test/drbgtest.c

   1 /*
   2  * Copyright 2011-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 /*
  11  * RAND_DRBG_set is deprecated for public use, but still ok for
  12  * internal use.
  13  */
  14 #include "internal/deprecated.h"
  15
  16 #include <string.h>
  17 #include "internal/nelem.h"
  18 #include <openssl/crypto.h>
  19 #include <openssl/err.h>
  20 #include <openssl/rand.h>
  21 #include <openssl/obj_mac.h>
  22 #include <openssl/evp.h>
  23 #include <openssl/aes.h>
  24 #include "../crypto/rand/rand_local.h"
  25 #include "../include/crypto/rand.h"
  26 #include "../providers/implementations/rands/drbg_local.h"
  27 #include "../crypto/evp/evp_local.h"
  28
  29 #if defined(_WIN32)
  30 # include <windows.h>
  31 #endif
  32
  33
  34 #if defined(OPENSSL_SYS_UNIX)
  35 # include <sys/types.h>
  36 # include <sys/wait.h>
  37 # include <unistd.h>
  38 #endif
  39
  40 #include "testutil.h"
  41 #include "drbgtest.h"
  42
  43 typedef struct drbg_selftest_data_st {
  44     int post;
  45     int nid;
  46     unsigned int flags;
  47
  48     /* KAT data for no PR */
  49     const unsigned char *entropy;
  50     size_t entropylen;
  51     const unsigned char *nonce;
  52     size_t noncelen;
  53     const unsigned char *pers;
  54     size_t perslen;
  55     const unsigned char *adin;
  56     size_t adinlen;
  57     const unsigned char *entropyreseed;
  58     size_t entropyreseedlen;
  59     const unsigned char *adinreseed;
  60     size_t adinreseedlen;
  61     const unsigned char *adin2;
  62     size_t adin2len;
  63     const unsigned char *expected;
  64     size_t exlen;
  65     const unsigned char *kat2;
  66     size_t kat2len;
  67
  68     /* KAT data for PR */
  69     const unsigned char *entropy_pr;
  70     size_t entropylen_pr;
  71     const unsigned char *nonce_pr;
  72     size_t noncelen_pr;
  73     const unsigned char *pers_pr;
  74     size_t perslen_pr;
  75     const unsigned char *adin_pr;
  76     size_t adinlen_pr;
  77     const unsigned char *entropypr_pr;
  78     size_t entropyprlen_pr;
  79     const unsigned char *ading_pr;
  80     size_t adinglen_pr;
  81     const unsigned char *entropyg_pr;
  82     size_t entropyglen_pr;
  83     const unsigned char *kat_pr;
  84     size_t katlen_pr;
  85     const unsigned char *kat2_pr;
  86     size_t kat2len_pr;
  87 } DRBG_SELFTEST_DATA;
  88
  89 #define make_drbg_test_data(nid, flag, pr, post) {\
  90     post, nid, flag, \
  91     pr##_entropyinput, sizeof(pr##_entropyinput), \
  92     pr##_nonce, sizeof(pr##_nonce), \
  93     pr##_personalizationstring, sizeof(pr##_personalizationstring), \
  94     pr##_additionalinput, sizeof(pr##_additionalinput), \
  95     pr##_entropyinputreseed, sizeof(pr##_entropyinputreseed), \
  96     pr##_additionalinputreseed, sizeof(pr##_additionalinputreseed), \
  97     pr##_additionalinput2, sizeof(pr##_additionalinput2), \
  98     pr##_int_returnedbits, sizeof(pr##_int_returnedbits), \
  99     pr##_returnedbits, sizeof(pr##_returnedbits), \
 100     pr##_pr_entropyinput, sizeof(pr##_pr_entropyinput), \
 101     pr##_pr_nonce, sizeof(pr##_pr_nonce), \
 102     pr##_pr_personalizationstring, sizeof(pr##_pr_personalizationstring), \
 103     pr##_pr_additionalinput, sizeof(pr##_pr_additionalinput), \
 104     pr##_pr_entropyinputpr, sizeof(pr##_pr_entropyinputpr), \
 105     pr##_pr_additionalinput2, sizeof(pr##_pr_additionalinput2), \
 106     pr##_pr_entropyinputpr2, sizeof(pr##_pr_entropyinputpr2), \
 107     pr##_pr_int_returnedbits, sizeof(pr##_pr_int_returnedbits), \
 108     pr##_pr_returnedbits, sizeof(pr##_pr_returnedbits) \
 109     }
 110
 111 #define make_drbg_test_data_use_df(nid, pr, p) \
 112     make_drbg_test_data(nid, 0, pr, p)
 113
 114 #define make_drbg_test_data_no_df(nid, pr, p)                      \
 115     make_drbg_test_data(nid, RAND_DRBG_FLAG_CTR_NO_DF, pr, p)
 116
 117 #define make_drbg_test_data_hash(nid, pr, p) \
 118     make_drbg_test_data(nid, RAND_DRBG_FLAG_HMAC, hmac_##pr, p), \
 119     make_drbg_test_data(nid, 0, pr, p)
 120
 121 static DRBG_SELFTEST_DATA drbg_test[] = {
 122 #ifndef FIPS_MODULE
 123     /* FIPS mode doesn't support CTR DRBG without a derivation function */
 124     make_drbg_test_data_no_df (NID_aes_128_ctr, aes_128_no_df,  0),
 125     make_drbg_test_data_no_df (NID_aes_192_ctr, aes_192_no_df,  0),
 126     make_drbg_test_data_no_df (NID_aes_256_ctr, aes_256_no_df,  1),
 127 #endif
 128     make_drbg_test_data_use_df(NID_aes_128_ctr, aes_128_use_df, 0),
 129     make_drbg_test_data_use_df(NID_aes_192_ctr, aes_192_use_df, 0),
 130     make_drbg_test_data_use_df(NID_aes_256_ctr, aes_256_use_df, 1),
 131     make_drbg_test_data_hash(NID_sha1, sha1, 0),
 132     make_drbg_test_data_hash(NID_sha224, sha224, 0),
 133     make_drbg_test_data_hash(NID_sha256, sha256, 1),
 134     make_drbg_test_data_hash(NID_sha384, sha384, 0),
 135     make_drbg_test_data_hash(NID_sha512, sha512, 0),
 136 };
 137
 138 /*
 139  * DRBG query functions
 140  */
 141 static int state(RAND_DRBG *drbg)
 142 {
 143     return EVP_RAND_state(drbg->rand);
 144 }
 145
 146 static size_t query_rand_size_t(RAND_DRBG *drbg, const char *name)
 147 {
 148     OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
 149     size_t n;
 150
 151     *params = OSSL_PARAM_construct_size_t(name, &n);
 152     if (EVP_RAND_get_ctx_params(drbg->rand, params))
 153         return n;
 154     return 0;
 155 }
 156
 157 static unsigned int query_rand_uint(RAND_DRBG *drbg, const char *name)
 158 {
 159     OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
 160     unsigned int n;
 161
