ExternalVendorCode/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2025-02-01 00:45:28 +00:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

wolfssl: bump to 4.1.0-stable

Browse Source 
Always build AES-GCM support.
Unnecessary patches were removed.

This includes two vulnerability fixes:

CVE-2019-11873: a potential buffer overflow case with the TLSv1.3 PSK
extension parsing.

CVE-2019-13628 (currently assigned-only): potential leak of nonce sizes
when performing ECDSA signing operations. The leak is considered to be
difficult to exploit but it could potentially be used maliciously to
perform a lattice based timing attack.

This brings the package up-to-date with master, so it incorporates
changes from 4.0.0 in master:
* Removed options that can't be turned off because we're building with
  --enable-stunnel, some of which affect hostapd's Config.in.
* Adjusted the title of OCSP option, as OCSP itself can't be turned off,
  only the stapling part is selectable.
* Mark options turned on when wpad support is selected.
* Add building options for TLS 1.0, and TLS 1.3.
* Add hardware crypto support, which due to a bug, only works when CCM
  support is turned off.
* Reorganized option conditionals in Makefile.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
This commit is contained in:
Eneas U de Queiroz 2019-08-05 11:52:08 -03:00 committed by Hauke Mehrtens
parent 3809b6662d
commit b35e1360cd
6 changed files with 62 additions and 166 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
package/libs/wolfssl/Config.in
View File

@ -4,16 +4,8 @@ config WOLFSSL_HAS_AES_CCM
bool "Include AES-CCM support"
default y
config WOLFSSL_HAS_AES_GCM
bool "Include AES-GCM support"
default y
config WOLFSSL_HAS_CHACHA
bool "Include ChaCha cipher suite support"
default n
config WOLFSSL_HAS_ECC
bool "Include ECC (Elliptic Curve Cryptography) support"
config WOLFSSL_HAS_CHACHA_POLY
bool "Include ChaCha20-Poly1305 cipher suite support"
default y
config WOLFSSL_HAS_DH
@ -24,12 +16,12 @@ config WOLFSSL_HAS_ARC4
bool "Include ARC4 support"
default y
config WOLFSSL_HAS_DES3
bool "Include DES3 (Tripple-DES) support"
config WOLFSSL_HAS_TLSV10
bool "Include TLS 1.0 support"
default y
config WOLFSSL_HAS_PSK
bool "Include PKS (Pre Share Key) support"
config WOLFSSL_HAS_TLSV13
bool "Include TLS 1.3 support"
default y
config WOLFSSL_HAS_SESSION_TICKET
@ -41,20 +33,45 @@ config WOLFSSL_HAS_DTLS
default n
config WOLFSSL_HAS_OCSP
bool "Include OSCP support"
bool "Include OSCP stapling support"
default y
config WOLFSSL_HAS_WPAS
bool "Include wpa_supplicant support"
select WOLFSSL_HAS_ARC4
select WOLFSSL_HAS_OCSP
select WOLFSSL_HAS_SESSION_TICKET
default y
config WOLFSSL_HAS_ECC25519
bool "Include ECC Curve 22519 support"
depends on WOLFSSL_HAS_ECC
default n
config WOLFSSL_HAS_POLY1305
bool "Include Poly-1305 support"
default n
config WOLFSSL_HAS_DEVCRYPTO
bool
if WOLFSSL_HAS_AES_CCM
comment "! Hardware Acceleration does not build with AES-CCM enabled"
endif
if !WOLFSSL_HAS_AES_CCM
choice
prompt "Hardware Acceleration"
default WOLFSSL_HAS_NO_HW
config WOLFSSL_HAS_NO_HW
bool "None"
config WOLFSSL_HAS_AFALG
bool "AF_ALG"
config WOLFSSL_HAS_DEVCRYPTO_AES
bool "/dev/crypto - AES-only"
select WOLFSSL_HAS_DEVCRYPTO
config WOLFSSL_HAS_DEVCRYPTO_FULL
bool "/dev/crypto - full"
select WOLFSSL_HAS_DEVCRYPTO
endchoice
endif
endif

