RNG changes (GH #593)

Change reseed interval logic to count calls to `randomize` rather than
bytes, to match SP 800-90A

Changes RNG reseeding API: there is no implicit reference to the
global entropy sources within the RNGs anymore. The entropy sources
must be supplied with the API call. Adds support for reseding directly
from another RNG (such as a system or hardware RNG).

Stateful_RNG keeps optional references to both an RNG and a set of
entropy sources. During a reseed, both sources are used if set.
These can be provided to HMAC_DRBG constructor.

For HMAC_DRBG, SP800-90A requires we output no more than 2**16 bytes
per DRBG request. We treat requests longer than that as if the caller
had instead made several sequential maximum-length requests. This
means it is possible for one or more reseeds to trigger even in the
course of generating a single (long) output (generate a 256-bit key
and use ChaCha or HKDF if this is a problem).

Adds RNG::randomize_with_ts_input which takes timestamps and uses them
as the additional_data DRBG field. Stateful_RNG overrides this to also
include the process ID and the reseed counter. AutoSeeded_RNG's
`randomize` uses this.

Officially deprecates RNG::make_rng and the Serialized_RNG construtor
which creates an AutoSeeded_RNG. With these removed, it would be
possible to perform a build with no AutoSeeded_RNG/HMAC_DRBG at all
(eg, for applications which only use the system RNG).

Tests courtesy @cordney in GH PRs #598 and #600

6 files changed, 357 insertions, 54 deletions

diff --git a/src/tests/main.cpp b/src/tests/main.cpp
index 79be98a0e..07aaac519 100644
--- a/src/tests/main.cpp
+++ b/src/tests/main.cpp
@@ -15,8 +15,8 @@
 #include <future>
 
 #include <botan/version.h>
-#include <botan/auto_rng.h>
 #include <botan/loadstor.h>
+#include <botan/hash.h>
 
 #if defined(BOTAN_HAS_HMAC_DRBG)
 #include <botan/hmac_drbg.h>
@@ -26,6 +26,10 @@
 #include <botan/system_rng.h>
 #endif
 
+#if defined(BOTAN_HAS_AUTO_SEEDING_RNG)
+  #include <botan/auto_rng.h>
+#endif
+
 namespace {
 
 class Test_Runner : public Botan_CLI::Command
@@ -140,7 +144,14 @@ class Test_Runner : public Botan_CLI::Command
             }
 
          output() << " rng:HMAC_DRBG with seed '" << Botan::hex_encode(seed) << "'";
-         std::unique_ptr<Botan::HMAC_DRBG> drbg(new Botan::HMAC_DRBG("SHA-384", 0));
+
+         // Expand out the seed to 512 bits to make the DRBG happy
+         std::unique_ptr<Botan::HashFunction> sha512(Botan::HashFunction::create("SHA-512"));
+         sha512->update(seed);
+         seed.resize(sha512->output_length());
+         sha512->final(seed.data());
+
+         std::unique_ptr<Botan::HMAC_DRBG> drbg(new Botan::HMAC_DRBG("SHA-384"));
          drbg->initialize_with(seed.data(), seed.size());
          rng.reset(new Botan::Serialized_RNG(drbg.release()));
 
@@ -152,16 +163,19 @@ class Test_Runner : public Botan_CLI::Command
 #if defined(BOTAN_HAS_SYSTEM_RNG)
          output() << " rng:system";
          rng.reset(new Botan::System_RNG);
-#else
-         // AutoSeeded_RNG always available
+#elif defined(BOTAN_HAS_AUTO_SEEDING_RNG)
          output() << " rng:autoseeded";
          rng.reset(new Botan::Serialized_RNG(new Botan::AutoSeeded_RNG));
 #endif
 
 #endif
-
          output() << "\n";
 
+         if(rng.get() == nullptr)
+             {
+             throw Botan_Tests::Test_Error("No usable RNG enabled in build, aborting tests");
+             }
+
          Botan_Tests::Test::setup_tests(soak_level, log_success, data_dir, pkcs11_lib, rng.get());
 
          const size_t failed = run_tests(req, output(), threads);
diff --git a/src/tests/test_mceliece.cpp b/src/tests/test_mceliece.cpp
index 8658bf5e6..5e3501b3e 100644
--- a/src/tests/test_mceliece.cpp
+++ b/src/tests/test_mceliece.cpp
@@ -67,7 +67,7 @@ class McEliece_Keygen_Encrypt_Test : public Text_Based_Test
          const size_t keygen_n = get_req_sz(vars, "KeyN");
          const size_t keygen_t = get_req_sz(vars, "KeyT");
 
