C++ RAND_poll函数代码示例

biginteger OpenSSLRSAPermutation::computeRSA(biginteger elementP) {
	ERR_load_crypto_strings();
	//SSL_load_error_strings();
	// Seed the random geneartor.
#ifdef _WIN32
	RAND_screen(); // only defined for windows, reseeds from screen contents
#else
	RAND_poll(); // reseeds using hardware state (clock, interrupts, etc).
#endif

	// Allocate a new byte array to hold the output.
	int size = RSA_size(rsa);
	std::shared_ptr<byte> ret(new byte[size], std::default_delete<byte[]>());

	size_t encodedSize = bytesCount(elementP);
	std::shared_ptr<byte> encodedBi(new byte[encodedSize], std::default_delete<byte[]>());
	encodeBigInteger(elementP, encodedBi.get(), encodedSize);
	int success = RSA_public_encrypt(encodedSize, encodedBi.get(), ret.get(), rsa, RSA_NO_PADDING);
	if (-1 == success)
	{
		string error(ERR_reason_error_string(ERR_get_error()));
		throw runtime_error("failed to compute rsa " + error);
	}
	biginteger result = decodeBigInteger(ret.get(), size);
	return result;
}

void OpenSSL::ClassInit() {
	MS_TRACE();

	MS_DEBUG("loaded openssl version: %s", SSLeay_version(SSLEAY_VERSION));

	// First initialize OpenSSL stuff.
	SSL_load_error_strings();
	SSL_library_init();
	RAND_poll();

	// Make OpenSSL thread-safe.
	OpenSSL::mutexes = new pthread_mutex_t[CRYPTO_num_locks()];
	if (! OpenSSL::mutexes)
		MS_THROW_ERROR("allocation of mutexes failed");

	OpenSSL::numMutexes = CRYPTO_num_locks();

	for (int i=0; i<OpenSSL::numMutexes; i++) {
		int err = pthread_mutex_init(&OpenSSL::mutexes[i], nullptr);
		if (err)
			MS_THROW_ERROR("pthread_mutex_init() failed with return code %d\n", err);
	}

	CRYPTO_THREADID_set_callback(OpenSSL::SetThreadId);
	CRYPTO_set_locking_callback(OpenSSL::LockingFunction);
	CRYPTO_set_dynlock_create_callback(OpenSSL::DynCreateFunction);
	CRYPTO_set_dynlock_lock_callback(OpenSSL::DynLockFunction);
	CRYPTO_set_dynlock_destroy_callback(OpenSSL::DynDestroyFunction);
}

static SSL_CTX *
evssl_init(void)
{
    SSL_CTX  *server_ctx;

    /* Initialize the OpenSSL library */
    SSL_load_error_strings();
    SSL_library_init();
    /* We MUST have entropy, or else there's no point to crypto. */
    if (!RAND_poll())
        return NULL;

    server_ctx = SSL_CTX_new(SSLv23_server_method());

    if (! SSL_CTX_use_certificate_chain_file(server_ctx, "cert") ||
            ! SSL_CTX_use_PrivateKey_file(server_ctx, "pkey", SSL_FILETYPE_PEM)) {
        puts("Couldn't read 'pkey' or 'cert' file.  To generate a key\n"
             "and self-signed certificate, run:\n"
             "  openssl genrsa -out pkey 2048\n"
             "  openssl req -new -key pkey -out cert.req\n"
             "  openssl x509 -req -days 365 -in cert.req -signkey pkey -out cert");
        return NULL;
    }
    SSL_CTX_set_options(server_ctx, SSL_OP_NO_SSLv2);

    return server_ctx;
}

void openssl_bioBS_random()
{
	int size;
	const char *p;
	unsigned char outs[SHA_DIGEST_LENGTH + 16] = { 0 };
	char buf[32], filename[COMM_LEN];

	strcpy(buf, "bioBS random");
	RAND_add(buf, 32, strlen(buf));
	strcpy(buf, "beike2012");
	RAND_seed(buf, 32);
	while (1) {
		if (RAND_status() == 1)
			break;
		else
			RAND_poll();
	}

	p = RAND_file_name(filename, COMM_LEN);
	RAND_write_file(p);
	RAND_load_file(p, MAX1_LEN);
	RAND_bytes(outs, sizeof(outs));
	printf("\nBIO_RANDOM() = ");
	for (size = 0; size < strlen((char *)&outs); size++)
		printf("%.02x", outs[size]);
	printf("\n");
	RAND_cleanup();
}

