summaryrefslogtreecommitdiffstats
path: root/crypto/rand
AgeCommit message (Collapse)Author
2021-12-14Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17271)
2021-09-09VMS: Fix misspelt typeRichard Levitte
'__int64', not 'int64_t' Ref: commit 2e5cdbc18a1a26bfc817070a52689886fa0669c2 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16557)
2021-09-07VMS: Compensate for compiler type incompatibilityRichard Levitte
The compiler says that 'unsigned long long' isn't the same as 'unsigned __int64'. Sure, and considering that crypto/rand/rand_vms.c is specific VMS only code, it's easy to just change the type to the exact same as what's specified in the system headers. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15613)
2021-08-27Darwin platform allows to build on releases before Yosemite/ios 8.David Carlier
issue #16407 #16408 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16409)
2021-08-24Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-06-30apple getentropy removalDavid CARLIER
backport of #15924 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15935)
2021-03-25Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-03-20Add a missing RUN_ONCE in rand_lib.cMatt Caswell
Some of the callbacks in rand_lib.c were being invoked without the RUN_ONCE for that file being called. We add it during rand_pool_new which should cover all cases. Fixes #7870 Fixes #11144 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14603)
2020-10-14syscall_random(): don't fail if the getentropy() function is a dummyYury Is
Several embedded toolchains may provide dummy implemented getentropy() function which always returns -1 and sets errno to the ENOSYS. As a result the function SSL_CTX_new() fails to create a new context. Fixes #13002 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/13112)
2020-09-22Update copyright yearMatt Caswell
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/12949)
2020-09-10Revert two renamings backported from masterDr. Matthias St. Pierre
The original names were more intuitive: the generate_counter counts the number of generate requests, and the reseed_counter counts the number of reseedings (of the principal DRBG). reseed_gen_counter -> generate_counter reseed_prop_counter -> reseed_counter This partially reverts commit 35a34508ef4d649ace4e373e1d019192b7e38c36. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12759)
2020-09-10Fix the DRBG seed propagationDr. Matthias St. Pierre
In a nutshell, reseed propagation is a compatibility feature with the sole purpose to support the traditional way of (re-)seeding manually by calling 'RAND_add()' before 'RAND_bytes(). It ensures that the former has an immediate effect on the latter *within the same thread*, but it does not care about immediate reseed propagation to other threads. The implementation is lock-free, i.e., it works without taking the lock of the primary DRBG. Pull request #7399 not only fixed the data race issue #7394 but also changed the original implementation of the seed propagation unnecessarily. This commit reverts most of the changes of commit 1f98527659b8 and intends to fix the data race while retaining the original simplicity of the seed propagation. - use atomics with relaxed semantics to load and store the seed counter - add a new member drbg->enable_reseed_propagation to simplify the overflow treatment of the seed propagation counter - don't handle races between different threads This partially reverts commit 1f98527659b8290d442c4e1532452b9ba6463f1e. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12759)
2020-09-07Coverity FixesShane Lontis
x_algor.c: Explicit null dereferenced cms_sd.c: Resource leak ts_rsp_sign.c Resource Leak extensions_srvr.c: Resourse Leak v3_alt.c: Resourse Leak pcy_data.c: Resource Leak cms_lib.c: Resource Leak drbg_lib.c: Unchecked return code Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12531)
2020-07-15Enable WinCE build without deceiving _MSC_VER.aSoujyuTanaka
Reviewed-by: Mark J. Cox <mark@awe.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11526) (cherry picked from commit c35b8535768e22cd3b7743f4887a72e53a621a5f)
2020-06-03Fix a buffer overflow in drbg_ctr_generateBernd Edlinger
This can happen if the 32-bit counter overflows and the last block is not a multiple of 16 bytes. Fixes #12012 [extended tests] Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/12016) (cherry picked from commit 42fa3e66697baa121220b4eacf03607280e4ff89)
2020-05-28AES CTR-DRGB: performance improvementPatrick Steuer
