X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=crypto%2Frand%2Frand_lib.c;h=a4c9e694726e749f7ce981364f192f0086d85b17;hp=489b5380c9876eeb233032e058a596badf2096c7;hb=4bffc025fd1b75b690f50552f443cbd3b1f1cbaf;hpb=9ed79d8ee1ef845fce94739787d45ad03f675eaa

diff --git a/crypto/rand/rand_lib.c b/crypto/rand/rand_lib.c
index 489b5380c9..a4c9e69472 100644
--- a/crypto/rand/rand_lib.c
+++ b/crypto/rand/rand_lib.c
@@ -1,7 +1,7 @@
 /*
- * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
@@ -11,21 +11,24 @@
 #include <time.h>
 #include "internal/cryptlib.h"
 #include <openssl/opensslconf.h>
-#include "internal/rand_int.h"
+#include "crypto/rand.h"
 #include <openssl/engine.h>
 #include "internal/thread_once.h"
-#include "rand_lcl.h"
+#include "rand_local.h"
+#include "e_os.h"
 
-#ifndef OPENSSL_NO_ENGINE
+#ifndef FIPS_MODULE
+# ifndef OPENSSL_NO_ENGINE
 /* non-NULL if default_RAND_meth is ENGINE-provided */
 static ENGINE *funct_ref;
 static CRYPTO_RWLOCK *rand_engine_lock;
-#endif
+# endif
 static CRYPTO_RWLOCK *rand_meth_lock;
 static const RAND_METHOD *default_RAND_meth;
 static CRYPTO_ONCE rand_init = CRYPTO_ONCE_STATIC_INIT;
-RAND_BYTES_BUFFER rand_bytes;
-int rand_fork_count;
+
+static int rand_inited = 0;
+#endif /* FIPS_MODULE */
 
 #ifdef OPENSSL_RAND_SEED_RDTSC
 /*
@@ -37,12 +40,15 @@ int rand_fork_count;
 # error "RDTSC enabled?  Should not be possible!"
 
 /*
+ * Acquire entropy from high-speed clock
+ *
  * Since we get some randomness from the low-order bits of the
- * high-speec clock, it can help.  But don't return a status since
- * it's not sufficient to indicate whether or not the seeding was
- * done.
+ * high-speed clock, it can help.
+ *
+ * Returns the total entropy count, if it exceeds the requested
+ * entropy count. Otherwise, returns an entropy count of 0.
  */
-void rand_read_tsc(RAND_poll_fn cb, void *arg)
+size_t rand_acquire_entropy_from_tsc(RAND_POOL *pool)
 {
     unsigned char c;
     int i;
@@ -50,221 +56,304 @@ void rand_read_tsc(RAND_poll_fn cb, void *arg)
     if ((OPENSSL_ia32cap_P[0] & (1 << 4)) != 0) {
         for (i = 0; i < TSC_READ_COUNT; i++) {
             c = (unsigned char)(OPENSSL_rdtsc() & 0xFF);
-            cb(arg, &c, 1, 0.5);
+            rand_pool_add(pool, &c, 1, 4);
         }
     }
+    return rand_pool_entropy_available(pool);
 }
 #endif
 
 #ifdef OPENSSL_RAND_SEED_RDCPU
-size_t OPENSSL_ia32_rdseed_bytes(char *buf, size_t len);
-size_t OPENSSL_ia32_rdrand_bytes(char *buf, size_t len);
+size_t OPENSSL_ia32_rdseed_bytes(unsigned char *buf, size_t len);
+size_t OPENSSL_ia32_rdrand_bytes(unsigned char *buf, size_t len);
 