 162     *params = OSSL_PARAM_construct_uint(name, &n);
 163     if (EVP_RAND_get_ctx_params(drbg->rand, params))
 164         return n;
 165     return 0;
 166 }
 167
 168 #define DRBG_SIZE_T(name)                               \
 169     static size_t name(RAND_DRBG *drbg)                 \
 170     {                                                   \
 171         return query_rand_size_t(drbg, #name);          \
 172     }
 173 DRBG_SIZE_T(min_entropylen)
 174 DRBG_SIZE_T(max_entropylen)
 175 DRBG_SIZE_T(min_noncelen)
 176 DRBG_SIZE_T(max_noncelen)
 177 DRBG_SIZE_T(max_perslen)
 178 DRBG_SIZE_T(max_adinlen)
 179 DRBG_SIZE_T(max_request)
 180
 181 #define DRBG_UINT(name)                                 \
 182     static unsigned int name(RAND_DRBG *drbg)           \
 183     {                                                   \
 184         return query_rand_uint(drbg, #name);            \
 185     }
 186 DRBG_UINT(reseed_requests)
 187 DRBG_UINT(reseed_counter)
 188
 189 static PROV_DRBG *prov_rand(RAND_DRBG *drbg)
 190 {
 191     return (PROV_DRBG *)drbg->rand->data;
 192 }
 193
 194 static void set_reseed_counter(RAND_DRBG *drbg, unsigned int n)
 195 {
 196     PROV_DRBG *p = prov_rand(drbg);
 197
 198     p->reseed_counter = n;
 199 }
 200
 201 static void inc_reseed_counter(RAND_DRBG *drbg)
 202 {
 203     set_reseed_counter(drbg, reseed_counter(drbg) + 1);
 204 }
 205
 206 static time_t reseed_time(RAND_DRBG *drbg)
 207 {
 208     OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
 209     time_t t;
 210
 211     *params = OSSL_PARAM_construct_time_t(OSSL_DRBG_PARAM_RESEED_TIME, &t);
 212     if (EVP_RAND_get_ctx_params(drbg->rand, params))
 213         return t;
 214     return 0;
 215 }
 216
 217 /*
 218  * Test context data, attached as EXDATA to the RAND_DRBG
 219  */
 220 typedef struct test_ctx_st {
 221     const unsigned char *entropy;
 222     size_t entropylen;
 223     int entropycnt;
 224     const unsigned char *nonce;
 225     size_t noncelen;
 226     int noncecnt;
 227 } TEST_CTX;
 228
 229 static size_t kat_entropy(RAND_DRBG *drbg, unsigned char **pout,
 230                           int entropy, size_t min_len, size_t max_len,
 231                           int prediction_resistance)
 232 {
 233     TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_callback_data(drbg);
 234
 235     t->entropycnt++;
 236     *pout = (unsigned char *)t->entropy;
 237     return t->entropylen;
 238 }
 239
 240 static size_t kat_nonce(RAND_DRBG *drbg, unsigned char **pout,
 241                         int entropy, size_t min_len, size_t max_len)
 242 {
 243     TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_callback_data(drbg);
 244
 245     t->noncecnt++;
 246     *pout = (unsigned char *)t->nonce;
 247     return t->noncelen;
 248 }
 249
 250 /*
 251  * When building the FIPS module, it isn't possible to disable the continuous
 252  * RNG tests.  Tests that require this are skipped.
 253  */
 254 static int crngt_skip(void)
 255 {
 256 #ifdef FIPS_MODULE
 257     return 1;
 258 #else
 259     return 0;
 260 #endif
 261 }
 262
 263  /*
 264  * Disable CRNG testing if it is enabled.
 265  * This stub remains to indicate the calling locations where it is necessary.
 266  * Once the RNG infrastructure is able to disable these tests, it should be
 267  * reconstituted.
 268  */
 269 static int disable_crngt(RAND_DRBG *drbg)
 270 {
 271     return 1;
 272 }
 273
 274 static int uninstantiate(RAND_DRBG *drbg)
 275 {
 276     int ret = drbg == NULL ? 1 : RAND_DRBG_uninstantiate(drbg);
 277
 278     ERR_clear_error();
 279     return ret;
 280 }
 281
 282 /*
 283  * Do a single KAT test.  Return 0 on failure.
 284  */
 285 static int single_kat(DRBG_SELFTEST_DATA *td)
 286 {
 287     RAND_DRBG *drbg = NULL;
 288     TEST_CTX t;
 289     int failures = 0;
 290     unsigned char buff[1024];
 291
 292     if (crngt_skip())
 293         return TEST_skip("CRNGT cannot be disabled");
 294
 295     /*
 296      * Test without PR: Instantiate DRBG with test entropy, nonce and
 297      * personalisation string.
 298      */
 299     if (!TEST_ptr(drbg = RAND_DRBG_new(td->nid, td->flags, NULL)))
 300         return 0;
 301     if (!TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
 302                                            kat_nonce, NULL))
 303         || !TEST_true(RAND_DRBG_set_callback_data(drbg, &t))
 304         || !TEST_true(disable_crngt(drbg))) {
 305         failures++;
 306         goto err;
 307     }
 308     memset(&t, 0, sizeof(t));
 309     t.entropy = td->entropy;
 310     t.entropylen = td->entropylen;
 311     t.nonce = td->nonce;
 312     t.noncelen = td->noncelen;
 313
 314     if (!TEST_true(RAND_DRBG_instantiate(drbg, td->pers, td->perslen))
 315             || !TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
 316                                              td->adin, td->adinlen))
 317             || !TEST_mem_eq(td->expected, td->exlen, buff, td->exlen))
 318         failures++;
 319
 320     /* Reseed DRBG with test entropy and additional input */
 321     t.entropy = td->entropyreseed;
 322     t.entropylen = td->entropyreseedlen;
 323     if (!TEST_true(RAND_DRBG_reseed(drbg, td->adinreseed, td->adinreseedlen, 0)
 324             || !TEST_true(RAND_DRBG_generate(drbg, buff, td->kat2len, 0,
 325                                              td->adin2, td->adin2len))
 326             || !TEST_mem_eq(td->kat2, td->kat2len, buff, td->kat2len)))
 327         failures++;
 328     uninstantiate(drbg);
 329
 330     /*
 331      * Now test with PR: Instantiate DRBG with test entropy, nonce and
 332      * personalisation string.
