*
*/
-#define ENTROPY_NEEDED 16 /* require 128 bits = 16 bytes of randomness */
-
-#ifndef MD_RAND_DEBUG
+#ifdef MD_RAND_DEBUG
# ifndef NDEBUG
# define NDEBUG
# endif
#include <assert.h>
#include <stdio.h>
-#include <time.h>
#include <string.h>
#include "openssl/e_os.h"
+#include <openssl/rand.h>
+#include "rand_lcl.h"
+
#include <openssl/crypto.h>
#include <openssl/err.h>
-#if !defined(USE_MD5_RAND) && !defined(USE_SHA1_RAND) && !defined(USE_MDC2_RAND) && !defined(USE_MD2_RAND)
-#if !defined(NO_SHA) && !defined(NO_SHA1)
-#define USE_SHA1_RAND
-#elif !defined(NO_MD5)
-#define USE_MD5_RAND
-#elif !defined(NO_MDC2) && !defined(NO_DES)
-#define USE_MDC2_RAND
-#elif !defined(NO_MD2)
-#define USE_MD2_RAND
-#else
-#error No message digest algorithm available
-#endif
-#endif
-
-/* Changed how the state buffer used. I now attempt to 'wrap' such
- * that I don't run over the same locations the next time go through
- * the 1023 bytes - many thanks to
- * Robert J. LeBlanc <rjl@renaissoft.com> for his comments
- */
-
-#if defined(USE_MD5_RAND)
-#include <openssl/md5.h>
-#define MD_DIGEST_LENGTH MD5_DIGEST_LENGTH
-#define MD_CTX MD5_CTX
-#define MD_Init(a) MD5_Init(a)
-#define MD_Update(a,b,c) MD5_Update(a,b,c)
-#define MD_Final(a,b) MD5_Final(a,b)
-#define MD(a,b,c) MD5(a,b,c)
-#elif defined(USE_SHA1_RAND)
-#include <openssl/sha.h>
-#define MD_DIGEST_LENGTH SHA_DIGEST_LENGTH
-#define MD_CTX SHA_CTX
-#define MD_Init(a) SHA1_Init(a)
-#define MD_Update(a,b,c) SHA1_Update(a,b,c)
-#define MD_Final(a,b) SHA1_Final(a,b)
-#define MD(a,b,c) SHA1(a,b,c)
-#elif defined(USE_MDC2_RAND)
-#include <openssl/mdc2.h>
-#define MD_DIGEST_LENGTH MDC2_DIGEST_LENGTH
-#define MD_CTX MDC2_CTX
-#define MD_Init(a) MDC2_Init(a)
-#define MD_Update(a,b,c) MDC2_Update(a,b,c)
-#define MD_Final(a,b) MDC2_Final(a,b)
-#define MD(a,b,c) MDC2(a,b,c)
-#elif defined(USE_MD2_RAND)
-#include <openssl/md2.h>
-#define MD_DIGEST_LENGTH MD2_DIGEST_LENGTH
-#define MD_CTX MD2_CTX
-#define MD_Init(a) MD2_Init(a)
-#define MD_Update(a,b,c) MD2_Update(a,b,c)
-#define MD_Final(a,b) MD2_Final(a,b)
-#define MD(a,b,c) MD2(a,b,c)
-#endif
-
-#include <openssl/rand.h>
-
#ifdef BN_DEBUG
# define PREDICT
#endif
-/* #define NORAND 1 */
/* #define PREDICT 1 */
#define STATE_SIZE 1023
static double entropy=0;
static int initialized=0;
+/* This should be set to 1 only when ssleay_rand_add() is called inside
+ an already locked state, so it doesn't try to lock and thereby cause
+ a hang. And it should always be reset back to 0 before unlocking. */
+static int add_do_not_lock=0;
+
#ifdef PREDICT
int rand_predictable=0;
#endif
unsigned char local_md[MD_DIGEST_LENGTH];
MD_CTX m;
-#ifdef NORAND
- return;
-#endif
-
/*
* (Based on the rand(3) manpage)
*
* hash function.
