1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227 | diff -Nru python3.5-3.5.1/debian/changelog python3.5-3.5.1/debian/changelog
--- python3.5-3.5.1/debian/changelog 2016-06-02 19:50:22.000000000 -0400
+++ python3.5-3.5.1/debian/changelog 2016-06-09 11:04:41.000000000 -0400
@@ -1,3 +1,11 @@
+python3.5 (3.5.1-13ubuntu1) yakkety; urgency=medium
+
+ * debian/patches/os-random-use-nonblock.diff:
+ Issue #26839: os.urandom() doesn't block on Linux anymore.
+ LP: #1584147.
+
+ -- Scott Moser <smoser@ubuntu.com> Thu, 09 Jun 2016 09:19:45 -0400
+
python3.5 (3.5.1-13) unstable; urgency=medium
* Update to 20160603 from the 3.5 branch.
diff -Nru python3.5-3.5.1/debian/control python3.5-3.5.1/debian/control
--- python3.5-3.5.1/debian/control 2016-05-09 07:55:20.000000000 -0400
+++ python3.5-3.5.1/debian/control 2016-06-09 09:21:02.000000000 -0400
@@ -1,7 +1,8 @@
Source: python3.5
Section: python
Priority: optional
-Maintainer: Matthias Klose <doko@debian.org>
+Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss@lists.ubuntu.com>
+XSBC-Original-Maintainer: Matthias Klose <doko@debian.org>
Build-Depends: debhelper (>= 9), dpkg-dev (>= 1.17.11),
quilt, autoconf,
lsb-release, sharutils,
diff -Nru python3.5-3.5.1/debian/patches/os-random-use-nonblock.diff python3.5-3.5.1/debian/patches/os-random-use-nonblock.diff
--- python3.5-3.5.1/debian/patches/os-random-use-nonblock.diff 1969-12-31 19:00:00.000000000 -0500
+++ python3.5-3.5.1/debian/patches/os-random-use-nonblock.diff 2016-06-09 09:24:46.000000000 -0400
@@ -0,0 +1,187 @@
+Description: os.urandom() doesn't block on Linux anymore
+Origin: https://hg.python.org/cpython/rev/9de508dc4837
+Bug-Ubuntu: https://bugs.launchpad.net/cloud-images/+bug/1584147
+Bug: http://bugs.python.org/issue26839
+
+# HG changeset patch
+# User Victor Stinner <victor.stinner@gmail.com>
+# Date 1465291302 -7200
+# Node ID 9de508dc48377128ee7b318a30a4023c7237148d
+# Parent de5b85f96266c2ea7104c200e4873e3d1ad045b5
+os.urandom() doesn't block on Linux anymore
+
+Issue #26839: On Linux, os.urandom() now calls getrandom() with GRND_NONBLOCK
+to fall back on reading /dev/urandom if the urandom entropy pool is not
+initialized yet. Patch written by Colm Buckley.
+
+--- a/Doc/library/os.rst
++++ b/Doc/library/os.rst
+@@ -3733,14 +3733,21 @@ Miscellaneous Functions
+
+ This function returns random bytes from an OS-specific randomness source. The
+ returned data should be unpredictable enough for cryptographic applications,
+- though its exact quality depends on the OS implementation. On a Unix-like
+- system this will query ``/dev/urandom``, and on Windows it will use
+- ``CryptGenRandom()``. If a randomness source is not found,
++ though its exact quality depends on the OS implementation.
++
++ On Linux, ``getrandom()`` syscall is used if available and the urandom
++ entropy pool is initialized (``getrandom()`` does not block).
++ On a Unix-like system this will query ``/dev/urandom``. On Windows, it
++ will use ``CryptGenRandom()``. If a randomness source is not found,
+ :exc:`NotImplementedError` will be raised.
+
+ For an easy-to-use interface to the random number generator
+ provided by your platform, please see :class:`random.SystemRandom`.
+
++ .. versionchanged:: 3.5.2
++ On Linux, if ``getrandom()`` blocks (the urandom entropy pool is not
++ initialized yet), fall back on reading ``/dev/urandom``.
++
+ .. versionchanged:: 3.5
+ On Linux 3.17 and newer, the ``getrandom()`` syscall is now used
+ when available. On OpenBSD 5.6 and newer, the C ``getentropy()``
+--- a/Misc/ACKS
++++ b/Misc/ACKS
+@@ -199,6 +199,7 @@ Ian Bruntlett
+ Floris Bruynooghe
+ Matt Bryant
+ Stan Bubrouski
++Colm Buckley
+ Erik de Bueger
+ Jan-Hein Bührman
+ Lars Buitinck
+--- a/Misc/NEWS
++++ b/Misc/NEWS
+@@ -128,6 +128,10 @@ Core and Builtins
+ Library
+ -------
+
++- Issue #26839: On Linux, :func:`os.urandom` now calls ``getrandom()`` with
++ ``GRND_NONBLOCK`` to fall back on reading ``/dev/urandom`` if the urandom
++ entropy pool is not initialized yet. Patch written by Colm Buckley.
++
+ - Issue #21776: distutils.upload now correctly handles HTTPError.
+ Initial patch by Claudiu Popa.
+
+--- a/Python/random.c
++++ b/Python/random.c
+@@ -6,6 +6,9 @@
+ # ifdef HAVE_SYS_STAT_H
+ # include <sys/stat.h>
+ # endif
++# ifdef HAVE_LINUX_RANDOM_H
++# include <linux/random.h>
++# endif
+ # ifdef HAVE_GETRANDOM
+ # include <sys/random.h>
+ # elif defined(HAVE_GETRANDOM_SYSCALL)
+@@ -122,9 +125,13 @@ py_getrandom(void *buffer, Py_ssize_t si
+ /* Is getrandom() supported by the running kernel?
