diff --git a/cf/crypto.m4 b/cf/crypto.m4 index f42905d0d..248b86ce5 100644 --- a/cf/crypto.m4 +++ b/cf/crypto.m4 @@ -118,7 +118,7 @@ if test "$crypto_lib" = "unknown" -a "$with_openssl" != "no"; then break; fi done - AC_CHECK_LIB(crypto, RAND_egd, AC_DEFINE(HAVE_RAND_EGD, 1, [Define if the libcrypto has RAND_egd])) + AC_CHECK_LIB(crypto, OPENSSL_init, []) CFLAGS="$save_CFLAGS" LIBS="$save_LIBS" fi diff --git a/lib/hcrypto/Makefile.am b/lib/hcrypto/Makefile.am index 510e5350e..cc0e6c527 100644 --- a/lib/hcrypto/Makefile.am +++ b/lib/hcrypto/Makefile.am @@ -127,7 +127,6 @@ libhcrypto_la_SOURCES = \ md5.h \ pkcs5.c \ pkcs12.c \ - rand-egd.c \ rand-fortuna.c \ rand-timer.c \ rand-unix.c \ diff --git a/lib/hcrypto/libhcrypto-exports.def b/lib/hcrypto/libhcrypto-exports.def index 6fc728614..8c0d79a6a 100644 --- a/lib/hcrypto/libhcrypto-exports.def +++ b/lib/hcrypto/libhcrypto-exports.def @@ -241,9 +241,6 @@ EXPORTS hc_RAND_add hc_RAND_bytes hc_RAND_cleanup -;! hc_RAND_egd -;! hc_RAND_egd_bytes -;! hc_RAND_egd_method hc_RAND_file_name ;! hc_RAND_fortuna_method hc_RAND_get_rand_method diff --git a/lib/hcrypto/rand-egd.c b/lib/hcrypto/rand-egd.c deleted file mode 100644 index dd2d3e13e..000000000 --- a/lib/hcrypto/rand-egd.c +++ /dev/null @@ -1,260 +0,0 @@ -/* - * Copyright (c) 2007 Kungliga Tekniska Högskolan - * (Royal Institute of Technology, Stockholm, Sweden). - * All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * - * 3. Neither the name of the Institute nor the names of its contributors - * may be used to endorse or promote products derived from this software - * without specific prior written permission. - * - * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - */ - -#include - -#include -#ifdef HAVE_SYS_UN_H -#include -#endif - -#include -#include -#ifdef HAVE_UNISTD_H -#include -#endif -#include - -#include -#include - -#include - -static const char *egd_path = "/var/run/egd-pool"; - -#define MAX_EGD_DATA 255 - -static int -connect_egd(const char *path) -{ - struct sockaddr_un addr; - int fd; - - memset(&addr, 0, sizeof(addr)); - - if (strlen(path) > sizeof(addr.sun_path)) - return -1; - - addr.sun_family = AF_UNIX; - strlcpy(addr.sun_path, path, sizeof(addr.sun_path)); - - fd = socket(AF_UNIX, SOCK_STREAM, 0); - if (fd < 0) - return -1; - - rk_cloexec(fd); - - if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) != 0) { - close(fd); - return -1; - } - - return fd; -} - -static int -get_entropy(int fd, void *data, size_t len) -{ - unsigned char msg[2]; - - assert(len <= MAX_EGD_DATA); - - msg[0] = 0x02; /* read blocking data */ - msg[1] = len; /* wanted length */ - - if (net_write(fd, msg, sizeof(msg)) != sizeof(msg)) - return 0; - - if (net_read(fd, data, len) != len) - return 0; - - return 1; -} - -static int -put_entropy(int fd, const void *data, size_t len) -{ - unsigned char msg[4]; - - assert (len <= MAX_EGD_DATA); - - msg[0] = 0x03; /* write data */ - msg[1] = 0; /* dummy */ - msg[2] = 0; /* entropy */ - msg[3] = len; /* length */ - - if (net_write(fd, msg, sizeof(msg)) != sizeof(msg)) - return 0; - if (net_write(fd, data, len) != len) - return 0; - - return 1; -} - -/* - * - */ - -static void -egd_seed(const void *indata, int size) -{ - size_t len; - int fd, ret = 1; - - fd = connect_egd(egd_path); - if (fd < 0) - return; - - while(size) { - len = size; - if (len > MAX_EGD_DATA) - len = MAX_EGD_DATA; - ret = put_entropy(fd, indata, len); - if (ret != 1) - break; - indata = ((unsigned char *)indata) + len; - size -= len; - } - close(fd); -} - -static int -get_bytes(const char *path, unsigned char *outdata, int size) -{ - size_t len; - int fd, ret = 1; - - if (path == NULL) - path = egd_path; - - fd = connect_egd(path); - if (fd < 0) - return 0; - - while(size) { - len = size; - if (len > MAX_EGD_DATA) - len = MAX_EGD_DATA; - ret = get_entropy(fd, outdata, len); - if (ret != 1) - break; - outdata += len; - size -= len; - } - close(fd); - - return ret; -} - -static int -egd_bytes(unsigned char *outdata, int size) -{ - return get_bytes(NULL, outdata, size); -} - -static void -egd_cleanup(void) -{ -} - -static void -egd_add(const void *indata, int size, double entropi) -{ - egd_seed(indata, size); -} - -static int -egd_pseudorand(unsigned char *outdata, int size) -{ - return get_bytes(NULL, outdata, size); -} - -static int -egd_status(void) -{ - int fd; - fd = connect_egd(egd_path); - if (fd < 0) - return 0; - close(fd); - return 1; -} - -const RAND_METHOD