[331] | 1 | /*
|
---|
| 2 | * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
|
---|
| 3 | *
|
---|
| 4 | * Licensed under the OpenSSL license (the "License"). You may not use
|
---|
| 5 | * this file except in compliance with the License. You can obtain a copy
|
---|
| 6 | * in the file LICENSE in the source distribution or at
|
---|
| 7 | * https://www.openssl.org/source/license.html
|
---|
| 8 | */
|
---|
| 9 |
|
---|
| 10 | #include <stdio.h>
|
---|
| 11 | #include <string.h>
|
---|
| 12 |
|
---|
| 13 | #include "e_os.h"
|
---|
| 14 |
|
---|
| 15 | #if !(defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_DSPBIOS))
|
---|
| 16 | # include <sys/time.h>
|
---|
| 17 | #endif
|
---|
| 18 | #if defined(OPENSSL_SYS_VXWORKS)
|
---|
| 19 | # include <time.h>
|
---|
| 20 | #endif
|
---|
| 21 |
|
---|
| 22 | #include <openssl/opensslconf.h>
|
---|
| 23 | #include <openssl/crypto.h>
|
---|
| 24 | #include <openssl/rand.h>
|
---|
| 25 | #include <openssl/async.h>
|
---|
| 26 | #include "rand_lcl.h"
|
---|
| 27 |
|
---|
| 28 | #include <openssl/err.h>
|
---|
| 29 |
|
---|
| 30 | #include <internal/thread_once.h>
|
---|
| 31 |
|
---|
| 32 | #ifdef OPENSSL_FIPS
|
---|
| 33 | # include <openssl/fips.h>
|
---|
| 34 | #endif
|
---|
| 35 |
|
---|
| 36 | #ifdef BN_DEBUG
|
---|
| 37 | # define PREDICT
|
---|
| 38 | #endif
|
---|
| 39 |
|
---|
| 40 | /* #define PREDICT 1 */
|
---|
| 41 |
|
---|
| 42 | #define STATE_SIZE 1023
|
---|
| 43 | static size_t state_num = 0, state_index = 0;
|
---|
| 44 | static unsigned char state[STATE_SIZE + MD_DIGEST_LENGTH];
|
---|
| 45 | static unsigned char md[MD_DIGEST_LENGTH];
|
---|
| 46 | static long md_count[2] = { 0, 0 };
|
---|
| 47 |
|
---|
| 48 | static double entropy = 0;
|
---|
| 49 | static int initialized = 0;
|
---|
| 50 |
|
---|
| 51 | static CRYPTO_RWLOCK *rand_lock = NULL;
|
---|
| 52 | static CRYPTO_RWLOCK *rand_tmp_lock = NULL;
|
---|
| 53 | static CRYPTO_ONCE rand_lock_init = CRYPTO_ONCE_STATIC_INIT;
|
---|
| 54 |
|
---|
| 55 | /* May be set only when a thread holds rand_lock (to prevent double locking) */
|
---|
| 56 | static unsigned int crypto_lock_rand = 0;
|
---|
| 57 | /* access to locking_threadid is synchronized by rand_tmp_lock */
|
---|
| 58 | /* valid iff crypto_lock_rand is set */
|
---|
| 59 | static CRYPTO_THREAD_ID locking_threadid;
|
---|
| 60 |
|
---|
| 61 | #ifdef PREDICT
|
---|
| 62 | int rand_predictable = 0;
|
---|
| 63 | #endif
|
---|
| 64 |
|
---|
| 65 | static int rand_hw_seed(EVP_MD_CTX *ctx);
|
---|
| 66 |
|
---|
| 67 | static void rand_cleanup(void);
|
---|
| 68 | static int rand_seed(const void *buf, int num);
|
---|
| 69 | static int rand_add(const void *buf, int num, double add_entropy);
|
---|
| 70 | static int rand_bytes(unsigned char *buf, int num, int pseudo);
|
---|
| 71 | static int rand_nopseudo_bytes(unsigned char *buf, int num);
|
---|
| 72 | #if OPENSSL_API_COMPAT < 0x10100000L
|
---|
| 73 | static int rand_pseudo_bytes(unsigned char *buf, int num);
|
---|
| 74 | #endif
|
---|
| 75 | static int rand_status(void);
|
---|
| 76 |
|
---|
| 77 | static RAND_METHOD rand_meth = {
|
---|
| 78 | rand_seed,
|
---|
| 79 | rand_nopseudo_bytes,
|
---|
| 80 | rand_cleanup,
|
---|
| 81 | rand_add,
|
---|
| 82 | #if OPENSSL_API_COMPAT < 0x10100000L
|
---|
| 83 | rand_pseudo_bytes,
|
---|
| 84 | #else
|
---|
| 85 | NULL,
|
---|
| 86 | #endif
