/* fips/rand/fips_drbg_selftest.c */

/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL

 * project.

 */

/* ====================================================================

 * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 *

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer. 

 *

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in

 *    the documentation and/or other materials provided with the

 *    distribution.

 *

 * 3. All advertising materials mentioning features or use of this

 *    software must display the following acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"

 *

 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

 *    endorse or promote products derived from this software without

 *    prior written permission. For written permission, please contact

 *    licensing@OpenSSL.org.

 *

 * 5. Products derived from this software may not be called "OpenSSL"

 *    nor may "OpenSSL" appear in their names without prior written

 *    permission of the OpenSSL Project.

 *

 * 6. Redistributions of any form whatsoever must retain the following

 *    acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"

 *

 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 * OF THE POSSIBILITY OF SUCH DAMAGE.

 * ====================================================================

 */

#include <string.h>

#include <openssl/crypto.h>

#include <openssl/err.h>

#include <openssl/fips.h>

#define FIPS_DRBG_generate FIPS_DRBG_generate_internal

#define FIPS_DRBG_reseed FIPS_DRBG_reseed_internal

#include <openssl/fips_rand.h>

#include "fips_rand_lcl.h"

#include "fips_locl.h"

#include "fips_drbg_selftest.h"

typedef struct {

    int post;

    int nid;

    unsigned int flags;

    /* KAT data for no PR */

    const unsigned char *ent;

    size_t entlen;

    const unsigned char *nonce;

    size_t noncelen;

    const unsigned char *pers;

    size_t perslen;

    const unsigned char *adin;

    size_t adinlen;

    const unsigned char *entreseed;

    size_t entreseedlen;

    const unsigned char *adinreseed;

    size_t adinreseedlen;

    const unsigned char *adin2;

    size_t adin2len;

    const unsigned char *kat;

    size_t katlen;

    const unsigned char *kat2;

    size_t kat2len;

    /* KAT data for PR */

    const unsigned char *ent_pr;

    size_t entlen_pr;

    const unsigned char *nonce_pr;

    size_t noncelen_pr;

    const unsigned char *pers_pr;

    size_t perslen_pr;

    const unsigned char *adin_pr;

    size_t adinlen_pr;

    const unsigned char *entpr_pr;

    size_t entprlen_pr;

    const unsigned char *ading_pr;

    size_t adinglen_pr;

    const unsigned char *entg_pr;

    size_t entglen_pr;

    const unsigned char *kat_pr;

    size_t katlen_pr;

    const unsigned char *kat2_pr;

    size_t kat2len_pr;

} DRBG_SELFTEST_DATA;

#define make_drbg_test_data(nid, flag, pr, p) {p, nid, flag | DRBG_FLAG_TEST, \

        pr##_entropyinput, sizeof(pr##_entropyinput), \

        pr##_nonce, sizeof(pr##_nonce), \

        pr##_personalizationstring, sizeof(pr##_personalizationstring), \

        pr##_additionalinput, sizeof(pr##_additionalinput), \

        pr##_entropyinputreseed, sizeof(pr##_entropyinputreseed), \

        pr##_additionalinputreseed, sizeof(pr##_additionalinputreseed), \

        pr##_additionalinput2, sizeof(pr##_additionalinput2), \

        pr##_int_returnedbits, sizeof(pr##_int_returnedbits), \

        pr##_returnedbits, sizeof(pr##_returnedbits), \

        pr##_pr_entropyinput, sizeof(pr##_pr_entropyinput), \

        pr##_pr_nonce, sizeof(pr##_pr_nonce), \

        pr##_pr_personalizationstring, sizeof(pr##_pr_personalizationstring), \

        pr##_pr_additionalinput, sizeof(pr##_pr_additionalinput), \

        pr##_pr_entropyinputpr, sizeof(pr##_pr_entropyinputpr), \

        pr##_pr_additionalinput2, sizeof(pr##_pr_additionalinput2), \

        pr##_pr_entropyinputpr2, sizeof(pr##_pr_entropyinputpr2), \

        pr##_pr_int_returnedbits, sizeof(pr##_pr_int_returnedbits), \

        pr##_pr_returnedbits, sizeof(pr##_pr_returnedbits), \

        }

#define make_drbg_test_data_df(nid, pr, p) \

        make_drbg_test_data(nid, DRBG_FLAG_CTR_USE_DF, pr, p)

