New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FIXED: secret.txt opened in text mode on Windows #51

Closed
jojothe opened this Issue Dec 1, 2018 · 9 comments

Comments

Projects
None yet
2 participants
@jojothe
Copy link

jojothe commented Dec 1, 2018

After using Deadwood on Windows successfully for years (and loving it!), I got this error when I installed it on a new machine:

Friday, November 30, 2018 17:12:22 PM: Unable to get 128 bits of entropy; file secret.txt must be
at least 16 bytes (128 bits) long

It turns out mkSecretTxt.exe happened to put a control-Z in the first 16 bytes of secret.txt, and the file is opened in text mode (O_RDONLY), so Windows reads the control-Z as EOF and thinks the file is too short. (I worked around it by re-running mkSecretTxt.exe to get a secret.txt with no control-Z.)

A better fix, in get_entropy_from_seedfile():
seed = open(filename, O_RDONLY|O_BINARY);

@samboy

This comment has been minimized.

Copy link
Owner

samboy commented Jan 5, 2019

Thanks for the heads-up; this looks to be a legitimate code with a one-line patch. Not sure when I will have free time to make this so (The problem with working in the private sector is that, even in California, when I am clocked in, anything I do is owned by my employer; when I’m not on the clock, I’m usually taking care of a young child)

@samboy

This comment has been minimized.

Copy link
Owner

samboy commented Jan 7, 2019

O_BINARY is a Windows-specific option, so I had to put the code in a #ifdef MINGW block

samboy added a commit that referenced this issue Jan 7, 2019

@samboy

This comment has been minimized.

Copy link
Owner

samboy commented Jan 7, 2019

Looks like that will work, but, yes, O_BINARY will not compile in Linux. See https://sourceforge.net/p/mingw/bugs/1396/

@samboy

This comment has been minimized.

Copy link
Owner

samboy commented Jan 8, 2019

I have fixed the issue and have committed the code. I will close this ticket when I make a new Deadwood tarball (and, yes, Windows binary zipfile) with the updated code.

@samboy

This comment has been minimized.

Copy link
Owner

samboy commented Jan 17, 2019

Snapshot Deadwood with this fix made: https://maradns.samiam.org/Deadwood/snap/

Next:

  • Run automated SQA tests on snapshot to ensure no regressions were introduced
  • Once the SQA suite passes, compile and make Windows binary
  • Make sure Windows does not have Ctrl+Z issue
  • Make Deadwood 3.2.14 release (Source, Windows binary) with updated code
@samboy

This comment has been minimized.

Copy link
Owner

samboy commented Jan 18, 2019

The 2019-01-16 snapshot passes all SQA regression tests; no regressions were introduced.

@samboy

This comment has been minimized.

Copy link
Owner

samboy commented Jan 19, 2019

I have made a test compile in Windows. The test compile is able to start and resolve domains with a secret.txt consisting of nothing but ^Z (ASCII code 26); to verify this fixes the bug, Deadwood 3.2.12 is unable to resolve domains with the same secret.txt file.

Next: Release Deadwood 3.2.14

@samboy

This comment has been minimized.

Copy link
Owner

samboy commented Jan 19, 2019

Deadwood 3.2.14 released. No changes except this bugfix. Available for download:

Closing ticket.

@samboy samboy closed this Jan 19, 2019

@samboy samboy changed the title Deadwood bug: secret.txt opened in text mode on Windows FIXED: secret.txt opened in text mode on Windows Jan 19, 2019

@samboy

This comment has been minimized.

Copy link
Owner

samboy commented Jan 19, 2019

I will make a MaraDNS 2.0.17 release with Deadwood 3.2.14 once I have a fix for #52 available.

Also, this is not a security problem because Deadwood refuses to run if it does not have a safe level of entropy (128 bits or more).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment