forked from pool/libgcrypt
Pedro Monreal Gonzalez
dea0435690
- Update to 1.9.1
* *Fix exploitable bug* in hash functions introduced with
1.9.0. [bsc#1181632, CVE-2021-3345]
* Return an error if a negative MPI is used with sexp scan
functions.
* Check for operational FIPS in the random and KDF functions.
* Fix compile error on ARMv7 with NEON disabled.
* Fix self-test in KDF module.
* Improve assembler checks for better LTO support.
* Fix 32-bit cross build on x86.
* Fix non-NEON ARM assembly implementation for SHA512.
* Fix build problems with the cipher_bulk_ops_t typedef.
* Fix Ed25519 private key handling for preceding ZEROs.
* Fix overflow in modular inverse implementation.
* Fix register access for AVX/AVX2 implementations of Blake2.
* Add optimized cipher and hash functions for s390x/zSeries.
* Use hardware bit counting functionx when available.
* Update DSA functions to match FIPS 186-3.
* New self-tests for CMACs and KDFs.
* Add bulk cipher functions for OFB and GCM modes.
- Update libgpg-error required version
- Use the suffix variable correctly in get_hmac_path()
- Rebase libgcrypt-fips_selftest_trigger_file.patch
- Add the global config file /etc/gcrypt/random.conf
* This file can be used to globally change parameters of the random
generator with the options: only-urandom and disable-jent.
- Update to 1.9.0:
OBS-URL: https://build.opensuse.org/request/show/868925
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/libgcrypt?expand=0&rev=142
82 lines
2.4 KiB
Diff
82 lines
2.4 KiB
Diff
---
|
|
src/Makefile.in | 2 +-
|
|
src/fips.c | 39 ++++++++++++++++++++++++++++++++-------
|
|
2 files changed, 33 insertions(+), 8 deletions(-)
|
|
|
|
Index: libgcrypt-1.9.0/src/fips.c
|
|
===================================================================
|
|
--- libgcrypt-1.9.0.orig/src/fips.c
|
|
+++ libgcrypt-1.9.0/src/fips.c
|
|
@@ -603,23 +603,49 @@ run_random_selftests (void)
|
|
return !!err;
|
|
}
|
|
|
|
+#ifdef ENABLE_HMAC_BINARY_CHECK
|
|
+static int
|
|
+get_library_path(const char *libname, const char *symbolname, char *path, size_t pathlen)
|
|
+{
|
|
+ Dl_info info;
|
|
+ void *dl, *sym;
|
|
+ int rv = -1;
|
|
+
|
|
+ dl = dlopen(libname, RTLD_LAZY);
|
|
+ if (dl == NULL)
|
|
+ return -1;
|
|
+
|
|
+ sym = dlsym(dl, symbolname);
|
|
+ if (sym != NULL && dladdr(sym, &info))
|
|
+ {
|
|
+ strncpy(path, info.dli_fname, pathlen-1);
|
|
+ path[pathlen-1] = '\0';
|
|
+ rv = 0;
|
|
+ }
|
|
+
|
|
+ dlclose(dl);
|
|
+
|
|
+ return rv;
|
|
+}
|
|
+#endif
|
|
+
|
|
/* Run an integrity check on the binary. Returns 0 on success. */
|
|
static int
|
|
check_binary_integrity (void)
|
|
{
|
|
#ifdef ENABLE_HMAC_BINARY_CHECK
|
|
gpg_error_t err;
|
|
- Dl_info info;
|
|
+ char libpath[4096];
|
|
unsigned char digest[32];
|
|
int dlen;
|
|
char *fname = NULL;
|
|
- const char key[] = "What am I, a doctor or a moonshuttle conductor?";
|
|
+ const char key[] = "orboDeJITITejsirpADONivirpUkvarP";
|
|
|
|
- if (!dladdr ("gcry_check_version", &info))
|
|
+ if (get_library_path ("libgcrypt.so.20", "gcry_check_version", libpath, sizeof(libpath)))
|
|
err = gpg_error_from_syserror ();
|
|
else
|
|
{
|
|
- dlen = _gcry_hmac256_file (digest, sizeof digest, info.dli_fname,
|
|
+ dlen = _gcry_hmac256_file (digest, sizeof digest, libpath,
|
|
key, strlen (key));
|
|
if (dlen < 0)
|
|
err = gpg_error_from_syserror ();
|
|
@@ -627,7 +652,7 @@ check_binary_integrity (void)
|
|
err = gpg_error (GPG_ERR_INTERNAL);
|
|
else
|
|
{
|
|
- fname = xtrymalloc (strlen (info.dli_fname) + 1 + 5 + 1 );
|
|
+ fname = xtrymalloc (strlen (libpath) + 1 + 5 + 1 );
|
|
if (!fname)
|
|
err = gpg_error_from_syserror ();
|
|
else
|
|
@@ -636,7 +661,7 @@ check_binary_integrity (void)
|
|
char *p;
|
|
|
|
/* Prefix the basename with a dot. */
|
|
- strcpy (fname, info.dli_fname);
|
|
+ strcpy (fname, libpath);
|
|
p = strrchr (fname, '/');
|
|
if (p)
|
|
p++;
|