blob: 2d483b39174cd3f833aa0c536181a658af473389 [file] [log] [blame]
Damien Miller040f3832000-04-03 14:50:43 +10001/*
Damien Miller62116dc2001-12-24 01:41:47 +11002 * Copyright (c) 2001 Damien Miller. All rights reserved.
Damien Miller040f3832000-04-03 14:50:43 +10003 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
Damien Miller040f3832000-04-03 14:50:43 +100012 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24
25#include "includes.h"
26
Darren Tuckerd82cbcb2006-03-16 07:21:35 +110027#include <sys/types.h>
Damien Millerf22019b2011-05-05 13:48:37 +100028#include <sys/socket.h>
29#ifdef HAVE_SYS_UN_H
30# include <sys/un.h>
Darren Tuckere0e4aad2006-07-11 19:01:51 +100031#endif
32
Damien Millerf22019b2011-05-05 13:48:37 +100033#include <netinet/in.h>
34#include <arpa/inet.h>
35
36#include <errno.h>
Darren Tucker23dd6582006-09-28 19:40:20 +100037#include <signal.h>
Damien Millerf22019b2011-05-05 13:48:37 +100038#include <string.h>
Darren Tuckera8d51ee2007-03-13 07:35:38 +110039#include <unistd.h>
Damien Millerf22019b2011-05-05 13:48:37 +100040#include <stddef.h> /* for offsetof */
Darren Tuckere0e4aad2006-07-11 19:01:51 +100041
Damien Miller5f056372000-04-16 12:31:48 +100042#include <openssl/rand.h>
Damien Miller767c7fc2001-02-27 09:20:57 +110043#include <openssl/crypto.h>
Darren Tuckerc6f82192005-09-27 22:46:32 +100044#include <openssl/err.h>
Damien Miller040f3832000-04-03 14:50:43 +100045
Ben Lindstrom226cfa02001-01-22 05:34:40 +000046#include "ssh.h"
Damien Millera1072a82001-02-18 15:28:11 +110047#include "misc.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000048#include "xmalloc.h"
49#include "atomicio.h"
Ben Lindstromcb577332001-01-22 21:06:19 +000050#include "pathnames.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000051#include "log.h"
Darren Tuckerc6f82192005-09-27 22:46:32 +100052#include "buffer.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000053
Damien Miller14c12cb2000-06-07 22:20:23 +100054/*
Damien Miller62116dc2001-12-24 01:41:47 +110055 * Portable OpenSSH PRNG seeding:
Damien Millera8e06ce2003-11-21 23:48:55 +110056 * If OpenSSL has not "internally seeded" itself (e.g. pulled data from
Damien Millerf22019b2011-05-05 13:48:37 +100057 * /dev/random), then collect RANDOM_SEED_SIZE bytes of randomness from
58 * PRNGd.
Damien Miller14c12cb2000-06-07 22:20:23 +100059 */
Damien Miller6c21c512002-01-22 21:57:53 +110060#ifndef OPENSSL_PRNG_ONLY
Damien Millerf22019b2011-05-05 13:48:37 +100061
Damien Miller62116dc2001-12-24 01:41:47 +110062#define RANDOM_SEED_SIZE 48
Damien Miller62116dc2001-12-24 01:41:47 +110063
Damien Millerf22019b2011-05-05 13:48:37 +100064/*
65 * Collect 'len' bytes of entropy into 'buf' from PRNGD/EGD daemon
66 * listening either on 'tcp_port', or via Unix domain socket at *
67 * 'socket_path'.
68 * Either a non-zero tcp_port or a non-null socket_path must be
69 * supplied.