115
package/libs/wolfssl/Makefile
View File

@ -8,12 +8,12 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=wolfssl
PKG_VERSION:=3.15.7-stable
PKG_VERSION:=4.1.0-stable
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://github.com/wolfSSL/wolfssl/archive/v$(PKG_VERSION)
PKG_HASH:=70e4fbeb91284a269b25a84fc526755c670475aee4034a6f237b1f754d108af3
PKG_HASH:=f0d630c3ddfeb692b8ae38cc739f47d5e9f0fb708662aa241ede0c42a5eb3dd8
PKG_FIXUP:=libtool
PKG_INSTALL:=1
@ -21,16 +21,17 @@ PKG_USE_MIPS16:=0
PKG_BUILD_PARALLEL:=1
PKG_LICENSE:=GPL-2.0-or-later
PKG_LICENSE_FILES:=LICENSING COPYING
PKG_MAINTAINER:=Eneas U de Queiroz <cotequeiroz@gmail.com>
PKG_CPE_ID:=cpe:/a:wolfssl:wolfssl
PKG_CONFIG_DEPENDS:=\
CONFIG_WOLFSSL_HAS_AES_CCM CONFIG_WOLFSSL_HAS_AES_GCM \
CONFIG_WOLFSSL_HAS_ARC4 CONFIG_WOLFSSL_HAS_CHACHA \
CONFIG_WOLFSSL_HAS_DES3 CONFIG_WOLFSSL_HAS_DH CONFIG_WOLFSSL_HAS_DTLS \
CONFIG_WOLFSSL_HAS_ECC CONFIG_WOLFSSL_HAS_ECC25519 \
CONFIG_WOLFSSL_HAS_OCSP CONFIG_WOLFSSL_HAS_POLY1305 \
CONFIG_WOLFSSL_HAS_PSK CONFIG_WOLFSSL_HAS_SESSION_TICKET \
CONFIG_WOLFSSL_HAS_WPAS
CONFIG_WOLFSSL_HAS_AES_CCM CONFIG_WOLFSSL_HAS_AFALG \
CONFIG_WOLFSSL_HAS_ARC4 CONFIG_WOLFSSL_HAS_CHACHA_POLY \
CONFIG_WOLFSSL_HAS_DEVCRYPTO_AES CONFIG_WOLFSSL_HAS_DEVCRYPTO_FULL \
CONFIG_WOLFSSL_HAS_DH CONFIG_WOLFSSL_HAS_DTLS \
CONFIG_WOLFSSL_HAS_ECC25519 CONFIG_WOLFSSL_HAS_OCSP \
CONFIG_WOLFSSL_HAS_SESSION_TICKET CONFIG_WOLFSSL_HAS_TLSV10 \
CONFIG_WOLFSSL_HAS_TLSV13 CONFIG_WOLFSSL_HAS_WPAS
include $(INCLUDE_DIR)/package.mk
@ -42,6 +43,7 @@ define Package/libwolfssl
URL:=http://www.wolfssl.com/
MENU:=1
PROVIDES:=libcyassl
DEPENDS:=+WOLFSSL_HAS_DEVCRYPTO:kmod-cryptodev +WOLFSSL_HAS_AFALG:kmod-crypto-user
ABI_VERSION:=19
endef
@ -62,70 +64,20 @@ CONFIGURE_ARGS += \
--enable-sni \
--enable-stunnel \
--disable-examples \
--disable-leanpsk \
--disable-leantls \
ifeq ($(CONFIG_IPV6),y)
CONFIGURE_ARGS += \
--enable-ipv6
endif
ifeq ($(CONFIG_WOLFSSL_HAS_AES_CCM),y)
CONFIGURE_ARGS += \
--enable-aesccm
endif
ifneq ($(CONFIG_WOLFSSL_HAS_AES_GCM),y)
CONFIGURE_ARGS += \
--disable-aesgcm
endif
ifneq ($(CONFIG_WOLFSSL_HAS_CHACHA),y)
CONFIGURE_ARGS += \
--disable-chacha
endif
ifeq ($(CONFIG_WOLFSSL_HAS_ECC),y)
CONFIGURE_ARGS += \
--enable-ecc \
--enable-supportedcurves
endif
ifeq ($(CONFIG_WOLFSSL_HAS_DH),y)
CONFIGURE_ARGS += \
--enable-dh
endif
ifneq ($(CONFIG_WOLFSSL_HAS_ARC4),y)
CONFIGURE_ARGS += \
--disable-arc4
else
CONFIGURE_ARGS += \
--enable-arc4
endif
ifneq ($(CONFIG_WOLFSSL_HAS_DES3),y)
CONFIGURE_ARGS += \
--disable-des3
else
CONFIGURE_ARGS += \
--enable-des3
endif
ifeq ($(CONFIG_WOLFSSL_HAS_PSK),y)
CONFIGURE_ARGS += \
--enable-psk
endif
ifeq ($(CONFIG_WOLFSSL_HAS_SESSION_TICKET),y)
CONFIGURE_ARGS += \
--enable-session-ticket
endif
ifeq ($(CONFIG_WOLFSSL_HAS_DTLS),y)
CONFIGURE_ARGS += \
--enable-dtls
endif
--disable-jobserver \
--$(if $(CONFIG_IPV6),enable,disable)-ipv6 \
--$(if $(CONFIG_WOLFSSL_HAS_AES_CCM),enable,disable)-aesccm \
--$(if $(CONFIG_WOLFSSL_HAS_CHACHA_POLY),enable,disable)-chacha \
--$(if $(CONFIG_WOLFSSL_HAS_CHACHA_POLY),enable,disable)-poly1305 \
--$(if $(CONFIG_WOLFSSL_HAS_DH),enable,disable)-dh \
--$(if $(CONFIG_WOLFSSL_HAS_ARC4),enable,disable)-arc4 \
--$(if $(CONFIG_WOLFSSL_HAS_TLSV10),enable,disable)-tlsv10 \
--$(if $(CONFIG_WOLFSSL_HAS_TLSV13),enable,disable)-tls13 \
--$(if $(CONFIG_WOLFSSL_HAS_SESSION_TICKET),enable,disable)-session-ticket \
--$(if $(CONFIG_WOLFSSL_HAS_DTLS),enable,disable)-dtls \
--$(if $(CONFIG_WOLFSSL_HAS_ECC25519),enable,disable)-curve25519 \
--$(if $(CONFIG_WOLFSSL_HAS_AFALG),enable,disable)-afalg \
--enable-devcrypto=$(if $(CONFIG_WOLFSSL_HAS_DEVCRYPTO_AES),aes,$(if $(CONFIG_WOLFSSL_HAS_DEVCRYPTO_FULL),yes,no))
ifeq ($(CONFIG_WOLFSSL_HAS_OCSP),y)
CONFIGURE_ARGS += \
@ -137,23 +89,6 @@ CONFIGURE_ARGS += \
--enable-wpas --enable-sha512 --enable-fortress --enable-fastmath
endif
ifeq ($(CONFIG_WOLFSSL_HAS_ECC25519),y)
CONFIGURE_ARGS += \
--enable-curve25519
endif
ifneq ($(CONFIG_WOLFSSL_HAS_POLY1305),y)
CONFIGURE_ARGS += \
--enable-poly1305
endif
#ifneq ($(CONFIG_TARGET_x86),)
# CONFIGURE_ARGS += --enable-intelasm
#endif
#ifneq ($(CONFIG_TARGET_x86_64),)
# CONFIGURE_ARGS += --enable-intelasm
#endif
define Build/InstallDev
$(INSTALL_DIR) $(1)/usr/include $(1)/usr/lib/pkgconfig
$(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/