|
---|
| 87 | rand_status
|
---|
| 88 | };
|
---|
| 89 |
|
---|
| 90 | DEFINE_RUN_ONCE_STATIC(do_rand_lock_init)
|
---|
| 91 | {
|
---|
| 92 | OPENSSL_init_crypto(0, NULL);
|
---|
| 93 | rand_lock = CRYPTO_THREAD_lock_new();
|
---|
| 94 | rand_tmp_lock = CRYPTO_THREAD_lock_new();
|
---|
| 95 | return rand_lock != NULL && rand_tmp_lock != NULL;
|
---|
| 96 | }
|
---|
| 97 |
|
---|
| 98 | RAND_METHOD *RAND_OpenSSL(void)
|
---|
| 99 | {
|
---|
| 100 | return (&rand_meth);
|
---|
| 101 | }
|
---|
| 102 |
|
---|
| 103 | static void rand_cleanup(void)
|
---|
| 104 | {
|
---|
| 105 | OPENSSL_cleanse(state, sizeof(state));
|
---|
| 106 | state_num = 0;
|
---|
| 107 | state_index = 0;
|
---|
| 108 | OPENSSL_cleanse(md, MD_DIGEST_LENGTH);
|
---|
| 109 | md_count[0] = 0;
|
---|
| 110 | md_count[1] = 0;
|
---|
| 111 | entropy = 0;
|
---|
| 112 | initialized = 0;
|
---|
| 113 | CRYPTO_THREAD_lock_free(rand_lock);
|
---|
| 114 | CRYPTO_THREAD_lock_free(rand_tmp_lock);
|
---|
| 115 | }
|
---|
| 116 |
|
---|
| 117 | static int rand_add(const void *buf, int num, double add)
|
---|
| 118 | {
|
---|
| 119 | int i, j, k, st_idx;
|
---|
| 120 | long md_c[2];
|
---|
| 121 | unsigned char local_md[MD_DIGEST_LENGTH];
|
---|
| 122 | EVP_MD_CTX *m;
|
---|
| 123 | int do_not_lock;
|
---|
| 124 | int rv = 0;
|
---|
| 125 |
|
---|
| 126 | if (!num)
|
---|
| 127 | return 1;
|
---|
| 128 |
|
---|
| 129 | /*
|
---|
| 130 | * (Based on the rand(3) manpage)
|
---|
| 131 | *
|
---|
| 132 | * The input is chopped up into units of 20 bytes (or less for
|
---|
| 133 | * the last block). Each of these blocks is run through the hash
|
---|
| 134 | * function as follows: The data passed to the hash function
|
---|
| 135 | * is the current 'md', the same number of bytes from the 'state'
|
---|
| 136 | * (the location determined by in incremented looping index) as
|
---|
| 137 | * the current 'block', the new key data 'block', and 'count'
|
---|
| 138 | * (which is incremented after each use).
|
---|
| 139 | * The result of this is kept in 'md' and also xored into the
|
---|
| 140 | * 'state' at the same locations that were used as input into the
|
---|
| 141 | * hash function.
|
---|
| 142 | */
|
---|
| 143 |
|
---|
| 144 | m = EVP_MD_CTX_new();
|
---|
| 145 | if (m == NULL)
|
---|
| 146 | goto err;
|
---|
| 147 |
|
---|
| 148 | if (!RUN_ONCE(&rand_lock_init, do_rand_lock_init))
|
---|
| 149 | goto err;
|
---|
| 150 |
|
---|
| 151 | /* check if we already have the lock */
|
---|
| 152 | if (crypto_lock_rand) {
|
---|
| 153 | CRYPTO_THREAD_ID cur = CRYPTO_THREAD_get_current_id();
|
---|
| 154 | CRYPTO_THREAD_read_lock(rand_tmp_lock);
|
---|
| 155 | do_not_lock = CRYPTO_THREAD_compare_id(locking_threadid, cur);
|
---|
| 156 | CRYPTO_THREAD_unlock(rand_tmp_lock);
|
---|
| 157 | } else
|
---|
| 158 | do_not_lock = 0;
|
---|
| 159 |
|
---|
| 160 | if (!do_not_lock)
|
---|
| 161 | CRYPTO_THREAD_write_lock(rand_lock);
|
---|
| 162 | st_idx = state_index;
|
---|
| 163 |
|
---|
| 164 | /*
|
---|
| 165 | * use our own copies of the counters so that even if a concurrent thread
|
---|
| 166 | * seeds with exactly the same data and uses the same subarray there's
|
---|
| 167 | * _some_ difference
|
---|
| 168 | */
|
---|
| 169 | md_c[0] = md_count[0];
|
---|
| 170 | md_c[1] = md_count[1];
|
---|
| 171 |
|
---|
| 172 | memcpy(local_md, md, sizeof md);
|
---|
| 173 |
