYPTO_THREADID_current(&cur);
239 : 64792 : CRYPTO_r_lock(CRYPTO_LOCK_RAND2);
240 : 64792 : do_not_lock = !CRYPTO_THREADID_cmp(&locking_threadid, &cur);
241 : 64792 : CRYPTO_r_unlock(CRYPTO_LOCK_RAND2);
242 : : }
243 : : else
244 : : do_not_lock = 0;
245 : :
246 [ + + ]: 181392 : if (!do_not_lock) CRYPTO_w_lock(CRYPTO_LOCK_RAND);
247 : 181392 : st_idx=state_index;
248 : :
249 : : /* use our own copies of the counters so that even
250 : : * if a concurrent thread seeds with exactly the
251 : : * same data and uses the same subarray there's _some_
252 : : * difference */
253 : 181392 : md_c[0] = md_count[0];
254 : 181392 : md_c[1] = md_count[1];
255 : :
256 : : memcpy(local_md, md, sizeof md);
257 : :
258 : : /* state_index <= state_num <= STATE_SIZE */
259 : 181392 : state_index += num;
260 [ + + ]: 181392 : if (state_index >= STATE_SIZE)
261 : : {
262 : 2195 : state_index%=STATE_SIZE;
263 : 2195 : state_num=STATE_SIZE;
264 : : }
265 [ + + ]: 179197 : else if (state_num < STATE_SIZE)
266 : : {
267 [ + - ]: 54183 : if (state_index > state_num)
268 : 54183 : state_num=state_index;
269 : : }
270 : : /* state_index <= state_num <= STATE_SIZE */
271 : :
272 : : /* state[st_idx], ..., state[(st_idx + num - 1) % STATE_SIZE]
273 : : * are what we will use now, but other threads may use them
274 : : * as well */
275 : :
276 : 181392 : md_count[1] += (num / MD_DIGEST_LENGTH) + (num % MD_DIGEST_LENGTH > 0);
277 : :
278 [ + + ]: 181392 : if (!do_not_lock) CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
279 : :
280 [ + + ]: 372063 : for (i=0; i<num; i+=MD_DIGEST_LENGTH)
281 : : {
282 : 190671 : j=(num-i);
283 : 190671 : j=(j > MD_DIGEST_LENGTH)?MD_DIGEST_LENGTH:j;
284 : :
285 [ + - ]: 190671 : if (!MD_Init(&m))
286 : : goto err;
287 [ + - ]: 190671 : if (!MD_Update(&m,local_md,MD_DIGEST_LENGTH))
288 : : goto err;
289 : 190671 : k=(st_idx+j)-STATE_SIZE;
290 [ + + ]: 190671 : if (k > 0)
291 : : {
292 [ + - ]: 2107 : if (!MD_Update(&m,&(state[st_idx]),j-k))
293 : : goto err;
294 [ + - ]: 2107 : if (!MD_Update(&m,&(state[0]),k))
295 : : goto err;
296 : : }
297 : : else
298 [ + - ]: 188564 : if (!MD_Update(&m,&(state[st_idx]),j))
299 : : goto err;
300 : :
301 : : /* DO NOT REMOVE THE FOLLOWING CALL TO MD_Update()! */
302 [ + - ]: 190671 : if (!MD_Update(&m,buf,j))
303 : : goto err;
304 : : /* We know that line may cause programs such as
305 : : purify and valgrind to complain about use of
306 : : uninitialized data. The problem is not, it's
307 : : with the caller. Removing that line will make
308 : : sure you get really bad randomness and thereby
309 : : other problems such as very insecure keys. */
310 : :
311 [ + - ]: 190671 : if (!MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c)))
312 : : goto err;
313 [ + - ]: 190671 : if (!MD_Final(&m,local_md))
314 : : goto err;
315 : 190671 : md_c[1]++;
316 : :
317 : 190671 : buf=(const char *)buf + j;
318 : :
319 [ + + ]: 2550990 : for (k=0; k<j; k++)
320 : : {
321 : : /* Parallel threads may interfere with this,
322 : : * but always each byte of the new state is
323 : : * the XOR of some previous value of its
324 : : * and local_md (itermediate values may be lost).