-extern unsigned int OPENSSL_ia32cap_P[];
-
-int rand_read_cpu(RAND_poll_fn cb, void *arg)
+/*
+ * Acquire entropy using Intel-specific cpu instructions
+ *
+ * Uses the RDSEED instruction if available, otherwise uses
+ * RDRAND if available.
+ *
+ * For the differences between RDSEED and RDRAND, and why RDSEED
+ * is the preferred choice, see https://goo.gl/oK3KcN
+ *
+ * Returns the total entropy count, if it exceeds the requested
+ * entropy count. Otherwise, returns an entropy count of 0.
+ */
+size_t rand_acquire_entropy_from_cpu(RAND_POOL *pool)
 {
-    char buff[RANDOMNESS_NEEDED];
-
-    /* If RDSEED is available, use that. */
-    if ((OPENSSL_ia32cap_P[2] & (1 << 18)) != 0) {
-        if (OPENSSL_ia32_rdseed_bytes(buff, sizeof(buff)) == sizeof(buff)) {
-            cb(arg, buff, (int)sizeof(buff), sizeof(buff));
-            return 1;
-        }
-    }
-
-    /* Second choice is RDRAND. */
-    if ((OPENSSL_ia32cap_P[1] & (1 << (62 - 32))) != 0) {
-        if (OPENSSL_ia32_rdrand_bytes(buff, sizeof(buff)) == sizeof(buff)) {
-            cb(arg, buff, (int)sizeof(buff), sizeof(buff));
-            return 1;
+    size_t bytes_needed;
+    unsigned char *buffer;
+
+    bytes_needed = rand_pool_bytes_needed(pool, 1 /*entropy_factor*/);
+    if (bytes_needed > 0) {
+        buffer = rand_pool_add_begin(pool, bytes_needed);
+
+        if (buffer != NULL) {
+            /* Whichever comes first, use RDSEED, RDRAND or nothing */
+            if ((OPENSSL_ia32cap_P[2] & (1 << 18)) != 0) {
+                if (OPENSSL_ia32_rdseed_bytes(buffer, bytes_needed)
+                    == bytes_needed) {
+                    rand_pool_add_end(pool, bytes_needed, 8 * bytes_needed);
+                }
+            } else if ((OPENSSL_ia32cap_P[1] & (1 << (62 - 32))) != 0) {
+                if (OPENSSL_ia32_rdrand_bytes(buffer, bytes_needed)
+                    == bytes_needed) {
+                    rand_pool_add_end(pool, bytes_needed, 8 * bytes_needed);
+                }
+            } else {
+                rand_pool_add_end(pool, 0, 0);
+            }
         }
     }
 
-    return 0;
+    return rand_pool_entropy_available(pool);
 }
 #endif
 
-
+#if 0
 /*
- * DRBG has two sets of callbacks; we only discuss the "entropy" one
- * here.  When the DRBG needs additional randomness bits (called entropy
- * in the NIST document), it calls the get_entropy callback which fills in
- * a pointer and returns the number of bytes. When the DRBG is finished with
- * the buffer, it calls the cleanup_entropy callback, with the value of
- * the buffer that the get_entropy callback filled in.
+ * Implements the get_entropy() callback (see RAND_DRBG_set_callbacks())
+ *
+ * If the DRBG has a parent, then the required amount of entropy input
+ * is fetched using the parent's RAND_DRBG_generate().
  *
- * Get entropy from the system, via RAND_poll if needed.  The |entropy|
- * is the bits of randomness required, and is expected to fit into a buffer
- * of |min_len|..|max__len| size.  We assume we're getting high-quality
- * randomness from the system, and that |min_len| bytes will do.
+ * Otherwise, the entropy is polled from the system entropy sources
+ * using rand_pool_acquire_entropy().
+ *
+ * If a random pool has been added to the DRBG using RAND_add(), then
+ * its entropy will be used up first.
  */
-size_t drbg_entropy_from_system(RAND_DRBG *drbg,
-                                unsigned char **pout,
-                                int entropy, size_t min_len, size_t max_len)
+size_t rand_drbg_get_entropy(RAND_DRBG *drbg,
+                             unsigned char **pout,
+                             int entropy, size_t min_len, size_t max_len,
+                             int prediction_resistance)
 {
-    int i;
-
-
-    if (min_len > (size_t)drbg->size) {
-        /* Should not happen.  See comment near RANDOMNESS_NEEDED. */
-        min_len = drbg->size;
+    size_t ret = 0;
+    size_t entropy_available = 0;
+    RAND_POOL *pool;
+
+    if (drbg->parent != NULL && drbg->strength > drbg->parent->strength) {
+        /*
+         * We currently don't support the algorithm from NIST SP 800-90C
+         * 10.1.2 to use a weaker DRBG as source
+         */
+        RANDerr(RAND_F_RAND_DRBG_GET_ENTROPY, RAND_R_PARENT_STRENGTH_TOO_WEAK);
+        return 0;
     }
 
-    if (drbg->filled) {
-        /* Re-use what we have. */
-        *pout = drbg->randomness;
-        return drbg->size;
+    if (drbg->seed_pool != NULL) {
+        pool = drbg->seed_pool;
+        pool->entropy_requested = entropy;
+    } else {
+        pool = rand_pool_new(entropy, drbg->secure, min_len, max_len);
+        if (pool == NULL)
+            return 0;
     }
 
