rand_lib.c 20.2 KB
Newer Older
R
Rich Salz 已提交
1
/*
R
Rich Salz 已提交
2
 * Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved.
3
 *
R
Rich Salz 已提交
4 5 6 7
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
8 9 10 11
 */

#include <stdio.h>
#include <time.h>
12
#include "internal/cryptlib.h"
13
#include <openssl/opensslconf.h>
R
Rich Salz 已提交
14
#include "internal/rand_int.h"
R
Rich Salz 已提交
15
#include <openssl/engine.h>
16
#include "internal/thread_once.h"
R
Rich Salz 已提交
17
#include "rand_lcl.h"
K
Kurt Roeckx 已提交
18 19 20 21 22 23
#ifdef OPENSSL_SYS_UNIX
# include <sys/types.h>
# include <unistd.h>
# include <sys/time.h>
#endif
#include "e_os.h"
24

25
#ifndef OPENSSL_NO_ENGINE
26
/* non-NULL if default_RAND_meth is ENGINE-provided */
R
Rich Salz 已提交
27 28
static ENGINE *funct_ref;
static CRYPTO_RWLOCK *rand_engine_lock;
29
#endif
R
Rich Salz 已提交
30 31 32
static CRYPTO_RWLOCK *rand_meth_lock;
static const RAND_METHOD *default_RAND_meth;
static CRYPTO_ONCE rand_init = CRYPTO_ONCE_STATIC_INIT;
33

R
Rich Salz 已提交
34
int rand_fork_count;
35

R
Rich Salz 已提交
36 37 38
#ifdef OPENSSL_RAND_SEED_RDTSC
/*
 * IMPORTANT NOTE:  It is not currently possible to use this code
R
Rich Salz 已提交
39 40
 * because we are not sure about the amount of randomness it provides.
 * Some SP900 tests have been run, but there is internal skepticism.
R
Rich Salz 已提交
41 42 43 44 45
 * So for now this code is not used.
 */
# error "RDTSC enabled?  Should not be possible!"

/*
46 47
 * Acquire entropy from high-speed clock
 *
R
Rich Salz 已提交
48
 * Since we get some randomness from the low-order bits of the
49 50 51 52
 * high-speed clock, it can help.
 *
 * Returns the total entropy count, if it exceeds the requested
 * entropy count. Otherwise, returns an entropy count of 0.
R
Rich Salz 已提交
53
 */
54
size_t rand_acquire_entropy_from_tsc(RAND_POOL *pool)
R
Rich Salz 已提交
55 56 57 58
{
    unsigned char c;
    int i;

R
Rich Salz 已提交
59 60 61
    if ((OPENSSL_ia32cap_P[0] & (1 << 4)) != 0) {
        for (i = 0; i < TSC_READ_COUNT; i++) {
            c = (unsigned char)(OPENSSL_rdtsc() & 0xFF);
62
            RAND_POOL_add(pool, &c, 1, 4);
R
Rich Salz 已提交
63
        }
R
Rich Salz 已提交
64
    }
65
    return RAND_POOL_entropy_available(pool);
R
Rich Salz 已提交
66 67 68 69
}
#endif

#ifdef OPENSSL_RAND_SEED_RDCPU
70 71
size_t OPENSSL_ia32_rdseed_bytes(unsigned char *buf, size_t len);
size_t OPENSSL_ia32_rdrand_bytes(unsigned char *buf, size_t len);
R
Rich Salz 已提交
72 73 74

extern unsigned int OPENSSL_ia32cap_P[];

75 76 77 78 79 80 81 82 83 84 85 86 87
/*
 * Acquire entropy using Intel-specific cpu instructions
 *
 * Uses the RDSEED instruction if available, otherwise uses
 * RDRAND if available.
 *
 * For the differences between RDSEED and RDRAND, and why RDSEED
 * is the preferred choice, see https://goo.gl/oK3KcN
 *
 * Returns the total entropy count, if it exceeds the requested
 * entropy count. Otherwise, returns an entropy count of 0.
 */
size_t rand_acquire_entropy_from_cpu(RAND_POOL *pool)
R
Rich Salz 已提交
88
{
89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116
    size_t bytes_needed;
    unsigned char *buffer;

