Skip to content

Commit 297b90e

Browse files
authored
fix intermittent openssl FIPS selftest failures in jitterentropy (#9890)
1 parent e44fb2e commit 297b90e

6 files changed

Lines changed: 95 additions & 23 deletions

File tree

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
From d0e139f4e697265cd693769860b20d61c89bbd96 Mon Sep 17 00:00:00 2001
2+
From: Tobias Brick <tobiasb@microsoft.com>
3+
Date: Wed, 3 Jul 2024 20:24:14 +0000
4+
Subject: [PATCH] TOBIASB: Initialize ec.mem and set minimum OSR in
5+
jent_time_entropy_init
6+
7+
Ocassionally, the jitterentropy module was failing the FIPS self-test because it was unable to create
8+
sufficient entropy. This was due to two main reasons:
9+
A memory buffer was not being initialized in the jent_time_entropy_init function. This buffer is used
10+
to add variations based on memory access to the entropy pool.
11+
12+
The OSR value was being set to 1, rather than the standard minimum of 3. Since this affects the threshold
13+
for number of times the allows itself to attempt to generate entropy before failing out, this made the issue
14+
more likely to occur.
15+
16+
This patch initializes that buffer and enforces the standard minmum OSR value.
17+
18+
---
19+
crypto/fips/jitterentropy-base.c | 19 ++++++++++++++++++-
20+
1 file changed, 18 insertions(+), 1 deletion(-)
21+
22+
diff --git a/crypto/fips/jitterentropy-base.c b/crypto/fips/jitterentropy-base.c
23+
index 9fb5b96..a5079a0 100644
24+
--- a/crypto/fips/jitterentropy-base.c
25+
+++ b/crypto/fips/jitterentropy-base.c
26+
@@ -1265,13 +1265,27 @@ static int jent_time_entropy_init(unsigned int enable_notime)
27+
28+
memset(&ec, 0, sizeof(ec));
29+
30+
+ /* Allocate memory for adding variations based on memory
31+
+ * access
32+
+ */
33+
+ ec.mem =
34+
+ (unsigned char *)jent_zalloc(JENT_MEMORY_SIZE);
35+
+ if (ec.mem == NULL) {
36+
+ ret = EHEALTH;
37+
+ goto out;
38+
+ }
39+
+
40+
+ ec.memblocksize = JENT_MEMORY_BLOCKSIZE;
41+
+ ec.memblocks = JENT_MEMORY_BLOCKS;
42+
+ ec.memaccessloops = JENT_MEMORY_ACCESSLOOPS;
43+
+
44+
if (enable_notime) {
45+
ec.enable_notime = 1;
46+
jent_notime_settick(&ec);
47+
}
48+
49+
/* Required for RCT */
50+
- ec.osr = 1;
51+
+ ec.osr = JENT_MIN_OSR;
52+
if (jent_fips_enabled())
53+
ec.fips_enabled = 1;
54+
55+
@@ -1429,6 +1443,9 @@ static int jent_time_entropy_init(unsigned int enable_notime)
56+
ret = ESTUCK;
57+
58+
out:
59+
+ if (ec.mem != NULL)
60+
+ jent_zfree(ec.mem, JENT_MEMORY_SIZE);
61+
+
62+
if (enable_notime)
63+
jent_notime_unsettick(&ec);
64+
65+
--
66+
2.39.4
67+

SPECS/openssl/openssl.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
Summary: Utilities from the general purpose cryptography library with TLS implementation
55
Name: openssl
66
Version: 1.1.1k
7-
Release: 32%{?dist}
7+
Release: 33%{?dist}
88
License: OpenSSL
99
Vendor: Microsoft Corporation
1010
Distribution: Mariner
@@ -63,6 +63,7 @@ Patch39: openssl-1.1.1-add-null-checks-where-contentinfo-data-can-be-null
6363
Patch40: openssl-1.1.1-Fix-unconstrained-session-cache-growth-in-TLSv1.3.patch
6464
Patch41: openssl-1.1.1-pkcs1-implicit-rejection.patch
6565
Patch42: openssl-1.1.1-Only-free-the-read-buffers-if-we-re-not-using-them.patch
66+
Patch43: openssl-1.1.1-jitterentropy-fix-intermittent-fips-selftest-failure.patch
6667
BuildRequires: perl-Test-Warnings
6768
BuildRequires: perl-Text-Template
6869
BuildRequires: perl(FindBin)
@@ -178,6 +179,7 @@ cp %{SOURCE4} test/
178179
%patch40 -p1
179180
%patch41 -p1
180181
%patch42 -p1
182+
%patch43 -p1
181183

182184
%build
183185
# Add -Wa,--noexecstack here so that libcrypto's assembler modules will be
@@ -367,6 +369,9 @@ rm -f %{buildroot}%{_sysconfdir}/pki/tls/ct_log_list.cnf.dist
367369
%postun libs -p /sbin/ldconfig
368370

369371
%changelog
372+
* Tue Jul 16 2024 Tobias Brick <tobiasb@microsoft.com> - 1.1.1k-33
373+
- Fix intermittent FIPS selftest failures in jitterentropy module
374+
370375
* Tue Jun 04 2024 Tobias Brick <tobiasb@microsoft.com> - 1.1.1k-32
371376
- Only free the read buffers if we're not using them
372377

