7 files changed, 822 insertions, 58 deletions

diff --git a/src/lib/libcrypto/rand/md_rand.c b/src/lib/libcrypto/rand/md_rand.c
index fcdd3f2a84..b2f04ff13e 100644
--- a/src/lib/libcrypto/rand/md_rand.c
+++ b/src/lib/libcrypto/rand/md_rand.c
@@ -109,8 +109,6 @@
  *
  */
 
-#define OPENSSL_FIPSEVP
-
 #ifdef MD_RAND_DEBUG
 # ifndef NDEBUG
 #   define NDEBUG
@@ -159,14 +157,13 @@ const char RAND_version[]="RAND" OPENSSL_VERSION_PTEXT;
 static void ssleay_rand_cleanup(void);
 static void ssleay_rand_seed(const void *buf, int num);
 static void ssleay_rand_add(const void *buf, int num, double add_entropy);
-static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo);
-static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num);
+static int ssleay_rand_bytes(unsigned char *buf, int num);
 static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num);
 static int ssleay_rand_status(void);
 
 RAND_METHOD rand_ssleay_meth={
         ssleay_rand_seed,
-        ssleay_rand_nopseudo_bytes,
+        ssleay_rand_bytes,
         ssleay_rand_cleanup,
         ssleay_rand_add,
         ssleay_rand_pseudo_bytes,
@@ -331,7 +328,7 @@ static void ssleay_rand_seed(const void *buf, int num)
         ssleay_rand_add(buf, num, (double)num);
         }
 
-static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
+static int ssleay_rand_bytes(unsigned char *buf, int num)
         {
         static volatile int stirred_pool = 0;
         int i,j,k,st_num,st_idx;
@@ -520,9 +517,7 @@ static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
         EVP_MD_CTX_cleanup(&m);
         if (ok)
                 return(1);
-        else if (pseudo)
-                return 0;
-        else 
+        else
                 {
                 RANDerr(RAND_F_SSLEAY_RAND_BYTES,RAND_R_PRNG_NOT_SEEDED);
                 ERR_add_error_data(1, "You need to read the OpenSSL FAQ, "
@@ -531,16 +526,22 @@ static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
                 }
         }
 
-static int ssleay_rand_nopseudo_bytes(unsigned char *buf, int num)
-        {
-        return ssleay_rand_bytes(buf, num, 0);
-        }
-
 /* pseudo-random bytes that are guaranteed to be unique but not
    unpredictable */
 static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num) 
         {
-        return ssleay_rand_bytes(buf, num, 1);
+        int ret;
+        unsigned long err;
+
+        ret = RAND_bytes(buf, num);
+        if (ret == 0)
+                {
+                err = ERR_peek_error();
+                if (ERR_GET_LIB(err) == ERR_LIB_RAND &&
+                    ERR_GET_REASON(err) == RAND_R_PRNG_NOT_SEEDED)
+                        ERR_clear_error();
+                }
+        return (ret);
         }
 
