[PATCH 0/2] mbedtls: fail cleanly when no entropy source is available

[Daniel Golle <daniel@xxxxxxxxxxxxxx>]

When libssh is built against mbedtls 3.x and no entropy source is
available (no usable getrandom() and no /dev/urandom or /dev/random,
as can happen in a minimal container or chroot), the constructor
initialisation fails but the library remains loaded with a freed,
zeroed CTR-DRBG context. The first ssh_get_random() call then crashes
inside mbedtls: SIGSEGV observed on big-endian MIPS (OpenWrt, musl),
SIGBUS on x86-64 glibc, in both cases below
mbedtls_ctr_drbg_random() reached from ed25519 key generation.

The first patch guards the RNG the same way the mbedtls 4.x (PSA)
implementation already does, so ssh_get_random() reports failure
instead of touching the unseeded DRBG; every in-tree caller already
handles that. The second patch makes is_ssh_initialized() report the
recorded initialisation result, so ssh_connect() fails with the
intended "Library not initialized" error instead of running into the
unusable crypto state.

Verified against mbedtls 3.6.5 on x86-64 and on big-endian MIPS: with
the series applied, an entropy-less environment yields a clean
SSH_ERROR from ssh_pki_generate() and "Library not initialized" from
ssh_connect(), where before the process crashed. No changes in
testsuite results.

Daniel Golle (2):
  mbedtls: Guard the CTR-DRBG against use before it is seeded
  init: Do not report a failed initialisation as initialised

 include/libssh/libmbedcrypto.h | 1 +
 src/getrandom_mbedcrypto.c     | 3 +++
 src/init.c                     | 5 +++--
 src/libmbedcrypto.c            | 4 ++--
 4 files changed, 9 insertions(+), 4 deletions(-)

-- 
2.55.0