diff options
Diffstat (limited to 'poky/meta/recipes-connectivity/openssl')
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/files/environment.d-openssl.sh (renamed from poky/meta/recipes-connectivity/openssl/openssl/environment.d-openssl.sh) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch | 43 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch | 70 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl/0001-skip-test_symbol_presence.patch | 46 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl/0002-fix-CVE-2018-0734.patch | 108 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl/0003-fix-CVE-2018-0735.patch | 50 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl/run-ptest | 14 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/0001-Fix-build-with-clang-using-external-assembler.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/0001-Fix-build-with-clang-using-external-assembler.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/0001-allow-manpages-to-be-disabled.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/0001-allow-manpages-to-be-disabled.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/0001-fix-CVE-2018-0734.patch | 33 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/0001-openssl-force-soft-link-to-avoid-rare-race.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/0001-openssl-force-soft-link-to-avoid-rare-race.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/Makefiles-ptest.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/Makefiles-ptest.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/Use-SHA256-not-MD5-as-default-digest.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/Use-SHA256-not-MD5-as-default-digest.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/configure-musl-target.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/configure-musl-target.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/configure-targets.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/configure-targets.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/debian/c_rehash-compat.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/c_rehash-compat.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/debian/debian-targets.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/debian-targets.patch) | 4 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/debian/man-dir.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/man-dir.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/debian/man-section.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/man-section.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/debian/no-rpath.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/no-rpath.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/debian/no-symbolic.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/no-symbolic.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/debian/pic.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/pic.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/debian1.0.2/block_digicert_malaysia.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian1.0.2/block_digicert_malaysia.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/debian1.0.2/block_diginotar.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian1.0.2/block_diginotar.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/debian1.0.2/soname.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian1.0.2/soname.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/debian1.0.2/version-script.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian1.0.2/version-script.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/engines-install-in-libdir-ssl.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/engines-install-in-libdir-ssl.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/oe-ldflags.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/oe-ldflags.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/openssl-c_rehash.sh (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/openssl-c_rehash.sh) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/openssl-fix-des.pod-error.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/openssl-fix-des.pod-error.