Completely remove RAND_egd support
The EGD daemon is completely unmaintained and has not seen a release since 13 years which is not an acceptable timeframe for cryptographic software. It is not packaged in any linux distribution I know of and definitely not in *BSD. LibreSSL has already dropped support for RAND_egd.
This commit is contained in:
@@ -118,7 +118,7 @@ if test "$crypto_lib" = "unknown" -a "$with_openssl" != "no"; then
|
||||
break;
|
||||
fi
|
||||
done
|
||||
AC_CHECK_LIB(crypto, RAND_egd, AC_DEFINE(HAVE_RAND_EGD, 1, [Define if the libcrypto has RAND_egd]))
|
||||
AC_CHECK_LIB(crypto, OPENSSL_init, [])
|
||||
CFLAGS="$save_CFLAGS"
|
||||
LIBS="$save_LIBS"
|
||||
fi
|
||||
|
@@ -127,7 +127,6 @@ libhcrypto_la_SOURCES = \
|
||||
md5.h \
|
||||
pkcs5.c \
|
||||
pkcs12.c \
|
||||
rand-egd.c \
|
||||
rand-fortuna.c \
|
||||
rand-timer.c \
|
||||
rand-unix.c \
|
||||
|
@@ -241,9 +241,6 @@ EXPORTS
|
||||
hc_RAND_add
|
||||
hc_RAND_bytes
|
||||
hc_RAND_cleanup
|
||||
;! hc_RAND_egd
|
||||
;! hc_RAND_egd_bytes
|
||||
;! hc_RAND_egd_method
|
||||
hc_RAND_file_name
|
||||
;! hc_RAND_fortuna_method
|
||||
hc_RAND_get_rand_method
|
||||
|
@@ -1,260 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 2007 Kungliga Tekniska Högskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#include <sys/types.h>
|
||||
#ifdef HAVE_SYS_UN_H
|
||||
#include <sys/un.h>
|
||||
#endif
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#ifdef HAVE_UNISTD_H
|
||||
#include <unistd.h>
|
||||
#endif
|
||||
#include <assert.h>
|
||||
|
||||
#include <rand.h>
|
||||
#include <randi.h>
|
||||
|
||||
#include <roken.h>
|
||||
|
||||
static const char *egd_path = "/var/run/egd-pool";
|
||||
|
||||
#define MAX_EGD_DATA 255
|
||||
|
||||
static int
|
||||
connect_egd(const char *path)
|
||||
{
|
||||
struct sockaddr_un addr;
|
||||
int fd;
|
||||
|
||||
memset(&addr, 0, sizeof(addr));
|
||||
|
||||
if (strlen(path) > sizeof(addr.sun_path))
|
||||
return -1;
|
||||
|
||||
addr.sun_family = AF_UNIX;
|
||||
strlcpy(addr.sun_path, path, sizeof(addr.sun_path));
|
||||
|
||||
fd = socket(AF_UNIX, SOCK_STREAM, 0);
|
||||
if (fd < 0)
|
||||
return -1;
|
||||
|
||||
rk_cloexec(fd);
|
||||
|
||||
if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) != 0) {
|
||||
close(fd);
|
||||
return -1;
|
||||
}
|
||||
|
||||
return fd;
|
||||
}
|
||||
|
||||
static int
|
||||
get_entropy(int fd, void *data, size_t len)
|
||||
{
|
||||
unsigned char msg[2];
|
||||
|
||||
assert(len <= MAX_EGD_DATA);
|
||||
|
||||
msg[0] = 0x02; /* read blocking data */
|
||||
msg[1] = len; /* wanted length */
|
||||
|
||||
if (net_write(fd, msg, sizeof(msg)) != sizeof(msg))
|
||||
return 0;
|
||||
|
||||
if (net_read(fd, data, len) != len)
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int
|
||||
put_entropy(int fd, const void *data, size_t len)
|
||||
{
|
||||
unsigned char msg[4];
|
||||
|
||||
assert (len <= MAX_EGD_DATA);
|
||||
|
||||
msg[0] = 0x03; /* write data */
|
||||
msg[1] = 0; /* dummy */
|
||||
msg[2] = 0; /* entropy */
|
||||
msg[3] = len; /* length */
|
||||
|
||||
