Load rand state after loading providers

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14135)

diff --git a/apps/ca.c b/apps/ca.c
index 61e49336d05a3b7b2bed70d3528821f3956c6481..29f62f86f25e14d22729cfd93bdf02d2147899a0 100755 (executable)
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -209,7 +209,7 @@ const OPTIONS ca_options[] = {
     {"noemailDN", OPT_NOEMAILDN, '-', "Don't add the EMAIL field to the DN"},
 
     OPT_SECTION("Signing"),
-    {"md", OPT_MD, 's', "md to use; one of md2, md5, sha or sha1"},
+    {"md", OPT_MD, 's', "Digest to use, such as sha256"},
     {"keyfile", OPT_KEYFILE, 's', "The CA private key"},
     {"keyform", OPT_KEYFORM, 'f',
      "Private key file format (ENGINE, other values ignored)"},
@@ -521,6 +521,7 @@ end_of_options:
         goto end;
 
     app_RAND_load_conf(conf, BASE_SECTION);
+    app_RAND_load();
 
     f = NCONF_get_string(conf, section, STRING_MASK);
     if (f == NULL)

diff --git a/apps/cms.c b/apps/cms.c
index 36fb88e15cf0dacdece7dc9baec6d96c2d250263..451f0862c2d0b27b709d7514ba26d028890aae9d 100644 (file)
--- a/apps/cms.c
+++ b/apps/cms.c
@@ -698,6 +698,7 @@ int cms_main(int argc, char **argv)
             break;
         }
     }
+    app_RAND_load();
 
     /* Remaining args are files to process. */
     argc = opt_num_rest();

diff --git a/apps/dgst.c b/apps/dgst.c
index 0eb84f5169ac43136e9d20d26451ac8a82a701b0..8f22334b37846bb421dbb6a93191a7d13359fab3 100644 (file)
--- a/apps/dgst.c
+++ b/apps/dgst.c
@@ -227,6 +227,7 @@ int dgst_main(int argc, char **argv)
         BIO_printf(bio_err, "%s: Can only sign or verify one file.\n", prog);
         goto end;
     }
+    app_RAND_load();
 
     if (do_verify && sigfile == NULL) {
         BIO_printf(bio_err,

diff --git a/apps/dhparam.c b/apps/dhparam.c
index cfa399e4595cdc2cd72668d582647a9984f8f6c6..30fdfbbf6e27f36cf0b0696cc051a1553465e85f 100644 (file)
--- a/apps/dhparam.c
+++ b/apps/dhparam.c
@@ -158,6 +158,7 @@ int dhparam_main(int argc, char **argv)
     } else if (argc != 0) {
         goto opthelp;
     }
+    app_RAND_load();
 
 
     if (g && !num)

diff --git a/apps/dsaparam.c b/apps/dsaparam.c
index f09318f54b68fae6e90beb2aee4f48fb54f9e0b5..70c698dbec79aa804daa16be0635c07c9ecf1ce7 100644 (file)
--- a/apps/dsaparam.c
+++ b/apps/dsaparam.c
@@ -135,6 +135,7 @@ int dsaparam_main(int argc, char **argv)
     } else if (argc != 0) {
         goto opthelp;
     }
+    app_RAND_load();
 
     /* generate a key */
     numbits = num;

diff --git a/apps/ecparam.c b/apps/ecparam.c
index 762da3f2c96ad1e0135eebe1766558633c63ce44..e05a3a495f1cbac8db7f713bdd8816c3fedc7923 100644 (file)
--- a/apps/ecparam.c
+++ b/apps/ecparam.c
@@ -190,6 +190,7 @@ int ecparam_main(int argc, char **argv)
     if (argc != 0)
         goto opthelp;
 
+    app_RAND_load();
     private = genkey ? 1 : 0;
 
     in = bio_open_default(infile, 'r', informat);

diff --git a/apps/enc.c b/apps/enc.c
index 0a8591de83b44f8941b6e0460f46033ebe8c30be..4549895b9ebf8c37826bb7a0418bba4fe331af3b 100644 (file)
--- a/apps/enc.c
+++ b/apps/enc.c
@@ -293,6 +293,7 @@ int enc_main(int argc, char **argv)
     argc = opt_num_rest();
     if (argc != 0)
         goto opthelp;
+    app_RAND_load();
 
