Commit Graph

109 Commits

Author SHA1 Message Date
Gustavo Zacarias
58d3978e4e openssl: add fix for hash cryptodev offloading
See http://rt.openssl.org/Ticket/Display.html?id=2770&user=guest&pass=guest
This has been sitting for ages in the openssl tracker and it's verified
to cause issues.
The patch only touches cryptodev engine offloading so it's pretty safe.
Tested on CAAM SEC4 hardware.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-08-09 10:07:15 +02:00
Gustavo Zacarias
5dd65f2635 openssl: security bump to version 1.0.1i
Fixes:
CVE-2014-3508 - Information leak in pretty printing functions
CVE-2014-5139 - Crash with SRP ciphersuite in Server Hello message
CVE-2014-3509 - Race condition in ssl_parse_serverhello_tlsext
CVE-2014-3505 - Double Free when processing DTLS packets
CVE-2014-3506 - DTLS memory exhaustion
CVE-2014-3507 - DTLS memory leak from zero-length fragments
CVE-2014-3510 - OpenSSL DTLS anonymous EC(DH) denial of service
CVE-2014-3511 - OpenSSL TLS protocol downgrade attack
CVE-2014-3512 - SRP buffer overrun

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Tested-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-08-07 22:13:14 +02:00
Gustavo Zacarias
c130c5d463 openssl: drop libdl from pc file
Fixes:
http://autobuild.buildroot.net/results/2a2/2a274e2dbffd268a391b0e8a15dae5a759b870a1/

[Thomas: move registration of the hook inside the condition.]

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-07-19 18:06:19 +02:00
Baruch Siach
5e00a5e3a9 openssl: security bump to version 1.0.1h
Fixes CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198 among others.
See https://www.openssl.org/news/secadv_20140605.txt for details.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-06-05 21:26:30 +02:00
Cody P Schafer
7e674dfa4f powerpc: add powerpc64 and powerpc64le support
This enables powerpc64 and powerpc64le. Currently, le needs at least
glibc 2.19 and gcc 4.9.0. For gdb, 7.7.1 works (added in an earlier
patch).

[Peter: also disallow gcc 4.8 for ppc64le]
Signed-off-by: Cody P Schafer <cody@linux.vnet.ibm.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-05-26 21:48:33 +02:00
Baruch Siach
ab39c1b47c openssl: bump to version 1.0.1g
Fixes highly critical CVE-2014-0160. See http://heartbleed.com .

Drop patch applied upstream.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-04-08 08:53:09 +02:00
Gustavo Zacarias
e85696b9bf openssl: fix bug #6770
openssl 1.0.1f Makefile.org doesn't quote $(CC) when passing the
parameter in another invocation of make, hence breaking when the
compiler string contains a space with multiple strings (for example with
ccache).

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-01-10 15:40:21 +01:00
Gustavo Zacarias
757690a262 openssl: bump to version 1.0.1f
Fixes CVE-2013-4343, CVE-2013-6450 and the previously patched
CVE-2013-6449.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-01-07 17:25:04 +01:00
Gustavo Zacarias
27a7ab51e3 openssl: add fix for CVE-2013-6449
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-01-03 20:45:29 +01:00
Thomas De Schampheleire
35eaed8d07 Config.in files: use if/endif instead of 'depends on' for main symbol
In the Config.in file of package foo, it often happens that there are other
symbols besides BR2_PACKAGE_FOO. Typically, these symbols only make sense
when foo itself is enabled. There are two ways to express this: with
    depends on BR2_PACKAGE_FOO
in each extra symbol, or with
    if BR2_PACKAGE_FOO
        ...
    endif
around the entire set of extra symbols.

The if/endif approach avoids the repetition of 'depends on' statements on
multiple symbols, so this is clearly preferred. But even when there is only
one extra symbol, if/endif is a more logical choice:
- it is future-proof for when extra symbols are added
- it allows to have just one strategy instead of two (less confusion)

This patch modifies the Config.in files accordingly.

Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2013-12-25 12:21:39 +01:00
Thomas De Schampheleire
eb7bd9ef61 packages: remove uninstall commands
Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2013-12-06 09:40:40 +01:00
Yann E. MORIN
a17ec1645d package/openssl: fix coding style
Currently, openssl defines three conditional hooks, but two do not
follow our coding rules:
  - for PRE_CONFIGURE, the hook is defined in the if-block, but
    the _HOOK variable is always set
  - for POST_INSTALL_TARGET, the hook is always defined, but the
    _HOOK variable is set in the if-block

Fix that:
  - define the hook in the if-block
  - assign the _HOOK variable in the if-block

At the same time, get rid of extra empty lines that make it more
difficult to read.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2013-12-06 00:10:09 +01:00
Peter Korsgaard
43becdba4c openssl: only build threads configuration if toolchain has pthread support
Gets rid of a large number of warnings (and suboptimal code?):

..sysroot/usr/include/features.h:209:5: warning: #warning requested
reentrant code, but thread support was disabled [-Wcpp]

