test/drbgtest.c

   1 /*
   2  * Copyright 2011-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 /*
  11  * RAND_DRBG_set is deprecated for public use, but still ok for
  12  * internal use.
  13  */
  14 #include "internal/deprecated.h"
  15
  16 #include <string.h>
  17 #include "internal/nelem.h"
  18 #include <openssl/crypto.h>
  19 #include <openssl/err.h>
  20 #include <openssl/rand.h>
  21 #include <openssl/obj_mac.h>
  22 #include <openssl/evp.h>
  23 #include <openssl/aes.h>
  24 #include "../crypto/rand/rand_local.h"
  25 #include "../include/crypto/rand.h"
  26 #include "../providers/implementations/rands/drbg_local.h"
  27 #include "../crypto/evp/evp_local.h"
  28
  29 #if defined(_WIN32)
  30 # include <windows.h>
  31 #endif
  32
  33
  34 #if defined(OPENSSL_SYS_UNIX)
  35 # include <sys/types.h>
  36 # include <sys/wait.h>
  37 # include <unistd.h>
  38 #endif
  39
  40 #include "testutil.h"
  41 #include "drbgtest.h"
  42
  43 typedef struct drbg_selftest_data_st {
  44     int post;
  45     int nid;
  46     unsigned int flags;
  47
  48     /* KAT data for no PR */
  49     const unsigned char *entropy;
  50     size_t entropylen;
  51     const unsigned char *nonce;
  52     size_t noncelen;
  53     const unsigned char *pers;
  54     size_t perslen;
  55     const unsigned char *adin;
  56     size_t adinlen;
  57     const unsigned char *entropyreseed;
  58     size_t entropyreseedlen;
  59     const unsigned char *adinreseed;
  60     size_t adinreseedlen;
  61     const unsigned char *adin2;
  62     size_t adin2len;
  63     const unsigned char *expected;
  64     size_t exlen;
  65     const unsigned char *kat2;
  66     size_t kat2len;
  67
  68     /* KAT data for PR */
  69     const unsigned char *entropy_pr;
  70     size_t entropylen_pr;
  71     const unsigned char *nonce_pr;
  72     size_t noncelen_pr;
  73     const unsigned char *pers_pr;
  74     size_t perslen_pr;
  75     const unsigned char *adin_pr;
  76     size_t adinlen_pr;
  77     const unsigned char *entropypr_pr;
  78     size_t entropyprlen_pr;
  79     const unsigned char *ading_pr;
  80     size_t adinglen_pr;
  81     const unsigned char *entropyg_pr;
  82     size_t entropyglen_pr;
  83     const unsigned char *kat_pr;
  84     size_t katlen_pr;
  85     const unsigned char *kat2_pr;
  86     size_t kat2len_pr;
  87 } DRBG_SELFTEST_DATA;
  88
  89 #define make_drbg_test_data(nid, flag, pr, post) {\
  90     post, nid, flag, \
  91     pr##_entropyinput, sizeof(pr##_entropyinput), \
  92     pr##_nonce, sizeof(pr##_nonce), \
  93     pr##_personalizationstring, sizeof(pr##_personalizationstring), \
  94     pr##_additionalinput, sizeof(pr##_additionalinput), \
  95     pr##_entropyinputreseed, sizeof(pr##_entropyinputreseed), \
  96     pr##_additionalinputreseed, sizeof(pr##_additionalinputreseed), \
  97     pr##_additionalinput2, sizeof(pr##_additionalinput2), \
  98     pr##_int_returnedbits, sizeof(pr##_int_returnedbits), \
  99     pr##_returnedbits, sizeof(pr##_returnedbits), \
 100     pr##_pr_entropyinput, sizeof(pr##_pr_entropyinput), \
 101     pr##_pr_nonce, sizeof(pr##_pr_nonce), \
 102     pr##_pr_personalizationstring, sizeof(pr##_pr_personalizationstring), \
 103     pr##_pr_additionalinput, sizeof(pr##_pr_additionalinput), \
 104     pr##_pr_entropyinputpr, sizeof(pr##_pr_entropyinputpr), \
 105     pr##_pr_additionalinput2, sizeof(pr##_pr_additionalinput2), \
 106     pr##_pr_entropyinputpr2, sizeof(pr##_pr_entropyinputpr2), \
 107     pr##_pr_int_returnedbits, sizeof(pr##_pr_int_returnedbits), \
 108     pr##_pr_returnedbits, sizeof(pr##_pr_returnedbits) \
 109     }
 110
 111 #define make_drbg_test_data_use_df(nid, pr, p) \
 112     make_drbg_test_data(nid, 0, pr, p)
 113
 114 #define make_drbg_test_data_no_df(nid, pr, p)                      \
 115     make_drbg_test_data(nid, RAND_DRBG_FLAG_CTR_NO_DF, pr, p)
 116
 117 #define make_drbg_test_data_hash(nid, pr, p) \
 118     make_drbg_test_data(nid, RAND_DRBG_FLAG_HMAC, hmac_##pr, p), \
 119     make_drbg_test_data(nid, 0, pr, p)
 120
 121 static DRBG_SELFTEST_DATA drbg_test[] = {
 122 #ifndef FIPS_MODULE
 123     /* FIPS mode doesn't support CTR DRBG without a derivation function */
 124     make_drbg_test_data_no_df (NID_aes_128_ctr, aes_128_no_df,  0),
 125     make_drbg_test_data_no_df (NID_aes_192_ctr, aes_192_no_df,  0),
 126     make_drbg_test_data_no_df (NID_aes_256_ctr, aes_256_no_df,  1),
 127 #endif
 128     make_drbg_test_data_use_df(NID_aes_128_ctr, aes_128_use_df, 0),
 129     make_drbg_test_data_use_df(NID_aes_192_ctr, aes_192_use_df, 0),
 130     make_drbg_test_data_use_df(NID_aes_256_ctr, aes_256_use_df, 1),
 131     make_drbg_test_data_hash(NID_sha1, sha1, 0),
 132     make_drbg_test_data_hash(NID_sha224, sha224, 0),
 133     make_drbg_test_data_hash(NID_sha256, sha256, 1),
 134     make_drbg_test_data_hash(NID_sha384, sha384, 0),
 135     make_drbg_test_data_hash(NID_sha512, sha512, 0),
 136 };
 137
 138 /*
 139  * DRBG query functions
 140  */
 141 static int state(RAND_DRBG *drbg)
 142 {
 143     return EVP_RAND_state(drbg->rand);
 144 }
 145
 146 static size_t query_rand_size_t(RAND_DRBG *drbg, const char *name)
 147 {
 148     OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
 149     size_t n;
 150
 151     *params = OSSL_PARAM_construct_size_t(name, &n);
 152     if (EVP_RAND_get_ctx_params(drbg->rand, params))
 153         return n;
 154     return 0;
 155 }
 156
 157 static unsigned int query_rand_uint(RAND_DRBG *drbg, const char *name)
 158 {
 159     OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
 160     unsigned int n;
 161