-         Botan::HMAC_DRBG rng("SHA-384", 0);
+         Botan::HMAC_DRBG rng("SHA-384");
          rng.initialize_with(keygen_seed.data(), keygen_seed.size());
          Botan::McEliece_PrivateKey mce_priv(rng, keygen_n, keygen_t);
 
diff --git a/src/tests/test_pkcs11_high_level.cpp b/src/tests/test_pkcs11_high_level.cpp
index 8e894ef28..e8c19224e 100644
--- a/src/tests/test_pkcs11_high_level.cpp
+++ b/src/tests/test_pkcs11_high_level.cpp
@@ -1346,18 +1346,12 @@ Test::Result test_pkcs11_hmac_drbg()
    Test::Result result("PKCS11 HMAC_DRBG using PKCS11_RNG");
    TestSession test_session(true);
 
-   // FIXME: this is only a temporary fix
-   // It should be possible to instantiate HMAC_DRBG with PKCS11_RNG and
-   // HMAC_DRBG should reseed itself from PKCS11_RNG
-   HMAC_DRBG drbg(MessageAuthenticationCode::create("HMAC(SHA-512)").release());
+   PKCS11_RNG p11_rng(test_session.session());
+   HMAC_DRBG drbg(MessageAuthenticationCode::create("HMAC(SHA-512)"), p11_rng);
    // result.test_success("HMAC_DRBG(HMAC(SHA512)) instantiated with PKCS11_RNG");
 
    result.test_eq("HMAC_DRBG is not seeded yet.", drbg.is_seeded(), false);
-
-   PKCS11_RNG p11_rng(test_session.session());
-   secure_vector<byte> rnd = p11_rng.random_vec(64);
-
-   drbg.initialize_with(rnd.data(), rnd.size());
+   secure_vector<byte> rnd = drbg.random_vec(64);
    result.test_eq("HMAC_DRBG is seeded now", drbg.is_seeded(), true);
 
    std::string personalization_string = "Botan PKCS#11 Tests";
diff --git a/src/tests/test_rng.cpp b/src/tests/test_rng.cpp
index ab5a38135..3368ab52b 100644
--- a/src/tests/test_rng.cpp
+++ b/src/tests/test_rng.cpp
@@ -1,5 +1,6 @@
 /*
 * (C) 2014,2015 Jack Lloyd
+* (C) 2016 René Korthaus, Rohde & Schwarz Cybersecurity
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -15,6 +16,17 @@
   #include <botan/x931_rng.h>
 #endif
 
+#if defined(BOTAN_HAS_ENTROPY_SOURCE)
+  #include <botan/entropy_src.h>
+#endif
+
+#if defined(BOTAN_TARGET_OS_TYPE_IS_UNIX)
+  #include <unistd.h>
+  #include <sys/wait.h>
+#endif
+
+#include <iostream>
+
 namespace Botan_Tests {
 
 namespace {
@@ -81,7 +93,7 @@ class HMAC_DRBG_Tests : public Text_Based_Test
             return result;
             }
 
-         std::unique_ptr<Botan::HMAC_DRBG> rng(new Botan::HMAC_DRBG(mac.release(), 0));
+         std::unique_ptr<Botan::HMAC_DRBG> rng(new Botan::HMAC_DRBG(std::move(mac)));
          rng->initialize_with(seed_input.data(), seed_input.size());
 
          // now reseed
@@ -100,23 +112,69 @@ class HMAC_DRBG_Tests : public Text_Based_Test
 
 BOTAN_REGISTER_TEST("hmac_drbg", HMAC_DRBG_Tests);
 
-class HMAC_DRBG_Reseed_Tests : public Test
+class HMAC_DRBG_Unit_Tests : public Test
    {
-   public:
-      HMAC_DRBG_Reseed_Tests() : Test() {}
+   private:
+      class Broken_Entropy_Source : public Botan::Entropy_Source
+         {
+         public:
+            std::string name() const override { return "Broken Entropy Source"; }
 
