From 214bee3ec4c25be010a0b94091da61de005c604c Mon Sep 17 00:00:00 2001 From: Yann Ylavic Date: Mon, 11 Jun 2018 22:06:09 +0000 Subject: Cryptographic Pseudo Random Number Generator (CPRNG). New apr_crypto_prng API and apr_crypto[_thread]_random_bytes() functions. Allows to generate cryptographically secure random bytes indefinitely given an initial seed of APR_CRYPTO_PRNG_SEED_SIZE bytes (32), which is either provided by the caller or automatically gathered from the system. The CPRNG can also be re-seeded at any time, or after a process is fork()ed. The internal key is renewed every APR_CRYPTO_PRNG_SEED_SIZE random bytes produced and those data once returned to the caller are cleared from the internal state, which ensures forward secrecy. This CPRNG is fast, based on a stream cipher, and will never block besides the initial seed or any reseed if it depends on the system entropy. Finally, it can be used either globally (locked in multithread environment), per-thread (a lock free instance is automatically created for each thread on first use), or created as standalone instance (manageable independently). For now it's only implemented with the OpenSSL library as underlying crypto, that is --with-crypto --with-openssl needs to be configured, and the latter links libcrypto with APR. git-svn-id: https://svn.apache.org/repos/asf/apr/apr/trunk@1833359 13f79535-47bb-0310-9956-ffa450edef68 --- threadproc/unix/proc.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'threadproc') diff --git a/threadproc/unix/proc.c b/threadproc/unix/proc.c index 004772ff8..de9720045 100644 --- a/threadproc/unix/proc.c +++ b/threadproc/unix/proc.c @@ -19,6 +19,7 @@ #include "apr_portable.h" #include "apr_signal.h" #include "apr_random.h" +#include "apr_crypto.h" /* Heavy on no'ops, here's what we want to pass if there is APR_NO_FILE * requested for a specific child handle; @@ -229,6 +230,9 @@ APR_DECLARE(apr_status_t) apr_proc_fork(apr_proc_t *proc, apr_pool_t *pool) proc->pid = getpid(); apr_random_after_fork(proc); +#if APU_HAVE_CRYPTO_PRNG + apr_crypto_prng_after_fork(); +#endif return APR_INCHILD; } -- cgit v1.2.1