mirror of
https://github.com/openwrt/openwrt.git
synced 2025-01-29 15:44:04 +00:00
dee4309bdf
This contains a fix for: CVE-2024-28960: An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory. (cherry picked from commit 360ac07eb933feaf29bb031f788f0bf81c473be7) Link: https://github.com/openwrt/openwrt/pull/15898 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
163 lines
4.6 KiB
Makefile
163 lines
4.6 KiB
Makefile
#
|
|
# Copyright (C) 2011-2015 OpenWrt.org
|
|
#
|
|
# This is free software, licensed under the GNU General Public License v2.
|
|
# See /LICENSE for more information.
|
|
#
|
|
|
|
include $(TOPDIR)/rules.mk
|
|
|
|
PKG_NAME:=mbedtls
|
|
PKG_VERSION:=2.28.8
|
|
PKG_RELEASE:=1
|
|
PKG_BUILD_FLAGS:=no-mips16 gc-sections no-lto
|
|
|
|
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
|
|
PKG_SOURCE_URL:=https://codeload.github.com/ARMmbed/mbedtls/tar.gz/v$(PKG_VERSION)?
|
|
PKG_HASH:=4fef7de0d8d542510d726d643350acb3cdb9dc76ad45611b59c9aa08372b4213
|
|
|
|
PKG_LICENSE:=GPL-2.0-or-later
|
|
PKG_LICENSE_FILES:=gpl-2.0.txt
|
|
PKG_CPE_ID:=cpe:/a:arm:mbed_tls
|
|
|
|
MBEDTLS_BUILD_OPTS_CURVES= \
|
|
CONFIG_MBEDTLS_ECP_DP_SECP192R1_ENABLED \
|
|
CONFIG_MBEDTLS_ECP_DP_SECP224R1_ENABLED \
|
|
CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED \
|
|
CONFIG_MBEDTLS_ECP_DP_SECP384R1_ENABLED \
|
|
CONFIG_MBEDTLS_ECP_DP_SECP521R1_ENABLED \
|
|
CONFIG_MBEDTLS_ECP_DP_SECP192K1_ENABLED \
|
|
CONFIG_MBEDTLS_ECP_DP_SECP224K1_ENABLED \
|
|
CONFIG_MBEDTLS_ECP_DP_SECP256K1_ENABLED \
|
|
CONFIG_MBEDTLS_ECP_DP_BP256R1_ENABLED \
|
|
CONFIG_MBEDTLS_ECP_DP_BP384R1_ENABLED \
|
|
CONFIG_MBEDTLS_ECP_DP_BP512R1_ENABLED \
|
|
CONFIG_MBEDTLS_ECP_DP_CURVE25519_ENABLED \
|
|
CONFIG_MBEDTLS_ECP_DP_CURVE448_ENABLED
|
|
|
|
MBEDTLS_BUILD_OPTS_CIPHERS= \
|
|
CONFIG_MBEDTLS_AES_C \
|
|
CONFIG_MBEDTLS_CAMELLIA_C \
|
|
CONFIG_MBEDTLS_CCM_C \
|
|
CONFIG_MBEDTLS_CMAC_C \
|
|
CONFIG_MBEDTLS_DES_C \
|
|
CONFIG_MBEDTLS_GCM_C \
|
|
CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED \
|
|
CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED \
|
|
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED \
|
|
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED \
|
|
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED \
|
|
CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \
|
|
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \
|
|
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \
|
|
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED \
|
|
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \
|
|
CONFIG_MBEDTLS_NIST_KW_C \
|
|
CONFIG_MBEDTLS_RIPEMD160_C \
|
|
CONFIG_MBEDTLS_RSA_NO_CRT \
|
|
CONFIG_MBEDTLS_XTEA_C
|
|
|
|
MBEDTLS_BUILD_OPTS= \
|
|
$(MBEDTLS_BUILD_OPTS_CURVES) \
|
|
$(MBEDTLS_BUILD_OPTS_CIPHERS) \
|
|
CONFIG_MBEDTLS_CERTS_C \
|
|
CONFIG_MBEDTLS_CIPHER_MODE_OFB \
|
|
CONFIG_MBEDTLS_CIPHER_MODE_XTS \
|
|
CONFIG_MBEDTLS_DEBUG_C \
|
|
CONFIG_MBEDTLS_ENTROPY_FORCE_SHA256 \
|
|
CONFIG_MBEDTLS_HKDF_C \
|
|
CONFIG_MBEDTLS_PLATFORM_C \
|
|
CONFIG_MBEDTLS_SELF_TEST \
|
|
CONFIG_MBEDTLS_SSL_RENEGOTIATION \
|
|
CONFIG_MBEDTLS_SSL_TRUNCATED_HMAC \
|
|
CONFIG_MBEDTLS_VERSION_C \
|
|
CONFIG_MBEDTLS_VERSION_FEATURES
|
|
|
|
PKG_CONFIG_DEPENDS := $(MBEDTLS_BUILD_OPTS)
|
|
|
|
include $(INCLUDE_DIR)/package.mk
|
|
include $(INCLUDE_DIR)/cmake.mk
|
|
|
|
define Package/mbedtls/Default
|
|
TITLE:=Embedded SSL
|
|
URL:=https://tls.mbed.org
|
|
endef
|
|
|
|
define Package/mbedtls/Default/description
|
|
The aim of the mbedtls project is to provide a quality, open-source
|
|
cryptographic library written in C and targeted at embedded systems.