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/openssl_fix_for_x32.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/openssl_fix_for_x32.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/parallel.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/parallel.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/ptest-deps.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/ptest-deps.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/ptest_makefile_deps.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/ptest_makefile_deps.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/reproducible-cflags.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/reproducible-cflags.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/reproducible-mkbuildinf.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/reproducible-mkbuildinf.patch) | 0 | ||||
-rwxr-xr-x | poky/meta/recipes-connectivity/openssl/openssl10/run-ptest (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/run-ptest) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10/shared-libs.patch (renamed from poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/shared-libs.patch) | 0 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl10_1.0.2p.bb (renamed from poky/meta/recipes-connectivity/openssl/openssl_1.0.2p.bb) | 95 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl_1.1.0i.bb | 170 | ||||
-rw-r--r-- | poky/meta/recipes-connectivity/openssl/openssl_1.1.1.bb | 205 |
41 files changed, 581 insertions, 257 deletions
diff --git a/poky/meta/recipes-connectivity/openssl/openssl/environment.d-openssl.sh b/poky/meta/recipes-connectivity/openssl/files/environment.d-openssl.sh index b9cc24a7a..b9cc24a7a 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl/environment.d-openssl.sh +++ b/poky/meta/recipes-connectivity/openssl/files/environment.d-openssl.sh diff --git a/poky/meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch b/poky/meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch deleted file mode 100644 index 6ce4e47d7..000000000 --- a/poky/meta/recipes-connectivity/openssl/openssl/0001-Take-linking-flags-from-LDFLAGS-env-var.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 08face4353d80111973aba9c1304c92158cfad0e Mon Sep 17 00:00:00 2001 -From: Alexander Kanavin <alex.kanavin@gmail.com> -Date: Tue, 28 Mar 2017 16:40:12 +0300 -Subject: [PATCH] Take linking flags from LDFLAGS env var - -This fixes "No GNU_HASH in the elf binary" issues. - -Upstream-Status: Inappropriate [oe-core specific] -Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> ---- - Configurations/unix-Makefile.tmpl | 2 +- - Configure | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl -index c029817..43b769b 100644 ---- a/Configurations/unix-Makefile.tmpl -+++ b/Configurations/unix-Makefile.tmpl -@@ -173,7 +173,7 @@ CROSS_COMPILE= {- $config{cross_compile_prefix} -} - CC= $(CROSS_COMPILE){- $target{cc} -} - CFLAGS={- our $cflags2 = join(" ",(map { "-D".$_} @{$target{defines}}, @{$config{defines}}),"-DOPENSSLDIR=\"\\\"\$(OPENSSLDIR)\\\"\"","-DENGINESDIR=\"\\\"\$(ENGINESDIR)\\\"\"") -} {- $target{cflags} -} {- $config{cflags} -} - CFLAGS_Q={- $cflags2 =~ s|([\\"])|\\$1|g; $cflags2 -} {- $config{cflags} -} --LDFLAGS= {- $target{lflags} -} -+LDFLAGS= {- $target{lflags}." ".$ENV{'LDFLAGS'} -} - PLIB_LDFLAGS= {- $target{plib_lflags} -} - EX_LIBS= {- $target{ex_libs} -} {- $config{ex_libs} -} - LIB_CFLAGS={- $target{shared_cflag} || "" -} -diff --git a/Configure b/Configure -index aee7cc3..274d236 100755 ---- a/Configure -+++ b/Configure -@@ -979,7 +979,7 @@ $config{build_file} = $target{build_file}; - $config{defines} = []; - $config{cflags} = ""; - $config{ex_libs} = ""; --$config{shared_ldflag} = ""; -+$config{shared_ldflag} = $ENV{'LDFLAGS'}; - - # Make sure build_scheme is consistent. - $target{build_scheme} = [ $target{build_scheme} ] --- -2.11.0 - diff --git a/poky/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch b/poky/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch new file mode 100644 index 000000000..80b62ab18 --- /dev/null +++ b/poky/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch @@ -0,0 +1,70 @@ +From 3e1d00481093e10775eaf69d619c45b32a4aa7dc Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Martin=20Hundeb=C3=B8ll?