Optimize the the AES-based implementation of the CTR_DRBG construction, see 10.2.1 in [1]. Due to the optimizations, the code may deviate (more) from the pseudocode in [1], but it is functional equivalence being decisive for compliance: "All DRBG mechanisms and algorithms are described in this document in pseudocode, which is intended to explain functionality. The pseudocode is not intended to constrain real-world implementations." [9 in [1]]. The following optimizations are done: - Replace multiple plain AES encryptions by a single AES-ECB encryption of a corresponding pre-initialized buffer, where possible. This allows platform-specific AES-ECB support to be used and reduces the overhead of multiple EVP calls. - Replace the generate operation loop (which is a counter increment followed by a plain AES encryption) by a loop which does a plain AES encryption followed by a counter increment. The latter loop is just a description of AES-CTR, so we replace it by a single AES-CTR encryption. This allows for platform-specific AES-CTR support to be used and reduces the overhead of multiple EVP calls. This change, that is, going from a pre- to a post- counter increment, requires the counter in the internal state to be kept at "+1" (compared to the pseudocode in [1]) such that it is in the correct state, when a generate operation is called. That in turn also requires all other operations to be changed from pre- to post-increment to keep functional equivalence. [1] NIST SP 800-90A Revision 1 Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (cherry picked from commit 28bdbe1aaa474ae8cd83e520d02e463e46ce89d9) Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/11968)
2020-05-20Fix egd and devrandom source configsBernd Edlinger
./config --with-rand-seed=egd need to defines OPENSSL_RAND_SEED_EGD and OPENSSL_NO_EGD so get rid of OPENSSL_NO_EGD (compiles but I did not really test EGD) ./config --with-rand-seed=devrandom does not work since wait_random_seeded works under the assumption that OPENSSL_RAND_SEED_GETRANDOM is supposed to be enabled as well, that is usually the case, but not when only devrandom is enabled. Skip the wait code in this special case. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11848) (cherry picked from commit ddec332f329a432a45c0131d83f3bfb46114532b)
2020-05-04rand_unix.c: Ensure requests to KERN_ARND don't exceed 256 bytes.nia
Requests for more than 256 bytes will fail. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11689) (cherry picked from commit 7421f085005e0d7a1dd2fe61b991ff23cef91c22)
2020-05-04rand_unix.c: Only enable hack for old FreeBSD versions on FreeBSDnia
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11689) (cherry picked from commit 0c27ce7322e15a7e0733d48aaf9c8e1d1249541f)
2020-05-04rand_unix.c: Include correct headers for sysctl() on NetBSDnia
This allows sysctl(KERN_ARND) to be detected properly. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11689) (cherry picked from commit e2e4b784e65eaafb133a7db3d344446c43112d41)
2020-04-21Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2020-04-09Fix AES-CTR_DRBG on 1.1.1.Pauli
The backport of the timing information leak fix uses u32 which is defined in crypto/modes/modes_local.h in 1.1.1 and include/crypto/modes.h for 3.0. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11489)
2020-04-08AES CTR-DRGB: do not leak timing informationPatrick Steuer
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11147) (cherry picked from commit 069165d10646a22000c596095cc04d43bbf1f807)
2020-03-17Update copyright yearMatt Caswell
Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/11344)
2020-02-15VMS: Correct error reporting in crypto/rand/rand_vms.cRichard Levitte
The future style that's coming with OpenSSL 3.0 was used, we need to revert that back to "traditional" style. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11088)
2020-02-06Fix misspelling errors and typos reported by codespellDr. Matthias St. Pierre
Fixes #10998 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11000)
2020-01-07Revert "Move random-related defines from e_os.h to rand_unix.c"Dr. Matthias St. Pierre
This reverts commit 7b18d1a53f932391bbc599a4717d6f98a597849c, which moved the DEVRANDOM and DEVRANDOM_EGD defines into rand_unix.c. That change introduced the regression that the compiler complains about missing declarations in apps/version.c when OpenSSL is configured using `--with-rand-seed=devrandom` (resp. `--with-rand-seed=egd`): apps/version.c:173:42: error: 'DEVRANDOM' undeclared static const char *dev[] = { DEVRANDOM, NULL }; ^~~~~~~~~ Fixes #10759 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10764)
2019-12-15rand_lib.c: fix null pointer dereferences after RAND_get_rand_method() failureDr. Matthias St. Pierre
RAND_get_rand_method() can return a NULL method pointer in the case of a malloc failure, so don't dereference it without a check. Reported-by: Zu-Ming Jiang (detected by FIFUZZ) Fixes #10480 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10490)
2019-12-11Fix some typosVeres Lajos