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2013-11-22 22:44:54 +01:00
Gustavo Zacarias
467b8d1f69 openssl: don't build tests
These require shared libraries and we save a tiny amount of build time.
Fixes:
http://autobuild.buildroot.net/results/88e/88e5e07e94e49879907186ff35ce66944f867ec2/

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2013-08-23 20:41:54 +02:00
Thomas Petazzoni
12d1aa4b69 Remove BR2_HAVE_DEVFILES
This finally removes the BR2_HAVE_DEVFILES option, that was used to
install/keep development files on target. With the recent migration of
the internal backend to the package infrastructure, we had anyway lost
the ability to build gcc for the target, and install the uClibc
development files on the target.

[Peter: also remove support/scripts/copy.sh]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2013-07-04 09:06:33 +02:00
Alexandre Belloni
8dfd59d114 Normalize separator size to 80
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2013-06-06 22:30:24 +02:00
Arnout Vandecappelle (Essensium/Mind)
6a77344162 openssl: fix host-openssl dependencies
Support for ocf-linux or cryptodev-linux added a dependency of host-openssl
on host-ocf-linux / host-cryptodev-linux, which we don't have and the
dependency is anyway not needed.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2013-05-12 21:10:25 +02:00
Gustavo Zacarias
c714dba577 openssl: integrate variable cryptodev support
Allow openssl to use cryptodev-linux hardware crypto support besides
OCF.
To do this we remove the OCF option from openssl and automatically use
any of the available implementations when available.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2013-05-05 23:00:12 +02:00
Gustavo Zacarias
7842789cb5 openssl: add host variant
Useful for the upcoming host-python-m2crypto package.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2013-04-17 23:00:21 +02:00
Gustavo Zacarias
1b7f398dbb openssl: adjust ARM optimizations
We no longer support ARM less than v4 so just kill dead code that we had
for those cases.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2013-04-11 09:25:51 +02:00
Gustavo Zacarias
0ff2d0f74b openssl: bump to version 1.0.1e
Fixes some regressions introduced by 1.0.1d

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2013-02-18 13:15:17 +01:00
Gustavo Zacarias
ae27c45568 openssl: security bump to version 1.0.1d
Fixes CVE-2013-0169, CVE-2012-2686 and CVE-2013-0166.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2013-02-05 17:17:31 +01:00
Peter Korsgaard
a3671a3f25 openssl: fix static build
Just use the default target instead of hardcoding shared library support.

Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-12-16 10:49:01 +01:00
Gustavo Zacarias
85736773fa openssl: fix runtime failure on some powerpc variants
OpenSSL's assembly optimizations por PowerPC seem to be broken for at
least 4xx cores.
Thanks go to Jan Schunke for reporting and testing.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-12-10 22:29:03 +01:00
Gustavo Zacarias
720893b625 openssl: disable apps for NOMMU
The openssl binary uses fork() so disable the option and build for !MMU.
Fixes
http://autobuild.buildroot.net/results/45a9b84c16caadbf77b6fc43d7a0001c981a4c87/build-end.log

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-10-22 20:53:15 +02:00
Peter Korsgaard
32a0454d3c Merge branch 'next'
Conflicts:
	package/e2fsprogs/e2fsprogs.mk
	package/libfuse/libfuse.mk
	package/multimedia/mpd/mpd.mk
	package/smartmontools/smartmontools.mk

Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-09-03 21:59:03 +02:00
Gustavo Zacarias
f3c33a354b openssl: bump to version 1.0.1c
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2012-08-24 23:28:26 +02:00
Danomi Manchego
9e6ab3600f openssl: add license info
Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2012-08-15 12:03:44 +02:00
Arnout Vandecappelle (Essensium/Mind)
e1502ebc0c all packages: rename XXXTARGETS to xxx-package
Also remove the redundant $(call ...).

This is a purely mechanical change, performed with
find package linux toolchain boot -name \*.mk | \
  xargs sed -i -e 's/$(eval $(call GENTARGETS))/$(eval $(generic-package))/' \
               -e 's/$(eval $(call AUTOTARGETS))/$(eval $(autotools-package))/' \
               -e 's/$(eval $(call CMAKETARGETS))/$(eval $(cmake-package))/'

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2012-07-17 20:23:05 +02:00
Peter Korsgaard
d8c630d539 openssl: fix static build
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-07-01 23:59:29 +02:00
Gustavo Zacarias
b108e9b5dd openssl: security bump to version 1.0.0j
Bump to version 1.0.0j to fix CVE-2012-2333

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-05-14 14:36:17 +02:00
Gustavo Zacarias
30a246be8b openssl: switch to the ocf-linux package
Remove builtin OCF support from the openssl package into a new package.
Even though ocf support is just a header file we'd rather have it in a
separate package because of unrelated version bumps and to fetch it from
source.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-05-05 16:21:49 +02:00
Gustavo Zacarias
776f0b441d openssl: security bump to version 1.0.0i
Fix for CVE-2012-2110