 333      */
 334     if (!TEST_true(RAND_DRBG_set(drbg, td->nid, td->flags))
 335             || !TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
 336                                                   kat_nonce, NULL))
 337             || !TEST_true(RAND_DRBG_set_callback_data(drbg, &t)))
 338         failures++;
 339     t.entropy = td->entropy_pr;
 340     t.entropylen = td->entropylen_pr;
 341     t.nonce = td->nonce_pr;
 342     t.noncelen = td->noncelen_pr;
 343     t.entropycnt = 0;
 344     t.noncecnt = 0;
 345     if (!TEST_true(RAND_DRBG_instantiate(drbg, td->pers_pr, td->perslen_pr)))
 346         failures++;
 347
 348     /*
 349      * Now generate with PR: we need to supply entropy as this will
 350      * perform a reseed operation.
 351      */
 352     t.entropy = td->entropypr_pr;
 353     t.entropylen = td->entropyprlen_pr;
 354     if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->katlen_pr, 1,
 355                                       td->adin_pr, td->adinlen_pr))
 356             || !TEST_mem_eq(td->kat_pr, td->katlen_pr, buff, td->katlen_pr))
 357         failures++;
 358
 359     /*
 360      * Now generate again with PR: supply new entropy again.
 361      */
 362     t.entropy = td->entropyg_pr;
 363     t.entropylen = td->entropyglen_pr;
 364
 365     if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->kat2len_pr, 1,
 366                                       td->ading_pr, td->adinglen_pr))
 367                 || !TEST_mem_eq(td->kat2_pr, td->kat2len_pr,
 368                                 buff, td->kat2len_pr))
 369         failures++;
 370
 371 err:
 372     uninstantiate(drbg);
 373     RAND_DRBG_free(drbg);
 374     return failures == 0;
 375 }
 376
 377 /*
 378  * Initialise a DRBG based on selftest data
 379  */
 380 static int init(RAND_DRBG *drbg, DRBG_SELFTEST_DATA *td, TEST_CTX *t)
 381 {
 382     if (!TEST_true(RAND_DRBG_set(drbg, td->nid, td->flags))
 383             || !TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
 384                                                   kat_nonce, NULL)))
 385         return 0;
 386     RAND_DRBG_set_callback_data(drbg, t);
 387     t->entropy = td->entropy;
 388     t->entropylen = td->entropylen;
 389     t->nonce = td->nonce;
 390     t->noncelen = td->noncelen;
 391     t->entropycnt = 0;
 392     t->noncecnt = 0;
 393     return 1;
 394 }
 395
 396 /*
 397  * Initialise and instantiate DRBG based on selftest data
 398  */
 399 static int instantiate(RAND_DRBG *drbg, DRBG_SELFTEST_DATA *td,
 400                        TEST_CTX *t)
 401 {
 402     if (!TEST_true(init(drbg, td, t))
 403             || !TEST_true(RAND_DRBG_instantiate(drbg, td->pers, td->perslen)))
 404         return 0;
 405     return 1;
 406 }
 407
 408 /*
 409  * Perform extensive error checking as required by SP800-90.
 410  * Induce several failure modes and check an error condition is set.
 411  */
 412 static int error_check(DRBG_SELFTEST_DATA *td)
 413 {
 414     RAND_DRBG *drbg = NULL;
 415     TEST_CTX t;
 416     unsigned char buff[1024];
 417     unsigned int reseed_counter_tmp;
 418     int ret = 0;
 419
 420     if (!TEST_ptr(drbg = RAND_DRBG_new(td->nid, td->flags, NULL))
 421         || !TEST_true(disable_crngt(drbg)))
 422         goto err;
 423
 424     /*
 425      * Personalisation string tests
 426      */
 427
 428     /* Test detection of too large personalisation string */
 429     if (!init(drbg, td, &t)
 430             || RAND_DRBG_instantiate(drbg, td->pers, max_perslen(drbg) + 1) > 0)
 431         goto err;
 432
 433     /*
 434      * Entropy source tests
 435      */
 436
 437     /* Test entropy source failure detection: i.e. returns no data */
 438     t.entropylen = 0;
 439     if (TEST_int_le(RAND_DRBG_instantiate(drbg, td->pers, td->perslen), 0))
 440         goto err;
 441
 442     /* Try to generate output from uninstantiated DRBG */
 443     if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
 444                                        td->adin, td->adinlen))
 445             || !uninstantiate(drbg))
 446         goto err;
 447
 448     /* Test insufficient entropy */
 449     t.entropylen = min_entropylen(drbg) - 1;
 450     if (!init(drbg, td, &t)
 451             || RAND_DRBG_instantiate(drbg, td->pers, td->perslen) > 0
 452             || !uninstantiate(drbg))
 453         goto err;
 454
 455     /* Test too much entropy */
 456     t.entropylen = max_entropylen(drbg) + 1;
 457     if (!init(drbg, td, &t)
 458             || RAND_DRBG_instantiate(drbg, td->pers, td->perslen) > 0
 459             || !uninstantiate(drbg))
 460         goto err;
 461
 462     /*
 463      * Nonce tests
 464      */
 465
 466     /* Test too small nonce */
 467     if (min_noncelen(drbg) != 0) {
 468         t.noncelen = min_noncelen(drbg) - 1;
 469         if (!init(drbg, td, &t)
 470                 || RAND_DRBG_instantiate(drbg, td->pers, td->perslen) > 0
 471                 || !uninstantiate(drbg))
 472             goto err;
 473     }
 474
 475     /* Test too large nonce */
 476     if (max_noncelen(drbg) != 0) {
 477         t.noncelen = max_noncelen(drbg) + 1;
 478         if (!init(drbg, td, &t)
 479                 || RAND_DRBG_instantiate(drbg, td->pers, td->perslen) > 0
 480                 || !uninstantiate(drbg))
 481             goto err;
 482     }
 483
 484     /* Instantiate with valid data, Check generation is now OK */
 485     if (!instantiate(drbg, td, &t)
 486             || !TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
 487                                              td->adin, td->adinlen)))
 488         goto err;
 489
 490     /* Request too much data for one request */
 491     if (!TEST_false(RAND_DRBG_generate(drbg, buff, max_request(drbg) + 1, 0,
 492                                        td->adin, td->adinlen)))
 493         goto err;
 494
 495     /* Try too large additional input */
 496     if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
 497                                        td->adin, max_adinlen(drbg) + 1)))
 498         goto err;
 499
 500     /*
 501      * Check prediction resistance request fails if entropy source
 502      * failure.