     /* Get the cipher name, either from progname (if set) or flag. */
     if (ciphername != NULL) {

diff --git a/apps/gendsa.c b/apps/gendsa.c
index c90a01d97900ef13957e352081757fe62a41f097..81ab10d07c1de047f57013d45de2b7cd4ea333e5 100644 (file)
--- a/apps/gendsa.c
+++ b/apps/gendsa.c
@@ -108,6 +108,7 @@ int gendsa_main(int argc, char **argv)
     if (argc != 1)
         goto opthelp;
 
+    app_RAND_load();
     dsaparams = argv[0];
     private = 1;
 

diff --git a/apps/genrsa.c b/apps/genrsa.c
index 2cc1abfbe5817835598b4b59113de48199b7efbb..39c23e7df8c1e4e9b08e1f0e1ce16af886e6fb81 100644 (file)
--- a/apps/genrsa.c
+++ b/apps/genrsa.c
@@ -164,6 +164,7 @@ opthelp:
         goto opthelp;
     }
 
+    app_RAND_load();
     private = 1;
     if (!app_passwd(NULL, passoutarg, NULL, &passout)) {
         BIO_printf(bio_err, "Error getting password\n");

diff --git a/apps/include/apps.h b/apps/include/apps.h
index d4241fa61e3d565de2af1f372b2df4e0a0d65e1c..45a9c4e7585e88f301092d47be49faae53db6d54 100644 (file)
--- a/apps/include/apps.h
+++ b/apps/include/apps.h
@@ -47,6 +47,7 @@
 
 void app_RAND_load_conf(CONF *c, const char *section);
 void app_RAND_write(void);
+int app_RAND_load(void);
 
 extern char *default_config_file; /* may be "" */
 extern BIO *bio_in;

diff --git a/apps/lib/app_rand.c b/apps/lib/app_rand.c
index 1861343a9c2cd91db39f4d03d02e8b9920fee64f..cd4ee6753e17049318cd757d557665b5da49be0d 100644 (file)
--- a/apps/lib/app_rand.c
+++ b/apps/lib/app_rand.c
@@ -14,6 +14,7 @@
 #include <openssl/conf.h>
 
 static char *save_rand_file;
+static char *load_rand_file;
 
 void app_RAND_load_conf(CONF *c, const char *section)
 {
@@ -31,27 +32,30 @@ void app_RAND_load_conf(CONF *c, const char *section)
         save_rand_file = OPENSSL_strdup(randfile);
 }
 
-static int loadfiles(char *name)
+int app_RAND_load(void)
 {
     char *p;
     int last, ret = 1;
 
+    if (load_rand_file == NULL)
+        return 1;
+
     for ( ; ; ) {
         last = 0;
-        for (p = name; *p != '\0' && *p != LIST_SEPARATOR_CHAR; p++)
+        for (p = load_rand_file; *p != '\0' && *p != LIST_SEPARATOR_CHAR; p++)
             continue;
         if (*p == '\0')
             last = 1;
         *p = '\0';
-        if (RAND_load_file(name, -1) < 0) {
-            BIO_printf(bio_err, "Can't load %s into RNG\n", name);
+        if (RAND_load_file(load_rand_file, -1) < 0) {
+            BIO_printf(bio_err, "Can't load %s into RNG\n", load_rand_file);
             ERR_print_errors(bio_err);
             ret = 0;
         }
         if (last)
             break;
-        name = p + 1;
-        if (*name == '\0')
+        load_rand_file = p + 1;
+        if (*load_rand_file == '\0')
             break;
     }
     return ret;
@@ -82,7 +86,7 @@ int opt_rand(int opt)
     case OPT_R__LAST:
         break;
     case OPT_R_RAND:
-        return loadfiles(opt_arg());
+        load_rand_file = opt_arg();
         break;
     case OPT_R_WRITERAND:
         OPENSSL_free(save_rand_file);

diff --git a/apps/passwd.c b/apps/passwd.c
index f8a0493c4c692491255e86068e5d7a016e4e0a00..08b94622da204a03cc9d6c4e770122a401ea3139 100644 (file)
--- a/apps/passwd.c
+++ b/apps/passwd.c
@@ -195,6 +195,7 @@ int passwd_main(int argc, char **argv)
         passwds = argv;
     }
 
