ExternalVendorCode/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2024-12-30 10:39:04 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity
aef8bab9d7
openwrt/package/libs/mbedtls/Makefile

163 lines
4.6 KiB
Makefile
Raw Normal View History

cosmetic: remove trailing whitespaces Signed-off-by: Luka Perkov <luka@openwrt.org> SVN-Revision: 47197
2015-10-15 22:12:13 +00:00
#
mbedtls: package version 2.0, make polarssl compatible Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46484
2015-07-24 22:26:44 +00:00
# Copyright (C) 2011-2015 OpenWrt.org
#
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.
#
include $(TOPDIR)/rules.mk
PKG_NAME:=mbedtls
mbedtls: update to version 2.28.2 Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.2 This release of Mbed TLS provides bug fixes and minor enhancements. This release includes fixes for security issues. Fixes the following CVEs: * CVE-2022-46393: Fix potential heap buffer overread and overwrite in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX. * CVE-2022-46392: An adversary with access to precise enough information about memory accesses (typically, an untrusted operating system attacking a secure enclave) could recover an RSA private key after observing the victim performing a single private-key operation if the window size used for the exponentiation was 3 or smaller. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2022-12-29 20:26:28 +00:00
PKG_VERSION:=2.28.2
mbedtls: x509 crt verify SAN iPAddress backport from X509 crt verify SAN iPAddress https://github.com/Mbed-TLS/mbedtls/pull/6475 addresses curl built with mbedtls fails on https://1.1.1.1/ (IP address in SubjectAltName) https://github.com/Mbed-TLS/mbedtls/issues/6473 filed for mbedTLS: BADCERT_CN_MISMATCH on https://1.1.1.1 with curl+mbedtls https://github.com/openwrt/packages/issues/19677 Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
2022-10-28 02:26:48 +00:00
PKG_RELEASE:=2
treewide: add support for "gc-sections" in PKG_BUILD_FLAGS This reduces open coding and allows to easily add a knob to enable it treewide, where chosen packages can still opt-out via "no-gc-sections". Note: libnl, mbedtls and opkg only used the CFLAGS part without the LDFLAGS counterpart. That doesn't help at all if the goal is to produce smaller binaries. I consider that an accident, and this fixes it. Note: there are also packages using only the LDFLAGS part. I didn't touch those, as gc might have been disabled via CFLAGS intentionally. Signed-off-by: Andre Heider <a.heider@gmail.com>
2023-02-02 20:16:21 +00:00
PKG_BUILD_FLAGS:=no-mips16 gc-sections
mbedtls: package version 2.0, make polarssl compatible Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46484
2015-07-24 22:26:44 +00:00
mbedtls: update to 2.16.7 Mbed TLS 2.16.7 is a maintenance release of the Mbed TLS 2.16 branch, and provides bug fixes and minor enhancements. This release includes fixes for security issues and the most severe one is described in more detail in a security advisory: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-07 * Fix a side channel vulnerability in modular exponentiation that could reveal an RSA private key used in a secure enclave. * Fix side channel in mbedtls_ecp_check_pub_priv() and mbedtls_pk_parse_key() / mbedtls_pk_parse_keyfile() (when loading a private key that didn't include the uncompressed public key), as well as mbedtls_ecp_mul() / mbedtls_ecp_mul_restartable() when called with a NULL f_rng argument. An attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave) could fully recover the ECC private key. * Fix issue in Lucky 13 counter-measure that could make it ineffective when hardware accelerators were used (using one of the MBEDTLS_SHAxxx_ALT macros). Due to Mbed TLS moving from ARMmbed to the Trusted Firmware project, some changes to the download URLs are required. For the time being, the ARMmbed/mbedtls Github repository is the canonical source for Mbed TLS. Signed-off-by: Magnus Kroken <mkroken@gmail.com> [Use https://codeload.github.com and new tar.gz file] Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2020-07-25 12:19:28 +00:00
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/ARMmbed/mbedtls/tar.gz/v$(PKG_VERSION)?