    bytes_needed = RAND_POOL_bytes_needed(pool, 8 /*entropy_per_byte*/);
    if (bytes_needed > 0) {
        buffer = RAND_POOL_add_begin(pool, bytes_needed);

        if (buffer != NULL) {

            /* If RDSEED is available, use that. */
            if ((OPENSSL_ia32cap_P[2] & (1 << 18)) != 0) {
                if (OPENSSL_ia32_rdseed_bytes(buffer, bytes_needed)
                    == bytes_needed)
                    return RAND_POOL_add_end(pool,
                                             bytes_needed,
                                             8 * bytes_needed);
            }

            /* Second choice is RDRAND. */
            if ((OPENSSL_ia32cap_P[1] & (1 << (62 - 32))) != 0) {
                if (OPENSSL_ia32_rdrand_bytes(buffer, bytes_needed)
                    == bytes_needed)
                    return RAND_POOL_add_end(pool,
                                             bytes_needed,
                                             8 * bytes_needed);
            }

            return RAND_POOL_add_end(pool, 0, 0);
R
Rich Salz 已提交
117
        }
R
Rich Salz 已提交
118 119
    }

120
    return RAND_POOL_entropy_available(pool);
R
Rich Salz 已提交
121 122
}
#endif
R
Rich Salz 已提交
123

R
Rich Salz 已提交
124 125

/*
126 127 128 129
 * Implements the get_entropy() callback (see RAND_DRBG_set_callbacks())
 *
 * If the DRBG has a parent, then the required amount of entropy input
 * is fetched using the parent's RAND_DRBG_generate().
R
Rich Salz 已提交
130
 *
131 132 133 134 135
 * Otherwise, the entropy is polled from the system entropy sources
 * using RAND_POOL_acquire_entropy().
 *
 * If a random pool has been added to the DRBG using RAND_add(), then
 * its entropy will be used up first.
R
Rich Salz 已提交
136
 */
137 138 139
size_t rand_drbg_get_entropy(RAND_DRBG *drbg,
                        unsigned char **pout,
                        int entropy, size_t min_len, size_t max_len)
R
Rich Salz 已提交
140
{
141 142 143
    size_t ret = 0;
    size_t entropy_available = 0;
    RAND_POOL *pool = RAND_POOL_new(entropy, min_len, max_len);
R
Rich Salz 已提交
144

145 146 147 148 149 150 151 152 153 154
    if (pool == NULL)
        return 0;

    if (drbg->pool) {
        RAND_POOL_add(pool,
                      RAND_POOL_buffer(drbg->pool),
                      RAND_POOL_length(drbg->pool),
                      RAND_POOL_entropy(drbg->pool));
        RAND_POOL_free(drbg->pool);
        drbg->pool = NULL;
R
Rich Salz 已提交
155 156
    }

157 158 159
    if (drbg->parent) {
        size_t bytes_needed = RAND_POOL_bytes_needed(pool, 8);
        unsigned char *buffer = RAND_POOL_add_begin(pool, bytes_needed);
R
Rich Salz 已提交
160

161 162
        if (buffer != NULL) {
            size_t bytes = 0;
R
Rich Salz 已提交
163

B
Benjamin Kaduk 已提交
164 165 166 167 168 169 170
            /*
             * Get random from parent, include our state as additional input.
             * Our lock is already held, but we need to lock our parent before
             * generating bits from it.
             */
            if (drbg->parent->lock)
                CRYPTO_THREAD_write_lock(drbg->parent->lock);
171 172 173 174 175
            if (RAND_DRBG_generate(drbg->parent,
                                   buffer, bytes_needed,
                                   0,
                                   (unsigned char *)drbg, sizeof(*drbg)) != 0)
                bytes = bytes_needed;
B
Benjamin Kaduk 已提交
176 177
            if (drbg->parent->lock)
                CRYPTO_THREAD_unlock(drbg->parent->lock);
R
Rich Salz 已提交
178

179 180
            entropy_available = RAND_POOL_add_end(pool, bytes, 8 * bytes);
        }
181

