Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-15-SP4:Update
openssl-1_1.32465
openssl-1_1-jitterentropy-3.4.0.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File openssl-1_1-jitterentropy-3.4.0.patch of Package openssl-1_1.32465
--- Configurations/00-base-templates.conf | 2 - crypto/fips/build.info | 3 +- crypto/fips/fips.c | 8 +++++++ crypto/fips/fips_entropy.c | 38 ++++++++++++++++++++++++++++++++++ crypto/fips/fips_err.h | 1 crypto/init.c | 4 +++ crypto/rand/rand_unix.c | 30 +++++++++++++++++++++++++- include/crypto/fips.h | 2 + include/openssl/fips.h | 4 +++ util/libcrypto.num | 2 + 10 files changed, 91 insertions(+), 3 deletions(-) --- a/Configurations/00-base-templates.conf +++ b/Configurations/00-base-templates.conf @@ -96,7 +96,7 @@ my %targets=( ex_libs => sub { !defined($disabled{zlib}) && defined($disabled{"zlib-dynamic"}) - ? "-lz" : () }, + ? "-lz -ljitterentropy" : "-ljitterentropy" }, HASHBANGPERL => "/usr/bin/env perl", # Only Unix actually cares RANLIB => sub { which("$config{cross_compile_prefix}ranlib") ? "ranlib" : "" }, --- a/crypto/fips/build.info +++ b/crypto/fips/build.info @@ -5,7 +5,8 @@ SOURCE[../../libcrypto]=\ fips_post.c drbgtest.c fips_drbg_ctr.c fips_drbg_hash.c fips_drbg_hmac.c \ fips_drbg_lib.c fips_drbg_rand.c fips_drbg_selftest.c fips_rand_lib.c \ fips_cmac_selftest.c fips_ecdh_selftest.c fips_ecdsa_selftest.c \ - fips_dh_selftest.c fips_kdf_selftest.c fips_ers.c fips_sli.c + fips_dh_selftest.c fips_kdf_selftest.c fips_ers.c fips_sli.c \ + fips_entropy.c PROGRAMS=\ fips_standalone_hmac --- a/crypto/fips/fips.c +++ b/crypto/fips/fips.c @@ -461,6 +461,14 @@ int FIPS_module_mode_set(int onoff) fips_post = 1; + if (!FIPS_entropy_init()) { + FIPSerr(FIPS_F_FIPS_MODULE_MODE_SET, + FIPS_R_ENTROPY_INIT_FAILED); + fips_selftest_fail = 1; + ret = 0; + goto end; + } + /* Run the KATs before the HMAC verification for FIPS 140-3 compliance */ if (!FIPS_selftest()) { fips_selftest_fail = 1; --- /dev/null +++ b/crypto/fips/fips_entropy.c @@ -0,0 +1,38 @@ +#include <openssl/fips.h> + +#include "crypto/fips.h" +#include "jitterentropy.h" + +static struct rand_data* ec = NULL; + +struct rand_data* FIPS_entropy_init(void) +{ + if (ec != NULL) + /* Entropy source has been initiated and collector allocated */ + return ec; + /* If the initialization is successful, the call returns with 0 */ + if (jent_entropy_init_ex(1, JENT_FORCE_FIPS) == 0) + /* Allocate entropy collector */ + ec = jent_entropy_collector_alloc(1, JENT_FORCE_FIPS); + return ec; +} + +void FIPS_entropy_cleanup(void) +{ + /* Free entropy collector */ + if (ec != NULL) { + jent_entropy_collector_free(ec); + ec = NULL; + } +} + +ssize_t FIPS_jitter_entropy(unsigned char *buf, size_t buflen) +{ + ssize_t ent_bytes = -1; + + if (buf != NULL && buflen != 0 && FIPS_entropy_init()) { + /* Get entropy */ + ent_bytes = jent_read_entropy_safe(&ec, (char *)buf, buflen); + } + return ent_bytes; +} --- a/crypto/fips/fips_err.h +++ b/crypto/fips/fips_err.h @@ -135,6 +135,7 @@ static ERR_STRING_DATA FIPS_str_reasons[ {ERR_REASON(FIPS_R_DRBG_NOT_INITIALISED), "drbg not initialised"}, {ERR_REASON(FIPS_R_DRBG_STUCK), "drbg stuck"}, {ERR_REASON(FIPS_R_ENTROPY_ERROR_UNDETECTED), "entropy error