From 7d4e4745a7dbe29f6c737ee62a36771ede20d09e Mon Sep 17 00:00:00 2001 From: Greg Hartman Date: Mon, 16 Nov 2015 10:13:36 -0800 Subject: [PATCH] makes certain libcrypto implementations cache a /dev/urandom fd in preparation of sandboxing. Upstream patch is: https://anongit.mindrot.org/openssh.git/patch/?id=07889c75926c040b8e095949c724e66af26441cb BUG=25695426 Change-Id: I0f746c30e31e7d938c70bcebe402f472c4649919 --- sshd.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sshd.c b/sshd.c index 30f8c6f..54ea6c0 100644 --- a/sshd.c +++ b/sshd.c @@ -623,6 +623,8 @@ privsep_preauth_child(void) arc4random_buf(rnd, sizeof(rnd)); #ifdef WITH_OPENSSL RAND_seed(rnd, sizeof(rnd)); + if ((RAND_bytes((u_char *)rnd, 1)) != 1) + fatal("%s: RAND_bytes failed", __func__); #endif explicit_bzero(rnd, sizeof(rnd)); @@ -766,6 +768,8 @@ privsep_postauth(Authctxt *authctxt) arc4random_buf(rnd, sizeof(rnd)); #ifdef WITH_OPENSSL RAND_seed(rnd, sizeof(rnd)); + if ((RAND_bytes((u_char *)rnd, 1)) != 1) + fatal("%s: RAND_bytes failed", __func__); #endif explicit_bzero(rnd, sizeof(rnd)); @@ -1430,6 +1434,8 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s) arc4random_buf(rnd, sizeof(rnd)); #ifdef WITH_OPENSSL RAND_seed(rnd, sizeof(rnd)); + if ((RAND_bytes((u_char *)rnd, 1)) != 1) + fatal("%s: RAND_bytes failed", __func__); #endif explicit_bzero(rnd, sizeof(rnd)); } -- 2.11.0