d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

decryptcore: preload OpenSSL error strings; seed PRNG

Browse Source 
As in r360226, preload OpenSSL error strings and seed the PRNG
before entering capability mode.

MFC after:	2 weeks
Sponsored by:	Dell EMC Isilon
This commit is contained in:
Eric van Gyzen 2020-12-11 14:32:42 +00:00
parent 580a173a05
commit 4617b1f62b
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
sbin/decryptcore/decryptcore.c
View File

@ -170,6 +170,19 @@ decrypt(int ofd, const char *privkeyfile, const char *keyfile,
goto failed;
}
/*
* Obsolescent OpenSSL only knows about /dev/random, and needs to
* pre-seed before entering cap mode. For whatever reason,
* RSA_pub_encrypt uses the internal PRNG.
*/
#if OPENSSL_VERSION_NUMBER < 0x10100000L
{
unsigned char c[1];
RAND_bytes(c, 1);
}
#endif
ERR_load_crypto_strings();
caph_cache_catpages();
if (caph_enter() < 0) {
pjdlog_errno(LOG_ERR, "Unable to enter capability mode");