- Fix Bad Randomness in Seed, reported by X41 D-Sec.

diff --git a/daemon/daemon.c b/daemon/daemon.c
index a407800b551c6712c93d5073da3aac192686201e..0b1200a2e00acd2dd1d9fcb6f85397ee2497a013 100644 (file)
--- a/daemon/daemon.c
+++ b/daemon/daemon.c
@@ -250,8 +250,6 @@ daemon_init(void)
        /* init timezone info while we are not chrooted yet */
        tzset();
 #endif
-       /* open /dev/urandom if needed */
-       ub_systemseed((unsigned)time(NULL)^(unsigned)getpid()^0xe67);
        daemon->need_to_exit = 0;
        modstack_init(&daemon->mods);
        if(!(daemon->env = (struct module_env*)calloc(1, 

diff --git a/doc/Changelog b/doc/Changelog
index 75fb6a4cad92b3a1c48348a7db7ea0066f02e3a0..a9287055321ba3fc31d5070635405c2c607a54f8 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -37,6 +37,7 @@
        - Fix Enum Name not Used, reported by X41 D-Sec.
        - Fix NULL Pointer Dereference via Control Port,
          reported by X41 D-Sec.
+       - Fix Bad Randomness in Seed, reported by X41 D-Sec.
 
 19 November 2019: Wouter
        - Fix CVE-2019-18934, shell execution in ipsecmod.

diff --git a/util/random.c b/util/random.c
index bda6d5a6891694262bdcc640083f2d26de8d8f5f..bb564f2f99aad6cba1b6b4bd349b0150d3d078b9 100644 (file)
--- a/util/random.c
+++ b/util/random.c
@@ -79,12 +79,6 @@
 #define MAX_VALUE 0x7fffffff
 
 #if defined(HAVE_SSL)
-void
-ub_systemseed(unsigned int ATTR_UNUSED(seed))
-{
-       /* arc4random_uniform does not need seeds, it gets kernel entropy */
-}
-
 struct ub_randstate* 
 ub_initstate(struct ub_randstate* ATTR_UNUSED(from))
 {
@@ -118,10 +112,6 @@ struct ub_randstate {
        int ready;
 };
 
-void ub_systemseed(unsigned int ATTR_UNUSED(seed))
-{
-}
-
 struct ub_randstate* ub_initstate(struct ub_randstate* ATTR_UNUSED(from))
 {
        struct ub_randstate* s = (struct ub_randstate*)calloc(1, sizeof(*s));
@@ -157,15 +147,6 @@ struct ub_randstate {
        int seeded;
 };
 
-void ub_systemseed(unsigned int ATTR_UNUSED(seed))
-{
-/**
- * We seed on init and not here, as we need the ctx to re-seed.
- * This also means that re-seeding is not supported.
- */
-       log_err("Re-seeding not supported, generator untouched");
-}
-
 struct ub_randstate* ub_initstate(struct ub_randstate* ATTR_UNUSED(from))
 {
        struct ub_randstate* s = (struct ub_randstate*)calloc(1, sizeof(*s));

diff --git a/util/random.h b/util/random.h
index e75157d38a15c4c892e997453b1089d4444a8b83..b257793a4449f4d2903b39af9f5782f82ab2e396 100644 (file)
--- a/util/random.h
+++ b/util/random.h
@@ -47,14 +47,6 @@
  */
 struct ub_randstate;
 
-/**
- * Initialize the system randomness.  Obtains entropy from the system
- * before a chroot or privilege makes it unavailable. 
- * You do not have to call this, otherwise ub_initstate does so.
- * @param seed: seed value to create state (if no good entropy is found).
- */
-void ub_systemseed(unsigned int seed);
-
 /**
  * Initialize a random generator state for use 
  * @param from: if not NULL, the seed is taken from this random structure.