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -165,11 +165,11 @@ texinfo-6.8-1.cm2.aarch64.rpm
165165
gtk-doc-1.33.2-1.cm2.noarch.rpm
166166
autoconf-2.71-3.cm2.noarch.rpm
167167
automake-1.16.5-1.cm2.noarch.rpm
168-
openssl-1.1.1k-32.cm2.aarch64.rpm
169-
openssl-devel-1.1.1k-32.cm2.aarch64.rpm
170-
openssl-libs-1.1.1k-32.cm2.aarch64.rpm
171-
openssl-perl-1.1.1k-32.cm2.aarch64.rpm
172-
openssl-static-1.1.1k-32.cm2.aarch64.rpm
168+
openssl-1.1.1k-33.cm2.aarch64.rpm
169+
openssl-devel-1.1.1k-33.cm2.aarch64.rpm
170+
openssl-libs-1.1.1k-33.cm2.aarch64.rpm
171+
openssl-perl-1.1.1k-33.cm2.aarch64.rpm
172+
openssl-static-1.1.1k-33.cm2.aarch64.rpm
173173
libcap-2.60-2.cm2.aarch64.rpm
174174
libcap-devel-2.60-2.cm2.aarch64.rpm
175175
debugedit-5.0-2.cm2.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -165,11 +165,11 @@ texinfo-6.8-1.cm2.x86_64.rpm
165165
gtk-doc-1.33.2-1.cm2.noarch.rpm
166166
autoconf-2.71-3.cm2.noarch.rpm
167167
automake-1.16.5-1.cm2.noarch.rpm
168-
openssl-1.1.1k-32.cm2.x86_64.rpm
169-
openssl-devel-1.1.1k-32.cm2.x86_64.rpm
170-
openssl-libs-1.1.1k-32.cm2.x86_64.rpm
171-
openssl-perl-1.1.1k-32.cm2.x86_64.rpm
172-
openssl-static-1.1.1k-32.cm2.x86_64.rpm
168+
openssl-1.1.1k-33.cm2.x86_64.rpm
169+
openssl-devel-1.1.1k-33.cm2.x86_64.rpm
170+
openssl-libs-1.1.1k-33.cm2.x86_64.rpm
171+
openssl-perl-1.1.1k-33.cm2.x86_64.rpm
172+
openssl-static-1.1.1k-33.cm2.x86_64.rpm
173173
libcap-2.60-2.cm2.x86_64.rpm
174174
libcap-devel-2.60-2.cm2.x86_64.rpm
175175
debugedit-5.0-2.cm2.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -270,12 +270,12 @@ npth-1.6-4.cm2.aarch64.rpm
270270
npth-debuginfo-1.6-4.cm2.aarch64.rpm
271271
npth-devel-1.6-4.cm2.aarch64.rpm
272272
ntsysv-1.20-4.cm2.aarch64.rpm
273-
openssl-1.1.1k-32.cm2.aarch64.rpm
274-
openssl-debuginfo-1.1.1k-32.cm2.aarch64.rpm
275-
openssl-devel-1.1.1k-32.cm2.aarch64.rpm
276-
openssl-libs-1.1.1k-32.cm2.aarch64.rpm
277-
openssl-perl-1.1.1k-32.cm2.aarch64.rpm
278-
openssl-static-1.1.1k-32.cm2.aarch64.rpm
273+
openssl-1.1.1k-33.cm2.aarch64.rpm
274+
openssl-debuginfo-1.1.1k-33.cm2.aarch64.rpm
275+
openssl-devel-1.1.1k-33.cm2.aarch64.rpm
276+
openssl-libs-1.1.1k-33.cm2.aarch64.rpm
277+
openssl-perl-1.1.1k-33.cm2.aarch64.rpm
278+
openssl-static-1.1.1k-33.cm2.aarch64.rpm
279279
p11-kit-0.24.1-1.cm2.aarch64.rpm
280280
p11-kit-debuginfo-0.24.1-1.cm2.aarch64.rpm
281281
p11-kit-devel-0.24.1-1.cm2.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -276,12 +276,12 @@ npth-1.6-4.cm2.x86_64.rpm
276276
npth-debuginfo-1.6-4.cm2.x86_64.rpm
277277
npth-devel-1.6-4.cm2.x86_64.rpm
278278
ntsysv-1.20-4.cm2.x86_64.rpm
279-
openssl-1.1.1k-32.cm2.x86_64.rpm
280-
openssl-debuginfo-1.1.1k-32.cm2.x86_64.rpm
281-
openssl-devel-1.1.1k-32.cm2.x86_64.rpm
282-
openssl-libs-1.1.1k-32.cm2.x86_64.rpm
283-
openssl-perl-1.1.1k-32.cm2.x86_64.rpm
284-
openssl-static-1.1.1k-32.cm2.x86_64.rpm
279+
openssl-1.1.1k-33.cm2.x86_64.rpm
280+
openssl-debuginfo-1.1.1k-33.cm2.x86_64.rpm
281+
openssl-devel-1.1.1k-33.cm2.x86_64.rpm
282+
openssl-libs-1.1.1k-33.cm2.x86_64.rpm
283+
openssl-perl-1.1.1k-33.cm2.x86_64.rpm
284+
openssl-static-1.1.1k-33.cm2.x86_64.rpm
285285
p11-kit-0.24.1-1.cm2.x86_64.rpm
286286
p11-kit-debuginfo-0.24.1-1.cm2.x86_64.rpm
287287
p11-kit-devel-0.24.1-1.cm2.x86_64.rpm

0 commit comments

Comments
 (0)