#define make_drbg_test_data_ec(curve, md, pr, p) \

        make_drbg_test_data((curve << 16) | md , 0, pr, p)

static DRBG_SELFTEST_DATA drbg_test[] = {

    make_drbg_test_data_df(NID_aes_128_ctr, aes_128_use_df, 0),

    make_drbg_test_data_df(NID_aes_192_ctr, aes_192_use_df, 0),

    make_drbg_test_data_df(NID_aes_256_ctr, aes_256_use_df, 1),

    make_drbg_test_data(NID_aes_128_ctr, 0, aes_128_no_df, 0),

    make_drbg_test_data(NID_aes_192_ctr, 0, aes_192_no_df, 0),

    make_drbg_test_data(NID_aes_256_ctr, 0, aes_256_no_df, 1),

    make_drbg_test_data(NID_sha1, 0, sha1, 0),

    make_drbg_test_data(NID_sha224, 0, sha224, 0),

    make_drbg_test_data(NID_sha256, 0, sha256, 1),

    make_drbg_test_data(NID_sha384, 0, sha384, 0),

    make_drbg_test_data(NID_sha512, 0, sha512, 0),

    make_drbg_test_data(NID_hmacWithSHA1, 0, hmac_sha1, 0),

    make_drbg_test_data(NID_hmacWithSHA224, 0, hmac_sha224, 0),

    make_drbg_test_data(NID_hmacWithSHA256, 0, hmac_sha256, 1),

    make_drbg_test_data(NID_hmacWithSHA384, 0, hmac_sha384, 0),

    make_drbg_test_data(NID_hmacWithSHA512, 0, hmac_sha512, 0),

    {0, 0, 0}

};

typedef struct {

    const unsigned char *ent;

    size_t entlen;

    int entcnt;

    const unsigned char *nonce;

    size_t noncelen;

    int noncecnt;

} TEST_ENT;

static size_t test_entropy(DRBG_CTX *dctx, unsigned char **pout,

                           int entropy, size_t min_len, size_t max_len)

{

    TEST_ENT *t = FIPS_drbg_get_app_data(dctx);

    *pout = (unsigned char *)t->ent;

    t->entcnt++;

    return t->entlen;

}

static size_t test_nonce(DRBG_CTX *dctx, unsigned char **pout,

                         int entropy, size_t min_len, size_t max_len)

{

    TEST_ENT *t = FIPS_drbg_get_app_data(dctx);

    *pout = (unsigned char *)t->nonce;

    t->noncecnt++;

    return t->noncelen;

}

static int fips_drbg_single_kat(DRBG_CTX *dctx, DRBG_SELFTEST_DATA * td,

                                int quick)

{

    TEST_ENT t;

    int rv = 0;

    size_t adinlen;

    unsigned char randout[1024];

    /* Initial test without PR */

    /* Instantiate DRBG with test entropy, nonce and personalisation

     * string.

     */

    if (!FIPS_drbg_init(dctx, td->nid, td->flags))

        return 0;

    if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))

        return 0;

    FIPS_drbg_set_app_data(dctx, &t);

    t.ent = td->ent;

    t.entlen = td->entlen;

    t.nonce = td->nonce;

    t.noncelen = td->noncelen;

    t.entcnt = 0;

    t.noncecnt = 0;

    if (!FIPS_drbg_instantiate(dctx, td->pers, td->perslen))

        goto err;

    /* Note for CTR without DF some additional input values

     * ignore bytes after the keylength: so reduce adinlen

     * to half to ensure invalid data is fed in.

     */

    if (!fips_post_corrupt(FIPS_TEST_DRBG, dctx->type, &dctx->iflags))

        adinlen = td->adinlen / 2;

    else

        adinlen = td->adinlen;

    /* Generate with no PR and verify output matches expected data */

    if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0, td->adin, adinlen))

        goto err;

    if (memcmp(randout, td->kat, td->katlen)) {

        FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_NOPR_TEST1_FAILURE);

        goto err2;

    }

    /* If abbreviated POST end of test */

    if (quick) {

        rv = 1;

        goto err;

    }

    /* Reseed DRBG with test entropy and additional input */

    t.ent = td->entreseed;

    t.entlen = td->entreseedlen;

    if (!FIPS_drbg_reseed(dctx, td->adinreseed, td->adinreseedlen))

        goto err;

    /* Generate with no PR and verify output matches expected data */

    if (!FIPS_drbg_generate(dctx, randout, td->kat2len, 0,

                            td->adin2, td->adin2len))

        goto err;

    if (memcmp(randout, td->kat2, td->kat2len)) {

        FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_NOPR_TEST2_FAILURE);

        goto err2;

    }

    FIPS_drbg_uninstantiate(dctx);

    /* Now test with PR */

    /* Instantiate DRBG with test entropy, nonce and personalisation

     * string.