 162     *params = OSSL_PARAM_construct_uint(name, &n);
 163     if (EVP_RAND_get_ctx_params(drbg->rand, params))
 164         return n;
 165     return 0;
 166 }
 167
 168 #define DRBG_SIZE_T(name)                               \
 169     static size_t name(RAND_DRBG *drbg)                 \
 170     {                                                   \
 171         return query_rand_size_t(drbg, #name);          \
 172     }
 173 DRBG_SIZE_T(min_entropylen)
 174 DRBG_SIZE_T(max_entropylen)
 175 DRBG_SIZE_T(min_noncelen)
 176 DRBG_SIZE_T(max_noncelen)
 177 DRBG_SIZE_T(max_perslen)
 178 DRBG_SIZE_T(max_adinlen)
 179 DRBG_SIZE_T(max_request)
 180
 181 #define DRBG_UINT(name)                                 \
 182     static unsigned int name(RAND_DRBG *drbg)           \
 183     {                                                   \
 184         return query_rand_uint(drbg, #name);            \
 185     }
 186 DRBG_UINT(reseed_requests)
 187 DRBG_UINT(reseed_counter)
 188
 189 static PROV_DRBG *prov_rand(RAND_DRBG *drbg)
 190 {
 191     return (PROV_DRBG *)drbg->rand->data;
 192 }
 193
 194 static void set_reseed_counter(RAND_DRBG *drbg, unsigned int n)
 195 {
 196     PROV_DRBG *p = prov_rand(drbg);
 197
 198     p->reseed_counter = n;
 199 }
 200
 201 static void inc_reseed_counter(RAND_DRBG *drbg)
 202 {
 203     set_reseed_counter(drbg, reseed_counter(drbg) + 1);
 204 }
 205
 206 static time_t reseed_time(RAND_DRBG *drbg)
 207 {
 208     OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
 209     time_t t;
 210
 211     *params = OSSL_PARAM_construct_time_t(OSSL_DRBG_PARAM_RESEED_TIME, &t);
 212     if (EVP_RAND_get_ctx_params(drbg->rand, params))
 213         return t;
 214     return 0;
 215 }
 216
 217 /*
 218  * Test context data, attached as EXDATA to the RAND_DRBG
 219  */
 220 typedef struct test_ctx_st {
 221     const unsigned char *entropy;
 222     size_t entropylen;
 223     int entropycnt;
 224     const unsigned char *nonce;
 225     size_t noncelen;
 226     int noncecnt;
 227 } TEST_CTX;
 228
 229 static size_t kat_entropy(RAND_DRBG *drbg, unsigned char **pout,
 230                           int entropy, size_t min_len, size_t max_len,
 231                           int prediction_resistance)
 232 {
 233     TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_callback_data(drbg);
 234
 235     t->entropycnt++;
 236     *pout = (unsigned char *)t->entropy;
 237     return t->entropylen;
 238 }
 239
 240 static size_t kat_nonce(RAND_DRBG *drbg, unsigned char **pout,
 241                         int entropy, size_t min_len, size_t max_len)
 242 {
 243     TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_callback_data(drbg);
 244
 245     t->noncecnt++;
 246     *pout = (unsigned char *)t->nonce;
 247     return t->noncelen;
 248 }
 249
 250 /*
 251  * When building the FIPS module, it isn't possible to disable the continuous
 252  * RNG tests.  Tests that require this are skipped.
 253  */
 254 static int crngt_skip(void)
 255 {
 256 #ifdef FIPS_MODULE
 257     return 1;
 258 #else
 259     return 0;
 260 #endif
 261 }
 262
 263  /*
 264  * Disable CRNG testing if it is enabled.
 265  * This stub remains to indicate the calling locations where it is necessary.
 266  * Once the RNG infrastructure is able to disable these tests, it should be
 267  * reconstituted.
 268  */
 269 static int disable_crngt(RAND_DRBG *drbg)
 270 {
 271     return 1;
 272 }
 273
 274 static int uninstantiate(RAND_DRBG *drbg)
 275 {
 276     int ret = drbg == NULL ? 1 : RAND_DRBG_uninstantiate(drbg);
 277
 278     ERR_clear_error();
 279     return ret;
 280 }
 281
 282 /*
 283  * Do a single KAT test.  Return 0 on failure.
 284  */
 285 static int single_kat(DRBG_SELFTEST_DATA *td)
 286 {
 287     RAND_DRBG *drbg = NULL;
 288     TEST_CTX t;
 289     int failures = 0;
 290     unsigned char buff[1024];
 291
 292     if (crngt_skip())
 293         return TEST_skip("CRNGT cannot be disabled");
 294
 295     /*
 296      * Test without PR: Instantiate DRBG with test entropy, nonce and
 297      * personalisation string.
 298      */
 299     if (!TEST_ptr(drbg = RAND_DRBG_new(td->nid, td->flags, NULL)))
 300         return 0;
 301     if (!TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
 302                                            kat_nonce, NULL))
 303         || !TEST_true(RAND_DRBG_set_callback_data(drbg, &t))
 304         || !TEST_true(disable_crngt(drbg))) {
 305         failures++;
 306         goto err;
 307     }
 308     memset(&t, 0, sizeof(t));
 309     t.entropy = td->entropy;
 310     t.entropylen = td->entropylen;
 311     t.nonce = td->nonce;
 312     t.noncelen = td->noncelen;
 313
 314     if (!TEST_true(RAND_DRBG_instantiate(drbg, td->pers, td->perslen))
 315             || !TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
 316                                              td->adin, td->adinlen))
 317             || !TEST_mem_eq(td->expected, td->exlen, buff, td->exlen))
 318         failures++;
 319
 320     /* Reseed DRBG with test entropy and additional input */
 321     t.entropy = td->entropyreseed;
 322     t.entropylen = td->entropyreseedlen;
 323     if (!TEST_true(RAND_DRBG_reseed(drbg, td->adinreseed, td->adinreseedlen, 0)
 324             || !TEST_true(RAND_DRBG_generate(drbg, buff, td->kat2len, 0,
 325                                              td->adin2, td->adin2len))
 326             || !TEST_mem_eq(td->kat2, td->kat2len, buff, td->kat2len)))
 327         failures++;
 328     uninstantiate(drbg);
 329
 330     /*
 331      * Now test with PR: Instantiate DRBG with test entropy, nonce and
 332      * personalisation string.
