0004-Support-urandom-inside-chroot.patch 3.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113
  1. From 330e8c8352eb0ed3c178ac6e0102403c0a835492 Mon Sep 17 00:00:00 2001
  2. From: Jason Miller <jason@milr.com>
  3. Date: Thu, 5 Jul 2018 20:53:51 -0700
  4. Subject: [PATCH] Support urandom inside chroot
  5. This adds a new default entropy function that uses a /dev/urandom stream
  6. opened before the chroot. If initializing that fails, it fallsback on
  7. HAVEGE only if HAVEGE is supported by the mbedTLS.
  8. This should remove the hard requirement on HAVEGE
  9. resolves #326
  10. resolves #327
  11. [Upstream status: https://github.com/mongrel2/mongrel2/pull/328]
  12. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
  13. ---
  14. src/mongrel2.c | 7 -------
  15. src/server.c | 36 +++++++++++++++++++++++-------------
  16. 2 files changed, 23 insertions(+), 20 deletions(-)
  17. diff --git a/src/mongrel2.c b/src/mongrel2.c
  18. index da632d95..48ece8a5 100644
  19. --- a/src/mongrel2.c
  20. +++ b/src/mongrel2.c
  21. @@ -404,13 +404,6 @@ void taskmain(int argc, char **argv)
  22. rc = attempt_chroot_drop(srv);
  23. check(rc == 0, "Major failure in chroot/droppriv, aborting.");
  24. - // set up rng after chroot
  25. - // TODO: once mbedtls is updated, we can move this back into Server_create
  26. - if(srv->use_ssl) {
  27. - rc = Server_init_rng(srv);
  28. - check(rc == 0, "Failed to initialize rng for server %s", bdata(srv->uuid));
  29. - }
  30. -
  31. final_setup();
  32. taskcreate(tickertask, NULL, TICKER_TASK_STACK);
  33. diff --git a/src/server.c b/src/server.c
  34. index 45761db4..e44e199b 100644
  35. --- a/src/server.c
  36. +++ b/src/server.c
  37. @@ -149,35 +149,45 @@ static int Server_load_ciphers(Server *srv, bstring ssl_ciphers_val)
  38. return -1;
  39. }
  40. +static int urandom_entropy_func(void *data, unsigned char *output, size_t len)
  41. +{
  42. + FILE* urandom = (FILE *)data;
  43. + size_t rc = fread(output, 1, len, urandom);
  44. +
  45. + if (rc != len) return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
  46. +
  47. + return 0;
  48. +}
  49. +
  50. int Server_init_rng(Server *srv)
  51. {
  52. int rc;
  53. - unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
  54. void *ctx = NULL;
  55. - mbedtls_entropy_init( &srv->entropy );
  56. + FILE *urandom = fopen("/dev/urandom","r");
  57. - // test the entropy source
  58. - rc = mbedtls_entropy_func(&srv->entropy, buf, MBEDTLS_ENTROPY_BLOCK_SIZE);
  59. -
  60. - if(rc == 0) {
  61. + if(urandom != NULL) {
  62. ctx = calloc(sizeof(mbedtls_ctr_drbg_context), 1);
  63. mbedtls_ctr_drbg_init((mbedtls_ctr_drbg_context *)ctx);
  64. rc = mbedtls_ctr_drbg_seed((mbedtls_ctr_drbg_context *)ctx,
  65. - mbedtls_entropy_func, &srv->entropy, NULL, 0);
  66. + urandom_entropy_func, urandom, NULL, 0);
  67. check(rc == 0, "Init rng failed: ctr_drbg_init returned %d\n", rc);
  68. srv->rng_func = mbedtls_ctr_drbg_random;
  69. srv->rng_ctx = ctx;
  70. } else {
  71. - log_warn("entropy source unavailable. falling back to havege rng");
  72. +#if defined(MBEDTLS_HAVEGE_C)
  73. + log_warn("entropy source unavailable. falling back to havege rng");
  74. ctx = calloc(sizeof(mbedtls_havege_state), 1);
  75. mbedtls_havege_init((mbedtls_havege_state *)ctx);
  76. -
  77. srv->rng_func = mbedtls_havege_random;
  78. srv->rng_ctx = ctx;
  79. +#else
  80. + log_err("Unable to initialize urandom entropy source, and mbedTLS compiled without HAVEGE");
  81. + goto error;
  82. +#endif
  83. }
  84. return 0;
  85. @@ -278,10 +288,10 @@ Server *Server_create(bstring uuid, bstring default_host,
  86. // TODO: once mbedtls supports opening urandom early and keeping it open,
  87. // put the rng initialization back here (before chroot)
  88. - //if(use_ssl) {
  89. - // rc = Server_init_rng(srv);
  90. - // check(rc == 0, "Failed to initialize rng for server %s", bdata(uuid));
  91. - //}
  92. + if(use_ssl) {
  93. + rc = Server_init_rng(srv);
  94. + check(rc == 0, "Failed to initialize rng for server %s", bdata(uuid));
  95. + }
  96. if(blength(chroot) > 0) {
  97. srv->chroot = bstrcpy(chroot); check_mem(srv->chroot);