forked from boostorg/beast
Vinnie Falco
749e54f31b
This resolves a medium vulnerability described in the Beast Hybrid Assessment Report by Bishop Fox, where masks generated for use with outgoing WebSocket client frames use an insufficient source of entropy and a non-cryptographically secure pseudo-random number generator. By default, all newly constructed WebSocket streams will use a uniquely seeded secure PRNG (ChaCha20 in counter mode). As this may result in increased CPU resource consumption, the function websocket::stream::secure_prng() may be used to select a faster but less secure PRNG, for the case where the caller knows that the secure generator is not necessary. On some systems, std::random_device may produce insufficient entropy to securely seed the PRNG. As this condition cannot be detected by Beast, callers may use the function websocket::seed_prng() called once at startup to provide at least 256 bits of entropy which will be used to uniquely seed all subsequent PRNGs.
41 lines
754 B
Plaintext
41 lines
754 B
Plaintext
#
|
|
# Copyright (c) 2016-2017 Vinnie Falco (vinnie dot falco at gmail dot com)
|
|
#
|
|
# Distributed under the Boost Software License, Version 1.0. (See accompanying
|
|
# file LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt)
|
|
#
|
|
# Official repository: https://github.com/boostorg/beast
|
|
#
|
|
|
|
local SOURCES =
|
|
accept.cpp
|
|
close.cpp
|
|
error.cpp
|
|
frame.cpp
|
|
handshake.cpp
|
|
option.cpp
|
|
ping.cpp
|
|
read1.cpp
|
|
read2.cpp
|
|
rfc6455.cpp
|
|
role.cpp
|
|
stream.cpp
|
|
stream_fwd.cpp
|
|
teardown.cpp
|
|
utf8_checker.cpp
|
|
write.cpp
|
|
;
|
|
|
|
local RUN_TESTS ;
|
|
|
|
for local f in $(SOURCES)
|
|
{
|
|
RUN_TESTS += [ run $(f) $(TEST_MAIN) ] ;
|
|
}
|
|
|
|
alias run-tests : $(RUN_TESTS) ;
|
|
|
|
exe fat-tests : $(TEST_MAIN) $(SOURCES) ;
|
|
|
|
explicit fat-tests ;
|