diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2013-06-24 22:24:35 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2013-06-25 09:55:49 +0200 |
| commit | 365c5ba39591fab2e60bf4f0e67d9dcf79ecc506 (patch) | |
| tree | 6e02f6904f12fcd94b1036643bc5064c809e807b /lib/sslgen.h | |
| parent | cb1aa8b0e32068ec4bbbc42d41267420b46a36e7 (diff) | |
formpost: better random boundaries
When doing multi-part formposts, libcurl used a pseudo-random value that
was seeded with time(). This turns out to be bad for users who formpost
data that is provided with users who then can guess how the boundary
string will look like and then they can forge a different formpost part
and trick the receiver.
My advice to such implementors is (still even after this change) to not
rely on the boundary strings being cryptographically strong. Fix your
code and logic to not depend on them that much!
I moved the Curl_rand() function into the sslgen.c source file now to be
able to take advantage of the SSL library's random function if it
provides one. If not, try to use the RANDOM_FILE for seeding and as a
last resort keep the old logic, just modified to also add microseconds
which makes it harder to properly guess the exact seed.
The formboundary() function in formdata.c is now using 64 bit entropy
for the boundary and therefore the string of dashes was reduced by 4
letters and there are 16 hex digits following it. The total length is
thus still the same.
Bug: http://curl.haxx.se/bug/view.cgi?id=1251
Reported-by: "Floris"
Diffstat (limited to 'lib/sslgen.h')
| -rw-r--r-- | lib/sslgen.h | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/lib/sslgen.h b/lib/sslgen.h index 17ad8e343..182dd8f24 100644 --- a/lib/sslgen.h +++ b/lib/sslgen.h @@ -33,6 +33,8 @@ bool Curl_clone_ssl_config(struct ssl_config_data* source, struct ssl_config_data* dest); void Curl_free_ssl_config(struct ssl_config_data* sslc); +unsigned int Curl_rand(struct SessionHandle *); + #ifdef USE_SSL int Curl_ssl_init(void); void Curl_ssl_cleanup(void); @@ -83,6 +85,13 @@ void Curl_ssl_md5sum(unsigned char *tmp, /* input */ #define SSL_SHUTDOWN_TIMEOUT 10000 /* ms */ +#ifdef have_curlssl_random +#define HAVE_CURL_SSL_RANDOM +#endif +#ifdef have_curlssl_md5sum +#define HAVE_CURL_SSL_MD5SUM +#endif + #else /* When SSL support is not present, just define away these function calls */ #define Curl_ssl_init() 1 |