|
|
endef
|
|
|
|
define Package/libmbedtls
|
|
$(call Package/mbedtls/Default)
|
|
SECTION:=libs
|
|
CATEGORY:=Libraries
|
|
SUBMENU:=SSL
|
|
TITLE+= (library)
|
|
ABI_VERSION:=12
|
|
MENU:=1
|
|
endef
|
|
|
|
define Package/libmbedtls/config
|
|
source "$(SOURCE)/Config.in"
|
|
endef
|
|
|
|
define Package/mbedtls-util
|
|
$(call Package/mbedtls/Default)
|
|
SECTION:=utils
|
|
CATEGORY:=Utilities
|
|
TITLE+= (utilities)
|
|
DEPENDS:=+libmbedtls
|
|
endef
|
|
|
|
define Package/libmbedtls/description
|
|
$(call Package/mbedtls/Default/description)
|
|
This package contains the mbedtls library.
|
|
endef
|
|
|
|
define Package/mbedtls-util/description
|
|
$(call Package/mbedtls/Default/description)
|
|
This package contains mbedtls helper programs for private key and
|
|
CSR generation (gen_key, cert_req)
|
|
endef
|
|
|
|
TARGET_CFLAGS := $(filter-out -O%,$(TARGET_CFLAGS))
|
|
|
|
CMAKE_OPTIONS += \
|
|
-DCMAKE_POSITION_INDEPENDENT_CODE=ON \
|
|
-DUSE_SHARED_MBEDTLS_LIBRARY:Bool=ON \
|
|
-DENABLE_TESTING:Bool=OFF \
|
|
-DENABLE_PROGRAMS:Bool=ON
|
|
|
|
define Build/Prepare
|
|
$(call Build/Prepare/Default)
|
|
|
|
$(if $(strip $(foreach opt,$(MBEDTLS_BUILD_OPTS),$($(opt)))),
|
|
$(foreach opt,$(MBEDTLS_BUILD_OPTS),
|
|
$(PKG_BUILD_DIR)/scripts/config.py \
|
|
-f $(PKG_BUILD_DIR)/include/mbedtls/config.h \
|
|
$(if $($(opt)),set,unset) $(patsubst CONFIG_%,%,$(opt))),)
|
|
endef
|
|
|
|
define Build/InstallDev
|
|
$(INSTALL_DIR) $(1)/usr/include
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/include/mbedtls $(1)/usr/include/
|
|
$(INSTALL_DIR) $(1)/usr/lib
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.so* $(1)/usr/lib/
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.a $(1)/usr/lib/
|
|
endef
|
|
|
|
define Package/libmbedtls/install
|
|
$(INSTALL_DIR) $(1)/usr/lib
|
|
$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.so.* $(1)/usr/lib/
|
|
endef
|
|
|
|
define Package/mbedtls-util/install
|
|
$(INSTALL_DIR) $(1)/usr/bin
|
|
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/gen_key $(1)/usr/bin/
|
|
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/cert_req $(1)/usr/bin/
|
|
endef
|
|
|
|
$(eval $(call BuildPackage,libmbedtls))
|
|
$(eval $(call BuildPackage,mbedtls-util))
|