prosody
3a1b1d3084fb
util/random.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

util/random.lua @ 10721:3a1b1d3084fb 0.11

core.certmanager: Move EECDH ciphers before EDH in default cipherstring (fixes #1513) Backport of 94e341dee51c The original intent of having kEDH before kEECDH was that if a `dhparam` file was specified, this would be interpreted as a preference by the admin for old and well-tested Diffie-Hellman key agreement over newer elliptic curve ones. Otherwise the faster elliptic curve ciphersuites would be preferred. This didn't really work as intended since this affects the ClientHello on outgoing s2s connections, leading to some servers using poorly configured kEDH. With Debian shipping OpenSSL settings that enforce a higher security level, this caused interoperability problems with servers that use DH params smaller than 2048 bits. E.g. jabber.org at the time of this writing has 1024 bit DH params. MattJ says > Curves have won, and OpenSSL is less weird about them now
author Kim Alvefur <zash@zash.se>
date Sun, 25 Aug 2019 20:22:35 +0200
parent 10016:af8c514e5cf7
child 12446:e54b8a5e35ad
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
6376
bd812a7713ad util.random: Generic util lib for generating strings of random bytes
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1 -- Prosody IM
bd812a7713ad util.random: Generic util lib for generating strings of random bytes
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
2 -- Copyright (C) 2008-2014 Matthew Wild
bd812a7713ad util.random: Generic util lib for generating strings of random bytes
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
3 -- Copyright (C) 2008-2014 Waqas Hussain
bd812a7713ad util.random: Generic util lib for generating strings of random bytes
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
4 --
bd812a7713ad util.random: Generic util lib for generating strings of random bytes
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5 -- This project is MIT/X11 licensed. Please see the
bd812a7713ad util.random: Generic util lib for generating strings of random bytes
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
6 -- COPYING file in the source package for more information.
bd812a7713ad util.random: Generic util lib for generating strings of random bytes
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
7 --
bd812a7713ad util.random: Generic util lib for generating strings of random bytes
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
8
7187
3d2c2f0809ee util.crand: C binding to one of OpenSSL, Linux getrandom() or OpenBSD arc4random() CSPRNG
Kim Alvefur <zash@zash.se>
parents: 7114
diff changeset
9 local ok, crand = pcall(require, "util.crand");
3d2c2f0809ee util.crand: C binding to one of OpenSSL, Linux getrandom() or OpenBSD arc4random() CSPRNG
Kim Alvefur <zash@zash.se>
parents: 7114
diff changeset
10 if ok then return crand; end
3d2c2f0809ee util.crand: C binding to one of OpenSSL, Linux getrandom() or OpenBSD arc4random() CSPRNG
Kim Alvefur <zash@zash.se>
parents: 7114
diff changeset
11
7114
51cf09bb74eb util.random: Restore friendlier error from 0.9/util.uuid
Kim Alvefur <zash@zash.se>
parents: 7083
diff changeset
12 local urandom, urandom_err = io.open("/dev/urandom", "r");
6376
bd812a7713ad util.random: Generic util lib for generating strings of random bytes
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
13
bd812a7713ad util.random: Generic util lib for generating strings of random bytes
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
14 local function bytes(n)
10014
5d2f7144fa12 util.random: Handle unlikely read errors from /dev/urandom (see #1313)
Kim Alvefur <zash@zash.se>
parents: 8243
diff changeset
15 local data, err = urandom:read(n);
5d2f7144fa12 util.random: Handle unlikely read errors from /dev/urandom (see #1313)
Kim Alvefur <zash@zash.se>
parents: 8243
diff changeset
16 if not data then
10016
af8c514e5cf7 util.random: Throw different error for EOL condition
Kim Alvefur <zash@zash.se>
parents: 10015
diff changeset
17 if err then
af8c514e5cf7 util.random: Throw different error for EOL condition
Kim Alvefur <zash@zash.se>
parents: 10015
diff changeset
18 error("Unable to retrieve data from secure random number generator (/dev/urandom): "..tostring(err));
af8c514e5cf7 util.random: Throw different error for EOL condition
Kim Alvefur <zash@zash.se>
parents: 10015
diff changeset
19 else
af8c514e5cf7 util.random: Throw different error for EOL condition
Kim Alvefur <zash@zash.se>
parents: 10015
diff changeset
20 error("Secure random number generator (/dev/urandom) returned an end-of-file condition");
af8c514e5cf7 util.random: Throw different error for EOL condition
Kim Alvefur <zash@zash.se>
parents: 10015
diff changeset
21 end
10014
5d2f7144fa12 util.random: Handle unlikely read errors from /dev/urandom (see #1313)
Kim Alvefur <zash@zash.se>
parents: 8243
diff changeset
22 end
5d2f7144fa12 util.random: Handle unlikely read errors from /dev/urandom (see #1313)
Kim Alvefur <zash@zash.se>
parents: 8243
diff changeset
23 return data;
6376
bd812a7713ad util.random: Generic util lib for generating strings of random bytes
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
24 end
bd812a7713ad util.random: Generic util lib for generating strings of random bytes
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
25
7114
51cf09bb74eb util.random: Restore friendlier error from 0.9/util.uuid
Kim Alvefur <zash@zash.se>
parents: 7083
diff changeset
26 if not urandom then
51cf09bb74eb util.random: Restore friendlier error from 0.9/util.uuid
Kim Alvefur <zash@zash.se>
parents: 7083
diff changeset
27 function bytes()
51cf09bb74eb util.random: Restore friendlier error from 0.9/util.uuid
Kim Alvefur <zash@zash.se>
parents: 7083
diff changeset
28 error("Unable to obtain a secure random number generator, please see https://prosody.im/doc/random ("..urandom_err..")");
51cf09bb74eb util.random: Restore friendlier error from 0.9/util.uuid
Kim Alvefur <zash@zash.se>
parents: 7083
diff changeset
29 end
51cf09bb74eb util.random: Restore friendlier error from 0.9/util.uuid
Kim Alvefur <zash@zash.se>
parents: 7083
diff changeset
30 end
51cf09bb74eb util.random: Restore friendlier error from 0.9/util.uuid
Kim Alvefur <zash@zash.se>
parents: 7083
diff changeset
31
6376
bd812a7713ad util.random: Generic util lib for generating strings of random bytes
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
32 return {
bd812a7713ad util.random: Generic util lib for generating strings of random bytes
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
33 bytes = bytes;
8242
177873dc9cf3 util.random: Add a _source field to match util.crand
Kim Alvefur <zash@zash.se>
parents: 7187
diff changeset
34 _source = "/dev/urandom";
6376
bd812a7713ad util.random: Generic util lib for generating strings of random bytes
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
35 };