int ctr_generate(RAND_DRBG *drbg,
                 unsigned char *out, size_t outlen,
                 const unsigned char *adin, size_t adinlen)
{
    RAND_DRBG_CTR *ctr = &drbg->ctr;
    if (adin != NULL && adinlen != 0) {
        ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);
        if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) {
            adin = NULL;
            adinlen = 1;
        }
    } else {
        adinlen = 0;
    }
    for ( ; ; ) {
        inc_128(ctr);
        if (outlen < 16) {
            AES_encrypt(ctr->V, ctr->K, &ctr->ks);
            memcpy(out, ctr->K, outlen);
            break;
        }
        AES_encrypt(ctr->V, out, &ctr->ks);
        out += 16;
        outlen -= 16;
        if (outlen == 0)
            break;
    }
    ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);
    return 1;
}
['int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt)\n{\n    unsigned char *senc = NULL;\n    EVP_CIPHER_CTX *ctx = NULL;\n    HMAC_CTX *hctx = NULL;\n    unsigned char *p, *encdata1, *encdata2, *macdata1, *macdata2;\n    const unsigned char *const_p;\n    int len, slen_full, slen, lenfinal;\n    SSL_SESSION *sess;\n    unsigned int hlen;\n    SSL_CTX *tctx = s->session_ctx;\n    unsigned char iv[EVP_MAX_IV_LENGTH];\n    unsigned char key_name[TLSEXT_KEYNAME_LENGTH];\n    int iv_len;\n    size_t macoffset, macendoffset;\n    union {\n        unsigned char age_add_c[sizeof(uint32_t)];\n        uint32_t age_add;\n    } age_add_u;\n    if (SSL_IS_TLS13(s)) {\n        if (ssl_randbytes(s, age_add_u.age_add_c, sizeof(age_add_u)) <= 0) {\n            SSLfatal(s, SSL_AD_INTERNAL_ERROR,\n                     SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,\n                     ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n        s->session->ext.tick_age_add = age_add_u.age_add;\n        OPENSSL_free(s->session->ext.tick_nonce);\n        s->session->ext.tick_nonce = OPENSSL_zalloc(sizeof(char));\n        if (s->session->ext.tick_nonce == NULL) {\n            SSLfatal(s, SSL_AD_INTERNAL_ERROR,\n                     SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,\n                     ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        s->session->ext.tick_nonce_len = 1;\n        s->session->time = (long)time(NULL);\n        if (s->s3->alpn_selected != NULL) {\n            OPENSSL_free(s->session->ext.alpn_selected);\n            s->session->ext.alpn_selected =\n                OPENSSL_memdup(s->s3->alpn_selected, s->s3->alpn_selected_len);\n            if (s->session->ext.alpn_selected == NULL) {\n                SSLfatal(s, SSL_AD_INTERNAL_ERROR,\n                         SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,\n                         ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            s->session->ext.alpn_selected_len = s->s3->alpn_selected_len;\n        }\n        s->session->ext.max_early_data = s->max_early_data;\n    }\n    slen_full = i2d_SSL_SESSION(s->session, NULL);\n    if (slen_full == 0 || slen_full > 0xFF00) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR,\n                 SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    senc = OPENSSL_malloc(slen_full);\n    if (senc == NULL) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR,\n                 SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    ctx = EVP_CIPHER_CTX_new();\n    hctx = HMAC_CTX_new();\n    if (ctx == NULL || hctx == NULL) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR,\n                 SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    p = senc;\n    if (!i2d_SSL_SESSION(s->session, &p)) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR,\n                 SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    const_p = senc;\n    sess = d2i_SSL_SESSION(NULL, &const_p, slen_full);\n    if (sess == NULL) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR,\n                 SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    sess->session_id_length = 0;\n    slen = i2d_SSL_SESSION(sess, NULL);\n    if (slen == 0 || slen > slen_full) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR,\n                 SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_INTERNAL_ERROR);\n        SSL_SESSION_free(sess);\n        goto err;\n    }\n    p = senc;\n    if (!i2d_SSL_SESSION(sess, &p)) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR,\n                 SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_INTERNAL_ERROR);\n        SSL_SESSION_free(sess);\n        goto err;\n    }\n    SSL_SESSION_free(sess);\n    if (tctx->ext.ticket_key_cb) {\n        int ret = tctx->ext.ticket_key_cb(s, key_name, iv, ctx,\n                                             hctx, 1);\n        if (ret == 0) {\n            if (!WPACKET_put_bytes_u32(pkt, 0)\n                    || !WPACKET_put_bytes_u16(pkt, 0)) {\n                SSLfatal(s, SSL_AD_INTERNAL_ERROR,\n                         SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,\n                         ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n            OPENSSL_free(senc);\n            EVP_CIPHER_CTX_free(ctx);\n            HMAC_CTX_free(hctx);\n            return 1;\n        }\n        if (ret < 0) {\n            SSLfatal(s, SSL_AD_INTERNAL_ERROR,\n                     SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,\n                     SSL_R_CALLBACK_FAILED);\n            goto err;\n        }\n        iv_len = EVP_CIPHER_CTX_iv_length(ctx);\n    } else {\n        const EVP_CIPHER *cipher = EVP_aes_256_cbc();\n        iv_len = EVP_CIPHER_iv_length(cipher);\n        if (ssl_randbytes(s, iv, iv_len) <= 0\n                || !EVP_EncryptInit_ex(ctx, cipher, NULL,\n                                       tctx->ext.tick_aes_key, iv)\n                || !HMAC_Init_ex(hctx, tctx->ext.tick_hmac_key,\n                                 sizeof(tctx->ext.tick_hmac_key),\n                                 EVP_sha256(), NULL)) {\n            SSLfatal(s, SSL_AD_INTERNAL_ERROR,\n                     SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,\n                     ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n        memcpy(key_name, tctx->ext.tick_key_name,\n               sizeof(tctx->ext.tick_key_name));\n    }\n    if (!WPACKET_put_bytes_u32(pkt,\n                               (s->hit && !SSL_IS_TLS13(s))\n                               ? 