tree 89b6a0a88a91cfd13cb80d303971d8e9819c8bcf
parent 656233715e1e9810c43f05b12e13f8829ea4cad2
author Thierry Fournier <tfournier@exceliance.fr> 1359033343 +0100
committer Willy Tarreau <w@1wt.eu> 1359058601 +0100

BUG/MEDIUM: ssl: openssl 0.9.8 doesn't open /dev/random before chroot

Openssl needs to access /dev/urandom to initialize its internal random
number generator. It does so when it needs a random for the first time,
which fails if it is a handshake performed after the chroot(), causing
all SSL incoming connections to fail.

This fix consists in calling RAND_bytes() to produce a random before
the chroot, which will in turn open /dev/urandom before it's too late,
and avoid the issue.

If the random generator fails to work while processing the config,
haproxy now fails with an error instead of causing SSL connections to
fail at runtime.