From 5cc4c2c5d62a5e11f57db9c45b68145e64bddde2 Mon Sep 17 00:00:00 2001
From: Paul Kehrer <paul.l.kehrer@gmail.com>
Date: Mon, 20 Nov 2017 15:12:30 +0800
Subject: [PATCH] restore a subset of the rand module

---
 CHANGELOG.rst       |  4 ++-
 src/OpenSSL/rand.py | 59 +++++++++++++++++++++++++++++++++++++++++++++
 tests/test_rand.py  | 48 ++++++++++++++++++++++++++++++++++++
 3 files changed, 110 insertions(+), 1 deletion(-)
 create mode 100644 src/OpenSSL/rand.py
 create mode 100644 tests/test_rand.py

diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 5025cc864..644065916 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -23,7 +23,9 @@ Deprecations:
 Changes:
 ^^^^^^^^
 
-*none*
+- Re-added a subset of the ``OpenSSL.rand`` module.
+  This subset allows conscientious users to reseed the OpenSSL CSPRNG after fork.
+  `#708 <https://github.com/pyca/pyopenssl/pull/708>`_
 
 
 ----
diff --git a/src/OpenSSL/rand.py b/src/OpenSSL/rand.py
new file mode 100644
index 000000000..ac2560ba3
--- /dev/null
+++ b/src/OpenSSL/rand.py
@@ -0,0 +1,59 @@
+"""
+PRNG management routines, thin wrappers.
+"""
+
+from OpenSSL._util import (
+    ffi as _ffi,
+    lib as _lib,
+    exception_from_error_queue as _exception_from_error_queue,
+    path_string as _path_string)
+
+
+_builtin_bytes = bytes
+
+
+def add(buffer, entropy):
+    """
+    Mix bytes from *string* into the PRNG state.
+
+    The *entropy* argument is (the lower bound of) an estimate of how much
+    randomness is contained in *string*, measured in bytes.
+
+    For more information, see e.g. :rfc:`1750`.
+
+    This function is only relevant if you are forking Python processes and
+    need to reseed the CSPRNG after fork.
+
+    :param buffer: Buffer with random data.
+    :param entropy: The entropy (in bytes) measurement of the buffer.
+
+    :return: :obj:`None`
+    """
+    if not isinstance(buffer, _builtin_bytes):
+        raise TypeError("buffer must be a byte string")
+
+    if not isinstance(entropy, int):
+        raise TypeError("entropy must be an integer")
+
+    _lib.RAND_add(buffer, len(buffer), entropy)
+
+
+def status():
+    """
+    Check whether the PRNG has been seeded with enough data.
+
+    :return: 1 if the PRNG is seeded enough, 0 otherwise.
+    """
+    return _lib.RAND_status()
+
+
+def cleanup():
+    """
+    Erase the memory used by the PRNG.
+
+    This is a wrapper for the C function ``RAND_cleanup``.
+
+    :return: :obj:`None`
+    """
+    # TODO Nothing tests this call actually being made, or made properly.
+    _lib.RAND_cleanup()
diff --git a/tests/test_rand.py b/tests/test_rand.py
new file mode 100644
index 000000000..bd61f47e6
--- /dev/null
+++ b/tests/test_rand.py
@@ -0,0 +1,48 @@
+# Copyright (c) Frederick Dean
+# See LICENSE for details.
+
+"""
+Unit tests for `OpenSSL.rand`.
+"""
+
+import pytest
+
+from OpenSSL import rand
+
+
+class TestRand(object):
+
+    @pytest.mark.parametrize('args', [
+        (b"foo", None),
+        (None, 3),
+    ])
+    def test_add_wrong_args(self, args):
+        """
+        `OpenSSL.rand.add` raises `TypeError` if called with arguments not of
+        type `str` and `int`.
+        """
+        with pytest.raises(TypeError):
+            rand.add(*args)
+
+    def test_add(self):
+        """
+        `OpenSSL.rand.add` adds entropy to the PRNG.
+        """
+        rand.add(b'hamburger', 3)
+
+    def test_status(self):
+        """
+        `OpenSSL.rand.status` returns `1` if the PRNG has sufficient entropy,
+        `0` otherwise.
+        """
+        # It's hard to know what it is actually going to return.  Different
+        # OpenSSL random engines decide differently whether they have enough
+        # entropy or not.
+        assert rand.status() in (0, 1)
+
+    def test_cleanup(self):
+        """
+        `OpenSSL.rand.cleanup` releases the memory used by the PRNG and
+        returns `None`.
+        """
+        assert rand.cleanup() is None