325 : : * Alway using locking could hurt performance more
326 : : * than necessary given that conflicts occur only
327 : : * when the total seeding is longer than the random
328 : : * state. */
329 : 2360319 : state[st_idx++]^=local_md[k];
330 [ + + ]: 2360319 : if (st_idx >= STATE_SIZE)
331 : 2195 : st_idx=0;
332 : : }
333 : : }
334 : :
335 [ + + ]: 181392 : if (!do_not_lock) CRYPTO_w_lock(CRYPTO_LOCK_RAND);
336 : : /* Don't just copy back local_md into md -- this could mean that
337 : : * other thread's seeding remains without effect (except for
338 : : * the incremented counter). By XORing it we keep at least as
339 : : * much entropy as fits into md. */
340 [ + + ]: 3809232 : for (k = 0; k < (int)sizeof(md); k++)
341 : : {
342 : 3627840 : md[k] ^= local_md[k];
343 : : }
344 [ + + ]: 181392 : if (entropy < ENTROPY_NEEDED) /* stop counting when we have enough */
345 : 1240 : entropy += add;
346 [ + + ]: 181392 : if (!do_not_lock) CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
347 : :
348 : : #if !defined(OPENSSL_THREADS) && !defined(OPENSSL_SYS_WIN32)
349 : : assert(md_c[1] == md_count[1]);
350 : : #endif
351 : : rv = 1;
352 : : err:
353 : 181392 : EVP_MD_CTX_cleanup(&m);
354 : 181392 : return rv;
355 : : }
356 : :
357 : 1011 : static int ssleay_rand_seed(const void *buf, int num)
358 : : {
359 : 1011 : return ssleay_rand_add(buf, num, (double)num);
360 : : }
361 : :
362 : 316530 : static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
363 : : {
364 : : static volatile int stirred_pool = 0;
365 : : int i,j,k,st_num,st_idx;
366 : : int num_ceil;
367 : : int ok;
368 : : long md_c[2];
369 : : unsigned char local_md[MD_DIGEST_LENGTH];
370 : : EVP_MD_CTX m;
371 : : #ifndef GETPID_IS_MEANINGLESS
372 : 316530 : pid_t curr_pid = getpid();
373 : : #endif
374 : 316530 : time_t curr_time = time(NULL);
375 : 316530 : int do_stir_pool = 0;
376 : : /* time value for various platforms */
377 : : #ifdef OPENSSL_SYS_WIN32
378 : : FILETIME tv;
379 : : # ifdef _WIN32_WCE
380 : : SYSTEMTIME t;
381 : : GetSystemTime(&t);
382 : : SystemTimeToFileTime(&t, &tv);
383 : : # else
384 : : GetSystemTimeAsFileTime(&tv);
385 : : # endif
386 : : #elif defined(OPENSSL_SYS_VXWORKS)
387 : : struct timespec tv;
388 : : clock_gettime(CLOCK_REALTIME, &ts);
389 : : #elif defined(OPENSSL_SYSNAME_DSPBIOS)
390 : : unsigned long long tv, OPENSSL_rdtsc();
391 : : tv = OPENSSL_rdtsc();
392 : : #else
393 : : struct timeval tv;
394 : 316530 : gettimeofday(&tv, NULL);
395 : : #endif
396 : :
397 : : #ifdef PREDICT
398 : : if (rand_predictable)
399 : : {
400 : : static unsigned char val=0;
401 : :
402 : : for (i=0; i<num; i++)
403 : : buf[i]=val++;
404 : : return(1);
405 : : }
406 : : #endif
407 : :
408 [ + - ]: 316530 : if (num <= 0)
409 : : return 1;
410 : :
411 : 316530 : EVP_MD_CTX_init(&m);
412 : : /* round upwards to multiple of MD_DIGEST_LENGTH/2 */
413 : 316530 : num_ceil = (1 + (num-1)/(MD_DIGEST_LENGTH/2)) * (MD_DIGEST_LENGTH/2);
414 : :
415 : : /*
416 : : * (Based on the rand(3) manpage:)
417 : : *
418 : : * For each group of 10 bytes (or less), we do the following:
419 : : *
420 : : * Input into the hash function the local 'md' (which is initialized from
421 : : * the global 'md' before any bytes are generated), the bytes that are to
422 : : * be overwritten by the random bytes, and bytes from the 'state'
423 : : * (incrementing looping index). From this digest output (which is kept
424 : : * in 'md'), the top (up to) 10 bytes are returned to the caller and the
425 : : * bottom 10 bytes are xored into the 'state'.
426 : : *
427 : : * Finally, after we have finished 'num' random bytes for the
428 : : * caller, 'count' (which is incremented) and the local and global 'md'
429 : : * are fed into the hash function and the results are kept in the
430 : : * global 'md'.
