You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
65 lines
3.0 KiB
65 lines
3.0 KiB
diff -up openssl-1.0.2k/crypto/fips/fips_drbg_lib.c.fips-randlock openssl-1.0.2k/crypto/fips/fips_drbg_lib.c |
|
--- openssl-1.0.2k/crypto/fips/fips_drbg_lib.c.fips-randlock 2017-03-09 17:59:26.249231181 +0100 |
|
+++ openssl-1.0.2k/crypto/fips/fips_drbg_lib.c 2017-11-16 09:16:06.188098078 +0100 |
|
@@ -338,6 +338,12 @@ int FIPS_drbg_reseed(DRBG_CTX *dctx, |
|
return drbg_reseed(dctx, adin, adinlen, 1); |
|
} |
|
|
|
+void FIPS_drbg_set_reseed(DRBG_CTX *dctx) |
|
+{ |
|
+ if (dctx->status == DRBG_STATUS_READY) |
|
+ dctx->reseed_counter = dctx->reseed_interval; |
|
+} |
|
+ |
|
static int fips_drbg_check(DRBG_CTX *dctx) |
|
{ |
|
if (dctx->xflags & DRBG_FLAG_TEST) |
|
diff -up openssl-1.0.2k/crypto/fips/fips_rand.h.fips-randlock openssl-1.0.2k/crypto/fips/fips_rand.h |
|
--- openssl-1.0.2k/crypto/fips/fips_rand.h.fips-randlock 2017-03-09 17:59:26.252231250 +0100 |
|
+++ openssl-1.0.2k/crypto/fips/fips_rand.h 2017-11-07 10:06:40.241450151 +0100 |
|
@@ -86,6 +86,7 @@ extern "C" { |
|
const unsigned char *pers, size_t perslen); |
|
int FIPS_drbg_reseed(DRBG_CTX *dctx, const unsigned char *adin, |
|
size_t adinlen); |
|
+ void FIPS_drbg_set_reseed(DRBG_CTX *dctx); |
|
int FIPS_drbg_generate(DRBG_CTX *dctx, unsigned char *out, size_t outlen, |
|
int prediction_resistance, |
|
const unsigned char *adin, size_t adinlen); |
|
diff -up openssl-1.0.2k/crypto/rand/md_rand.c.fips-randlock openssl-1.0.2k/crypto/rand/md_rand.c |
|
--- openssl-1.0.2k/crypto/rand/md_rand.c.fips-randlock 2017-03-09 17:59:26.255231320 +0100 |
|
+++ openssl-1.0.2k/crypto/rand/md_rand.c 2017-12-06 09:20:23.615879425 +0100 |
|
@@ -391,10 +391,10 @@ int ssleay_rand_bytes(unsigned char *buf |
|
CRYPTO_w_unlock(CRYPTO_LOCK_RAND2); |
|
crypto_lock_rand = 1; |
|
|
|
- /* always poll for external entropy in FIPS mode, drbg provides the |
|
- * expansion |
|
+ /* always poll for external entropy in FIPS mode, if run as seed |
|
+ * source, drbg provides the expansion |
|
*/ |
|
- if (!initialized || FIPS_module_mode()) { |
|
+ if (!initialized || (!lock && FIPS_module_mode())) { |
|
RAND_poll(); |
|
initialized = 1; |
|
} |
|
diff -up openssl-1.0.2k/crypto/rand/rand_lib.c.fips-randlock openssl-1.0.2k/crypto/rand/rand_lib.c |
|
--- openssl-1.0.2k/crypto/rand/rand_lib.c.fips-randlock 2017-03-09 17:59:26.292232183 +0100 |
|
+++ openssl-1.0.2k/crypto/rand/rand_lib.c 2017-11-07 10:20:08.050403861 +0100 |
|
@@ -238,7 +238,7 @@ static int drbg_rand_add(DRBG_CTX *ctx, |
|
RAND_SSLeay()->add(in, inlen, entropy); |
|
if (FIPS_rand_status()) { |
|
CRYPTO_w_lock(CRYPTO_LOCK_RAND); |
|
- FIPS_drbg_reseed(ctx, NULL, 0); |
|
+ FIPS_drbg_set_reseed(ctx); |
|
CRYPTO_w_unlock(CRYPTO_LOCK_RAND); |
|
} |
|
return 1; |
|
@@ -249,7 +249,7 @@ static int drbg_rand_seed(DRBG_CTX *ctx, |
|
RAND_SSLeay()->seed(in, inlen); |
|
if (FIPS_rand_status()) { |
|
CRYPTO_w_lock(CRYPTO_LOCK_RAND); |
|
- FIPS_drbg_reseed(ctx, NULL, 0); |
|
+ FIPS_drbg_set_reseed(ctx); |
|
CRYPTO_w_unlock(CRYPTO_LOCK_RAND); |
|
} |
|
return 1;
|
|
|