/*
 * 执行ssl请求，返回chttp_str_t *  需要释放内存
 */
chttp_str_t* chttp_ssl_request(chttp_socket_t socket, void *buffer, size_t size)
{
#if defined(_HTTPS)
	SSL_CTX *ctx = NULL;
	SSL *ssl = NULL;
	int ret = 0;
	char text[1024];
	chttp_str_t *html = NULL;

	SSL_library_init();
	SSL_load_error_strings();

	ctx = SSL_CTX_new(SSLv23_client_method());
	if (ctx == NULL)
		return NULL;

	ssl = SSL_new(ctx);
	if (ssl == NULL)
		return NULL;

	ret = SSL_set_fd(ssl, socket);
	if (0 == ret)
		return NULL;

	RAND_poll();
	while (RAND_status() == 0)
	{
		unsigned short rand_ret = rand() % 65536;
		RAND_seed(&rand_ret, sizeof(rand_ret));
	}

	ret = SSL_connect(ssl);
	if (ret != 1)
		return NULL;

	if (!(SSL_write(ssl, buffer, size)))
	{
		return NULL;
	}

	while ((ret = SSL_read(ssl, text, 1024)) > 0)
	{
		html = chttp_str_size_append(html, text, ret);
	}

	//free resource
	if (ssl)
	{
		SSL_free(ssl);
		SSL_CTX_free(ctx);
		ERR_free_strings();
	}

	return html;
#else
	printf("不支持https方式请求，请在编译的时候加入开启 _HTTPS \n");
	exit(1);
#endif
}

Global::Global() {
  SSL_library_init();
  ERR_load_CRYPTO_strings();
  SSL_load_error_strings();
  OpenSSL_add_all_algorithms();
  RAND_poll();
  event_base = event_base_new();
  dns_base = evdns_base_new(event_base, 1);
};

QByteArray KeyHelper::getRandomBytes(int bytes)
{
    RAND_poll();

    unsigned char buff1[bytes];
    memset(buff1, 0, bytes);
    RAND_bytes(buff1, bytes);
    return QByteArray::fromRawData((const char *)buff1, bytes);
}

golle_error golle_random_seed (void) {
  LOAD_HARDWARE_ENGINE;
    
  /* Only seed when needed */
  if (!RAND_status ()) {
    RAND_poll ();
  }
  return GOLLE_OK;
}

SSL_CTX *
evssl_init()
{
	DH		*dh;
	SSL_CTX		*ctx;

	SSL_load_error_strings();
	SSL_library_init();
	RAND_poll();

	if ((passport = pki_passport_load_from_file(cfg->cert,
	    cfg->pkey, cfg->tcert)) == NULL) {
		return NULL;
	}

	if ((ctx = SSL_CTX_new(TLSv1_2_client_method())) == NULL) {
		jlog(L_ERROR, "SSL_CTX_new failed");
		return NULL;
	}

	if ((dh = get_dh_1024()) == NULL) {
		jlog(L_ERROR, "get_dh_1024 failed");
		goto out;
	}

	if ((SSL_CTX_set_tmp_dh(ctx, dh)) == 0) {
		jlog(L_ERROR, "SSL_CTX_set_tmp_dh failed");
		goto out;
	}

