From 7f6bf5cdac7db6e3c0bb03acfaa8ddbeb9b97518 Mon Sep 17 00:00:00 2001 From: Pauli Date: Wed, 26 Oct 2022 20:09:24 +1100 Subject: fips: verify that the RNG was restored after the self tests Reviewed-by: Tomas Mraz Reviewed-by: Tim Hudson Reviewed-by: Shane Lontis (Merged from https://github.com/openssl/openssl/pull/19486) --- providers/fips/self_test.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'providers/fips') diff --git a/providers/fips/self_test.c b/providers/fips/self_test.c index bcb23344da..2b228da262 100644 --- a/providers/fips/self_test.c +++ b/providers/fips/self_test.c @@ -15,6 +15,7 @@ #include #include #include +#include #include "e_os.h" #include "prov/providercommon.h" @@ -307,6 +308,8 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) unsigned char *indicator_checksum = NULL; int loclstate; OSSL_SELF_TEST *ev = NULL; + EVP_RAND *testrand = NULL; + EVP_RAND_CTX *rng; if (!RUN_ONCE(&fips_self_test_init, do_fips_self_test_init)) return 0; @@ -417,8 +420,19 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) } } + /* Verify that the RNG has been restored properly */ + testrand = EVP_RAND_fetch(st->libctx, "TEST-RAND", NULL); + if (testrand == NULL + || (rng = RAND_get0_private(st->libctx)) == NULL + || strcmp(EVP_RAND_get0_name(EVP_RAND_CTX_get0_rand(rng)), + EVP_RAND_get0_name(testrand)) == 0) { + ERR_raise(ERR_LIB_PROV, PROV_R_SELF_TEST_KAT_FAILURE); + goto end; + } + ok = 1; end: + EVP_RAND_free(testrand); OSSL_SELF_TEST_free(ev); OPENSSL_free(module_checksum); OPENSSL_free(indicator_checksum); -- cgit v1.2.3