431 : : */
432 : :
433 : 316530 : CRYPTO_w_lock(CRYPTO_LOCK_RAND);
434 : :
435 : : /* prevent ssleay_rand_bytes() from trying to obtain the lock again */
436 : 316530 : CRYPTO_w_lock(CRYPTO_LOCK_RAND2);
437 : 316530 : CRYPTO_THREADID_current(&locking_threadid);
438 : 316530 : CRYPTO_w_unlock(CRYPTO_LOCK_RAND2);
439 : 316530 : crypto_lock_rand = 1;
440 : :
441 [ + + ]: 316530 : if (!initialized)
442 : : {
443 : 1112 : RAND_poll();
444 : 1112 : initialized = 1;
445 : : }
446 : :
447 [ + + ]: 316530 : if (!stirred_pool)
448 : 1157 : do_stir_pool = 1;
449 : :
450 : 316530 : ok = (entropy >= ENTROPY_NEEDED);
451 [ - + ]: 316530 : if (!ok)
452 : : {
453 : : /* If the PRNG state is not yet unpredictable, then seeing
454 : : * the PRNG output may help attackers to determine the new
455 : : * state; thus we have to decrease the entropy estimate.
456 : : * Once we've had enough initial seeding we don't bother to
457 : : * adjust the entropy count, though, because we're not ambitious
458 : : * to provide *information-theoretic* randomness.
459 : : *
460 : : * NOTE: This approach fails if the program forks before
461 : : * we have enough entropy. Entropy should be collected
462 : : * in a separate input pool and be transferred to the
463 : : * output pool only when the entropy limit has been reached.
464 : : */
465 : 0 : entropy -= num;
466 [ # # ]: 0 : if (entropy < 0)
467 : 0 : entropy = 0;
468 : : }
469 : :
470 [ + + ]: 316530 : if (do_stir_pool)
471 : : {
472 : : /* In the output function only half of 'md' remains secret,
473 : : * so we better make sure that the required entropy gets
474 : : * 'evenly distributed' through 'state', our randomness pool.
475 : : * The input function (ssleay_rand_add) chains all of 'md',
476 : : * which makes it more suitable for this purpose.
477 : : */
478 : :
479 : : int n = STATE_SIZE; /* so that the complete pool gets accessed */
480 [ + + ]: 61321 : while (n > 0)
481 : : {
482 : : #if MD_DIGEST_LENGTH > 20
483 : : # error "Please adjust DUMMY_SEED."
484 : : #endif
485 : : #define DUMMY_SEED "...................." /* at least MD_DIGEST_LENGTH */
486 : : /* Note that the seed does not matter, it's just that
487 : : * ssleay_rand_add expects to have something to hash. */
488 : 60164 : ssleay_rand_add(DUMMY_SEED, MD_DIGEST_LENGTH, 0.0);
489 : 60164 : n -= MD_DIGEST_LENGTH;
490 : : }
491 [ + - ]: 1157 : if (ok)
492 : 1157 : stirred_pool = 1;
493 : : }
494 : :
495 : 316530 : st_idx=state_index;
496 : 316530 : st_num=state_num;
497 : 316530 : md_c[0] = md_count[0];
498 : 316530 : md_c[1] = md_count[1];
499 : : memcpy(local_md, md, sizeof md);
500 : :
501 : 316530 : state_index+=num_ceil;
502 [ + + ]: 316530 : if (state_index > state_num)
503 : 5304 : state_index %= state_num;
504 : :
505 : : /* state[st_idx], ..., state[(st_idx + num_ceil - 1) % st_num]
506 : : * are now ours (but other threads may use them too) */
507 : :
508 : 316530 : md_count[0] += 1;
509 : :
510 : : /* before unlocking, we must clear 'crypto_lock_rand' */
511 : 316530 : crypto_lock_rand = 0;
512 : 316530 : CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
513 : :
514 [ + + ]: 909156 : while (num > 0)
515 : : {
516 : : /* num_ceil -= MD_DIGEST_LENGTH/2 */
517 : 592626 : j=(num >= MD_DIGEST_LENGTH/2)?MD_DIGEST_LENGTH/2:num;
518 : 592626 : num-=j;
519 [ + - ]: 592626 : if (!MD_Init(&m))
520 : : goto err;
521 : : #ifndef GETPID_IS_MEANINGLESS
522 [ + + ]: 592626 : if (curr_pid) /* just in the first iteration to save time */
523 : : {
524 [ + - ]: 316530 : if (!MD_Update(&m,(unsigned char*)&curr_pid,
525 : : sizeof curr_pid))
526 : : goto err;
527 : 316530 : curr_pid = 0;
528 : : }
529 : : #endif
530 [ + + ]: 592626 : if (curr_time) /* just in the first iteration to save time */
531 : : {
532 [ + - ]: 316530 : if (!MD_Update(&m,(unsigned char*)&curr_time,
533 : : sizeof curr_time))
534 : : goto err;
535 [ + - ]: 316530 : if (!MD_Update(&m,(unsigned char*)&tv,
536 : : sizeof tv))
537 : : goto err;
538 : 316530 : curr_time = 0;
539 : 316530 : rand_hw_seed(&m);
540 : : }
541 [ + - ]: 592626 : if (!MD_Update(&m,local_md,MD_DIGEST_LENGTH))
542 : : goto err;
543 [ + - ]: 592626 : if (!MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c)))
544 : : goto err;
545 : :
546 : : #ifndef PURIFY /* purify complains */
547 : : /* The following line uses the supplied buffer as a small
548 : : * source of entropy: since this buffer is often uninitialised
549 : : * it may cause programs such as purify or valgrind to
550 : : * complain. So for those builds it is not used: the removal
551 : : * of such a small source of entropy has negligible impact on
552 : : * security.