hc_rand_egd_method = { - egd_seed, - egd_bytes, - egd_cleanup, - egd_add, - egd_pseudorand, - egd_status -}; - -const RAND_METHOD * -RAND_egd_method(void) -{ - return &hc_rand_egd_method; -} - - -int -RAND_egd(const char *filename) -{ - return RAND_egd_bytes(filename, 128); -} - -int -RAND_egd_bytes(const char *filename, int size) -{ - void *data; - int ret; - - if (size <= 0) - return 0; - - data = malloc(size); - if (data == NULL) - return 0; - - ret = get_bytes(filename, data, size); - if (ret != 1) { - free(data); - return ret; - } - - RAND_seed(data, size); - - memset(data, 0, size); - free(data); - - return 1; -} diff --git a/lib/hcrypto/rand-fortuna.c b/lib/hcrypto/rand-fortuna.c index 68112e054..a4c388584 100644 --- a/lib/hcrypto/rand-fortuna.c +++ b/lib/hcrypto/rand-fortuna.c @@ -485,20 +485,6 @@ fortuna_reseed(void) add_entropy(&main_state, (void *)buf, sizeof(buf)); entropy_p = 1; } -#endif -#if defined(HAVE_RAND_EGD) - /* - * Only to get egd entropy if /dev/random or arc4rand failed since - * it can be horribly slow to generate new bits. - */ - if (!entropy_p) { - unsigned char buf[INIT_BYTES]; - if ((*hc_rand_egd_method.bytes)(buf, sizeof(buf)) == 1) { - add_entropy(&main_state, buf, sizeof(buf)); - entropy_p = 1; - memset(buf, 0, sizeof(buf)); - } - } #endif /* * Fall back to gattering data from timer and secret files, this diff --git a/lib/hcrypto/rand.h b/lib/hcrypto/rand.h index 590bd8cf1..1c9df8a18 100644 --- a/lib/hcrypto/rand.h +++ b/lib/hcrypto/rand.h @@ -56,10 +56,7 @@ typedef struct RAND_METHOD RAND_METHOD; #define RAND_load_file hc_RAND_load_file #define RAND_write_file hc_RAND_write_file #define RAND_status hc_RAND_status -#define RAND_egd hc_RAND_egd -#define RAND_egd_bytes hc_RAND_egd_bytes #define RAND_fortuna_method hc_RAND_fortuna_method -#define RAND_egd_method hc_RAND_egd_method #define RAND_unix_method hc_RAND_unix_method #define RAND_w32crypto_method hc_RAND_w32crypto_method @@ -97,13 +94,10 @@ const char * int RAND_load_file(const char *, size_t); int RAND_write_file(const char *); int RAND_status(void); -int RAND_egd(const char *); -int RAND_egd_bytes(const char *, int); const RAND_METHOD * RAND_fortuna_method(void); const RAND_METHOD * RAND_unix_method(void); -const RAND_METHOD * RAND_egd_method(void); const RAND_METHOD * RAND_w32crypto_method(void); #endif /* _HEIM_RAND_H */ diff --git a/lib/hcrypto/randi.h b/lib/hcrypto/randi.h index fe021a80e..85d5d6605 100644 --- a/lib/hcrypto/randi.h +++ b/lib/hcrypto/randi.h @@ -40,7 +40,6 @@ extern const RAND_METHOD hc_rand_fortuna_method; extern const RAND_METHOD hc_rand_unix_method; -extern const RAND_METHOD hc_rand_egd_method; extern const RAND_METHOD hc_rand_timer_method; extern const RAND_METHOD hc_rand_w32crypto_method; diff --git a/lib/hcrypto/test_rand.c b/lib/hcrypto/test_rand.c index a55547e8a..9548a7700 100644 --- a/lib/hcrypto/test_rand.c +++ b/lib/hcrypto/test_rand.c @@ -125,10 +125,6 @@ main(int argc, char **argv) else if (strcasecmp(rand_method, "unix") == 0) RAND_set_rand_method(RAND_unix_method()); #endif -#if defined(HAVE_RAND_EGD) - else if (strcasecmp(rand_method, "egd") == 0) - RAND_set_rand_method(RAND_egd_method()); -#endif #ifdef WIN32 else if (strcasecmp(rand_method, "w32crypto") == 0) RAND_set_rand_method(RAND_w32crypto_method()); diff --git a/lib/hcrypto/version-script.map b/lib/hcrypto/version-script.map index ec202133f..7eec8870b 100644 --- a/lib/hcrypto/version-script.map +++ b/lib/hcrypto/version-script.map @@ -226,9 +226,6 @@ HEIMDAL_CRYPTO_1.0 { hc_RAND_add; hc_RAND_bytes; hc_RAND_cleanup; - hc_RAND_egd; - hc_RAND_egd_bytes; - hc_RAND_egd_method; hc_RAND_file_name; hc_RAND_fortuna_method; hc_RAND_get_rand_method; diff --git a/lib/krb5/crypto-rand.c b/lib/krb5/crypto-rand.c index 6e85c2a0e..7b126c695 100644 --- a/lib/krb5/crypto-rand.c +++ b/lib/krb5/crypto-rand.c @@ -67,22 +67,8 @@ seed_something(void) /* Calling RAND_status() will try to use /dev/urandom if it exists so we do not have to deal with it. */ if (RAND_status() != 1) { -#if defined(HAVE_RAND_EGD) - krb5_context context; - const char *p; - - /* Try using egd */ - if (!krb5_init_context(&context)) { - p = krb5_config_get_string(context, NULL, "libdefaults", - "egd_socket", NULL); - if (p != NULL) - RAND_egd_bytes(p, ENTROPY_NEEDED); - krb5_free_context(context); - } -#else /* TODO: Once a Windows CryptoAPI RAND method is defined, we can use that and failover to another method. */ -#endif } if (RAND_status() == 1) {