 503      */
 504     t.entropylen = 0;
 505     if (TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 1,
 506                                       td->adin, td->adinlen))
 507             || !uninstantiate(drbg))
 508         goto err;
 509
 510     /* Instantiate again with valid data */
 511     if (!instantiate(drbg, td, &t))
 512         goto err;
 513     reseed_counter_tmp = reseed_counter(drbg);
 514     set_reseed_counter(drbg, reseed_requests(drbg));
 515
 516     /* Generate output and check entropy has been requested for reseed */
 517     t.entropycnt = 0;
 518     if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
 519                                       td->adin, td->adinlen))
 520             || !TEST_int_eq(t.entropycnt, 1)
 521             || !TEST_int_eq(reseed_counter(drbg), reseed_counter_tmp + 1)
 522             || !uninstantiate(drbg))
 523         goto err;
 524
 525     /*
 526      * Check prediction resistance request fails if entropy source
 527      * failure.
 528      */
 529     t.entropylen = 0;
 530     if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 1,
 531                                        td->adin, td->adinlen))
 532             || !uninstantiate(drbg))
 533         goto err;
 534
 535     /* Test reseed counter works */
 536     if (!instantiate(drbg, td, &t))
 537         goto err;
 538     reseed_counter_tmp = reseed_counter(drbg);
 539     set_reseed_counter(drbg, reseed_requests(drbg));
 540
 541     /* Generate output and check entropy has been requested for reseed */
 542     t.entropycnt = 0;
 543     if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
 544                                       td->adin, td->adinlen))
 545             || !TEST_int_eq(t.entropycnt, 1)
 546             || !TEST_int_eq(reseed_counter(drbg), reseed_counter_tmp + 1)
 547             || !uninstantiate(drbg))
 548         goto err;
 549
 550     /*
 551      * Explicit reseed tests
 552      */
 553
 554     /* Test explicit reseed with too large additional input */
 555     if (!instantiate(drbg, td, &t)
 556             || RAND_DRBG_reseed(drbg, td->adin, max_adinlen(drbg) + 1, 0) > 0)
 557         goto err;
 558
 559     /* Test explicit reseed with entropy source failure */
 560     t.entropylen = 0;
 561     if (!TEST_int_le(RAND_DRBG_reseed(drbg, td->adin, td->adinlen, 0), 0)
 562             || !uninstantiate(drbg))
 563         goto err;
 564
 565     /* Test explicit reseed with too much entropy */
 566     if (!instantiate(drbg, td, &t))
 567         goto err;
 568     t.entropylen = max_entropylen(drbg) + 1;
 569     if (!TEST_int_le(RAND_DRBG_reseed(drbg, td->adin, td->adinlen, 0), 0)
 570             || !uninstantiate(drbg))
 571         goto err;
 572
 573     /* Test explicit reseed with too little entropy */
 574     if (!instantiate(drbg, td, &t))
 575         goto err;
 576     t.entropylen = min_entropylen(drbg) - 1;
 577     if (!TEST_int_le(RAND_DRBG_reseed(drbg, td->adin, td->adinlen, 0), 0)
 578             || !uninstantiate(drbg))
 579         goto err;
 580
 581     /* Standard says we have to check uninstantiate really zeroes */
 582     if (!TEST_true(EVP_RAND_verify_zeroization(drbg->rand)))
 583         goto err;
 584
 585     ret = 1;
 586
 587 err:
 588     uninstantiate(drbg);
 589     RAND_DRBG_free(drbg);
 590     return ret;
 591 }
 592
 593 static int test_kats(int i)
 594 {
 595     DRBG_SELFTEST_DATA *td = &drbg_test[i];
 596     int rv = 0;
 597
 598     if (!single_kat(td))
 599         goto err;
 600     rv = 1;
 601
 602 err:
 603     return rv;
 604 }
 605
 606 static int test_error_checks(int i)
 607 {
 608     DRBG_SELFTEST_DATA *td = &drbg_test[i];
 609     int rv = 0;
 610
 611     if (crngt_skip())
 612         return TEST_skip("CRNGT cannot be disabled");
 613
 614     if (error_check(td))
 615         goto err;
 616     rv = 1;
 617
 618 err:
 619     return rv;
 620 }
 621
 622 /*
 623  * Generates random output using RAND_bytes() and RAND_priv_bytes()
 624  * and checks whether the three shared DRBGs were reseeded as
 625  * expected.
 626  *
 627  * |expect_success|: expected outcome (as reported by RAND_status())
 628  * |master|, |public|, |private|: pointers to the three shared DRBGs
 629  * |expect_xxx_reseed| =
 630  *       1:  it is expected that the specified DRBG is reseeded
 631  *       0:  it is expected that the specified DRBG is not reseeded
 632  *      -1:  don't check whether the specified DRBG was reseeded or not
 633  * |reseed_time|: if nonzero, used instead of time(NULL) to set the
 634  *                |before_reseed| time.
