lib-ssl-iostream: Seed OpenSSL RNG earlier

Make sure we give the RNG a chance to
seed before we chroot.

diff --git a/src/lib-ssl-iostream/dovecot-openssl-common.c b/src/lib-ssl-iostream/dovecot-openssl-common.c
index e53a2d77b86cd6eed56d463226b3453bf5eeec7f..ac1d90af6d3ff49ea7f379f5a9ca9dc5964f41ff 100644 (file)
--- a/src/lib-ssl-iostream/dovecot-openssl-common.c
+++ b/src/lib-ssl-iostream/dovecot-openssl-common.c
@@ -1,6 +1,7 @@
 /* Copyright (c) 2016-2017 Dovecot authors, see the included COPYING file */
 
 #include "lib.h"
+#include "randgen.h"
 #include "dovecot-openssl-common.h"
 
 #include <openssl/ssl.h>
@@ -51,8 +52,6 @@ static void dovecot_openssl_free(void *ptr)
 
 void dovecot_openssl_common_global_ref(void)
 {
-       unsigned char buf;
-
        if (openssl_init_refcount++ > 0)
                return;
 
@@ -67,12 +66,6 @@ void dovecot_openssl_common_global_ref(void)
        SSL_library_init();
        SSL_load_error_strings();
        OpenSSL_add_all_algorithms();
-
-       /* PRNG initialization might want to use /dev/urandom, make sure it
-          does it before chrooting. We might not have enough entropy at
-          the first try, so this function may fail. It's still been
-          initialized though. */
-       (void)RAND_bytes(&buf, 1);
 }
 
 bool dovecot_openssl_common_global_unref(void)

diff --git a/src/lib-ssl-iostream/iostream-openssl.c b/src/lib-ssl-iostream/iostream-openssl.c
index 958cd731676957afab096534ba67f2a43001a1f4..e6f5480ec736ff01a41da10736a9e7f21a14d4f7 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl.c
+++ b/src/lib-ssl-iostream/iostream-openssl.c
@@ -5,6 +5,7 @@
 #include "ostream-private.h"
 #include "iostream-openssl.h"
 
+#include <openssl/rand.h>
 #include <openssl/err.h>
 
 static void openssl_iostream_free(struct ssl_iostream *ssl_io);
@@ -777,6 +778,9 @@ static const struct iostream_ssl_vfuncs ssl_vfuncs = {
 
 void ssl_iostream_openssl_init(void)
 {
+       unsigned char buf;
+       if (RAND_bytes(&buf, 1) < 1)
+               i_fatal("OpenSSL RNG failed to initialize");
        iostream_ssl_module_init(&ssl_vfuncs);
 }