182 183 184
    } else {
        /* Get entropy by polling system entropy sources. */
        entropy_available = RAND_POOL_acquire_entropy(pool);
R
Rich Salz 已提交
185 186
    }

187 188 189
    if (entropy_available > 0) {
        ret   = RAND_POOL_length(pool);
        *pout = RAND_POOL_detach(pool);
190
    }
191 192 193

    RAND_POOL_free(pool);
    return ret;
R
Rich Salz 已提交
194 195
}

K
Kurt Roeckx 已提交
196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212
/*
 * Generate additional data that can be used for the drbg. The data does
 * not need to contain entropy, but it's useful if it contains at least
 * some bits that are unpredictable.
 *
 * Returns 0 on failure.
 *
 * On success it allocates a buffer at |*pout| and returns the length of
 * the data. The buffer should get freed using OPENSSL_secure_clear_free().
 */
size_t rand_drbg_get_additional_data(unsigned char **pout, size_t max_len)
{
    RAND_POOL *pool;
    CRYPTO_THREAD_ID thread_id;
    size_t len;
#ifdef OPENSSL_SYS_UNIX
    pid_t pid;
213
    struct timeval tv;
K
Kurt Roeckx 已提交
214 215 216 217 218
#elif defined(OPENSSL_SYS_WIN32)
    DWORD pid;
    FILETIME ft;
    LARGE_INTEGER pc;
#endif
219
#ifdef OPENSSL_CPUID_OBJ
K
Kurt Roeckx 已提交
220
    uint32_t tsc = 0;
221
#endif
K
Kurt Roeckx 已提交
222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245

    pool = RAND_POOL_new(0, 0, max_len);
    if (pool == NULL)
        return 0;

#ifdef OPENSSL_SYS_UNIX
    pid = getpid();
    RAND_POOL_add(pool, (unsigned char *)&pid, sizeof(pid), 0);
#elif defined(OPENSSL_SYS_WIN32)
    pid = GetCurrentProcessId();
    RAND_POOL_add(pool, (unsigned char *)&pid, sizeof(pid), 0);
#endif

    thread_id = CRYPTO_THREAD_get_current_id();
    if (thread_id != 0)
        RAND_POOL_add(pool, (unsigned char *)&thread_id, sizeof(thread_id), 0);

#ifdef OPENSSL_CPUID_OBJ
    tsc = OPENSSL_rdtsc();
    if (tsc != 0)
        RAND_POOL_add(pool, (unsigned char *)&tsc, sizeof(tsc), 0);
#endif

#ifdef OPENSSL_SYS_UNIX
246 247
    if (gettimeofday(&tv, NULL) == 0)
        RAND_POOL_add(pool, (unsigned char *)&tv, sizeof(tv), 0);
K
Kurt Roeckx 已提交
248
#elif defined(OPENSSL_SYS_WIN32)
249
    if (QueryPerformanceCounter(&pc) != 0)
K
Kurt Roeckx 已提交
250 251 252 253 254 255 256 257 258 259 260 261 262 263
        RAND_POOL_add(pool, (unsigned char *)&pc, sizeof(pc), 0);
    GetSystemTimeAsFileTime(&ft);
    RAND_POOL_add(pool, (unsigned char *)&ft, sizeof(ft), 0);
#endif

    /* TODO: Use RDSEED? */

    len = RAND_POOL_length(pool);
    if (len != 0)
        *pout = RAND_POOL_detach(pool);
    RAND_POOL_free(pool);

    return len;
}
264 265 266 267 268 269 270

/*
 * Implements the cleanup_entropy() callback (see RAND_DRBG_set_callbacks())
 *
 */
void rand_drbg_cleanup_entropy(RAND_DRBG *drbg,
                               unsigned char *out, size_t outlen)
R
Rich Salz 已提交
271
{
272
    OPENSSL_secure_clear_free(out, outlen);
273 274
}

R
Rich Salz 已提交
275 276 277 278 279
void rand_fork()
{
    rand_fork_count++;
}

R
Rich Salz 已提交
280
DEFINE_RUN_ONCE_STATIC(do_rand_init)
281
{
282
    int ret = 1;
R
Rich Salz 已提交
283

