Add automatic query of EGD sockets to RAND_poll(). The EGD sockets are

only queried when the /dev/[u]random devices did not return enough
entropy. Only the amount of entropy missing to reach the required minimum
is queried, as EGD may be drained.
Queried locations are: /etc/entropy, /var/run/egd-pool

diff --git a/CHANGES b/CHANGES
index b0a1f58c55d4a91496ad82f039f3757cad4aab58..75fdcc509b48aa10757e8ffcce1cb4005ef9f975 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -10,6 +10,12 @@
      (and "OBJ_cleanup" in crypto/objects/obj_dat.c as an example).
      [Geoff Thorpe]
 
+  *) Add automatic query of EGD sockets in RAND_poll() for the unix variant.
+     If an EGD or PRNGD is running and enough entropy is returned, automatic
+     seeding like with /dev/[u]random will be performed.
+     Positions tried are: /etc/entropy, /var/run/egd-pool.
+     [Lutz Jaenicke]
+
   *) Change the Unix RAND_poll() variant to be able to poll several
      random devices and only read data for a small fragment of time
      to avoid hangs.  Also separate out the Unix variant to it's own

diff --git a/crypto/rand/rand.h b/crypto/rand/rand.h
index eb9c8c034de906b3a960b2aa2885e8e517b9cec8..1331db99dbfd8c5938ab1afb2410f0e68dbb53df 100644 (file)
--- a/crypto/rand/rand.h
+++ b/crypto/rand/rand.h
@@ -91,6 +91,7 @@ int  RAND_load_file(const char *file,long max_bytes);
 int  RAND_write_file(const char *file);
 const char *RAND_file_name(char *file,int num);
 int RAND_status(void);
+int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes);
 int RAND_egd(const char *path);
 int RAND_egd_bytes(const char *path,int bytes);
 void ERR_load_RAND_strings(void);

diff --git a/crypto/rand/rand_egd.c b/crypto/rand/rand_egd.c
index 02a0d86fa330aa0504d76e863d1eee9f9767bb73..28fb1f2c600b284f271b6be13daebb2b4478d942 100644 (file)
--- a/crypto/rand/rand_egd.c
+++ b/crypto/rand/rand_egd.c
@@ -60,6 +60,10 @@
  */
 
 #if defined(WIN32) || defined(VMS) || defined(__VMS)
+int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)
+       {
+       return(-1);
+       }
 int RAND_egd(const char *path)
        {
        return(-1);
@@ -81,13 +85,13 @@ int RAND_egd_bytes(const char *path,int bytes)
 #  define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)
 #endif
 
-int RAND_egd(const char *path)
+int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)
        {
-       int ret = -1;
+       int ret = 0;
        struct sockaddr_un addr;
        int len, num;
        int fd = -1;
-       unsigned char buf[256];
+       unsigned char egdbuf[2];
 
        memset(&addr, 0, sizeof(addr));
        addr.sun_family = AF_UNIX;
@@ -98,18 +102,44 @@ int RAND_egd(const char *path)
        fd = socket(AF_UNIX, SOCK_STREAM, 0);
        if (fd == -1) return (-1);
        if (connect(fd, (struct sockaddr *)&addr, len) == -1) goto err;
-       buf[0] = 1;
-       buf[1] = 255;
-       write(fd, buf, 2);
-       if (read(fd, buf, 1) != 1) goto err;
-       if (buf[0] == 0) goto err;
-       num = read(fd, buf, 255);
+
+       while(bytes > 0)
+           {
+           egdbuf[0] = 1;
+           egdbuf[1] = bytes < 255 ? bytes : 255;
+           write(fd, egdbuf, 2);
+           if (read(fd, egdbuf, 1) != 1)
+               {
+               ret=-1;
+               goto err;
+               }
+           if(egdbuf[0] == 0)
+               goto err;
+           num = read(fd, buf + ret, egdbuf[0]);
+           if (num < 1)
+               {
+               ret=-1;
+               goto err;
+               }
+           ret += num;
+           bytes-=num;
+           }
+ err:
+       if (fd != -1) close(fd);
+       return(ret);
+       }
+
+int RAND_egd(const char *path)
+       {
+       int num, ret;
+       unsigned char buf[256];
+
+       num = RAND_query_egd_bytes(path, buf, 255);
        if (num < 1) goto err;
        RAND_seed(buf, num);
        if (RAND_status() == 1)
                ret = num;
  err:
-       if (fd != -1) close(fd);
        return(ret);
        }
 