 static int ssleay_rand_status(void)
diff --git a/src/lib/libcrypto/rand/rand.h b/src/lib/libcrypto/rand/rand.h
new file mode 100644
index 0000000000..ac6c021763
--- /dev/null
+++ b/src/lib/libcrypto/rand/rand.h
@@ -0,0 +1,140 @@
+/* crypto/rand/rand.h */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+#ifndef HEADER_RAND_H
+#define HEADER_RAND_H
+
+#include <stdlib.h>
+#include <openssl/ossl_typ.h>
+#include <openssl/e_os2.h>
+
+#if defined(OPENSSL_SYS_WINDOWS)
+#include <windows.h>
+#endif
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+#if defined(OPENSSL_FIPS)
+#define FIPS_RAND_SIZE_T size_t
+#endif
+
+/* Already defined in ossl_typ.h */
+/* typedef struct rand_meth_st RAND_METHOD; */
+
+struct rand_meth_st
+        {
+        void (*seed)(const void *buf, int num);
+        int (*bytes)(unsigned char *buf, int num);
+        void (*cleanup)(void);
+        void (*add)(const void *buf, int num, double entropy);
+        int (*pseudorand)(unsigned char *buf, int num);
+        int (*status)(void);
+        };
+
+#ifdef BN_DEBUG
+extern int rand_predictable;
+#endif
+
+int RAND_set_rand_method(const RAND_METHOD *meth);
+const RAND_METHOD *RAND_get_rand_method(void);
+#ifndef OPENSSL_NO_ENGINE
+int RAND_set_rand_engine(ENGINE *engine);
+#endif
+RAND_METHOD *RAND_SSLeay(void);
+void RAND_cleanup(void );
+int  RAND_bytes(unsigned char *buf,int num);
+int  RAND_pseudo_bytes(unsigned char *buf,int num);
+void RAND_seed(const void *buf,int num);
+void RAND_add(const void *buf,int num,double entropy);
+int  RAND_load_file(const char *file,long max_bytes);
+int  RAND_write_file(const char *file);
+const char *RAND_file_name(char *file,size_t num);
+int RAND_status(void);
+int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes);
+int RAND_egd(const char *path);
+int RAND_egd_bytes(const char *path,int bytes);
+int RAND_poll(void);
+
+#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_WIN32)
+
+void RAND_screen(void);
+int RAND_event(UINT, WPARAM, LPARAM);
+
+#endif
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+void ERR_load_RAND_strings(void);
+
+/* Error codes for the RAND functions. */
+
+/* Function codes. */
+#define RAND_F_RAND_GET_RAND_METHOD                      101
+#define RAND_F_SSLEAY_RAND_BYTES                         100
+
+/* Reason codes. */
+#define RAND_R_PRNG_NOT_SEEDED                           100
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libcrypto/rand/rand_err.c b/src/lib/libcrypto/rand/rand_err.c
new file mode 100644
index 0000000000..03cda4dd92
--- /dev/null
+++ b/src/lib/libcrypto/rand/rand_err.c
@@ -0,0 +1,96 @@
+/* crypto/rand/rand_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include <openssl/rand.h>
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(ERR_LIB_RAND,func,0)
+#define ERR_REASON(reason) ERR_PACK(ERR_LIB_RAND,0,reason)
+
+static ERR_STRING_DATA RAND_str_functs[]=
+        {
+{ERR_FUNC(RAND_F_RAND_GET_RAND_METHOD), "RAND_get_rand_method"},
+{ERR_FUNC(RAND_F_SSLEAY_RAND_BYTES),    "SSLEAY_RAND_BYTES"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA RAND_str_reasons[]=
+        {
+{ERR_REASON(RAND_R_PRNG_NOT_SEEDED)      ,"PRNG not seeded"},
+{0,NULL}
+        };
+
+#endif
+
+void ERR_load_RAND_strings(void)
+        {
+#ifndef OPENSSL_NO_ERR
+
+        if (ERR_func_error_string(RAND_str_functs[0].error) == NULL)
+                {
+                ERR_load_strings(0,RAND_str_functs);
+                ERR_load_strings(0,RAND_str_reasons);
+                }
+#endif
+        }
diff --git a/src/lib/libcrypto/rand/rand_eng.c b/src/lib/libcrypto/rand/rand_lib.c
index 1669cef43c..513e338985 100644
--- a/src/lib/libcrypto/rand/rand_eng.c
+++ b/src/lib/libcrypto/rand/rand_lib.c
@@ -59,42 +59,40 @@
 #include <stdio.h>
 #include <time.h>
 #include "cryptlib.h"
-#include "rand_lcl.h"
 #include <openssl/rand.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#include <openssl/fips_rand.h>
-#endif
-
 #ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
 #endif
 
-#if defined(OPENSSL_FIPS) && !defined(OPENSSL_NO_ENGINE)
-
+#ifndef OPENSSL_NO_ENGINE
 /* non-NULL if default_RAND_meth is ENGINE-provided */
 static ENGINE *funct_ref =NULL;
+#endif
+static const RAND_METHOD *default_RAND_meth = NULL;
 
-int eng_RAND_set_rand_method(const RAND_METHOD *meth, const RAND_METHOD **pmeth)
+int RAND_set_rand_method(const RAND_METHOD *meth)
         {
+#ifndef OPENSSL_NO_ENGINE
         if(funct_ref)
                 {
                 ENGINE_finish(funct_ref);
                 funct_ref = NULL;
                 }
-        *pmeth = meth;
+#endif
+        default_RAND_meth = meth;
         return 1;
         }
 
