From: Marius Gavrilescu Date: Sat, 15 Jul 2017 15:20:40 +0000 (+0300) Subject: Use Data::Entropy for random numbers X-Git-Tag: 0.003~2 X-Git-Url: http://git.ieval.ro/?a=commitdiff_plain;h=61456017abf30a3c00c25b53ac7ca4c8c90741eb;p=plack-middleware-auth-complex.git Use Data::Entropy for random numbers --- diff --git a/Makefile.PL b/Makefile.PL index 531b607..94058df 100644 --- a/Makefile.PL +++ b/Makefile.PL @@ -18,7 +18,7 @@ WriteMakefile( PREREQ_PM => { qw/Authen::Passphrase 0 Authen::Passphrase::BlowfishCrypt 0 - Bytes::Random::Secure 0 + Data::Entropy 0 DBI 0 Email::Simple 0 Email::Sender::Simple 0 diff --git a/lib/Plack/Middleware/Auth/Complex.pm b/lib/Plack/Middleware/Auth/Complex.pm index b8e3565..59d9bc3 100644 --- a/lib/Plack/Middleware/Auth/Complex.pm +++ b/lib/Plack/Middleware/Auth/Complex.pm @@ -11,8 +11,10 @@ use re '/s'; use Authen::Passphrase; use Authen::Passphrase::BlowfishCrypt; -use Bytes::Random::Secure qw//; -use Carp qw/croak/; +use Data::Entropy qw/entropy_source/; +use Data::Entropy::Source; +use Data::Entropy::RawSource::Local; +use Carp qw/carp croak/; use DBI; use Digest::SHA qw/hmac_sha1_base64 sha256/; use Email::Simple; @@ -21,6 +23,18 @@ use MIME::Base64 qw/decode_base64/; use Plack::Request; use Tie::Hash::Expire; +sub make_entropy_source { + if (-e '/dev/urandom') { + Data::Entropy::Source->new( + Data::Entropy::RawSource::Local->new('/dev/urandom'), + 'sysread' + ) + } else { + carp "/dev/urandom not found, using insecure random source\n"; + entropy_source + } +} + sub default_opts {( dbi_connect => ['dbi:Pg:', '', ''], select_user => 'SELECT passphrase, email FROM users WHERE id = ?', @@ -43,6 +57,7 @@ sub new { my ($class, $opts) = @_; my %self = $class->default_opts; %self = (%self, %$opts); + $self{entropy_source} //= make_entropy_source; my $self = bless \%self, $class; $self } @@ -100,7 +115,7 @@ sub set_passphrase { sub make_reset_hmac { my ($self, $username, @data) = @_; - $self->{hmackey} //= Bytes::Random::Secure->new(NonBlocking => 1)->bytes(512); # uncoverable condition false + $self->{hmackey} //= $self->{entropy_source}->get_bits(8 * 512); # uncoverable condition false my $user = $self->get_user($username); my $message = join ' ', $username, $user->{passphrase}, @data; hmac_sha1_base64 $message, $self->{hmackey}; @@ -332,6 +347,14 @@ This URL performs a password reset. Arrayref of arguments to pass to DBI->connect. Defaults to C<['dbi:Pg', '', '']>. +=item entropy_source + +C object to get random numbers from. By default +uses F via C if +possible, or the default entropy source otherwise. A warning is +printed if the default entropy source is used, to supress it set this +argument to the default entropy source. + =item post_connect_cb Callback (coderef) that is called just after connecting to the