RubyGems - grpc - Versions diffs - 1.21.0 → 1.32.0 - Mend

grpc 1.21.0 → 1.32.0

Potentially problematic release.

This version of grpc might be problematic. Click here for more details.

Files changed (1843) hide show

data/third_party/boringssl/crypto/fipsmodule/rand/ctrdrbg.c DELETED

@@ -1,202 +0,0 @@
-/* Copyright (c) 2017, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
-#include <openssl/rand.h>
-#include <openssl/type_check.h>
-#include <openssl/mem.h>
-#include "internal.h"
-#include "../cipher/internal.h"
-// Section references in this file refer to SP 800-90Ar1:
-// http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf
-// See table 3.
-static const uint64_t kMaxReseedCount = UINT64_C(1) << 48;
-int CTR_DRBG_init(CTR_DRBG_STATE *drbg,
-                  const uint8_t entropy[CTR_DRBG_ENTROPY_LEN],
-                  const uint8_t *personalization, size_t personalization_len) {
-  // Section 10.2.1.3.1
-  if (personalization_len > CTR_DRBG_ENTROPY_LEN) {
-    return 0;
-  }
-  uint8_t seed_material[CTR_DRBG_ENTROPY_LEN];
-  OPENSSL_memcpy(seed_material, entropy, CTR_DRBG_ENTROPY_LEN);
-  for (size_t i = 0; i < personalization_len; i++) {
-    seed_material[i] ^= personalization[i];
-  }
-  // Section 10.2.1.2
-  // kInitMask is the result of encrypting blocks with big-endian value 1, 2
-  // and 3 with the all-zero AES-256 key.
-  static const uint8_t kInitMask[CTR_DRBG_ENTROPY_LEN] = {
-      0x53, 0x0f, 0x8a, 0xfb, 0xc7, 0x45, 0x36, 0xb9, 0xa9, 0x63, 0xb4, 0xf1,
-      0xc4, 0xcb, 0x73, 0x8b, 0xce, 0xa7, 0x40, 0x3d, 0x4d, 0x60, 0x6b, 0x6e,
-      0x07, 0x4e, 0xc5, 0xd3, 0xba, 0xf3, 0x9d, 0x18, 0x72, 0x60, 0x03, 0xca,
-      0x37, 0xa6, 0x2a, 0x74, 0xd1, 0xa2, 0xf5, 0x8e, 0x75, 0x06, 0x35, 0x8e,
-  };
-  for (size_t i = 0; i < sizeof(kInitMask); i++) {
-    seed_material[i] ^= kInitMask[i];
-  }
-  drbg->ctr = aes_ctr_set_key(&drbg->ks, NULL, &drbg->block, seed_material, 32);
-  OPENSSL_memcpy(drbg->counter.bytes, seed_material + 32, 16);
-  drbg->reseed_counter = 1;
-  return 1;
-}
-OPENSSL_COMPILE_ASSERT(CTR_DRBG_ENTROPY_LEN % AES_BLOCK_SIZE == 0,
-                       not_a_multiple_of_block_size);
-// ctr_inc adds |n| to the last four bytes of |drbg->counter|, treated as a
-// big-endian number.
-static void ctr32_add(CTR_DRBG_STATE *drbg, uint32_t n) {
-  drbg->counter.words[3] =
-      CRYPTO_bswap4(CRYPTO_bswap4(drbg->counter.words[3]) + n);
-}
-static int ctr_drbg_update(CTR_DRBG_STATE *drbg, const uint8_t *data,
-                           size_t data_len) {
-  // Per section 10.2.1.2, |data_len| must be |CTR_DRBG_ENTROPY_LEN|. Here, we
-  // allow shorter inputs and right-pad them with zeros. This is equivalent to
-  // the specified algorithm but saves a copy in |CTR_DRBG_generate|.