-    /* If we don't have enough, try to get more. */
-    CRYPTO_THREAD_write_lock(rand_bytes.lock);
-    for (i = RAND_POLL_RETRIES; rand_bytes.curr < min_len && --i >= 0; ) {
-        CRYPTO_THREAD_unlock(rand_bytes.lock);
-        RAND_poll();
-        CRYPTO_THREAD_write_lock(rand_bytes.lock);
-    }
+    if (drbg->parent != NULL) {
+        size_t bytes_needed = rand_pool_bytes_needed(pool, 1 /*entropy_factor*/);
+        unsigned char *buffer = rand_pool_add_begin(pool, bytes_needed);
+
+        if (buffer != NULL) {
+            size_t bytes = 0;
+
+            /*
+             * Get random data from parent. Include our address as additional input,
+             * in order to provide some additional distinction between different
+             * DRBG child instances.
+             * Our lock is already held, but we need to lock our parent before
+             * generating bits from it. (Note: taking the lock will be a no-op
+             * if locking if drbg->parent->lock == NULL.)
+             */
+            rand_drbg_lock(drbg->parent);
+            if (RAND_DRBG_generate(drbg->parent,
+                                   buffer, bytes_needed,
+                                   prediction_resistance,
+                                   (unsigned char *)&drbg, sizeof(drbg)) != 0)
+                bytes = bytes_needed;
+            drbg->reseed_next_counter
+                = tsan_load(&drbg->parent->reseed_prop_counter);
+            rand_drbg_unlock(drbg->parent);
+
+            rand_pool_add_end(pool, bytes, 8 * bytes);
+            entropy_available = rand_pool_entropy_available(pool);
+        }
 
-    /* Get desired amount, but no more than we have. */
-    if (min_len > rand_bytes.curr)
-        min_len = rand_bytes.curr;
-    if (min_len != 0) {
-        memcpy(drbg->randomness, rand_bytes.buff, min_len);
-        drbg->filled = 1;
-        /* Update amount left and shift it down. */
-        rand_bytes.curr -= min_len;
-        if (rand_bytes.curr != 0)
-            memmove(rand_bytes.buff, &rand_bytes.buff[min_len], rand_bytes.curr);
+    } else {
+        /* Get entropy by polling system entropy sources. */
+        entropy_available = rand_pool_acquire_entropy(pool);
     }
-    CRYPTO_THREAD_unlock(rand_bytes.lock);
-    *pout = drbg->randomness;
-    return min_len;
-}
 
-size_t drbg_entropy_from_parent(RAND_DRBG *drbg,
-                                unsigned char **pout,
-                                int entropy, size_t min_len, size_t max_len)
-{
-    int st;
-
-    if (min_len > (size_t)drbg->size) {
-        /* Should not happen.  See comment near RANDOMNESS_NEEDED. */
-        min_len = drbg->size;
+    if (entropy_available > 0) {
+        ret   = rand_pool_length(pool);
+        *pout = rand_pool_detach(pool);
     }
 
-    /* Get random from parent, include our state as additional input. */
-    st = RAND_DRBG_generate(drbg->parent, drbg->randomness, min_len, 0,
-                            (unsigned char *)drbg, sizeof(*drbg));
-    if (st == 0)
-        return 0;
-    drbg->filled = 1;
-    *pout = drbg->randomness;
-    return min_len;
+    if (drbg->seed_pool == NULL)
+        rand_pool_free(pool);
+    return ret;
 }
 
-void drbg_release_entropy(RAND_DRBG *drbg, unsigned char *out)
+/*
+ * Implements the cleanup_entropy() callback (see RAND_DRBG_set_callbacks())
+ *
+ */
+void rand_drbg_cleanup_entropy(RAND_DRBG *drbg,
+                               unsigned char *out, size_t outlen)
 {
-    drbg->filled = 0;
-    OPENSSL_cleanse(drbg->randomness, drbg->size);
+    if (drbg->seed_pool == NULL) {
+        if (drbg->secure)
+            OPENSSL_secure_clear_free(out, outlen);
+        else
+            OPENSSL_clear_free(out, outlen);
+    }
 }
 