 333      */
 334     if (!TEST_true(RAND_DRBG_set(drbg, td->nid, td->flags))
 335             || !TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
 336                                                   kat_nonce, NULL))
 337             || !TEST_true(RAND_DRBG_set_callback_data(drbg, &t)))
 338         failures++;
 339     t.entropy = td->entropy_pr;
 340     t.entropylen = td->entropylen_pr;
 341     t.nonce = td->nonce_pr;
 342     t.noncelen = td->noncelen_pr;
 343     t.entropycnt = 0;
 344     t.noncecnt = 0;
 345     if (!TEST_true(RAND_DRBG_instantiate(drbg, td->pers_pr, td->perslen_pr)))
 346         failures++;
 347
 348     /*
 349      * Now generate with PR: we need to supply entropy as this will
 350      * perform a reseed operation.
 351      */
 352     t.entropy = td->entropypr_pr;
 353     t.entropylen = td->entropyprlen_pr;
 354     if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->katlen_pr, 1,
 355                                       td->adin_pr, td->adinlen_pr))
 356             || !TEST_mem_eq(td->kat_pr, td->katlen_pr, buff, td->katlen_pr))
 357         failures++;
 358
 359     /*
 360      * Now generate again with PR: supply new entropy again.
 361      */
 362     t.entropy = td->entropyg_pr;
 363     t.entropylen = td->entropyglen_pr;
 364
 365     if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->kat2len_pr, 1,
 366                                       td->ading_pr, td->adinglen_pr))
 367                 || !TEST_mem_eq(td->kat2_pr, td->kat2len_pr,
 368                                 buff, td->kat2len_pr))
 369         failures++;
 370
 371 err:
 372     uninstantiate(drbg);
 373     RAND_DRBG_free(drbg);
 374     return failures == 0;
 375 }
 376
 377 /*
 378  * Initialise a DRBG based on selftest data
 379  */
 380 static int init(RAND_DRBG *drbg, DRBG_SELFTEST_DATA *td, TEST_CTX *t)
 381 {
 382     if (!TEST_true(RAND_DRBG_set(drbg, td->nid, td->flags))
 383             || !TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
 384                                                   kat_nonce, NULL)))
 385         return 0;
 386     RAND_DRBG_set_callback_data(drbg, t);
 387     t->entropy = td->entropy;
 388     t->entropylen = td->entropylen;
 389     t->nonce = td->nonce;
 390     t->noncelen = td->noncelen;
 391     t->entropycnt = 0;
 392     t->noncecnt = 0;
 393     return 1;
 394 }
 395
 396 /*
 397  * Initialise and instantiate DRBG based on selftest data
 398  */
 399 static int instantiate(RAND_DRBG *drbg, DRBG_SELFTEST_DATA *td,
 400                        TEST_CTX *t)
 401 {
 402     if (!TEST_true(init(drbg, td, t))
 403             || !TEST_true(RAND_DRBG_instantiate(drbg, td->pers, td->perslen)))
 404         return 0;
 405     return 1;
 406 }
 407
 408 /*
 409  * Perform extensive error checking as required by SP800-90.
 410  * Induce several failure modes and check an error condition is set.
 411  */
 412 static int error_check(DRBG_SELFTEST_DATA *td)
 413 {
 414     RAND_DRBG *drbg = NULL;
 415     TEST_CTX t;
 416     unsigned char buff[1024];
 417     unsigned int reseed_counter_tmp;
 418     int ret = 0;
 419
 420     if (!TEST_ptr(drbg = RAND_DRBG_new(td->nid, td->flags, NULL))
 421         || !TEST_true(disable_crngt(drbg)))
 422         goto err;
 423
 424     /*
 425      * Personalisation string tests
 426      */
 427
 428     /* Test detection of too large personalisation string */
 429     if (!init(drbg, td, &t)
 430             || !TEST_false(RAND_DRBG_instantiate(drbg, td->pers, max_perslen(drbg) + 1)))
 431         goto err;
 432
 433     /*
 434      * Entropy source tests
 435      */
 436
 437     /* Test entropy source failure detection: i.e. returns no data */
 438     t.entropylen = 0;
 439     if (!TEST_false(RAND_DRBG_instantiate(drbg, td->pers, td->perslen)))
 440         goto err;
 441
 442     /* Try to generate output from uninstantiated DRBG */
 443     if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
 444                                        td->adin, td->adinlen))
 445             || !uninstantiate(drbg))
 446         goto err;
 447
 448     /* Test insufficient entropy */
 449     if (!init(drbg, td, &t))
 450         goto err;
 451     t.entropylen = min_entropylen(drbg) - 1;
 452     if (!TEST_false(RAND_DRBG_instantiate(drbg, td->pers, td->perslen))
 453             || !uninstantiate(drbg))
 454         goto err;
 455
 456     /* Test too much entropy */
 457     if (!init(drbg, td, &t))
 458         goto err;
 459     t.entropylen = max_entropylen(drbg) + 1;
 460     if (!TEST_false(RAND_DRBG_instantiate(drbg, td->pers, td->perslen))
 461             || !uninstantiate(drbg))
 462         goto err;
 463
 464     /*
 465      * Nonce tests
 466      */
 467
 468     /* Test too small nonce */
 469     if (min_noncelen(drbg) != 0) {
 470         if (!init(drbg, td, &t))
 471             goto err;
 472         t.noncelen = min_noncelen(drbg) - 1;
 473         if (!TEST_false(RAND_DRBG_instantiate(drbg, td->pers, td->perslen))
 474                 || !uninstantiate(drbg))
 475             goto err;
 476     }
 477
 478     /* Test too large nonce */
 479     if (max_noncelen(drbg) != 0) {
 480         if (!init(drbg, td, &t))
 481             goto err;
 482         t.noncelen = max_noncelen(drbg) + 1;
 483         if (!TEST_false(RAND_DRBG_instantiate(drbg, td->pers, td->perslen))
 484                 || !uninstantiate(drbg))
 485             goto err;
 486     }
 487
 488     /* Instantiate with valid data, Check generation is now OK */
 489     if (!instantiate(drbg, td, &t)
 490             || !TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
 491                                              td->adin, td->adinlen)))
 492         goto err;
 493
 494     /* Request too much data for one request */
 495     if (!TEST_false(RAND_DRBG_generate(drbg, buff, max_request(drbg) + 1, 0,
 496                                        td->adin, td->adinlen)))
 497         goto err;
 498
 499     /* Try too large additional input */
 500     if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
 501                                        td->adin, max_adinlen(drbg) + 1)))
 502         goto err;
 503
 504     /*
 505      * Check prediction resistance request fails if entropy source
 506      * failure.