-      std::vector<Test::Result> run() override
+            size_t poll(Botan::RandomNumberGenerator&) override
+               {
+               throw Botan::Exception("polling not available");
+               }
+         };
+
+      class Insufficient_Entropy_Source : public Botan::Entropy_Source
          {
-         Test::Result result("HMAC_DRBG Reseed");
+         public:
+            std::string name() const override { return "Insufficient Entropy Source"; }
+
+            size_t poll(Botan::RandomNumberGenerator&) override
+               {
+               return 0;
+               }
+         };
+
+      class Request_Counting_RNG : public Botan::RandomNumberGenerator
+         {
+         public:
+            Request_Counting_RNG() : m_randomize_count(0) {};
+
+            bool is_seeded() const override { return true; }
+
+            void clear() override {}
+
+            void randomize(byte[], size_t) override
+               {
+               m_randomize_count++;
+               }
+
+            void add_entropy(const byte[], size_t) override {}
+
+            std::string name() const override { return "Request_Counting_RNG"; }
+
+            size_t randomize_count() { return m_randomize_count; }
+
+         private:
+            size_t m_randomize_count;
+         };
+
+   public:
+      Test::Result test_reseed_kat()
+         {
+         Test::Result result("HMAC_DRBG Reseed KAT");
 
          auto mac = Botan::MessageAuthenticationCode::create("HMAC(SHA-256)");
          if(!mac)
             {
             result.note_missing("HMAC(SHA-256)");
-            return {result};
+            return result;
             }
 
-         Botan::HMAC_DRBG rng(mac.release(), 17);
+         Request_Counting_RNG counting_rng;
+         Botan::HMAC_DRBG rng(std::move(mac), counting_rng, Botan::Entropy_Sources::global_sources(), 2);
          Botan::secure_vector<Botan::byte> seed_input(
                {0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xAA,0xBB,0xCC,0xDD,0xEE,0xFF});
          Botan::secure_vector<Botan::byte> output_after_initialization(
@@ -130,16 +188,273 @@ class HMAC_DRBG_Reseed_Tests : public Test
          Botan::secure_vector<Botan::byte> out(16);
 
          rng.randomize(out.data(), out.size());
+         result.test_eq("underlying RNG calls", counting_rng.randomize_count(), size_t(0));
          result.test_eq("out before reseed", out, output_after_initialization);
 