if (net_write(fd, msg, sizeof(msg)) != sizeof(msg))
|
||||
return 0;
|
||||
if (net_write(fd, data, len) != len)
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
*
|
||||
*/
|
||||
|
||||
static void
|
||||
egd_seed(const void *indata, int size)
|
||||
{
|
||||
size_t len;
|
||||
int fd, ret = 1;
|
||||
|
||||
fd = connect_egd(egd_path);
|
||||
if (fd < 0)
|
||||
return;
|
||||
|
||||
while(size) {
|
||||
len = size;
|
||||
if (len > MAX_EGD_DATA)
|
||||
len = MAX_EGD_DATA;
|
||||
ret = put_entropy(fd, indata, len);
|
||||
if (ret != 1)
|
||||
break;
|
||||
indata = ((unsigned char *)indata) + len;
|
||||
size -= len;
|
||||
}
|
||||
close(fd);
|
||||
}
|
||||
|
||||
static int
|
||||
get_bytes(const char *path, unsigned char *outdata, int size)
|
||||
{
|
||||
size_t len;
|
||||
int fd, ret = 1;
|
||||
|
||||
if (path == NULL)
|
||||
path = egd_path;
|
||||
|
||||
fd = connect_egd(path);
|
||||
if (fd < 0)
|
||||
return 0;
|
||||
|
||||
while(size) {
|
||||
len = size;
|
||||
if (len > MAX_EGD_DATA)
|
||||
len = MAX_EGD_DATA;
|
||||
ret = get_entropy(fd, outdata, len);
|
||||
if (ret != 1)
|
||||
break;
|
||||
outdata += len;
|
||||
size -= len;
|
||||
}
|
||||
close(fd);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int
|
||||
egd_bytes(unsigned char *outdata, int size)
|
||||
{
|
||||
return get_bytes(NULL, outdata, size);
|
||||
}
|
||||
|
||||
static void
|
||||
egd_cleanup(void)
|
||||
{
|
||||
}
|
||||
|
||||
static void
|
||||
egd_add(const void *indata, int size, double entropi)
|
||||
{
|
||||
egd_seed(indata, size);
|
||||
}
|
||||
|
||||
static int
|
||||
egd_pseudorand(unsigned char *outdata, int size)
|
||||
{
|
||||
return get_bytes(NULL, outdata, size);
|
||||
}
|
||||
|
||||
static int
|
||||
egd_status(void)
|
||||
{
|
||||
int fd;
|
||||
fd = connect_egd(egd_path);
|
||||
if (fd < 0)
|
||||
return 0;
|
||||
close(fd);
|
||||
return 1;
|
||||
}
|
||||
|
||||
const RAND_METHOD hc_rand_egd_method = {
|
||||
egd_seed,
|
||||
egd_bytes,
|
||||
egd_cleanup,
|
||||
egd_add,
|
||||
egd_pseudorand,
|
||||
egd_status
|
||||
};
|
||||
|
||||
const RAND_METHOD *
|
||||
RAND_egd_method(void)
|
||||
{
|
||||
return &hc_rand_egd_method;
|
||||
}
|
||||
|
||||
|
||||
int
|
||||
RAND_egd(const char *filename)
|
||||
{
|
||||
return RAND_egd_bytes(filename, 128);
|
||||
}
|
||||
|
||||
int
|
||||
RAND_egd_bytes(const char *filename, int size)
|
||||
{
|
||||
void *data;
|
||||
int ret;
|
||||
|
||||
if (size <= 0)
|
||||
return 0;
|
||||
|
||||
data = malloc(size);
|
||||
if (data == NULL)
|
||||
return 0;
|
||||
|
||||
ret = get_bytes(filename, data, size);
|
||||
if (ret != 1) {
|
||||
free(data);
|
||||
return ret;
|
||||
}
|
||||
|
||||
RAND_seed(data, size);
|
||||
|
||||
memset(data, 0, size);
|
||||
free(data);
|
||||
|
||||
return 1;
|
||||
}
|
@@ -485,20 +485,6 @@ fortuna_reseed(void)
|
||||
add_entropy(&main_state, (void *)buf, sizeof(buf));
|
||||
entropy_p = 1;
|
||||
}
|
||||
#endif
|
||||
#if defined(HAVE_RAND_EGD)
|
||||
/*
|
||||
* Only to get egd entropy if /dev/random or arc4rand failed since
|
||||
* it can be horribly slow to generate new bits.
