Make randomness generation deterministic under BORINGSSL_UNSAFE_FUZZER_MODE

crypto/fipsmodule/rand/entropy/entropy_source_test.cc

@@ -6,6 +6,7 @@
 #include <openssl/crypto.h>
 
 #include "internal.h"
+#include "../../../rand_extra/internal.h"
 #include "../../../ube/vm_ube_detect.h"
 
 #define MAX_MULTIPLE_FROM_RNG (16)
@@ -79,6 +80,11 @@ TEST(EntropySources, Configuration) {
 #if defined(AWSLC_VM_UBE_TESTING) && defined(OPENSSL_LINUX)
   EXPECT_EQ(OPT_OUT_CPU_JITTER_ENTROPY_SOURCE, get_entropy_source_method_id_FOR_TESTING());
 
+// In this mode, we expect deterministic behaviour from the randomness
+// generation.
+#elif defined(OPENSSL_RAND_DETERMINISTIC)
+  EXPECT_EQ(DETERMINISTIC_ENTROPY_SOURCE, get_entropy_source_method_id_FOR_TESTING());
+
 // If entropy build configuration choose to explicitly opt-out of CPU Jitter
 // Entropy
 #elif defined(DISABLE_CPU_JITTER_ENTROPY)

crypto/fipsmodule/rand/entropy/entropy_sources.c

@@ -122,11 +122,54 @@ DEFINE_LOCAL_DATA(struct entropy_source_methods, opt_out_cpu_jitter_entropy_sour
   out->id = OPT_OUT_CPU_JITTER_ENTROPY_SOURCE;
 }
 
+static int entropy_deterministic_initialize(
+  struct entropy_source_t *entropy_source) {
+  return 1;
+}
+
+static void entropy_deterministic_zeroize_thread(struct entropy_source_t *entropy_source) {}
+
+static void entropy_deterministic_free_thread(struct entropy_source_t *entropy_source) {}
+
+static int entropy_deterministic_get(
+  const struct entropy_source_t *entropy_source,
+  uint8_t entropy[CTR_DRBG_ENTROPY_LEN]) {
+  CRYPTO_sysrand(entropy, CTR_DRBG_ENTROPY_LEN);
+  return 1;
+}
+
+static int use_deterministic_entropy(void) {
+#if defined(OPENSSL_RAND_DETERMINISTIC)
+  return 1;
+#else
+  return 0;
+#endif
+}
+
+// Deterministic configuration.
+// - When OPENSSL_RAND_DETERMINISTIC is defined, the expectation is that
+//   generated randomness is deterministic. Typically to support fuzzing.
+// - Using |CRYPTO_sysrand| is deterministic under the
+//   |OPENSSL_RAND_DETERMINISTIC| mode.
+DEFINE_LOCAL_DATA(struct entropy_source_methods, deterministic_entropy_source_methods) {
+  out->initialize = entropy_deterministic_initialize;
+  out->zeroize_thread = entropy_deterministic_zeroize_thread;
+  out->free_thread = entropy_deterministic_free_thread;
+  out->get_seed = entropy_deterministic_get;
+  out->get_extra_entropy = entropy_deterministic_get;
+  out->get_prediction_resistance = NULL;
+  out->id = DETERMINISTIC_ENTROPY_SOURCE;
+}
+
 static const struct entropy_source_methods * get_entropy_source_methods(void) {
   if (*allow_entropy_source_methods_override_bss_get() == 1) {
     return *entropy_source_methods_override_bss_get();
   }
 
+  if (use_deterministic_entropy()) {
+    return deterministic_entropy_source_methods();
+  }
+
   if (use_opt_out_cpu_jitter_entropy()) {
     return opt_out_cpu_jitter_entropy_source_methods();
   }

crypto/fipsmodule/rand/entropy/internal.h

@@ -16,6 +16,7 @@ extern "C" {
 #define OVERRIDDEN_ENTROPY_SOURCE 0
 #define TREE_DRBG_JITTER_ENTROPY_SOURCE 1
 #define OPT_OUT_CPU_JITTER_ENTROPY_SOURCE 2
+#define DETERMINISTIC_ENTROPY_SOURCE 3
 
 #define ENTROPY_JITTER_MAX_NUM_TRIES (3)