-         // reseed must happend here
+         // reseed must happen here
          rng.randomize(out.data(), out.size());
+         result.test_eq("underlying RNG calls", counting_rng.randomize_count(), size_t(1));
          result.test_ne("out after reseed", out, output_without_reseed);
-         return {result};
+
+         return result;
+         }
+
+      Test::Result test_reseed()
+         {
+         Test::Result result("HMAC_DRBG Reseed");
+
+         auto mac = Botan::MessageAuthenticationCode::create("HMAC(SHA-256)");
+         if(!mac)
+            {
+            result.note_missing("HMAC(SHA-256)");
+            return result;
+            }
+
+         // test reseed_interval is enforced
+         Request_Counting_RNG counting_rng;
+         Botan::HMAC_DRBG rng(std::move(mac), counting_rng, 2);
+
+         rng.random_vec(7);
+         result.test_eq("initial seeding", counting_rng.randomize_count(), 1);
+         rng.random_vec(9);
+         result.test_eq("still initial seed", counting_rng.randomize_count(), 1);
+
+         rng.random_vec(1);
+         result.test_eq("first reseed", counting_rng.randomize_count(), 2);
+         rng.random_vec(15);
+         result.test_eq("still first reseed", counting_rng.randomize_count(), 2);
+
+         rng.random_vec(15);
+         result.test_eq("second reseed", counting_rng.randomize_count(), 3);
+         rng.random_vec(1);
+         result.test_eq("still second reseed", counting_rng.randomize_count(), 3);
+
+         // request > max_number_of_bits_per_request, do reseeds occur?
+         rng.random_vec(64*1024 + 1);
+         result.test_eq("request exceeds output limit", counting_rng.randomize_count(), 4);
+
+         rng.random_vec(9*64*1024 + 1);
+         result.test_eq("request exceeds output limit", counting_rng.randomize_count(), 9);
+
+         return result;
+         }
+
+      Test::Result test_broken_entropy_input()
+         {
+         Test::Result result("HMAC_DRBG Broken Entropy Input");
+
+         auto mac = Botan::MessageAuthenticationCode::create("HMAC(SHA-256)");
+         if(!mac)
+            {
+            result.note_missing("HMAC(SHA-256)");
+            return result;
+            }
+
+         // make sure no output is generated when the entropy input source is broken
+
+         const size_t reseed_interval = 1024;
+
+         // underlying_rng throws exception
+         Botan::Null_RNG broken_entropy_input_rng;
+         Botan::HMAC_DRBG rng_with_broken_rng(std::move(mac), broken_entropy_input_rng, reseed_interval);
+
+         result.test_throws("broken underlying rng", [&rng_with_broken_rng] () { rng_with_broken_rng.random_vec(16); });
+
+         // entropy_sources throw exception
+         std::unique_ptr<Broken_Entropy_Source> broken_entropy_source_1(new Broken_Entropy_Source());
+         std::unique_ptr<Broken_Entropy_Source> broken_entropy_source_2(new Broken_Entropy_Source());
+
+         Botan::Entropy_Sources broken_entropy_sources;
+         broken_entropy_sources.add_source(std::move(broken_entropy_source_1));
+         broken_entropy_sources.add_source(std::move(broken_entropy_source_2));
+
+         mac = Botan::MessageAuthenticationCode::create("HMAC(SHA-256)");
+         Botan::HMAC_DRBG rng_with_broken_es(std::move(mac), broken_entropy_sources, reseed_interval);
+         result.test_throws("broken entropy sources", [&rng_with_broken_es] () { rng_with_broken_es.random_vec(16); });
+
+         // entropy source returns insufficient entropy
+         Botan::Entropy_Sources insufficient_entropy_sources;
+         std::unique_ptr<Insufficient_Entropy_Source> insufficient_entropy_source(new Insufficient_Entropy_Source());
+         insufficient_entropy_sources.add_source(std::move(insufficient_entropy_source));
+
+         mac = Botan::MessageAuthenticationCode::create("HMAC(SHA-256)");
+         Botan::HMAC_DRBG rng_with_insufficient_es(std::move(mac), insufficient_entropy_sources, reseed_interval);
+         result.test_throws("insufficient entropy source", [&rng_with_insufficient_es] () { rng_with_insufficient_es.random_vec(16); });
+
+         // one of or both underlying_rng and entropy_sources throw exception
+         mac = Botan::MessageAuthenticationCode::create("HMAC(SHA-256)");
+         Botan::HMAC_DRBG rng_with_broken_rng_and_es(std::move(mac), broken_entropy_input_rng,
+               Botan::Entropy_Sources::global_sources(), reseed_interval);
+         result.test_throws("broken underlying rng but good entropy sources", [&rng_with_broken_rng_and_es] ()
+                  { rng_with_broken_rng_and_es.random_vec(16); });
+
+         mac = Botan::MessageAuthenticationCode::create("HMAC(SHA-256)");
+         Botan::HMAC_DRBG rng_with_rng_and_broken_es(std::move(mac), Test::rng(), broken_entropy_sources, reseed_interval);
+         result.test_throws("good underlying rng but broken entropy sources", [&rng_with_rng_and_broken_es] ()
+                  { rng_with_rng_and_broken_es.random_vec(16); });
+
+         mac = Botan::MessageAuthenticationCode::create("HMAC(SHA-256)");
+         Botan::HMAC_DRBG rng_with_broken_rng_and_broken_es(std::move(mac), broken_entropy_input_rng, broken_entropy_sources, reseed_interval);
+         result.test_throws("underlying rng and entropy sources broken", [&rng_with_broken_rng_and_broken_es] ()