     */

    if (!FIPS_drbg_init(dctx, td->nid, td->flags))

        return 0;

    if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))

        return 0;

    FIPS_drbg_set_app_data(dctx, &t);

    t.ent = td->ent_pr;

    t.entlen = td->entlen_pr;

    t.nonce = td->nonce_pr;

    t.noncelen = td->noncelen_pr;

    t.entcnt = 0;

    t.noncecnt = 0;

    if (!FIPS_drbg_instantiate(dctx, td->pers_pr, td->perslen_pr))

        goto err;

    /* Now generate with PR: we need to supply entropy as this will

     * perform a reseed operation. Check output matches expected value.

     */

    t.ent = td->entpr_pr;

    t.entlen = td->entprlen_pr;

    /* Note for CTR without DF some additional input values

     * ignore bytes after the keylength: so reduce adinlen

     * to half to ensure invalid data is fed in.

     */

    if (!fips_post_corrupt(FIPS_TEST_DRBG, dctx->type, &dctx->iflags))

        adinlen = td->adinlen_pr / 2;

    else

        adinlen = td->adinlen_pr;

    if (!FIPS_drbg_generate(dctx, randout, td->katlen_pr, 1,

                            td->adin_pr, adinlen))

        goto err;

    if (memcmp(randout, td->kat_pr, td->katlen_pr)) {

        FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_PR_TEST1_FAILURE);

        goto err2;

    }

    /* Now generate again with PR: supply new entropy again.

     * Check output matches expected value.

     */

    t.ent = td->entg_pr;

    t.entlen = td->entglen_pr;

    if (!FIPS_drbg_generate(dctx, randout, td->kat2len_pr, 1,

                            td->ading_pr, td->adinglen_pr))

        goto err;

    if (memcmp(randout, td->kat2_pr, td->kat2len_pr)) {

        FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_PR_TEST2_FAILURE);

        goto err2;

    }

    /* All OK, test complete */

    rv = 1;

 err:

    if (rv == 0)

        FIPSerr(FIPS_F_FIPS_DRBG_SINGLE_KAT, FIPS_R_SELFTEST_FAILED);

 err2:

    FIPS_drbg_uninstantiate(dctx);

    return rv;

}

/* Initialise a DRBG based on selftest data */

static int do_drbg_init(DRBG_CTX *dctx, DRBG_SELFTEST_DATA * td, TEST_ENT * t)

{

    if (!FIPS_drbg_init(dctx, td->nid, td->flags))

        return 0;

    if (!FIPS_drbg_set_callbacks(dctx, test_entropy, 0, 0, test_nonce, 0))

        return 0;

    FIPS_drbg_set_app_data(dctx, t);

    t->ent = td->ent;

    t->entlen = td->entlen;

    t->nonce = td->nonce;

    t->noncelen = td->noncelen;

    t->entcnt = 0;

    t->noncecnt = 0;

    return 1;

}

/* Initialise and instantiate DRBG based on selftest data */

static int do_drbg_instantiate(DRBG_CTX *dctx, DRBG_SELFTEST_DATA * td,

                               TEST_ENT * t)

{

    if (!do_drbg_init(dctx, td, t))

        return 0;

    if (!FIPS_drbg_instantiate(dctx, td->pers, td->perslen))

        return 0;

    return 1;

}

/* This function performs extensive error checking as required by SP800-90.

 * Induce several failure modes and check an error condition is set.

 * This function along with fips_drbg_single_kat peforms the health checking

 * operation.