-  if (data_len > CTR_DRBG_ENTROPY_LEN) {
-    return 0;
-  }
-  uint8_t temp[CTR_DRBG_ENTROPY_LEN];
-  for (size_t i = 0; i < CTR_DRBG_ENTROPY_LEN; i += AES_BLOCK_SIZE) {
-    ctr32_add(drbg, 1);
-    drbg->block(drbg->counter.bytes, temp + i, &drbg->ks);
-  }
-  for (size_t i = 0; i < data_len; i++) {
-    temp[i] ^= data[i];
-  }
-  drbg->ctr = aes_ctr_set_key(&drbg->ks, NULL, &drbg->block, temp, 32);
-  OPENSSL_memcpy(drbg->counter.bytes, temp + 32, 16);
-  return 1;
-}
-int CTR_DRBG_reseed(CTR_DRBG_STATE *drbg,
-                    const uint8_t entropy[CTR_DRBG_ENTROPY_LEN],
-                    const uint8_t *additional_data,
-                    size_t additional_data_len) {
-  // Section 10.2.1.4
-  uint8_t entropy_copy[CTR_DRBG_ENTROPY_LEN];
-  if (additional_data_len > 0) {
-    if (additional_data_len > CTR_DRBG_ENTROPY_LEN) {
-      return 0;
-    }
-    OPENSSL_memcpy(entropy_copy, entropy, CTR_DRBG_ENTROPY_LEN);
-    for (size_t i = 0; i < additional_data_len; i++) {
-      entropy_copy[i] ^= additional_data[i];
-    }
-    entropy = entropy_copy;
-  }
-  if (!ctr_drbg_update(drbg, entropy, CTR_DRBG_ENTROPY_LEN)) {
-    return 0;
-  }
-  drbg->reseed_counter = 1;
-  return 1;
-}
-int CTR_DRBG_generate(CTR_DRBG_STATE *drbg, uint8_t *out, size_t out_len,
-                      const uint8_t *additional_data,
-                      size_t additional_data_len) {
-  // See 9.3.1
-  if (out_len > CTR_DRBG_MAX_GENERATE_LENGTH) {
-    return 0;
-  }
-  // See 10.2.1.5.1
-  if (drbg->reseed_counter > kMaxReseedCount) {
-    return 0;
-  }
-  if (additional_data_len != 0 &&
-      !ctr_drbg_update(drbg, additional_data, additional_data_len)) {
-    return 0;
-  }
-  // kChunkSize is used to interact better with the cache. Since the AES-CTR
-  // code assumes that it's encrypting rather than just writing keystream, the
-  // buffer has to be zeroed first. Without chunking, large reads would zero
-  // the whole buffer, flushing the L1 cache, and then do another pass (missing
-  // the cache every time) to “encrypt” it. The code can avoid this by
-  // chunking.
-  static const size_t kChunkSize = 8 * 1024;
-  while (out_len >= AES_BLOCK_SIZE) {
-    size_t todo = kChunkSize;
-    if (todo > out_len) {
-      todo = out_len;
-    }
-    todo &= ~(AES_BLOCK_SIZE-1);
-    const size_t num_blocks = todo / AES_BLOCK_SIZE;
-    if (drbg->ctr) {
-      OPENSSL_memset(out, 0, todo);
-      ctr32_add(drbg, 1);
-      drbg->ctr(out, out, num_blocks, &drbg->ks, drbg->counter.bytes);
-      ctr32_add(drbg, num_blocks - 1);
-    } else {
-      for (size_t i = 0; i < todo; i += AES_BLOCK_SIZE) {
-        ctr32_add(drbg, 1);
-        drbg->block(drbg->counter.bytes, out + i, &drbg->ks);
-      }
-    }
-    out += todo;
-    out_len -= todo;
-  }
-  if (out_len > 0) {
-    uint8_t block[AES_BLOCK_SIZE];
-    ctr32_add(drbg, 1);
-    drbg->block(drbg->counter.bytes, block, &drbg->ks);
-    OPENSSL_memcpy(out, block, out_len);
-  }
-  // Right-padding |additional_data| in step 2.2 is handled implicitly by
-  // |ctr_drbg_update|, to save a copy.
-  if (!ctr_drbg_update(drbg, additional_data, additional_data_len)) {
-    return 0;
-  }
-  drbg->reseed_counter++;
-  return 1;
-}
-void CTR_DRBG_clear(CTR_DRBG_STATE *drbg) {
-  OPENSSL_cleanse(drbg, sizeof(CTR_DRBG_STATE));
-}

data/third_party/boringssl/crypto/fipsmodule/rand/internal.h DELETED

@@ -1,92 +0,0 @@
-/* Copyright (c) 2015, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
-#ifndef OPENSSL_HEADER_CRYPTO_RAND_INTERNAL_H
-#define OPENSSL_HEADER_CRYPTO_RAND_INTERNAL_H
-#include <openssl/aes.h>
-#include "../../internal.h"
-#include "../modes/internal.h"
-#if defined(__cplusplus)
-extern "C" {
-#endif
-// RAND_bytes_with_additional_data samples from the RNG after mixing 32 bytes
-// from |user_additional_data| in.
