mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 06:25:31 +00:00
Code Issues Releases Wiki Activity

[master] completed and corrected the crypto-random change

Browse Source 
4724.	[func]		By default, BIND now uses the random number
			functions provided by the crypto library (i.e.,
			OpenSSL or a PKCS#11 provider) as a source of
			randomness rather than /dev/random.  This is
			suitable for virtual machine environments
			which have limited entropy pools and lack
			hardware random number generators.

			This can be overridden by specifying another
			entropy source via the "random-device" option
			in named.conf, or via the -r command line option;
			however, for functions requiring full cryptographic
			strength, such as DNSSEC key generation, this
			cannot be overridden. In particular, the -r
			command line option no longer has any effect on
			dnssec-keygen.

			This can be disabled by building with
			"configure --disable-crypto-rand".
			[RT #31459] [RT #46047]
This commit is contained in:
Evan Hunt
2017-09-28 10:09:22 -07:00
parent 86e5d14e82
commit 24172bd2ee
24 changed files with 242 additions and 131 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/ns/client.c
View File

@@ -1638,7 +1638,9 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
isc_buffer_init(&buf, cookie, sizeof(cookie));
isc_stdtime_get(&now);
isc_random_get(&nonce);
nonce = ((isc_rng_random(client->sctx->rngctx) << 16) |
isc_rng_random(client->sctx->rngctx));
compute_cookie(client, now, nonce, client->sctx->secret, &buf);