-
 /*
- * Set up a global DRBG.
+ * Generate additional data that can be used for the drbg. The data does
+ * not need to contain entropy, but it's useful if it contains at least
+ * some bits that are unpredictable.
+ *
+ * Returns 0 on failure.
+ *
+ * On success it allocates a buffer at |*pout| and returns the length of
+ * the data. The buffer should get freed using OPENSSL_secure_clear_free().
  */
-static int setup_drbg(RAND_DRBG *drbg)
+size_t rand_drbg_get_additional_data(RAND_POOL *pool, unsigned char **pout)
 {
-    int ret = 1;
-
-    drbg->lock = CRYPTO_THREAD_lock_new();
-    ret &= drbg->lock != NULL;
-    drbg->size = RANDOMNESS_NEEDED;
-    drbg->secure = CRYPTO_secure_malloc_initialized();
-    drbg->randomness = drbg->secure
-        ? OPENSSL_secure_malloc(drbg->size)
-        : OPENSSL_malloc(drbg->size);
-    ret &= drbg->randomness != NULL;
-    /* If you change these parameters, see RANDOMNESS_NEEDED */
-    ret &= RAND_DRBG_set(drbg,
-                         NID_aes_128_ctr, RAND_DRBG_FLAG_CTR_USE_DF) == 1;
-    ret &= RAND_DRBG_set_callbacks(drbg, drbg_entropy_from_system,
-                                   drbg_release_entropy, NULL, NULL) == 1;
-    return ret;
-}
+    size_t ret = 0;
 
-static void free_drbg(RAND_DRBG *drbg)
-{
-    CRYPTO_THREAD_lock_free(drbg->lock);
-    if (drbg->secure)
-        OPENSSL_secure_clear_free(drbg->randomness, drbg->size);
-    else
-        OPENSSL_clear_free(drbg->randomness, drbg->size);
-    RAND_DRBG_uninstantiate(drbg);
+    if (rand_pool_add_additional_data(pool) == 0)
+        goto err;
+
+    ret = rand_pool_length(pool);
+    *pout = rand_pool_detach(pool);
+
+ err:
+    return ret;
 }
 
-void rand_fork()
+void rand_drbg_cleanup_additional_data(RAND_POOL *pool, unsigned char *out)
 {
-    rand_fork_count++;
+    rand_pool_reattach(pool, out);
 }
+#endif
 
+#ifndef FIPS_MODULE
 DEFINE_RUN_ONCE_STATIC(do_rand_init)
 {
-    int ret = 1;
-
-#ifndef OPENSSL_NO_ENGINE
+# ifndef OPENSSL_NO_ENGINE
     rand_engine_lock = CRYPTO_THREAD_lock_new();
-    ret &= rand_engine_lock != NULL;
-#endif
+    if (rand_engine_lock == NULL)
+        return 0;
+# endif
+
     rand_meth_lock = CRYPTO_THREAD_lock_new();
-    ret &= rand_meth_lock != NULL;
-
-    rand_bytes.lock = CRYPTO_THREAD_lock_new();
-    ret &= rand_bytes.lock != NULL;
-    rand_bytes.curr = 0;
-    rand_bytes.size = MAX_RANDOMNESS_HELD;
-    rand_bytes.secure = CRYPTO_secure_malloc_initialized();
-    rand_bytes.buff = rand_bytes.secure
-        ? OPENSSL_secure_malloc(rand_bytes.size)
-        : OPENSSL_malloc(rand_bytes.size);
-    ret &= rand_bytes.buff != NULL;
-    ret &= setup_drbg(&rand_drbg);
-    ret &= setup_drbg(&priv_drbg);
-    return ret;
+    if (rand_meth_lock == NULL)
+        goto err;
+
+    if (!rand_pool_init())
+        goto err;
+
+    rand_inited = 1;
+    return 1;
+
+ err:
+    CRYPTO_THREAD_lock_free(rand_meth_lock);
+    rand_meth_lock = NULL;
+# ifndef OPENSSL_NO_ENGINE
+    CRYPTO_THREAD_lock_free(rand_engine_lock);
+    rand_engine_lock = NULL;
+# endif
+    return 0;
 }
 
 void rand_cleanup_int(void)
 {
     const RAND_METHOD *meth = default_RAND_meth;
 
+    if (!rand_inited)
+        return;
+
     if (meth != NULL && meth->cleanup != NULL)
         meth->cleanup();
     RAND_set_rand_method(NULL);
-#ifndef OPENSSL_NO_ENGINE
+    rand_pool_cleanup();
+# ifndef OPENSSL_NO_ENGINE
     CRYPTO_THREAD_lock_free(rand_engine_lock);
-#endif
+    rand_engine_lock = NULL;
+# endif
     CRYPTO_THREAD_lock_free(rand_meth_lock);
-    CRYPTO_THREAD_lock_free(rand_bytes.lock);
-    if (rand_bytes.secure)
-        OPENSSL_secure_clear_free(rand_bytes.buff, rand_bytes.size);
-    else
-        OPENSSL_clear_free(rand_bytes.buff, rand_bytes.size);
-    free_drbg(&rand_drbg);
-    free_drbg(&priv_drbg);
+    rand_meth_lock = NULL;
+    rand_inited = 0;
 }
 