-const RAND_METHOD *eng_RAND_get_rand_method(const RAND_METHOD **pmeth)
+const RAND_METHOD *RAND_get_rand_method(void)
         {
-        if (!*pmeth)
+        if (!default_RAND_meth)
                 {
+#ifndef OPENSSL_NO_ENGINE
                 ENGINE *e = ENGINE_get_default_RAND();
                 if(e)
                         {
-                        *pmeth = ENGINE_get_RAND(e);
-                        if(!*pmeth)
+                        default_RAND_meth = ENGINE_get_RAND(e);
+                        if(!default_RAND_meth)
                                 {
                                 ENGINE_finish(e);
                                 e = NULL;
@@ -103,22 +101,13 @@ const RAND_METHOD *eng_RAND_get_rand_method(const RAND_METHOD **pmeth)
                 if(e)
                         funct_ref = e;
                 else
-                        if(FIPS_mode())
-                                *pmeth=FIPS_rand_method();
-                        else
-                        *pmeth = RAND_SSLeay();
+#endif
+                        default_RAND_meth = RAND_SSLeay();
                 }
-
-        if(FIPS_mode()
-                && *pmeth != FIPS_rand_check())
-            {
-            RANDerr(RAND_F_ENG_RAND_GET_RAND_METHOD,RAND_R_NON_FIPS_METHOD);
-            return 0;
-            }
-
-        return *pmeth;
+        return default_RAND_meth;
         }
 
+#ifndef OPENSSL_NO_ENGINE
 int RAND_set_rand_engine(ENGINE *engine)
         {
         const RAND_METHOD *tmp_meth = NULL;
@@ -138,15 +127,50 @@ int RAND_set_rand_engine(ENGINE *engine)
         funct_ref = engine;
         return 1;
         }
+#endif
 
-void int_RAND_init_engine_callbacks(void)
+void RAND_cleanup(void)
         {
-        static int done = 0;
-        if (done)
-                return;
-        int_RAND_set_callbacks(eng_RAND_set_rand_method,
-                                 eng_RAND_get_rand_method);
-        done = 1;
+        const RAND_METHOD *meth = RAND_get_rand_method();
+        if (meth && meth->cleanup)
+                meth->cleanup();
+        RAND_set_rand_method(NULL);
         }
 