 635  */
 636 static int test_drbg_reseed(int expect_success,
 637                             RAND_DRBG *master,
 638                             RAND_DRBG *public,
 639                             RAND_DRBG *private,
 640                             int expect_master_reseed,
 641                             int expect_public_reseed,
 642                             int expect_private_reseed,
 643                             time_t reseed_when
 644                            )
 645 {
 646     unsigned char buf[32];
 647     time_t before_reseed, after_reseed;
 648     int expected_state = (expect_success ? DRBG_READY : DRBG_ERROR);
 649     unsigned int master_reseed, public_reseed, private_reseed;
 650
 651     /*
 652      * step 1: check preconditions
 653      */
 654
 655     /* Test whether seed propagation is enabled */
 656     if (!TEST_int_ne(master_reseed = reseed_counter(master), 0)
 657         || !TEST_int_ne(public_reseed = reseed_counter(public), 0)
 658         || !TEST_int_ne(private_reseed = reseed_counter(private), 0))
 659         return 0;
 660
 661     /*
 662      * step 2: generate random output
 663      */
 664
 665     if (reseed_when == 0)
 666         reseed_when = time(NULL);
 667
 668     /* Generate random output from the public and private DRBG */
 669     before_reseed = expect_master_reseed == 1 ? reseed_when : 0;
 670     if (!TEST_int_eq(RAND_bytes(buf, sizeof(buf)), expect_success)
 671         || !TEST_int_eq(RAND_priv_bytes(buf, sizeof(buf)), expect_success))
 672         return 0;
 673     after_reseed = time(NULL);
 674
 675
 676     /*
 677      * step 3: check postconditions
 678      */
 679
 680     /* Test whether reseeding succeeded as expected */
 681     if (/*!TEST_int_eq(state(master), expected_state)
 682         || */!TEST_int_eq(state(public), expected_state)
 683         || !TEST_int_eq(state(private), expected_state))
 684         return 0;
 685
 686     if (expect_master_reseed >= 0) {
 687         /* Test whether master DRBG was reseeded as expected */
 688         if (!TEST_int_ge(reseed_counter(master), master_reseed))
 689             return 0;
 690     }
 691
 692     if (expect_public_reseed >= 0) {
 693         /* Test whether public DRBG was reseeded as expected */
 694         if (!TEST_int_ge(reseed_counter(public), public_reseed)
 695                 || !TEST_uint_ge(reseed_counter(public),
 696                                  reseed_counter(master)))
 697             return 0;
 698     }
 699
 700     if (expect_private_reseed >= 0) {
 701         /* Test whether public DRBG was reseeded as expected */
 702         if (!TEST_int_ge(reseed_counter(private), private_reseed)
 703                 || !TEST_uint_ge(reseed_counter(private),
 704                                  reseed_counter(master)))
 705             return 0;
 706     }
 707
 708     if (expect_success == 1) {
 709         /* Test whether reseed time of master DRBG is set correctly */
 710         if (!TEST_time_t_le(before_reseed, reseed_time(master))
 711             || !TEST_time_t_le(reseed_time(master), after_reseed))
 712             return 0;
 713
 714         /* Test whether reseed times of child DRBGs are synchronized with master */
 715         if (!TEST_time_t_ge(reseed_time(public), reseed_time(master))
 716             || !TEST_time_t_ge(reseed_time(private), reseed_time(master)))
 717             return 0;
 718     } else {
 719         ERR_clear_error();
 720     }
 721
 722     return 1;
 723 }
 724
 725
 726 #if defined(OPENSSL_SYS_UNIX)
 727 /*
 728  * Test whether master, public and private DRBG are reseeded after
 729  * forking the process.
 730  */
 731 static int test_drbg_reseed_after_fork(RAND_DRBG *master,
 732                                        RAND_DRBG *public,
 733                                        RAND_DRBG *private)
 734 {
 735     pid_t pid;
 736     int status=0;
 737
 738     pid = fork();
 739     if (!TEST_int_ge(pid, 0))
 740         return 0;
 741
 742     if (pid > 0) {
 743         /* I'm the parent; wait for the child and check its exit code */
 744         return TEST_int_eq(waitpid(pid, &status, 0), pid) && TEST_int_eq(status, 0);
 745     }
 746
 747     /* I'm the child; check whether all three DRBGs reseed. */
 748     if (!TEST_true(test_drbg_reseed(1, master, public, private, 1, 1, 1, 0)))
 749         status = 1;
 750     exit(status);
 751 }
 752 #endif
 753
 754 /*
 755  * Test whether the default rand_method (RAND_OpenSSL()) is
 756  * setup correctly, in particular whether reseeding  works
 757  * as designed.
 758  */
 759 static int test_rand_drbg_reseed(void)
 760 {
 761     RAND_DRBG *master, *public, *private;
 762     unsigned char rand_add_buf[256];
 763     int rv = 0;
 764     time_t before_reseed;
 765
 766     if (crngt_skip())
 767         return TEST_skip("CRNGT cannot be disabled");
 768
 769     /* Check whether RAND_OpenSSL() is the default method */
 770     if (!TEST_ptr_eq(RAND_get_rand_method(), RAND_OpenSSL()))
 771         return 0;
 772
 773     /* All three DRBGs should be non-null */
 774     if (!TEST_ptr(master = RAND_DRBG_get0_master())
 775         || !TEST_ptr(public = RAND_DRBG_get0_public())
 776         || !TEST_ptr(private = RAND_DRBG_get0_private()))
 777         return 0;
 778
 779     /* There should be three distinct DRBGs, two of them chained to master */
 780     if (!TEST_ptr_ne(public, private)
 781         || !TEST_ptr_ne(public, master)
 782         || !TEST_ptr_ne(private, master)
 783         || !TEST_ptr_eq(public->parent, master)
 784         || !TEST_ptr_eq(private->parent, master))
 785         return 0;
 786
 787     /* Disable CRNG testing for the master DRBG */
 788     if (!TEST_true(disable_crngt(master)))
 789         return 0;
 790
 791     /* uninstantiate the three global DRBGs */
 792     RAND_DRBG_uninstantiate(master);
 793     RAND_DRBG_uninstantiate(private);
 794     RAND_DRBG_uninstantiate(public);
 795
 796
 797     /*
 798      * Test initial seeding of shared DRBGs
 799      */
 800     if (!TEST_true(test_drbg_reseed(1, master, public, private, 1, 1, 1, 0)))
 801         goto error;
 802
 803
 804     /*
 805      * Test initial state of shared DRBGs
 806      */
 807     if (!TEST_true(test_drbg_reseed(1, master, public, private, 0, 0, 0, 0)))
 808         goto error;
 809
 810     /*
 811      * Test whether the public and private DRBG are both reseeded when their
 812      * reseed counters differ from the master's reseed counter.
 813      */
 814     inc_reseed_counter(master);
 815     if (!TEST_true(test_drbg_reseed(1, master, public, private, 0, 1, 1, 0)))
 816         goto error;
 817
 818     /*
 819      * Test whether the public DRBG is reseeded when its reseed counter differs
 820      * from the master's reseed counter.
 821      */
 822     inc_reseed_counter(master);
 823     inc_reseed_counter(private);
 824     if (!TEST_true(test_drbg_reseed(1, master, public, private, 0, 1, 0, 0)))
 825         goto error;
 826
 827     /*
 828      * Test whether the private DRBG is reseeded when its reseed counter differs
 829      * from the master's reseed counter.
 830      */
 831     inc_reseed_counter(master);
 832     inc_reseed_counter(public);
 833     if (!TEST_true(test_drbg_reseed(1, master, public, private, 0, 0, 1, 0)))
 834         goto error;
 835
 836 #if defined(OPENSSL_SYS_UNIX)
 837     if (!TEST_true(test_drbg_reseed_after_fork(master, public, private)))
 838         goto error;
 839 #endif
 840
 841     /* fill 'randomness' buffer with some arbitrary data */
 842     memset(rand_add_buf, 'r', sizeof(rand_add_buf));
 843
 844 #ifndef FIPS_MODULE
 845     /*
 846      * Test whether all three DRBGs are reseeded by RAND_add().