-void RAND_bytes_with_additional_data(uint8_t *out, size_t out_len,
-                                     const uint8_t user_additional_data[32]);
-// CRYPTO_sysrand fills |len| bytes at |buf| with entropy from the operating
-// system.
-void CRYPTO_sysrand(uint8_t *buf, size_t len);
-// rand_fork_unsafe_buffering_enabled returns whether fork-unsafe buffering has
-// been enabled via |RAND_enable_fork_unsafe_buffering|.
-int rand_fork_unsafe_buffering_enabled(void);
-// CTR_DRBG_STATE contains the state of a CTR_DRBG based on AES-256. See SP
-// 800-90Ar1.
-typedef struct {
-  AES_KEY ks;
-  block128_f block;
-  ctr128_f ctr;
-  union {
-    uint8_t bytes[16];
-    uint32_t words[4];
-  } counter;
-  uint64_t reseed_counter;
-} CTR_DRBG_STATE;
-// See SP 800-90Ar1, table 3.
-#define CTR_DRBG_ENTROPY_LEN 48
-#define CTR_DRBG_MAX_GENERATE_LENGTH 65536
-// CTR_DRBG_init initialises |*drbg| given |CTR_DRBG_ENTROPY_LEN| bytes of
-// entropy in |entropy| and, optionally, a personalization string up to
-// |CTR_DRBG_ENTROPY_LEN| bytes in length. It returns one on success and zero
-// on error.
-OPENSSL_EXPORT int CTR_DRBG_init(CTR_DRBG_STATE *drbg,
-                                 const uint8_t entropy[CTR_DRBG_ENTROPY_LEN],
-                                 const uint8_t *personalization,
-                                 size_t personalization_len);
-// CTR_DRBG_reseed reseeds |drbg| given |CTR_DRBG_ENTROPY_LEN| bytes of entropy
-// in |entropy| and, optionally, up to |CTR_DRBG_ENTROPY_LEN| bytes of
-// additional data. It returns one on success or zero on error.
-OPENSSL_EXPORT int CTR_DRBG_reseed(CTR_DRBG_STATE *drbg,
-                                   const uint8_t entropy[CTR_DRBG_ENTROPY_LEN],
-                                   const uint8_t *additional_data,
-                                   size_t additional_data_len);
-// CTR_DRBG_generate processes to up |CTR_DRBG_ENTROPY_LEN| bytes of additional
-// data (if any) and then writes |out_len| random bytes to |out|, where
-// |out_len| <= |CTR_DRBG_MAX_GENERATE_LENGTH|. It returns one on success or
-// zero on error.
-OPENSSL_EXPORT int CTR_DRBG_generate(CTR_DRBG_STATE *drbg, uint8_t *out,
-                                     size_t out_len,
-                                     const uint8_t *additional_data,
-                                     size_t additional_data_len);
-// CTR_DRBG_clear zeroises the state of |drbg|.
-OPENSSL_EXPORT void CTR_DRBG_clear(CTR_DRBG_STATE *drbg);
-#if defined(__cplusplus)
-}  // extern C
-#endif
-#endif  // OPENSSL_HEADER_CRYPTO_RAND_INTERNAL_H

data/third_party/boringssl/crypto/fipsmodule/rand/rand.c DELETED

@@ -1,358 +0,0 @@
-/* Copyright (c) 2014, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
-#include <openssl/rand.h>
-#include <assert.h>
-#include <limits.h>
-#include <string.h>
-#if defined(BORINGSSL_FIPS)
-#include <unistd.h>
-#endif
-#include <openssl/chacha.h>
-#include <openssl/cpu.h>
-#include <openssl/mem.h>
-#include "internal.h"
-#include "../../internal.h"
-#include "../delocate.h"
-// It's assumed that the operating system always has an unfailing source of
-// entropy which is accessed via |CRYPTO_sysrand|. (If the operating system
-// entropy source fails, it's up to |CRYPTO_sysrand| to abort the process—we
-// don't try to handle it.)
