234 lines
6.7 KiB
C
234 lines
6.7 KiB
C
/*
|
|
* util/random.c - thread safe random generator, which is reasonably secure.
|
|
*
|
|
* Copyright (c) 2007, NLnet Labs. All rights reserved.
|
|
*
|
|
* This software is open source.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
*
|
|
* Redistributions of source code must retain the above copyright notice,
|
|
* this list of conditions and the following disclaimer.
|
|
*
|
|
* Redistributions in binary form must reproduce the above copyright notice,
|
|
* this list of conditions and the following disclaimer in the documentation
|
|
* and/or other materials provided with the distribution.
|
|
*
|
|
* Neither the name of the NLNET LABS nor the names of its contributors may
|
|
* be used to endorse or promote products derived from this software without
|
|
* specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
|
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
|
* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
|
|
* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
|
|
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
|
|
* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
|
|
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
|
|
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
/**
|
|
* \file
|
|
* Thread safe random functions. Similar to arc4random() with an explicit
|
|
* initialisation routine.
|
|
*
|
|
* The code in this file is based on arc4random from
|
|
* openssh-4.0p1/openbsd-compat/bsd-arc4random.c
|
|
* That code is also BSD licensed. Here is their statement:
|
|
*
|
|
* Copyright (c) 1996, David Mazieres <dm@uun.org>
|
|
* Copyright (c) 2008, Damien Miller <djm@openbsd.org>
|
|
*
|
|
* Permission to use, copy, modify, and distribute this software for any
|
|
* purpose with or without fee is hereby granted, provided that the above
|
|
* copyright notice and this permission notice appear in all copies.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
|
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
*/
|
|
#include "config.h"
|
|
#include "util/random.h"
|
|
#include "util/log.h"
|
|
#include <time.h>
|
|
|
|
#ifdef HAVE_NSS
|
|
/* nspr4 */
|
|
#include "prerror.h"
|
|
/* nss3 */
|
|
#include "secport.h"
|
|
#include "pk11pub.h"
|
|
#elif defined(HAVE_NETTLE)
|
|
#include "yarrow.h"
|
|
#endif
|
|
|
|
/**
|
|
* Max random value. Similar to RAND_MAX, but more portable
|
|
* (mingw uses only 15 bits random).
|
|
*/
|
|
#define MAX_VALUE 0x7fffffff
|
|
|
|
#if defined(HAVE_SSL)
|
|
void
|
|
ub_systemseed(unsigned int ATTR_UNUSED(seed))
|
|
{
|
|
/* arc4random_uniform does not need seeds, it gets kernel entropy */
|
|
}
|
|
|
|
struct ub_randstate*
|
|
ub_initstate(unsigned int ATTR_UNUSED(seed),
|
|
struct ub_randstate* ATTR_UNUSED(from))
|
|
{
|
|
struct ub_randstate* s = (struct ub_randstate*)malloc(1);
|
|
if(!s) {
|
|
log_err("malloc failure in random init");
|
|
return NULL;
|
|
}
|
|
return s;
|
|
}
|
|
|
|
long int
|
|
ub_random(struct ub_randstate* ATTR_UNUSED(s))
|
|
{
|
|
/* This relies on MAX_VALUE being 0x7fffffff. */
|
|
return (long)arc4random() & MAX_VALUE;
|
|
}
|
|
|
|
long int
|
|
ub_random_max(struct ub_randstate* state, long int x)
|
|
{
|
|
(void)state;
|
|
/* on OpenBSD, this does not need _seed(), or _stir() calls */
|
|
return (long)arc4random_uniform((uint32_t)x);
|
|
}
|
|
|
|
#elif defined(HAVE_NSS)
|
|
|
|
/* not much to remember for NSS since we use its pk11_random, placeholder */
|
|
struct ub_randstate {
|
|
int ready;
|
|
};
|
|
|
|
void ub_systemseed(unsigned int ATTR_UNUSED(seed))
|
|
{
|
|
}
|
|
|
|
struct ub_randstate* ub_initstate(unsigned int ATTR_UNUSED(seed),
|
|
struct ub_randstate* ATTR_UNUSED(from))
|
|
{
|
|
struct ub_randstate* s = (struct ub_randstate*)calloc(1, sizeof(*s));
|
|
if(!s) {
|
|
log_err("malloc failure in random init");
|
|
return NULL;
|
|
}
|
|
return s;
|
|
}
|
|
|
|
long int ub_random(struct ub_randstate* ATTR_UNUSED(state))
|
|
{
|
|
long int x;
|
|
/* random 31 bit value. */
|
|
SECStatus s = PK11_GenerateRandom((unsigned char*)&x, (int)sizeof(x));
|
|
if(s != SECSuccess) {
|
|
log_err("PK11_GenerateRandom error: %s",
|
|
PORT_ErrorToString(PORT_GetError()));
|
|
}
|
|
return x & MAX_VALUE;
|
|
}
|
|
|
|
#elif defined(HAVE_NETTLE)
|
|
|
|
/**
|
|
* libnettle implements a Yarrow-256 generator (SHA256 + AES),
|
|
* and we have to ensure it is seeded before use.
