upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-01-28 09:29:20 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- FIPS_mode openssl does not use arc4random but RAND_pseudo_bytes.

Browse source 
git-svn-id: file:///svn/unbound/trunk@2709 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards 2012-07-03 09:32:16 +00:00
parent 6b1222dcb6
commit 64b28585e0
2 changed files with 30 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
doc/Changelog
View file

@ -1,3 +1,6 @@
3 July 2012: Wouter
- FIPS_mode openssl does not use arc4random but RAND_pseudo_bytes.
2 July 2012: Wouter
- updated iana ports list.

27
util/random.c
View file

@ -147,6 +147,16 @@ ub_arc4random_stir(struct ub_randstate* s, struct ub_randstate* from)
return;
}
}
#ifdef HAVE_FIPS_MODE
if(FIPS_mode()) {
/* RC4 is not allowed, get some trustworthy randomness */
/* double certainty here, this routine should not be
* called in FIPS_mode */
memset(rand_buf, 0, sizeof(rand_buf));
s->rc4_ready = REKEY_BYTES;
return;
}
#endif /* FIPS_MODE */
RC4_set_key(&s->rc4, SEED_SIZE, (unsigned char*)rand_buf);
/*
@ -171,6 +181,9 @@ ub_initstate(unsigned int seed, struct ub_randstate* from)
return NULL;
}
ub_systemseed(seed);
#ifdef HAVE_FIPS_MODE
if(!FIPS_mode())
#endif
ub_arc4random_stir(s, from);
return s;
}
@ -179,6 +192,20 @@ long int
ub_random(struct ub_randstate* s)
{
unsigned int r = 0;
#ifdef HAVE_FIPS_MODE
if(FIPS_mode()) {
/* RC4 is not allowed, get some trustworthy randomness */
/* we use pseudo bytes: it tries to return secure randomness
* but returns 'something' if that fails. We need something
* else if it fails, because we cannot block here */
if(RAND_pseudo_bytes((unsigned char*)&r, (int)sizeof(r))
== -1) {
log_err("FIPSmode, no arc4random but RAND failed "
"(error %ld)", ERR_get_error());
}
return (long int)((r) % (((unsigned)MAX_VALUE + 1)));
}
#endif /* FIPS_MODE */
if (s->rc4_ready <= 0) {
ub_arc4random_stir(s, NULL);
}