+                  { rng_with_broken_rng_and_broken_es.random_vec(16); });
+
+         return result;
+         }
+
+      Test::Result test_check_nonce()
+         {
+         Test::Result result("HMAC_DRBG Nonce Check");
+
+         auto mac = Botan::MessageAuthenticationCode::create("HMAC(SHA-256)");
+         if(!mac)
+            {
+            result.note_missing("HMAC(SHA-256)");
+            return result;
+            }
+
+         // make sure the nonce has at least 1/2*security_strength bits
+
+         // SHA-256 -> 128 bits security strength
+         for( auto nonce_size : { 0, 4, 15, 16, 17, 32 } )
+            {
+            if(!mac)
+               {
+               mac = Botan::MessageAuthenticationCode::create("HMAC(SHA-256)");
+               }
+
+            Botan::HMAC_DRBG rng(std::move(mac));
+            result.test_eq("not seeded", rng.is_seeded(), false);
+            std::vector<Botan::byte> nonce(nonce_size);
+            rng.initialize_with(nonce.data(), nonce.size());
+
+            if(nonce_size < 16)
+               {
+               result.test_eq("not seeded", rng.is_seeded(), false);
+               result.test_throws("invalid nonce size", [&rng, &nonce] () { rng.random_vec(16); });
+               }
+            else
+               {
+               result.test_eq("is seeded", rng.is_seeded(), true);
+               rng.random_vec(16);
+               }
+            }
+
+         return result;
+         }
+
+      Test::Result test_prediction_resistance()
+         {
+         Test::Result result("HMAC_DRBG Prediction Resistance");
+
+         auto mac = Botan::MessageAuthenticationCode::create("HMAC(SHA-256)");
+         if(!mac)
+            {
+            result.note_missing("HMAC(SHA-256)");
+            return result;
+            }
+
+         // set max_output_before_reseed = 1, forcing a reseed on every request
+         Request_Counting_RNG counting_rng;
+         Botan::HMAC_DRBG rng(std::move(mac), counting_rng, 1);
+
+         rng.random_vec(16);
+         result.test_eq("first request", counting_rng.randomize_count(), size_t(1));
+
+         rng.random_vec(16);
+         result.test_eq("second request", counting_rng.randomize_count(), size_t(2));
+
+         rng.random_vec(16);
+         result.test_eq("third request", counting_rng.randomize_count(), size_t(3));
+
+         return result;
+         }
+
+      Test::Result test_fork_safety()
+         {
+         Test::Result result("HMAC_DRBG Fork Safety");
+
+#if defined(BOTAN_TARGET_OS_TYPE_IS_UNIX)
+         auto mac = Botan::MessageAuthenticationCode::create("HMAC(SHA-256)");
+         if(!mac)
+            {
+            result.note_missing("HMAC(SHA-256)");
+            return result;
+            }
+
+         const size_t reseed_interval = 1024;
+
+         // make sure rng is reseeded after every fork
+         Request_Counting_RNG counting_rng;
+         Botan::HMAC_DRBG rng(std::move(mac), counting_rng, reseed_interval);
+
+         rng.random_vec(16);
+         result.test_eq("first request", counting_rng.randomize_count(), size_t(1));
+
+         // fork and request from parent and child, both should output different sequences
+         size_t count = counting_rng.randomize_count();
+         Botan::secure_vector<byte> parent_bytes(16), child_bytes(16);
+         int fd[2];
+         int rc = pipe(fd);
+         if(rc != 0)
+            {
+            result.test_failure("failed to create pipe");
+            }
+
+         pid_t pid = fork();
+         if ( pid == -1 )
+            {
+            result.test_failure("failed to fork process");
+            return result;
+            }
+         else if ( pid != 0 )
+            {
+            // parent process, wait for randomize_count from child's rng
+            close(fd[1]);
+            read(fd[0], &count, sizeof(count));
+            close(fd[0]);
+
+
+            result.test_eq("parent not reseeded",  counting_rng.randomize_count(), 1);
+            result.test_eq("child reseed occurred", count, 2);
+
+            parent_bytes = rng.random_vec(16);
+            read(fd[0], &child_bytes[0], child_bytes.size());
+            result.test_ne("parent and child output sequences differ", parent_bytes, child_bytes);
+            close(fd[0]);
+
+            int status = 0;
+            ::waitpid(pid, &status, 0);
+            }
+         else
+            {
+            // child process, send randomize_count and first output sequence back to parent
+            close(fd[0]);
+            rng.randomize(&child_bytes[0], child_bytes.size());
+            count = counting_rng.randomize_count();
+            write(fd[1], &count, sizeof(count));
+            rng.randomize(&child_bytes[0], child_bytes.size());
+            write(fd[1], &child_bytes[0], child_bytes.size());
+            close(fd[1]);
+            _exit(0);
+            }
+#endif
+         return result;
+         }
+
+      std::vector<Test::Result> run() override
+         {
+         std::vector<Test::Result> results;
+         results.push_back(test_reseed_kat());
+         results.push_back(test_reseed());
+         results.push_back(test_broken_entropy_input());
+         results.push_back(test_check_nonce());
+         results.push_back(test_prediction_resistance());
+         results.push_back(test_fork_safety());
+         return results;
          }
    };
 
