/*

 * util/random.c - thread safe random generator, which is reasonably secure.

 * 

 * Copyright (c) 2007, NLnet Labs. All rights reserved.

 * 

 * This software is open source.

 * 

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 

 * Redistributions of source code must retain the above copyright notice,

 * this list of conditions and the following disclaimer.

 * 

 * Redistributions in binary form must reproduce the above copyright notice,

 * this list of conditions and the following disclaimer in the documentation

 * and/or other materials provided with the distribution.

 * 

 * Neither the name of the NLNET LABS nor the names of its contributors may

 * be used to endorse or promote products derived from this software without

 * specific prior written permission.

 * 

 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED

 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF

 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */

/**

 * \file

 * Thread safe random functions. Similar to arc4random() with an explicit

 * initialisation routine.

 *

 * The code in this file is based on arc4random from

 * openssh-4.0p1/openbsd-compat/bsd-arc4random.c

 * That code is also BSD licensed. Here is their statement:

 *

 * Copyright (c) 1996, David Mazieres <dm@uun.org>

 * Copyright (c) 2008, Damien Miller <djm@openbsd.org>

 *

 * Permission to use, copy, modify, and distribute this software for any

 * purpose with or without fee is hereby granted, provided that the above

 * copyright notice and this permission notice appear in all copies.

 *

 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 */

#include "config.h"

#include "util/random.h"

#include "util/log.h"

#include <time.h>

#ifdef HAVE_NSS

/* nspr4 */

#include "prerror.h"

/* nss3 */

#include "secport.h"

#include "pk11pub.h"

#elif defined(HAVE_NETTLE)

#include "yarrow.h"

#endif

/** 

 * Max random value.  Similar to RAND_MAX, but more portable

 * (mingw uses only 15 bits random).

 */

#define MAX_VALUE 0x7fffffff

/* If the build mode is for fuzzing this removes randomness from the output.

 * This helps fuzz engines from having state increase due to the randomness. */

#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION

struct ub_randstate {

       unsigned int dummy;

};

struct ub_randstate* ub_initstate(struct ub_randstate* ATTR_UNUSED(from))

{

       struct ub_randstate* s = (struct ub_randstate*)calloc(1, sizeof(*s));

       if(!s) {

               log_err("malloc failure in random init");

               return NULL;

       }

       return s;

}

long int ub_random(struct ub_randstate* state)

{

       state->dummy++;

       return (long int)(state->dummy & MAX_VALUE);

}

long int

ub_random_max(struct ub_randstate* state, long int x)

{

       state->dummy++;

       return ((long int)state->dummy % x);

}

#else /* !FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */

#if defined(HAVE_SSL) || defined(HAVE_LIBBSD)

struct ub_randstate* 

ub_initstate(struct ub_randstate* ATTR_UNUSED(from))

{

  struct ub_randstate* s = (struct ub_randstate*)malloc(1);

  if(!s) {

    log_err("malloc failure in random init");

    return NULL;

  }

  return s;

}

long int 

ub_random(struct ub_randstate* ATTR_UNUSED(s))

{

  /* This relies on MAX_VALUE being 0x7fffffff. */

  return (long)arc4random() & MAX_VALUE;

}

long int

ub_random_max(struct ub_randstate* state, long int x)

{

  (void)state;

  /* on OpenBSD, this does not need _seed(), or _stir() calls */

  return (long)arc4random_uniform((uint32_t)x);

}

#elif defined(HAVE_NSS)

/* not much to remember for NSS since we use its pk11_random, placeholder */

struct ub_randstate {

  int ready;

};

struct ub_randstate* ub_initstate(struct ub_randstate* ATTR_UNUSED(from))

{

  struct ub_randstate* s = (struct ub_randstate*)calloc(1, sizeof(*s));

  if(!s) {

    log_err("malloc failure in random init");

    return NULL;

  }

  return s;

}

long int ub_random(struct ub_randstate* ATTR_UNUSED(state))

{

  long int x;

  /* random 31 bit value. */

  SECStatus s = PK11_GenerateRandom((unsigned char*)&x, (int)sizeof(x));

  if(s != SECSuccess) {

    /* unbound needs secure randomness for randomized

     * ID bits and port numbers in packets to upstream servers */

    fatal_exit("PK11_GenerateRandom error: %s",

      PORT_ErrorToString(PORT_GetError()));

  }

  return x & MAX_VALUE;

}

#elif defined(HAVE_NETTLE)

/**

 * libnettle implements a Yarrow-256 generator (SHA256 + AES),

 * and we have to ensure it is seeded before use.

 */

struct ub_randstate {

  struct yarrow256_ctx ctx;

  int seeded;

};

struct ub_randstate* ub_initstate(struct ub_randstate* ATTR_UNUSED(from))

{

  struct ub_randstate* s = (struct ub_randstate*)calloc(1, sizeof(*s));

  uint8_t buf[YARROW256_SEED_FILE_SIZE];

  if(!s) {

    log_err("malloc failure in random init");

    return NULL;

  }

  /* Setup Yarrow context */

  yarrow256_init(&s->ctx, 0, NULL);

  if(getentropy(buf, sizeof(buf)) != -1) {

    /* got entropy */

    yarrow256_seed(&s->ctx, YARROW256_SEED_FILE_SIZE, buf);

    s->seeded = yarrow256_is_seeded(&s->ctx);

  } else {

    log_err("nettle random(yarrow) cannot initialize, "

      "getentropy failed: %s", strerror(errno));

    free(s);

    return NULL;

  }

  return s;

}

long int ub_random(struct ub_randstate* s)

{

  /* random 31 bit value. */

  long int x = 0;

  if (!s || !s->seeded) {

    log_err("Couldn't generate randomness, Yarrow-256 generator not yet seeded");

  } else {

    yarrow256_random(&s->ctx, sizeof(x), (uint8_t *)&x);

  }

  return x & MAX_VALUE;

}

#endif /* HAVE_SSL or HAVE_LIBBSD or HAVE_NSS or HAVE_NETTLE */

#if defined(HAVE_NSS) || defined(HAVE_NETTLE) && !defined(HAVE_LIBBSD)

long int

ub_random_max(struct ub_randstate* state, long int x)

{

  /* make sure we fetch in a range that is divisible by x. ignore

   * values from d .. MAX_VALUE, instead draw a new number */

  long int d = MAX_VALUE - (MAX_VALUE % x); /* d is divisible by x */

  long int v = ub_random(state);

  while(d <= v)

    v = ub_random(state);

  return (v % x);

}

#endif /* HAVE_NSS or HAVE_NETTLE and !HAVE_LIBBSD */

#endif /* FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */

void 

ub_randfree(struct ub_randstate* s)

{

  free(s);

  /* user app must do RAND_cleanup(); */

}