2721. [port] Have dst__entropy_status() prime the random number

                        generator. [RT #20369]

diff --git a/CHANGES b/CHANGES
index 081788080f905f4911b8b96a9c673b7cd278706d..2440343b583fa3845d242c58d8423674007dc103 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2721.  [port]          Have dst__entropy_status() prime the random number
+                       generator. [RT #20369]
+
 2720.  [bug]           RFC 5011 trust anchor updates could trigger an
                        assert if the DNSKEY record was unsigned. [RT #20406]
 

diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index b0dabb5be4d839be75a6748a2ca6628e1658c959..08e8ee3c7a5686cc0ad819a7d8b1f5aee20c8554 100644 (file)
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -31,7 +31,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: dst_api.c,v 1.41 2009/10/12 20:48:12 each Exp $
+ * $Id: dst_api.c,v 1.42 2009/10/20 04:39:48 marka Exp $
  */
 
 /*! \file */
@@ -1581,6 +1581,9 @@ isc_result_t
 dst__entropy_getdata(void *buf, unsigned int len, isc_boolean_t pseudo) {
 #ifdef BIND9
        unsigned int flags = dst_entropy_flags;
+
+       if (len == 0)
+               return (ISC_R_SUCCESS);
        if (pseudo)
                flags &= ~ISC_ENTROPY_GOODONLY;
        else
@@ -1598,6 +1601,23 @@ dst__entropy_getdata(void *buf, unsigned int len, isc_boolean_t pseudo) {
 unsigned int
 dst__entropy_status(void) {
 #ifdef BIND9
+#ifdef GSSAPI
+       unsigned int flags = dst_entropy_flags;
+       isc_result_t ret;
+       unsigned char buf[32];
+       static isc_boolean_t first = ISC_TRUE;
+
+       if (first) {
+               /* Someone believes RAND_status() initializes the PRNG */
+               flags &= ~ISC_ENTROPY_GOODONLY;
+               ret = isc_entropy_getdata(dst_entropy_pool, buf,
+                                         sizeof(buf), NULL, flags);
+               INSIST(ret == ISC_R_SUCCESS);
+               isc_entropy_putdata(dst_entropy_pool, buf,
+                                   sizeof(buf), 2 * sizeof(buf));
+               first = ISC_FALSE;
+       }
+#endif
        return (isc_entropy_status(dst_entropy_pool));
 #else
        return (0);