From 2a3fb25b16660ea9601f20e71ded249233dc942a Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 5 Aug 2022 16:19:02 +0900 Subject: [PATCH] sysrng: reseed source DRBG for prediction resistance Related: #2097327 Signed-off-by: Daiki Ueno --- gnutls-3.7.6-drbg-reseed.patch | 41 ++++++++++++++++++++++++++++++++++ gnutls.spec | 2 ++ 2 files changed, 43 insertions(+) create mode 100644 gnutls-3.7.6-drbg-reseed.patch diff --git a/gnutls-3.7.6-drbg-reseed.patch b/gnutls-3.7.6-drbg-reseed.patch new file mode 100644 index 0000000..8fd5f58 --- /dev/null +++ b/gnutls-3.7.6-drbg-reseed.patch @@ -0,0 +1,41 @@ +From 3035e884b3abc68bcebff5adec5bd8819bbc6d7b Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Fri, 5 Aug 2022 16:16:42 +0900 +Subject: [PATCH] gnutls-3.7.6-drbg-reseed.patch + +Signed-off-by: rpm-build +--- + lib/nettle/sysrng-linux.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/lib/nettle/sysrng-linux.c b/lib/nettle/sysrng-linux.c +index 6b3971c..dae9061 100644 +--- a/lib/nettle/sysrng-linux.c ++++ b/lib/nettle/sysrng-linux.c +@@ -31,6 +31,9 @@ + # include + # include + # include ++# include "fips.h" ++#else ++# define _gnutls_fips_mode_enabled() 0 + #endif + + #include +@@ -103,7 +106,12 @@ static int force_getrandom(void *buf, size_t buflen, unsigned int flags) + static int _rnd_get_system_entropy_getrandom(void* _rnd, size_t size) + { + int ret; +- ret = force_getrandom(_rnd, size, 0); ++ unsigned int flags = 0; ++ ++ if (_gnutls_fips_mode_enabled()) { ++ flags |= 2/*GRND_RANDOM*/; ++ } ++ ret = force_getrandom(_rnd, size, flags); + if (ret == -1) { + int e = errno; + gnutls_assert(); +-- +2.37.1 + diff --git a/gnutls.spec b/gnutls.spec index 2f3a6ca..fe34a7f 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -31,6 +31,7 @@ Patch: gnutls-3.7.6-fips-pkcs12-des-cbc.patch # not upstreamed Patch: gnutls-3.7.3-disable-config-reload.patch Patch: gnutls-3.7.3-fips-dsa-post.patch +Patch: gnutls-3.7.6-drbg-reseed.patch %bcond_without bootstrap %bcond_without dane @@ -363,6 +364,7 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null %changelog * Thu Aug 4 2022 Daiki Ueno - 3.7.6-5 - Block DES-CBC usage in decrypting PKCS#12 bag under FIPS (#2115244) +- sysrng: reseed source DRBG for prediction resistance * Fri Jul 29 2022 Daiki Ueno - 3.7.6-4 - Make gnutls-cli work with KTLS for testing