diff -up openssl-1.0.2k/crypto/fips/fips_drbg_lib.c.fips-randlock openssl-1.0.2k/crypto/fips/fips_drbg_lib.c
--- openssl-1.0.2k/crypto/fips/fips_drbg_lib.c.fips-randlock 2017-03-09 17:59:26.249231181 +0100
+++ openssl-1.0.2k/crypto/fips/fips_drbg_lib.c 2017-11-07 10:06:11.666777108 +0100
@@ -338,6 +338,12 @@ int FIPS_drbg_reseed(DRBG_CTX *dctx,
return drbg_reseed(dctx, adin, adinlen, 1);
}
+void FIPS_drbg_set_reseed(DRBG_CTX *dctx)
+{
+ if (dctx->status == DRBG_STATUS_READY)
+ dctx->status = DRBG_STATUS_RESEED;
+}
+
static int fips_drbg_check(DRBG_CTX *dctx)
{
if (dctx->xflags & DRBG_FLAG_TEST)
diff -up openssl-1.0.2k/crypto/fips/fips_rand.h.fips-randlock openssl-1.0.2k/crypto/fips/fips_rand.h
--- openssl-1.0.2k/crypto/fips/fips_rand.h.fips-randlock 2017-03-09 17:59:26.252231250 +0100
+++ openssl-1.0.2k/crypto/fips/fips_rand.h 2017-11-07 10:06:40.241450151 +0100
@@ -86,6 +86,7 @@ extern "C" {
const unsigned char *pers, size_t perslen);
int FIPS_drbg_reseed(DRBG_CTX *dctx, const unsigned char *adin,
size_t adinlen);
+ void FIPS_drbg_set_reseed(DRBG_CTX *dctx);
int FIPS_drbg_generate(DRBG_CTX *dctx, unsigned char *out, size_t outlen,
int prediction_resistance,
const unsigned char *adin, size_t adinlen);
diff -up openssl-1.0.2k/crypto/rand/md_rand.c.fips-randlock openssl-1.0.2k/crypto/rand/md_rand.c
--- openssl-1.0.2k/crypto/rand/md_rand.c.fips-randlock 2017-03-09 17:59:26.255231320 +0100
+++ openssl-1.0.2k/crypto/rand/md_rand.c 2017-10-23 17:28:00.999638475 +0200
@@ -365,6 +365,14 @@ int ssleay_rand_bytes(unsigned char *buf
num_ceil =
(1 + (num - 1) / (MD_DIGEST_LENGTH / 2)) * (MD_DIGEST_LENGTH / 2);
+ /* always poll for external entropy in FIPS mode, drbg provides the
+ * expansion
+ */
+ if (FIPS_module_mode()) {
+ RAND_poll();
+ initialized = 1;
+ }
+
/*
* (Based on the rand(3) manpage:)
*
@@ -391,10 +399,7 @@ int ssleay_rand_bytes(unsigned char *buf
CRYPTO_w_unlock(CRYPTO_LOCK_RAND2);
crypto_lock_rand = 1;
- /* always poll for external entropy in FIPS mode, drbg provides the
- * expansion
- */
- if (!initialized || FIPS_module_mode()) {
+ if (!initialized) {
RAND_poll();
initialized = 1;
}
diff -up openssl-1.0.2k/crypto/rand/rand_lib.c.fips-randlock openssl-1.0.2k/crypto/rand/rand_lib.c
--- openssl-1.0.2k/crypto/rand/rand_lib.c.fips-randlock 2017-03-09 17:59:26.292232183 +0100
+++ openssl-1.0.2k/crypto/rand/rand_lib.c 2017-11-07 10:20:08.050403861 +0100
@@ -238,7 +238,7 @@ static int drbg_rand_add(DRBG_CTX *ctx,
RAND_SSLeay()->add(in, inlen, entropy);
if (FIPS_rand_status()) {
CRYPTO_w_lock(CRYPTO_LOCK_RAND);
- FIPS_drbg_reseed(ctx, NULL, 0);
+ FIPS_drbg_set_reseed(ctx);
CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
}
return 1;
@@ -249,7 +249,7 @@ static int drbg_rand_seed(DRBG_CTX *ctx,
RAND_SSLeay()->seed(in, inlen);
if (FIPS_rand_status()) {
CRYPTO_w_lock(CRYPTO_LOCK_RAND);
- FIPS_drbg_reseed(ctx, NULL, 0);
+ FIPS_drbg_set_reseed(ctx);
CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
}
return 1;