Reported-by: misspell-fixer <https://github.com/vlajos/misspell-fixer> CLA: trivial Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10544) (cherry picked from commit 79c44b4e3044aee9dc9618850d4f1ce067757b4b)
2019-11-02VMS: Added new method to gather entropy on VMS, based on SYS$GET_ENTROPY.Richard Levitte
This system services is based on FreeBSD 12's getentropy(), and is therefore treated the same way as getentropy() with regards to amount of entropy bits per data bit. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8926) (cherry picked from commit 8b9896eb293a0861f0b8c191b7a278f176b729e6)
2019-10-19Move random-related defines from e_os.h to rand_unix.cDr. Matthias St. Pierre
Fixes #10049 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10050) (cherry picked from commit 01036e2afbe116d608be048ed15930fc885ab2a8)
2019-10-19rand_unix.c: correct include guard commentsDr. Matthias St. Pierre
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10050) (cherry picked from commit 2a7e6ed86be20bd472696a3eafe5d20ec9579dab)
2019-09-30Add defines for __NR_getrandom for all Linux architecturesKurt Roeckx
Fixes: #10015 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> GH: #10044 (cherry picked from commit 4dcb150ea30f9bbfa7946e6b39c30a86aca5ed02)
2019-09-27Fix header file include guard namesDr. Matthias St. Pierre
Make the include guards consistent by renaming them systematically according to the naming conventions below The public header files (in the 'include/openssl' directory) are not changed in 1.1.1, because it is a stable release. For the private header files files, the guard names try to match the path specified in the include directives, with all letters converted to upper case and '/' and '.' replaced by '_'. An extra 'OSSL_' is added as prefix. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9681)
2019-09-27Reorganize local header filesDr. Matthias St. Pierre
Apart from public and internal header files, there is a third type called local header files, which are located next to source files in the source directory. Currently, they have different suffixes like '*_lcl.h', '*_local.h', or '*_int.h' This commit changes the different suffixes to '*_local.h' uniformly. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9681)
2019-09-27Reorganize private crypto header filesDr. Matthias St. Pierre
Currently, there are two different directories which contain internal header files of libcrypto which are meant to be shared internally: While header files in 'include/internal' are intended to be shared between libcrypto and libssl, the files in 'crypto/include/internal' are intended to be shared inside libcrypto only. To make things complicated, the include search path is set up in such a way that the directive #include "internal/file.h" could refer to a file in either of these two directoroes. This makes it necessary in some cases to add a '_int.h' suffix to some files to resolve this ambiguity: #include "internal/file.h" # located in 'include/internal' #include "internal/file_int.h" # located in 'crypto/include/internal' This commit moves the private crypto headers from 'crypto/include/internal' to 'include/crypto' As a result, the include directives become unambiguous #include "internal/file.h" # located in 'include/internal' #include "crypto/file.h" # located in 'include/crypto' hence the superfluous '_int.h' suffixes can be stripped. The files 'store_int.h' and 'store.h' need to be treated specially; they are joined into a single file. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9681)
2019-09-10Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9847)
2019-09-10Fix a potential crash in rand_unix.cBernd Edlinger
Due to the dynamic allocation that was added to rand_pool_add_begin this function could now return a null pointer where it was previously guaranteed to succeed. But the return value of this function does not need to be checked by design. Move rand_pool_grow from rand_pool_add_begin to rand_pool_bytes_needed. Make an allocation error persistent to avoid falling back to less secure or blocking entropy sources. Fixes: a6a66e4511ee ("Make rand_pool buffers more dynamic in their sizing.") Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9687) (cherry picked from commit fa3eb248e29ca8031e6a14e8a2c6f3cd58b5450e)
2019-09-10Fix a strict warnings error in rand_pool_acquire_entropyBernd Edlinger
There was a warning about unused variables in this config: ./config --strict-warnings --with-rand-seed=rdcpu Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9687) (cherry picked from commit e301c147a763f67dcc5ba63eb7e2ae40d83a68aa)
2019-09-09drbg: fix issue where DRBG_CTR fails if NO_DF is used (2nd attempt)Dr. Matthias St. Pierre