 847      * The before_reseed time has to be measured here and passed into the
 848      * test_drbg_reseed() test, because the master DRBG gets already reseeded
 849      * in RAND_add(), whence the check for the condition
 850      * before_reseed <= reseed_time(master) will fail if the time value happens
 851      * to increase between the RAND_add() and the test_drbg_reseed() call.
 852      */
 853     before_reseed = time(NULL);
 854     RAND_add(rand_add_buf, sizeof(rand_add_buf), sizeof(rand_add_buf));
 855     if (!TEST_true(test_drbg_reseed(1, master, public, private, 1, 1, 1,
 856                                     before_reseed)))
 857         goto error;
 858 #else /* FIPS_MODULE */
 859     /*
 860      * In FIPS mode, random data provided by the application via RAND_add()
 861      * is not considered a trusted entropy source. It is only treated as
 862      * additional_data and no reseeding is forced. This test assures that
 863      * no reseeding occurs.
 864      */
 865     before_reseed = time(NULL);
 866     RAND_add(rand_add_buf, sizeof(rand_add_buf), sizeof(rand_add_buf));
 867     if (!TEST_true(test_drbg_reseed(1, master, public, private, 0, 0, 0,
 868                                     before_reseed)))
 869         goto error;
 870 #endif
 871
 872     rv = 1;
 873
 874 error:
 875    return rv;
 876 }
 877
 878 #if defined(OPENSSL_THREADS)
 879 static int multi_thread_rand_bytes_succeeded = 1;
 880 static int multi_thread_rand_priv_bytes_succeeded = 1;
 881
 882 static void run_multi_thread_test(void)
 883 {
 884     unsigned char buf[256];
 885     time_t start = time(NULL);
 886     RAND_DRBG *public = NULL, *private = NULL;
 887
 888     if (!TEST_ptr(public = RAND_DRBG_get0_public())
 889             || !TEST_ptr(private = RAND_DRBG_get0_private())) {
 890         multi_thread_rand_bytes_succeeded = 0;
 891         return;
 892     }
 893     RAND_DRBG_set_reseed_time_interval(private, 1);
 894     RAND_DRBG_set_reseed_time_interval(public, 1);
 895
 896     do {
 897         if (RAND_bytes(buf, sizeof(buf)) <= 0)
 898             multi_thread_rand_bytes_succeeded = 0;
 899         if (RAND_priv_bytes(buf, sizeof(buf)) <= 0)
 900             multi_thread_rand_priv_bytes_succeeded = 0;
 901     }
 902     while(time(NULL) - start < 5);
 903 }
 904
 905 # if defined(OPENSSL_SYS_WINDOWS)
 906
 907 typedef HANDLE thread_t;
 908
 909 static DWORD WINAPI thread_run(LPVOID arg)
 910 {
 911     run_multi_thread_test();
 912     /*
 913      * Because we're linking with a static library, we must stop each
 914      * thread explicitly, or so says OPENSSL_thread_stop(3)
 915      */
 916     OPENSSL_thread_stop();
 917     return 0;
 918 }
 919
 920 static int run_thread(thread_t *t)
 921 {
 922     *t = CreateThread(NULL, 0, thread_run, NULL, 0, NULL);
 923     return *t != NULL;
 924 }
 925
 926 static int wait_for_thread(thread_t thread)
 927 {
 928     return WaitForSingleObject(thread, INFINITE) == 0;
 929 }
 930
 931 # else
 932
 933 typedef pthread_t thread_t;
 934
 935 static void *thread_run(void *arg)
 936 {
 937     run_multi_thread_test();
 938     /*
 939      * Because we're linking with a static library, we must stop each
 940      * thread explicitly, or so says OPENSSL_thread_stop(3)
 941      */
 942     OPENSSL_thread_stop();
 943     return NULL;
 944 }
 945
 946 static int run_thread(thread_t *t)
 947 {
 948     return pthread_create(t, NULL, thread_run, NULL) == 0;
 949 }
 950
 951 static int wait_for_thread(thread_t thread)
 952 {
 953     return pthread_join(thread, NULL) == 0;
 954 }
 955
 956 # endif
 957
 958 /*
 959  * The main thread will also run the test, so we'll have THREADS+1 parallel
 960  * tests running
 961  */
 962 # define THREADS 3
 963
 964 static int test_multi_thread(void)
 965 {
 966     thread_t t[THREADS];
 967     int i;
 968
 969     for (i = 0; i < THREADS; i++)
 970         run_thread(&t[i]);
 971     run_multi_thread_test();
 972     for (i = 0; i < THREADS; i++)
 973         wait_for_thread(t[i]);
 974
 975     if (!TEST_true(multi_thread_rand_bytes_succeeded))
 976         return 0;
 977     if (!TEST_true(multi_thread_rand_priv_bytes_succeeded))
 978         return 0;
 979
 980     return 1;
 981 }
 982 #endif
 983
 984 static int test_rand_drbg_prediction_resistance(void)
 985 {
 986     RAND_DRBG *m = NULL, *i = NULL, *s = NULL;
 987     unsigned char buf1[51], buf2[sizeof(buf1)];
 988     int ret = 0, mreseed, ireseed, sreseed;
 989
 990     if (crngt_skip())
 991         return TEST_skip("CRNGT cannot be disabled");
 992
 993     /* Initialise a three long DRBG chain */
 994     if (!TEST_ptr(m = RAND_DRBG_new(0, 0, NULL))
 995         || !TEST_true(disable_crngt(m))
 996         || !TEST_true(RAND_DRBG_instantiate(m, NULL, 0))
 997         || !TEST_ptr(i = RAND_DRBG_new(0, 0, m))
 998         || !TEST_true(RAND_DRBG_instantiate(i, NULL, 0))
 999         || !TEST_ptr(s = RAND_DRBG_new(0, 0, i))
1000         || !TEST_true(RAND_DRBG_instantiate(s, NULL, 0)))
1001         goto err;
1002
1003     /* During a normal reseed, only the slave DRBG should be reseed */
1004     inc_reseed_counter(i);
1005     mreseed = reseed_counter(m);
1006     ireseed = reseed_counter(i);
1007     sreseed = reseed_counter(s);
1008     if (!TEST_true(RAND_DRBG_reseed(s, NULL, 0, 0))
1009         || !TEST_int_eq(reseed_counter(m), mreseed)
1010         || !TEST_int_eq(reseed_counter(i), ireseed)
1011         || !TEST_int_gt(reseed_counter(s), sreseed))
1012         goto err;
1013
1014     /*
1015      * When prediction resistance is requested, the request should be
1016      * propagated to the master, so that the entire DRBG chain reseeds.
