Subject: RAND function using OpenSSL 0.9.7 (A Solution)

From: "Frederic DONNAT" <[email-masked]>
Date: Mon, 15 Jul 2002 20:54:58 +0200

Hi All,

I change a function call and it works fine now. I do not know if this is the real way to solve my problem but this provide a solution.

In file pkg.modssl/ssl_engine_int.c:
move "ssl_init_Engine(s, p);" function call before "ssl_init_SSLLibrary();" function call instead of after.
 
In fact if you want to use ENGINE default functionnalities you muste set ENGINE before everything.

Regards
Fred

---

From: Geoff Thorpe <[email-masked]>
Date: Mon, 15 Jul 2002 16:10:36 -0400 (EDT)

Hi Fred,

I was just starting to wonder what might be behind all this when you hit
the nail on the head.

On Mon, 15 Jul 2002, Frederic DONNAT wrote:

> I change a function call and it works fine now. I do not know if this is
> the real way to solve my problem but this provide a solution.
>
> move "ssl_init_Engine(s, p);" function call before
> "ssl_init_SSLLibrary();" function call instead of after.
>

That is not *a* solution, it is *the* solution. ssl_init_SSLLibrary() must
be seeding the PRNG, and thus initialising the set-on-first-use pointer in
openssl to a default RAND_METHOD. Do you want to post a patch to the list?
I suggest "diff -u", I suggest a subject starting with "[PATCH]", and I
suggest you CC Ralf. Otherwise, things have a way of slipping through the
net. (Resists temptation to harp on about the simple but important session
caching bug, read "potential security problem", that Ralf still hasn't
incorporated despite me repeatedly harping on about it ...)

Cheers,
Geoff

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Cliff Woolley <[email-masked]>
Date: Mon, 15 Jul 2002 16:22:12 -0400 (EDT)

> openssl to a default RAND_METHOD. Do you want to post a patch to the list?

Well, I can't do anything about 1.3's mod_ssl, but if somebody can verify
for me that the following fixes Apache 2.0's mod_ssl, I'll commit it.

--Cliff

Index: ssl_engine_init.c
===================================================================
RCS file: /home/cvs/httpd-2.0/modules/ssl/ssl_engine_init.c,v
retrieving revision 1.102
diff -u -d -r1.102 ssl_engine_init.c
--- ssl_engine_init.c   8 Jul 2002 17:43:33 -0000       1.102
+++ ssl_engine_init.c   15 Jul 2002 20:22:13 -0000
@@ -266,6 +266,11 @@

     }

+#ifdef SSL_EXPERIMENTAL_ENGINE
+    /* SSL external crypto device ("engine") support */
+    ssl_init_Engine(base_server, p);
+#endif
+
     ssl_init_SSLLibrary(base_server);

 #if APR_HAS_THREADS
@@ -290,13 +295,6 @@
     if (ssl_tmp_keys_init(base_server)) {
         return !OK;
     }
-
-    /*
-     * SSL external crypto device ("engine") support
-     */
-#ifdef SSL_EXPERIMENTAL_ENGINE
-    ssl_init_Engine(base_server, p);
-#endif

     /*
      * initialize the mutex handling

---

From: "Bill Angus" <[email-masked]>
Date: Mon, 15 Jul 2002 14:11:19 -0700

Strange behavior: The error I recently reported on compiling under WIN2000
with MSVC++ diappeared on re-trying the same compile. First time through an
error was reported and compilation stopped. But the same batch file ran and
completed when tried a second time. This time with no errors.