From 15a258e8f4dcc2db5b3e422716ff6cde55475ad2 Mon Sep 17 00:00:00 2001 From: tobtoht Date: Thu, 29 Jun 2023 13:09:12 +0200 Subject: [PATCH] depends: libgcrypt: update to 1.10.2 --- contrib/depends/packages/libgcrypt.mk | 8 +- .../libgcrypt/fix_getrandom_darwin.patch | 131 ++++++++++++++++++ 2 files changed, 136 insertions(+), 3 deletions(-) create mode 100644 contrib/depends/patches/libgcrypt/fix_getrandom_darwin.patch diff --git a/contrib/depends/packages/libgcrypt.mk b/contrib/depends/packages/libgcrypt.mk index 676828b..34456e7 100644 --- a/contrib/depends/packages/libgcrypt.mk +++ b/contrib/depends/packages/libgcrypt.mk @@ -1,16 +1,18 @@ package=libgcrypt -$(package)_version=1.10.1 +$(package)_version=1.10.2 $(package)_download_path=https://www.gnupg.org/ftp/gcrypt/libgcrypt/ $(package)_file_name=libgcrypt-$($(package)_version).tar.bz2 -$(package)_sha256_hash=ef14ae546b0084cd84259f61a55e07a38c3b53afc0f546bffcef2f01baffe9de +$(package)_sha256_hash=3b9c02a004b68c256add99701de00b383accccf37177e0d6c58289664cce0c03 $(package)_dependencies=libgpg-error +$(package)_patches=fix_getrandom_darwin.patch define $(package)_set_vars $(package)_build_opts=CFLAGS="-fPIE" endef define $(package)_preprocess_cmds - cp -f $(BASEDIR)/config.guess $(BASEDIR)/config.sub build-aux + cp -f $(BASEDIR)/config.guess $(BASEDIR)/config.sub build-aux && \ + patch -p1 < $($(package)_patch_dir)/fix_getrandom_darwin.patch endef # TODO: building on linux with $($(package)_autoconf) fails for mysterious reasons diff --git a/contrib/depends/patches/libgcrypt/fix_getrandom_darwin.patch b/contrib/depends/patches/libgcrypt/fix_getrandom_darwin.patch new file mode 100644 index 0000000..c108571 --- /dev/null +++ b/contrib/depends/patches/libgcrypt/fix_getrandom_darwin.patch @@ -0,0 +1,131 @@ +diff --git a/random/rndgetentropy.c b/random/rndgetentropy.c +index 513da0b9..a6f3c4ab 100644 +--- a/random/rndgetentropy.c ++++ b/random/rndgetentropy.c +@@ -1,124 +1,126 @@ + /* rndgetentropy.c - raw random number for OSes by getentropy function. + * Copyright (C) 1998, 2001, 2002, 2003, 2007, + * 2009 Free Software Foundation, Inc. + * + * This file is part of Libgcrypt. + * + * Libgcrypt is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * Libgcrypt is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this program; if not, see . + */ + + + #include + #include + #include + #include + #include + #include + #include + #ifdef HAVE_SYS_RANDOM_H + #include + #endif + + #include "types.h" + #include "g10lib.h" + #include "rand-internal.h" + + /* The function returns 0 on success or true on failure (in which case + * the caller will signal a fatal error). */ + int + _gcry_rndgetentropy_gather_random (void (*add)(const void*, size_t, + enum random_origins), + enum random_origins origin, + size_t length, int level) + { + byte buffer[256]; + + if (!add) + { + /* Special mode to release resouces. */ + _gcry_rndjent_fini (); + return 0; + } + + /* When using a blocking random generator try to get some entropy + * from the jitter based RNG. In this case we take up to 50% of the + * remaining requested bytes. */ + if (level >= GCRY_VERY_STRONG_RANDOM) + { + size_t n; + + n = _gcry_rndjent_poll (add, origin, length/2); + if (n > length/2) + n = length/2; + if (length > 1) + length -= n; + } + + /* Enter the loop. */ + while (length) + { + int ret; + size_t nbytes; + + /* For a modern operating system, we use the new getentropy + * function. That call guarantees that the kernel's RNG has + * been properly seeded before returning any data. This is + * different from /dev/urandom which may, due to its + * non-blocking semantics, return data even if the kernel has + * not been properly seeded. And it differs from /dev/random by + * never blocking once the kernel is seeded. */ + do + { + _gcry_pre_syscall (); ++#ifdef GRND_RANDOM + if (fips_mode ()) + { + /* DRBG chaining defined in SP 800-90A (rev 1) specify + * the upstream (kernel) DRBG needs to be reseeded for + * initialization of downstream (libgcrypt) DRBG. For this + * in RHEL, we repurposed the GRND_RANDOM flag of getrandom API. + * The libgcrypt DRBG is initialized with 48B of entropy, but + * the kernel can provide only 32B at a time after reseeding + * so we need to limit our requests to 32B here. + * This is clarified in IG 7.19 / IG D.K. for FIPS 140-2 / 3 + * and might not be applicable on other FIPS modules not running + * RHEL kernel. + */ + nbytes = length < 32 ? length : 32; + ret = getrandom (buffer, nbytes, GRND_RANDOM); + } + else ++#endif + { + nbytes = length < sizeof (buffer) ? length : sizeof (buffer); + ret = getentropy (buffer, nbytes); + } + _gcry_post_syscall (); + } + while (ret == -1 && errno == EINTR); + + if (ret == -1 && errno == ENOSYS) + log_fatal ("getentropy is not supported: %s\n", strerror (errno)); + else + { /* getentropy is supported. Some sanity checks. */ + if (ret == -1) + log_fatal ("unexpected error from getentropy: %s\n", + strerror (errno)); + + (*add) (buffer, nbytes, origin); + length -= nbytes; + } + } + wipememory (buffer, sizeof buffer); + + return 0; /* success */ + }