*/
- CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+ if (!add_do_not_lock) CRYPTO_w_lock(CRYPTO_LOCK_RAND);
st_idx=state_index;
/* use our own copies of the counters so that even
md_count[1] += (num / MD_DIGEST_LENGTH) + (num % MD_DIGEST_LENGTH > 0);
- CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+ if (!add_do_not_lock) CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
for (i=0; i<num; i+=MD_DIGEST_LENGTH)
{
}
memset((char *)&m,0,sizeof(m));
- CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+ if (!add_do_not_lock) CRYPTO_w_lock(CRYPTO_LOCK_RAND);
/* Don't just copy back local_md into md -- this could mean that
* other thread's seeding remains without effect (except for
* the incremented counter). By XORing it we keep at least as
}
if (entropy < ENTROPY_NEEDED) /* stop counting when we have enough */
entropy += add;
- CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+ if (!add_do_not_lock) CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
#ifndef THREADS
assert(md_c[1] == md_count[1]);
ssleay_rand_add(buf, num, num);
}
-static void ssleay_rand_initialize(void)
- {
- unsigned long l;
-#ifndef GETPID_IS_MEANINGLESS
- pid_t curr_pid = getpid();
-#endif
-#ifdef DEVRANDOM
- FILE *fh;
-#endif
-
-#ifdef NORAND
- return;
-#endif
-
- CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
- /* put in some default random data, we need more than just this */
-#ifndef GETPID_IS_MEANINGLESS
- l=curr_pid;
- RAND_add(&l,sizeof(l),0);
- l=getuid();
- RAND_add(&l,sizeof(l),0);
-#endif
- l=time(NULL);
- RAND_add(&l,sizeof(l),0);
-
-#ifdef DEVRANDOM
- /* Use a random entropy pool device. Linux, FreeBSD and OpenBSD
- * have this. Use /dev/urandom if you can as /dev/random may block
- * if it runs out of random entries. */
-
- if ((fh = fopen(DEVRANDOM, "r")) != NULL)
- {
- unsigned char tmpbuf[ENTROPY_NEEDED];
- int n;
-
- setvbuf(fh, NULL, _IONBF, 0);
- n=fread((unsigned char *)tmpbuf,1,ENTROPY_NEEDED,fh);
- fclose(fh);
- RAND_add(tmpbuf,sizeof tmpbuf,n);
- memset(tmpbuf,0,n);
- }
-#endif
-#ifdef PURIFY
- memset(state,0,STATE_SIZE);
- memset(md,0,MD_DIGEST_LENGTH);
-#endif
- CRYPTO_w_lock(CRYPTO_LOCK_RAND);
- initialized=1;
- }
-
static int ssleay_rand_bytes(unsigned char *buf, int num)
{
+ static volatile int stirred_pool = 0;
int i,j,k,st_num,st_idx;
int ok;
long md_c[2];
#ifndef GETPID_IS_MEANINGLESS
pid_t curr_pid = getpid();
#endif
+ int do_stir_pool = 0;
#ifdef PREDICT
if (rand_predictable)
* global 'md'.
*/
- CRYPTO_w_lock(CRYPTO_LOCK_RAND);
-
if (!initialized)
- ssleay_rand_initialize();
+ RAND_poll();
+ CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+ add_do_not_lock = 1; /* Since we call ssleay_rand_add while in
+ this locked state. */
+
+ initialized = 1;
+ if (!stirred_pool)
+ do_stir_pool = 1;
+
ok = (entropy >= ENTROPY_NEEDED);
if (!ok)
{
* Once we've had enough initial seeding we don't bother to
* adjust the entropy count, though, because we're not ambitious
* to provide *information-theoretic* randomness.
+ *
+ * NOTE: This approach fails if the program forks before
+ * we have enough entropy. Entropy should be collected
+ * in a separate input pool and be transferred to the
+ * output pool only when the entropy limit has been reached.
*/
entropy -= num;
if (entropy < 0)
entropy = 0;
}
+ if (do_stir_pool)
+ {
+ /* Our output function chains only half of 'md', so we better
+ * make sure that the required entropy gets 'evenly distributed'
+ * through 'state', our randomness pool. The input function
+ * (ssleay_rand_add) chains all of 'md', which makes it more
+ * suitable for this purpose.
+ */
+
+ int n = STATE_SIZE; /* so that the complete pool gets accessed */
+ while (n > 0)
+ {
+#if MD_DIGEST_LENGTH > 20
+# error "Please adjust DUMMY_SEED."
+#endif
+#define DUMMY_SEED "...................." /* at least MD_DIGEST_LENGTH */
+ /* Note that the seed does not matter, it's just that
+ * ssleay_rand_add expects to have something to hash. */
+ ssleay_rand_add(DUMMY_SEED, MD_DIGEST_LENGTH, 0.0);
+ n -= MD_DIGEST_LENGTH;
+ }
+ if (ok)
+ stirred_pool = 1;
+ }
+
st_idx=state_index;
st_num=state_num;
md_c[0] = md_count[0];
* are now ours (but other threads may use them too) */
md_count[0] += 1;
+
+ add_do_not_lock = 0; /* If this would ever be forgotten, we can
+ expect any evil god to eat our souls. */
CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
while (num > 0)
else
{
RANDerr(RAND_F_SSLEAY_RAND_BYTES,RAND_R_PRNG_NOT_SEEDED);
+ ERR_add_error_data(1, "You need to read the OpenSSL FAQ, "
+ "http://www.openssl.org/support/faq.html");
return(0);
}
}
static int ssleay_rand_status(void)
{
- if (!initialized)
- ssleay_rand_initialize();
- return (entropy >= ENTROPY_NEEDED);
- }
+ int ret;
-#ifdef WINDOWS
-#include <windows.h>
-#include <openssl/rand.h>
-
-int RAND_event(UINT iMsg, WPARAM wParam, LPARAM lParam)
- {
- double add_entropy=0;
- SYSTEMTIME t;
-
- switch (iMsg)
- {
- case WM_KEYDOWN:
- {
- static WPARAM key;
- if (key != wParam)
- add_entropy = 0.05;
- key = wParam;
- }
- break;
- case WM_MOUSEMOVE:
- {
- static int lastx,lasty,lastdx,lastdy;
- int x,y,dx,dy;
-
- x=LOWORD(lParam);
- y=HIWORD(lParam);
- dx=lastx-x;
- dy=lasty-y;
- if (dx != 0 && dy != 0 && dx-lastdx != 0 && dy-lastdy != 0)
- entropy += .2;
- lastx=x,lasty=y;
- lastdx=dx, lastdy=dy;
- }
- break;
- }
-
- GetSystemTime(&t);
- RAND_add(&iMsg, sizeof(iMsg), add_entropy);
- RAND_add(&wParam, sizeof(wParam), 0);
- RAND_add(&lParam, sizeof(lParam), 0);
- RAND_add(&t, sizeof(t), 0);
+ if (!initialized)
+ RAND_poll();
- return (RAND_status());
- }
+ CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+ initialized = 1;
+ ret = entropy >= ENTROPY_NEEDED;
+ CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
-/*****************************************************************************
- * Initialisation function for the SSL random generator. Takes the contents
- * of the screen as random seed.