284
#ifndef OPENSSL_NO_ENGINE
285
    rand_engine_lock = CRYPTO_THREAD_lock_new();
286
    ret &= rand_engine_lock != NULL;
287
#endif
288
    rand_meth_lock = CRYPTO_THREAD_lock_new();
289
    ret &= rand_meth_lock != NULL;
R
Rich Salz 已提交
290

291
    return ret;
292
}
293

R
Rich Salz 已提交
294 295 296 297 298 299 300 301 302 303 304
void rand_cleanup_int(void)
{
    const RAND_METHOD *meth = default_RAND_meth;

    if (meth != NULL && meth->cleanup != NULL)
        meth->cleanup();
    RAND_set_rand_method(NULL);
#ifndef OPENSSL_NO_ENGINE
    CRYPTO_THREAD_lock_free(rand_engine_lock);
#endif
    CRYPTO_THREAD_lock_free(rand_meth_lock);
R
Rich Salz 已提交
305 306 307
}

/*
308 309 310 311 312 313 314 315 316 317 318 319 320 321 322
 * RAND_poll() reseeds the default RNG using random input
 *
 * The random input is obtained from polling various entropy
 * sources which depend on the operating system and are
 * configurable via the --with-rand-seed configure option.
 */
int RAND_poll(void)
{
    int ret = 0;

    RAND_POOL *pool = NULL;

    const RAND_METHOD *meth = RAND_get_rand_method();

    if (meth == RAND_OpenSSL()) {
323 324
        /* fill random pool and seed the master DRBG */
        RAND_DRBG *drbg = RAND_DRBG_get0_master();
325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369

        if (drbg == NULL)
            return 0;

        CRYPTO_THREAD_write_lock(drbg->lock);
        ret = rand_drbg_restart(drbg, NULL, 0, 0);
        CRYPTO_THREAD_unlock(drbg->lock);

        return ret;

    } else {
        /* fill random pool and seed the current legacy RNG */
        pool = RAND_POOL_new(RAND_DRBG_STRENGTH,
                             RAND_DRBG_STRENGTH / 8,
                             DRBG_MINMAX_FACTOR * (RAND_DRBG_STRENGTH / 8));
        if (pool == NULL)
            return 0;

        if (RAND_POOL_acquire_entropy(pool) == 0)
            goto err;

        if (meth->add == NULL
            || meth->add(RAND_POOL_buffer(pool),
                         RAND_POOL_length(pool),
                         (RAND_POOL_entropy(pool) / 8.0)) == 0)
            goto err;

        ret = 1;
    }

err:
    RAND_POOL_free(pool);
    return ret;
}

/*
 * The 'random pool' acts as a dumb container for collecting random
 * input from various entropy sources. The pool has no knowledge about
 * whether its randomness is fed into a legacy RAND_METHOD via RAND_add()
 * or into a new style RAND_DRBG. It is the callers duty to 1) initialize the
 * random pool, 2) pass it to the polling callbacks, 3) seed the RNG, and
 * 4) cleanup the random pool again.
 *
 * The random pool contains no locking mechanism because its scope and
 * lifetime is intended to be restricted to a single stack frame.
R
Rich Salz 已提交
370
 */
371 372 373 374 375 376 377 378 379 380 381 382 383 384 385
struct rand_pool_st {
    unsigned char *buffer;  /* points to the beginning of the random pool */
    size_t len; /* current number of random bytes contained in the pool */

    size_t min_len; /* minimum number of random bytes requested */
    size_t max_len; /* maximum number of random bytes (allocated buffer size) */
    size_t entropy; /* current entropy count in bits */
    size_t requested_entropy; /* requested entropy count in bits */
};