1017      */
1018     sreseed = reseed_counter(s);
1019     if (!TEST_true(RAND_DRBG_reseed(s, NULL, 0, 1))
1020         || !TEST_int_gt(reseed_counter(m), mreseed)
1021         || !TEST_int_gt(reseed_counter(i), ireseed)
1022         || !TEST_int_gt(reseed_counter(s), sreseed))
1023         goto err;
1024
1025     /* During a normal generate, only the slave DRBG should be reseed */
1026     inc_reseed_counter(i);
1027     mreseed = reseed_counter(m);
1028     ireseed = reseed_counter(i);
1029     sreseed = reseed_counter(s);
1030     if (!TEST_true(RAND_DRBG_generate(s, buf1, sizeof(buf1), 0, NULL, 0))
1031         || !TEST_int_eq(reseed_counter(m), mreseed)
1032         || !TEST_int_eq(reseed_counter(i), ireseed)
1033         || !TEST_int_gt(reseed_counter(s), sreseed))
1034         goto err;
1035
1036     /*
1037      * When a prediction resistant generate is requested, the request
1038      * should be propagated to the master, reseeding the entire DRBG chain.
1039      */
1040     sreseed = reseed_counter(s);
1041     if (!TEST_true(RAND_DRBG_generate(s, buf2, sizeof(buf2), 1, NULL, 0))
1042         || !TEST_int_gt(reseed_counter(m), mreseed)
1043         || !TEST_int_gt(reseed_counter(i), ireseed)
1044         || !TEST_int_gt(reseed_counter(s), sreseed)
1045         || !TEST_mem_ne(buf1, sizeof(buf1), buf2, sizeof(buf2)))
1046         goto err;
1047
1048     /* Verify that a normal reseed still only reseeds the slave DRBG */
1049     inc_reseed_counter(i);
1050     mreseed = reseed_counter(m);
1051     ireseed = reseed_counter(i);
1052     sreseed = reseed_counter(s);
1053     if (!TEST_true(RAND_DRBG_reseed(s, NULL, 0, 0))
1054         || !TEST_int_eq(reseed_counter(m), mreseed)
1055         || !TEST_int_eq(reseed_counter(i), ireseed)
1056         || !TEST_int_gt(reseed_counter(s), sreseed))
1057         goto err;
1058
1059     ret = 1;
1060 err:
1061     RAND_DRBG_free(s);
1062     RAND_DRBG_free(i);
1063     RAND_DRBG_free(m);
1064     return ret;
1065 }
1066
1067 static int test_multi_set(void)
1068 {
1069     int rv = 0;
1070     RAND_DRBG *drbg = NULL;
1071
1072     if (crngt_skip())
1073         return TEST_skip("CRNGT cannot be disabled");
1074
1075     /* init drbg with default CTR initializer */
1076     if (!TEST_ptr(drbg = RAND_DRBG_new(0, 0, NULL))
1077         || !TEST_true(disable_crngt(drbg)))
1078         goto err;
1079     /* change it to use hmac */
1080     if (!TEST_true(RAND_DRBG_set(drbg, NID_sha1, RAND_DRBG_FLAG_HMAC)))
1081         goto err;
1082     /* use same type */
1083     if (!TEST_true(RAND_DRBG_set(drbg, NID_sha1, RAND_DRBG_FLAG_HMAC)))
1084         goto err;
1085     /* change it to use hash */
1086     if (!TEST_true(RAND_DRBG_set(drbg, NID_sha256, 0)))
1087         goto err;
1088     /* use same type */
1089     if (!TEST_true(RAND_DRBG_set(drbg, NID_sha256, 0)))
1090         goto err;
1091     /* change it to use ctr */
1092     if (!TEST_true(RAND_DRBG_set(drbg, NID_aes_192_ctr, 0)))
1093         goto err;
1094     /* use same type */
1095     if (!TEST_true(RAND_DRBG_set(drbg, NID_aes_192_ctr, 0)))
1096         goto err;
1097     if (!TEST_int_gt(RAND_DRBG_instantiate(drbg, NULL, 0), 0))
1098         goto err;
1099
1100     rv = 1;
1101 err:
1102     uninstantiate(drbg);
1103     RAND_DRBG_free(drbg);
1104     return rv;
1105 }
1106
1107 static int test_set_defaults(void)
1108 {
1109     RAND_DRBG *master = NULL, *public = NULL, *private = NULL;
1110
1111            /* Check the default type and flags for master, public and private */
1112     return TEST_ptr(master = RAND_DRBG_get0_master())
1113            && TEST_ptr(public = RAND_DRBG_get0_public())
1114            && TEST_ptr(private = RAND_DRBG_get0_private())
1115            && TEST_int_eq(master->type, RAND_DRBG_TYPE)
1116            && TEST_int_eq(master->flags,
1117                           RAND_DRBG_FLAGS | RAND_DRBG_FLAG_MASTER)
1118            && TEST_int_eq(public->type, RAND_DRBG_TYPE)
1119            && TEST_int_eq(public->flags,
1120                           RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PUBLIC)
1121            && TEST_int_eq(private->type, RAND_DRBG_TYPE)
1122            && TEST_int_eq(private->flags,
1123                           RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PRIVATE)
1124
1125            /* change master DRBG and check again */
1126            && TEST_true(RAND_DRBG_set_defaults(NID_sha256,
1127                                                RAND_DRBG_FLAG_MASTER))
1128            && TEST_true(RAND_DRBG_uninstantiate(master))
1129            && TEST_int_eq(master->type, NID_sha256)
1130            && TEST_int_eq(master->flags, RAND_DRBG_FLAG_MASTER)
1131            && TEST_int_eq(public->type, RAND_DRBG_TYPE)
1132            && TEST_int_eq(public->flags,
1133                           RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PUBLIC)
1134            && TEST_int_eq(private->type, RAND_DRBG_TYPE)
1135            && TEST_int_eq(private->flags,
1136                           RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PRIVATE)
1137            /* change private DRBG and check again */
1138            && TEST_true(RAND_DRBG_set_defaults(NID_sha256,
1139                         RAND_DRBG_FLAG_PRIVATE|RAND_DRBG_FLAG_HMAC))
1140            && TEST_true(RAND_DRBG_uninstantiate(private))
1141            && TEST_int_eq(master->type, NID_sha256)
1142            && TEST_int_eq(master->flags, RAND_DRBG_FLAG_MASTER)
1143            && TEST_int_eq(public->type, RAND_DRBG_TYPE)