 */

static int fips_drbg_error_check(DRBG_CTX *dctx, DRBG_SELFTEST_DATA * td)

{

    unsigned char randout[1024];

    TEST_ENT t;

    size_t i;

    unsigned int reseed_counter_tmp;

    unsigned char *p = (unsigned char *)dctx;

    /* Initialise DRBG */

    if (!do_drbg_init(dctx, td, &t))

        goto err;

    /* Don't report induced errors */

    dctx->iflags |= DRBG_FLAG_NOERR;

    /* Personalisation string tests */

    /* Test detection of too large personlisation string */

    if (FIPS_drbg_instantiate(dctx, td->pers, dctx->max_pers + 1) > 0) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                FIPS_R_PERSONALISATION_ERROR_UNDETECTED);

        goto err;

    }

    /* Entropy source tests */

    /* Test entropy source failure detecion: i.e. returns no data */

    t.entlen = 0;

    if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                FIPS_R_ENTROPY_ERROR_UNDETECTED);

        goto err;

    }

    /* Try to generate output from uninstantiated DRBG */

    if (FIPS_drbg_generate(dctx, randout, td->katlen, 0,

                           td->adin, td->adinlen)) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                FIPS_R_GENERATE_ERROR_UNDETECTED);

        goto err;

    }

    dctx->iflags &= ~DRBG_FLAG_NOERR;

    if (!FIPS_drbg_uninstantiate(dctx)) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);

        goto err;

    }

    if (!do_drbg_init(dctx, td, &t))

        goto err;

    dctx->iflags |= DRBG_FLAG_NOERR;

    /* Test insufficient entropy */

    t.entlen = dctx->min_entropy - 1;

    if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                FIPS_R_ENTROPY_ERROR_UNDETECTED);

        goto err;

    }

    dctx->iflags &= ~DRBG_FLAG_NOERR;

    if (!FIPS_drbg_uninstantiate(dctx)) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);

        goto err;

    }

    /* Test too much entropy */

    if (!do_drbg_init(dctx, td, &t))

        goto err;

    dctx->iflags |= DRBG_FLAG_NOERR;

    t.entlen = dctx->max_entropy + 1;

    if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                FIPS_R_ENTROPY_ERROR_UNDETECTED);

        goto err;

    }

    dctx->iflags &= ~DRBG_FLAG_NOERR;

    if (!FIPS_drbg_uninstantiate(dctx)) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);

        goto err;

    }

    /* Nonce tests */

    /* Test too small nonce */

    if (dctx->min_nonce) {

        if (!do_drbg_init(dctx, td, &t))

            goto err;

        dctx->iflags |= DRBG_FLAG_NOERR;

        t.noncelen = dctx->min_nonce - 1;

        if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0) {

            FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                    FIPS_R_NONCE_ERROR_UNDETECTED);

            goto err;

        }

        dctx->iflags &= ~DRBG_FLAG_NOERR;

        if (!FIPS_drbg_uninstantiate(dctx)) {

            FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);

            goto err;

        }

    }

    /* Test too large nonce */

    if (dctx->max_nonce) {

        if (!do_drbg_init(dctx, td, &t))

            goto err;

        dctx->iflags |= DRBG_FLAG_NOERR;

        t.noncelen = dctx->max_nonce + 1;

        if (FIPS_drbg_instantiate(dctx, td->pers, td->perslen) > 0) {

            FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                    FIPS_R_NONCE_ERROR_UNDETECTED);

            goto err;

        }

        dctx->iflags &= ~DRBG_FLAG_NOERR;

        if (!FIPS_drbg_uninstantiate(dctx)) {

            FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);

            goto err;

        }

    }

    /* Instantiate with valid data. */

    if (!do_drbg_instantiate(dctx, td, &t))

        goto err;

    /* Check generation is now OK */

    if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0,

                            td->adin, td->adinlen))

        goto err;

    dctx->iflags |= DRBG_FLAG_NOERR;

    /* Request too much data for one request */

    if (FIPS_drbg_generate(dctx, randout, dctx->max_request + 1, 0,

                           td->adin, td->adinlen)) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                FIPS_R_REQUEST_LENGTH_ERROR_UNDETECTED);

        goto err;

    }

    /* Try too large additional input */

    if (FIPS_drbg_generate(dctx, randout, td->katlen, 0,

                           td->adin, dctx->max_adin + 1)) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                FIPS_R_ADDITIONAL_INPUT_ERROR_UNDETECTED);

        goto err;

    }

    /* Check prediction resistance request fails if entropy source

     * failure.

