[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v2 07/14] ui/vnc: Use qcrypto_random_bytes for m
From: |
Richard Henderson |
Subject: |
Re: [Qemu-devel] [PATCH v2 07/14] ui/vnc: Use qcrypto_random_bytes for make_challenge |
Date: |
Thu, 14 Mar 2019 15:27:22 -0700 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 |
On 3/14/19 2:43 PM, Philippe Mathieu-Daudé wrote:
> On 3/14/19 4:39 PM, Daniel P. Berrangé wrote:
>> On Wed, Mar 13, 2019 at 09:55:19PM -0700, Richard Henderson wrote:
>>> static void make_challenge(VncState *vs)
>>> {
>>> - int i;
>>> -
>>> - srand(time(NULL)+getpid()+getpid()*987654+rand());
>>> -
>>> - for (i = 0 ; i < sizeof(vs->challenge) ; i++)
>>> - vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
>>> + qcrypto_random_bytes(vs->challenge, sizeof(vs->challenge),
>>> &error_fatal);
>>> }
>>
>> Old code would not fail, but the new code can. So make_challenge needs
>> to return an error to the caller, which must then drop the client conn.
>
> Is the old code equivalent to using a NULL errp?
>
> qcrypto_random_bytes(vs->challenge, sizeof(vs->challenge), NULL);
No, since it doesn't initialize challenge to anything.
Daniel is right that I must do more to fail the session.
Will be done in v3.
r~
- Re: [Qemu-devel] [PATCH v2 04/14] crypto: Use O_CLOEXEC in qcrypto_random_init, (continued)
[Qemu-devel] [PATCH v2 05/14] crypto: Use getrandom for qcrypto_random_bytes, Richard Henderson, 2019/03/14
[Qemu-devel] [PATCH v2 10/14] linux-user: Call qcrypto_init if not using -seed, Richard Henderson, 2019/03/14
[Qemu-devel] [PATCH v2 09/14] util: Use qcrypto_random_bytes for qemu_getrandom, Richard Henderson, 2019/03/14
[Qemu-devel] [PATCH v2 07/14] ui/vnc: Use qcrypto_random_bytes for make_challenge, Richard Henderson, 2019/03/14
[Qemu-devel] [PATCH v2 08/14] util: Add qemu_getrandom and support functions, Richard Henderson, 2019/03/14
Re: [Qemu-devel] [PATCH v2 08/14] util: Add qemu_getrandom and support functions, Eric Blake, 2019/03/14
[Qemu-devel] [PATCH v2 12/14] linux-user/aarch64: Use qemu_getrandom for arm_init_pauth_key, Richard Henderson, 2019/03/14
[Qemu-devel] [PATCH v2 06/14] crypto: Change the qcrypto_random_bytes buffer type to void*, Richard Henderson, 2019/03/14