undetected"}, + {ERR_REASON(FIPS_R_ENTROPY_INIT_FAILED), "entropy init failed"}, {ERR_REASON(FIPS_R_ENTROPY_NOT_REQUESTED_FOR_RESEED), "entropy not requested for reseed"}, {ERR_REASON(FIPS_R_ENTROPY_SOURCE_STUCK), "entropy source stuck"}, --- a/crypto/init.c +++ b/crypto/init.c @@ -27,6 +27,7 @@ #include "crypto/dso_conf.h" #include "internal/dso.h" #include "crypto/store.h" +#include "openssl/fips.h" static int stopped = 0; @@ -597,6 +598,9 @@ void OPENSSL_cleanup(void) rand_cleanup_int(); rand_drbg_cleanup_int(); conf_modules_free_int(); +#ifdef OPENSSL_FIPS + FIPS_entropy_cleanup(); +#endif #ifndef OPENSSL_NO_ENGINE engine_cleanup_int(); #endif --- a/crypto/rand/rand_unix.c +++ b/crypto/rand/rand_unix.c @@ -642,9 +642,37 @@ size_t rand_pool_acquire_entropy(RAND_PO return rand_pool_entropy_available(pool); # else size_t entropy_available; + int in_post; + +# ifdef OPENSSL_FIPS + if (FIPS_mode()) { + /* Use jitter entropy in FIPS mode */ + for (in_post = fips_in_post(); in_post >= 0; --in_post) { + size_t bytes_needed; + unsigned char *buffer; + ssize_t bytes; + /* Maximum allowed number of consecutive unsuccessful attempts */ + int attempts = 3; + + bytes_needed = rand_pool_bytes_needed(pool, 1 /*entropy_factor*/); + while (bytes_needed != 0 && attempts-- > 0) { + buffer = rand_pool_add_begin(pool, bytes_needed); + bytes = FIPS_jitter_entropy(buffer, bytes_needed); + if (bytes > 0) { + rand_pool_add_end(pool, bytes, 8 * bytes); + bytes_needed -= bytes; + attempts = 3; /* reset counter after successful attempt */ + } else if (bytes < 0) { + break; + } + } + } + entropy_available = rand_pool_entropy_available(pool); + return entropy_available; + } +# endif # if defined(OPENSSL_RAND_SEED_GETRANDOM) - int in_post; for (in_post = fips_in_post(); in_post >= 0; --in_post) { { --- a/include/crypto/fips.h +++ b/include/crypto/fips.h @@ -101,4 +101,6 @@ void fips_set_selftest_fail(void); void FIPS_get_timevec(unsigned char *buf, unsigned long *pctr); +ssize_t FIPS_jitter_entropy(unsigned char *buf, size_t buflen); + #endif --- a/include/openssl/fips.h +++ b/include/openssl/fips.h @@ -74,6 +74,9 @@ extern "C" { BN_GENCB *cb); int FIPS_dsa_paramgen_check_g(DSA *dsa); + struct rand_data* FIPS_entropy_init(void); + void FIPS_entropy_cleanup(void); + /* BEGIN ERROR CODES */ /* The following lines are auto generated by the script mkerr.pl. Any changes * made after this point may be overwritten when the script is next run. @@ -151,6 +154,7 @@ extern "C" { # define FIPS_R_DRBG_NOT_INITIALISED 152 # define FIPS_R_DRBG_STUCK 103 # define FIPS_R_ENTROPY_ERROR_UNDETECTED 104 +# define FIPS_R_ENTROPY_INIT_FAILED 161 # define FIPS_R_ENTROPY_NOT_REQUESTED_FOR_RESEED 105 # define FIPS_R_ENTROPY_SOURCE_STUCK 142 # define FIPS_R_ERROR_INITIALISING_DRBG 115 --- a/util/libcrypto.num +++ b/util/libcrypto.num @@ -4647,3 +4647,5 @@ fips_sli_PKCS5_PBKDF2_HMAC_is_approved fips_sli_HMAC_is_approved 6608 1_1_1l EXIST::FUNCTION: fips_sli_RAND_bytes_is_approved 6609 1_1_1l EXIST::FUNCTION: fips_sli_RAND_priv_bytes_is_approved 6610 1_1_1l EXIST::FUNCTION: +FIPS_entropy_init 6611 1_1_1l EXIST::FUNCTION: +FIPS_entropy_cleanup 6612 1_1_1l EXIST::FUNCTION:
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