+/* TODO(3.0): Do we need to handle this somehow in the FIPS module? */
 /*
- * RAND_poll_ex() gets a function pointer to call when it has random bytes.
- * RAND_poll() sets the function pointer to be a wrapper that calls RAND_add().
+ * RAND_close_seed_files() ensures that any seed file descriptors are
+ * closed after use.
  */
-static void call_rand_add(void* arg, const void *buf, int num, double r)
+void RAND_keep_random_devices_open(int keep)
 {
-    RAND_add(buf, num, r);
+    if (RUN_ONCE(&rand_init, do_rand_init))
+        rand_pool_keep_random_devices_open(keep);
 }
 
+/*
+ * RAND_poll() reseeds the default RNG using random input
+ *
+ * The random input is obtained from polling various entropy
+ * sources which depend on the operating system and are
+ * configurable via the --with-rand-seed configure option.
+ */
 int RAND_poll(void)
 {
-    return RAND_poll_ex(call_rand_add, NULL);
+    int ret = 0;
+
+    const RAND_METHOD *meth = RAND_get_rand_method();
+
+    if (meth == NULL)
+        return 0;
+
+    if (meth == RAND_OpenSSL()) {
+        /* fill random pool and seed the master DRBG */
+        RAND_DRBG *drbg = RAND_DRBG_get0_master();
+
+        if (drbg == NULL)
+            return 0;
+
+#if 0
+        ret = rand_drbg_restart(drbg, NULL, 0, 0);
+#endif
+
+        return ret;
+
+    } else {
+        RAND_POOL *pool = NULL;
+
+        /* fill random pool and seed the current legacy RNG */
+        pool = rand_pool_new(RAND_DRBG_STRENGTH, 1,
+                             (RAND_DRBG_STRENGTH + 7) / 8,
+                             RAND_POOL_MAX_LENGTH);
+        if (pool == NULL)
+            return 0;
+#if 0
+        if (rand_pool_acquire_entropy(pool) == 0)
+            goto err;
+#endif
+        if (meth->add == NULL
+            || meth->add(rand_pool_buffer(pool),
+                         rand_pool_length(pool),
+                         (rand_pool_entropy(pool) / 8.0)) == 0)
+            goto err;
+
+        ret = 1;
+
+     err:
+        rand_pool_free(pool);
+    }
+
+    return ret;
 }
 
 int RAND_set_rand_method(const RAND_METHOD *meth)
@@ -273,17 +362,21 @@ int RAND_set_rand_method(const RAND_METHOD *meth)
         return 0;
 
     CRYPTO_THREAD_write_lock(rand_meth_lock);
-#ifndef OPENSSL_NO_ENGINE
+# ifndef OPENSSL_NO_ENGINE
     ENGINE_finish(funct_ref);
     funct_ref = NULL;
-#endif
+# endif
     default_RAND_meth = meth;
     CRYPTO_THREAD_unlock(rand_meth_lock);
     return 1;
 }
+#endif /* FIPS_MODULE */
 
 const RAND_METHOD *RAND_get_rand_method(void)
 {
+#ifdef FIPS_MODULE
+    return NULL;
+#else
     const RAND_METHOD *tmp_meth = NULL;
 
     if (!RUN_ONCE(&rand_init, do_rand_init))
@@ -291,7 +384,7 @@ const RAND_METHOD *RAND_get_rand_method(void)
 
     CRYPTO_THREAD_write_lock(rand_meth_lock);
     if (default_RAND_meth == NULL) {
-#ifndef OPENSSL_NO_ENGINE
+# ifndef OPENSSL_NO_ENGINE
         ENGINE *e;
 
         /* If we have an engine that can do RAND, use it. */
@@ -303,16 +396,17 @@ const RAND_METHOD *RAND_get_rand_method(void)
             ENGINE_finish(e);
             default_RAND_meth = &rand_meth;
         }
-#else
+# else
         default_RAND_meth = &rand_meth;
-#endif
+# endif
     }
     tmp_meth = default_RAND_meth;
     CRYPTO_THREAD_unlock(rand_meth_lock);
     return tmp_meth;
+#endif
 }
 
