openssl/openssl

OpenSSL 3.0: --with-rand-seed without effect

Closed

#21,631 opened on Aug 2, 2023

 (4 comments) (0 reactions) (0 assignees)C (11,262 forks)batch import
backlog fixbranch: 3.0branch: 3.1branch: 3.2branch: masterhelp wantedtriaged: bug

Repository metrics

Stars
 (30,157 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

I'm compiling OpenSSL with https://github.com/jart/cosmopolitan and configure openssl-3.0 as follows:

./config --with-rand-seed=getrandom no-asm no-shared no-dso no-engine -DPURIFY CC=/opt/cosmo/tool/scripts/cosmocc

Configure obviously recognizes this option and outputs:

Configuring OpenSSL version 3.0.11-dev for target linux-x86_64
Created configdata.pm
Running configdata.pm
Created Makefile.in
Created Makefile

**********************************************************************
***                                                                ***
***   OpenSSL has been successfully configured                     ***
***                                                                ***
***   If you encounter a problem while building, please open an    ***
***   issue on GitHub <https://github.com/openssl/openssl/issues>  ***
***   and include the output from the following command:           ***
***                                                                ***
***       perl configdata.pm --dump                                ***
***                                                                ***
***   (If you are new to OpenSSL, you might want to consult the    ***
***   'Troubleshooting' section in the INSTALL.md file first)      ***
***                                                                ***
**********************************************************************

However, running make does compile syscall_random without the following https://github.com/openssl/openssl/blob/a24eaa828354ea71f9f09a6f565b9228012aecaf/providers/implementations/rands/seeding/rand_unix.c#L400 This can be reproduced by simply adding an #error before that line.

Despite my configuration, it seems that the code is compiled so that it first tries to call getentropy() https://github.com/openssl/openssl/blob/a24eaa828354ea71f9f09a6f565b9228012aecaf/providers/implementations/rands/seeding/rand_unix.c#L363-L368 and then it errors here: https://github.com/openssl/openssl/blob/a24eaa828354ea71f9f09a6f565b9228012aecaf/providers/implementations/rands/seeding/rand_unix.c#L402-L403

Currently I changed the source code to delegate seeding to getrandom(), which works as expected. What is the correct way to specify the entropy source?

Contributor guide