1144            && TEST_int_eq(public->flags,
1145                           RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PUBLIC)
1146            && TEST_int_eq(private->type, NID_sha256)
1147            && TEST_int_eq(private->flags,
1148                           RAND_DRBG_FLAG_PRIVATE | RAND_DRBG_FLAG_HMAC)
1149            /* change public DRBG and check again */
1150            && TEST_true(RAND_DRBG_set_defaults(NID_sha1,
1151                                                RAND_DRBG_FLAG_PUBLIC
1152                                                | RAND_DRBG_FLAG_HMAC))
1153            && TEST_true(RAND_DRBG_uninstantiate(public))
1154            && TEST_int_eq(master->type, NID_sha256)
1155            && TEST_int_eq(master->flags, RAND_DRBG_FLAG_MASTER)
1156            && TEST_int_eq(public->type, NID_sha1)
1157            && TEST_int_eq(public->flags,
1158                           RAND_DRBG_FLAG_PUBLIC | RAND_DRBG_FLAG_HMAC)
1159            && TEST_int_eq(private->type, NID_sha256)
1160            && TEST_int_eq(private->flags,
1161                           RAND_DRBG_FLAG_PRIVATE | RAND_DRBG_FLAG_HMAC)
1162            /* Change DRBG defaults and change public and check again */
1163            && TEST_true(RAND_DRBG_set_defaults(NID_sha256, 0))
1164            && TEST_true(RAND_DRBG_uninstantiate(public))
1165            && TEST_int_eq(public->type, NID_sha256)
1166            && TEST_int_eq(public->flags, RAND_DRBG_FLAG_PUBLIC)
1167
1168           /* FIPS mode doesn't support CTR DRBG without a derivation function */
1169 #ifndef FIPS_MODULE
1170           /* Change DRBG defaults and change master and check again */
1171            && TEST_true(RAND_DRBG_set_defaults(NID_aes_256_ctr,
1172                                                RAND_DRBG_FLAG_CTR_NO_DF))
1173            && TEST_true(RAND_DRBG_uninstantiate(master))
1174            && TEST_int_eq(master->type, NID_aes_256_ctr)
1175            && TEST_int_eq(master->flags,
1176                           RAND_DRBG_FLAG_MASTER|RAND_DRBG_FLAG_CTR_NO_DF)
1177 #endif
1178            /* Reset back to the standard defaults */
1179            && TEST_true(RAND_DRBG_set_defaults(RAND_DRBG_TYPE,
1180                                                RAND_DRBG_FLAGS
1181                                                | RAND_DRBG_FLAG_MASTER
1182                                                | RAND_DRBG_FLAG_PUBLIC
1183                                                | RAND_DRBG_FLAG_PRIVATE))
1184            && TEST_true(RAND_DRBG_uninstantiate(master))
1185            && TEST_true(RAND_DRBG_uninstantiate(public))
1186            && TEST_true(RAND_DRBG_uninstantiate(private));
1187 }
1188
1189 #if 0
1190 /*
1191  * A list of the FIPS DRGB types.
1192  * Because of the way HMAC DRGBs are implemented, both the NID and flags
1193  * are required.
1194  */
1195 static const struct s_drgb_types {
1196     int nid;
1197     int flags;
1198 } drgb_types[] = {
1199     { NID_aes_128_ctr,  0                   },
1200     { NID_aes_192_ctr,  0                   },
1201     { NID_aes_256_ctr,  0                   },
1202     { NID_sha1,         0                   },
1203     { NID_sha224,       0                   },
1204     { NID_sha256,       0                   },
1205     { NID_sha384,       0                   },
1206     { NID_sha512,       0                   },
1207     { NID_sha512_224,   0                   },
1208     { NID_sha512_256,   0                   },
1209     { NID_sha3_224,     0                   },
1210     { NID_sha3_256,     0                   },
1211     { NID_sha3_384,     0                   },
1212     { NID_sha3_512,     0                   },
1213     { NID_sha1,         RAND_DRBG_FLAG_HMAC },
1214     { NID_sha224,       RAND_DRBG_FLAG_HMAC },
1215     { NID_sha256,       RAND_DRBG_FLAG_HMAC },
1216     { NID_sha384,       RAND_DRBG_FLAG_HMAC },
1217     { NID_sha512,       RAND_DRBG_FLAG_HMAC },
1218     { NID_sha512_224,   RAND_DRBG_FLAG_HMAC },
1219     { NID_sha512_256,   RAND_DRBG_FLAG_HMAC },
1220     { NID_sha3_224,     RAND_DRBG_FLAG_HMAC },
1221     { NID_sha3_256,     RAND_DRBG_FLAG_HMAC },
1222     { NID_sha3_384,     RAND_DRBG_FLAG_HMAC },
1223     { NID_sha3_512,     RAND_DRBG_FLAG_HMAC },
1224 };
1225
1226 /* Six cases for each covers seed sizes up to 32 bytes */
1227 static const size_t crngt_num_cases = 6;
1228
1229 static size_t crngt_case, crngt_idx;
1230
1231 static int crngt_entropy_cb(OPENSSL_CTX *ctx, RAND_POOL *pool,
1232                             unsigned char *buf, unsigned char *md,
1233                             unsigned int *md_size)
1234 {
1235     size_t i, z;
1236
1237     if (!TEST_int_lt(crngt_idx, crngt_num_cases))
1238         return 0;
1239     /* Generate a block of unique data unless this is the duplication point */
1240     z = crngt_idx++;
1241     if (z > 0 && crngt_case == z)
1242         z--;
1243     for (i = 0; i < CRNGT_BUFSIZ; i++)
1244         buf[i] = (unsigned char)(i + 'A' + z);
1245     return EVP_Digest(buf, CRNGT_BUFSIZ, md, md_size, EVP_sha256(), NULL);
1246 }
1247 #endif
1248
1249 int setup_tests(void)
1250 {
1251     ADD_ALL_TESTS(test_kats, 1);
1252     ADD_ALL_TESTS(test_error_checks, OSSL_NELEM(drbg_test));
1253     ADD_TEST(test_rand_drbg_reseed);
1254     ADD_TEST(test_rand_drbg_prediction_resistance);
1255     ADD_TEST(test_multi_set);
1256     ADD_TEST(test_set_defaults);
1257 #if defined(OPENSSL_THREADS)
1258     ADD_TEST(test_multi_thread);
1259 #endif
1260     return 1;
1261 }