Temporarily disable RAND call in FIPS_MODE until RAND is available

Other commits will enable the RAND code in FIPS_MODE. Until those commits
are in place we temporarily disable making RAND calls while in FIPS_MODE.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9130)

diff --git a/crypto/bn/bn_rand.c b/crypto/bn/bn_rand.c
index f33c856eb59dfc9a0935bc896f7868ffc89dce9d..696762773222d89c42821cebca936b6c2365064d 100644 (file)
--- a/crypto/bn/bn_rand.c
+++ b/crypto/bn/bn_rand.c
@@ -45,7 +45,16 @@ static int bnrand(BNRAND_FLAG flag, BIGNUM *rnd, int bits, int top, int bottom)
     }
 
     /* make a random number and set the top and bottom bits */
+    /*
+     * TODO(3.0): Temporarily disable RAND code in the FIPS module until we
+     * have made it available there.
+     */
+#if defined(FIPS_MODE)
+    BNerr(BN_F_BNRAND, ERR_R_INTERNAL_ERROR);
+    goto err;
+#else
     b = flag == NORMAL ? RAND_bytes(buf, bytes) : RAND_priv_bytes(buf, bytes);
+#endif
     if (b <= 0)
         goto err;
 
@@ -57,8 +66,14 @@ static int bnrand(BNRAND_FLAG flag, BIGNUM *rnd, int bits, int top, int bottom)
         unsigned char c;
 
         for (i = 0; i < bytes; i++) {
+    /*
+     * TODO(3.0): Temporarily disable RAND code in the FIPS module until we
+     * have made it available there.
+     */
+#if !defined(FIPS_MODE)
             if (RAND_bytes(&c, 1) <= 0)
                 goto err;
+#endif
             if (c >= 128 && i > 0)
                 buf[i] = buf[i - 1];
             else if (c < 42)
@@ -223,7 +238,15 @@ int BN_generate_dsa_nonce(BIGNUM *out, const BIGNUM *range,
     int ret = 0;
     EVP_MD *md = NULL;
     OPENSSL_CTX *libctx = (ctx != NULL) ? bn_get_lib_ctx(ctx) : NULL;
+    /*
+     * TODO(3.0): Temporarily disable RAND code in the FIPS module until we
+     * have made it available there.
+     */
+#ifdef FIPS_MODE
+    RAND_DRBG *privdrbg = NULL;
+#else
     RAND_DRBG *privdrbg = OPENSSL_CTX_get0_private_drbg(libctx);
+#endif
 
     if (mdctx == NULL || privdrbg == NULL)
         goto err;
@@ -252,8 +275,14 @@ int BN_generate_dsa_nonce(BIGNUM *out, const BIGNUM *range,
         goto err;
     }
     for (done = 0; done < num_k_bytes;) {
+        /*
+         * TODO(3.0): Temporarily disable RAND code in the FIPS module until we
+         * have made it available there.
+         */
+#if !defined(FIPS_MODE)
         if (!RAND_DRBG_bytes(privdrbg, random_bytes, sizeof(random_bytes)))
             goto err;
+#endif
 
         if (!EVP_DigestInit_ex(mdctx, md, NULL)
                 || !EVP_DigestUpdate(mdctx, &done, sizeof(done))