|
 |
1524bc |
From 290c078652ffcacd69b0b00ea5e5413515c5de22 Mon Sep 17 00:00:00 2001
|
|
|
1524bc |
From: Andreas Schneider <asn@samba.org>
|
|
|
1524bc |
Date: Mon, 18 Mar 2019 17:03:30 +0100
|
|
|
1524bc |
Subject: [PATCH 005/187] lib:util: Use GnuTLS random number generator in
|
|
|
1524bc |
genrand.c
|
|
|
1524bc |
|
|
|
1524bc |
FIPS requires that a random number generator from a certified crypto
|
|
|
1524bc |
library is used.
|
|
|
1524bc |
|
|
|
1524bc |
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
|
1524bc |
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
|
1524bc |
|
|
|
1524bc |
Autobuild-User(master): Jeremy Allison <jra@samba.org>
|
|
|
1524bc |
Autobuild-Date(master): Thu Jul 18 01:30:20 UTC 2019 on sn-devel-184
|
|
|
1524bc |
|
|
|
1524bc |
(cherry picked from commit 664eed2e926f8f572b81e6d7c8e09b7ccbafb908)
|
|
|
1524bc |
---
|
|
|
1524bc |
lib/util/genrand.c | 31 +++++++------------------------
|
|
|
1524bc |
lib/util/genrand.h | 11 ++++-------
|
|
|
1524bc |
lib/util/wscript_build | 2 +-
|
|
|
1524bc |
3 files changed, 12 insertions(+), 32 deletions(-)
|
|
|
1524bc |
|
|
|
1524bc |
diff --git a/lib/util/genrand.c b/lib/util/genrand.c
|
|
|
1524bc |
index a775535c49e..55997c3dd55 100644
|
|
|
1524bc |
--- a/lib/util/genrand.c
|
|
|
1524bc |
+++ b/lib/util/genrand.c
|
|
|
1524bc |
@@ -20,35 +20,17 @@
|
|
|
1524bc |
*/
|
|
|
1524bc |
|
|
|
1524bc |
#include "replace.h"
|
|
|
1524bc |
-#include "system/filesys.h"
|
|
|
1524bc |
#include "lib/util/genrand.h"
|
|
|
1524bc |
-#include "sys_rw_data.h"
|
|
|
1524bc |
-#include "lib/util/blocking.h"
|
|
|
1524bc |
|
|
|
1524bc |
-static int urand_fd = -1;
|
|
|
1524bc |
+#include <gnutls/gnutls.h>
|
|
|
1524bc |
+#include <gnutls/crypto.h>
|
|
|
1524bc |
|
|
|
1524bc |
-static void open_urandom(void)
|
|
|
1524bc |
-{
|
|
|
1524bc |
- if (urand_fd != -1) {
|
|
|
1524bc |
- return;
|
|
|
1524bc |
- }
|
|
|
1524bc |
- urand_fd = open( "/dev/urandom", O_RDONLY,0);
|
|
|
1524bc |
- if (urand_fd == -1) {
|
|
|
1524bc |
- abort();
|
|
|
1524bc |
- }
|
|
|
1524bc |
- smb_set_close_on_exec(urand_fd);
|
|
|
1524bc |
-}
|
|
|
1524bc |
+/* TODO: Add API for generating nonce or use gnutls_rnd directly everywhere. */
|
|
|
1524bc |
|
|
|
1524bc |
_PUBLIC_ void generate_random_buffer(uint8_t *out, int len)
|
|
|
1524bc |
{
|
|
|
1524bc |
- ssize_t rw_ret;
|
|
|
1524bc |
-
|
|
|
1524bc |
- open_urandom();
|
|
|
1524bc |
-
|
|
|
1524bc |
- rw_ret = read_data(urand_fd, out, len);
|
|
|
1524bc |
- if (rw_ret != len) {
|
|
|
1524bc |
- abort();
|
|
|
1524bc |
- }
|
|
|
1524bc |
+ /* Thread and fork safe random number generator for temporary keys. */
|
|
|
1524bc |
+ gnutls_rnd(GNUTLS_RND_RANDOM, out, len);
|
|
|
1524bc |
}
|
|
|
1524bc |
|
|
|
1524bc |
/*
|
|
|
1524bc |
@@ -57,5 +39,6 @@ _PUBLIC_ void generate_random_buffer(uint8_t *out, int len)
|
|
|
1524bc |
*/
|
|
|
1524bc |
_PUBLIC_ void generate_secret_buffer(uint8_t *out, int len)
|
|
|
1524bc |
{
|
|
|
1524bc |
- generate_random_buffer(out, len);
|
|
|
1524bc |
+ /* Thread and fork safe random number generator for long term keys. */
|
|
|
1524bc |
+ gnutls_rnd(GNUTLS_RND_KEY, out, len);
|
|
|
1524bc |
}
|
|
|
1524bc |
diff --git a/lib/util/genrand.h b/lib/util/genrand.h
|
|
|
1524bc |
index ef6bbc64157..899ce8badc0 100644
|
|
|
1524bc |
--- a/lib/util/genrand.h
|
|
|
1524bc |
+++ b/lib/util/genrand.h
|
|
|
1524bc |
@@ -20,14 +20,11 @@
|
|
|
1524bc |
*/
|
|
|
1524bc |
|
|
|
1524bc |
/**
|
|
|
1524bc |
- Interface to the (hopefully) good crypto random number generator.
|
|
|
1524bc |
- Will use our internal PRNG if more than 40 bytes of random generation
|
|
|
1524bc |
- has been requested, otherwise tries to read from /dev/random
|
|
|
1524bc |
-**/
|
|
|
1524bc |
+ * Thread and fork safe random number generator for temporary keys.
|
|
|
1524bc |
+ */
|
|
|
1524bc |
void generate_random_buffer(uint8_t *out, int len);
|
|
|
1524bc |
|
|
|
1524bc |
/**
|
|
|
1524bc |
- Interface to the (hopefully) good crypto random number generator.
|
|
|
1524bc |
- Will always use /dev/urandom if available.
|
|
|
1524bc |
-**/
|
|
|
1524bc |
+ * Thread and fork safe random number generator for long term keys.
|
|
|
1524bc |
+ */
|
|
|
1524bc |
void generate_secret_buffer(uint8_t *out, int len);
|
|
|
1524bc |
diff --git a/lib/util/wscript_build b/lib/util/wscript_build
|
|
|
1524bc |
index ff1c76e3686..5f005c41e49 100644
|
|
|
1524bc |
--- a/lib/util/wscript_build
|
|
|
1524bc |
+++ b/lib/util/wscript_build
|
|
|
1524bc |
@@ -104,7 +104,7 @@ else:
|
|
|
1524bc |
|
|
|
1524bc |
bld.SAMBA_LIBRARY('genrand',
|
|
|
1524bc |
source='genrand.c',
|
|
|
1524bc |
- deps='replace socket-blocking sys_rw',
|
|
|
1524bc |
+ deps='replace gnutls',
|
|
|
1524bc |
local_include=False,
|
|
|
1524bc |
private_library=True)
|
|
|
1524bc |
|
|
|
1524bc |
--
|
|
|
1524bc |
2.23.0
|
|
|
1524bc |
|