     */

    t.entlen = 0;

    if (FIPS_drbg_generate(dctx, randout, td->katlen, 1,

                           td->adin, td->adinlen)) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                FIPS_R_ENTROPY_ERROR_UNDETECTED);

        goto err;

    }

    dctx->iflags &= ~DRBG_FLAG_NOERR;

    if (!FIPS_drbg_uninstantiate(dctx)) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);

        goto err;

    }

    /* Instantiate again with valid data */

    if (!do_drbg_instantiate(dctx, td, &t))

        goto err;

    /* Test reseed counter works */

    /* Save initial reseed counter */

    reseed_counter_tmp = dctx->reseed_counter;

    /* Set reseed counter to beyond interval */

    dctx->reseed_counter = dctx->reseed_interval;

    /* Generate output and check entropy has been requested for reseed */

    t.entcnt = 0;

    if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0,

                            td->adin, td->adinlen))

        goto err;

    if (t.entcnt != 1) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                FIPS_R_ENTROPY_NOT_REQUESTED_FOR_RESEED);

        goto err;

    }

    /* Check reseed counter has been reset */

    if (dctx->reseed_counter != reseed_counter_tmp + 1) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_RESEED_COUNTER_ERROR);

        goto err;

    }

    dctx->iflags &= ~DRBG_FLAG_NOERR;

    if (!FIPS_drbg_uninstantiate(dctx)) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);

        goto err;

    }

    /* Check prediction resistance request fails if entropy source

     * failure.

     */

    t.entlen = 0;

    dctx->iflags |= DRBG_FLAG_NOERR;

    if (FIPS_drbg_generate(dctx, randout, td->katlen, 1,

                           td->adin, td->adinlen)) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                FIPS_R_ENTROPY_ERROR_UNDETECTED);

        goto err;

    }

    dctx->iflags &= ~DRBG_FLAG_NOERR;

    if (!FIPS_drbg_uninstantiate(dctx)) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);

        goto err;

    }

    if (!do_drbg_instantiate(dctx, td, &t))

        goto err;

    /* Test reseed counter works */

    /* Save initial reseed counter */

    reseed_counter_tmp = dctx->reseed_counter;

    /* Set reseed counter to beyond interval */

    dctx->reseed_counter = dctx->reseed_interval;

    /* Generate output and check entropy has been requested for reseed */

    t.entcnt = 0;

    if (!FIPS_drbg_generate(dctx, randout, td->katlen, 0,

                            td->adin, td->adinlen))

        goto err;

    if (t.entcnt != 1) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                FIPS_R_ENTROPY_NOT_REQUESTED_FOR_RESEED);

        goto err;

    }

    /* Check reseed counter has been reset */

    if (dctx->reseed_counter != reseed_counter_tmp + 1) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_RESEED_COUNTER_ERROR);

        goto err;

    }

    dctx->iflags &= ~DRBG_FLAG_NOERR;

    if (!FIPS_drbg_uninstantiate(dctx)) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);

        goto err;

    }

    /* Explicit reseed tests */

    /* Test explicit reseed with too large additional input */

    if (!do_drbg_init(dctx, td, &t))

        goto err;

    dctx->iflags |= DRBG_FLAG_NOERR;

    if (FIPS_drbg_reseed(dctx, td->adin, dctx->max_adin + 1) > 0) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                FIPS_R_ADDITIONAL_INPUT_ERROR_UNDETECTED);

        goto err;

    }

    /* Test explicit reseed with entropy source failure */

    t.entlen = 0;

    if (FIPS_drbg_reseed(dctx, td->adin, td->adinlen) > 0) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                FIPS_R_ENTROPY_ERROR_UNDETECTED);

        goto err;

    }

    if (!FIPS_drbg_uninstantiate(dctx)) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);

        goto err;

    }

    /* Test explicit reseed with too much entropy */

    if (!do_drbg_init(dctx, td, &t))

        goto err;

    dctx->iflags |= DRBG_FLAG_NOERR;

    t.entlen = dctx->max_entropy + 1;

    if (FIPS_drbg_reseed(dctx, td->adin, td->adinlen) > 0) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                FIPS_R_ENTROPY_ERROR_UNDETECTED);

        goto err;

    }

    if (!FIPS_drbg_uninstantiate(dctx)) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);

        goto err;

    }

    /* Test explicit reseed with too little entropy */

    if (!do_drbg_init(dctx, td, &t))

        goto err;

    dctx->iflags |= DRBG_FLAG_NOERR;

    t.entlen = dctx->min_entropy - 1;

    if (FIPS_drbg_reseed(dctx, td->adin, td->adinlen) > 0) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                FIPS_R_ENTROPY_ERROR_UNDETECTED);

        goto err;

    }

    if (!FIPS_drbg_uninstantiate(dctx)) {

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_UNINSTANTIATE_ERROR);

        goto err;

    }

    p = (unsigned char *)&dctx->d;

    /* Standard says we have to check uninstantiate really zeroes

     * the data...

