1 /***************************************************************************
2 * _ _ ____ _
3 * Project ___| | | | _ \| |
4 * / __| | | | |_) | |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
7 *
8 * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
9 *
10 * This software is licensed as described in the file COPYING, which
11 * you should have received as part of this distribution. The terms
12 * are also available at https://curl.haxx.se/docs/copyright.html.
13 *
14 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
15 * copies of the Software, and permit persons to whom the Software is
16 * furnished to do so, under the terms of the COPYING file.
17 *
18 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19 * KIND, either express or implied.
20 *
21 ***************************************************************************/
22
23 #include "curl_setup.h"
24
25 #include <fcntl.h>
26
27 #include <curl/curl.h>
28 #include "vtls/vtls.h"
29 #include "sendf.h"
30 #include "rand.h"
31
32 /* The last 3 #include files should be in this order */
33 #include "curl_printf.h"
34 #include "curl_memory.h"
35 #include "memdebug.h"
36
randit(struct Curl_easy * data,unsigned int * rnd)37 static CURLcode randit(struct Curl_easy *data, unsigned int *rnd)
38 {
39 unsigned int r;
40 CURLcode result = CURLE_OK;
41 static unsigned int randseed;
42 static bool seeded = FALSE;
43
44 #ifdef CURLDEBUG
45 char *force_entropy = getenv("CURL_ENTROPY");
46 if(force_entropy) {
47 if(!seeded) {
48 size_t elen = strlen(force_entropy);
49 size_t clen = sizeof(randseed);
50 size_t min = elen < clen ? elen : clen;
51 memcpy((char *)&randseed, force_entropy, min);
52 seeded = TRUE;
53 }
54 else
55 randseed++;
56 *rnd = randseed;
57 return CURLE_OK;
58 }
59 #endif
60
61 /* data may be NULL! */
62 result = Curl_ssl_random(data, (unsigned char *)&rnd, sizeof(rnd));
63 if(result != CURLE_NOT_BUILT_IN)
64 /* only if there is no random funtion in the TLS backend do the non crypto
65 version, otherwise return result */
66 return result;
67
68 /* ---- non-cryptographic version following ---- */
69
70 #ifdef RANDOM_FILE
71 if(!seeded) {
72 /* if there's a random file to read a seed from, use it */
73 int fd = open(RANDOM_FILE, O_RDONLY);
74 if(fd > -1) {
75 /* read random data into the randseed variable */
76 ssize_t nread = read(fd, &randseed, sizeof(randseed));
77 if(nread == sizeof(randseed))
78 seeded = TRUE;
79 close(fd);
80 }
81 }
82 #endif
83
84 if(!seeded) {
85 struct timeval now = curlx_tvnow();
86 infof(data, "WARNING: Using weak random seed\n");
87 randseed += (unsigned int)now.tv_usec + (unsigned int)now.tv_sec;
88 randseed = randseed * 1103515245 + 12345;
89 randseed = randseed * 1103515245 + 12345;
90 randseed = randseed * 1103515245 + 12345;
91 seeded = TRUE;
92 }
93
94 /* Return an unsigned 32-bit pseudo-random number. */
95 r = randseed = randseed * 1103515245 + 12345;
96 *rnd = (r << 16) | ((r >> 16) & 0xFFFF);
97 return CURLE_OK;
98 }
99
100 /*
101 * Curl_rand() stores 'num' number of random unsigned integers in the buffer
102 * 'rndptr' points to.
103 *
104 * If libcurl is built without TLS support or with a TLS backend that lacks a
105 * proper random API (Gskit, PolarSSL or mbedTLS), this function will use
106 * "weak" random.
107 *
108 * When built *with* TLS support and a backend that offers strong random, it
109 * will return error if it cannot provide strong random values.
110 *
111 * NOTE: 'data' may be passed in as NULL when coming from external API without
112 * easy handle!
113 *
114 */
115
Curl_rand(struct Curl_easy * data,unsigned int * rndptr,unsigned int num)116 CURLcode Curl_rand(struct Curl_easy *data, unsigned int *rndptr,
117 unsigned int num)
118 {
119 CURLcode result = CURLE_BAD_FUNCTION_ARGUMENT;
120 unsigned int i;
121
122 assert(num > 0);
123
124 for(i = 0; i < num; i++) {
125 result = randit(data, rndptr++);
126 if(result)
127 return result;
128 }
129 return result;
130 }
131