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-04-19 20:44:50 +02:00
Gustavo Zacarias
94b3f6064a openssl: security bump to version 1.0.0h
Bump to version 1.0.0h to fix CMS and S/MIME Bleichenbacher attack (CVE-2012-0884)

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-03-15 23:33:52 +01:00
Gustavo Zacarias
6d8abaf9f1 openssl: security bump to version 1.0.0g
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-01-22 21:45:09 +01:00
Gustavo Zacarias
19f280c311 openssl: security bump to version 1.0.0f
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2012-01-06 11:03:50 +01:00
Thomas Petazzoni
0849e8193e package: remove useless arguments from GENTARGETS
Thanks to the pkgparentdir and pkgname functions, we can rewrite the
GENTARGETS macro in a way that avoids the need for each package to
repeat its name and the directory in which it is present.

[Peter: pkgdir->pkgparentdir]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2011-09-29 23:09:58 +02:00
Yegor Yefremov
a50f6ef29e openssl: bump to 1.0.0e
Changes between 1.0.0d and 1.0.0e [6 Sep 2011]

  *) Fix bug where CRLs with nextUpdate in the past are sometimes accepted
     by initialising X509_STORE_CTX properly. (CVE-2011-3207)
     [Kaspar Brand <ossl@velox.ch>]

  *) Fix SSL memory handling for (EC)DH ciphersuites, in particular
     for multi-threaded use of ECDH. (CVE-2011-3210)
     [Adam Langley (Google)]

  *) Fix x509_name_ex_d2i memory leak on bad inputs.
     [Bodo Moeller]

  *) Remove hard coded ecdsaWithSHA1 signature tests in ssl code and check
     signature public key algorithm by using OID xref utilities instead.
     Before this you could only use some ECC ciphersuites with SHA1 only.
     [Steve Henson]

  *) Add protection against ECDSA timing attacks as mentioned in the paper
     by Billy Bob Brumley and Nicola Tuveri, see:

	http://eprint.iacr.org/2011/232.pdf

     [Billy Bob Brumley and Nicola Tuveri]

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Acked-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2011-09-13 00:17:15 +02:00
Gustavo Zacarias
47736c88c3 openssl: fix compilation for i386
Closes #3445.

OpenSSL emits bswap instructions when building for i386 targets which
unfortunately is only available on 486+ class processors.
Since the normal workaround is detected at build time and we are cross
compiling we need to specify this.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2011-04-01 21:56:21 +02:00
Gustavo Zacarias
d17c165280 openssl: fix libdir issue
Closes #3205

OpenSSL's build system tries to be too wise for it's own good when
guessing what libdir should be.
This causes problems like the one reported in bug #3205 so just specify
libdir to point to /lib (since it's prefixed it would finally be
/usr/lib) since it should be present on 32 and 64 bit targets.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2011-02-23 23:31:49 +01:00
Gustavo Zacarias
68bb70ce5a openssl: security bump to 1.0.0d
CVE-2011-0014
http://www.openssl.org/news/secadv_20110208.txt

OCSP stapling vulnerability in OpenSSL

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2011-02-09 22:50:49 +01:00
Gustavo Zacarias
7b9faa03ee openssl: add ocf support
Enable OCF (cryptodev) support for openssl as an option.

This requires a patched kernel to export hardware acceleration for
openssl to use it.
If you lack a patched kernel or support it won't break anything, it will
simply fall back to the default software engine from openssl, you'll
just have a slightly bigger libssl/libcrypto.

Tested with 20100325 release + 20101223 patch from the mailing list.

[Peter: slightly tweaked .mk]
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2011-01-17 22:00:08 +01:00
Gustavo Zacarias
a01ee272fe openssl: security bump to version 1.0.0c
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2010-12-11 02:25:21 +01:00
Gustavo Zacarias
9df0952493 openssl: security bump to version 1.0.0b
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2010-11-19 15:46:37 +01:00
Gustavo Zacarias
567eee4f54 openssl: Bump to 1.0.0a
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2010-10-18 11:18:12 +02:00
Thomas Petazzoni
97d8618c6c Remove code specific to removed architectures
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2010-08-31 20:28:21 +02:00
Thomas Petazzoni
9d6610f58f openssl: don't override the CC passed at configure time
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2010-07-07 08:14:42 +02:00
Gustavo Zacarias
3dbc86f098 openssl: bump version, enable mdc2+camellia+tlsext
Closes #1951

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2010-06-06 23:15:29 +02:00
Thomas Petazzoni
c9a06efff3 openssl: convert to the generic infrastructure
OpenSSL is not using the autotools as its build system. Therefore, we
must use the generic infrastructure instead of the autotools one.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2010-05-02 23:26:11 +02:00
Peter Korsgaard
65e209ca07 openssl: fix build without ipv6 support
Closes #1567

Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2010-04-15 16:26:15 +02:00