-//
-// In addition, the hardware may provide a low-latency RNG. Intel's rdrand
-// instruction is the canonical example of this. When a hardware RNG is
-// available we don't need to worry about an RNG failure arising from fork()ing
-// the process or moving a VM, so we can keep thread-local RNG state and use it
-// as an additional-data input to CTR-DRBG.
-//
-// (We assume that the OS entropy is safe from fork()ing and VM duplication.
-// This might be a bit of a leap of faith, esp on Windows, but there's nothing
-// that we can do about it.)
-// kReseedInterval is the number of generate calls made to CTR-DRBG before
-// reseeding.
-static const unsigned kReseedInterval = 4096;
-// CRNGT_BLOCK_SIZE is the number of bytes in a “block” for the purposes of the
-// continuous random number generator test in FIPS 140-2, section 4.9.2.
-#define CRNGT_BLOCK_SIZE 16
-// rand_thread_state contains the per-thread state for the RNG.
-struct rand_thread_state {
-  CTR_DRBG_STATE drbg;
-  // calls is the number of generate calls made on |drbg| since it was last
-  // (re)seeded. This is bound by |kReseedInterval|.
-  unsigned calls;
-  // last_block_valid is non-zero iff |last_block| contains data from
-  // |CRYPTO_sysrand|.
-  int last_block_valid;
-#if defined(BORINGSSL_FIPS)
-  // last_block contains the previous block from |CRYPTO_sysrand|.
-  uint8_t last_block[CRNGT_BLOCK_SIZE];
-  // next and prev form a NULL-terminated, double-linked list of all states in
-  // a process.
-  struct rand_thread_state *next, *prev;
-#endif
-};
-#if defined(BORINGSSL_FIPS)
-// thread_states_list is the head of a linked-list of all |rand_thread_state|
-// objects in the process, one per thread. This is needed because FIPS requires
-// that they be zeroed on process exit, but thread-local destructors aren't
-// called when the whole process is exiting.
-DEFINE_BSS_GET(struct rand_thread_state *, thread_states_list);
-DEFINE_STATIC_MUTEX(thread_states_list_lock);
-static void rand_thread_state_clear_all(void) __attribute__((destructor));
-static void rand_thread_state_clear_all(void) {
-  CRYPTO_STATIC_MUTEX_lock_write(thread_states_list_lock_bss_get());
-  for (struct rand_thread_state *cur = *thread_states_list_bss_get();
-       cur != NULL; cur = cur->next) {
-    CTR_DRBG_clear(&cur->drbg);
-  }
-  // |thread_states_list_lock is deliberately left locked so that any threads
-  // that are still running will hang if they try to call |RAND_bytes|.
-}
-#endif
-// rand_thread_state_free frees a |rand_thread_state|. This is called when a
-// thread exits.
-static void rand_thread_state_free(void *state_in) {
-  struct rand_thread_state *state = state_in;
-  if (state_in == NULL) {
-    return;
-  }
-#if defined(BORINGSSL_FIPS)
-  CRYPTO_STATIC_MUTEX_lock_write(thread_states_list_lock_bss_get());
-  if (state->prev != NULL) {
-    state->prev->next = state->next;
-  } else {
-    *thread_states_list_bss_get() = state->next;
-  }
-  if (state->next != NULL) {
-    state->next->prev = state->prev;
-  }
-  CRYPTO_STATIC_MUTEX_unlock_write(thread_states_list_lock_bss_get());
-  CTR_DRBG_clear(&state->drbg);
-#endif
-  OPENSSL_free(state);
-}
-#if defined(OPENSSL_X86_64) && !defined(OPENSSL_NO_ASM) && \
-    !defined(BORINGSSL_UNSAFE_DETERMINISTIC_MODE)
-// These functions are defined in asm/rdrand-x86_64.pl
-extern int CRYPTO_rdrand(uint8_t out[8]);
-extern int CRYPTO_rdrand_multiple8_buf(uint8_t *buf, size_t len);
-static int have_rdrand(void) {
-  return (OPENSSL_ia32cap_get()[1] & (1u << 30)) != 0;
-}
-static int hwrand(uint8_t *buf, const size_t len) {
-  if (!have_rdrand()) {
-    return 0;
-  }
-  const size_t len_multiple8 = len & ~7;
-  if (!CRYPTO_rdrand_multiple8_buf(buf, len_multiple8)) {
-    return 0;
-  }
-  const size_t remainder = len - len_multiple8;
-  if (remainder != 0) {
-    assert(remainder < 8);
-    uint8_t rand_buf[8];
-    if (!CRYPTO_rdrand(rand_buf)) {
-      return 0;
-    }
-    OPENSSL_memcpy(buf + len_multiple8, rand_buf, remainder);
-  }
-#if defined(BORINGSSL_FIPS_BREAK_CRNG)
-  // This breaks the "continuous random number generator test" defined in FIPS
-  // 140-2, section 4.9.2, and implemented in rand_get_seed().