70 * Returns 0 on success, -1 on error
71 */
72int
73get_random_bytes_prngd(unsigned char *buf, int len,
74 unsigned short tcp_port, char *socket_path)
Damien Miller14c12cb2000-06-07 22:20:23 +100075{
Damien Millerf22019b2011-05-05 13:48:37 +100076 int fd, addr_len, rval, errors;
77 u_char msg[2];
78 struct sockaddr_storage addr;
79 struct sockaddr_in *addr_in = (struct sockaddr_in *)&addr;
80 struct sockaddr_un *addr_un = (struct sockaddr_un *)&addr;
81 mysig_t old_sigpipe;
Kevin Stevesef4eea92001-02-05 12:42:17 +000082
Damien Millerf22019b2011-05-05 13:48:37 +100083 /* Sanity checks */
84 if (socket_path == NULL && tcp_port == 0)
85 fatal("You must specify a port or a socket");
86 if (socket_path != NULL &&
87 strlen(socket_path) >= sizeof(addr_un->sun_path))
88 fatal("Random pool path is too long");
89 if (len <= 0 || len > 255)
90 fatal("Too many bytes (%d) to read from PRNGD", len);
91
92 memset(&addr, '\0', sizeof(addr));
93
94 if (tcp_port != 0) {
95 addr_in->sin_family = AF_INET;
96 addr_in->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
97 addr_in->sin_port = htons(tcp_port);
98 addr_len = sizeof(*addr_in);
99 } else {
100 addr_un->sun_family = AF_UNIX;
101 strlcpy(addr_un->sun_path, socket_path,
102 sizeof(addr_un->sun_path));
103 addr_len = offsetof(struct sockaddr_un, sun_path) +
104 strlen(socket_path) + 1;
Damien Miller08006472000-06-26 13:55:31 +1000105 }
Kevin Stevesef4eea92001-02-05 12:42:17 +0000106
Damien Millerf22019b2011-05-05 13:48:37 +1000107 old_sigpipe = mysignal(SIGPIPE, SIG_IGN);
Damien Miller62116dc2001-12-24 01:41:47 +1100108
Damien Millerf22019b2011-05-05 13:48:37 +1000109 errors = 0;
110 rval = -1;
111reopen:
112 fd = socket(addr.ss_family, SOCK_STREAM, 0);
113 if (fd == -1) {
114 error("Couldn't create socket: %s", strerror(errno));
115 goto done;
116 }
Damien Miller62116dc2001-12-24 01:41:47 +1100117
Damien Millerf22019b2011-05-05 13:48:37 +1000118 if (connect(fd, (struct sockaddr*)&addr, addr_len) == -1) {
119 if (tcp_port != 0) {
120 error("Couldn't connect to PRNGD port %d: %s",
121 tcp_port, strerror(errno));
122 } else {
123 error("Couldn't connect to PRNGD socket \"%s\": %s",
124 addr_un->sun_path, strerror(errno));
Damien Miller62116dc2001-12-24 01:41:47 +1100125 }
Damien Millerf22019b2011-05-05 13:48:37 +1000126 goto done;
Damien Miller62116dc2001-12-24 01:41:47 +1100127 }
128
Damien Millerf22019b2011-05-05 13:48:37 +1000129 /* Send blocking read request to PRNGD */
130 msg[0] = 0x02;
131 msg[1] = len;
Damien Miller62116dc2001-12-24 01:41:47 +1100132
Damien Millerf22019b2011-05-05 13:48:37 +1000133 if (atomicio(vwrite, fd, msg, sizeof(msg)) != sizeof(msg)) {
134 if (errno == EPIPE && errors < 10) {
135 close(fd);
136 errors++;
137 goto reopen;
138 }
139 error("Couldn't write to PRNGD socket: %s",
Damien Miller62116dc2001-12-24 01:41:47 +1100140 strerror(errno));
Damien Millerf22019b2011-05-05 13:48:37 +1000141 goto done;
142 }
Damien Miller62116dc2001-12-24 01:41:47 +1100143
Damien Millerf22019b2011-05-05 13:48:37 +1000144 if (atomicio(read, fd, buf, len) != (size_t)len) {
145 if (errno == EPIPE && errors < 10) {
146 close(fd);
147 errors++;
148 goto reopen;
149 }
150 error("Couldn't read from PRNGD socket: %s",
Damien Millerb6f72f52005-07-17 17:26:43 +1000151 strerror(errno));
