path: root/crypto/rand/ossl_rand.c

/*
 * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdio.h>
#include <string.h>

#include "e_os.h"

#if !(defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_DSPBIOS))
# include <sys/time.h>
#endif
#if defined(OPENSSL_SYS_VXWORKS)
# include <time.h>
#endif

#include <openssl/opensslconf.h>
#include <openssl/crypto.h>
#include <openssl/rand.h>
#include <openssl/async.h>
#include <openssl/err.h>
#include <internal/thread_once.h>
#include "rand_lcl.h"

#if defined(BN_DEBUG) || defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
# define PREDICT 1
#endif

#define STATE_SIZE      1023

typedef struct ossl_rand_state_st OSSL_RAND_STATE;

struct ossl_rand_state_st {
    size_t num;
    size_t index;
    unsigned char state[STATE_SIZE + SHA_DIGEST_LENGTH];
    unsigned char md[SHA_DIGEST_LENGTH];
    long md_count[2];
};

static OSSL_RAND_STATE global_state;
static double randomness = 0;
static int initialized = 0;
static CRYPTO_RWLOCK *rand_lock = NULL;
static CRYPTO_RWLOCK *rand_tmp_lock = NULL;
static CRYPTO_ONCE ossl_rand_init = CRYPTO_ONCE_STATIC_INIT;
static CRYPTO_THREAD_LOCAL key;

/* May be set only when a thread holds rand_lock (to prevent double locking) */
static unsigned int crypto_lock_rand = 0;
/*
 * access to locking_threadid is synchronized by rand_tmp_lock;
 * valid iff crypto_lock_rand is set
 */
static CRYPTO_THREAD_ID locking_threadid;

#ifdef PREDICT
int rand_predictable = 0;
#endif

static int rand_hw_seed(EVP_MD_CTX *ctx);

static void rand_thread_cleanup(void *arg)
{
    OSSL_RAND_STATE *sp = arg;

    OPENSSL_clear_free(sp, sizeof(*sp));
}

DEFINE_RUN_ONCE_STATIC(do_ossl_rand_init)
{
    int ret = 1;

    OPENSSL_init_crypto(0, NULL);
    rand_lock = CRYPTO_THREAD_lock_new();
    ret &= rand_lock != NULL;
    rand_tmp_lock = CRYPTO_THREAD_lock_new();
    ret &= rand_tmp_lock != NULL;
    ret &= CRYPTO_THREAD_init_local(&key, rand_thread_cleanup) == 1;
    return ret;
}

RAND_METHOD *RAND_OpenSSL(void)
{
    return &openssl_rand_meth;
}

static void rand_cleanup(void)
{
    OPENSSL_cleanse(&global_state, sizeof(global_state));
    randomness = 0;
    initialized = 0;
    CRYPTO_THREAD_lock_free(rand_lock);
    CRYPTO_THREAD_lock_free(rand_tmp_lock);
}

static int rand_add(const void *buf, int num, double add)
{
    int i, j, k, st_idx;
    long md_c[2];
    unsigned char local_md[SHA_DIGEST_LENGTH];
    EVP_MD_CTX *m;
    int do_not_lock;
    int rv = 0;
    OSSL_RAND_STATE *sp = &global_state;

    if (!num)
        return 1;

#ifdef PREDICT
    if (rand_predictable)
        return 1;
#endif

    /*
     * (Based on the rand(3) manpage)
     *
     * The input is chopped up into units of 20 bytes (or less for
     * the last block).  Each of these blocks is run through the hash
     * function as follows:  The data passed to the hash function
     * is the current 'md', the same number of bytes from the 'state'
     * (the location determined by in incremented looping index) as
     * the current 'block', the new key data 'block', and 'count'
     * (which is incremented after each use).
     * The result of this is kept in 'md' and also xored into the
     * 'state' at the same locations that were used as input into the
     * hash function.
     */

    m = EVP_MD_CTX_new();
    if (m == NULL)
        goto err;

    if (!RUN_ONCE(&ossl_rand_init, do_ossl_rand_init))
        goto err;

    /* check if we already have the lock */
    if (crypto_lock_rand) {
        CRYPTO_THREAD_ID cur = CRYPTO_THREAD_get_current_id();
        CRYPTO_THREAD_read_lock(rand_tmp_lock);
        do_not_lock = CRYPTO_THREAD_compare_id(locking_threadid, cur);
        CRYPTO_THREAD_unlock(rand_tmp_lock);
    } else
        do_not_lock = 0;

    if (!do_not_lock)
        CRYPTO_THREAD_write_lock(rand_lock);
    st_idx = sp->index;

    /*
     * use our own copies of the counters so that even if a concurrent thread
     * seeds with exactly the same data and uses the same subarray there's
     * _some_ difference
     */
    md_c[0] = sp->md_count[0];
    md_c[1] = sp->md_count[1];

    memcpy(local_md, sp->md, sizeof(sp->md));

    /* sp->index <= sp->num <= STATE_SIZE */
    sp->index += num;
    if (sp->index >= STATE_SIZE) {
        sp->index %= STATE_SIZE;
        sp->num = STATE_SIZE;
    } else if (sp->num < STATE_SIZE) {
        if (sp->index > sp->num)
            sp->num = sp->index;
    }
    /* sp->index <= sp->num <= STATE_SIZE */

    /*
     * state[st_idx], ..., state[(st_idx + num - 1) % STATE_SIZE] are what we
     * will use now, but other threads may use them as well
     */

    sp->md_count[1] += (num / SHA_DIGEST_LENGTH) + (num % SHA_DIGEST_LENGTH > 0);

    if (!do_not_lock)
        CRYPTO_THREAD_unlock(rand_lock);

    for (i = 0; i < num; i += SHA_DIGEST_LENGTH) {
        j = (num - i);
        j = (j > SHA_DIGEST_LENGTH) ? SHA_DIGEST_LENGTH : j;

        if (!EVP_DigestInit_ex(m, EVP_sha1(), NULL))
            goto err;
        if (!EVP_DigestUpdate(m, local_md, SHA_DIGEST_LENGTH))
            goto err;
        k = (st_idx + j) - STATE_SIZE;
        if (k > 0) {
            if (!EVP_DigestUpdate(m, &sp->state[st_idx], j - k))
                goto err;
            if (!EVP_DigestUpdate(m, &sp->state[0], k))
                goto err;
        } else if (!EVP_DigestUpdate(m, &sp->state[st_idx], j))
            goto err;

        /* DO NOT REMOVE THE FOLLOWING CALL TO EVP_DigestUpdate()! */
        if (!EVP_DigestUpdate(m, buf, j))
            goto err;
        /*
         * We know that line may cause programs such as purify and valgrind
         * to complain about use of uninitialized data.  The problem is not,
         * it's with the caller.  Removing that line will make sure you get
         * really bad randomness and thereby other problems such as very
         * insecure keys.
         */

        if (!EVP_DigestUpdate(m, (unsigned char *)md_c, sizeof(md_c)))
            goto err;
        if (!EVP_DigestFinal_ex(m, local_md, NULL))
            goto err;
        md_c[1]++;

        buf = (const char *)buf + j;

        for (k = 0; k < j; k++) {
            /*
             * Parallel threads may interfere with this, but always each byte
             * of the new state is the XOR of some previous value of its and
             * local_md (intermediate values may be lost). Alway using locking
             * could hurt performance more than necessary given that
             * conflicts occur only when the total seeding is longer than the
             * random state.
             */
            sp->state[st_idx++] ^= local_md[k];</