-#endif
+void RAND_seed(const void *buf, int num)
+        {
+        const RAND_METHOD *meth = RAND_get_rand_method();
+        if (meth && meth->seed)
+                meth->seed(buf,num);
+        }
+
+void RAND_add(const void *buf, int num, double entropy)
+        {
+        const RAND_METHOD *meth = RAND_get_rand_method();
+        if (meth && meth->add)
+                meth->add(buf,num,entropy);
+        }
+
+int RAND_bytes(unsigned char *buf, int num)
+        {
+        const RAND_METHOD *meth = RAND_get_rand_method();
+        if (meth && meth->bytes)
+                return meth->bytes(buf,num);
+        return(-1);
+        }
+
+int RAND_pseudo_bytes(unsigned char *buf, int num)
+        {
+        const RAND_METHOD *meth = RAND_get_rand_method();
+        if (meth && meth->pseudorand)
+                return meth->pseudorand(buf,num);
+        return(-1);
+        }
+
+int RAND_status(void)
+        {
+        const RAND_METHOD *meth = RAND_get_rand_method();
+        if (meth && meth->status)
+                return meth->status();
+        return 0;
+        }
diff --git a/src/lib/libcrypto/rand/rand_nw.c b/src/lib/libcrypto/rand/rand_nw.c
new file mode 100644
index 0000000000..8d5b8d2e32
--- /dev/null
+++ b/src/lib/libcrypto/rand/rand_nw.c
@@ -0,0 +1,183 @@
+/* crypto/rand/rand_nw.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include "cryptlib.h"
+#include <openssl/rand.h>
+#include "rand_lcl.h"
+
+#if defined (OPENSSL_SYS_NETWARE)
+
+#if defined(NETWARE_LIBC)
+#include <nks/thread.h>
+#else
+#include <nwthread.h>
+#endif
+
+extern int GetProcessSwitchCount(void);
+#if !defined(NETWARE_LIBC) || (CURRENT_NDK_THRESHOLD < 509220000)
+extern void *RunningProcess; /* declare here same as found in newer NDKs */
+extern unsigned long GetSuperHighResolutionTimer(void);
+#endif
+
+   /* the FAQ indicates we need to provide at least 20 bytes (160 bits) of seed
+   */
+int RAND_poll(void)
+{
+   unsigned long l;
+   unsigned long tsc;
+   int i; 
+
+      /* There are several options to gather miscellaneous data
+       * but for now we will loop checking the time stamp counter (rdtsc) and
+       * the SuperHighResolutionTimer.  Each iteration will collect 8 bytes
+       * of data but it is treated as only 1 byte of entropy.  The call to
+       * ThreadSwitchWithDelay() will introduce additional variability into
+       * the data returned by rdtsc.
+       *
+       * Applications can agument the seed material by adding additional
+       * stuff with RAND_add() and should probably do so.
+      */
+   l = GetProcessSwitchCount();
+   RAND_add(&l,sizeof(l),1);
+   
+   /* need to cast the void* to unsigned long here */
+   l = (unsigned long)RunningProcess;
+   RAND_add(&l,sizeof(l),1);
+
+   for( i=2; i<ENTROPY_NEEDED; i++)
+   {
+#ifdef __MWERKS__
+      asm 
+      {
+         rdtsc
+         mov tsc, eax        
+      }
+#elif defined(__GNUC__) && __GNUC__>=2 && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM)
+      asm volatile("rdtsc":"=a"(tsc)::"edx");
+#endif
+
+      RAND_add(&tsc, sizeof(tsc), 1);
+
+      l = GetSuperHighResolutionTimer();
+      RAND_add(&l, sizeof(l), 0);
+
+# if defined(NETWARE_LIBC)
+      NXThreadYield();
+# else /* NETWARE_CLIB */
+      ThreadSwitchWithDelay();
+# endif
+   }
+
+   return 1;
+}
+
+#endif 
+
diff --git a/src/lib/libcrypto/rand/rand_unix.c b/src/lib/libcrypto/rand/rand_unix.c
index e3a65571c8..3316388443 100644
--- a/src/lib/libcrypto/rand/rand_unix.c
+++ b/src/lib/libcrypto/rand/rand_unix.c
@@ -219,16 +219,10 @@ int RAND_poll(void)
 #elif defined __OpenBSD__
 int RAND_poll(void)
 {
-        u_int32_t rnd = 0, i;
         unsigned char buf[ENTROPY_NEEDED];
 
-        for (i = 0; i < sizeof(buf); i++) {
-                if (i % 4 == 0)
-                        rnd = arc4random();
-                buf[i] = rnd;
-                rnd >>= 8;
-        }
-        RAND_add(buf, sizeof(buf), ENTROPY_NEEDED);
+        arc4random_buf(buf, sizeof(buf));
+        RAND_add(buf, sizeof(buf), sizeof(buf));
         memset(buf, 0, sizeof(buf));
 