-  OPENSSL_memset(buf, 0, len);
-#endif
-  return 1;
-}
-#else
-static int hwrand(uint8_t *buf, size_t len) {
-  return 0;
-}
-#endif
-#if defined(BORINGSSL_FIPS)
-static void rand_get_seed(struct rand_thread_state *state,
-                          uint8_t seed[CTR_DRBG_ENTROPY_LEN]) {
-  if (!state->last_block_valid) {
-    if (!hwrand(state->last_block, sizeof(state->last_block))) {
-      CRYPTO_sysrand(state->last_block, sizeof(state->last_block));
-    }
-    state->last_block_valid = 1;
-  }
-  // We overread from /dev/urandom or RDRAND by a factor of 10 and XOR to
-  // whiten.
-#define FIPS_OVERREAD 10
-  uint8_t entropy[CTR_DRBG_ENTROPY_LEN * FIPS_OVERREAD];
-  if (!hwrand(entropy, sizeof(entropy))) {
-    CRYPTO_sysrand(entropy, sizeof(entropy));
-  }
-  // See FIPS 140-2, section 4.9.2. This is the “continuous random number
-  // generator test” which causes the program to randomly abort. Hopefully the
-  // rate of failure is small enough not to be a problem in practice.
-  if (CRYPTO_memcmp(state->last_block, entropy, CRNGT_BLOCK_SIZE) == 0) {
-    printf("CRNGT failed.\n");
-    BORINGSSL_FIPS_abort();
-  }
-  for (size_t i = CRNGT_BLOCK_SIZE; i < sizeof(entropy);
-       i += CRNGT_BLOCK_SIZE) {
-    if (CRYPTO_memcmp(entropy + i - CRNGT_BLOCK_SIZE, entropy + i,
-                      CRNGT_BLOCK_SIZE) == 0) {
-      printf("CRNGT failed.\n");
-      BORINGSSL_FIPS_abort();
-    }
-  }
-  OPENSSL_memcpy(state->last_block,
-                 entropy + sizeof(entropy) - CRNGT_BLOCK_SIZE,
-                 CRNGT_BLOCK_SIZE);
-  OPENSSL_memcpy(seed, entropy, CTR_DRBG_ENTROPY_LEN);
-  for (size_t i = 1; i < FIPS_OVERREAD; i++) {
-    for (size_t j = 0; j < CTR_DRBG_ENTROPY_LEN; j++) {
-      seed[j] ^= entropy[CTR_DRBG_ENTROPY_LEN * i + j];
-    }
-  }
-}
-#else
-static void rand_get_seed(struct rand_thread_state *state,
-                          uint8_t seed[CTR_DRBG_ENTROPY_LEN]) {
-  // If not in FIPS mode, we don't overread from the system entropy source and
-  // we don't depend only on the hardware RDRAND.
-  CRYPTO_sysrand(seed, CTR_DRBG_ENTROPY_LEN);
-}
-#endif
-void RAND_bytes_with_additional_data(uint8_t *out, size_t out_len,
-                                     const uint8_t user_additional_data[32]) {
-  if (out_len == 0) {
-    return;
-  }
-  // Additional data is mixed into every CTR-DRBG call to protect, as best we
-  // can, against forks & VM clones. We do not over-read this information and
-  // don't reseed with it so, from the point of view of FIPS, this doesn't
-  // provide “prediction resistance”. But, in practice, it does.
-  uint8_t additional_data[32];
-  if (!hwrand(additional_data, sizeof(additional_data))) {
-    // Without a hardware RNG to save us from address-space duplication, the OS
-    // entropy is used. This can be expensive (one read per |RAND_bytes| call)
-    // and so can be disabled by applications that we have ensured don't fork
-    // and aren't at risk of VM cloning.
