1 files changed, 65 insertions, 266 deletions

diff --git a/src/lib/libcrypto/rand/md_rand.c b/src/lib/libcrypto/rand/md_rand.c
index da4258c479..d167dea77d 100644
--- a/src/lib/libcrypto/rand/md_rand.c
+++ b/src/lib/libcrypto/rand/md_rand.c
@@ -109,9 +109,7 @@
  *
  */
 
-#define ENTROPY_NEEDED 16  /* require 128 bits = 16 bytes of randomness */
-
-#ifndef MD_RAND_DEBUG
+#ifdef MD_RAND_DEBUG
 # ifndef NDEBUG
 #   define NDEBUG
 # endif
@@ -119,75 +117,20 @@
 
 #include <assert.h>
 #include <stdio.h>
-#include <time.h>
 #include <string.h>
 
 #include "openssl/e_os.h"
 
+#include <openssl/rand.h>
+#include "rand_lcl.h"
+
 #include <openssl/crypto.h>
 #include <openssl/err.h>
 
-#if !defined(USE_MD5_RAND) && !defined(USE_SHA1_RAND) && !defined(USE_MDC2_RAND) && !defined(USE_MD2_RAND)
-#if !defined(NO_SHA) && !defined(NO_SHA1)
-#define USE_SHA1_RAND
-#elif !defined(NO_MD5)
-#define USE_MD5_RAND
-#elif !defined(NO_MDC2) && !defined(NO_DES)
-#define USE_MDC2_RAND
-#elif !defined(NO_MD2)
-#define USE_MD2_RAND
-#else
-#error No message digest algorithm available
-#endif
-#endif
-
-/* Changed how the state buffer used.  I now attempt to 'wrap' such
- * that I don't run over the same locations the next time  go through
- * the 1023 bytes - many thanks to
- * Robert J. LeBlanc <rjl@renaissoft.com> for his comments
- */
-
-#if defined(USE_MD5_RAND)
-#include <openssl/md5.h>
-#define MD_DIGEST_LENGTH        MD5_DIGEST_LENGTH
-#define MD_CTX                  MD5_CTX
-#define MD_Init(a)              MD5_Init(a)
-#define MD_Update(a,b,c)        MD5_Update(a,b,c)
-#define MD_Final(a,b)           MD5_Final(a,b)
-#define MD(a,b,c)               MD5(a,b,c)
-#elif defined(USE_SHA1_RAND)
-#include <openssl/sha.h>
-#define MD_DIGEST_LENGTH        SHA_DIGEST_LENGTH
-#define MD_CTX                  SHA_CTX
-#define MD_Init(a)              SHA1_Init(a)
-#define MD_Update(a,b,c)        SHA1_Update(a,b,c)
-#define MD_Final(a,b)           SHA1_Final(a,b)
-#define MD(a,b,c)               SHA1(a,b,c)
-#elif defined(USE_MDC2_RAND)
-#include <openssl/mdc2.h>
-#define MD_DIGEST_LENGTH        MDC2_DIGEST_LENGTH
-#define MD_CTX                  MDC2_CTX
-#define MD_Init(a)              MDC2_Init(a)
-#define MD_Update(a,b,c)        MDC2_Update(a,b,c)
-#define MD_Final(a,b)           MDC2_Final(a,b)
-#define MD(a,b,c)               MDC2(a,b,c)
-#elif defined(USE_MD2_RAND)
-#include <openssl/md2.h>
-#define MD_DIGEST_LENGTH        MD2_DIGEST_LENGTH
-#define MD_CTX                  MD2_CTX
-#define MD_Init(a)              MD2_Init(a)
-#define MD_Update(a,b,c)        MD2_Update(a,b,c)
-#define MD_Final(a,b)           MD2_Final(a,b)
-#define MD(a,b,c)               MD2(a,b,c)
-#endif
-
-#include <openssl/rand.h>
-
 #ifdef BN_DEBUG
 # define PREDICT
 #endif
 
-/* #define NORAND       1 */
 /* #define PREDICT      1 */
 
 #define STATE_SIZE      1023
@@ -198,6 +141,11 @@ static long md_count[2]={0,0};
 static double entropy=0;
 static int initialized=0;
 