|
|
*/
|
|
struct ub_randstate {
|
|
struct yarrow256_ctx ctx;
|
|
int seeded;
|
|
};
|
|
|
|
void ub_systemseed(unsigned int ATTR_UNUSED(seed))
|
|
{
|
|
/**
|
|
* We seed on init and not here, as we need the ctx to re-seed.
|
|
* This also means that re-seeding is not supported.
|
|
*/
|
|
log_err("Re-seeding not supported, generator untouched");
|
|
}
|
|
|
|
struct ub_randstate* ub_initstate(unsigned int seed,
|
|
struct ub_randstate* ATTR_UNUSED(from))
|
|
{
|
|
struct ub_randstate* s = (struct ub_randstate*)calloc(1, sizeof(*s));
|
|
uint8_t buf[YARROW256_SEED_FILE_SIZE];
|
|
if(!s) {
|
|
log_err("malloc failure in random init");
|
|
return NULL;
|
|
}
|
|
/* Setup Yarrow context */
|
|
yarrow256_init(&s->ctx, 0, NULL);
|
|
|
|
if(getentropy(buf, sizeof(buf)) != -1) {
|
|
/* got entropy */
|
|
yarrow256_seed(&s->ctx, YARROW256_SEED_FILE_SIZE, buf);
|
|
s->seeded = yarrow256_is_seeded(&s->ctx);
|
|
} else {
|
|
/* Stretch the uint32 input seed and feed it to Yarrow */
|
|
uint32_t v = seed;
|
|
size_t i;
|
|
for(i=0; i < (YARROW256_SEED_FILE_SIZE/sizeof(seed)); i++) {
|
|
memmove(buf+i*sizeof(seed), &v, sizeof(seed));
|
|
v = v*seed + (uint32_t)i;
|
|
}
|
|
yarrow256_seed(&s->ctx, YARROW256_SEED_FILE_SIZE, buf);
|
|
s->seeded = yarrow256_is_seeded(&s->ctx);
|
|
}
|
|
|
|
return s;
|
|
}
|
|
|
|
long int ub_random(struct ub_randstate* s)
|
|
{
|
|
/* random 31 bit value. */
|
|
long int x = 0;
|
|
if (!s || !s->seeded) {
|
|
log_err("Couldn't generate randomness, Yarrow-256 generator not yet seeded");
|
|
} else {
|
|
yarrow256_random(&s->ctx, sizeof(x), (uint8_t *)&x);
|
|
}
|
|
return x & MAX_VALUE;
|
|
}
|
|
#endif /* HAVE_SSL or HAVE_NSS or HAVE_NETTLE */
|
|
|
|
|
|
#if defined(HAVE_NSS) || defined(HAVE_NETTLE)
|
|
long int
|
|
ub_random_max(struct ub_randstate* state, long int x)
|
|
{
|
|
/* make sure we fetch in a range that is divisible by x. ignore
|
|
* values from d .. MAX_VALUE, instead draw a new number */
|
|
long int d = MAX_VALUE - (MAX_VALUE % x); /* d is divisible by x */
|
|
long int v = ub_random(state);
|
|
while(d <= v)
|
|
v = ub_random(state);
|
|
return (v % x);
|
|
}
|
|
#endif /* HAVE_NSS or HAVE_NETTLE */
|
|
|
|
void
|
|
ub_randfree(struct ub_randstate* s)
|
|
{
|
|
free(s);
|
|
/* user app must do RAND_cleanup(); */
|
|
}
|