 507      */
 508     t.entropylen = 0;
 509     if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 1,
 510                                       td->adin, td->adinlen))
 511             || !uninstantiate(drbg))
 512         goto err;
 513
 514     /* Instantiate again with valid data */
 515     if (!instantiate(drbg, td, &t))
 516         goto err;
 517     reseed_counter_tmp = reseed_counter(drbg);
 518     set_reseed_counter(drbg, reseed_requests(drbg));
 519
 520     /* Generate output and check entropy has been requested for reseed */
 521     t.entropycnt = 0;
 522     if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
 523                                       td->adin, td->adinlen))
 524             || !TEST_int_eq(t.entropycnt, 1)
 525             || !TEST_int_eq(reseed_counter(drbg), reseed_counter_tmp + 1)
 526             || !uninstantiate(drbg))
 527         goto err;
 528
 529     /*
 530      * Check prediction resistance request fails if entropy source
 531      * failure.
 532      */
 533     t.entropylen = 0;
 534     if (!TEST_false(RAND_DRBG_generate(drbg, buff, td->exlen, 1,
 535                                        td->adin, td->adinlen))
 536             || !uninstantiate(drbg))
 537         goto err;
 538
 539     /* Test reseed counter works */
 540     if (!instantiate(drbg, td, &t))
 541         goto err;
 542     reseed_counter_tmp = reseed_counter(drbg);
 543     set_reseed_counter(drbg, reseed_requests(drbg));
 544
 545     /* Generate output and check entropy has been requested for reseed */
 546     t.entropycnt = 0;
 547     if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->exlen, 0,
 548                                       td->adin, td->adinlen))
 549             || !TEST_int_eq(t.entropycnt, 1)
 550             || !TEST_int_eq(reseed_counter(drbg), reseed_counter_tmp + 1)
 551             || !uninstantiate(drbg))
 552         goto err;
 553
 554     /*
 555      * Explicit reseed tests
 556      */
 557
 558     /* Test explicit reseed with too large additional input */
 559     if (!instantiate(drbg, td, &t)
 560             || !TEST_false(RAND_DRBG_reseed(drbg, td->adin, max_adinlen(drbg) + 1, 0)))
 561         goto err;
 562
 563     /* Test explicit reseed with entropy source failure */
 564     t.entropylen = 0;
 565     if (!TEST_false(RAND_DRBG_reseed(drbg, td->adin, td->adinlen, 0))
 566             || !uninstantiate(drbg))
 567         goto err;
 568
 569     /* Test explicit reseed with too much entropy */
 570     if (!instantiate(drbg, td, &t))
 571         goto err;
 572     t.entropylen = max_entropylen(drbg) + 1;
 573     if (!TEST_false(RAND_DRBG_reseed(drbg, td->adin, td->adinlen, 0))
 574             || !uninstantiate(drbg))
 575         goto err;
 576
 577     /* Test explicit reseed with too little entropy */
 578     if (!instantiate(drbg, td, &t))
 579         goto err;
 580     t.entropylen = min_entropylen(drbg) - 1;
 581     if (!TEST_false(RAND_DRBG_reseed(drbg, td->adin, td->adinlen, 0))
 582             || !uninstantiate(drbg))
 583         goto err;
 584
 585     /* Standard says we have to check uninstantiate really zeroes */
 586     if (!TEST_true(EVP_RAND_verify_zeroization(drbg->rand)))
 587         goto err;
 588
 589     ret = 1;
 590
 591 err:
 592     uninstantiate(drbg);
 593     RAND_DRBG_free(drbg);
 594     return ret;
 595 }
 596
 597 static int test_kats(int i)
 598 {
 599     DRBG_SELFTEST_DATA *td = &drbg_test[i];
 600     int rv = 0;
 601
 602     if (!single_kat(td))
 603         goto err;
 604     rv = 1;
 605
 606 err:
 607     return rv;
 608 }
 609
 610 static int test_error_checks(int i)
 611 {
 612     DRBG_SELFTEST_DATA *td = &drbg_test[i];
 613     int rv = 0;
 614
 615     if (crngt_skip())
 616         return TEST_skip("CRNGT cannot be disabled");
 617
 618     if (!error_check(td))
 619         goto err;
 620     rv = 1;
 621
 622 err:
 623     return rv;
 624 }
 625
 626 /*
 627  * Generates random output using RAND_bytes() and RAND_priv_bytes()
 628  * and checks whether the three shared DRBGs were reseeded as
 629  * expected.
 630  *
 631  * |expect_success|: expected outcome (as reported by RAND_status())
 632  * |primary|, |public|, |private|: pointers to the three shared DRBGs
 633  * |expect_xxx_reseed| =
 634  *       1:  it is expected that the specified DRBG is reseeded
 635  *       0:  it is expected that the specified DRBG is not reseeded
 636  *      -1:  don't check whether the specified DRBG was reseeded or not
 637  * |reseed_time|: if nonzero, used instead of time(NULL) to set the
 638  *                |before_reseed| time.