|
---|
| 174 | /* state_index <= state_num <= STATE_SIZE */
|
---|
| 175 | state_index += num;
|
---|
| 176 | if (state_index >= STATE_SIZE) {
|
---|
| 177 | state_index %= STATE_SIZE;
|
---|
| 178 | state_num = STATE_SIZE;
|
---|
| 179 | } else if (state_num < STATE_SIZE) {
|
---|
| 180 | if (state_index > state_num)
|
---|
| 181 | state_num = state_index;
|
---|
| 182 | }
|
---|
| 183 | /* state_index <= state_num <= STATE_SIZE */
|
---|
| 184 |
|
---|
| 185 | /*
|
---|
| 186 | * state[st_idx], ..., state[(st_idx + num - 1) % STATE_SIZE] are what we
|
---|
| 187 | * will use now, but other threads may use them as well
|
---|
| 188 | */
|
---|
| 189 |
|
---|
| 190 | md_count[1] += (num / MD_DIGEST_LENGTH) + (num % MD_DIGEST_LENGTH > 0);
|
---|
| 191 |
|
---|
| 192 | if (!do_not_lock)
|
---|
| 193 | CRYPTO_THREAD_unlock(rand_lock);
|
---|
| 194 |
|
---|
| 195 | for (i = 0; i < num; i += MD_DIGEST_LENGTH) {
|
---|
| 196 | j = (num - i);
|
---|
| 197 | j = (j > MD_DIGEST_LENGTH) ? MD_DIGEST_LENGTH : j;
|
---|
| 198 |
|
---|
| 199 | if (!MD_Init(m))
|
---|
| 200 | goto err;
|
---|
| 201 | if (!MD_Update(m, local_md, MD_DIGEST_LENGTH))
|
---|
| 202 | goto err;
|
---|
| 203 | k = (st_idx + j) - STATE_SIZE;
|
---|
| 204 | if (k > 0) {
|
---|
| 205 | if (!MD_Update(m, &(state[st_idx]), j - k))
|
---|
| 206 | goto err;
|
---|
| 207 | if (!MD_Update(m, &(state[0]), k))
|
---|
| 208 | goto err;
|
---|
| 209 | } else if (!MD_Update(m, &(state[st_idx]), j))
|
---|
| 210 | goto err;
|
---|
| 211 |
|
---|
| 212 | /* DO NOT REMOVE THE FOLLOWING CALL TO MD_Update()! */
|
---|
| 213 | if (!MD_Update(m, buf, j))
|
---|
| 214 | goto err;
|
---|
| 215 | /*
|
---|
| 216 | * We know that line may cause programs such as purify and valgrind
|
---|
| 217 | * to complain about use of uninitialized data. The problem is not,
|
---|
| 218 | * it's with the caller. Removing that line will make sure you get
|
---|
| 219 | * really bad randomness and thereby other problems such as very
|
---|
| 220 | * insecure keys.
|
---|
| 221 | */
|
---|
| 222 |
|
---|
| 223 | if (!MD_Update(m, (unsigned char *)&(md_c[0]), sizeof(md_c)))
|
---|
| 224 | goto err;
|
---|
| 225 | if (!MD_Final(m, local_md))
|
---|
| 226 | goto err;
|
---|
| 227 | md_c[1]++;
|
---|
| 228 |
|
---|
| 229 | buf = (const char *)buf + j;
|
---|
| 230 |
|
---|
| 231 | for (k = 0; k < j; k++) {
|
---|
| 232 | /*
|
---|
| 233 | * Parallel threads may interfere with this, but always each byte
|
---|
| 234 | * of the new state is the XOR of some previous value of its and
|
---|
| 235 | * local_md (intermediate values may be lost). Alway using locking
|
---|
| 236 | * could hurt performance more than necessary given that
|
---|
| 237 | * conflicts occur only when the total seeding is longer than the
|
---|
| 238 | * random state.
|
---|
| 239 | */
|
---|
| 240 | state[st_idx++] ^= local_md[k];
|
---|
| 241 | if (st_idx >= STATE_SIZE)
|
---|
| 242 | st_idx = 0;
|
---|
| 243 | }
|
---|
| 244 | }
|
---|
| 245 |
|
---|
| 246 | if (!do_not_lock)
|
---|
| 247 | CRYPTO_THREAD_write_lock(rand_lock);
|
---|
| 248 | /*
|
---|
| 249 | * Don't just copy back local_md into md -- this could mean that other
|
---|
| 250 | * thread's seeding remains without effect (except for the incremented
|
---|
| 251 | * counter). By XORing it we keep at least as much entropy as fits into
|
---|
| 252 | * md.
