|
 |
32d91f |
From b16a1ff25644bb075f454afe68ee63f6f385ca9c Mon Sep 17 00:00:00 2001
|
|
|
32d91f |
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
|
|
32d91f |
Date: Wed, 23 Jan 2019 21:11:07 +0100
|
|
|
67a5cd |
Subject: [PATCH] Made RAND_status check optional (broke --disable-crypto-rand)
|
|
|
32d91f |
MIME-Version: 1.0
|
|
|
32d91f |
Content-Type: text/plain; charset=UTF-8
|
|
|
32d91f |
Content-Transfer-Encoding: 8bit
|
|
|
67a5cd |
|
|
|
32d91f |
Unlike upstream, skip it also for DHCP.
|
|
|
32d91f |
|
|
|
32d91f |
Disable RAND_status also in non-threaded builds. DHCP is built without
|
|
|
32d91f |
threads and should not check RAND_status on dns library initialization.
|
|
|
32d91f |
Lack of entropy is possible state for dhclient, but it must not fail
|
|
|
32d91f |
even in this case. Because DHCP itself does not require custom random
|
|
|
32d91f |
generator, leave default RAND_OpenSSL configured. It should help TLS
|
|
|
32d91f |
connection to LDAP in single DHCP binary, while keeping secure random
|
|
|
32d91f |
data if needed.
|
|
|
32d91f |
|
|
|
32d91f |
(modified upstream commit 8a98277811ea50035ff37b744fa3dc5b75bee099)
|
|
|
32d91f |
|
|
|
32d91f |
Signed-off-by: Petr Menšík <pemensik@redhat.com>
|
|
|
67a5cd |
---
|
|
|
67a5cd |
lib/dns/openssl_link.c | 2 ++
|
|
|
67a5cd |
1 file changed, 2 insertions(+)
|
|
|
67a5cd |
|
|
|
67a5cd |
diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
|
|
|
32d91f |
index 7a233dd..941eb17 100644
|
|
|
67a5cd |
--- a/lib/dns/openssl_link.c
|
|
|
67a5cd |
+++ b/lib/dns/openssl_link.c
|
|
|
67a5cd |
@@ -289,6 +289,7 @@ dst__openssl_init(const char *engine) {
|
|
|
67a5cd |
#endif
|
|
|
67a5cd |
#endif /* !defined(OPENSSL_NO_ENGINE) */
|
|
|
67a5cd |
|
|
|
32d91f |
+#if defined(ISC_PLATFORM_CRYPTORANDOM) && defined(ISC_PLATFORM_USETHREADS)
|
|
|
67a5cd |
/* Protect ourselves against unseeded PRNG */
|
|
|
67a5cd |
if (RAND_status() != 1) {
|
|
|
67a5cd |
FATAL_ERROR(__FILE__, __LINE__,
|
|
|
67a5cd |
@@ -296,6 +297,7 @@ dst__openssl_init(const char *engine) {
|
|
|
67a5cd |
"cannot be initialized (see the `PRNG not "
|
|
|
67a5cd |
"seeded' message in the OpenSSL FAQ)");
|
|
|
67a5cd |
}
|
|
|
67a5cd |
+#endif
|
|
|
67a5cd |
|
|
|
67a5cd |
return (ISC_R_SUCCESS);
|
|
|
67a5cd |
|
|
|
67a5cd |
--
|
|
|
67a5cd |
2.20.1
|
|
|
67a5cd |
|