mbedtls: update to version 2.28.2 Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.2 This release of Mbed TLS provides bug fixes and minor enhancements. This release includes fixes for security issues. Fixes the following CVEs: * CVE-2022-46393: Fix potential heap buffer overread and overwrite in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX. * CVE-2022-46392: An adversary with access to precise enough information about memory accesses (typically, an untrusted operating system attacking a secure enclave) could recover an RSA private key after observing the victim performing a single private-key operation if the window size used for the exponentiation was 3 or smaller. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2022-12-29 20:26:28 +00:00
PKG_HASH:=bc55232bf71fd66045122ba9050a29ea7cb2e8f99b064a9e6334a82f715881a0
mbedtls: package version 2.0, make polarssl compatible Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46484
2015-07-24 22:26:44 +00:00
mbedtls: use correct SPDX License Identifier and add License file License "GPL-2.0+" is deprecated License Identifier according to SPDX License list [1]. The correct one is GPL-2.0-or-later. While at it, also add the License file. [1] https://spdx.org/licenses/ Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2020-02-22 22:03:37 +00:00
PKG_LICENSE:=GPL-2.0-or-later
PKG_LICENSE_FILES:=gpl-2.0.txt
add PKG_CPE_ID ids to package and tools CPE ids helps to tracks CVE in packages. https://cpe.mitre.org/specification/ Thanks to swalker for CPE to package mapping and keep tracking CVEs. Acked-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
2017-09-28 02:55:46 +00:00
PKG_CPE_ID:=cpe:/a:arm:mbed_tls
mbedtls: package version 2.0, make polarssl compatible Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46484
2015-07-24 22:26:44 +00:00
libmbedtls: build option submenu menuconfig libmbedtls build option submenu Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
2022-10-20 20:22:01 +00:00
MBEDTLS_BUILD_OPTS_CURVES= \
CONFIG_MBEDTLS_ECP_DP_SECP192R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP224R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP384R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP521R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP192K1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP224K1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP256K1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_BP256R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_BP384R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_BP512R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_CURVE25519_ENABLED \
CONFIG_MBEDTLS_ECP_DP_CURVE448_ENABLED
MBEDTLS_BUILD_OPTS_CIPHERS= \
CONFIG_MBEDTLS_AES_C \
CONFIG_MBEDTLS_CAMELLIA_C \
CONFIG_MBEDTLS_CCM_C \
CONFIG_MBEDTLS_CMAC_C \
CONFIG_MBEDTLS_DES_C \
CONFIG_MBEDTLS_GCM_C \
CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \
CONFIG_MBEDTLS_NIST_KW_C \
CONFIG_MBEDTLS_RIPEMD160_C \
CONFIG_MBEDTLS_RSA_NO_CRT \
CONFIG_MBEDTLS_XTEA_C
MBEDTLS_BUILD_OPTS= \
$(MBEDTLS_BUILD_OPTS_CURVES) \
$(MBEDTLS_BUILD_OPTS_CIPHERS) \
CONFIG_MBEDTLS_CERTS_C \
CONFIG_MBEDTLS_CIPHER_MODE_OFB \
CONFIG_MBEDTLS_CIPHER_MODE_XTS \
CONFIG_MBEDTLS_DEBUG_C \
CONFIG_MBEDTLS_ENTROPY_FORCE_SHA256 \
CONFIG_MBEDTLS_HKDF_C \
CONFIG_MBEDTLS_PLATFORM_C \
CONFIG_MBEDTLS_SELF_TEST \
CONFIG_MBEDTLS_SSL_RENEGOTIATION \
CONFIG_MBEDTLS_SSL_TRUNCATED_HMAC \
CONFIG_MBEDTLS_VERSION_C \
CONFIG_MBEDTLS_VERSION_FEATURES
PKG_CONFIG_DEPENDS := $(MBEDTLS_BUILD_OPTS)
mbedtls: Kconfig option to enable/disable debug functions This introduces a new Kconfig option to switch on/off mbedtls' support for debug functions. The idea behind is to inspect TLS traffic with Wireshark for debug purposes. At the moment, there is no native or 'nice' support for this, but at https://github.com/Lekensteyn/mbedtls/commit/68aea15833e1ac9290b8f52a4223fb4585fb3986 an example implementation can be found which uses the debug functions of the library. However, this requires to have this debug stuff enabled in the library, but at the moment it is staticly patched out. So this patch removes the static part from the configuration patch and introduces a dynamic config file editing during build. When enabled, this heavily increases the library size, so I added a warning in the Kconfig help section. Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2019-01-03 23:00:41 +00:00
mbedtls: package version 2.0, make polarssl compatible Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46484
2015-07-24 22:26:44 +00:00
include $(INCLUDE_DIR)/package.mk
include $(INCLUDE_DIR)/cmake.mk
define Package/mbedtls/Default
TITLE:=Embedded SSL
URL:=https://tls.mbed.org
endef
define Package/mbedtls/Default/description
The aim of the mbedtls project is to provide a quality, open-source
cryptographic library written in C and targeted at embedded systems.