|
||||
*/
|
||||
if (!entropy_p) {
|
||||
unsigned char buf[INIT_BYTES];
|
||||
if ((*hc_rand_egd_method.bytes)(buf, sizeof(buf)) == 1) {
|
||||
add_entropy(&main_state, buf, sizeof(buf));
|
||||
entropy_p = 1;
|
||||
memset(buf, 0, sizeof(buf));
|
||||
}
|
||||
}
|
||||
#endif
|
||||
/*
|
||||
* Fall back to gattering data from timer and secret files, this
|
||||
|
@@ -56,10 +56,7 @@ typedef struct RAND_METHOD RAND_METHOD;
|
||||
#define RAND_load_file hc_RAND_load_file
|
||||
#define RAND_write_file hc_RAND_write_file
|
||||
#define RAND_status hc_RAND_status
|
||||
#define RAND_egd hc_RAND_egd
|
||||
#define RAND_egd_bytes hc_RAND_egd_bytes
|
||||
#define RAND_fortuna_method hc_RAND_fortuna_method
|
||||
#define RAND_egd_method hc_RAND_egd_method
|
||||
#define RAND_unix_method hc_RAND_unix_method
|
||||
#define RAND_w32crypto_method hc_RAND_w32crypto_method
|
||||
|
||||
@@ -97,13 +94,10 @@ const char *
|
||||
int RAND_load_file(const char *, size_t);
|
||||
int RAND_write_file(const char *);
|
||||
int RAND_status(void);
|
||||
int RAND_egd(const char *);
|
||||
int RAND_egd_bytes(const char *, int);
|
||||
|
||||
|
||||
const RAND_METHOD * RAND_fortuna_method(void);
|
||||
const RAND_METHOD * RAND_unix_method(void);
|
||||
const RAND_METHOD * RAND_egd_method(void);
|
||||
const RAND_METHOD * RAND_w32crypto_method(void);
|
||||
|
||||
#endif /* _HEIM_RAND_H */
|
||||
|
@@ -40,7 +40,6 @@
|
||||
|
||||
extern const RAND_METHOD hc_rand_fortuna_method;
|
||||
extern const RAND_METHOD hc_rand_unix_method;
|
||||
extern const RAND_METHOD hc_rand_egd_method;
|
||||
extern const RAND_METHOD hc_rand_timer_method;
|
||||
extern const RAND_METHOD hc_rand_w32crypto_method;
|
||||
|
||||
|
@@ -125,10 +125,6 @@ main(int argc, char **argv)
|
||||
else if (strcasecmp(rand_method, "unix") == 0)
|
||||
RAND_set_rand_method(RAND_unix_method());
|
||||
#endif
|
||||
#if defined(HAVE_RAND_EGD)
|
||||
else if (strcasecmp(rand_method, "egd") == 0)
|
||||
RAND_set_rand_method(RAND_egd_method());
|
||||
#endif
|
||||
#ifdef WIN32
|
||||
else if (strcasecmp(rand_method, "w32crypto") == 0)
|
||||
RAND_set_rand_method(RAND_w32crypto_method());
|
||||
|
@@ -226,9 +226,6 @@ HEIMDAL_CRYPTO_1.0 {
|
||||
hc_RAND_add;
|
||||
hc_RAND_bytes;
|
||||
hc_RAND_cleanup;
|
||||
hc_RAND_egd;
|
||||
hc_RAND_egd_bytes;
|
||||
hc_RAND_egd_method;
|
||||
hc_RAND_file_name;
|
||||
hc_RAND_fortuna_method;
|
||||
hc_RAND_get_rand_method;
|
||||
|
@@ -67,22 +67,8 @@ seed_something(void)
|
||||
/* Calling RAND_status() will try to use /dev/urandom if it exists so
|
||||
we do not have to deal with it. */
|
||||
if (RAND_status() != 1) {
|
||||
#if defined(HAVE_RAND_EGD)
|
||||
krb5_context context;
|
||||
const char *p;
|
||||
|
||||
/* Try using egd */
|
||||
if (!krb5_init_context(&context)) {
|
||||
p = krb5_config_get_string(context, NULL, "libdefaults",
|
||||
"egd_socket", NULL);
|
||||
if (p != NULL)
|
||||
RAND_egd_bytes(p, ENTROPY_NEEDED);
|
||||
krb5_free_context(context);
|
||||
}
|
||||
#else
|
||||
/* TODO: Once a Windows CryptoAPI RAND method is defined, we
|
||||
can use that and failover to another method. */
|
||||
#endif
|
||||
}
|
||||
|
||||
if (RAND_status() == 1) {
|
||||
|
Reference in New Issue
Block a user