	//SSL_CTX_set_cipher_list(ctx, "ECDHE-ECDSA-AES256-GCM-SHA384");
	if ((SSL_CTX_set_cipher_list(ctx, "AES256-GCM-SHA384")) == 0) {
		jlog(L_ERROR, "SSL_CTX_set_cipher failed");
		goto out;
	}

	SSL_CTX_set_cert_store(ctx, passport->cacert_store);

	if ((SSL_CTX_use_certificate(ctx, passport->certificate)) == 0) {
		jlog(L_ERROR, "SSL_CTX_use_certificate failed");
		goto out;
	}

	if ((SSL_CTX_use_PrivateKey(ctx, passport->keyring)) == 0) {
		jlog(L_ERROR, "SSL_CTX_use_PrivateKey failed");
		goto out;
	}

	DH_free(dh);
	return ctx;

out:
	DH_free(dh);
	SSL_CTX_free(ctx);
	return NULL;
}

static int rand_status(void)
{
    CRYPTO_THREAD_ID cur;
    int ret;
    int do_not_lock;

    if (!RUN_ONCE(&rand_lock_init, do_rand_lock_init))
        return 0;

    cur = CRYPTO_THREAD_get_current_id();
    /*
     * check if we already have the lock (could happen if a RAND_poll()
     * implementation calls RAND_status())
     */
    if (crypto_lock_rand) {
        CRYPTO_THREAD_read_lock(rand_tmp_lock);
        do_not_lock = CRYPTO_THREAD_compare_id(locking_threadid, cur);
        CRYPTO_THREAD_unlock(rand_tmp_lock);
    } else
        do_not_lock = 0;

    if (!do_not_lock) {
        CRYPTO_THREAD_write_lock(rand_lock);
        /*
         * Prevent deadlocks in case we end up in an async engine
         */
        ASYNC_block_pause();

        /*
         * prevent rand_bytes() from trying to obtain the lock again
         */
        CRYPTO_THREAD_write_lock(rand_tmp_lock);
        locking_threadid = cur;
        CRYPTO_THREAD_unlock(rand_tmp_lock);
        crypto_lock_rand = 1;
    }

    if (!initialized) {
        RAND_poll();
        initialized = 1;
    }

    ret = entropy >= ENTROPY_NEEDED;

    if (!do_not_lock) {
        /* before unlocking, we must clear 'crypto_lock_rand' */
        crypto_lock_rand = 0;

        ASYNC_unblock_pause();
        CRYPTO_THREAD_unlock(rand_lock);
    }

    return ret;
}

Global::Global() {
  SSL_library_init();
  ERR_load_CRYPTO_strings();
  SSL_load_error_strings();
  OpenSSL_add_all_algorithms();
  RAND_poll();
#ifndef _NO_LIBEVENT_THREADS
  evthread_use_pthreads();
#endif
  event_base = event_base_new();
  dns_base = evdns_base_new(event_base, 1);
};

void
ntp_crypto_srandom(
	void
	)
{
#ifdef USE_OPENSSL_CRYPTO_RAND
	if (!crypto_rand_init) {
		RAND_poll();
		crypto_rand_init = 1;
	}
#else
	/* No initialization needed for arc4random() */
#endif
}

bool SecureRNG::seed()
{
#if QT_VERSION >= 0x040700
    QElapsedTimer timer;
    timer.start();
#endif

#ifdef Q_OS_WIN
    /* RAND_poll is very unreliable on windows; with older versions of OpenSSL,
     * it can take up to several minutes to run and has been known to crash.
     * Even newer versions seem to take around 400ms, which is far too long for
     * interactive startup. Random data from the windows CSP is used as a seed
     * instead, as it should be very high quality random and fast. */
    HCRYPTPROV provider = 0;
    if (!CryptAcquireContext(&provider, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
    {
        qWarning() << "Failed to acquire CSP context for RNG seed:" << hex << GetLastError();
        return false;
    }