 639  */
 640 static int test_drbg_reseed(int expect_success,
 641                             RAND_DRBG *primary,
 642                             RAND_DRBG *public,
 643                             RAND_DRBG *private,
 644                             int expect_primary_reseed,
 645                             int expect_public_reseed,
 646                             int expect_private_reseed,
 647                             time_t reseed_when
 648                            )
 649 {
 650     unsigned char buf[32];
 651     time_t before_reseed, after_reseed;
 652     int expected_state = (expect_success ? DRBG_READY : DRBG_ERROR);
 653     unsigned int primary_reseed, public_reseed, private_reseed;
 654
 655     /*
 656      * step 1: check preconditions
 657      */
 658
 659     /* Test whether seed propagation is enabled */
 660     if (!TEST_int_ne(primary_reseed = reseed_counter(primary), 0)
 661         || !TEST_int_ne(public_reseed = reseed_counter(public), 0)
 662         || !TEST_int_ne(private_reseed = reseed_counter(private), 0))
 663         return 0;
 664
 665     /*
 666      * step 2: generate random output
 667      */
 668
 669     if (reseed_when == 0)
 670         reseed_when = time(NULL);
 671
 672     /* Generate random output from the public and private DRBG */
 673     before_reseed = expect_primary_reseed == 1 ? reseed_when : 0;
 674     if (!TEST_int_eq(RAND_bytes(buf, sizeof(buf)), expect_success)
 675         || !TEST_int_eq(RAND_priv_bytes(buf, sizeof(buf)), expect_success))
 676         return 0;
 677     after_reseed = time(NULL);
 678
 679
 680     /*
 681      * step 3: check postconditions
 682      */
 683
 684     /* Test whether reseeding succeeded as expected */
 685     if (/*!TEST_int_eq(state(primary), expected_state)
 686         || */!TEST_int_eq(state(public), expected_state)
 687         || !TEST_int_eq(state(private), expected_state))
 688         return 0;
 689
 690     if (expect_primary_reseed >= 0) {
 691         /* Test whether primary DRBG was reseeded as expected */
 692         if (!TEST_int_ge(reseed_counter(primary), primary_reseed))
 693             return 0;
 694     }
 695
 696     if (expect_public_reseed >= 0) {
 697         /* Test whether public DRBG was reseeded as expected */
 698         if (!TEST_int_ge(reseed_counter(public), public_reseed)
 699                 || !TEST_uint_ge(reseed_counter(public),
 700                                  reseed_counter(primary)))
 701             return 0;
 702     }
 703
 704     if (expect_private_reseed >= 0) {
 705         /* Test whether public DRBG was reseeded as expected */
 706         if (!TEST_int_ge(reseed_counter(private), private_reseed)
 707                 || !TEST_uint_ge(reseed_counter(private),
 708                                  reseed_counter(primary)))
 709             return 0;
 710     }
 711
 712     if (expect_success == 1) {
 713         /* Test whether reseed time of primary DRBG is set correctly */
 714         if (!TEST_time_t_le(before_reseed, reseed_time(primary))
 715             || !TEST_time_t_le(reseed_time(primary), after_reseed))
 716             return 0;
 717
 718         /* Test whether reseed times of child DRBGs are synchronized with primary */
 719         if (!TEST_time_t_ge(reseed_time(public), reseed_time(primary))
 720             || !TEST_time_t_ge(reseed_time(private), reseed_time(primary)))
 721             return 0;
 722     } else {
 723         ERR_clear_error();
 724     }
 725
 726     return 1;
 727 }
 728
 729
 730 #if defined(OPENSSL_SYS_UNIX)
 731 /*
 732  * Test whether primary, public and private DRBG are reseeded after
 733  * forking the process.
 734  */
 735 static int test_drbg_reseed_after_fork(RAND_DRBG *primary,
 736                                        RAND_DRBG *public,
 737                                        RAND_DRBG *private)
 738 {
 739     pid_t pid;
 740     int status=0;
 741
 742     pid = fork();
 743     if (!TEST_int_ge(pid, 0))
 744         return 0;
 745
 746     if (pid > 0) {
 747         /* I'm the parent; wait for the child and check its exit code */
 748         return TEST_int_eq(waitpid(pid, &status, 0), pid) && TEST_int_eq(status, 0);
 749     }
 750
 751     /* I'm the child; check whether all three DRBGs reseed. */
 752     if (!TEST_true(test_drbg_reseed(1, primary, public, private, 1, 1, 1, 0)))
 753         status = 1;
 754     exit(status);
 755 }
 756 #endif
 757
 758 /*
 759  * Test whether the default rand_method (RAND_OpenSSL()) is
 760  * setup correctly, in particular whether reseeding  works
 761  * as designed.
 762  */
 763 static int test_rand_drbg_reseed(void)
 764 {
 765     RAND_DRBG *primary, *public, *private;
 766     unsigned char rand_add_buf[256];
 767     int rv = 0;
 768     time_t before_reseed;
 769
 770     if (crngt_skip())
 771         return TEST_skip("CRNGT cannot be disabled");
 772
 773     /* Check whether RAND_OpenSSL() is the default method */
 774     if (!TEST_ptr_eq(RAND_get_rand_method(), RAND_OpenSSL()))
 775         return 0;
 776
 777     /* All three DRBGs should be non-null */
 778     if (!TEST_ptr(primary = RAND_DRBG_get0_master())
 779         || !TEST_ptr(public = RAND_DRBG_get0_public())
 780         || !TEST_ptr(private = RAND_DRBG_get0_private()))
 781         return 0;
 782
 783     /* There should be three distinct DRBGs, two of them chained to primary */
 784     if (!TEST_ptr_ne(public, private)
 785         || !TEST_ptr_ne(public, primary)
 786         || !TEST_ptr_ne(private, primary)
 787         || !TEST_ptr_eq(public->parent, primary)
 788         || !TEST_ptr_eq(private->parent, primary))
 789         return 0;
 790
 791     /* Disable CRNG testing for the primary DRBG */
 792     if (!TEST_true(disable_crngt(primary)))
 793         return 0;
 794
 795     /* uninstantiate the three global DRBGs */
 796     RAND_DRBG_uninstantiate(primary);
 797     RAND_DRBG_uninstantiate(private);
 798     RAND_DRBG_uninstantiate(public);
 799
 800
 801     /*
 802      * Test initial seeding of shared DRBGs
 803      */
 804     if (!TEST_true(test_drbg_reseed(1, primary, public, private, 1, 1, 1, 0)))
 805         goto error;
 806
 807
 808     /*
 809      * Test initial state of shared DRBGs
 810      */
 811     if (!TEST_true(test_drbg_reseed(1, primary, public, private, 0, 0, 0, 0)))
 812         goto error;
 813
 814     /*
 815      * Test whether the public and private DRBG are both reseeded when their
 816      * reseed counters differ from the primary's reseed counter.
 817      */
 818     inc_reseed_counter(primary);
 819     if (!TEST_true(test_drbg_reseed(1, primary, public, private, 0, 1, 1, 0)))
 820         goto error;
 821
 822     /*
 823      * Test whether the public DRBG is reseeded when its reseed counter differs
 824      * from the primary's reseed counter.
 825      */
 826     inc_reseed_counter(primary);
 827     inc_reseed_counter(private);
 828     if (!TEST_true(test_drbg_reseed(1, primary, public, private, 0, 1, 0, 0)))
 829         goto error;
 830
 831     /*
 832      * Test whether the private DRBG is reseeded when its reseed counter differs
 833      * from the primary's reseed counter.
 834      */
 835     inc_reseed_counter(primary);
 836     inc_reseed_counter(public);
 837     if (!TEST_true(test_drbg_reseed(1, primary, public, private, 0, 0, 1, 0)))
 838         goto error;
 839
 840 #if defined(OPENSSL_SYS_UNIX)
 841     if (!TEST_true(test_drbg_reseed_after_fork(primary, public, private)))
 842         goto error;
 843 #endif
 844
 845     /* fill 'randomness' buffer with some arbitrary data */
 846     memset(rand_add_buf, 'r', sizeof(rand_add_buf));
 847
 848 #ifndef FIPS_MODULE
 849     /*
 850      * Test whether all three DRBGs are reseeded by RAND_add().
