mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-24 07:46:48 +00:00
387c2df15c
The bump to 3.0.8 inadvertently removed patches that are needed here,
but were not adopted upstream. The most important one changes the
default value of the DIGESTS setting from ALL to NONE. The absence of
this patch causes a sysupgrade failure while the engine is in use with
digests enabled. When this happens, the system fails to boot with a
kernel panic.
Also, explicitly set DIGESTS to NONE in the provided config file, and
change the default ciphers setting to disable ECB, which has been
recommended for a long time and may cause trouble with some apps.
The config file change by itself is not enough because the config file
may be preserved during sysupgrade.
For people affected by this bug:
You can either:
1. remove, the libopenssl-devcrypto package
2. disable the engine in /etc/config/openssl;
3. change /etc/ssl/engines.cnf.d/devcrypto.cnf to set DIGESTS=NONE;
4. update libopenssl-devcrypto to >=3.0.8-3
However, after doing any of the above, **you must reboot the device
before running sysupgrade** to ensure no running application is using
the engine. Running `/etc/init.d/openssl restart` is not enough.
Fixes:
|
||
|---|---|---|
| .. | ||
| 100-Configure-afalg-support.patch | ||
| 110-openwrt_targets.patch | ||
| 120-strip-cflags-from-binary.patch | ||
| 130-dont-build-fuzz-docs.patch | ||
| 140-allow-prefer-chacha20.patch | ||
| 150-openssl.cnf-add-engines-conf.patch | ||
| 500-e_devcrypto-default-to-not-use-digests-in-engine.patch | ||
| 510-e_devcrypto-ignore-error-when-closing-session.patch | ||