Dr. Matthias St. Pierre 849529257c drbg: ensure fork-safety without using a pthread_atfork handler ... When the new OpenSSL CSPRNG was introduced in version 1.1.1, it was announced in the release notes that it would be fork-safe, which the old CSPRNG hadn't been. The fork-safety was implemented using a fork count, which was incremented by a pthread_atfork handler. Initially, this handler was enabled by default. Unfortunately, the default behaviour had to be changed for other reasons in commit b5319bdbd0, so the new OpenSSL CSPRNG failed to keep its promise. This commit restores the fork-safety using a different approach. It replaces the fork count by a fork id, which coincides with the process id on UNIX-like operating systems and is zero on other operating systems. It is used to detect when an automatic reseed after a fork is necessary. To prevent a future regression, it also adds a test to verify that the child reseeds after fork. CVE-2019-1549 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9832)		2019-09-11 11:22:18 +02:00
..
internal	drbg: ensure fork-safety without using a pthread_atfork handler	2019-09-11 11:22:18 +02:00
openssl	Add EVP_CIPHER_CTX_tag_length()	2019-09-11 17:52:30 +10:00