2
package/libs/wolfssl/patches/100-disable-hardening-check.patch
View File

@ -1,6 +1,6 @@
--- a/wolfssl/wolfcrypt/settings.h
+++ b/wolfssl/wolfcrypt/settings.h
@@ -1759,7 +1759,7 @@ extern void uITRON4_free(void *p) ;
@@ -1930,7 +1930,7 @@ extern void uITRON4_free(void *p) ;
#endif
/* warning for not using harden build options (default with ./configure) */

23
package/libs/wolfssl/patches/101-AR-flags-configure-update.patch
View File

@ -1,23 +0,0 @@
From 42eacece82b6375a9f4bab3903a1a39f7d1dd579 Mon Sep 17 00:00:00 2001
From: John Safranek <john@wolfssl.com>
Date: Tue, 5 Mar 2019 09:26:30 -0800
Subject: [PATCH] AR flags configure update In at least one environment the
check for particular AR options was failing due to a bash script bug. Deleted
an extra pair of parenthesis triggering an arithmetic statement when
redundant grouping was desired.
---
configure.ac | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/configure.ac
+++ b/configure.ac
@@ -15,7 +15,7 @@ AC_CONFIG_AUX_DIR([build-aux])
: ${CFLAGS=""}
# Test ar for the "U" option. Should be checked before the libtool macros.
-xxx_ar_flags=$((ar --help) 2>&1)
+xxx_ar_flags=$(ar --help 2>&1)
AS_CASE([$xxx_ar_flags],[*'use actual timestamps and uids/gids'*],[: ${AR_FLAGS="Ucru"}])
AC_PROG_CC

12
package/libs/wolfssl/patches/400-additional_compatibility.patch
View File

@ -1,12 +0,0 @@
--- a/cyassl/openssl/ssl.h
+++ b/cyassl/openssl/ssl.h
@@ -28,6 +28,9 @@
#define CYASSL_OPENSSL_H_
#include <cyassl/ssl.h>
+#ifndef HAVE_SNI
+#undef CYASSL_SNI_HOST_NAME
+#endif
#include <wolfssl/openssl/ssl.h>
#endif

21
package/libs/wolfssl/patches/900-remove-broken-autoconf-macros.patch
View File

@ -1,21 +0,0 @@
--- a/configure.ac
+++ b/configure.ac
@@ -4614,7 +4614,6 @@ AC_CONFIG_FILES([stamp-h], [echo timesta
AC_CONFIG_FILES([Makefile wolfssl/version.h wolfssl/options.h cyassl/options.h support/wolfssl.pc rpm/spec])
AX_CREATE_GENERIC_CONFIG
-AX_AM_JOBSERVER([yes])
AC_OUTPUT
--- a/Makefile.am
+++ b/Makefile.am
@@ -20,8 +20,6 @@ dist_noinst_SCRIPTS =
noinst_SCRIPTS =
check_SCRIPTS =
-#includes additional rules from aminclude.am
-@INC_AMINCLUDE@
DISTCLEANFILES+= aminclude.am
CLEANFILES+= cert.der \