- *
- * Created 960901 by Gertjan van Oosten, gertjan@West.NL, West Consulting B.V.
- *
- * Code adapted from
- * <URL:http://www.microsoft.com/kb/developr/win_dk/q97193.htm>;
- * the original copyright message is:
- *
- * (C) Copyright Microsoft Corp. 1993. All rights reserved.
- *
- * You have a royalty-free right to use, modify, reproduce and
- * distribute the Sample Files (and/or any modified version) in
- * any way you find useful, provided that you agree that
- * Microsoft has no warranty obligations or liability for any
- * Sample Application Files which are modified.
- */
-/*
- * I have modified the loading of bytes via RAND_seed() mechanism since
- * the original would have been very very CPU intensive since RAND_seed()
- * does an MD5 per 16 bytes of input. The cost to digest 16 bytes is the same
- * as that to digest 56 bytes. So under the old system, a screen of
- * 1024*768*256 would have been CPU cost of approximately 49,000 56 byte MD5
- * digests or digesting 2.7 mbytes. What I have put in place would
- * be 48 16k MD5 digests, or effectively 48*16+48 MD5 bytes or 816 kbytes
- * or about 3.5 times as much.
- * - eric
- */
-void RAND_screen(void)
-{
- HDC hScrDC; /* screen DC */
- HDC hMemDC; /* memory DC */
- HBITMAP hBitmap; /* handle for our bitmap */
- HBITMAP hOldBitmap; /* handle for previous bitmap */
- BITMAP bm; /* bitmap properties */
- unsigned int size; /* size of bitmap */
- char *bmbits; /* contents of bitmap */
- int w; /* screen width */
- int h; /* screen height */
- int y; /* y-coordinate of screen lines to grab */
- int n = 16; /* number of screen lines to grab at a time */
-
- /* Create a screen DC and a memory DC compatible to screen DC */
- hScrDC = CreateDC("DISPLAY", NULL, NULL, NULL);
- hMemDC = CreateCompatibleDC(hScrDC);
-
- /* Get screen resolution */
- w = GetDeviceCaps(hScrDC, HORZRES);
- h = GetDeviceCaps(hScrDC, VERTRES);
-
- /* Create a bitmap compatible with the screen DC */
- hBitmap = CreateCompatibleBitmap(hScrDC, w, n);
-
- /* Select new bitmap into memory DC */
- hOldBitmap = SelectObject(hMemDC, hBitmap);
-
- /* Get bitmap properties */
- GetObject(hBitmap, sizeof(BITMAP), (LPSTR)&bm);
- size = (unsigned int)bm.bmWidthBytes * bm.bmHeight * bm.bmPlanes;
-
- bmbits = Malloc(size);
- if (bmbits) {
- /* Now go through the whole screen, repeatedly grabbing n lines */
- for (y = 0; y < h-n; y += n)
- {
- unsigned char md[MD_DIGEST_LENGTH];
-
- /* Bitblt screen DC to memory DC */
- BitBlt(hMemDC, 0, 0, w, n, hScrDC, 0, y, SRCCOPY);
-
- /* Copy bitmap bits from memory DC to bmbits */
- GetBitmapBits(hBitmap, size, bmbits);
-
- /* Get the MD5 of the bitmap */
- MD(bmbits,size,md);
-
- /* Seed the random generator with the MD5 digest */
- RAND_seed(md, MD_DIGEST_LENGTH);
+ return ret;
}
-
- Free(bmbits);
- }
-
- /* Select old bitmap back into memory DC */
- hBitmap = SelectObject(hMemDC, hOldBitmap);
-
- /* Clean up */
- DeleteObject(hBitmap);
- DeleteDC(hMemDC);
- DeleteDC(hScrDC);
-}
-#endif
projects / openssl.git / blobdiff