/*
 * Allocate memory and initialize a new random pool
 */

RAND_POOL *RAND_POOL_new(int entropy, size_t min_len, size_t max_len)
R
Rich Salz 已提交
386
{
387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409
    RAND_POOL *pool = OPENSSL_zalloc(sizeof(*pool));

    if (pool == NULL) {
        RANDerr(RAND_F_RAND_POOL_NEW, ERR_R_MALLOC_FAILURE);
        goto err;
    }

    pool->min_len = min_len;
    pool->max_len = max_len;

    pool->buffer = OPENSSL_secure_zalloc(pool->max_len);
    if (pool->buffer == NULL) {
        RANDerr(RAND_F_RAND_POOL_NEW, ERR_R_MALLOC_FAILURE);
        goto err;
    }

    pool->requested_entropy = entropy;

    return pool;

err:
    OPENSSL_free(pool);
    return NULL;
R
Rich Salz 已提交
410 411
}

412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534
/*
 * Free |pool|, securely erasing its buffer.
 */
void RAND_POOL_free(RAND_POOL *pool)
{
    if (pool == NULL)
        return;

    OPENSSL_secure_clear_free(pool->buffer, pool->max_len);
    OPENSSL_free(pool);
}

/*
 * Return the |pool|'s buffer to the caller (readonly).
 */
const unsigned char *RAND_POOL_buffer(RAND_POOL *pool)
{
    return pool->buffer;
}

/*
 * Return the |pool|'s entropy to the caller.
 */
size_t RAND_POOL_entropy(RAND_POOL *pool)
{
    return pool->entropy;
}

/*
 * Return the |pool|'s buffer length to the caller.
 */
size_t RAND_POOL_length(RAND_POOL *pool)
{
    return pool->len;
}

/*
 * Detach the |pool| buffer and return it to the caller.
 * It's the responsibility of the caller to free the buffer
 * using OPENSSL_secure_clear_free().
 */
unsigned char *RAND_POOL_detach(RAND_POOL *pool)
{
    unsigned char *ret = pool->buffer;
    pool->buffer = NULL;
    return ret;
}


/*
 * If every byte of the input contains |entropy_per_bytes| bits of entropy,
 * how many bytes does one need to obtain at least |bits| bits of entropy?
 */
#define ENTROPY_TO_BYTES(bits, entropy_per_bytes) \
    (((bits) + ((entropy_per_bytes) - 1))/(entropy_per_bytes))


/*
 * Checks whether the |pool|'s entropy is available to the caller.
 * This is the case when entropy count and buffer length are high enough.
 * Returns
 *
 *  |entropy|  if the entropy count and buffer size is large enough
 *      0      otherwise
 */
size_t RAND_POOL_entropy_available(RAND_POOL *pool)
{
    if (pool->entropy < pool->requested_entropy)
        return 0;

    if (pool->len < pool->min_len)
        return 0;

    return pool->entropy;
}

/*
 * Returns the (remaining) amount of entropy needed to fill
 * the random pool.
 */

size_t RAND_POOL_entropy_needed(RAND_POOL *pool)
{
    if (pool->entropy < pool->requested_entropy)
        return pool->requested_entropy - pool->entropy;

    return 0;
}

/*
 * Returns the number of bytes needed to fill the pool, assuming
 * the input has 'entropy_per_byte' entropy bits per byte.
 * In case of an error, 0 is returned.
 */

size_t RAND_POOL_bytes_needed(RAND_POOL *pool, unsigned int entropy_per_byte)
{
    size_t bytes_needed;
    size_t entropy_needed = RAND_POOL_entropy_needed(pool);

    if (entropy_per_byte < 1 || entropy_per_byte > 8) {
        RANDerr(RAND_F_RAND_POOL_BYTES_NEEDED, RAND_R_ARGUMENT_OUT_OF_RANGE);
        return 0;
    }

    bytes_needed = ENTROPY_TO_BYTES(entropy_needed, entropy_per_byte);

    if (bytes_needed > pool->max_len - pool->len) {
        /* not enough space left */
        RANDerr(RAND_F_RAND_POOL_BYTES_NEEDED, RAND_R_RANDOM_POOL_OVERFLOW);
        return 0;
    }

    if (pool->len < pool->min_len &&
        bytes_needed < pool->min_len - pool->len)
        /* to meet the min_len requirement */
        bytes_needed = pool->min_len - pool->len;

    return bytes_needed;
}

/* Returns the remaining number of bytes available */
size_t RAND_POOL_bytes_remaining(RAND_POOL *pool)
R
Rich Salz 已提交
535
{
536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612
    return pool->max_len - pool->len;
}