|
---|
| 253 | */
|
---|
| 254 | for (k = 0; k < (int)sizeof(md); k++) {
|
---|
| 255 | md[k] ^= local_md[k];
|
---|
| 256 | }
|
---|
| 257 | if (entropy < ENTROPY_NEEDED) /* stop counting when we have enough */
|
---|
| 258 | entropy += add;
|
---|
| 259 | if (!do_not_lock)
|
---|
| 260 | CRYPTO_THREAD_unlock(rand_lock);
|
---|
| 261 |
|
---|
| 262 | rv = 1;
|
---|
| 263 | err:
|
---|
| 264 | EVP_MD_CTX_free(m);
|
---|
| 265 | return rv;
|
---|
| 266 | }
|
---|
| 267 |
|
---|
| 268 | static int rand_seed(const void *buf, int num)
|
---|
| 269 | {
|
---|
| 270 | return rand_add(buf, num, (double)num);
|
---|
| 271 | }
|
---|
| 272 |
|
---|
| 273 | static int rand_bytes(unsigned char *buf, int num, int pseudo)
|
---|
| 274 | {
|
---|
| 275 | static volatile int stirred_pool = 0;
|
---|
| 276 | int i, j, k;
|
---|
| 277 | size_t num_ceil, st_idx, st_num;
|
---|
| 278 | int ok;
|
---|
| 279 | long md_c[2];
|
---|
| 280 | unsigned char local_md[MD_DIGEST_LENGTH];
|
---|
| 281 | EVP_MD_CTX *m;
|
---|
| 282 | #ifndef GETPID_IS_MEANINGLESS
|
---|
| 283 | pid_t curr_pid = getpid();
|
---|
| 284 | #endif
|
---|
| 285 | time_t curr_time = time(NULL);
|
---|
| 286 | int do_stir_pool = 0;
|
---|
| 287 | /* time value for various platforms */
|
---|
| 288 | #ifdef OPENSSL_SYS_WIN32
|
---|
| 289 | FILETIME tv;
|
---|
| 290 | # ifdef _WIN32_WCE
|
---|
| 291 | SYSTEMTIME t;
|
---|
| 292 | GetSystemTime(&t);
|
---|
| 293 | SystemTimeToFileTime(&t, &tv);
|
---|
| 294 | # else
|
---|
| 295 | GetSystemTimeAsFileTime(&tv);
|
---|
| 296 | # endif
|
---|
| 297 | #elif defined(OPENSSL_SYS_VXWORKS)
|
---|
| 298 | struct timespec tv;
|
---|
| 299 | clock_gettime(CLOCK_REALTIME, &ts);
|
---|
| 300 | #elif defined(OPENSSL_SYS_DSPBIOS)
|
---|
| 301 | unsigned long long tv, OPENSSL_rdtsc();
|
---|
| 302 | tv = OPENSSL_rdtsc();
|
---|
| 303 | #else
|
---|
| 304 | struct timeval tv;
|
---|
| 305 | gettimeofday(&tv, NULL);
|
---|
| 306 | #endif
|
---|
| 307 |
|
---|
| 308 | #ifdef PREDICT
|
---|
| 309 | if (rand_predictable) {
|
---|
| 310 | static unsigned char val = 0;
|
---|
| 311 |
|
---|
| 312 | for (i = 0; i < num; i++)
|
---|
| 313 | buf[i] = val++;
|
---|
| 314 | return (1);
|
---|
| 315 | }
|
---|
| 316 | #endif
|
---|
| 317 |
|
---|
| 318 | if (num <= 0)
|
---|
| 319 | return 1;
|
---|
| 320 |
|
---|
| 321 | m = EVP_MD_CTX_new();
|
---|
| 322 | if (m == NULL)
|
---|
| 323 | goto err_mem;
|
---|
| 324 |
|
---|
| 325 | /* round upwards to multiple of MD_DIGEST_LENGTH/2 */
|
---|
| 326 | num_ceil =
|
---|
| 327 | (1 + (num - 1) / (MD_DIGEST_LENGTH / 2)) * (MD_DIGEST_LENGTH / 2);
|
---|
| 328 |
|
---|
| 329 | /*
|
---|
| 330 | * (Based on the rand(3) manpage:)
|
---|
| 331 | *
|
---|
| 332 | * For each group of 10 bytes (or less), we do the following:
|
---|
| 333 | *
|
---|
| 334 | * Input into the hash function the local 'md' (which is initialized from
|
---|
| 335 | * the global 'md' before any bytes are generated), the bytes that are to
|
---|
| 336 | * be overwritten by the random bytes, and bytes from the 'state'
|
---|
| 337 | * (incrementing looping index). From this digest output (which is kept
|
---|
| 338 | * in 'md'), the top (up to) 10 bytes are returned to the caller and the
|
---|
| 339 | * bottom 10 bytes are xored into the 'state'.
