From 4617b1f62b3b05364bd9fc4b501df8d504c18fac Mon Sep 17 00:00:00 2001
From: Eric van Gyzen <vangyzen@FreeBSD.org>
Date: Fri, 11 Dec 2020 14:32:42 +0000
Subject: [PATCH] decryptcore: preload OpenSSL error strings; seed PRNG

As in r360226, preload OpenSSL error strings and seed the PRNG
before entering capability mode.

MFC after:	2 weeks
Sponsored by:	Dell EMC Isilon
---
 sbin/decryptcore/decryptcore.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/sbin/decryptcore/decryptcore.c b/sbin/decryptcore/decryptcore.c
index 80050c9a0bfb..cc1807b18a80 100644
--- a/sbin/decryptcore/decryptcore.c
+++ b/sbin/decryptcore/decryptcore.c
@@ -170,6 +170,19 @@ decrypt(int ofd, const char *privkeyfile, const char *keyfile,
 		goto failed;
 	}
 
+	/*
+	 * Obsolescent OpenSSL only knows about /dev/random, and needs to
+	 * pre-seed before entering cap mode.  For whatever reason,
+	 * RSA_pub_encrypt uses the internal PRNG.
+	 */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+	{
+		unsigned char c[1];
+		RAND_bytes(c, 1);
+	}
+#endif
+	ERR_load_crypto_strings();
+
 	caph_cache_catpages();
 	if (caph_enter() < 0) {
 		pjdlog_errno(LOG_ERR, "Unable to enter capability mode");