+    app_RAND_load();
     if (mode == passwd_unset) {
         /* use default */
         mode = passwd_md5;

diff --git a/apps/pkcs12.c b/apps/pkcs12.c
index 60e12cf932d46e0fc9b90be6ad71f82b0222f80d..8cc1f8eeb5c1be9258720152aa392374394d9c6f 100644 (file)
--- a/apps/pkcs12.c
+++ b/apps/pkcs12.c
@@ -341,6 +341,7 @@ int pkcs12_main(int argc, char **argv)
     if (argc != 0)
         goto opthelp;
 
+    app_RAND_load();
     if (export_pkcs12) {
         if ((options & INFO) != 0)
             WARN_EXPORT("info");

diff --git a/apps/pkcs8.c b/apps/pkcs8.c
index ae0824c6d24d3133d428c3b36b1c5c1d2b51b642..1c459e7bc24e85ec079567cfc960d46b230badf2 100644 (file)
--- a/apps/pkcs8.c
+++ b/apps/pkcs8.c
@@ -200,6 +200,7 @@ int pkcs8_main(int argc, char **argv)
         goto opthelp;
 
     private = 1;
+    app_RAND_load();
 
     if (!app_passwd(passinarg, passoutarg, &passin, &passout)) {
         BIO_printf(bio_err, "Error getting passwords\n");

diff --git a/apps/pkeyutl.c b/apps/pkeyutl.c
index 4eb15c30f434252d160e47e7d05a50d93fea8dcc..28c4401745ab5174526820c750788b74da939c7d 100644 (file)
--- a/apps/pkeyutl.c
+++ b/apps/pkeyutl.c
@@ -255,6 +255,8 @@ int pkeyutl_main(int argc, char **argv)
     if (argc != 0)
         goto opthelp;
 
+    app_RAND_load();
+
     if (rawin && pkey_op != EVP_PKEY_OP_SIGN && pkey_op != EVP_PKEY_OP_VERIFY) {
         BIO_printf(bio_err,
                    "%s: -rawin can only be used with -sign or -verify\n",

diff --git a/apps/rand.c b/apps/rand.c
index c78123e1618cb5147dfa7fdba82998abc5078d4b..69a13f975e3c3c7064173fdf229fae1549310393 100644 (file)
--- a/apps/rand.c
+++ b/apps/rand.c
@@ -99,6 +99,7 @@ int rand_main(int argc, char **argv)
         goto opthelp;
     }
 
+    app_RAND_load();
     out = bio_open_default(outfile, 'w', format);
     if (out == NULL)
         goto end;

diff --git a/apps/req.c b/apps/req.c
index 75840ae38703a608736332b83158366ebf3c4587..4cd31cf4ba1dbf8b00957f5ead09ee3d95f49fb8 100644 (file)
--- a/apps/req.c
+++ b/apps/req.c
@@ -480,6 +480,7 @@ int req_main(int argc, char **argv)
     if (argc != 0)
         goto opthelp;
 
+    app_RAND_load();
     if (!gen_x509) {
         if (days != UNSET_DAYS)
             BIO_printf(bio_err, "Ignoring -days without -x509; not generating a certificate\n");

diff --git a/apps/rsautl.c b/apps/rsautl.c
index 333edb936389851613cae395e0883ac7e579e728..ae4855f8f560ba0e1d08d1c95fa19df3ab7caafb 100644 (file)
--- a/apps/rsautl.c
+++ b/apps/rsautl.c
@@ -177,6 +177,7 @@ int rsautl_main(int argc, char **argv)
     if (argc != 0)
         goto opthelp;
 