|
---|
| 340 | *
|
---|
| 341 | * Finally, after we have finished 'num' random bytes for the
|
---|
| 342 | * caller, 'count' (which is incremented) and the local and global 'md'
|
---|
| 343 | * are fed into the hash function and the results are kept in the
|
---|
| 344 | * global 'md'.
|
---|
| 345 | */
|
---|
| 346 |
|
---|
| 347 | if (!RUN_ONCE(&rand_lock_init, do_rand_lock_init))
|
---|
| 348 | goto err_mem;
|
---|
| 349 |
|
---|
| 350 | CRYPTO_THREAD_write_lock(rand_lock);
|
---|
| 351 | /*
|
---|
| 352 | * We could end up in an async engine while holding this lock so ensure
|
---|
| 353 | * we don't pause and cause a deadlock
|
---|
| 354 | */
|
---|
| 355 | ASYNC_block_pause();
|
---|
| 356 |
|
---|
| 357 | /* prevent rand_bytes() from trying to obtain the lock again */
|
---|
| 358 | CRYPTO_THREAD_write_lock(rand_tmp_lock);
|
---|
| 359 | locking_threadid = CRYPTO_THREAD_get_current_id();
|
---|
| 360 | CRYPTO_THREAD_unlock(rand_tmp_lock);
|
---|
| 361 | crypto_lock_rand = 1;
|
---|
| 362 |
|
---|
| 363 | if (!initialized) {
|
---|
| 364 | RAND_poll();
|
---|
| 365 | initialized = 1;
|
---|
| 366 | }
|
---|
| 367 |
|
---|
| 368 | if (!stirred_pool)
|
---|
| 369 | do_stir_pool = 1;
|
---|
| 370 |
|
---|
| 371 | ok = (entropy >= ENTROPY_NEEDED);
|
---|
| 372 | if (!ok) {
|
---|
| 373 | /*
|
---|
| 374 | * If the PRNG state is not yet unpredictable, then seeing the PRNG
|
---|
| 375 | * output may help attackers to determine the new state; thus we have
|
---|
| 376 | * to decrease the entropy estimate. Once we've had enough initial
|
---|
| 377 | * seeding we don't bother to adjust the entropy count, though,
|
---|
| 378 | * because we're not ambitious to provide *information-theoretic*
|
---|
| 379 | * randomness. NOTE: This approach fails if the program forks before
|
---|
| 380 | * we have enough entropy. Entropy should be collected in a separate
|
---|
| 381 | * input pool and be transferred to the output pool only when the
|
---|
| 382 | * entropy limit has been reached.
|
---|
| 383 | */
|
---|
| 384 | entropy -= num;
|
---|
| 385 | if (entropy < 0)
|
---|
| 386 | entropy = 0;
|
---|
| 387 | }
|
---|
| 388 |
|
---|
| 389 | if (do_stir_pool) {
|
---|
| 390 | /*
|
---|
| 391 | * In the output function only half of 'md' remains secret, so we
|
---|
| 392 | * better make sure that the required entropy gets 'evenly
|
---|
| 393 | * distributed' through 'state', our randomness pool. The input
|
---|
| 394 | * function (rand_add) chains all of 'md', which makes it more
|
---|
| 395 | * suitable for this purpose.
|
---|
| 396 | */
|
---|
| 397 |
|
---|
| 398 | int n = STATE_SIZE; /* so that the complete pool gets accessed */
|
---|
| 399 | while (n > 0) {
|
---|
| 400 | #if MD_DIGEST_LENGTH > 20
|
---|
| 401 | # error "Please adjust DUMMY_SEED."
|
---|
| 402 | #endif
|
---|
| 403 | #define DUMMY_SEED "...................." /* at least MD_DIGEST_LENGTH */
|
---|
| 404 | /*
|
---|
| 405 | * Note that the seed does not matter, it's just that
|
---|
| 406 | * rand_add expects to have something to hash.