/*
 * Add random bytes to the random pool.
 *
 * It is expected that the |buffer| contains |len| bytes of
 * random input which contains at least |entropy| bits of
 * randomness.
 *
 * Return available amount of entropy after this operation.
 * (see RAND_POOL_entropy_available(pool))
 */
size_t RAND_POOL_add(RAND_POOL *pool,
                     const unsigned char *buffer, size_t len, size_t entropy)
{
    if (len > pool->max_len - pool->len) {
        RANDerr(RAND_F_RAND_POOL_ADD, RAND_R_ENTROPY_INPUT_TOO_LONG);
        return 0;
    }

    if (len > 0) {
        memcpy(pool->buffer + pool->len, buffer, len);
        pool->len += len;
        pool->entropy += entropy;
    }

    return RAND_POOL_entropy_available(pool);
}

/*
 * Start to add random bytes to the random pool in-place.
 *
 * Reserves the next |len| bytes for adding random bytes in-place
 * and returns a pointer to the buffer.
 * The caller is allowed to copy up to |len| bytes into the buffer.
 * If |len| == 0 this is considered a no-op and a NULL pointer
 * is returned without producing an error message.
 *
 * After updating the buffer, RAND_POOL_add_end() needs to be called
 * to finish the udpate operation (see next comment).
 */
unsigned char *RAND_POOL_add_begin(RAND_POOL *pool, size_t len)
{
    if (len == 0)
        return NULL;

    if (len > pool->max_len - pool->len) {
        RANDerr(RAND_F_RAND_POOL_ADD_BEGIN, RAND_R_RANDOM_POOL_OVERFLOW);
        return NULL;
    }

    return pool->buffer + pool->len;
}

/*
 * Finish to add random bytes to the random pool in-place.
 *
 * Finishes an in-place update of the random pool started by
 * RAND_POOL_add_begin() (see previous comment).
 * It is expected that |len| bytes of random input have been added
 * to the buffer which contain at least |entropy| bits of randomness.
 * It is allowed to add less bytes than originally reserved.
 */
size_t RAND_POOL_add_end(RAND_POOL *pool, size_t len, size_t entropy)
{
    if (len > pool->max_len - pool->len) {
        RANDerr(RAND_F_RAND_POOL_ADD_END, RAND_R_RANDOM_POOL_OVERFLOW);
        return 0;
    }

    if (len > 0) {
        pool->len += len;
        pool->entropy += entropy;
    }

    return RAND_POOL_entropy_available(pool);
R
Rich Salz 已提交
613 614
}

615
int RAND_set_rand_method(const RAND_METHOD *meth)
616
{
R
Rich Salz 已提交
617
    if (!RUN_ONCE(&rand_init, do_rand_init))
618 619 620
        return 0;

    CRYPTO_THREAD_write_lock(rand_meth_lock);
621
#ifndef OPENSSL_NO_ENGINE
R
Rich Salz 已提交
622 623
    ENGINE_finish(funct_ref);
    funct_ref = NULL;
624
#endif
625
    default_RAND_meth = meth;
626
    CRYPTO_THREAD_unlock(rand_meth_lock);
627 628
    return 1;
}
629

630
const RAND_METHOD *RAND_get_rand_method(void)
631
{
632 633
    const RAND_METHOD *tmp_meth = NULL;

R
Rich Salz 已提交
634
    if (!RUN_ONCE(&rand_init, do_rand_init))
635 636 637
        return NULL;

    CRYPTO_THREAD_write_lock(rand_meth_lock);
R
Rich Salz 已提交
638
    if (default_RAND_meth == NULL) {
639
#ifndef OPENSSL_NO_ENGINE
R
Rich Salz 已提交
640 641 642 643 644
        ENGINE *e;

        /* If we have an engine that can do RAND, use it. */
        if ((e = ENGINE_get_default_RAND()) != NULL
                && (tmp_meth = ENGINE_get_RAND(e)) != NULL) {
645
            funct_ref = e;
R
Rich Salz 已提交
646 647 648
            default_RAND_meth = tmp_meth;
        } else {
            ENGINE_finish(e);
R
Rich Salz 已提交
649
            default_RAND_meth = &rand_meth;
R
Rich Salz 已提交
650 651
        }
#else
R
Rich Salz 已提交
652
        default_RAND_meth = &rand_meth;
653
#endif
654
    }
655 656 657
    tmp_meth = default_RAND_meth;
    CRYPTO_THREAD_unlock(rand_meth_lock);
    return tmp_meth;
658
}
659

