diff --git a/include/libssh/wrapper.h b/include/libssh/wrapper.h index 7374a88a..e8ff32c1 100644 --- a/include/libssh/wrapper.h +++ b/include/libssh/wrapper.h @@ -70,5 +70,6 @@ int crypt_set_algorithms_server(ssh_session session); struct ssh_crypto_struct *crypto_new(void); void crypto_free(struct ssh_crypto_struct *crypto); +void ssh_reseed(void); #endif /* WRAPPER_H_ */ diff --git a/src/bind.c b/src/bind.c index 8d82d0d4..03d34031 100644 --- a/src/bind.c +++ b/src/bind.c @@ -458,6 +458,8 @@ int ssh_bind_accept_fd(ssh_bind sshbind, ssh_session session, socket_t fd){ return SSH_ERROR; } } + /* force PRNG to change state in case we fork after ssh_bind_accept */ + ssh_reseed(); return SSH_OK; } diff --git a/src/libcrypto.c b/src/libcrypto.c index bb1d96ad..d8cc795c 100644 --- a/src/libcrypto.c +++ b/src/libcrypto.c @@ -23,6 +23,7 @@ #include #include #include +#include #include "libssh/priv.h" #include "libssh/session.h" @@ -38,6 +39,8 @@ #include #include #include +#include + #ifdef HAVE_OPENSSL_AES_H #define HAS_AES #include @@ -74,6 +77,12 @@ static int alloc_key(struct ssh_cipher_struct *cipher) { return 0; } +void ssh_reseed(void){ + struct timeval tv; + gettimeofday(&tv, NULL); + RAND_add(&tv, sizeof(tv), 0.0); +} + SHACTX sha1_init(void) { SHACTX c = malloc(sizeof(*c)); if (c == NULL) { diff --git a/src/libgcrypt.c b/src/libgcrypt.c index 899bccdf..46179016 100644 --- a/src/libgcrypt.c +++ b/src/libgcrypt.c @@ -45,6 +45,9 @@ static int alloc_key(struct ssh_cipher_struct *cipher) { return 0; } +void ssh_reseed(void){ + } + SHACTX sha1_init(void) { SHACTX ctx = NULL; gcry_md_open(&ctx, GCRY_MD_SHA1, 0);