 851      * The before_reseed time has to be measured here and passed into the
 852      * test_drbg_reseed() test, because the primary DRBG gets already reseeded
 853      * in RAND_add(), whence the check for the condition
 854      * before_reseed <= reseed_time(primary) will fail if the time value happens
 855      * to increase between the RAND_add() and the test_drbg_reseed() call.
 856      */
 857     before_reseed = time(NULL);
 858     RAND_add(rand_add_buf, sizeof(rand_add_buf), sizeof(rand_add_buf));
 859     if (!TEST_true(test_drbg_reseed(1, primary, public, private, 1, 1, 1,
 860                                     before_reseed)))
 861         goto error;
 862 #else /* FIPS_MODULE */
 863     /*
 864      * In FIPS mode, random data provided by the application via RAND_add()
 865      * is not considered a trusted entropy source. It is only treated as
 866      * additional_data and no reseeding is forced. This test assures that
 867      * no reseeding occurs.
 868      */
 869     before_reseed = time(NULL);
 870     RAND_add(rand_add_buf, sizeof(rand_add_buf), sizeof(rand_add_buf));
 871     if (!TEST_true(test_drbg_reseed(1, primary, public, private, 0, 0, 0,
 872                                     before_reseed)))
 873         goto error;
 874 #endif
 875
 876     rv = 1;
 877
 878 error:
 879    return rv;
 880 }
 881
 882 #if defined(OPENSSL_THREADS)
 883 static int multi_thread_rand_bytes_succeeded = 1;
 884 static int multi_thread_rand_priv_bytes_succeeded = 1;
 885
 886 static void run_multi_thread_test(void)
 887 {
 888     unsigned char buf[256];
 889     time_t start = time(NULL);
 890     RAND_DRBG *public = NULL, *private = NULL;
 891
 892     if (!TEST_ptr(public = RAND_DRBG_get0_public())
 893             || !TEST_ptr(private = RAND_DRBG_get0_private())) {
 894         multi_thread_rand_bytes_succeeded = 0;
 895         return;
 896     }
 897     RAND_DRBG_set_reseed_time_interval(private, 1);
 898     RAND_DRBG_set_reseed_time_interval(public, 1);
 899
 900     do {
 901         if (RAND_bytes(buf, sizeof(buf)) <= 0)
 902             multi_thread_rand_bytes_succeeded = 0;
 903         if (RAND_priv_bytes(buf, sizeof(buf)) <= 0)
 904             multi_thread_rand_priv_bytes_succeeded = 0;
 905     }
 906     while(time(NULL) - start < 5);
 907 }
 908
 909 # if defined(OPENSSL_SYS_WINDOWS)
 910
 911 typedef HANDLE thread_t;
 912
 913 static DWORD WINAPI thread_run(LPVOID arg)
 914 {
 915     run_multi_thread_test();
 916     /*
 917      * Because we're linking with a static library, we must stop each
 918      * thread explicitly, or so says OPENSSL_thread_stop(3)
 919      */
 920     OPENSSL_thread_stop();
 921     return 0;
 922 }
 923
 924 static int run_thread(thread_t *t)
 925 {
 926     *t = CreateThread(NULL, 0, thread_run, NULL, 0, NULL);
 927     return *t != NULL;
 928 }
 929
 930 static int wait_for_thread(thread_t thread)
 931 {
 932     return WaitForSingleObject(thread, INFINITE) == 0;
 933 }
 934
 935 # else
 936
 937 typedef pthread_t thread_t;
 938
 939 static void *thread_run(void *arg)
 940 {
 941     run_multi_thread_test();
 942     /*
 943      * Because we're linking with a static library, we must stop each
 944      * thread explicitly, or so says OPENSSL_thread_stop(3)
 945      */
 946     OPENSSL_thread_stop();
 947     return NULL;
 948 }
 949
 950 static int run_thread(thread_t *t)
 951 {
 952     return pthread_create(t, NULL, thread_run, NULL) == 0;
 953 }
 954
 955 static int wait_for_thread(thread_t thread)
 956 {
 957     return pthread_join(thread, NULL) == 0;
 958 }
 959
 960 # endif
 961
 962 /*
 963  * The main thread will also run the test, so we'll have THREADS+1 parallel
 964  * tests running
 965  */
 966 # define THREADS 3
 967
 968 static int test_multi_thread(void)
 969 {
 970     thread_t t[THREADS];
 971     int i;
 972
 973     for (i = 0; i < THREADS; i++)
 974         run_thread(&t[i]);
 975     run_multi_thread_test();
 976     for (i = 0; i < THREADS; i++)
 977         wait_for_thread(t[i]);
 978
 979     if (!TEST_true(multi_thread_rand_bytes_succeeded))
 980         return 0;
 981     if (!TEST_true(multi_thread_rand_priv_bytes_succeeded))
 982         return 0;
 983
 984     return 1;
 985 }
 986 #endif
 987
 988 static int test_rand_drbg_prediction_resistance(void)
 989 {
 990     RAND_DRBG *x = NULL, *y = NULL, *z = NULL;
 991     unsigned char buf1[51], buf2[sizeof(buf1)];
 992     int ret = 0, xreseed, yreseed, zreseed;
 993
 994     if (crngt_skip())
 995         return TEST_skip("CRNGT cannot be disabled");
 996
 997     /* Initialise a three long DRBG chain */
 998     if (!TEST_ptr(x = RAND_DRBG_new(0, 0, NULL))
 999         || !TEST_true(disable_crngt(x))
1000         || !TEST_true(RAND_DRBG_instantiate(x, NULL, 0))
1001         || !TEST_ptr(y = RAND_DRBG_new(0, 0, x))
1002         || !TEST_true(RAND_DRBG_instantiate(y, NULL, 0))
1003         || !TEST_ptr(z = RAND_DRBG_new(0, 0, y))
1004         || !TEST_true(RAND_DRBG_instantiate(z, NULL, 0)))
1005         goto err;
1006
1007     /*
1008      * During a normal reseed, only the last DRBG in the chain should
1009      * be reseeded.
1010      */
1011     inc_reseed_counter(y);
1012     xreseed = reseed_counter(x);
1013     yreseed = reseed_counter(y);
1014     zreseed = reseed_counter(z);
1015     if (!TEST_true(RAND_DRBG_reseed(z, NULL, 0, 0))
1016         || !TEST_int_eq(reseed_counter(x), xreseed)
1017         || !TEST_int_eq(reseed_counter(y), yreseed)
1018         || !TEST_int_gt(reseed_counter(z), zreseed))
1019         goto err;
1020
1021     /*
1022      * When prediction resistance is requested, the request should be
1023      * propagated to the primary, so that the entire DRBG chain reseeds.