660
#ifndef OPENSSL_NO_ENGINE
661
int RAND_set_rand_engine(ENGINE *engine)
662 663
{
    const RAND_METHOD *tmp_meth = NULL;
664

R
Rich Salz 已提交
665
    if (!RUN_ONCE(&rand_init, do_rand_init))
666 667
        return 0;

R
Rich Salz 已提交
668
    if (engine != NULL) {
669 670 671
        if (!ENGINE_init(engine))
            return 0;
        tmp_meth = ENGINE_get_RAND(engine);
R
Rich Salz 已提交
672
        if (tmp_meth == NULL) {
673 674 675 676
            ENGINE_finish(engine);
            return 0;
        }
    }
677
    CRYPTO_THREAD_write_lock(rand_engine_lock);
678 679 680
    /* This function releases any prior ENGINE so call it first */
    RAND_set_rand_method(tmp_meth);
    funct_ref = engine;
681
    CRYPTO_THREAD_unlock(rand_engine_lock);
682 683
    return 1;
}
684
#endif
685

686
void RAND_seed(const void *buf, int num)
687 688
{
    const RAND_METHOD *meth = RAND_get_rand_method();
R
Rich Salz 已提交
689 690

    if (meth->seed != NULL)
691 692
        meth->seed(buf, num);
}
693

R
Rich Salz 已提交
694
void RAND_add(const void *buf, int num, double randomness)
695 696
{
    const RAND_METHOD *meth = RAND_get_rand_method();
R
Rich Salz 已提交
697 698 699

    if (meth->add != NULL)
        meth->add(buf, num, randomness);
700
}
701

702 703 704 705 706 707 708 709
/*
 * This function is not part of RAND_METHOD, so if we're not using
 * the default method, then just call RAND_bytes().  Otherwise make
 * sure we're instantiated and use the private DRBG.
 */
int RAND_priv_bytes(unsigned char *buf, int num)
{
    const RAND_METHOD *meth = RAND_get_rand_method();
710
    RAND_DRBG *drbg;
B
Benjamin Kaduk 已提交
711
    int ret;
712 713 714 715

    if (meth != RAND_OpenSSL())
        return RAND_bytes(buf, num);

716
    drbg = RAND_DRBG_get0_private();
717
    if (drbg == NULL)
718 719
        return 0;

B
Benjamin Kaduk 已提交
720 721 722 723 724
    /* We have to lock the DRBG before generating bits from it. */
    CRYPTO_THREAD_write_lock(drbg->lock);
    ret = RAND_DRBG_generate(drbg, buf, num, 0, NULL, 0);
    CRYPTO_THREAD_unlock(drbg->lock);
    return ret;
725 726
}

727
int RAND_bytes(unsigned char *buf, int num)
728 729
{
    const RAND_METHOD *meth = RAND_get_rand_method();
R
Rich Salz 已提交
730 731

    if (meth->bytes != NULL)
732
        return meth->bytes(buf, num);
R
Rich Salz 已提交
733
    RANDerr(RAND_F_RAND_BYTES, RAND_R_FUNC_NOT_IMPLEMENTED);
R
Rich Salz 已提交
734
    return -1;
735
}
736

737
#if OPENSSL_API_COMPAT < 0x10100000L
738
int RAND_pseudo_bytes(unsigned char *buf, int num)
739 740
{
    const RAND_METHOD *meth = RAND_get_rand_method();
R
Rich Salz 已提交
741 742

    if (meth->pseudorand != NULL)
743
        return meth->pseudorand(buf, num);
R
Rich Salz 已提交
744
    return -1;
745
}
M
Matt Caswell 已提交
746
#endif
747 748

int RAND_status(void)
749 750
{
    const RAND_METHOD *meth = RAND_get_rand_method();
R
Rich Salz 已提交
751 752

    if (meth->status != NULL)
753 754 755
        return meth->status();
    return 0;
}