Added various improvements to rand()/mt_rand() protection

4 files changed, 40 insertions, 5 deletions

diff --git a/Changelog b/Changelog
index fc55650..50759a8 100644
--- a/Changelog
+++ b/Changelog
@@ -3,6 +3,11 @@
     - Added better handling of non existing/non executable shell scripts
     - Added protection against XSS/SQL/Other Injections through User-Agent HTTP header
     - Fix variable logging statistics outputting on every include - ticket: #37
+    - Added more entropy from /dev/urandom to internal random seeding (64 bit => 256 bit)
+    - Added non initialized stack variables to random seeding
+    - Added php_win32_get_random_bytes for windows compatibility in random seeding
+    - Added suhosin.rand.seedingkey for INI supplied additional entropy string (idea DavisNT)
+    - Added suhosin.rand.reseed_every_request to allow reseeding on every request (idea DavisNT)
     - Added LICENSE file to make distributions happy
 
 2014-02-24 - 0.9.35
diff --git a/execute.c b/execute.c
index 220c0ff..103a8bf 100644
--- a/execute.c
+++ b/execute.c
@@ -38,6 +38,13 @@
 
 #include "sha256.h"
 
+#ifdef PHP_WIN32
+# include "win32/winutil.h"
+# include "win32/time.h"
+#else
+# include <sys/time.h>
+#endif
+
 #if PHP_VERSION_ID >= 50500
 static void (*old_execute_ex)(zend_execute_data *execute_data TSRMLS_DC);
 static void suhosin_execute_ex(zend_execute_data *execute_data TSRMLS_DC);
@@ -1325,8 +1332,9 @@ static php_uint32 suhosin_mt_rand(TSRMLS_D)
 
 /* {{{ suhosin_gen_entropy
  */
-static void suhosin_gen_entropy(php_uint32 *seedbuf TSRMLS_DC)
+static void suhosin_gen_entropy(php_uint32 *entropybuf TSRMLS_DC)
 {
+    php_uint32 seedbuf[20];
     /* On a modern OS code, stack and heap base are randomized */
     unsigned long code_value  = (unsigned long)suhosin_gen_entropy;
     unsigned long stack_value = (unsigned long)&code_value;
@@ -1353,14 +1361,21 @@ static void suhosin_gen_entropy(php_uint32 *seedbuf TSRMLS_DC)
     fd = VCWD_OPEN("/dev/urandom", O_RDONLY);
     if (fd >= 0) {
         /* ignore error case - if urandom doesn't give us any/enough random bytes */
-        read(fd, &seedbuf[6], 2 * sizeof(php_uint32));
+        read(fd, &seedbuf[6], 8 * sizeof(php_uint32));
         close(fd);
     }
+#else
+    /* we have to live with the possibility that this call fails */
+    php_win32_get_random_bytes(rbuf, 8 * sizeof(php_uint32));
 #endif
 
     suhosin_SHA256Init(&context);
-        suhosin_SHA256Update(&context, (void *) seedbuf, sizeof(php_uint32) * 8);
-        suhosin_SHA256Final((void *)seedbuf, &context);
+    /* to our friends from Debian: yes this will add unitialized stack values to the entropy DO NOT REMOVE */
+    suhosin_SHA256Update(&context, (void *) seedbuf, sizeof(seedbuf));
+    if (SUHOSIN_G(seedingkey) != NULL && *SUHOSIN_G(seedingkey) != 0) {
+        suhosin_SHA256Update(&context, (unsigned char*)SUHOSIN_G(seedingkey), strlen(SUHOSIN_G(seedingkey)));
+    }
+    suhosin_SHA256Final((void *)entropybuf, &context);
 }
 /* }}} */
 
diff --git a/php_suhosin.h b/php_suhosin.h
index 608e420..152fe43 100644
--- a/php_suhosin.h
+++ b/php_suhosin.h
@@ -239,6 +239,9 @@ ZEND_BEGIN_MODULE_GLOBALS(suhosin)
         php_uint32   *mt_next;
         int          mt_left;
 