+/* This should be set to 1 only when ssleay_rand_add() is called inside
+   an already locked state, so it doesn't try to lock and thereby cause
+   a hang.  And it should always be reset back to 0 before unlocking. */
+static int add_do_not_lock=0;
+
 #ifdef PREDICT
 int rand_predictable=0;
 #endif
@@ -234,6 +182,7 @@ static void ssleay_rand_cleanup(void)
         md_count[0]=0;
         md_count[1]=0;
         entropy=0;
+        initialized=0;
         }
 
 static void ssleay_rand_add(const void *buf, int num, double add)
@@ -243,10 +192,6 @@ static void ssleay_rand_add(const void *buf, int num, double add)
         unsigned char local_md[MD_DIGEST_LENGTH];
         MD_CTX m;
 
-#ifdef NORAND
-        return;
-#endif
-
         /*
          * (Based on the rand(3) manpage)
          *
@@ -262,7 +207,7 @@ static void ssleay_rand_add(const void *buf, int num, double add)
          * hash function.
          */
 
-        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+        if (!add_do_not_lock) CRYPTO_w_lock(CRYPTO_LOCK_RAND);
         st_idx=state_index;
 
         /* use our own copies of the counters so that even
@@ -294,7 +239,7 @@ static void ssleay_rand_add(const void *buf, int num, double add)
 
         md_count[1] += (num / MD_DIGEST_LENGTH) + (num % MD_DIGEST_LENGTH > 0);
 
-        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+        if (!add_do_not_lock) CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
 
         for (i=0; i<num; i+=MD_DIGEST_LENGTH)
                 {
@@ -336,7 +281,7 @@ static void ssleay_rand_add(const void *buf, int num, double add)
                 }
         memset((char *)&m,0,sizeof(m));
 
-        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+        if (!add_do_not_lock) CRYPTO_w_lock(CRYPTO_LOCK_RAND);
         /* Don't just copy back local_md into md -- this could mean that
          * other thread's seeding remains without effect (except for
          * the incremented counter).  By XORing it we keep at least as
@@ -347,9 +292,9 @@ static void ssleay_rand_add(const void *buf, int num, double add)
                 }
         if (entropy < ENTROPY_NEEDED) /* stop counting when we have enough */
             entropy += add;
-        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+        if (!add_do_not_lock) CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
         
-#ifndef THREADS 
+#if !defined(THREADS) && !defined(WIN32)
         assert(md_c[1] == md_count[1]);
 #endif
         }
@@ -359,58 +304,9 @@ static void ssleay_rand_seed(const void *buf, int num)
         ssleay_rand_add(buf, num, num);
         }
 
-static void ssleay_rand_initialize(void)
-        {
-        unsigned long l;
-#ifndef GETPID_IS_MEANINGLESS
-        pid_t curr_pid = getpid();
-#endif
-#ifdef DEVRANDOM
-        FILE *fh;
-#endif
-
-#ifdef NORAND
-        return;
-#endif
-
-        CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
-        /* put in some default random data, we need more than just this */
-#ifndef GETPID_IS_MEANINGLESS
-        l=curr_pid;
-        RAND_add(&l,sizeof(l),0);
-        l=getuid();
-        RAND_add(&l,sizeof(l),0);
-#endif
-        l=time(NULL);
-        RAND_add(&l,sizeof(l),0);
-
-#ifdef DEVRANDOM
-        /* Use a random entropy pool device. Linux, FreeBSD and OpenBSD
-         * have this. Use /dev/urandom if you can as /dev/random may block
-         * if it runs out of random entries.  */
-
-        if ((fh = fopen(DEVRANDOM, "r")) != NULL)
-                {
-                unsigned char tmpbuf[ENTROPY_NEEDED];
-                int n;
-                
-                setvbuf(fh, NULL, _IONBF, 0);
-                n=fread((unsigned char *)tmpbuf,1,ENTROPY_NEEDED,fh);
-                fclose(fh);
-                RAND_add(tmpbuf,sizeof tmpbuf,n);
-                memset(tmpbuf,0,n);
-                }
-#endif
-#ifdef PURIFY
-        memset(state,0,STATE_SIZE);
-        memset(md,0,MD_DIGEST_LENGTH);
-#endif
-        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
-        initialized=1;
-        }
-
 static int ssleay_rand_bytes(unsigned char *buf, int num)
         {
+        static volatile int stirred_pool = 0;
         int i,j,k,st_num,st_idx;
         int ok;
         long md_c[2];
@@ -419,6 +315,7 @@ static int ssleay_rand_bytes(unsigned char *buf, int num)
 #ifndef GETPID_IS_MEANINGLESS
         pid_t curr_pid = getpid();
 #endif
+        int do_stir_pool = 0;
 