endef
define Package/libmbedtls
$(call Package/mbedtls/Default)
SECTION:=libs
CATEGORY:=Libraries
package/libs/mbedtls: add package with some mbedtls binaries. Add some basic binaries required for private key and CSR generation. Signed-off-by: Paul Wassi <p.wassi@gmx.at>
2018-03-12 19:19:49 +00:00
SUBMENU:=SSL
mbedtls: package version 2.0, make polarssl compatible Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46484
2015-07-24 22:26:44 +00:00
TITLE+= (library)
packages: set more explicit ABI_VERSION values In the case of upstream libraries, set the ABI_VERSION variable to the soname value of the first version version after the last backwards incompatible change. For custom OpenWrt libraries, set the ABI_VERSION to the date of the last Git commit doing backwards incompatible changes to the source, such as changing function singatures or dropping exported symbols. The soname values have been determined by either checking https://abi-laboratory.pro/index.php?view=tracker or - in the case of OpenWrt libraries - by carefully reviewing the changes made to header files thorough the corresponding Git history. In the future, the ABI_VERSION values must be bumped whenever the library is updated to an incpompatible version but not with every package update, in order to reduce the dependency churn in the binary package repository. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-01-17 16:24:31 +00:00
ABI_VERSION:=12
libmbedtls: build option submenu menuconfig libmbedtls build option submenu Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
2022-10-20 20:22:01 +00:00
MENU:=1
mbedtls: package version 2.0, make polarssl compatible Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46484
2015-07-24 22:26:44 +00:00
endef
mbedtls: Kconfig option to enable/disable debug functions This introduces a new Kconfig option to switch on/off mbedtls' support for debug functions. The idea behind is to inspect TLS traffic with Wireshark for debug purposes. At the moment, there is no native or 'nice' support for this, but at https://github.com/Lekensteyn/mbedtls/commit/68aea15833e1ac9290b8f52a4223fb4585fb3986 an example implementation can be found which uses the debug functions of the library. However, this requires to have this debug stuff enabled in the library, but at the moment it is staticly patched out. So this patch removes the static part from the configuration patch and introduces a dynamic config file editing during build. When enabled, this heavily increases the library size, so I added a warning in the Kconfig help section. Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2019-01-03 23:00:41 +00:00
define Package/libmbedtls/config
libmbedtls: build option submenu menuconfig libmbedtls build option submenu Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
2022-10-20 20:22:01 +00:00
source "$(SOURCE)/Config.in"
mbedtls: Kconfig option to enable/disable debug functions This introduces a new Kconfig option to switch on/off mbedtls' support for debug functions. The idea behind is to inspect TLS traffic with Wireshark for debug purposes. At the moment, there is no native or 'nice' support for this, but at https://github.com/Lekensteyn/mbedtls/commit/68aea15833e1ac9290b8f52a4223fb4585fb3986 an example implementation can be found which uses the debug functions of the library. However, this requires to have this debug stuff enabled in the library, but at the moment it is staticly patched out. So this patch removes the static part from the configuration patch and introduces a dynamic config file editing during build. When enabled, this heavily increases the library size, so I added a warning in the Kconfig help section. Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2019-01-03 23:00:41 +00:00
endef
package/libs/mbedtls: add package with some mbedtls binaries. Add some basic binaries required for private key and CSR generation. Signed-off-by: Paul Wassi <p.wassi@gmx.at>
2018-03-12 19:19:49 +00:00
define Package/mbedtls-util
$(call Package/mbedtls/Default)
SECTION:=utils
CATEGORY:=Utilities
TITLE+= (utilities)
DEPENDS:=+libmbedtls
endef
mbedtls: package version 2.0, make polarssl compatible Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46484
2015-07-24 22:26:44 +00:00
define Package/libmbedtls/description
$(call Package/mbedtls/Default/description)
This package contains the mbedtls library.
