- (dtucker) [ssh-rand-helper.c] Fall back to command-based seeding if reading

   from prngd is enabled at compile time but fails at run time, eg because
   prngd is not running.  Note that if you have prngd running when OpenSSH is
   built, OpenSSL will consider itself internally seeded and rand-helper won't
   be built at all unless explicitly enabled via --with-rand-helper.  ok djm@

diff --git a/ChangeLog b/ChangeLog
index f852c76e489571a2d13ea0c549c5b2a5ca1d36c7..1eb48df35d4dc678b52d688520ab0a72a0babdee 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+20041220
+ - (dtucker) [ssh-rand-helper.c] Fall back to command-based seeding if reading
+   from prngd is enabled at compile time but fails at run time, eg because
+   prngd is not running.  Note that if you have prngd running when OpenSSH is
+   built, OpenSSL will consider itself internally seeded and rand-helper won't
+   be built at all unless explicitly enabled via --with-rand-helper.  ok djm@
+
 20041213
  - (dtucker) [contrib/findssh.sh] Clean up on interrupt; from
    amarendra.godbole at ge com.

diff --git a/ssh-rand-helper.c b/ssh-rand-helper.c
index 46c9f8d6265ef3aafe0821048758dc00ce8e01bc..0f70f6b21e27da89b464ece6287da3a2293bec48 100644 (file)
--- a/ssh-rand-helper.c
+++ b/ssh-rand-helper.c
@@ -209,6 +209,22 @@ done:
        return rval;
 }
 
+static int
+seed_from_prngd(unsigned char *buf, size_t bytes)
+{
+#ifdef PRNGD_PORT
+       debug("trying egd/prngd port %d", PRNGD_PORT);
+       if (get_random_bytes_prngd(buf, bytes, PRNGD_PORT, NULL) == 0)
+               return 0;
+#endif
+#ifdef PRNGD_SOCKET
+       debug("trying egd/prngd socket %s", PRNGD_SOCKET);
+       if (get_random_bytes_prngd(buf, bytes, 0, PRNGD_SOCKET) == 0)
+               return 0;
+#endif
+       return -1;
+}
+
 double
 stir_gettimeofday(double entropy_estimate)
 {
@@ -815,21 +831,16 @@ main(int argc, char **argv)
        debug("Seeded RNG with %i bytes from system calls",
            (int)stir_from_system());
 
-#ifdef PRNGD_PORT
-       if (get_random_bytes_prngd(buf, bytes, PRNGD_PORT, NULL) == -1)
-               fatal("Entropy collection failed");
-       RAND_add(buf, bytes, bytes);
-#elif defined(PRNGD_SOCKET)
-       if (get_random_bytes_prngd(buf, bytes, 0, PRNGD_SOCKET) == -1)
-               fatal("Entropy collection failed");
-       RAND_add(buf, bytes, bytes);
-#else
-       /* Read in collection commands */
-       if (prng_read_commands(SSH_PRNG_COMMAND_FILE) == -1)
-               fatal("PRNG initialisation failed -- exiting.");
-       debug("Seeded RNG with %i bytes from programs",
-           (int)stir_from_programs());
-#endif
+       /* try prngd, fall back to commands if prngd fails or not configured */
+       if (seed_from_prngd(buf, bytes) == 0) {
+               RAND_add(buf, bytes, bytes);
+       } else {
+               /* Read in collection commands */
+               if (prng_read_commands(SSH_PRNG_COMMAND_FILE) == -1)
+                       fatal("PRNG initialisation failed -- exiting.");
+               debug("Seeded RNG with %i bytes from programs",
+                   (int)stir_from_programs());
+       }
 
 #ifdef USE_SEED_FILES
        prng_write_seedfile();