refactor php_win32_get_random_bytes()

- avoid locking
- initialize only once
- the process will fail, if no init failed

Author: weltling

main/main.c

@@ -2095,7 +2095,10 @@ int php_module_startup(sapi_module_struct *sf, zend_module_entry *additional_mod
 #endif
 
 #ifdef PHP_WIN32
-	php_win32_init_rng_lock();
+	if (!php_win32_init_random_bytes()) {
+		php_printf("\ncrypto service provider failed\n");
+		return FAILURE;
+	}
 #endif
 
 	module_shutdown = 0;
@@ -2409,7 +2412,7 @@ void php_module_shutdown(void)
 #endif
 
 #ifdef PHP_WIN32
-	php_win32_free_rng_lock();
+	(void)php_win32_shutdown_random_bytes();
 #endif
 
 	sapi_flush();

win32/winutil.c

@@ -51,77 +51,50 @@ int php_win32_check_trailing_space(const char * path, const int path_len) {
 	}
 }
 
-HCRYPTPROV   hCryptProv;
-unsigned int has_crypto_ctx = 0;
+static HCRYPTPROV hCryptProv;
+static BOOL has_crypto_ctx = 0;
 
-#ifdef ZTS
-MUTEX_T php_lock_win32_cryptoctx;
-void php_win32_init_rng_lock()
+#ifdef PHP_EXPORTS
+BOOL php_win32_init_random_bytes(void)
 {
-	php_lock_win32_cryptoctx = tsrm_mutex_alloc();
+	int err;
+
+	/* CRYPT_VERIFYCONTEXT > only hashing&co-like use, no need to acces prv keys */
+	has_crypto_ctx = CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_MACHINE_KEYSET|CRYPT_VERIFYCONTEXT);
+	err = GetLastError();
+	if (!has_crypto_ctx) {
+		/* Could mean that the key container does not exist, let try
+		   again by asking for a new one. If it fails here, it surely means that the user running
+		   this process does not have the permission(s) to use this container.
+		 */
+		if (NTE_BAD_KEYSET == err) {
+			has_crypto_ctx = CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET | CRYPT_MACHINE_KEYSET | CRYPT_VERIFYCONTEXT);
+		}
+	}
+
+	return has_crypto_ctx;
 }
 
-void php_win32_free_rng_lock()
+BOOL php_win32_shutdown_random_bytes(void)
 {
-	tsrm_mutex_lock(php_lock_win32_cryptoctx);
-	if (has_crypto_ctx == 1) {
-		CryptReleaseContext(hCryptProv, 0);
-		has_crypto_ctx = 0;
+	BOOL ret = TRUE;
+
+	if (has_crypto_ctx) {
+		ret = CryptReleaseContext(hCryptProv, 0);
 	}
-	tsrm_mutex_unlock(php_lock_win32_cryptoctx);
-	tsrm_mutex_free(php_lock_win32_cryptoctx);
 
+	return ret;
 }
-#else
-#define php_win32_init_rng_lock();
-#define php_win32_free_rng_lock();
 #endif
 
-
-
 PHP_WINUTIL_API int php_win32_get_random_bytes(unsigned char *buf, size_t size) {  /* {{{ */
 
 	BOOL ret;
 
-#ifdef ZTS
-	tsrm_mutex_lock(php_lock_win32_cryptoctx);
-#endif
-
-	if (has_crypto_ctx == 0) {
-		/* CRYPT_VERIFYCONTEXT > only hashing&co-like use, no need to acces prv keys */
-		if (!CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_MACHINE_KEYSET|CRYPT_VERIFYCONTEXT )) {
-			/* Could mean that the key container does not exist, let try
-			   again by asking for a new one. If it fails here, it surely means that the user running
-               this process does not have the permission(s) to use this container.
-             */
-			if (GetLastError() == NTE_BAD_KEYSET) {
-				if (CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET | CRYPT_MACHINE_KEYSET | CRYPT_VERIFYCONTEXT )) {
-					has_crypto_ctx = 1;
-				} else {
-					has_crypto_ctx = 0;
-				}
-			}
-		} else {
-			has_crypto_ctx = 1;
-		}
-	}
-
-#ifdef ZTS
-	tsrm_mutex_unlock(php_lock_win32_cryptoctx);
-#endif
-
-	if (has_crypto_ctx == 0) {
-		return FAILURE;
-	}
-
 	/* XXX should go in the loop if size exceeds UINT_MAX */
 	ret = CryptGenRandom(hCryptProv, (DWORD)size, buf);
 
-	if (ret) {
-		return SUCCESS;
-	} else {
-		return FAILURE;
-	}
+	return ret ? SUCCESS : FAILURE;
 }
 /* }}} */
 

win32/winutil.h

@@ -27,13 +27,9 @@ PHP_WINUTIL_API char *php_win32_error_to_msg(HRESULT error);
 #define php_win_err()	php_win32_error_to_msg(GetLastError())
 int php_win32_check_trailing_space(const char * path, const int path_len);
 PHP_WINUTIL_API int php_win32_get_random_bytes(unsigned char *buf, size_t size);
-
-#ifdef ZTS
-void php_win32_init_rng_lock();
-void php_win32_free_rng_lock();
-#else
-#define php_win32_init_rng_lock();
-#define php_win32_free_rng_lock();
+#ifdef PHP_EXPORTS
+BOOL php_win32_init_random_bytes(void);
+BOOL php_win32_shutdown_random_bytes(void);
 #endif
 
 #if !defined(ECURDIR)