diff --git a/crypto/rand/rand_unix.c b/crypto/rand/rand_unix.c
index 658d35f81ce428be38d6077123480ee6ceabc4f1..b68e2bab91aee651173ee7ec1184b5d84f0b7c00 100644 (file)
--- a/crypto/rand/rand_unix.c
+++ b/crypto/rand/rand_unix.c
@@ -125,13 +125,19 @@ int RAND_poll(void)
 {
        unsigned long l;
        pid_t curr_pid = getpid();
-#ifdef DEVRANDOM
+#if defined(DEVRANDOM) || defined(DEVRANDOM_EGD)
        unsigned char tmpbuf[ENTROPY_NEEDED];
        int n = 0;
+#endif
+#ifdef DEVRANDOM
        static const char *randomfiles[] = { DEVRANDOM, NULL };
        const char **randomfile = NULL;
        int fd;
 #endif
+#ifdef DEVRANDOM_EGD
+       static const char *egdsockets[] = { DEVRANDOM_EGD, NULL };
+       const char **egdsocket = NULL;
+#endif
 
 #ifdef DEVRANDOM
        /* Use a random entropy pool device. Linux, FreeBSD and OpenBSD
@@ -185,6 +191,24 @@ int RAND_poll(void)
                        close(fd);
                        }
                }
+#endif
+
+#ifdef DEVRANDOM_EGD
+       /* Use an EGD socket to read entropy from an EGD or PRNGD entropy
+        * collecting daemon. */
+
+       for (egdsocket = egdsockets; *egdsocket && n < ENTROPY_NEEDED; egdsocket++)
+               {
+               int r;
+
+               r = RAND_query_egd_bytes(*egdsocket, (unsigned char *)tmpbuf+n,
+                                        ENTROPY_NEEDED-n);
+               if (r > 0)
+                       n += r;
+               }
+#endif
+
+#if defined(DEVRANDOM) || defined(DEVRANDOM_EGD)
        if (n > 0)
                {
                RAND_add(tmpbuf,sizeof tmpbuf,n);
@@ -201,7 +225,7 @@ int RAND_poll(void)
        l=time(NULL);
        RAND_add(&l,sizeof(l),0);
 
-#ifdef DEVRANDOM
+#if defined(DEVRANDOM) || defined(DEVRANDOM_EGD)
        return 1;
 #endif
        return 0;

diff --git a/e_os.h b/e_os.h
index d658191987d33901a193e5bda94dfcfd6c31caf2..e23e254454bb4c6bd1440e79b2c3beb095b3d4b9 100644 (file)
--- a/e_os.h
+++ b/e_os.h
@@ -81,6 +81,12 @@ extern "C" {
  * My default, we will try to read at least one of these files */
 #define DEVRANDOM "/dev/urandom","/dev/random","/dev/srandom"
 #endif
+#ifndef DEVRANDOM_EGD
+/* set this to a comma-seperated list of 'egd' sockets to try out. These
+ * sockets will be tried in the order listed in case accessing the device files
+ * listed in DEVRANDOM did not return enough entropy. */
+#define DEVRANDOM_EGD "/etc/entropy","/var/run/egd-pool"
+#endif
 
 #if defined(__MWERKS__) && defined(macintosh)
 # if macintosh==1