|
---|
| 407 | */
|
---|
| 408 | rand_add(DUMMY_SEED, MD_DIGEST_LENGTH, 0.0);
|
---|
| 409 | n -= MD_DIGEST_LENGTH;
|
---|
| 410 | }
|
---|
| 411 | if (ok)
|
---|
| 412 | stirred_pool = 1;
|
---|
| 413 | }
|
---|
| 414 |
|
---|
| 415 | st_idx = state_index;
|
---|
| 416 | st_num = state_num;
|
---|
| 417 | md_c[0] = md_count[0];
|
---|
| 418 | md_c[1] = md_count[1];
|
---|
| 419 | memcpy(local_md, md, sizeof md);
|
---|
| 420 |
|
---|
| 421 | state_index += num_ceil;
|
---|
| 422 | if (state_index > state_num)
|
---|
| 423 | state_index %= state_num;
|
---|
| 424 |
|
---|
| 425 | /*
|
---|
| 426 | * state[st_idx], ..., state[(st_idx + num_ceil - 1) % st_num] are now
|
---|
| 427 | * ours (but other threads may use them too)
|
---|
| 428 | */
|
---|
| 429 |
|
---|
| 430 | md_count[0] += 1;
|
---|
| 431 |
|
---|
| 432 | /* before unlocking, we must clear 'crypto_lock_rand' */
|
---|
| 433 | crypto_lock_rand = 0;
|
---|
| 434 | ASYNC_unblock_pause();
|
---|
| 435 | CRYPTO_THREAD_unlock(rand_lock);
|
---|
| 436 |
|
---|
| 437 | while (num > 0) {
|
---|
| 438 | /* num_ceil -= MD_DIGEST_LENGTH/2 */
|
---|
| 439 | j = (num >= MD_DIGEST_LENGTH / 2) ? MD_DIGEST_LENGTH / 2 : num;
|
---|
| 440 | num -= j;
|
---|
| 441 | if (!MD_Init(m))
|
---|
| 442 | goto err;
|
---|
| 443 | #ifndef GETPID_IS_MEANINGLESS
|
---|
| 444 | if (curr_pid) { /* just in the first iteration to save time */
|
---|
| 445 | if (!MD_Update(m, (unsigned char *)&curr_pid, sizeof curr_pid))
|
---|
| 446 | goto err;
|
---|
| 447 | curr_pid = 0;
|
---|
| 448 | }
|
---|
| 449 | #endif
|
---|
| 450 | if (curr_time) { /* just in the first iteration to save time */
|
---|
| 451 | if (!MD_Update(m, (unsigned char *)&curr_time, sizeof curr_time))
|
---|
| 452 | goto err;
|
---|
| 453 | if (!MD_Update(m, (unsigned char *)&tv, sizeof tv))
|
---|
| 454 | goto err;
|
---|
| 455 | curr_time = 0;
|
---|
| 456 | if (!rand_hw_seed(m))
|
---|
| 457 | goto err;
|
---|
| 458 | }
|
---|
| 459 | if (!MD_Update(m, local_md, MD_DIGEST_LENGTH))
|
---|
| 460 | goto err;
|
---|
| 461 | if (!MD_Update(m, (unsigned char *)&(md_c[0]), sizeof(md_c)))
|
---|
| 462 | goto err;
|
---|
| 463 |
|
---|
| 464 | k = (st_idx + MD_DIGEST_LENGTH / 2) - st_num;
|
---|
| 465 | if (k > 0) {
|
---|
| 466 | if (!MD_Update(m, &(state[st_idx]), MD_DIGEST_LENGTH / 2 - k))
|
---|
| 467 | goto err;
|
---|
| 468 | if (!MD_Update(m, &(state[0]), k))
|
---|
| 469 | goto err;
|
---|
| 470 | } else if (!MD_Update(m, &(state[st_idx]), MD_DIGEST_LENGTH / 2))
|
---|
| 471 | goto err;
|
---|
| 472 | if (!MD_Final(m, local_md))
|
---|
| 473 | goto err;
|
---|
| 474 |
|
---|
| 475 | for (i = 0; i < MD_DIGEST_LENGTH / 2; i++) {
|
---|
| 476 | /* may compete with other threads */
|
---|
| 477 | state[st_idx++] ^= local_md[i];
|
---|
| 478 | if (st_idx >= st_num)
|
---|
| 479 | st_idx = 0;
|
---|
| 480 | if (i < j)
|
---|
| 481 | *(buf++) = local_md[i + MD_DIGEST_LENGTH / 2];
|
---|
| 482 | }
|
---|
| 483 | }
|
---|
| 484 |
|
---|
| 485 | if (!MD_Init(m)
|
---|
| 486 | || !MD_Update(m, (unsigned char *)&(md_c[0]), sizeof(md_c))
|
---|
| 487 | || !MD_Update(m, local_md, MD_DIGEST_LENGTH))
|
---|
| 488 | goto err;
|
---|
| 489 | CRYPTO_THREAD_write_lock(rand_lock);
|
---|
| 490 | /*
|
---|
| 491 | * Prevent deadlocks if we end up in an async engine
|
---|
| 492 | */
|
---|
| 493 | ASYNC_block_pause();
|
---|
| 494 | if (!MD_Update(m, md, MD_DIGEST_LENGTH) || !MD_Final(m, md)) {
|
---|
| 495 | CRYPTO_THREAD_unlock(rand_lock);