         return 1;
diff --git a/src/lib/libcrypto/rand/randfile.c b/src/lib/libcrypto/rand/randfile.c
new file mode 100644
index 0000000000..bc7d9c5804
--- /dev/null
+++ b/src/lib/libcrypto/rand/randfile.c
@@ -0,0 +1,326 @@
+/* crypto/rand/randfile.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
+/* We need to define this to get macros like S_IFBLK and S_IFCHR */
+#define _XOPEN_SOURCE 500
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "e_os.h"
+#include <openssl/crypto.h>
+#include <openssl/rand.h>
+#include <openssl/buffer.h>
+
+#ifdef OPENSSL_SYS_VMS
+#include <unixio.h>
+#endif
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+#ifndef OPENSSL_NO_POSIX_IO
+# include <sys/stat.h>
+#endif
+
+#ifdef _WIN32
+#define stat    _stat
+#define chmod   _chmod
+#define open    _open
+#define fdopen  _fdopen
+#endif
+
+#undef BUFSIZE
+#define BUFSIZE 1024
+#define RAND_DATA 1024
+
+#ifdef OPENSSL_SYS_VMS
+/* This declaration is a nasty hack to get around vms' extension to fopen
+ * for passing in sharing options being disabled by our /STANDARD=ANSI89 */
+static FILE *(*const vms_fopen)(const char *, const char *, ...) =
+    (FILE *(*)(const char *, const char *, ...))fopen;
+#define VMS_OPEN_ATTRS "shr=get,put,upd,del","ctx=bin,stm","rfm=stm","rat=none","mrs=0"
+#endif
+
+/* #define RFILE ".rnd" - defined in ../../e_os.h */
+
+/* Note that these functions are intended for seed files only.
+ * Entropy devices and EGD sockets are handled in rand_unix.c */
+
+int RAND_load_file(const char *file, long bytes)
+        {
+        /* If bytes >= 0, read up to 'bytes' bytes.
+         * if bytes == -1, read complete file. */
+
+        MS_STATIC unsigned char buf[BUFSIZE];
+#ifndef OPENSSL_NO_POSIX_IO
+        struct stat sb;
+#endif
+        int i,ret=0,n;
+        FILE *in;
+
+        if (file == NULL) return(0);
+
+#ifndef OPENSSL_NO_POSIX_IO
+#ifdef PURIFY
+        /* struct stat can have padding and unused fields that may not be
+         * initialized in the call to stat(). We need to clear the entire
+         * structure before calling RAND_add() to avoid complaints from
+         * applications such as Valgrind.
+         */
+        memset(&sb, 0, sizeof(sb));
+#endif
+        if (stat(file,&sb) < 0) return(0);
+        RAND_add(&sb,sizeof(sb),0.0);
+#endif
+        if (bytes == 0) return(ret);
+
+#ifdef OPENSSL_SYS_VMS
+        in=vms_fopen(file,"rb",VMS_OPEN_ATTRS);
+#else
+        in=fopen(file,"rb");
+#endif
+        if (in == NULL) goto err;
+#if defined(S_IFBLK) && defined(S_IFCHR) && !defined(OPNESSL_NO_POSIX_IO)
+        if (sb.st_mode & (S_IFBLK | S_IFCHR)) {
+          /* this file is a device. we don't want read an infinite number
+           * of bytes from a random device, nor do we want to use buffered
+           * I/O because we will waste system entropy. 
+           */
+          bytes = (bytes == -1) ? 2048 : bytes; /* ok, is 2048 enough? */
+#ifndef OPENSSL_NO_SETVBUF_IONBF
+          setvbuf(in, NULL, _IONBF, 0); /* don't do buffered reads */
+#endif /* ndef OPENSSL_NO_SETVBUF_IONBF */
+        }
+#endif
+        for (;;)
+                {
+                if (bytes > 0)
+                        n = (bytes < BUFSIZE)?(int)bytes:BUFSIZE;
+                else
+                        n = BUFSIZE;
+                i=fread(buf,1,n,in);
+                if (i <= 0) break;
+#ifdef PURIFY
+                RAND_add(buf,i,(double)i);
+#else
+                /* even if n != i, use the full array */
+                RAND_add(buf,n,(double)i);
+#endif
+                ret+=i;
+                if (bytes > 0)
+                        {
+                        bytes-=n;
+                        if (bytes <= 0) break;
+                        }
+                }
+        fclose(in);
+        OPENSSL_cleanse(buf,BUFSIZE);
+err:
+        return(ret);
+        }
+
+int RAND_write_file(const char *file)
+        {
+        unsigned char buf[BUFSIZE];
+        int i,ret=0,rand_err=0;
+        FILE *out = NULL;
+        int n;
+#ifndef OPENSSL_NO_POSIX_IO
+        struct stat sb;
+        
+        i=stat(file,&sb);
+        if (i != -1) { 
+#if defined(S_ISBLK) && defined(S_ISCHR)
+          if (S_ISBLK(sb.st_mode) || S_ISCHR(sb.st_mode)) {
+            /* this file is a device. we don't write back to it. 
+             * we "succeed" on the assumption this is some sort 
+             * of random device. Otherwise attempting to write to 
+             * and chmod the device causes problems.