553 : : */
554 [ + - ]: 592626 : if (!MD_Update(&m,buf,j))
555 : : goto err;
556 : : #endif
557 : :
558 : 592626 : k=(st_idx+MD_DIGEST_LENGTH/2)-st_num;
559 [ + + ]: 592626 : if (k > 0)
560 : : {
561 [ + - ]: 5055 : if (!MD_Update(&m,&(state[st_idx]),MD_DIGEST_LENGTH/2-k))
562 : : goto err;
563 [ + - ]: 5055 : if (!MD_Update(&m,&(state[0]),k))
564 : : goto err;
565 : : }
566 : : else
567 [ + - ]: 587571 : if (!MD_Update(&m,&(state[st_idx]),MD_DIGEST_LENGTH/2))
568 : : goto err;
569 [ + - ]: 592626 : if (!MD_Final(&m,local_md))
570 : : goto err;
571 : :
572 [ + + ]: 6518886 : for (i=0; i<MD_DIGEST_LENGTH/2; i++)
573 : : {
574 : 5926260 : state[st_idx++]^=local_md[i]; /* may compete with other threads */
575 [ + + ]: 5926260 : if (st_idx >= st_num)
576 : 5592 : st_idx=0;
577 [ + + ]: 5926260 : if (i < j)
578 : 3308851 : *(buf++)=local_md[i+MD_DIGEST_LENGTH/2];
579 : : }
580 : : }
581 : :
582 [ + - ]: 316530 : if (!MD_Init(&m)
583 [ + - ]: 316530 : || !MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c))
584 [ + - ]: 316530 : || !MD_Update(&m,local_md,MD_DIGEST_LENGTH))
585 : : goto err;
586 : 316530 : CRYPTO_w_lock(CRYPTO_LOCK_RAND);
587 [ + - ][ - + ]: 316530 : if (!MD_Update(&m,md,MD_DIGEST_LENGTH) || !MD_Final(&m,md))
588 : : {
589 : 0 : CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
590 : 0 : goto err;
591 : : }
592 : 316530 : CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
593 : :
594 : 316530 : EVP_MD_CTX_cleanup(&m);
595 [ - + ]: 316530 : if (ok)
596 : : return(1);
597 [ # # ]: 0 : else if (pseudo)
598 : : return 0;
599 : : else
600 : : {
601 : 0 : RANDerr(RAND_F_SSLEAY_RAND_BYTES,RAND_R_PRNG_NOT_SEEDED);
602 : 0 : ERR_add_error_data(1, "You need to read the OpenSSL FAQ, "
603 : : "http://www.openssl.org/support/faq.html");
604 : 0 : return(0);
605 : : }
606 : : err:
607 : 0 : EVP_MD_CTX_cleanup(&m);
608 : 0 : RANDerr(RAND_F_SSLEAY_RAND_BYTES,ERR_R_EVP_LIB);
609 : 0 : return 0;
610 : :
611 : : }
612 : :
613 : 49981 : static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num)
614 : : {
615 : 49981 : return ssleay_rand_bytes(buf, num, 0);
616 : : }
617 : :
618 : : /* pseudo-random bytes that are guaranteed to be unique but not
619 : : unpredictable */
620 : 266549 : static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num)
621 : : {
622 : 266549 : return ssleay_rand_bytes(buf, num, 1);
623 : : }
624 : :
625 : 1103 : static int ssleay_rand_status(void)
626 : : {
627 : : CRYPTO_THREADID cur;
628 : : int ret;
629 : : int do_not_lock;
630 : :
631 : 1103 : CRYPTO_THREADID_current(&cur);
632 : : /* check if we already have the lock
633 : : * (could happen if a RAND_poll() implementation calls RAND_status()) */
634 [ - + ]: 1103 : if (crypto_lock_rand)
635 : : {
636 : 0 : CRYPTO_r_lock(CRYPTO_LOCK_RAND2);
637 : 0 : do_not_lock = !CRYPTO_THREADID_cmp(&locking_threadid, &cur);
638 : 0 : CRYPTO_r_unlock(CRYPTO_LOCK_RAND2);