+        char         *seedingkey;
+        zend_bool    reseed_every_request;
+
         zend_bool r_is_seeded; 
         zend_bool mt_is_seeded;
 
diff --git a/suhosin.c b/suhosin.c
index f0a94b9..0d1eba0 100644
--- a/suhosin.c
+++ b/suhosin.c
@@ -1015,10 +1015,11 @@ PHP_INI_BEGIN()
         ZEND_INI_ENTRY("suhosin.cookie.cryptlist",      NULL,           ZEND_INI_PERDIR|ZEND_INI_SYSTEM,        OnUpdate_cookie_cryptlist)
         ZEND_INI_ENTRY("suhosin.cookie.plainlist",      NULL,           ZEND_INI_PERDIR|ZEND_INI_SYSTEM,        OnUpdate_cookie_plainlist)
 
-
         STD_ZEND_INI_BOOLEAN("suhosin.server.encode", "1", ZEND_INI_SYSTEM, OnUpdateBool, server_encode,zend_suhosin_globals,   suhosin_globals)
         STD_ZEND_INI_BOOLEAN("suhosin.server.strip", "1", ZEND_INI_SYSTEM, OnUpdateBool, server_strip,zend_suhosin_globals,     suhosin_globals)
 
+        STD_PHP_INI_ENTRY("suhosin.rand.seedingkey", "", ZEND_INI_SYSTEM|ZEND_INI_PERDIR, OnUpdateString, seedingkey, zend_suhosin_globals, suhosin_globals)
+        STD_ZEND_INI_BOOLEAN("suhosin.rand.reseed_every_request", "0", ZEND_INI_SYSTEM|ZEND_INI_PERDIR, OnUpdateMiscBool, reseed_every_request, zend_suhosin_globals, suhosin_globals)
         STD_ZEND_INI_BOOLEAN("suhosin.srand.ignore", "1", ZEND_INI_SYSTEM|ZEND_INI_PERDIR, OnUpdateMiscBool, srand_ignore,zend_suhosin_globals, suhosin_globals)
         STD_ZEND_INI_BOOLEAN("suhosin.mt_srand.ignore", "1", ZEND_INI_SYSTEM|ZEND_INI_PERDIR, OnUpdateMiscBool, mt_srand_ignore,zend_suhosin_globals,   suhosin_globals)
 
@@ -1239,6 +1240,11 @@ PHP_RSHUTDOWN_FUNCTION(suhosin)
         
         SUHOSIN_G(abort_request) = 0;
         
+        if (SUHOSIN_G(reseed_every_request)) {
+                SUHOSIN_G(r_is_seeded) = 0;
+                SUHOSIN_G(mt_is_seeded) = 0;
+        }
+        
         if (SUHOSIN_G(decrypted_cookie)) {
                 efree(SUHOSIN_G(decrypted_cookie));
                 SUHOSIN_G(decrypted_cookie)=NULL;
@@ -1301,6 +1307,9 @@ PHP_MINFO_FUNCTION(suhosin)
                 if (zend_hash_find(EG(ini_directives), "suhosin.session.cryptkey", sizeof("suhosin.session.cryptkey"), (void **) &i)==SUCCESS) {
             i->displayer = suhosin_ini_displayer;
         }
+                if (zend_hash_find(EG(ini_directives), "suhosin.rand.seedingkey", sizeof("suhosin.rand.seedingkey"), (void **) &i)==SUCCESS) {
+            i->displayer = suhosin_ini_displayer;
+        }
     }
     
         DISPLAY_INI_ENTRIES();
@@ -1314,6 +1323,9 @@ PHP_MINFO_FUNCTION(suhosin)
                 if (zend_hash_find(EG(ini_directives), "suhosin.session.cryptkey", sizeof("suhosin.session.cryptkey"), (void **) &i)==SUCCESS) {
             i->displayer = NULL;
         }
+                if (zend_hash_find(EG(ini_directives), "suhosin.rand.seedingkey", sizeof("suhosin.rand.seedingkey"), (void **) &i)==SUCCESS) {
+            i->displayer = NULL;
+        }
     }
 
 }