Damien Millerf22019b2011-05-05 13:48:37 +1000152 goto done;
153 }
Damien Miller62116dc2001-12-24 01:41:47 +1100154
Damien Millerf22019b2011-05-05 13:48:37 +1000155 rval = 0;
156done:
157 mysignal(SIGPIPE, old_sigpipe);
158 if (fd != -1)
159 close(fd);
160 return rval;
Damien Miller14c12cb2000-06-07 22:20:23 +1000161}
162
Damien Millerf22019b2011-05-05 13:48:37 +1000163static int
164seed_from_prngd(unsigned char *buf, size_t bytes)
Damien Miller767c7fc2001-02-27 09:20:57 +1100165{
Damien Millerf22019b2011-05-05 13:48:37 +1000166#ifdef PRNGD_PORT
167 debug("trying egd/prngd port %d", PRNGD_PORT);
168 if (get_random_bytes_prngd(buf, bytes, PRNGD_PORT, NULL) == 0)
169 return 0;
Damien Miller6c21c512002-01-22 21:57:53 +1100170#endif
Damien Millerf22019b2011-05-05 13:48:37 +1000171#ifdef PRNGD_SOCKET
172 debug("trying egd/prngd socket %s", PRNGD_SOCKET);
173 if (get_random_bytes_prngd(buf, bytes, 0, PRNGD_SOCKET) == 0)
174 return 0;
175#endif
176 return -1;
Damien Millerf9b625c2000-07-09 22:42:32 +1000177}
Damien Miller6c21c512002-01-22 21:57:53 +1100178
Darren Tuckerc6f82192005-09-27 22:46:32 +1000179void
180rexec_send_rng_seed(Buffer *m)
181{
182 u_char buf[RANDOM_SEED_SIZE];
183
184 if (RAND_bytes(buf, sizeof(buf)) <= 0) {
185 error("Couldn't obtain random bytes (error %ld)",
186 ERR_get_error());
187 buffer_put_string(m, "", 0);
188 } else
189 buffer_put_string(m, buf, sizeof(buf));
190}
191
192void
193rexec_recv_rng_seed(Buffer *m)
194{
Darren Tucker46e7ba52005-09-28 08:26:30 +1000195 u_char *buf;
Darren Tuckerc6f82192005-09-27 22:46:32 +1000196 u_int len;
197
198 buf = buffer_get_string_ret(m, &len);
199 if (buf != NULL) {
200 debug3("rexec_recv_rng_seed: seeding rng with %u bytes", len);
201 RAND_add(buf, len, len);
202 }
203}
Damien Millerf22019b2011-05-05 13:48:37 +1000204#endif /* OPENSSL_PRNG_ONLY */
205
206void
207seed_rng(void)
208{
209#ifndef OPENSSL_PRNG_ONLY
210 unsigned char buf[RANDOM_SEED_SIZE];
Darren Tuckerc6f82192005-09-27 22:46:32 +1000211#endif
Damien Millerf22019b2011-05-05 13:48:37 +1000212 /*
213 * OpenSSL version numbers: MNNFFPPS: major minor fix patch status
Damien Miller4d557342012-03-30 11:34:27 +1100214 * We match major, minor, fix and status (not patch) for <1.0.0.
215 * After that, we acceptable compatible fix versions (so we
216 * allow 1.0.1 to work with 1.0.0). Going backwards is only allowed
217 * within a patch series.
Damien Millerf22019b2011-05-05 13:48:37 +1000218 */
Damien Miller4d557342012-03-30 11:34:27 +1100219 u_long version_mask = SSLeay() >= 0x1000000f ? ~0xffff0L : ~0xff0L;
220 if (((SSLeay() ^ OPENSSL_VERSION_NUMBER) & version_mask) ||
221 (SSLeay() >> 12) < (OPENSSL_VERSION_NUMBER >> 12))
Damien Millerf22019b2011-05-05 13:48:37 +1000222 fatal("OpenSSL version mismatch. Built against %lx, you "
223 "have %lx", (u_long)OPENSSL_VERSION_NUMBER, SSLeay());
224
225#ifndef OPENSSL_PRNG_ONLY
226 if (RAND_status() == 1) {
227 debug3("RNG is ready, skipping seeding");
228 return;
229 }
230
231 if (seed_from_prngd(buf, sizeof(buf)) == -1)
232 fatal("Could not obtain seed from PRNGd");
233 RAND_add(buf, sizeof(buf), sizeof(buf));
234 memset(buf, '\0', sizeof(buf));
235
236#endif /* OPENSSL_PRNG_ONLY */
237 if (RAND_status() != 1)
238 fatal("PRNG is not seeded");
239}