+ * Need Linux kernel 3.17 or newer, or Solaris 11.3 or newer */
+ static int getrandom_works = 1;
+- /* Use non-blocking /dev/urandom device. On Linux at boot, the getrandom()
+- * syscall blocks until /dev/urandom is initialized with enough entropy. */
+- const int flags = 0;
++
++ /* getrandom() on Linux will block if called before the kernel has
++ * initialized the urandom entropy pool. This will cause Python
++ * to hang on startup if called very early in the boot process -
++ * see https://bugs.python.org/issue26839. To avoid this, use the
++ * GRND_NONBLOCK flag. */
++ const int flags = GRND_NONBLOCK;
+ int n;
+
+ if (!getrandom_works)
+@@ -168,6 +175,17 @@ py_getrandom(void *buffer, Py_ssize_t si
+ getrandom_works = 0;
+ return 0;
+ }
++ if (errno == EAGAIN) {
++ /* If we failed with EAGAIN, the entropy pool was
++ * uninitialized. In this case, we return failure to fall
++ * back to reading from /dev/urandom.
++ *
++ * Note: In this case the data read will not be random so
++ * should not be used for cryptographic purposes. Retaining
++ * the existing semantics for practical purposes. */
++ getrandom_works = 0;
++ return 0;
++ }
+
+ if (errno == EINTR) {
+ if (PyErr_CheckSignals()) {
+--- a/configure
++++ b/configure
+@@ -2869,6 +2869,7 @@ fi
+ ac_config_headers="$ac_config_headers pyconfig.h"
+
+
++
+ ac_aux_dir=
+ for ac_dir in "$srcdir" "$srcdir/.." "$srcdir/../.."; do
+ if test -f "$ac_dir/install-sh"; then
+@@ -7361,7 +7362,7 @@ sys/param.h sys/select.h sys/sendfile.h
+ sys/stat.h sys/syscall.h sys/sys_domain.h sys/termio.h sys/time.h \
+ sys/times.h sys/types.h sys/uio.h sys/un.h sys/utsname.h sys/wait.h pty.h \
+ libutil.h sys/resource.h netpacket/packet.h sysexits.h bluetooth.h \
+-bluetooth/bluetooth.h linux/tipc.h spawn.h util.h alloca.h endian.h \
++bluetooth/bluetooth.h linux/tipc.h linux/random.h spawn.h util.h alloca.h endian.h \
+ sys/endian.h
+ do :
+ as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
+@@ -16083,12 +16084,13 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_
+
+
+ #include <sys/syscall.h>
++ #include <linux/random.h>
+
+ int main() {
+ char buffer[1];
+ const size_t buflen = sizeof(buffer);
+- const int flags = 0;
+- /* ignore the result, Python checks for ENOSYS at runtime */
++ const int flags = GRND_NONBLOCK;
++ /* ignore the result, Python checks for ENOSYS and EAGAIN at runtime */
+ (void)syscall(SYS_getrandom, buffer, buflen, flags);
+ return 0;
+ }
+--- a/configure.ac
++++ b/configure.ac
+@@ -1886,7 +1886,7 @@ sys/param.h sys/select.h sys/sendfile.h
+ sys/stat.h sys/syscall.h sys/sys_domain.h sys/termio.h sys/time.h \
+ sys/times.h sys/types.h sys/uio.h sys/un.h sys/utsname.h sys/wait.h pty.h \
+ libutil.h sys/resource.h netpacket/packet.h sysexits.h bluetooth.h \
+-bluetooth/bluetooth.h linux/tipc.h spawn.h util.h alloca.h endian.h \
++bluetooth/bluetooth.h linux/tipc.h linux/random.h spawn.h util.h alloca.h endian.h \
+ sys/endian.h)
+ AC_HEADER_DIRENT
+ AC_HEADER_MAJOR
+@@ -5260,12 +5260,13 @@ AC_LINK_IFELSE(
+ AC_LANG_SOURCE([[
+ #include <unistd.h>
+ #include <sys/syscall.h>
++ #include <linux/random.h>
+
+ int main() {
+ char buffer[1];
+ const size_t buflen = sizeof(buffer);
+- const int flags = 0;
+- /* ignore the result, Python checks for ENOSYS at runtime */
++ const int flags = GRND_NONBLOCK;
++ /* ignore the result, Python checks for ENOSYS and EAGAIN at runtime */
+ (void)syscall(SYS_getrandom, buffer, buflen, flags);
+ return 0;
+ }
+--- a/pyconfig.h.in
++++ b/pyconfig.h.in
+@@ -546,6 +546,9 @@
+ /* Define to 1 if you have the <linux/tipc.h> header file. */
+ #undef HAVE_LINUX_TIPC_H
+
++/* Define to 1 if you have the <linux/random.h> header file. */
++#undef HAVE_LINUX_RANDOM_H
++
+ /* Define to 1 if you have the `lockf' function. */
+ #undef HAVE_LOCKF
+
diff -Nru python3.5-3.5.1/debian/patches/series python3.5-3.5.1/debian/patches/series
--- python3.5-3.5.1/debian/patches/series 2016-05-09 06:50:07.000000000 -0400
+++ python3.5-3.5.1/debian/patches/series 2016-06-09 09:15:45.000000000 -0400
@@ -40,3 +40,4 @@
pydoc-use-pager.diff
fix-sslv3-test.diff
idle-tk8.6.diff
+os-random-use-nonblock.diff
|