mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-12 01:56:58 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: init: Initialize random seed earlier in the init process

Browse Source 
The random seed used in ha_random functions needs to be first
initialized by calling ha_random_boot. This function was called rather
late in the init process, after the init functions (INITCALLS) are
called and after the configuration parsing for instance which means that
any ha_random call in an init function would return 0. This was the case
in 'vars_init' and 'cache_init' which tried to build seeds for specific
hash calculations but ended up not being seeded.

This patch can be backported on all stable branches.
This commit is contained in:
Remi Tricot-Le Breton 2025-08-11 15:55:35 +02:00 committed by Willy Tarreau
parent 84589a9f48
commit 15ee49e822
1 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
src/haproxy.c
View File

@ -2215,19 +2215,6 @@ static void step_init_2(int argc, char** argv)
if (global.mode & MODE_DUMP_CFG) if (global.mode & MODE_DUMP_CFG)
deinit_and_exit(0); deinit_and_exit(0);
#ifdef USE_OPENSSL
/* Initialize SSL random generator. Must be called before chroot for
* access to /dev/urandom, and before ha_random_boot() which may use
* RAND_bytes().
*/
if (!ssl_initialize_random()) {
ha_alert("OpenSSL random data generator initialization failed.\n");
exit(EXIT_FAILURE);
}
#endif
ha_random_boot(argv); // the argv pointer brings some kernel-fed entropy
/* now we know the buffer size, we can initialize the channels and buffers */ /* now we know the buffer size, we can initialize the channels and buffers */
init_buffer(); init_buffer();
@ -3154,6 +3141,19 @@ int main(int argc, char **argv)
rlim_fd_cur_at_boot = limit.rlim_cur; rlim_fd_cur_at_boot = limit.rlim_cur;
rlim_fd_max_at_boot = limit.rlim_max; rlim_fd_max_at_boot = limit.rlim_max;
#ifdef USE_OPENSSL
/* Initialize SSL random generator. Must be called before chroot for
* access to /dev/urandom, and before ha_random_boot() which may use
* RAND_bytes().
*/
if (!ssl_initialize_random()) {
ha_alert("OpenSSL random data generator initialization failed.\n");
exit(EXIT_FAILURE);
}
#endif
ha_random_boot(argv); // the argv pointer brings some kernel-fed entropy
/* process all initcalls in order of potential dependency */ /* process all initcalls in order of potential dependency */
RUN_INITCALLS(STG_PREPARE); RUN_INITCALLS(STG_PREPARE);
RUN_INITCALLS(STG_LOCK); RUN_INITCALLS(STG_LOCK);