    /* Same amount of entropy OpenSSL uses, apparently. */
    char buf[32];

    if (!CryptGenRandom(provider, sizeof(buf), reinterpret_cast<BYTE*>(buf)))
    {
        qWarning() << "Failed to get entropy from CSP for RNG seed: " << hex << GetLastError();
        CryptReleaseContext(provider, 0);
        return false;
    }

    CryptReleaseContext(provider, 0);

    RAND_seed(buf, sizeof(buf));
    memset(buf, 0, sizeof(buf));
#else
    if (!RAND_poll())
    {
        qWarning() << "OpenSSL RNG seed failed:" << ERR_get_error();
        return false;
    }
#endif

#if QT_VERSION >= 0x040700
    qDebug() << "RNG seed took" << timer.elapsed() << "ms";
#endif

    return true;
}

static int ssleay_rand_status(void)
	{
	CRYPTO_THREADID cur;
	int ret;
	int do_not_lock;

	CRYPTO_THREADID_current(&cur);
	/* check if we already have the lock
	 * (could happen if a RAND_poll() implementation calls RAND_status()) */
	if (crypto_lock_rand)
		{
		CRYPTO_r_lock(CRYPTO_LOCK_RAND2);
		do_not_lock = !CRYPTO_THREADID_cmp(&locking_threadid, &cur);
		CRYPTO_r_unlock(CRYPTO_LOCK_RAND2);
		}
	else
		do_not_lock = 0;
	
	if (!do_not_lock)
		{
		CRYPTO_w_lock(CRYPTO_LOCK_RAND);
		
		/* prevent ssleay_rand_bytes() from trying to obtain the lock again */
		CRYPTO_w_lock(CRYPTO_LOCK_RAND2);
		CRYPTO_THREADID_cpy(&locking_threadid, &cur);
		CRYPTO_w_unlock(CRYPTO_LOCK_RAND2);
		crypto_lock_rand = 1;
		}
	
	if (!initialized)
		{
		RAND_poll();
		initialized = 1;
		}

	ret = entropy >= ENTROPY_NEEDED;

	if (!do_not_lock)
		{
		/* before unlocking, we must clear 'crypto_lock_rand' */
		crypto_lock_rand = 0;
		
		CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
		}
	
	return ret;
	}

static SSL_CTX * ssl_server_init(const char *keypath, const char *certpath)
{
    SSL_CTX *ctx;
    ENGINE *e;

    ENGINE_load_builtin_engines();
    ENGINE_register_all_complete();

    e = ENGINE_by_id("padlock");
    if (e) {
        fprintf(stderr, "[*] Using padlock engine for default ciphers\n");
        ENGINE_set_default_ciphers(ENGINE_by_id("padlock"));
        use_padlock_engine = 1;
    } else {
        fprintf(stderr, "[*] Padlock engine not available\n");
        use_padlock_engine = 0;
    }

    SSL_load_error_strings();
    SSL_library_init();

    if (!RAND_poll())
	return NULL;

    ctx = SSL_CTX_new(SSLv23_server_method());

    if (!SSL_CTX_use_certificate_chain_file(ctx, certpath) ||
	    !SSL_CTX_use_PrivateKey_file(ctx, keypath, SSL_FILETYPE_PEM)) {
	fprintf(stderr, "Could not read %s or %s file\n", keypath, certpath);
	fprintf(stderr, "To generate a key and self-signed certificate, run:\n");
	fprintf(stderr, "\topenssl genrsa -out key.pem 2048\n");
	fprintf(stderr, "\topenssl req -new -key key.pem -out cert.req\n");
	fprintf(stderr, "\topenssl x509 -req -days 365 -in cert.req -signkey key.pem -out cert.pem\n");
	return NULL;
    }

    SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);
    if (use_padlock_engine == 1) {
	if (SSL_CTX_set_cipher_list(ctx, "AES+SHA") != 1) {
	    fprintf(stderr, "Error setting client cipher list\n");
	    return NULL;
	}
    }
    return ctx;
}