Since commit 7c226dfc434d a chained DRBG does not add additional data anymore when reseeding from its parent. The reason is that the size of the additional data exceeded the allowed size when no derivation function was used. This commit provides an alternative fix: instead of adding the entire DRBG's complete state, we just add the DRBG's address in memory, thereby providing some distinction between the different DRBG instances. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9802)
2019-09-09drbg: add fork id to additional data on UNIX systemsDr. Matthias St. Pierre
Provides a little extra fork-safety on UNIX systems, adding to the fact that all DRBGs reseed automatically when the fork_id changes. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9802)
2019-09-09drbg: ensure fork-safety without using a pthread_atfork handlerDr. Matthias St. Pierre
When the new OpenSSL CSPRNG was introduced in version 1.1.1, it was announced in the release notes that it would be fork-safe, which the old CSPRNG hadn't been. The fork-safety was implemented using a fork count, which was incremented by a pthread_atfork handler. Initially, this handler was enabled by default. Unfortunately, the default behaviour had to be changed for other reasons in commit b5319bdbd095, so the new OpenSSL CSPRNG failed to keep its promise. This commit restores the fork-safety using a different approach. It replaces the fork count by a fork id, which coincides with the process id on UNIX-like operating systems and is zero on other operating systems. It is used to detect when an automatic reseed after a fork is necessary. To prevent a future regression, it also adds a test to verify that the child reseeds after fork. CVE-2019-1549 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9802)
2019-09-09Fix build with VS2008Bernd Edlinger
crypto/rand/rand_win.c(70) : error C2065: 'BCRYPT_USE_SYSTEM_PREFERRED_RNG' : undeclared identifier Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9827) (cherry picked from commit d3a1128bc25ec8bf835c81821e1be68fba39ab4b)
2019-09-05Cleanup includes in rand_unix.cBernd Edlinger
Fixes #9757 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9761) (cherry picked from commit 41ffd2ab09d24692c71850ccd7d5ff154196fe01)
2019-09-05Remove ifndef FIPS_MODE from rand_unix.cBernd Edlinger
This will never be the case for 1.1.1 so removed. Fixes: comment 1 of #9757 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9762)
2019-08-30Fix NITs in comments and CHANGES for DEVRANDOM seeded check.Pauli
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/9734) (cherry picked from commit 46a9cc9451213039fd53f62733b2ccd04e853bb2)
2019-08-24Avoid overflowing FDSET when using select(2).Pauli
There is a problem in the rand_unix.c code when the random seed fd is greater than or equal to FD_SETSIZE and the FDSET overruns its limit and walks the stack. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/9686) (cherry picked from commit e1f8584d47a499301fba781086af6885fcf21fec)
2019-08-20Start up DEVRANDOM entropy improvement for older Linux devices.Pauli
Improve handling of low entropy at start up from /dev/urandom by waiting for a read(2) call on /dev/random to succeed. Once one such call has succeeded, a shared memory segment is created and persisted as an indicator to other processes that /dev/urandom is properly seeded. This does not fully prevent against attacks weakening the entropy source. An attacker who has control of the machine early in its boot sequence could create the shared memory segment preventing detection of low entropy conditions. However, this is no worse than the current situation. An attacker would also be capable of removing the shared memory segment and causing seeding to reoccur resulting in a denial of service attack. This is partially mitigated by keeping the shared memory alive for the duration of the process's existence. Thus, an attacker would not only need to have called call shmctl(2) with the IPC_RMID command but the system must subsequently enter a state where no instances of libcrypto exist in any process. Even one long running process will prevent this attack. The System V shared memory calls used here go back at least as far as Linux kernel 2.0. Linux kernels 4.8 and later, don't have a reliable way to detect that /dev/urandom has been properly seeded, so a failure is raised for this case (i.e. the getentropy(2) call has already failed). Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/9595) [manual merge]
2019-08-19Add a fallback definition for __NR_getrandom for x86 linuxBernd Edlinger
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9639) (cherry picked from commit 038b381ecf2a988eee4c7bb21074ed0603303bd1)
2019-08-19Add a fallback definition for __NR_getrandom for ARM linuxBernd Edlinger
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9619) (cherry picked from commit 24d932ec842bc5fdbd5e9b519cecf15a56bc74e6)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-24 05:48:10 +0000