Commit 5520695c authored by Dr. Matthias St. Pierre's avatar Dr. Matthias St. Pierre Committed by Matt Caswell
Browse files

drbg: add fork id to additional data on UNIX systems 



Provides a little extra fork-safety on UNIX systems, adding to the
fact that all DRBGs reseed automatically when the fork_id changes.

Reviewed-by: default avatarPaul Dale <paul.dale@oracle.com>
Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9802)
parent 1b0fe00e

crypto/rand/rand_unix.c

+3 −0
Original line number Original line Diff line number Diff line
@@ -711,15 +711,18 @@ int rand_pool_add_nonce_data(RAND_POOL *pool) 
int rand_pool_add_additional_data(RAND_POOL *pool)

int rand_pool_add_additional_data(RAND_POOL *pool)

{

{

    struct {

    struct {

        int fork_id;

        CRYPTO_THREAD_ID tid;

        CRYPTO_THREAD_ID tid;

        uint64_t time;

        uint64_t time;

    } data = { 0 };

    } data = { 0 };





    /*

    /*

     * Add some noise from the thread id and a high resolution timer.

     * Add some noise from the thread id and a high resolution timer.

     * The fork_id adds some extra fork-safety.

     * The thread id adds a little randomness if the drbg is accessed

     * The thread id adds a little randomness if the drbg is accessed

     * concurrently (which is the case for the <master> drbg).

     * concurrently (which is the case for the <master> drbg).

     */

     */

    data.fork_id = openssl_get_fork_id();

    data.tid = CRYPTO_THREAD_get_current_id();

    data.tid = CRYPTO_THREAD_get_current_id();

    data.time = get_timer_bits();

    data.time = get_timer_bits();