 #ifdef PREDICT
         if (rand_predictable)
@@ -450,11 +347,17 @@ static int ssleay_rand_bytes(unsigned char *buf, int num)
          * global 'md'.
          */
 
-        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
-
         if (!initialized)
-                ssleay_rand_initialize();
+                RAND_poll();
+
+        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+        add_do_not_lock = 1;    /* Since we call ssleay_rand_add while in
+                                   this locked state. */
 
+        initialized = 1;
+        if (!stirred_pool)
+                do_stir_pool = 1;
+        
         ok = (entropy >= ENTROPY_NEEDED);
         if (!ok)
                 {
@@ -464,12 +367,42 @@ static int ssleay_rand_bytes(unsigned char *buf, int num)
                  * Once we've had enough initial seeding we don't bother to
                  * adjust the entropy count, though, because we're not ambitious
                  * to provide *information-theoretic* randomness.
+                 *
+                 * NOTE: This approach fails if the program forks before
+                 * we have enough entropy. Entropy should be collected
+                 * in a separate input pool and be transferred to the
+                 * output pool only when the entropy limit has been reached.
                  */
                 entropy -= num;
                 if (entropy < 0)
                         entropy = 0;
                 }
 
+        if (do_stir_pool)
+                {
+                /* Our output function chains only half of 'md', so we better
+                 * make sure that the required entropy gets 'evenly distributed'
+                 * through 'state', our randomness pool.  The input function
+                 * (ssleay_rand_add) chains all of 'md', which makes it more
+                 * suitable for this purpose.
+                 */
+
+                int n = STATE_SIZE; /* so that the complete pool gets accessed */
+                while (n > 0)
+                        {
+#if MD_DIGEST_LENGTH > 20
+# error "Please adjust DUMMY_SEED."
+#endif
+#define DUMMY_SEED "...................." /* at least MD_DIGEST_LENGTH */
+                        /* Note that the seed does not matter, it's just that
+                         * ssleay_rand_add expects to have something to hash. */
+                        ssleay_rand_add(DUMMY_SEED, MD_DIGEST_LENGTH, 0.0);
+                        n -= MD_DIGEST_LENGTH;
+                        }
+                if (ok)
+                        stirred_pool = 1;
+                }
+
         st_idx=state_index;
         st_num=state_num;
         md_c[0] = md_count[0];
@@ -484,6 +417,9 @@ static int ssleay_rand_bytes(unsigned char *buf, int num)
          * are now ours (but other threads may use them too) */
 
         md_count[0] += 1;
+
+        add_do_not_lock = 0;    /* If this would ever be forgotten, we can
+                                   expect any evil god to eat our souls. */
         CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
 
         while (num > 0)
@@ -536,6 +472,8 @@ static int ssleay_rand_bytes(unsigned char *buf, int num)
         else
                 {
                 RANDerr(RAND_F_SSLEAY_RAND_BYTES,RAND_R_PRNG_NOT_SEEDED);
+                ERR_add_error_data(1, "You need to read the OpenSSL FAQ, "
+                        "http://www.openssl.org/support/faq.html");
                 return(0);
                 }
         }
@@ -561,152 +499,13 @@ static int ssleay_rand_status(void)
         {
         int ret;
 
-        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
-
         if (!initialized)
-                ssleay_rand_initialize();
-        ret = entropy >= ENTROPY_NEEDED;
+                RAND_poll();
 
+        CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+        initialized = 1;
+        ret = entropy >= ENTROPY_NEEDED;
         CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
 