|
---|
| 496 | goto err;
|
---|
| 497 | }
|
---|
| 498 | ASYNC_unblock_pause();
|
---|
| 499 | CRYPTO_THREAD_unlock(rand_lock);
|
---|
| 500 |
|
---|
| 501 | EVP_MD_CTX_free(m);
|
---|
| 502 | if (ok)
|
---|
| 503 | return (1);
|
---|
| 504 | else if (pseudo)
|
---|
| 505 | return 0;
|
---|
| 506 | else {
|
---|
| 507 | RANDerr(RAND_F_RAND_BYTES, RAND_R_PRNG_NOT_SEEDED);
|
---|
| 508 | ERR_add_error_data(1, "You need to read the OpenSSL FAQ, "
|
---|
| 509 | "https://www.openssl.org/docs/faq.html");
|
---|
| 510 | return (0);
|
---|
| 511 | }
|
---|
| 512 | err:
|
---|
| 513 | RANDerr(RAND_F_RAND_BYTES, ERR_R_EVP_LIB);
|
---|
| 514 | EVP_MD_CTX_free(m);
|
---|
| 515 | return 0;
|
---|
| 516 | err_mem:
|
---|
| 517 | RANDerr(RAND_F_RAND_BYTES, ERR_R_MALLOC_FAILURE);
|
---|
| 518 | EVP_MD_CTX_free(m);
|
---|
| 519 | return 0;
|
---|
| 520 |
|
---|
| 521 | }
|
---|
| 522 |
|
---|
| 523 | static int rand_nopseudo_bytes(unsigned char *buf, int num)
|
---|
| 524 | {
|
---|
| 525 | return rand_bytes(buf, num, 0);
|
---|
| 526 | }
|
---|
| 527 |
|
---|
| 528 | #if OPENSSL_API_COMPAT < 0x10100000L
|
---|
| 529 | /*
|
---|
| 530 | * pseudo-random bytes that are guaranteed to be unique but not unpredictable
|
---|
| 531 | */
|
---|
| 532 | static int rand_pseudo_bytes(unsigned char *buf, int num)
|
---|
| 533 | {
|
---|
| 534 | return rand_bytes(buf, num, 1);
|
---|
| 535 | }
|
---|
| 536 | #endif
|
---|
| 537 |
|
---|
| 538 | static int rand_status(void)
|
---|
| 539 | {
|
---|
| 540 | CRYPTO_THREAD_ID cur;
|
---|
| 541 | int ret;
|
---|
| 542 | int do_not_lock;
|
---|
| 543 |
|
---|
| 544 | if (!RUN_ONCE(&rand_lock_init, do_rand_lock_init))
|
---|
| 545 | return 0;
|
---|
| 546 |
|
---|
| 547 | cur = CRYPTO_THREAD_get_current_id();
|
---|
| 548 | /*
|
---|
| 549 | * check if we already have the lock (could happen if a RAND_poll()
|
---|
| 550 | * implementation calls RAND_status())
|
---|
| 551 | */
|
---|
| 552 | if (crypto_lock_rand) {
|
---|
| 553 | CRYPTO_THREAD_read_lock(rand_tmp_lock);
|
---|
| 554 | do_not_lock = CRYPTO_THREAD_compare_id(locking_threadid, cur);
|
---|
| 555 | CRYPTO_THREAD_unlock(rand_tmp_lock);
|
---|
| 556 | } else
|
---|
| 557 | do_not_lock = 0;
|
---|
| 558 |
|
---|
| 559 | if (!do_not_lock) {
|
---|
| 560 | CRYPTO_THREAD_write_lock(rand_lock);
|
---|
| 561 | /*
|
---|
| 562 | * Prevent deadlocks in case we end up in an async engine
|
---|
| 563 | */
|
---|
| 564 | ASYNC_block_pause();
|
---|
| 565 |
|
---|
| 566 | /*
|
---|
| 567 | * prevent rand_bytes() from trying to obtain the lock again
|
---|
| 568 | */
|
---|
| 569 | CRYPTO_THREAD_write_lock(rand_tmp_lock);
|
---|
| 570 | locking_threadid = cur;
|
---|
| 571 | CRYPTO_THREAD_unlock(rand_tmp_lock);
|
---|
| 572 | crypto_lock_rand = 1;
|
---|
| 573 | }
|
---|
| 574 |
|
---|
| 575 | if (!initialized) {
|
---|
| 576 | RAND_poll();
|
---|
| 577 | initialized = 1;
|
---|
| 578 | }
|
---|
| 579 |
|
---|
| 580 | ret = entropy >= ENTROPY_NEEDED;
|
---|
| 581 |
|
---|
| 582 | if (!do_not_lock) {
|
---|
| 583 | /* before unlocking, we must clear 'crypto_lock_rand' */
|
---|
| 584 | crypto_lock_rand = 0;
|
---|
| 585 |
|
---|
| 586 | ASYNC_unblock_pause();
|
---|
| 587 | CRYPTO_THREAD_unlock(rand_lock);
|
---|
| 588 | }
|
---|
| 589 |
|
---|
| 590 | return ret;
|
---|
| 591 | }
|
---|
| 592 |
|
---|
| 593 | /*
|
---|
| 594 | * rand_hw_seed: get seed data from any available hardware RNG. only
|
---|
| 595 | * currently supports rdrand.
