Commit 4ac62276 authored by Matt Caswell's avatar Matt Caswell
Browse files

Temporarily disable RAND call in FIPS_MODE until RAND is available 



Other commits will enable the RAND code in FIPS_MODE. Until those commits
are in place we temporarily disable making RAND calls while in FIPS_MODE.

Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
Reviewed-by: default avatarShane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9130)
parent 9632bd0e

crypto/bn/bn_rand.c

+29 −0
Original line number Diff line number Diff line
@@ -45,7 +45,16 @@ static int bnrand(BNRAND_FLAG flag, BIGNUM *rnd, int bits, int top, int bottom) 
    }



    /* make a random number and set the top and bottom bits */

    /*

     * TODO(3.0): Temporarily disable RAND code in the FIPS module until we

     * have made it available there.

     */

#if defined(FIPS_MODE)

    BNerr(BN_F_BNRAND, ERR_R_INTERNAL_ERROR);

    goto err;

#else

    b = flag == NORMAL ? RAND_bytes(buf, bytes) : RAND_priv_bytes(buf, bytes);

#endif

    if (b <= 0)

        goto err;
@@ -57,8 +66,14 @@ static int bnrand(BNRAND_FLAG flag, BIGNUM *rnd, int bits, int top, int bottom) 
        unsigned char c;



        for (i = 0; i < bytes; i++) {

    /*

     * TODO(3.0): Temporarily disable RAND code in the FIPS module until we

     * have made it available there.

     */

#if !defined(FIPS_MODE)

            if (RAND_bytes(&c, 1) <= 0)

                goto err;

#endif

            if (c >= 128 && i > 0)

                buf[i] = buf[i - 1];

            else if (c < 42)
@@ -223,7 +238,15 @@ int BN_generate_dsa_nonce(BIGNUM *out, const BIGNUM *range, 
    int ret = 0;

    EVP_MD *md = NULL;

    OPENSSL_CTX *libctx = (ctx != NULL) ? bn_get_lib_ctx(ctx) : NULL;

    /*

     * TODO(3.0): Temporarily disable RAND code in the FIPS module until we

     * have made it available there.

     */

#ifdef FIPS_MODE

    RAND_DRBG *privdrbg = NULL;

#else

    RAND_DRBG *privdrbg = OPENSSL_CTX_get0_private_drbg(libctx);

#endif



    if (mdctx == NULL || privdrbg == NULL)

        goto err;
@@ -252,8 +275,14 @@ int BN_generate_dsa_nonce(BIGNUM *out, const BIGNUM *range, 
        goto err;

    }

    for (done = 0; done < num_k_bytes;) {

        /*

         * TODO(3.0): Temporarily disable RAND code in the FIPS module until we

         * have made it available there.

         */

#if !defined(FIPS_MODE)

        if (!RAND_DRBG_bytes(privdrbg, random_bytes, sizeof(random_bytes)))

            goto err;

#endif



        if (!EVP_DigestInit_ex(mdctx, md, NULL)

                || !EVP_DigestUpdate(mdctx, &done, sizeof(done))