+    app_RAND_load();
     if (need_priv && (key_type != KEY_PRIVKEY)) {
         BIO_printf(bio_err, "A private key is needed for this operation\n");
         goto end;

diff --git a/apps/s_client.c b/apps/s_client.c
index 188ce26a8fbb5ca7d76cbb8a37d6f45c0d0c1ed9..90f9411f45f13aec18c1a475b21876b3eee1fab3 100644 (file)
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -1574,9 +1574,7 @@ int s_client_main(int argc, char **argv)
     /* Optional argument is connect string if -connect not used. */
     argc = opt_num_rest();
     if (argc == 1) {
-        /*
-         * Don't allow -connect and a separate argument.
-         */
+        /* Don't allow -connect and a separate argument. */
         if (connectstr != NULL) {
             BIO_printf(bio_err,
                        "%s: cannot provide both -connect option and target parameter\n",
@@ -1588,6 +1586,7 @@ int s_client_main(int argc, char **argv)
     } else if (argc != 0) {
         goto opthelp;
     }
+    app_RAND_load();
 
     if (count4or6 >= 2) {
         BIO_printf(bio_err, "%s: Can't use both -4 and -6\n", prog);

diff --git a/apps/s_server.c b/apps/s_server.c
index 2f9b4699536dde8599d28e6c161e4d1572e6d53c..498e629dbfb5cd42b633cefd4ee680cd43f5510d 100644 (file)
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -1662,6 +1662,7 @@ int s_server_main(int argc, char *argv[])
     if (argc != 0)
         goto opthelp;
 
+    app_RAND_load();
 #ifndef OPENSSL_NO_NEXTPROTONEG
     if (min_version == TLS1_3_VERSION && next_proto_neg_in != NULL) {
         BIO_printf(bio_err, "Cannot supply -nextprotoneg with TLSv1.3\n");

diff --git a/apps/smime.c b/apps/smime.c
index 2a9ee27a34082bc125e1102ec570a1e402e28be3..db9cf8f1f1664a6e40bc6254f0c97aeff5323fc9 100644 (file)
--- a/apps/smime.c
+++ b/apps/smime.c
@@ -360,6 +360,7 @@ int smime_main(int argc, char **argv)
     argc = opt_num_rest();
     argv = opt_rest();
 
+    app_RAND_load();
     if (!(operation & SMIME_SIGNERS) && (skkeys != NULL || sksigners != NULL)) {
         BIO_puts(bio_err, "Multiple signers or keys not allowed\n");
         goto opthelp;

diff --git a/apps/speed.c b/apps/speed.c
index fd2a8e951ad3b786b317a425b2ef61c61b4245cd..c41fca483fb1d1b6faa6f04cf40747782aaf33cf 100644 (file)
--- a/apps/speed.c
+++ b/apps/speed.c
@@ -1854,6 +1854,7 @@ int speed_main(int argc, char **argv)
     argc = opt_num_rest();
     argv = opt_rest();
 
+    app_RAND_load();
     for (; *argv; argv++) {
         const char *algo = *argv;
 

diff --git a/apps/srp.c b/apps/srp.c
index 764dba2c6b46bf522f4dcd489ef0f3591fe25dc5..2edc448c6c34852229af9f537703007f01c784e4 100644 (file)
--- a/apps/srp.c
+++ b/apps/srp.c
@@ -306,6 +306,7 @@ int srp_main(int argc, char **argv)
     argc = opt_num_rest();
     argv = opt_rest();
 
+    app_RAND_load();
     if (srpvfile != NULL && configfile != NULL) {
         BIO_printf(bio_err,
                    "-srpvfile and -configfile cannot be specified together.\n");

diff --git a/apps/ts.c b/apps/ts.c
index 5ff80062ef4d7bff655270d5607566d541901065..12958fbbd0ad96fbb73a4efa455896a2326e93ca 100644 (file)
--- a/apps/ts.c
+++ b/apps/ts.c
@@ -292,6 +292,7 @@ int ts_main(int argc, char **argv)
     if (argc != 0 || mode == OPT_ERR)
         goto opthelp;
 
+    app_RAND_load();
     if (mode == OPT_REPLY && passin &&
         !app_passwd(passin, NULL, &password, NULL)) {
         BIO_printf(bio_err, "Error getting password.\n");

diff --git a/apps/x509.c b/apps/x509.c
index 3fdd44f2f312786ff10acf922fdf4c25fde8100a..2ddb5499398c2fe1b469a9601b7ec620b8b00885 100644 (file)
--- a/apps/x509.c
+++ b/apps/x509.c
@@ -579,6 +579,7 @@ int x509_main(int argc, char **argv)
     if (argc != 0)
         goto opthelp;
 
+    app_RAND_load();
     if (preserve_dates && days != UNSET_DAYS) {
         BIO_printf(bio_err, "Cannot use -preserve_dates with -days option\n");
         goto end;