     */

    for (i = 0; i < sizeof(dctx->d); i++) {

        if (*p != 0) {

            FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK,

                    FIPS_R_UNINSTANTIATE_ZEROISE_ERROR);

            goto err;

        }

        p++;

    }

    return 1;

 err:

    /* A real error as opposed to an induced one: underlying function will

     * indicate the error.

     */

    if (!(dctx->iflags & DRBG_FLAG_NOERR))

        FIPSerr(FIPS_F_FIPS_DRBG_ERROR_CHECK, FIPS_R_FUNCTION_ERROR);

    FIPS_drbg_uninstantiate(dctx);

    return 0;

}

int fips_drbg_kat(DRBG_CTX *dctx, int nid, unsigned int flags)

{

    DRBG_SELFTEST_DATA *td;

    flags |= DRBG_FLAG_TEST;

    for (td = drbg_test; td->nid != 0; td++) {

        if (td->nid == nid && td->flags == flags) {

            if (!fips_drbg_single_kat(dctx, td, 0))

                return 0;

            return fips_drbg_error_check(dctx, td);

        }

    }

    return 0;

}

int FIPS_drbg_health_check(DRBG_CTX *dctx)

{

    int rv;

    DRBG_CTX *tctx = NULL;

    tctx = FIPS_drbg_new(0, 0);

    fips_post_started(FIPS_TEST_DRBG, dctx->type, &dctx->xflags);

    if (!tctx)

        return 0;

    rv = fips_drbg_kat(tctx, dctx->type, dctx->xflags);

    if (tctx)

        FIPS_drbg_free(tctx);

    if (rv)

        fips_post_success(FIPS_TEST_DRBG, dctx->type, &dctx->xflags);

    else

        fips_post_failed(FIPS_TEST_DRBG, dctx->type, &dctx->xflags);

    if (!rv)

        dctx->status = DRBG_STATUS_ERROR;

    else

        dctx->health_check_cnt = 0;

    return rv;

}

int FIPS_selftest_drbg(void)

{

    DRBG_CTX *dctx;

    DRBG_SELFTEST_DATA *td;

    int rv = 1;

    dctx = FIPS_drbg_new(0, 0);

    if (!dctx)

        return 0;

    for (td = drbg_test; td->nid != 0; td++) {

        if (td->post != 1)

            continue;

        if (!fips_post_started(FIPS_TEST_DRBG, td->nid, &td->flags))

            return 1;

        if (!fips_drbg_single_kat(dctx, td, 1)) {

            fips_post_failed(FIPS_TEST_DRBG, td->nid, &td->flags);

            rv = 0;

            continue;

        }

        if (!fips_post_success(FIPS_TEST_DRBG, td->nid, &td->flags))

            return 0;

    }

    FIPS_drbg_free(dctx);

    return rv;

}

int FIPS_selftest_drbg_all(void)

{

    DRBG_CTX *dctx;

    DRBG_SELFTEST_DATA *td;

    int rv = 1;

    dctx = FIPS_drbg_new(0, 0);

    if (!dctx)

        return 0;

    for (td = drbg_test; td->nid != 0; td++) {

        if (!fips_post_started(FIPS_TEST_DRBG, td->nid, &td->flags))

            return 1;

        if (!fips_drbg_single_kat(dctx, td, 0)) {

            fips_post_failed(FIPS_TEST_DRBG, td->nid, &td->flags);

            rv = 0;

            continue;

        }

        if (!fips_drbg_error_check(dctx, td)) {

            fips_post_failed(FIPS_TEST_DRBG, td->nid, &td->flags);

            rv = 0;

            continue;

        }

        if (!fips_post_success(FIPS_TEST_DRBG, td->nid, &td->flags))

            return 0;

    }

    FIPS_drbg_free(dctx);

    return rv;

}