-BOTAN_REGISTER_TEST("hmac_drbg_reseed", HMAC_DRBG_Reseed_Tests);
+BOTAN_REGISTER_TEST("hmac_drbg_unit", HMAC_DRBG_Unit_Tests);
 
 #endif
 
diff --git a/src/tests/test_rng.h b/src/tests/test_rng.h
index 6c29b1d55..0379a2ee9 100644
--- a/src/tests/test_rng.h
+++ b/src/tests/test_rng.h
@@ -15,13 +15,6 @@
 #include <botan/hex.h>
 #include <botan/exceptn.h>
 
-#if defined(BOTAN_HAS_SYSTEM_RNG)
-  #include <botan/system_rng.h>
-#else
-  #include <botan/auto_rng.h>
-#endif
-
-
 namespace Botan_Tests {
 
 /**
@@ -43,9 +36,9 @@ class Fixed_Output_RNG : public Botan::RandomNumberGenerator
          return out;
          }
 
-      size_t reseed_with_sources(Botan::Entropy_Sources&,
-                                 size_t,
-                                 std::chrono::milliseconds) override { return 0; }
+      size_t reseed(Botan::Entropy_Sources&,
+                    size_t,
+                    std::chrono::milliseconds) override { return 0; }
 
       void randomize(uint8_t out[], size_t len) override
          {
@@ -87,7 +80,7 @@ class Fixed_Output_RNG : public Botan::RandomNumberGenerator
 class Fixed_Output_Position_RNG : public Fixed_Output_RNG
    {
    public:
-      bool is_seeded() const override { return !m_buf.empty() || m_rng->is_seeded(); }
+      bool is_seeded() const override { return !m_buf.empty() || Test::rng().is_seeded(); }
 
       uint8_t random() override
          {
@@ -114,7 +107,7 @@ class Fixed_Output_Position_RNG : public Fixed_Output_RNG
             }
          else
             { // return random
-               m_rng->randomize(out,len);
+               Test::rng().randomize(out,len);
             }
          }
 
@@ -127,32 +120,19 @@ class Fixed_Output_Position_RNG : public Fixed_Output_RNG
 
       explicit Fixed_Output_Position_RNG(const std::vector<uint8_t>& in, uint32_t pos) :
             Fixed_Output_RNG(in),
-            m_pos(pos),
-            m_rng{}
+            m_pos(pos)
          {
-#if defined(BOTAN_HAS_SYSTEM_RNG)
-   m_rng.reset(new Botan::System_RNG);
-#else
-   m_rng.reset(new Botan::AutoSeeded_RNG);
-#endif
          }
 
       explicit Fixed_Output_Position_RNG(const std::string& in_str, uint32_t pos) :
             Fixed_Output_RNG(in_str),
-            m_pos(pos),
-            m_rng{}
+            m_pos(pos)
          {
-#if defined(BOTAN_HAS_SYSTEM_RNG)
-   m_rng.reset(new Botan::System_RNG);
-#else
-   m_rng.reset(new Botan::AutoSeeded_RNG);
-#endif
          }
 
    private:
       uint32_t m_pos = 0;
       uint32_t m_requests = 0;
-      std::unique_ptr<RandomNumberGenerator> m_rng;
    };
 
 class SeedCapturing_RNG : public Botan::RandomNumberGenerator
diff --git a/src/tests/tests.cpp b/src/tests/tests.cpp
index d3467460e..a6f96144c 100644
--- a/src/tests/tests.cpp
+++ b/src/tests/tests.cpp
@@ -127,7 +127,7 @@ bool Test::Result::test_ne(const std::string& what,
                            const uint8_t expected[], size_t expected_len)
    {
    if(produced_len == expected_len && Botan::same_mem(produced, expected, expected_len))
-      return test_failure(who() + ":" + what + " produced matching");
+      return test_failure(who() + ": " + what + " produced matching");
    return test_success();
    }