endef
package/libs/mbedtls: add package with some mbedtls binaries. Add some basic binaries required for private key and CSR generation. Signed-off-by: Paul Wassi <p.wassi@gmx.at>
2018-03-12 19:19:49 +00:00
define Package/mbedtls-util/description
$(call Package/mbedtls/Default/description)
This package contains mbedtls helper programs for private key and
CSR generation (gen_key, cert_req)
endef
mbedtls: Cosmetic cleanups This is more of a cosmetic change and a reminder that the CMake script hardcodes -O2. Source: https://github.com/ARMmbed/mbedtls/blob/mbedtls-2.7/CMakeLists.txt#L73 https://github.com/ARMmbed/mbedtls/blob/master/CMakeLists.txt#L97 Remove the release type option as it's already provided by the toolchain. Source: https://github.com/openwrt/openwrt/blob/master/include/cmake.mk#L50 Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>
2018-06-10 22:22:36 +00:00
TARGET_CFLAGS := $(filter-out -O%,$(TARGET_CFLAGS))
mbedtls: add --function-sections and --data-sections to CFLAGS This allows binaries that links these libraries statically to be reduced by using --gc-sections on link Signed-off-by: Felix Fietkau <nbd@nbd.name>
2017-02-21 13:33:14 +00:00
mbedtls: package version 2.0, make polarssl compatible Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46484
2015-07-24 22:26:44 +00:00
CMAKE_OPTIONS += \
mbedtls: build with PIC Fixes compilation with GCC12 and dependent packages for some reason. Signed-off-by: Rosen Penev <rosenp@gmail.com>
2022-07-09 03:50:44 +00:00
-DCMAKE_POSITION_INDEPENDENT_CODE=ON \
mbedtls: package version 2.0, make polarssl compatible Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46484
2015-07-24 22:26:44 +00:00
-DUSE_SHARED_MBEDTLS_LIBRARY:Bool=ON \
-DENABLE_TESTING:Bool=OFF \
package/libs/mbedtls: add package with some mbedtls binaries. Add some basic binaries required for private key and CSR generation. Signed-off-by: Paul Wassi <p.wassi@gmx.at>
2018-03-12 19:19:49 +00:00
-DENABLE_PROGRAMS:Bool=ON
mbedtls: package version 2.0, make polarssl compatible Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46484
2015-07-24 22:26:44 +00:00
libmbedtls: build option submenu menuconfig libmbedtls build option submenu Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
2022-10-20 20:22:01 +00:00
define Build/Prepare
$(call Build/Prepare/Default)
libmbedtls: use defaults if no build opts selected use defaults if no build opts selected (allows build with defaults when mbedtls not selected and configured) Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
2022-11-15 22:12:56 +00:00
$(if $(strip $(foreach opt,$(MBEDTLS_BUILD_OPTS),$($(opt)))),
$(foreach opt,$(MBEDTLS_BUILD_OPTS),
libmbedtls: build option submenu menuconfig libmbedtls build option submenu Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
2022-10-20 20:22:01 +00:00
$(PKG_BUILD_DIR)/scripts/config.py \
-f $(PKG_BUILD_DIR)/include/mbedtls/config.h \
libmbedtls: use defaults if no build opts selected use defaults if no build opts selected (allows build with defaults when mbedtls not selected and configured) Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
2022-11-15 22:12:56 +00:00
$(if $($(opt)),set,unset) $(patsubst CONFIG_%,%,$(opt))),)
libmbedtls: build option submenu menuconfig libmbedtls build option submenu Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
2022-10-20 20:22:01 +00:00
endef
mbedtls: package version 2.0, make polarssl compatible Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46484
2015-07-24 22:26:44 +00:00
define Build/InstallDev
$(INSTALL_DIR) $(1)/usr/include
$(CP) $(PKG_INSTALL_DIR)/usr/include/mbedtls $(1)/usr/include/
$(INSTALL_DIR) $(1)/usr/lib
$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.so* $(1)/usr/lib/
mbedtls: add static files in staging_dir Signed-off-by: Domagoj Pintaric <domagoj.pintaric@sartura.hr> Signed-off-by: Luka Perkov <luka.perkov@sartura.hr>
2017-01-01 18:10:38 +00:00
$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.a $(1)/usr/lib/
mbedtls: package version 2.0, make polarssl compatible Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46484
2015-07-24 22:26:44 +00:00
endef
define Package/libmbedtls/install
$(INSTALL_DIR) $(1)/usr/lib
treewide: revise library packaging - Annotate versionless libraries (such as libubox, libuci etc.) with a fixed ABI_VERSION resembling the source date of the last incompatible change - Annotate packages shipping versioned library objects with ABI_VERSION - Stop shipping unversioned library symlinks for packages with ABI_VERSION Ref: https://openwrt.org/docs/guide-developer/package-policies#shared_libraries Ref: https://github.com/KanjiMonster/maintainer-tools/blob/master/check-abi-versions.pl Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2019-01-22 18:17:32 +00:00
$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.so.* $(1)/usr/lib/
mbedtls: package version 2.0, make polarssl compatible Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46484
2015-07-24 22:26:44 +00:00
endef
package/libs/mbedtls: add package with some mbedtls binaries. Add some basic binaries required for private key and CSR generation. Signed-off-by: Paul Wassi <p.wassi@gmx.at>
2018-03-12 19:19:49 +00:00
define Package/mbedtls-util/install
$(INSTALL_DIR) $(1)/usr/bin
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/gen_key $(1)/usr/bin/
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/cert_req $(1)/usr/bin/
endef
mbedtls: package version 2.0, make polarssl compatible Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46484
2015-07-24 22:26:44 +00:00
$(eval $(call BuildPackage,libmbedtls))
package/libs/mbedtls: add package with some mbedtls binaries. Add some basic binaries required for private key and CSR generation. Signed-off-by: Paul Wassi <p.wassi@gmx.at>
2018-03-12 19:19:49 +00:00
$(eval $(call BuildPackage,mbedtls-util))
Reference in New Issue Copy Permalink