-#ifndef OPENSSL_NO_ENGINE
+#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
 int RAND_set_rand_engine(ENGINE *engine)
 {
     const RAND_METHOD *tmp_meth = NULL;
@@ -342,7 +436,7 @@ void RAND_seed(const void *buf, int num)
 {
     const RAND_METHOD *meth = RAND_get_rand_method();
 
-    if (meth->seed != NULL)
+    if (meth != NULL && meth->seed != NULL)
         meth->seed(buf, num);
 }
 
@@ -350,7 +444,7 @@ void RAND_add(const void *buf, int num, double randomness)
 {
     const RAND_METHOD *meth = RAND_get_rand_method();
 
-    if (meth->add != NULL)
+    if (meth != NULL && meth->add != NULL)
         meth->add(buf, num, randomness);
 }
 
@@ -359,37 +453,62 @@ void RAND_add(const void *buf, int num, double randomness)
  * the default method, then just call RAND_bytes().  Otherwise make
  * sure we're instantiated and use the private DRBG.
  */
-int RAND_priv_bytes(unsigned char *buf, int num)
+int RAND_priv_bytes_ex(OPENSSL_CTX *ctx, unsigned char *buf, int num)
 {
+    RAND_DRBG *drbg;
     const RAND_METHOD *meth = RAND_get_rand_method();
 
-    if (meth != RAND_OpenSSL())
-        return RAND_bytes(buf, num);
+    if (meth != NULL && meth != RAND_OpenSSL()) {
+        if (meth->bytes != NULL)
+            return meth->bytes(buf, num);
+        RANDerr(RAND_F_RAND_PRIV_BYTES_EX, RAND_R_FUNC_NOT_IMPLEMENTED);
+        return -1;
+    }
 
-    if (priv_drbg.state == DRBG_UNINITIALISED
-            && RAND_DRBG_instantiate(&priv_drbg, NULL, 0) == 0)
-        return 0;
-    return RAND_DRBG_generate(&priv_drbg, buf, num, 0, NULL, 0);
+    drbg = OPENSSL_CTX_get0_private_drbg(ctx);
+    if (drbg != NULL)
+        return RAND_DRBG_bytes(drbg, buf, num);
 
+    return 0;
 }
 
-int RAND_bytes(unsigned char *buf, int num)
+int RAND_priv_bytes(unsigned char *buf, int num)
 {
+    return RAND_priv_bytes_ex(NULL, buf, num);
+}
+
+int RAND_bytes_ex(OPENSSL_CTX *ctx, unsigned char *buf, int num)
+{
+    RAND_DRBG *drbg;
     const RAND_METHOD *meth = RAND_get_rand_method();
 
-    if (meth->bytes != NULL)
-        return meth->bytes(buf, num);
-    RANDerr(RAND_F_RAND_BYTES, RAND_R_FUNC_NOT_IMPLEMENTED);
-    return -1;
+    if (meth != NULL && meth != RAND_OpenSSL()) {
+        if (meth->bytes != NULL)
+            return meth->bytes(buf, num);
+        RANDerr(RAND_F_RAND_BYTES_EX, RAND_R_FUNC_NOT_IMPLEMENTED);
+        return -1;
+    }
+
+    drbg = OPENSSL_CTX_get0_public_drbg(ctx);
+    if (drbg != NULL)
+        return RAND_DRBG_bytes(drbg, buf, num);
+
+    return 0;
+}
+
+int RAND_bytes(unsigned char *buf, int num)
+{
+    return RAND_bytes_ex(NULL, buf, num);
 }
 
-#if OPENSSL_API_COMPAT < 0x10100000L
+#if !defined(OPENSSL_NO_DEPRECATED_1_1_0) && !defined(FIPS_MODULE)
 int RAND_pseudo_bytes(unsigned char *buf, int num)
 {
     const RAND_METHOD *meth = RAND_get_rand_method();
 
-    if (meth->pseudorand != NULL)
+    if (meth != NULL && meth->pseudorand != NULL)
         return meth->pseudorand(buf, num);
+    RANDerr(RAND_F_RAND_PSEUDO_BYTES, RAND_R_FUNC_NOT_IMPLEMENTED);
     return -1;
 }
 #endif
@@ -398,7 +517,7 @@ int RAND_status(void)
 {
     const RAND_METHOD *meth = RAND_get_rand_method();
 
-    if (meth->status != NULL)
+    if (meth != NULL && meth->status != NULL)
         return meth->status();
     return 0;
 }