         return ret;
         }
-
-#ifdef WINDOWS
-#include <windows.h>
-#include <openssl/rand.h>
-
-int RAND_event(UINT iMsg, WPARAM wParam, LPARAM lParam)
-        {
-        double add_entropy=0;
-        SYSTEMTIME t;
-
-        switch (iMsg)
-                {
-        case WM_KEYDOWN:
-                        {
-                        static WPARAM key;
-                        if (key != wParam)
-                                add_entropy = 0.05;
-                        key = wParam;
-                        }
-                        break;
-        case WM_MOUSEMOVE:
-                        {
-                        static int lastx,lasty,lastdx,lastdy;
-                        int x,y,dx,dy;
-
-                        x=LOWORD(lParam);
-                        y=HIWORD(lParam);
-                        dx=lastx-x;
-                        dy=lasty-y;
-                        if (dx != 0 && dy != 0 && dx-lastdx != 0 && dy-lastdy != 0)
-                                add_entropy=.2;
-                        lastx=x, lasty=y;
-                        lastdx=dx, lastdy=dy;
-                        }
-                break;
-                }
-
-        GetSystemTime(&t);
-        RAND_add(&iMsg, sizeof(iMsg), add_entropy);
-        RAND_add(&wParam, sizeof(wParam), 0);
-        RAND_add(&lParam, sizeof(lParam), 0);
-        RAND_add(&t, sizeof(t), 0);
-
-        return (RAND_status());
-        }
-
-/*****************************************************************************
- * Initialisation function for the SSL random generator.  Takes the contents
- * of the screen as random seed.
- *
- * Created 960901 by Gertjan van Oosten, gertjan@West.NL, West Consulting B.V.
- *
- * Code adapted from
- * <URL:http://www.microsoft.com/kb/developr/win_dk/q97193.htm>;
- * the original copyright message is:
- *
- *   (C) Copyright Microsoft Corp. 1993.  All rights reserved.
- *
- *   You have a royalty-free right to use, modify, reproduce and
- *   distribute the Sample Files (and/or any modified version) in
- *   any way you find useful, provided that you agree that
- *   Microsoft has no warranty obligations or liability for any
- *   Sample Application Files which are modified.
- */
-/*
- * I have modified the loading of bytes via RAND_seed() mechanism since
- * the original would have been very very CPU intensive since RAND_seed()
- * does an MD5 per 16 bytes of input.  The cost to digest 16 bytes is the same
- * as that to digest 56 bytes.  So under the old system, a screen of
- * 1024*768*256 would have been CPU cost of approximately 49,000 56 byte MD5
- * digests or digesting 2.7 mbytes.  What I have put in place would
- * be 48 16k MD5 digests, or effectively 48*16+48 MD5 bytes or 816 kbytes
- * or about 3.5 times as much.
- * - eric 
- */
-void RAND_screen(void)
-{
-  HDC           hScrDC;         /* screen DC */
-  HDC           hMemDC;         /* memory DC */
-  HBITMAP       hBitmap;        /* handle for our bitmap */
-  HBITMAP       hOldBitmap;     /* handle for previous bitmap */
-  BITMAP        bm;             /* bitmap properties */
-  unsigned int  size;           /* size of bitmap */
-  char          *bmbits;        /* contents of bitmap */
-  int           w;              /* screen width */
-  int           h;              /* screen height */
-  int           y;              /* y-coordinate of screen lines to grab */
-  int           n = 16;         /* number of screen lines to grab at a time */
-
-  /* Create a screen DC and a memory DC compatible to screen DC */
-  hScrDC = CreateDC("DISPLAY", NULL, NULL, NULL);
-  hMemDC = CreateCompatibleDC(hScrDC);
-
-  /* Get screen resolution */
-  w = GetDeviceCaps(hScrDC, HORZRES);
-  h = GetDeviceCaps(hScrDC, VERTRES);
-
-  /* Create a bitmap compatible with the screen DC */
-  hBitmap = CreateCompatibleBitmap(hScrDC, w, n);
-
-  /* Select new bitmap into memory DC */
-  hOldBitmap = SelectObject(hMemDC, hBitmap);
-
-  /* Get bitmap properties */
-  GetObject(hBitmap, sizeof(BITMAP), (LPSTR)&bm);
-  size = (unsigned int)bm.bmWidthBytes * bm.bmHeight * bm.bmPlanes;
-
-  bmbits = Malloc(size);
-  if (bmbits) {
-    /* Now go through the whole screen, repeatedly grabbing n lines */
-    for (y = 0; y < h-n; y += n)
-        {
-        unsigned char md[MD_DIGEST_LENGTH];
-
-        /* Bitblt screen DC to memory DC */
-        BitBlt(hMemDC, 0, 0, w, n, hScrDC, 0, y, SRCCOPY);
-
-        /* Copy bitmap bits from memory DC to bmbits */
-        GetBitmapBits(hBitmap, size, bmbits);
-
-        /* Get the MD5 of the bitmap */
-        MD(bmbits,size,md);
-
-        /* Seed the random generator with the MD5 digest */
-        RAND_seed(md, MD_DIGEST_LENGTH);
-        }
-
-    Free(bmbits);
-  }
-
-  /* Select old bitmap back into memory DC */
-  hBitmap = SelectObject(hMemDC, hOldBitmap);
-
-  /* Clean up */
-  DeleteObject(hBitmap);
-  DeleteDC(hMemDC);
-  DeleteDC(hScrDC);
-}
-#endif