|
---|
| 596 | */
|
---|
| 597 |
|
---|
| 598 | /* Adapted from eng_rdrand.c */
|
---|
| 599 |
|
---|
| 600 | #if (defined(__i386) || defined(__i386__) || defined(_M_IX86) || \
|
---|
| 601 | defined(__x86_64) || defined(__x86_64__) || \
|
---|
| 602 | defined(_M_AMD64) || defined (_M_X64)) && defined(OPENSSL_CPUID_OBJ) \
|
---|
| 603 | && !defined(OPENSSL_NO_RDRAND)
|
---|
| 604 |
|
---|
| 605 | # define RDRAND_CALLS 4
|
---|
| 606 |
|
---|
| 607 | size_t OPENSSL_ia32_rdrand(void);
|
---|
| 608 | extern unsigned int OPENSSL_ia32cap_P[];
|
---|
| 609 |
|
---|
| 610 | static int rand_hw_seed(EVP_MD_CTX *ctx)
|
---|
| 611 | {
|
---|
| 612 | int i;
|
---|
| 613 | if (!(OPENSSL_ia32cap_P[1] & (1 << (62 - 32))))
|
---|
| 614 | return 1;
|
---|
| 615 | for (i = 0; i < RDRAND_CALLS; i++) {
|
---|
| 616 | size_t rnd;
|
---|
| 617 | rnd = OPENSSL_ia32_rdrand();
|
---|
| 618 | if (rnd == 0)
|
---|
| 619 | return 1;
|
---|
| 620 | if (!MD_Update(ctx, (unsigned char *)&rnd, sizeof(size_t)))
|
---|
| 621 | return 0;
|
---|
| 622 | }
|
---|
| 623 | return 1;
|
---|
| 624 | }
|
---|
| 625 |
|
---|
| 626 | /* XOR an existing buffer with random data */
|
---|
| 627 |
|
---|
| 628 | void rand_hw_xor(unsigned char *buf, size_t num)
|
---|
| 629 | {
|
---|
| 630 | size_t rnd;
|
---|
| 631 | if (!(OPENSSL_ia32cap_P[1] & (1 << (62 - 32))))
|
---|
| 632 | return;
|
---|
| 633 | while (num >= sizeof(size_t)) {
|
---|
| 634 | rnd = OPENSSL_ia32_rdrand();
|
---|
| 635 | if (rnd == 0)
|
---|
| 636 | return;
|
---|
| 637 | *((size_t *)buf) ^= rnd;
|
---|
| 638 | buf += sizeof(size_t);
|
---|
| 639 | num -= sizeof(size_t);
|
---|
| 640 | }
|
---|
| 641 | if (num) {
|
---|
| 642 | rnd = OPENSSL_ia32_rdrand();
|
---|
| 643 | if (rnd == 0)
|
---|
| 644 | return;
|
---|
| 645 | while (num) {
|
---|
| 646 | *buf ^= rnd & 0xff;
|
---|
| 647 | rnd >>= 8;
|
---|
| 648 | buf++;
|
---|
| 649 | num--;
|
---|
| 650 | }
|
---|
| 651 | }
|
---|
| 652 | }
|
---|
| 653 |
|
---|
| 654 | #else
|
---|
| 655 |
|
---|
| 656 | static int rand_hw_seed(EVP_MD_CTX *ctx)
|
---|
| 657 | {
|
---|
| 658 | return 1;
|
---|
| 659 | }
|
---|
| 660 |
|
---|
| 661 | void rand_hw_xor(unsigned char *buf, size_t num)
|
---|
| 662 | {
|
---|
| 663 | return;
|
---|
| 664 | }
|
---|
| 665 |
|
---|
| 666 | #endif
|
---|