Created attachment 175879 [details] Patch to replace RAND_SSLeay by arc4random_buf if LibreSSL is detected When using data encryption at rest on MariaDB built with LibreSSL like described here https://mariadb.com/kb/en/mariadb/data-at-rest-encryption/ the following error occurs and mysql-server won't start: 2016-10-17 17:45:32 34426872832 [ERROR] InnoDB: Redo log crypto: generate 16-byte random number as crypto msg failed. 2016-10-17 17:45:32 804006400 InnoDB: Assertion failure in thread 34426872832 in file log0crypt.cc line 379 This is due to my_random_bytes using OpenSSL's deprecated RAND_* functions, which exist in LibreSSL for ABI compatibility, but have been disabled, see also: http://man.openbsd.org/OpenBSD-current/man3/RAND_set_rand_method.3 and the implementation of RAND_SSLeay here: https://github.com/libressl/libressl/blob/master/src/crypto/rand/rand_lib.c#L36 The attached patch fixes this by replacing the random function with arc4random_buf (which AFAIK should be non-blocking and should always be preferred). Right now the fix is only applied if LibreSSL is detected. I feel like it would be better to always use arc4random on *BSD and push that fix upstream, but this might require a lot more effort and discussion than just fixing it in the FreeBSD ports tree and for LibreSSL. p.s. I created and tested the patch on 10.1.17, which was the current version until like 90 minutes ago, but it should apply and build cleanly anyway.
As I didn't hear back in two and I think this covered by the SSL blanket approval anyway, I'll go ahead and commit it myself.
A commit references this bug: Author: grembo Date: Sat Nov 5 16:56:01 UTC 2016 New revision: 425398 URL: https://svnweb.freebsd.org/changeset/ports/425398 Log: Fix data encryption at rest when building with LibreSSL Replace RAND_SSLeay->bytes with arc4random_buf when using LibreSSL, as it supports RAND_SSLeay only for ABI compatibility [0]. Note that the code in question in mariadb mentions that RAND_bytes isn't guaranteed to not block and therefore uses these functions directly. As LibreSSL implements RAND_bytes in terms of arc4random_buf, which shouldn't block, the patch could also use RAND_bytes instead of using arc4random_buf directly, but the current version of the patch has been tested in production and might be less confusing overall. Bumped revision, as this fixes a runtime problem. [0] https://github.com/libressl/libressl/blob/master/src/crypto/rand/rand_lib.c#L36 PR: 213577 Approved by: ssl blanket Changes: head/databases/mariadb101-server/Makefile head/databases/mariadb101-server/files/patch-mysys_ssl-my_crypt.cc
A commit references this bug: Author: brnrd Date: Sat Nov 12 00:49:05 UTC 2016 New revision: 425917 URL: https://svnweb.freebsd.org/changeset/ports/425917 Log: MFH: r424132 r425398 r425916 databases/mariadb101-server: Update to 10.1.18 - Regular update to 10.1.18 Fix data encryption at rest when building with LibreSSL Replace RAND_SSLeay->bytes with arc4random_buf when using LibreSSL, as it supports RAND_SSLeay only for ABI compatibility [0]. Note that the code in question in mariadb mentions that RAND_bytes isn't guaranteed to not block and therefore uses these functions directly. As LibreSSL implements RAND_bytes in terms of arc4random_buf, which shouldn't block, the patch could also use RAND_bytes instead of using arc4random_buf directly, but the current version of the patch has been tested in production and might be less confusing overall. Bumped revision, as this fixes a runtime problem. [0] https://github.com/libressl/libressl/blob/master/src/crypto/rand/rand_lib.c#L36 PR: 213577 Approved by: ssl blanket databases/mariadb101-server: Update to 10.1.19 - Update to 10.1.19 - Use target-OPT-on not .if exists - Remove OQGraph patches now included upstream PR: 213902 Security: 9bc14850-a070-11e6-a881-b499baebfeaf Approved by: ports-secteam (junovitch) Changes: _U branches/2016Q4/ branches/2016Q4/databases/mariadb101-server/Makefile branches/2016Q4/databases/mariadb101-server/distinfo branches/2016Q4/databases/mariadb101-server/files/patch-mysys_ssl-my_crypt.cc branches/2016Q4/databases/mariadb101-server/files/patch-storage_oqgraph_graphcore.cc branches/2016Q4/databases/mariadb101-server/files/patch-storage_oqgraph_oqgraph__shim.h