Cryptographic Pseudo Random Number Generator (CPRNG).

New apr_crypto_prng API and apr_crypto[_thread]_random_bytes() functions.

Allows to generate cryptographically secure random bytes indefinitely
given an initial seed of APR_CRYPTO_PRNG_SEED_SIZE bytes (32), which
is either provided by the caller or automatically gathered from the system.
The CPRNG can also be re-seeded at any time, or after a process is fork()ed.

The internal key is renewed every APR_CRYPTO_PRNG_SEED_SIZE random
bytes produced and those data once returned to the caller are cleared from
the internal state, which ensures forward secrecy.

This CPRNG is fast, based on a stream cipher, and will never block besides
the initial seed or any reseed if it depends on the system entropy.

Finally, it can be used either globally (locked in multithread environment),
per-thread (a lock free instance is automatically created for each thread on
first use), or created as standalone instance (manageable independently).


For now it's only implemented with the OpenSSL library as underlying crypto,
that is --with-crypto --with-openssl needs to be configured, and the latter
links libcrypto with APR.



git-svn-id: http://svn.apache.org/repos/asf/apr/apr/trunk@1833359 13f79535-47bb-0310-9956-ffa450edef68

1 files changed, 4 insertions, 0 deletions

diff --git a/threadproc/unix/proc.c b/threadproc/unix/proc.c
index 004772ff8..de9720045 100644
--- a/threadproc/unix/proc.c
+++ b/threadproc/unix/proc.c
@@ -19,6 +19,7 @@
 #include "apr_portable.h"
 #include "apr_signal.h"
 #include "apr_random.h"
+#include "apr_crypto.h"
 
 /* Heavy on no'ops, here's what we want to pass if there is APR_NO_FILE
  * requested for a specific child handle;
@@ -229,6 +230,9 @@ APR_DECLARE(apr_status_t) apr_proc_fork(apr_proc_t *proc, apr_pool_t *pool)
         proc->pid = getpid();
 
         apr_random_after_fork(proc);
+#if APU_HAVE_CRYPTO_PRNG
+        apr_crypto_prng_after_fork();
+#endif
 
         return APR_INCHILD;
     }