-    if (!rand_fork_unsafe_buffering_enabled()) {
-      CRYPTO_sysrand(additional_data, sizeof(additional_data));
-    } else {
-      OPENSSL_memset(additional_data, 0, sizeof(additional_data));
-    }
-  }
-  for (size_t i = 0; i < sizeof(additional_data); i++) {
-    additional_data[i] ^= user_additional_data[i];
-  }
-  struct rand_thread_state stack_state;
-  struct rand_thread_state *state =
-      CRYPTO_get_thread_local(OPENSSL_THREAD_LOCAL_RAND);
-  if (state == NULL) {
-    state = OPENSSL_malloc(sizeof(struct rand_thread_state));
-    if (state == NULL ||
-        !CRYPTO_set_thread_local(OPENSSL_THREAD_LOCAL_RAND, state,
-                                 rand_thread_state_free)) {
-      // If the system is out of memory, use an ephemeral state on the
-      // stack.
-      state = &stack_state;
-    }
-    state->last_block_valid = 0;
-    uint8_t seed[CTR_DRBG_ENTROPY_LEN];
-    rand_get_seed(state, seed);
-    if (!CTR_DRBG_init(&state->drbg, seed, NULL, 0)) {
-      abort();
-    }
-    state->calls = 0;
-#if defined(BORINGSSL_FIPS)
-    if (state != &stack_state) {
-      CRYPTO_STATIC_MUTEX_lock_write(thread_states_list_lock_bss_get());
-      struct rand_thread_state **states_list = thread_states_list_bss_get();
-      state->next = *states_list;
-      if (state->next != NULL) {
-        state->next->prev = state;
-      }
-      state->prev = NULL;
-      *states_list = state;
-      CRYPTO_STATIC_MUTEX_unlock_write(thread_states_list_lock_bss_get());
-    }
-#endif
-  }
-  if (state->calls >= kReseedInterval) {
-    uint8_t seed[CTR_DRBG_ENTROPY_LEN];
-    rand_get_seed(state, seed);
-#if defined(BORINGSSL_FIPS)
-    // Take a read lock around accesses to |state->drbg|. This is needed to
-    // avoid returning bad entropy if we race with
-    // |rand_thread_state_clear_all|.
-    //
-    // This lock must be taken after any calls to |CRYPTO_sysrand| to avoid a
-    // bug on ppc64le. glibc may implement pthread locks by wrapping user code
-    // in a hardware transaction, but, on some older versions of glibc and the
-    // kernel, syscalls made with |syscall| did not abort the transaction.
-    CRYPTO_STATIC_MUTEX_lock_read(thread_states_list_lock_bss_get());
-#endif
-    if (!CTR_DRBG_reseed(&state->drbg, seed, NULL, 0)) {
-      abort();
-    }
-    state->calls = 0;
-  } else {
-#if defined(BORINGSSL_FIPS)
-    CRYPTO_STATIC_MUTEX_lock_read(thread_states_list_lock_bss_get());
-#endif
-  }
-  int first_call = 1;
-  while (out_len > 0) {
-    size_t todo = out_len;
-    if (todo > CTR_DRBG_MAX_GENERATE_LENGTH) {
-      todo = CTR_DRBG_MAX_GENERATE_LENGTH;
-    }
-    if (!CTR_DRBG_generate(&state->drbg, out, todo, additional_data,
-                           first_call ? sizeof(additional_data) : 0)) {
-      abort();
-    }
-    out += todo;
-    out_len -= todo;
-    state->calls++;
-    first_call = 0;
-  }
-  if (state == &stack_state) {
-    CTR_DRBG_clear(&state->drbg);
-  }
-#if defined(BORINGSSL_FIPS)
-  CRYPTO_STATIC_MUTEX_unlock_read(thread_states_list_lock_bss_get());
-#endif
-}
-int RAND_bytes(uint8_t *out, size_t out_len) {
-  static const uint8_t kZeroAdditionalData[32] = {0};
-  RAND_bytes_with_additional_data(out, out_len, kZeroAdditionalData);
-  return 1;
-}
-int RAND_pseudo_bytes(uint8_t *buf, size_t len) {
-  return RAND_bytes(buf, len);
-}