0 : s->session->timeout)\n            || (SSL_IS_TLS13(s)\n                && (!WPACKET_put_bytes_u32(pkt, age_add_u.age_add)\n                    || !WPACKET_sub_memcpy_u8(pkt, s->session->ext.tick_nonce,\n                                              s->session->ext.tick_nonce_len)))\n            || !WPACKET_start_sub_packet_u16(pkt)\n            || !WPACKET_get_total_written(pkt, &macoffset)\n            || !WPACKET_memcpy(pkt, key_name, sizeof(key_name))\n            || !WPACKET_memcpy(pkt, iv, iv_len)\n            || !WPACKET_reserve_bytes(pkt, slen + EVP_MAX_BLOCK_LENGTH,\n                                      &encdata1)\n            || !EVP_EncryptUpdate(ctx, encdata1, &len, senc, slen)\n            || !WPACKET_allocate_bytes(pkt, len, &encdata2)\n            || encdata1 != encdata2\n            || !EVP_EncryptFinal(ctx, encdata1 + len, &lenfinal)\n            || !WPACKET_allocate_bytes(pkt, lenfinal, &encdata2)\n            || encdata1 + len != encdata2\n            || len + lenfinal > slen + EVP_MAX_BLOCK_LENGTH\n            || !WPACKET_get_total_written(pkt, &macendoffset)\n            || !HMAC_Update(hctx,\n                            (unsigned char *)s->init_buf->data + macoffset,\n                            macendoffset - macoffset)\n            || !WPACKET_reserve_bytes(pkt, EVP_MAX_MD_SIZE, &macdata1)\n            || !HMAC_Final(hctx, macdata1, &hlen)\n            || hlen > EVP_MAX_MD_SIZE\n            || !WPACKET_allocate_bytes(pkt, hlen, &macdata2)\n            || macdata1 != macdata2\n            || !WPACKET_close(pkt)) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR,\n                 SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    if (SSL_IS_TLS13(s)\n            && !tls_construct_extensions(s, pkt,\n                                         SSL_EXT_TLS1_3_NEW_SESSION_TICKET,\n                                         NULL, 0)) {\n        goto err;\n    }\n    EVP_CIPHER_CTX_free(ctx);\n    HMAC_CTX_free(hctx);\n    OPENSSL_free(senc);\n    return 1;\n err:\n    OPENSSL_free(senc);\n    EVP_CIPHER_CTX_free(ctx);\n    HMAC_CTX_free(hctx);\n    return 0;\n}', 'int ssl_randbytes(SSL *s, unsigned char *rnd, size_t size)\n{\n    if (s->drbg != NULL) {\n         return RAND_DRBG_generate(s->drbg, rnd, size, 0, NULL, 0);\n    }\n    return RAND_bytes(rnd, (int)size);\n}', 'int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,\n                       int prediction_resistance,\n                       const unsigned char *adin, size_t adinlen)\n{\n    int reseed_required = 0;\n    if (drbg->state != DRBG_READY) {\n        rand_drbg_restart(drbg, NULL, 0, 0);\n        if (drbg->state == DRBG_ERROR) {\n            RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_IN_ERROR_STATE);\n            return 0;\n        }\n        if (drbg->state == DRBG_UNINITIALISED) {\n            RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_NOT_INSTANTIATED);\n            return 0;\n        }\n    }\n    if (outlen > drbg->max_request) {\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_REQUEST_TOO_LARGE_FOR_DRBG);\n        return 0;\n    }\n    if (adinlen > drbg->max_adinlen) {\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_ADDITIONAL_INPUT_TOO_LONG);\n        return 0;\n    }\n    if (drbg->fork_count != rand_fork_count) {\n        drbg->fork_count = rand_fork_count;\n        reseed_required = 1;\n    }\n    if (drbg->reseed_counter >= drbg->reseed_interval)\n        reseed_required = 1;\n    if (reseed_required || prediction_resistance) {\n        if (!RAND_DRBG_reseed(drbg, adin, adinlen)) {\n            RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_RESEED_ERROR);\n            return 0;\n        }\n        adin = NULL;\n        adinlen = 0;\n    }\n    if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {\n        drbg->state = DRBG_ERROR;\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);\n        return 0;\n    }\n    drbg->reseed_counter++;\n    return 1;\n}', 'int ctr_generate(RAND_DRBG *drbg,\n                 unsigned char *out, size_t outlen,\n                 const unsigned char *adin, size_t adinlen)\n{\n    RAND_DRBG_CTR *ctr = &drbg->ctr;\n    if (adin != NULL && adinlen != 0) {\n        ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);\n        if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) {\n            adin = NULL;\n            adinlen = 1;\n        }\n    } else {\n        adinlen = 0;\n    }\n    for ( ; ; ) {\n        inc_128(ctr);\n        if (outlen < 16) {\n            AES_encrypt(ctr->V, ctr->K, &ctr->ks);\n            memcpy(out, ctr->K, outlen);\n            break;\n        }\n        AES_encrypt(ctr->V, out, &ctr->ks);\n        out += 16;\n        outlen -= 16;\n        if (outlen == 0)\n            break;\n    }\n    ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);\n    return 1;\n}']