generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

FIPS mode changes to make RNG compile (this will need updating later as we

Browse Source 
need a whole new PRNG for FIPS).

1. avoid use of ERR_peek().

2. If compiling with FIPS use small FIPS EVP and disable ENGINE
This commit is contained in:
Dr. Stephen Henson 2011-01-26 14:55:23 +00:00
parent e1435034ae
commit c3ee90d8ca
2 changed files with 21 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
crypto/rand/md_rand.c
View File

@ -109,6 +109,8 @@
* *
*/ */
#define OPENSSL_FIPSEVP
#ifdef MD_RAND_DEBUG #ifdef MD_RAND_DEBUG
# ifndef NDEBUG # ifndef NDEBUG
# define NDEBUG # define NDEBUG
@ -157,13 +159,14 @@ const char RAND_version[]="RAND" OPENSSL_VERSION_PTEXT;
static void ssleay_rand_cleanup(void); static void ssleay_rand_cleanup(void);
static void ssleay_rand_seed(const void *buf, int num); static void ssleay_rand_seed(const void *buf, int num);
static void ssleay_rand_add(const void *buf, int num, double add_entropy); static void ssleay_rand_add(const void *buf, int num, double add_entropy);
static int ssleay_rand_bytes(unsigned char *buf, int num); static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo);
static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num);
static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num); static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num);
static int ssleay_rand_status(void); static int ssleay_rand_status(void);
RAND_METHOD rand_ssleay_meth={ RAND_METHOD rand_ssleay_meth={
ssleay_rand_seed, ssleay_rand_seed,
ssleay_rand_bytes, ssleay_rand_nopseudo_bytes,
ssleay_rand_cleanup, ssleay_rand_cleanup,
ssleay_rand_add, ssleay_rand_add,
ssleay_rand_pseudo_bytes, ssleay_rand_pseudo_bytes,
@ -328,7 +331,7 @@ static void ssleay_rand_seed(const void *buf, int num)
ssleay_rand_add(buf, num, (double)num); ssleay_rand_add(buf, num, (double)num);
} }
static int ssleay_rand_bytes(unsigned char *buf, int num) static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
{ {
static volatile int stirred_pool = 0; static volatile int stirred_pool = 0;
int i,j,k,st_num,st_idx; int i,j,k,st_num,st_idx;
@ -517,6 +520,8 @@ static int ssleay_rand_bytes(unsigned char *buf, int num)
EVP_MD_CTX_cleanup(&m); EVP_MD_CTX_cleanup(&m);
if (ok) if (ok)
return(1); return(1);
else if (pseudo)
return 0;
else else
{ {
RANDerr(RAND_F_SSLEAY_RAND_BYTES,RAND_R_PRNG_NOT_SEEDED); RANDerr(RAND_F_SSLEAY_RAND_BYTES,RAND_R_PRNG_NOT_SEEDED);
@ -526,22 +531,16 @@ static int ssleay_rand_bytes(unsigned char *buf, int num)
} }
} }
static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num)
{
return ssleay_rand_bytes(buf, num, 0);
}
/* pseudo-random bytes that are guaranteed to be unique but not /* pseudo-random bytes that are guaranteed to be unique but not
unpredictable */ unpredictable */
static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num) static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num)
{ {
int ret; return ssleay_rand_bytes(buf, num, 1);
unsigned long err;
ret = RAND_bytes(buf, num);
if (ret == 0)
{
err = ERR_peek_error();
if (ERR_GET_LIB(err) == ERR_LIB_RAND &&
ERR_GET_REASON(err) == RAND_R_PRNG_NOT_SEEDED)
ERR_clear_error();
}
return (ret);
} }
static int ssleay_rand_status(void) static int ssleay_rand_status(void)

6
crypto/rand/rand_lib.c
View File

@ -60,6 +60,12 @@
#include <time.h> #include <time.h>
#include "cryptlib.h" #include "cryptlib.h"
#include <openssl/rand.h> #include <openssl/rand.h>
#ifdef OPENSSL_FIPSCANISTER
#define OPENSSL_NO_ENGINE
#include <openssl/fips.h>
#endif
#ifndef OPENSSL_NO_ENGINE #ifndef OPENSSL_NO_ENGINE
#include <openssl/engine.h> #include <openssl/engine.h>
#endif #endif