Fixes for deallocation races, unpercolated errors, and gating flubs in
random.c/rng_bank.c:
* Move the NextStir aperture into WC_RNG;
* Add must-succeed DRBG health checks to new reseed APIs;
* Fix the DRBG health test error codes for consistency and specificity.
* Fixes for previously unrecovered internal SHA failures in low level DRBG
implementations (WOLFSSL_SMALL_STACK_CACHE builds only).
* Add WC_RNG_BANK_HAVE_ROOT_RNG, and consistently pivot on it throughout
wolfssl/wolfcrypt/rng_bank.h and wolfcrypt/src/rng_bank.c.
Details:
* Relocate nextStir/nextStirLen from DRBG_internal/DRBG_SHA512_internal to
WC_RNG itself, fixing a deallocation race in wc_RNG_DRBG_NextStirStore()
* The stir is generic, not DRBG-specific, making this refactor natural.
* Splits stir functionality out of wc_RNG_DRBG_NextSeedNow_Nonce_local() into
wc_RNG_DRBG_NextStirNow_local(), streamlining both.
* Pending stir material now survives DRBG reinstantiation and
condemnation-recovery reinit -- this fixes the deallocation race in
wc_RNG_DRBG_NextStirStore().
* WC_DRBG_NEXT_STIR_LEN renamed to WC_RNG_NEXT_STIR_LEN to reflect flavor independence.
* Health-test error codes:
* DRBG_CONT_FAILURE now means exactly one thing -- a ConstantCompare mismatch
in wc_RNG_HealthTestLocal(), its sole producer, signifying unrecoverable
back end cryptographic failure.
* The _ex_internal helpers return DRBG_FAILURE or BAD_FUNC_ARG rather than
blanket WC_FAILURE (generic -1).
* PollAndReSeed() propagates instead of collapsing codes together, with
percolation of distinct root causes (MEMORY_E, ENTROPY_RT_E, ENTROPY_APT_E,
seed-source errors), while positive protocol-domain codes (DRBG_FAILURE,
DRBG_CONT_FAILURE, etc.) are translated at the public boundaries.
* rng->status carries the disposition, while return carries the cause.
* Note that wc_RNG_HealthTest(_ex) with a wrong-size output now returns
BAD_FUNC_ARG, whereas previously it returned generic -1.
* Reseed error handling in wc_RNG_DRBG_Reseed_Now() and
wc_RNG_DRBG_NextSeedNow_Nonce_local():
* Fixed to force rng->status to DRBG_CONT_FAILED on KAT mismatch
(deterministic, non-retryable), returning DRBG_CONT_FIPS_E.
* Seed source failure fixed for consistency with wc_RNG_GenerateBlock(): force
rng->status to DRBG_FAILED when the reseed counter is exhausted. The seed
failure code is returned verbatim unless it is an internal code
(DRBG_FAILURE, DRBG_NO_SEED_CB, etc.), in which case RNG_FAILURE_E or
NOT_READY_E is returned, depending on whether the RNG was condemned for
failed mandatory reseed.
* Fix failure paths in Hash_df/Hash_gen/Hash_DRBG_Generate (both DRBG flavors)
in WOLFSSL_SMALL_STACK_CACHE builds:
* Unconditionally reset the cached hash context via
wc_Sha256Reset()/wc_Sha512Reset(), so a failed operation cannot leave a
partially updated context for the next use.
* Back story: wc_Sha256Final()/wc_Sha512Final() are only reachable if previous
SHA calls all succeed; on midstream failure, the existing code left the SHA
object in an indeterminate state.
* WC_RNG_BANK_HAVE_ROOT_RNG is added as a consistent marker that struct
wc_rng_bank has a root_rng member. The new macro is used to assure proper
initialization and teardown along with the bank.
3ecfc6df16