[PATCH] libosmocore[master]: Enable GnuTLS fallback

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.

Max gerrit-no-reply at lists.osmocom.org
Wed Nov 1 12:02:11 UTC 2017


Hello Jenkins Builder,

I'd like you to reexamine a change.  Please visit

    https://gerrit.osmocom.org/4593

to look at the new patch set (#6).

Enable GnuTLS fallback

On systems with GNU/Linux kernel older than 3.17 (Debian 8 "jessie" for
example) the osmo_get_rand_id() would always return failure due to
missing getrandom() syscall.

To support such systems, let's add fallback code which uses GnuTLS
library. It can be disabled explicitly via '--disable-gnutls' option at
compile-time, otherwise ./configure will fail if both getrandom() and
GnuTLS are not available. When building with '--enable-embedded' the
fallback is disabled automatically.

N. B: the fallback is purely compile-time - the syscall and GnuTLS
availability is checked at compile-time and appropriate code is compiled
in. There's no runtime check.

Related: OS#1694

Change-Id: Ic77866ce65acf524b768882c751a4f9c0635740b
---
M configure.ac
M src/gsm/Makefile.am
M src/gsm/gsm_utils.c
3 files changed, 45 insertions(+), 0 deletions(-)


  git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/93/4593/6

diff --git a/configure.ac b/configure.ac
index d9390cf..a8c1d2e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -130,6 +130,20 @@
 AM_CONDITIONAL(ENABLE_PCSC, test "x$ENABLE_PCSC" = "xyes")
 AC_SUBST(ENABLE_PCSC)
 
+AC_ARG_ENABLE([gnutls], [AS_HELP_STRING([--disable-gnutls], [Do not use GnuTLS fallback for missing getrandom()])],
+	[ENABLE_GNUTLS=$enableval], [ENABLE_GNUTLS="yes"])
+AM_CONDITIONAL(ENABLE_GNUTLS, test x"$ENABLE_GNUTLS" = x"yes")
+AS_IF([test "x$ENABLE_GNUTLS" = "xyes"], [
+	PKG_CHECK_MODULES([LIBGNUTLS], [gnutls >= 2.12.0])
+])
+AC_SUBST(ENABLE_GNUTLS)
+if test x"$ENABLE_GNUTLS" = x"yes"
+then
+	AC_SUBST([LIBGNUTLS_CFLAGS])
+	AC_SUBST([LIBGNUTLS_LIBS])
+	AC_DEFINE([USE_GNUTLS], [1], [Use GnuTLS as a fallback for missing getrandom()])
+fi
+
 AC_ARG_ENABLE(plugin,
 	[AS_HELP_STRING(
 		[--disable-plugin],
@@ -228,12 +242,15 @@
 	AM_CONDITIONAL(ENABLE_PLUGIN, false)
 	AM_CONDITIONAL(ENABLE_MSGFILE, false)
 	AM_CONDITIONAL(ENABLE_SERIAL, false)
+	AM_CONDITIONAL(ENABLE_GNUTLS, false)
 	AM_CONDITIONAL(ENABLE_VTY, false)
 	AM_CONDITIONAL(ENABLE_CTRL, false)
 	AM_CONDITIONAL(ENABLE_UTILITIES, false)
 	AM_CONDITIONAL(ENABLE_GB, false)
+	AM_CONDITIONAL(ENABLE_GNUTLS, false)
 	AM_CONDITIONAL(ENABLE_PCSC, false)
 	AM_CONDITIONAL(ENABLE_PSEUDOTALLOC, true)
+	AC_DEFINE([USE_GNUTLS], [0])
 	AC_DEFINE([PANIC_INFLOOP],[1],[Use infinite loop on panic rather than fprintf/abort])
 fi
 
diff --git a/src/gsm/Makefile.am b/src/gsm/Makefile.am
index 4476971..12f56db 100644
--- a/src/gsm/Makefile.am
+++ b/src/gsm/Makefile.am
@@ -38,6 +38,11 @@
 libosmogsm_la_LDFLAGS = $(LTLDFLAGS_OSMOGSM) -version-info $(LIBVERSION) -no-undefined
 libosmogsm_la_LIBADD = libgsmint.la $(TALLOC_LIBS)
 
+if ENABLE_GNUTLS
+AM_CPPFLAGS += $(LIBGNUTLS_CFLAGS)
+libosmogsm_la_LIBADD += $(LIBGNUTLS_LIBS)
+endif
+
 EXTRA_DIST = libosmogsm.map
 
 # Convolutional codes generation
diff --git a/src/gsm/gsm_utils.c b/src/gsm/gsm_utils.c
index e3f792e..627c79a 100644
--- a/src/gsm/gsm_utils.c
+++ b/src/gsm/gsm_utils.c
@@ -104,6 +104,10 @@
 #ifndef GRND_NONBLOCK
 #define GRND_NONBLOCK 0x0001
 #endif
+#elif (USE_GNUTLS)
+#pragma message ("Secure random unavailable: including GnuTLS.")
+#include <gnutls/gnutls.h>
+#include <gnutls/crypto.h>
 #endif
 
 /* ETSI GSM 03.38 6.2.1 and 6.2.1.1 default alphabet
@@ -415,14 +419,33 @@
 	if (len > OSMO_MAX_RAND_ID_LEN)
                return -E2BIG;
 
+	/* The conditional compile below is necessary to support legacy systems:
+	 1) On systems with recent enough glibc (>= 2.25) we use it and the rest is not compiled in
+	 2) On systems with old glibc but with recent enough kernel (>=3.17) we use syscall directly
+	 3) On systems with older kernel we check for GnuTLS fallback availability
+	 3a) If it's available at compile time - use it
+	 3b) Otherwise just return failure
+	 FIXME:
+	 * Once we do not have to support old kernels, 3a can be removed
+	 * Once we do not have to support old glibc, 2 and 3 can be removed */
 #if defined(__GLIBC__) && (__GLIBC__ >= 2) && (__GLIBC_MINOR__ >= 25)
+	/* 1) "main" branch (i. e. <if>) of conditional compile ifdef: use glibc */
 	rc = getrandom(out, len, GRND_NONBLOCK);
 #elif HAVE_DECL_SYS_GETRANDOM
+	/* 2) "alternative" branch (i. e. <else if>) of conditional compile ifdef: use syscall */
 #pragma message ("Using direct syscall access for getrandom(): consider upgrading to glibc >= 2.25")
 	/* FIXME: this can be removed once we bump glibc requirements to 2.25: */
 	rc = syscall(SYS_getrandom, out, len, GRND_NONBLOCK);
 #else
+	/* 3) "final" branch (i. e. <else>) of conditional compile ifdef: use fallback (if available) */
+#if (USE_GNUTLS)
+#pragma message ("Secure random unavailable: using GnuTLS fallback.")
+	/* 3a) GnuTLS is available - use it as fallback */
+	return gnutls_rnd(GNUTLS_RND_RANDOM, out, len);
+#else
 #pragma message ("Secure random unavailable: calls to osmo_get_rand_id() will always fail!")
+#endif
+	/* 3b) All other options exhausted - fail. */
 	return -ENOTSUP;
 #endif
 	/* getrandom() failed entirely: */

-- 
To view, visit https://gerrit.osmocom.org/4593
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Ic77866ce65acf524b768882c751a4f9c0635740b
Gerrit-PatchSet: 6
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Owner: Max <msuraev at sysmocom.de>
Gerrit-Reviewer: Harald Welte <laforge at gnumonks.org>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: Max <msuraev at sysmocom.de>



More information about the gerrit-log mailing list