[ssh_x509] audit module and "deffer seed_rng invocation in daemon after closefrom call"

[ssh_x509 at roumenpetrov.info]

ssh_x509 at roumenpetrov.info wrote:
> Hello,
>
>
> Release 14.0 adds:
> * deffer seed_rng invocation in daemon
>   Call after closefrom as work-around for random generator provided by an engine.
>
> So far so good but it seems to me this break some configurations. For now these configurations are are related to enabled audit module.
> * If audit module is set to linux it fails on some old Fedora releases.
> * If audit module is set to debug it fails if build is with recent OpenSSL 1.1.1 releases. It is know to pass with OpenSSL 1.1.1k and 1.1.1l.
>
> Note that PKIX-SSH by default enable engine support.
>
> So patch is put on hold. Soon will be published new release with reverted modification.
> [SNIP]

For protocol - failure is not related to audit module.
OpenSSL add a functionality to keep opened random devices. Functionality is more for UNIX OS-es and is fail-back if C library does not provide "random" functionality.

PKIX-SSH inherits from OpenBSD "re-exec" functionality. By design this functionality uses hard-coded numbers for used file descriptors. Because of this descriptors opened after closefrom() are clobbered by "re-exec" functionality.
Without word work-around for random generator provided by an engine is buggy by design.


More over issue shows design weakness in "re-exec" functionality implementation. It is only because code does not know how many descriptors are opened by cryptographic library. Program code may also open extra descriptors and result is expected - clobbered by "re-exec" functionality.


No plans to rewrite inherited "re-exec" functionality.


Regards,
Roumen Petrov