So, the implementation in libc seems to be deficient in some way.
Unfortunately, even after patching the libressl configure script to ignore the built-in arc4random* functions and provide its own workaround, the resulting libressl test programs and also httpd would still pick up the functions from libc. WTF! I am pretty sure there is some linker magic to make functions in libcrypto.so prefer their own workaround functions in the same library over the ones in libc.so, but I was unable to get this working
My workaround was to rename all arc4random* definitions and invocations in libressl to lssl_arc4random* (but not the header file names):
for i in $(find . -name *.c -o -name *.h|xargs fgrep -l arc4random); \
do sed -e"s/arc4random/lssl_arc4random/g" \
-e"s/lssl_arc4random\(.*\)\.h/arc4random\1.h/" \
$i >${i}.new && mv ${i}.new $i; \
done
and then patch configure like this:
diff -ur libressl-2.4.2~/configure libressl-2.4.2/configure
--- libressl-2.4.2~/configure 2016-08-01 01:08:09.000000000 +0000
+++ libressl-2.4.2/configure 2016-09-13 15:44:04.520419814 +0000
@@ -12169,6 +12169,7 @@
HOST_ABI=elf
CPPFLAGS="$CPPFLAGS -D__EXTENSIONS__ -D_XOPEN_SOURCE=600 -DBSD_COMP"
PLATFORM_LDADD='-lnsl -lsocket'
+ USE_BUILTIN_ARC4RANDOM=yes
;;
*) ;;
@@ -13137,6 +13138,7 @@
+if test "x$USE_BUILTIN_ARC4RANDOM" != xyes; then
# Check crypto-related libc functions and syscalls
for ac_func in arc4random arc4random_buf arc4random_uniform
do :
@@ -13149,6 +13151,7 @@
fi
done
+fi
for ac_func in explicit_bzero getauxval getentropy
do :
@@ -13231,17 +13234,6 @@
fi
-# Override arc4random_buf implementations with known issues
- if test "x$USE_BUILTIN_ARC4RANDOM" != xyes \
- -a "x$ac_cv_func_arc4random_buf" = xyes; then
- HAVE_ARC4RANDOM_BUF_TRUE=
- HAVE_ARC4RANDOM_BUF_FALSE='#'
-else
- HAVE_ARC4RANDOM_BUF_TRUE='#'
- HAVE_ARC4RANDOM_BUF_FALSE=
-fi
-
-
# Check for getentropy fallback dependencies
ac_fn_c_check_func "$LINENO" "getauxval" "ac_cv_func_getauxval"
if test "x$ac_cv_func_getauxval" = xyes; then :
Another thing (unrelated to the above problem) I am doing post-installation is:
for i in ${PREFIX}/lib/pkgconfig/*.pc;\
do sed -e"s/-L\${libdir}/-L\${libdir} -R\${libdir}/" $i >${i}.x && mv ${i}.x $i;\
done
where ${PREFIX} is your installation directory. This makes applications linking to libressl include an explicit run-time link path to their linking commands (i hate LD_LIBRARY_PATH).
