Bug 1429162

Summary:	libreswan: Should not override the getrandom function
Product:	[Fedora] Fedora	Reporter:	Florian Weimer <fweimer>
Component:	libreswan	Assignee:	Paul Wouters <pwouters>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	fweimer, pwouters
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-08 15:37:18 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1422434

Description Florian Weimer 2017-03-05 07:35:33 UTC

/usr/libexec/ipsec/rsasigkey contains an overriding, incompatible definition of the getrandom function.  This will cause problems if NSS ever switches to getrandom for seeding its own PRNG because it will then use the function in the rsasigkey program, not the one from the GNU C Library, due to the way ELF symbol interposition works.

It is probably best to remove the seedbits handling altogether and keep the -s option for backwards compatibility, but otherwise ignore it.  I assume that NSS seeds its PRNG properly on its own.

Comment 1 Paul Wouters 2017-03-06 16:47:28 UTC

The seedbits are a BSI requirements and cannot be removed. These are meant to be on top of the NSS seeding done on initialization.

I've renamed it to lsw_getrandom() upstream, will be in 3.20

Comment 2 Florian Weimer 2017-03-06 16:50:11 UTC

(In reply to Paul Wouters from comment #1)
> The seedbits are a BSI requirements and cannot be removed. These are meant
> to be on top of the NSS seeding done on initialization.

Which BSI would that be?

Why is this code only in libreswan and not every single user of NSS (or at least those users performing key generation)?

Comment 3 Paul Wouters 2017-03-06 17:00:54 UTC

https://www.bsi.bund.de/EN/Home/home_node.html

Comment 6 Paul Wouters 2017-08-08 03:35:51 UTC

note the function was renamed to lsw_getrandom() in version 3.20 which is in fedora, so I think this bug can be closed?

Comment 7 Florian Weimer 2017-08-08 06:15:19 UTC

Yes, libreswan no longer appears in my interposition reports.