Blame SOURCES/openssl-1.0.2k-fips-randlock.patch

fd2893
diff -up openssl-1.0.2k/crypto/fips/fips_drbg_lib.c.fips-randlock openssl-1.0.2k/crypto/fips/fips_drbg_lib.c
fd2893
--- openssl-1.0.2k/crypto/fips/fips_drbg_lib.c.fips-randlock	2017-03-09 17:59:26.249231181 +0100
fd2893
+++ openssl-1.0.2k/crypto/fips/fips_drbg_lib.c	2017-11-16 09:16:06.188098078 +0100
fd2893
@@ -338,6 +338,12 @@ int FIPS_drbg_reseed(DRBG_CTX *dctx,
fd2893
     return drbg_reseed(dctx, adin, adinlen, 1);
fd2893
 }
fd2893
 
fd2893
+void FIPS_drbg_set_reseed(DRBG_CTX *dctx)
fd2893
+{
fd2893
+    if (dctx->status == DRBG_STATUS_READY)
fd2893
+        dctx->reseed_counter = dctx->reseed_interval;
fd2893
+}
fd2893
+
fd2893
 static int fips_drbg_check(DRBG_CTX *dctx)
fd2893
 {
fd2893
     if (dctx->xflags & DRBG_FLAG_TEST)
fd2893
diff -up openssl-1.0.2k/crypto/fips/fips_rand.h.fips-randlock openssl-1.0.2k/crypto/fips/fips_rand.h
fd2893
--- openssl-1.0.2k/crypto/fips/fips_rand.h.fips-randlock	2017-03-09 17:59:26.252231250 +0100
fd2893
+++ openssl-1.0.2k/crypto/fips/fips_rand.h	2017-11-07 10:06:40.241450151 +0100
fd2893
@@ -86,6 +86,7 @@ extern "C" {
fd2893
                               const unsigned char *pers, size_t perslen);
fd2893
     int FIPS_drbg_reseed(DRBG_CTX *dctx, const unsigned char *adin,
fd2893
                          size_t adinlen);
fd2893
+    void FIPS_drbg_set_reseed(DRBG_CTX *dctx);
fd2893
     int FIPS_drbg_generate(DRBG_CTX *dctx, unsigned char *out, size_t outlen,
fd2893
                            int prediction_resistance,
fd2893
                            const unsigned char *adin, size_t adinlen);
fd2893
diff -up openssl-1.0.2k/crypto/rand/md_rand.c.fips-randlock openssl-1.0.2k/crypto/rand/md_rand.c
fd2893
--- openssl-1.0.2k/crypto/rand/md_rand.c.fips-randlock	2017-03-09 17:59:26.255231320 +0100
fd2893
+++ openssl-1.0.2k/crypto/rand/md_rand.c	2017-12-06 09:20:23.615879425 +0100
fd2893
@@ -391,10 +391,10 @@ int ssleay_rand_bytes(unsigned char *buf
fd2893
     CRYPTO_w_unlock(CRYPTO_LOCK_RAND2);
fd2893
     crypto_lock_rand = 1;
fd2893
 
fd2893
-    /* always poll for external entropy in FIPS mode, drbg provides the 
fd2893
-     * expansion
fd2893
+    /* always poll for external entropy in FIPS mode, if run as seed
fd2893
+     * source, drbg provides the expansion
fd2893
      */
fd2893
-    if (!initialized || FIPS_module_mode()) {
fd2893
+    if (!initialized || (!lock && FIPS_module_mode())) {
fd2893
         RAND_poll();
fd2893
         initialized = 1;
fd2893
     }
fd2893
diff -up openssl-1.0.2k/crypto/rand/rand_lib.c.fips-randlock openssl-1.0.2k/crypto/rand/rand_lib.c
fd2893
--- openssl-1.0.2k/crypto/rand/rand_lib.c.fips-randlock	2017-03-09 17:59:26.292232183 +0100
fd2893
+++ openssl-1.0.2k/crypto/rand/rand_lib.c	2017-11-07 10:20:08.050403861 +0100
fd2893
@@ -238,7 +238,7 @@ static int drbg_rand_add(DRBG_CTX *ctx,
fd2893
     RAND_SSLeay()->add(in, inlen, entropy);
fd2893
     if (FIPS_rand_status()) {
fd2893
         CRYPTO_w_lock(CRYPTO_LOCK_RAND);
fd2893
-        FIPS_drbg_reseed(ctx, NULL, 0);
fd2893
+        FIPS_drbg_set_reseed(ctx);
fd2893
         CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
fd2893
     }
fd2893
     return 1;
fd2893
@@ -249,7 +249,7 @@ static int drbg_rand_seed(DRBG_CTX *ctx,
fd2893
     RAND_SSLeay()->seed(in, inlen);
fd2893
     if (FIPS_rand_status()) {
fd2893
         CRYPTO_w_lock(CRYPTO_LOCK_RAND);
fd2893
-        FIPS_drbg_reseed(ctx, NULL, 0);
fd2893
+        FIPS_drbg_set_reseed(ctx);
fd2893
         CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
fd2893
     }
fd2893
     return 1;