1024      */
1025     zreseed = reseed_counter(z);
1026     if (!TEST_true(RAND_DRBG_reseed(z, NULL, 0, 1))
1027         || !TEST_int_gt(reseed_counter(x), xreseed)
1028         || !TEST_int_gt(reseed_counter(y), yreseed)
1029         || !TEST_int_gt(reseed_counter(z), zreseed))
1030         goto err;
1031
1032     /*
1033      * During a normal generate, only the last DRBG should be reseed */
1034     inc_reseed_counter(y);
1035     xreseed = reseed_counter(x);
1036     yreseed = reseed_counter(y);
1037     zreseed = reseed_counter(z);
1038     if (!TEST_true(RAND_DRBG_generate(z, buf1, sizeof(buf1), 0, NULL, 0))
1039         || !TEST_int_eq(reseed_counter(x), xreseed)
1040         || !TEST_int_eq(reseed_counter(y), yreseed)
1041         || !TEST_int_gt(reseed_counter(z), zreseed))
1042         goto err;
1043
1044     /*
1045      * When a prediction resistant generate is requested, the request
1046      * should be propagated to the primary, reseeding the entire DRBG chain.
1047      */
1048     zreseed = reseed_counter(z);
1049     if (!TEST_true(RAND_DRBG_generate(z, buf2, sizeof(buf2), 1, NULL, 0))
1050         || !TEST_int_gt(reseed_counter(x), xreseed)
1051         || !TEST_int_gt(reseed_counter(y), yreseed)
1052         || !TEST_int_gt(reseed_counter(z), zreseed)
1053         || !TEST_mem_ne(buf1, sizeof(buf1), buf2, sizeof(buf2)))
1054         goto err;
1055
1056     /* Verify that a normal reseed still only reseeds the last DRBG */
1057     inc_reseed_counter(y);
1058     xreseed = reseed_counter(x);
1059     yreseed = reseed_counter(y);
1060     zreseed = reseed_counter(z);
1061     if (!TEST_true(RAND_DRBG_reseed(z, NULL, 0, 0))
1062         || !TEST_int_eq(reseed_counter(x), xreseed)
1063         || !TEST_int_eq(reseed_counter(y), yreseed)
1064         || !TEST_int_gt(reseed_counter(z), zreseed))
1065         goto err;
1066
1067     ret = 1;
1068 err:
1069     RAND_DRBG_free(z);
1070     RAND_DRBG_free(y);
1071     RAND_DRBG_free(x);
1072     return ret;
1073 }
1074
1075 static int test_multi_set(void)
1076 {
1077     int rv = 0;
1078     RAND_DRBG *drbg = NULL;
1079
1080     if (crngt_skip())
1081         return TEST_skip("CRNGT cannot be disabled");
1082
1083     /* init drbg with default CTR initializer */
1084     if (!TEST_ptr(drbg = RAND_DRBG_new(0, 0, NULL))
1085         || !TEST_true(disable_crngt(drbg)))
1086         goto err;
1087     /* change it to use hmac */
1088     if (!TEST_true(RAND_DRBG_set(drbg, NID_sha1, RAND_DRBG_FLAG_HMAC)))
1089         goto err;
1090     /* use same type */
1091     if (!TEST_true(RAND_DRBG_set(drbg, NID_sha1, RAND_DRBG_FLAG_HMAC)))
1092         goto err;
1093     /* change it to use hash */
1094     if (!TEST_true(RAND_DRBG_set(drbg, NID_sha256, 0)))
1095         goto err;
1096     /* use same type */
1097     if (!TEST_true(RAND_DRBG_set(drbg, NID_sha256, 0)))
1098         goto err;
1099     /* change it to use ctr */
1100     if (!TEST_true(RAND_DRBG_set(drbg, NID_aes_192_ctr, 0)))
1101         goto err;
1102     /* use same type */
1103     if (!TEST_true(RAND_DRBG_set(drbg, NID_aes_192_ctr, 0)))
1104         goto err;
1105     if (!TEST_int_gt(RAND_DRBG_instantiate(drbg, NULL, 0), 0))
1106         goto err;
1107
1108     rv = 1;
1109 err:
1110     uninstantiate(drbg);
1111     RAND_DRBG_free(drbg);
1112     return rv;
1113 }
1114
1115 static int test_set_defaults(void)
1116 {
1117     RAND_DRBG *primary = NULL, *public = NULL, *private = NULL;
1118
1119    /* Check the default type and flags for primary, public and private */
1120     return TEST_ptr(primary = RAND_DRBG_get0_master())
1121            && TEST_ptr(public = RAND_DRBG_get0_public())
1122            && TEST_ptr(private = RAND_DRBG_get0_private())
1123            && TEST_int_eq(primary->type, RAND_DRBG_TYPE)
1124            && TEST_int_eq(primary->flags,
1125                           RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PRIMARY)
1126            && TEST_int_eq(public->type, RAND_DRBG_TYPE)
1127            && TEST_int_eq(public->flags,
1128                           RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PUBLIC)
1129            && TEST_int_eq(private->type, RAND_DRBG_TYPE)
1130            && TEST_int_eq(private->flags,
1131                           RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PRIVATE)
1132
1133            /* change primary DRBG and check again */
1134            && TEST_true(RAND_DRBG_set_defaults(NID_sha256,
1135                                                RAND_DRBG_FLAG_PRIMARY))
1136            && TEST_true(RAND_DRBG_uninstantiate(primary))
1137            && TEST_int_eq(primary->type, NID_sha256)
1138            && TEST_int_eq(primary->flags, RAND_DRBG_FLAG_PRIMARY)
1139            && TEST_int_eq(public->type, RAND_DRBG_TYPE)
1140            && TEST_int_eq(public->flags,
1141                           RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PUBLIC)
1142            && TEST_int_eq(private->type, RAND_DRBG_TYPE)
1143            && TEST_int_eq(private->flags,
1144                           RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PRIVATE)
1145            /* change private DRBG and check again */
1146            && TEST_true(RAND_DRBG_set_defaults(NID_sha256,
1147                         RAND_DRBG_FLAG_PRIVATE|RAND_DRBG_FLAG_HMAC))
1148            && TEST_true(RAND_DRBG_uninstantiate(private))
1149            && TEST_int_eq(primary->type, NID_sha256)
1150            && TEST_int_eq(primary->flags, RAND_DRBG_FLAG_PRIMARY)