639 : : }
640 : : else
641 : : do_not_lock = 0;
642 : :
643 [ + - ]: 1103 : if (!do_not_lock)
644 : : {
645 : 1103 : CRYPTO_w_lock(CRYPTO_LOCK_RAND);
646 : :
647 : : /* prevent ssleay_rand_bytes() from trying to obtain the lock again */
648 : 1103 : CRYPTO_w_lock(CRYPTO_LOCK_RAND2);
649 : 1103 : CRYPTO_THREADID_cpy(&locking_threadid, &cur);
650 : 1103 : CRYPTO_w_unlock(CRYPTO_LOCK_RAND2);
651 : 1103 : crypto_lock_rand = 1;
652 : : }
653 : :
654 [ + + ]: 1103 : if (!initialized)
655 : : {
656 : 45 : RAND_poll();
657 : 45 : initialized = 1;
658 : : }
659 : :
660 : 1103 : ret = entropy >= ENTROPY_NEEDED;
661 : :
662 [ + - ]: 1103 : if (!do_not_lock)
663 : : {
664 : : /* before unlocking, we must clear 'crypto_lock_rand' */
665 : 1103 : crypto_lock_rand = 0;
666 : :
667 : 1103 : CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
668 : : }
669 : :
670 : 1103 : return ret;
671 : : }
672 : :
673 : : /* rand_hw_seed: get seed data from any available hardware RNG.
674 : : * only currently supports rdrand.
675 : : */
676 : :
677 : : /* Adapted from eng_rdrand.c */
678 : :
679 : : #if (defined(__i386) || defined(__i386__) || defined(_M_IX86) || \
680 : : defined(__x86_64) || defined(__x86_64__) || \
681 : : defined(_M_AMD64) || defined (_M_X64)) && defined(OPENSSL_CPUID_OBJ)
682 : :
683 : : #define RDRAND_CALLS 4
684 : :
685 : : size_t OPENSSL_ia32_rdrand(void);
686 : : extern unsigned int OPENSSL_ia32cap_P[];
687 : :
688 : 316530 : static void rand_hw_seed(EVP_MD_CTX *ctx)
689 : : {
690 : : int i;
691 [ + - ]: 316530 : if (!(OPENSSL_ia32cap_P[1] & (1<<(62-32))))
692 : : return;
693 [ + + ]: 1582650 : for (i = 0; i < RDRAND_CALLS; i++)
694 : : {
695 : : size_t rnd;
696 : 1266120 : rnd = OPENSSL_ia32_rdrand();
697 [ + - ]: 1266120 : if (rnd == 0)
698 : 0 : return;
699 : 1266120 : MD_Update(ctx, (unsigned char *)&rnd, sizeof(size_t));
700 : : }
701 : : }
702 : :
703 : : /* XOR an existing buffer with random data */
704 : :
705 : 0 : void rand_hw_xor(unsigned char *buf, size_t num)
706 : : {
707 : : size_t rnd;
708 [ # # ]: 0 : if (!(OPENSSL_ia32cap_P[1] & (1<<(62-32))))
709 : : return;
710 [ # # ]: 0 : while (num >= sizeof(size_t))
711 : : {
712 : 0 : rnd = OPENSSL_ia32_rdrand();
713 [ # # ]: 0 : if (rnd == 0)
714 : : return;
715 : 0 : *((size_t *)buf) ^= rnd;
716 : 0 : buf += sizeof(size_t);
717 : 0 : num -= sizeof(size_t);
718 : : }
719 [ # # ]: 0 : if (num)
720 : : {
721 : 0 : rnd = OPENSSL_ia32_rdrand();
722 [ # # ]: 0 : if (rnd == 0)
723 : : return;
724 [ # # ]: 0 : while(num)
725 : : {
726 : 0 : *buf ^= rnd & 0xff;
727 : 0 : rnd >>= 8;
728 : 0 : buf++;
729 : 0 : num--;
730 : : }
731 : : }
732 : : }
733 : :
734 : :
735 : : #else
736 : :
737 : : static void rand_hw_seed(EVP_MD_CTX *ctx)
738 : : {
739 : : return;
740 : : }
741 : :
742 : : void rand_hw_xor(unsigned char *buf, size_t num)
743 : : {
744 : : return;
745 : : }
746 : :
747 : : #endif
|
