Set session.entropy_file to /dev/urandom or /dev/arandom by

default if present at compile-time.  Addresses part of bug #51436

diff --git a/NEWS b/NEWS
index f9ab1413c47671f2fefcd4f566badb3be7a76b99..8dffac53dc4ede72ed29104ebe9f77a45b287019 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -13,7 +13,9 @@ PHP                                                                        NEWS
 - Added command line option --rz to CLI. (Johannes)
 
 - default_charset if not specified is now UTF-8 instead of ISO-8859-1. (Rasmus)
-       
+- default session.entropy_file is now /dev/urandom or /dev/arandom if either
+  is present at compile time. (Rasmus)
+       
 ?? ??? 20??, PHP 5.3.3
 - Upgraded bundled PCRE to version 8.01. (Ilia)
 

diff --git a/UPGRADING b/UPGRADING
index ae123e53c7a9a6ba215add9f8ceb79b36022fa4c..72b81c571cd295194e1edebdc9cda5d2310f3ae8 100755 (executable)
--- a/UPGRADING
+++ b/UPGRADING
@@ -40,7 +40,19 @@ UPGRADE NOTES - PHP X.Y
 
     default_charset = iso-8859-1
 
-  to your php.ini to preserve pre-PHPX.Y behavior
+  to your php.ini to preserve pre-PHPX.Y behavior.
+
+- We now check at compile time if /dev/urandom or /dev/arandom
+  are present to provide non-blocking entropy to session id
+  generation.  If either is present, session.entropy_file
+  now defaults to that file and session.entropy_length defaults
+  to 32.  If you do not want extra entropy for your session ids
+  for some reason, add:
+
+    session.entropy_file=
+    session.entropy_length=0
+
+  to your php.ini to preserve pre-PHPX.Y behavior.
 
 =============================
 2. Reserved words and classes

diff --git a/Zend/Zend.m4 b/Zend/Zend.m4
index 6b1f705bee5d819b98844e86640d873fdc4b6781..c56b769a9959e12ff944cda9a786d2267d14db59 100644 (file)
--- a/Zend/Zend.m4
+++ b/Zend/Zend.m4
@@ -419,4 +419,11 @@ if test -r "/dev/urandom" && test -c "/dev/urandom"; then
   AC_MSG_RESULT(yes) 
 else 
   AC_MSG_RESULT(no) 
+  AC_MSG_CHECKING(whether /dev/arandom exists) 
+  if test -r "/dev/arandom" && test -c "/dev/arandom"; then 
+    AC_DEFINE([HAVE_DEV_ARANDOM], 1, [Define if the target system has /dev/arandom device])
+    AC_MSG_RESULT(yes) 
+  else 
+    AC_MSG_RESULT(no) 
+  fi 
 fi 

diff --git a/ext/session/session.c b/ext/session/session.c
index 6456f68163d5f63868a09440c3d935e5f4f08da9..3455421a7e502f03bb422ade0de89fe7d3cb2e7a 100644 (file)
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -781,8 +781,16 @@ PHP_INI_BEGIN()
        STD_PHP_INI_BOOLEAN("session.use_cookies",      "1",         PHP_INI_ALL, OnUpdateBool,   use_cookies,        php_ps_globals,    ps_globals)
        STD_PHP_INI_BOOLEAN("session.use_only_cookies", "1",         PHP_INI_ALL, OnUpdateBool,   use_only_cookies,   php_ps_globals,    ps_globals)
        STD_PHP_INI_ENTRY("session.referer_check",      "",          PHP_INI_ALL, OnUpdateString, extern_referer_chk, php_ps_globals,    ps_globals)
+#if HAVE_DEV_URANDOM
+       STD_PHP_INI_ENTRY("session.entropy_file",       "/dev/urandom",          PHP_INI_ALL, OnUpdateString, entropy_file,       php_ps_globals,    ps_globals)
+       STD_PHP_INI_ENTRY("session.entropy_length",     "32",         PHP_INI_ALL, OnUpdateLong,   entropy_length,     php_ps_globals,    ps_globals)
+#elif HAVE_DEV_ARANDOM
+       STD_PHP_INI_ENTRY("session.entropy_file",       "/dev/arandom",          PHP_INI_ALL, OnUpdateString, entropy_file,       php_ps_globals,    ps_globals)
+       STD_PHP_INI_ENTRY("session.entropy_length",     "32",         PHP_INI_ALL, OnUpdateLong,   entropy_length,     php_ps_globals,    ps_globals)
+#else
        STD_PHP_INI_ENTRY("session.entropy_file",       "",          PHP_INI_ALL, OnUpdateString, entropy_file,       php_ps_globals,    ps_globals)
        STD_PHP_INI_ENTRY("session.entropy_length",     "0",         PHP_INI_ALL, OnUpdateLong,   entropy_length,     php_ps_globals,    ps_globals)
+#endif
        STD_PHP_INI_ENTRY("session.cache_limiter",      "nocache",   PHP_INI_ALL, OnUpdateString, cache_limiter,      php_ps_globals,    ps_globals)
        STD_PHP_INI_ENTRY("session.cache_expire",       "180",       PHP_INI_ALL, OnUpdateLong,   cache_expire,       php_ps_globals,    ps_globals)
        PHP_INI_ENTRY("session.use_trans_sid",          "0",         PHP_INI_ALL, OnUpdateTransSid)

diff --git a/php.ini-development b/php.ini-development
index 7e304461c569ede568ce0e2c5643bceca1081db0..123187350d1e4fa4c26b8149f0838576dd60f8f1 100644 (file)
--- a/php.ini-development
+++ b/php.ini-development
@@ -1582,15 +1582,18 @@ session.referer_check =
 
 ; How many bytes to read from the file.
 ; http://php.net/session.entropy-length
-session.entropy_length = 0
+;session.entropy_length = 32
 
 ; Specified here to create the session id.
 ; http://php.net/session.entropy-file
+; Defaults to /dev/urandom
+; On systems that don't have /dev/urandom but do have /dev/arandom, this will default to /dev/arandom
+; If neither are found at compile time, the default is no entropy file.
 ;session.entropy_file = /dev/urandom
-session.entropy_file =
 
 ; http://php.net/session.entropy-length
-;session.entropy_length = 16
+; defaults to 32
+;session.entropy_length = 32
 
 ; Set to {nocache,private,public,} to determine HTTP caching aspects
 ; or leave this empty to avoid sending anti-caching headers.

diff --git a/php.ini-production b/php.ini-production
index 793f67ed7a3af1a6f9290a0694048572c63485e0..448be26405acd4e338b9a1cfb4c75b08158e77bb 100644 (file)
--- a/php.ini-production
+++ b/php.ini-production
@@ -1588,17 +1588,16 @@ session.bug_compat_warn = Off
 ; http://php.net/session.referer-check
 session.referer_check =
 
-; How many bytes to read from the file.
-; http://php.net/session.entropy-length
-session.entropy_length = 0
-
 ; Specified here to create the session id.
 ; http://php.net/session.entropy-file
+; Defaults to /dev/urandom
+; On systems that don't have /dev/urandom but do have /dev/arandom, this will default to /dev/arandom
+; If neither are found at compile time, the default is no entropy file.
 ;session.entropy_file = /dev/urandom
-session.entropy_file =
 
 ; http://php.net/session.entropy-length
-;session.entropy_length = 16
+; defaults to 32
+;session.entropy_length = 32
 
 ; Set to {nocache,private,public,} to determine HTTP caching aspects
 ; or leave this empty to avoid sending anti-caching headers.