1151            && TEST_int_eq(public->type, RAND_DRBG_TYPE)
1152            && TEST_int_eq(public->flags,
1153                           RAND_DRBG_FLAGS | RAND_DRBG_FLAG_PUBLIC)
1154            && TEST_int_eq(private->type, NID_sha256)
1155            && TEST_int_eq(private->flags,
1156                           RAND_DRBG_FLAG_PRIVATE | RAND_DRBG_FLAG_HMAC)
1157            /* change public DRBG and check again */
1158            && TEST_true(RAND_DRBG_set_defaults(NID_sha1,
1159                                                RAND_DRBG_FLAG_PUBLIC
1160                                                | RAND_DRBG_FLAG_HMAC))
1161            && TEST_true(RAND_DRBG_uninstantiate(public))
1162            && TEST_int_eq(primary->type, NID_sha256)
1163            && TEST_int_eq(primary->flags, RAND_DRBG_FLAG_PRIMARY)
1164            && TEST_int_eq(public->type, NID_sha1)
1165            && TEST_int_eq(public->flags,
1166                           RAND_DRBG_FLAG_PUBLIC | RAND_DRBG_FLAG_HMAC)
1167            && TEST_int_eq(private->type, NID_sha256)
1168            && TEST_int_eq(private->flags,
1169                           RAND_DRBG_FLAG_PRIVATE | RAND_DRBG_FLAG_HMAC)
1170            /* Change DRBG defaults and change public and check again */
1171            && TEST_true(RAND_DRBG_set_defaults(NID_sha256, 0))
1172            && TEST_true(RAND_DRBG_uninstantiate(public))
1173            && TEST_int_eq(public->type, NID_sha256)
1174            && TEST_int_eq(public->flags, RAND_DRBG_FLAG_PUBLIC)
1175
1176           /* FIPS mode doesn't support CTR DRBG without a derivation function */
1177 #ifndef FIPS_MODULE
1178           /* Change DRBG defaults and change primary and check again */
1179            && TEST_true(RAND_DRBG_set_defaults(NID_aes_256_ctr,
1180                                                RAND_DRBG_FLAG_CTR_NO_DF))
1181            && TEST_true(RAND_DRBG_uninstantiate(primary))
1182            && TEST_int_eq(primary->type, NID_aes_256_ctr)
1183            && TEST_int_eq(primary->flags,
1184                           RAND_DRBG_FLAG_PRIMARY|RAND_DRBG_FLAG_CTR_NO_DF)
1185 #endif
1186            /* Reset back to the standard defaults */
1187            && TEST_true(RAND_DRBG_set_defaults(RAND_DRBG_TYPE,
1188                                                RAND_DRBG_FLAGS
1189                                                | RAND_DRBG_FLAG_PRIMARY
1190                                                | RAND_DRBG_FLAG_PUBLIC
1191                                                | RAND_DRBG_FLAG_PRIVATE))
1192            && TEST_true(RAND_DRBG_uninstantiate(primary))
1193            && TEST_true(RAND_DRBG_uninstantiate(public))
1194            && TEST_true(RAND_DRBG_uninstantiate(private));
1195 }
1196
1197 #if 0
1198 /*
1199  * A list of the FIPS DRGB types.
1200  * Because of the way HMAC DRGBs are implemented, both the NID and flags
1201  * are required.
1202  */
1203 static const struct s_drgb_types {
1204     int nid;
1205     int flags;
1206 } drgb_types[] = {
1207     { NID_aes_128_ctr,  0                   },
1208     { NID_aes_192_ctr,  0                   },
1209     { NID_aes_256_ctr,  0                   },
1210     { NID_sha1,         0                   },
1211     { NID_sha224,       0                   },
1212     { NID_sha256,       0                   },
1213     { NID_sha384,       0                   },
1214     { NID_sha512,       0                   },
1215     { NID_sha512_224,   0                   },
1216     { NID_sha512_256,   0                   },
1217     { NID_sha3_224,     0                   },
1218     { NID_sha3_256,     0                   },
1219     { NID_sha3_384,     0                   },
1220     { NID_sha3_512,     0                   },
1221     { NID_sha1,         RAND_DRBG_FLAG_HMAC },
1222     { NID_sha224,       RAND_DRBG_FLAG_HMAC },
1223     { NID_sha256,       RAND_DRBG_FLAG_HMAC },
1224     { NID_sha384,       RAND_DRBG_FLAG_HMAC },
1225     { NID_sha512,       RAND_DRBG_FLAG_HMAC },
1226     { NID_sha512_224,   RAND_DRBG_FLAG_HMAC },
1227     { NID_sha512_256,   RAND_DRBG_FLAG_HMAC },
1228     { NID_sha3_224,     RAND_DRBG_FLAG_HMAC },
1229     { NID_sha3_256,     RAND_DRBG_FLAG_HMAC },
1230     { NID_sha3_384,     RAND_DRBG_FLAG_HMAC },
1231     { NID_sha3_512,     RAND_DRBG_FLAG_HMAC },
1232 };
1233
1234 /* Six cases for each covers seed sizes up to 32 bytes */
1235 static const size_t crngt_num_cases = 6;
1236
1237 static size_t crngt_case, crngt_idx;
1238
1239 static int crngt_entropy_cb(OPENSSL_CTX *ctx, RAND_POOL *pool,
1240                             unsigned char *buf, unsigned char *md,
1241                             unsigned int *md_size)
1242 {
1243     size_t i, z;
1244
1245     if (!TEST_int_lt(crngt_idx, crngt_num_cases))
1246         return 0;
1247     /* Generate a block of unique data unless this is the duplication point */
1248     z = crngt_idx++;
1249     if (z > 0 && crngt_case == z)
1250         z--;
1251     for (i = 0; i < CRNGT_BUFSIZ; i++)
1252         buf[i] = (unsigned char)(i + 'A' + z);
1253     return EVP_Digest(buf, CRNGT_BUFSIZ, md, md_size, EVP_sha256(), NULL);
1254 }
1255 #endif
1256
1257 int setup_tests(void)
1258 {
1259     ADD_ALL_TESTS(test_kats, 1);
1260     ADD_ALL_TESTS(test_error_checks, OSSL_NELEM(drbg_test));
1261     ADD_TEST(test_rand_drbg_reseed);
1262     ADD_TEST(test_rand_drbg_prediction_resistance);
1263     ADD_TEST(test_multi_set);
1264     ADD_TEST(test_set_defaults);
1265 #if defined(OPENSSL_THREADS)
1266     ADD_TEST(test_multi_thread);
1267 #endif
1268     return 1;
1269 }