+             */
+            return(1); 
+          }
+#endif
+        }
+#endif
+
+#if defined(O_CREAT) && !defined(OPENSSL_NO_POSIX_IO) && !defined(OPENSSL_SYS_VMS)
+        {
+#ifndef O_BINARY
+#define O_BINARY 0
+#endif
+        /* chmod(..., 0600) is too late to protect the file,
+         * permissions should be restrictive from the start */
+        int fd = open(file, O_WRONLY|O_CREAT|O_BINARY, 0600);
+        if (fd != -1)
+                out = fdopen(fd, "wb");
+        }
+#endif
+
+#ifdef OPENSSL_SYS_VMS
+        /* VMS NOTE: Prior versions of this routine created a _new_
+         * version of the rand file for each call into this routine, then
+         * deleted all existing versions named ;-1, and finally renamed
+         * the current version as ';1'. Under concurrent usage, this
+         * resulted in an RMS race condition in rename() which could
+         * orphan files (see vms message help for RMS$_REENT). With the
+         * fopen() calls below, openssl/VMS now shares the top-level
+         * version of the rand file. Note that there may still be
+         * conditions where the top-level rand file is locked. If so, this
+         * code will then create a new version of the rand file. Without
+         * the delete and rename code, this can result in ascending file
+         * versions that stop at version 32767, and this routine will then
+         * return an error. The remedy for this is to recode the calling
+         * application to avoid concurrent use of the rand file, or
+         * synchronize usage at the application level. Also consider
+         * whether or not you NEED a persistent rand file in a concurrent
+         * use situation. 
+         */
+
+        out = vms_fopen(file,"rb+",VMS_OPEN_ATTRS);
+        if (out == NULL)
+                out = vms_fopen(file,"wb",VMS_OPEN_ATTRS);
+#else
+        if (out == NULL)
+                out = fopen(file,"wb");
+#endif
+        if (out == NULL) goto err;
+
+#ifndef NO_CHMOD
+        chmod(file,0600);
+#endif
+        n=RAND_DATA;
+        for (;;)
+                {
+                i=(n > BUFSIZE)?BUFSIZE:n;
+                n-=BUFSIZE;
+                if (RAND_bytes(buf,i) <= 0)
+                        rand_err=1;
+                i=fwrite(buf,1,i,out);
+                if (i <= 0)
+                        {
+                        ret=0;
+                        break;
+                        }
+                ret+=i;
+                if (n <= 0) break;
+                }
+
+        fclose(out);
+        OPENSSL_cleanse(buf,BUFSIZE);
+err:
+        return (rand_err ? -1 : ret);
+        }
+
+const char *RAND_file_name(char *buf, size_t size)
+        {
+        char *s=NULL;
+#ifdef __OpenBSD__
+        struct stat sb;
+#endif
+
+        if (OPENSSL_issetugid() == 0)
+                s=getenv("RANDFILE");
+        if (s != NULL && *s && strlen(s) + 1 < size)
+                {
+                if (BUF_strlcpy(buf,s,size) >= size)
+                        return NULL;
+                }
+        else
+                {
+                if (OPENSSL_issetugid() == 0)
+                        s=getenv("HOME");
+#ifdef DEFAULT_HOME
+                if (s == NULL)
+                        {
+                        s = DEFAULT_HOME;
+                        }
+#endif
+                if (s && *s && strlen(s)+strlen(RFILE)+2 < size)
+                        {
+                        BUF_strlcpy(buf,s,size);
+#ifndef OPENSSL_SYS_VMS
+                        BUF_strlcat(buf,"/",size);
+#endif
+                        BUF_strlcat(buf,RFILE,size);
+                        }
+                else
+                        buf[0] = '\0'; /* no file name */
+                }
+
+#ifdef __OpenBSD__
+        /* given that all random loads just fail if the file can't be 
+         * seen on a stat, we stat the file we're returning, if it
+         * fails, use /dev/arandom instead. this allows the user to 
+         * use their own source for good random data, but defaults
+         * to something hopefully decent if that isn't available. 
+         */
+
+        if (!buf[0])
+                if (BUF_strlcpy(buf,"/dev/arandom",size) >= size) {
+                        return(NULL);
+                }       
+        if (stat(buf,&sb) == -1)
+                if (BUF_strlcpy(buf,"/dev/arandom",size) >= size) {
+                        return(NULL);
+                }       
+
+#endif
+        return(buf);
+        }