= <martin@geanix.com> +Date: Tue, 6 Nov 2018 14:50:47 +0100 +Subject: [PATCH] buildinfo: strip sysroot and debug-prefix-map from compiler + info +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The openssl build system generates buildinf.h containing the full +compiler command line used to compile objects. This breaks +reproducibility, as the compile command is baked into libcrypto, where +it is used when running `openssl version -f`. + +Add stripped build variables for the compiler and cflags lines, and use +those when generating buildinfo.h. + +This is based on a similar patch for older openssl versions: +https://patchwork.openembedded.org/patch/147229/ + +Upstream-Status: Inappropriate [OE specific] +Signed-off-by: Martin Hundebøll <martin@geanix.com> +--- + Configurations/unix-Makefile.tmpl | 10 +++++++++- + crypto/build.info | 2 +- + 2 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl +index 16af4d2087..54c162784c 100644 +--- a/Configurations/unix-Makefile.tmpl ++++ b/Configurations/unix-Makefile.tmpl +@@ -317,13 +317,21 @@ BIN_LDFLAGS={- join(' ', $target{bin_lflags} || (), + '$(CNF_LDFLAGS)', '$(LDFLAGS)') -} + BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS) + +-# CPPFLAGS_Q is used for one thing only: to build up buildinf.h ++# *_Q variables are used for one thing only: to build up buildinf.h + CPPFLAGS_Q={- $cppflags1 =~ s|([\\"])|\\$1|g; + $cppflags2 =~ s|([\\"])|\\$1|g; + $lib_cppflags =~ s|([\\"])|\\$1|g; + join(' ', $lib_cppflags || (), $cppflags2 || (), + $cppflags1 || ()) -} + ++CFLAGS_Q={- for (@{$config{CFLAGS}}) { ++ s|-fdebug-prefix-map=[^ ]+|-fdebug-prefix-map=|g; ++ } ++ join(' ', @{$config{CFLAGS}}) -} ++ ++CC_Q={- $config{CC} =~ s|--sysroot=[^ ]+|--sysroot=recipe-sysroot|g; ++ join(' ', $config{CC}) -} ++ + PERLASM_SCHEME= {- $target{perlasm_scheme} -} + + # For x86 assembler: Set PROCESSOR to 386 if you want to support +diff --git a/crypto/build.info b/crypto/build.info +index b515b7318e..8c9cee2a09 100644 +--- a/crypto/build.info ++++ b/crypto/build.info +@@ -10,7 +10,7 @@ EXTRA= ../ms/uplink-x86.pl ../ms/uplink.c ../ms/applink.c \ + ppccpuid.pl pariscid.pl alphacpuid.pl arm64cpuid.pl armv4cpuid.pl + + DEPEND[cversion.o]=buildinf.h +-GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(LIB_CFLAGS) $(CPPFLAGS_Q)" "$(PLATFORM)" ++GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC_Q) $(CFLAGS_Q) $(CPPFLAGS_Q)" "$(PLATFORM)" + DEPEND[buildinf.h]=../configdata.pm + + GENERATE[uplink-x86.s]=../ms/uplink-x86.pl $(PERLASM_SCHEME) +-- +2.19.1 + diff --git a/poky/meta/recipes-connectivity/openssl/openssl/0001-skip-test_symbol_presence.patch b/poky/meta/recipes-connectivity/openssl/openssl/0001-skip-test_symbol_presence.patch new file mode 100644 index 000000000..d8d9651b6 --- /dev/null +++ b/poky/meta/recipes-connectivity/openssl/openssl/0001-skip-test_symbol_presence.patch @@ -0,0 +1,46 @@ +From a9401b2289656c5a36dd1b0ecebf0d23e291ce70 Mon Sep 17 00:00:00 2001 +From: Hongxu Jia <hongxu.jia@windriver.com> +Date: Tue, 2 Oct 2018 23:58:24 +0800 +Subject: [PATCH] skip test_symbol_presence + +We cannot skip `01-test_symbol_presence.t' by configuring option `no-shared' +as INSTALL told us the shared libraries will not be built. + +[INSTALL snip] + Notes on shared libraries + ------------------------- + + For most systems the OpenSSL Configure script knows what is needed to + build shared libraries for libcrypto and libssl. On these systems + the shared libraries will be created by default. This can be suppressed and + only static libraries created by using the "no-shared" option. On systems + where OpenSSL does not know how to build shared libraries the "no-shared" + option will be forced and only static libraries will be created. +[INSTALL snip] + +Hence directly modification the case to skip it. + +Upstream-Status: Inappropriate [OE Specific] + +Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> +--- + test/recipes/01-test_symbol_presence.t | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/test/recipes/01-test_symbol_presence.t b/test/recipes/01-test_symbol_presence.t +index 7f2a2d7..0b93745 100644 +--- a/test/recipes/01-test_symbol_presence.t ++++ b/test/recipes/01-test_symbol_presence.t +@@ -14,8 +14,7 @@ use OpenSSL::Test::Utils; + + setup("test_symbol_presence"); + +-plan skip_all => "Only useful when building shared libraries" +- if disabled("shared"); ++plan skip_all => "The case needs debug symbols then we just disable it"; + + my @libnames = ("crypto", "ssl"); + my $testcount = scalar @libnames; +-- +2.7.4 + diff --git a/poky/meta/recipes-connectivity/openssl/openssl/0002-fix-CVE-2018-0734.patch b/poky/meta/recipes-connectivity/openssl/openssl/0002-fix-CVE-2018-0734.patch new file mode 100644 index 000000000..2a3e03fe2 --- /dev/null +++ b/poky/meta/recipes-connectivity/openssl/openssl/0002-fix-CVE-2018-0734.patch @@ -0,0 +1,108 @@ +Backport patch to fix CVE-2018-0734. Remove a section which only remove a +space. It can't be applied because the context is different. + +CVE: CVE-2018-0734 +Upstream-Status: Backport + +Signed-off-by: Kai Kang <kai.kang@windriver.com> + +From 8abfe72e8c1de1b95f50aa0d9134803b4d00070f Mon Sep 17 00:00:00 2001 +From: Pauli <paul.dale@oracle.com> +Date: Wed, 24 Oct 2018 07:42:46 +1000 +Subject: [PATCH] Timing vulnerability in DSA signature generation + (CVE-2018-0734). + +Avoid a timing attack that leaks information via a side channel that +triggers when a BN is resized. Increasing the size of the BNs +prior to doing anything with them suppresses the attack. + +Thanks due to Samuel Weiser for finding and locating this. + +Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> +(Merged from https://github.com/openssl/openssl/pull/7486) + +(cherry picked from commit a9cfb8c2aa7254a4aa6a1716909e3f8cb78049b6) +--- + crypto/dsa/dsa_ossl.c | 28 +++++++++++++++------------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +diff --git a/crypto/dsa/dsa_ossl.c b/crypto/dsa/dsa_ossl.c +index ca20811200..2dd2d7489a 100644 +--- a/crypto/dsa/dsa_ossl.c ++++ b/crypto/dsa/dsa_ossl.c +@@ -9,6 +9,7 @@ + + #include <stdio.h> + #include "internal/cryptlib.h" ++#include "internal/bn_int.h" + #include <openssl/bn.h> + #include <openssl/sha.h> + #include "dsa_locl.h" +@@ -180,9 +181,9 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, + { + BN_CTX *ctx = NULL; + BIGNUM *k, *kinv = NULL, *r = *rp; +- BIGNUM *l, *m; ++ BIGNUM *l; + int ret = 0; +- int q_bits; ++ int q_bits, q_words; + + if (!dsa->p || !dsa->q || !dsa->g) { + DSAerr(DSA_F_DSA_SIGN_SETUP, DSA_R_MISSING_PARAMETERS); +@@ -191,8 +192,7 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, + + k = BN_new(); + l = BN_new(); +- m = BN_new(); +- if (k == NULL || l == NULL || m == NULL) ++ if (k == NULL || l == NULL) + goto err; + + if (ctx_in == NULL) { +@@ -203,9 +203,9 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, + + /* Preallocate space */ + q_bits = BN_num_bits(dsa->q); +- if (!BN_set_bit(k, q_bits) +- || !BN_set_bit(l, q_bits) +- || !BN_set_bit(m, q_bits)) ++ q_words = bn_get_top(dsa->q); ++ if (!bn_wexpand(k, q_words + 2) ++ || !bn_wexpand(l, q_words + 2)) + goto err; + + /* Get random k */ +@@ -240,14 +240,17 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, + * small timing information leakage. We then choose the sum that is + * one bit longer than the modulus. + * +- * TODO: revisit the BN_copy aiming for a memory access agnostic +- * conditional copy. ++ * There are some concerns about the efficacy of doing this. More ++ * specificly refer to the discussion starting with: ++ * https://github.com/openssl/openssl/pull/7486#discussion_r228323705 ++ * The fix is to rework BN so these gymnastics aren't required. + */ + if (!BN_add(l, k, dsa->q) +- || !BN_add(m, l, dsa->q) +- || !BN_copy(k, BN_num_bits(l) > q_bits ? l : m)) ++ || !BN_add(k, l, dsa->q)) + goto err; + ++ BN_consttime_swap(BN_is_bit_set(l, q_bits), k, l, q_words + 2); ++ + if ((dsa)->meth->bn_mod_exp != NULL) { + if (!dsa->meth->bn_mod_exp(dsa, r, dsa->g, k, dsa->p, ctx, + dsa->method_mont_p)) +@@ -275,7 +278,6 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, + BN_CTX_free(ctx); + BN_clear_free(k); + BN_clear_free(l); +- BN_clear_free(m); + return ret; + } + +-- +2.17.0 + diff --git a/poky/meta/recipes-connectivity/openssl/openssl/0003-fix-CVE-2018-0735.patch b/poky/meta/recipes-connectivity/openssl/openssl/0003-fix-CVE-2018-0735.patch new file mode 100644 index 000000000..736323f0c --- /dev/null +++ b/poky/meta/recipes-connectivity/openssl/openssl/0003-fix-CVE-2018-0735.patch @@ -0,0 +1,50 @@ +CVE: CVE-2018-0735 + +Upstream-Status: Backport + +Signed-off-by: Kai Kang <kai.kang@windriver.com> + +From b1d6d55ece1c26fa2829e2b819b038d7b6d692b4 Mon Sep 17 00:00:00 2001 +From: Pauli <paul.dale@oracle.com> +Date: Fri, 26 Oct 2018 10:54:58 +1000 +Subject: [PATCH] Timing vulnerability in ECDSA signature generation + (CVE-2018-0735) + +Preallocate an extra limb for some of the big numbers to avoid a reallocation +that can potentially provide a side channel. + +Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> +(Merged from https://github.com/openssl/openssl/pull/7486) + +(cherry picked from commit 99540ec79491f59ed8b46b4edf130e17dc907f52) +--- + crypto/ec/ec_mult.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/crypto/ec/ec_mult.c b/crypto/ec/ec_mult.c +index 7e1b3650e7..0e0a5e1394 100644 +--- a/crypto/ec/ec_mult.c ++++ b/crypto/ec/ec_mult.c +@@ -206,8 +206,8 @@ int ec_scalar_mul_ladder(const EC_GROUP *group, EC_POINT *r, + */ + cardinality_bits = BN_num_bits(cardinality); + group_top = bn_get_top(cardinality); +- if ((bn_wexpand(k, group_top + 1) == NULL) +- || (bn_wexpand(lambda, group_top + 1) == NULL)) { ++ if ((bn_wexpand(k, group_top + 2) == NULL) ++ || (bn_wexpand(lambda, group_top + 2) == NULL)) { + ECerr(EC_F_EC_SCALAR_MUL_LADDER, ERR_R_BN_LIB); + goto err; + } +@@ -244,7 +244,7 @@ int ec_scalar_mul_ladder(const EC_GROUP *group, EC_POINT *r, + * k := scalar + 2*cardinality + */ + kbit = BN_is_bit_set(lambda, cardinality_bits); +- BN_consttime_swap(kbit, k, lambda, group_top + 1); ++ BN_consttime_swap(kbit, k, lambda, group_top + 2); + + group_top = bn_get_top(group->field); + if ((bn_wexpand(s->X, group_top) == NULL) +-- +2.17.0 + diff --git a/poky/meta/recipes-connectivity/openssl/openssl/run-ptest b/poky/meta/recipes-connectivity/openssl/openssl/run-ptest index 65c6cc7b8..0a620dea7 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl/run-ptest +++ b/poky/meta/recipes-connectivity/openssl/openssl/run-ptest @@ -1,4 +1,12 @@ #!/bin/sh -cd test -OPENSSL_ENGINES=../engines BLDTOP=.. SRCTOP=.. perl run_tests.pl -cd .. + +set -e + +# Optional arguments are 'list' to lists all tests, or the test name (base name +# ie test_evp, not 03_test_evp.t). + +export TOP=. +# OPENSSL_ENGINES is relative from the test binaries +export OPENSSL_ENGINES=../engines + +perl ./test/run_tests.pl $* diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/0001-Fix-build-with-clang-using-external-assembler.patch b/poky/meta/recipes-connectivity/openssl/openssl10/0001-Fix-build-with-clang-using-external-assembler.patch index 2270962a6..2270962a6 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/0001-Fix-build-with-clang-using-external-assembler.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/0001-Fix-build-with-clang-using-external-assembler.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/0001-allow-manpages-to-be-disabled.patch b/poky/meta/recipes-connectivity/openssl/openssl10/0001-allow-manpages-to-be-disabled.patch index 3f7d64995..3f7d64995 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/0001-allow-manpages-to-be-disabled.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/0001-allow-manpages-to-be-disabled.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl10/0001-fix-CVE-2018-0734.patch b/poky/meta/recipes-connectivity/openssl/openssl10/0001-fix-CVE-2018-0734.patch new file mode 100644 index 000000000..b9865a69b --- /dev/null +++ b/poky/meta/recipes-connectivity/openssl/openssl10/0001-fix-CVE-2018-0734.patch @@ -0,0 +1,33 @@ +CVE: CVE-2018-0734 + +Upstream-Status: Backport + +Signed-off-by: Kai Kang <kai.kang@windriver.com> + +From 43e6a58d4991a451daf4891ff05a48735df871ac Mon Sep 17 00:00:00 2001 +From: Pauli <paul.dale@oracle.com> +Date: Mon, 29 Oct 2018 08:24:22 +1000 +Subject: [PATCH] Merge DSA reallocation timing fix CVE-2018-0734. + +Reviewed-by: Richard Levitte <levitte@openssl.org> +(Merged from https://github.com/openssl/openssl/pull/7513) +--- + crypto/dsa/dsa_ossl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/crypto/dsa/dsa_ossl.c b/crypto/dsa/dsa_ossl.c +index 2dcfedeeee..100e269268 100644 +--- a/crypto/dsa/dsa_ossl.c ++++ b/crypto/dsa/dsa_ossl.c +@@ -279,7 +279,7 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, + goto err; + + /* Preallocate space */ +- q_bits = BN_num_bits(dsa->q); ++ q_bits = BN_num_bits(dsa->q) + sizeof(dsa->q->d[0]) * 16; + if (!BN_set_bit(&k, q_bits) + || !BN_set_bit(&l, q_bits) + || !BN_set_bit(&m, q_bits)) +-- +2.17.0 + diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/0001-openssl-force-soft-link-to-avoid-rare-race.patch b/poky/meta/recipes-connectivity/openssl/openssl10/0001-openssl-force-soft-link-to-avoid-rare-race.patch index dd1a9b1dd..dd1a9b1dd 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/0001-openssl-force-soft-link-to-avoid-rare-race.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/0001-openssl-force-soft-link-to-avoid-rare-race.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/Makefiles-ptest.patch b/poky/meta/recipes-connectivity/openssl/openssl10/Makefiles-ptest.patch index 1b8402af9..1b8402af9 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/Makefiles-ptest.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/Makefiles-ptest.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/Use-SHA256-not-MD5-as-default-digest.patch b/poky/meta/recipes-connectivity/openssl/openssl10/Use-SHA256-not-MD5-as-default-digest.patch index 58c9ee784..58c9ee784 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/Use-SHA256-not-MD5-as-default-digest.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/Use-SHA256-not-MD5-as-default-digest.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/configure-musl-target.patch b/poky/meta/recipes-connectivity/openssl/openssl10/configure-musl-target.patch index f357b3f59..f357b3f59 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/configure-musl-target.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/configure-musl-target.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/configure-targets.patch b/poky/meta/recipes-connectivity/openssl/openssl10/configure-targets.patch index 1e0158972..1e0158972 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/configure-targets.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/configure-targets.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/c_rehash-compat.patch b/poky/meta/recipes-connectivity/openssl/openssl10/debian/c_rehash-compat.patch index 3820e3e30..3820e3e30 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/c_rehash-compat.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/debian/c_rehash-compat.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/debian-targets.patch b/poky/meta/recipes-connectivity/openssl/openssl10/debian/debian-targets.patch index 35d92bedb..24709f4f0 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/debian-targets.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/debian/debian-targets.patch @@ -42,8 +42,8 @@ Index: openssl-1.0.2n/Configure +"debian-mipsel", "gcc:-DL_ENDIAN -DTERMIO ${debian_cflags}::-D_REENTRANT::-ldl:BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL DES_RISC2:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", +"debian-mipsn32", "mips64-linux-gnuabin32-gcc:-DB_ENDIAN -DTERMIO ${debian_cflags}::-D_REENTRANT::-ldl:BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL DES_RISC2:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", +"debian-mipsn32el", "mips64el-linux-gnuabin32-gcc:-DL_ENDIAN -DTERMIO ${debian_cflags}::-D_REENTRANT::-ldl:BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL DES_RISC2:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -+"debian-mips64", "mips64-linux-gnuabi64-gcc:-DB_ENDIAN -DTERMIO ${debian_cflags}::-D_REENTRANT::-ldl:BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL DES_RISC2:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -+"debian-mips64el", "mips64el-linux-gnuabi64-gcc:-DL_ENDIAN -DTERMIO ${debian_cflags}::-D_REENTRANT::-ldl:BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL DES_RISC2:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", ++"debian-mips64", "mips64-linux-gnuabi64-gcc:-DB_ENDIAN -DTERMIO ${debian_cflags}::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL DES_RISC2:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", ++"debian-mips64el", "mips64el-linux-gnuabi64-gcc:-DL_ENDIAN -DTERMIO ${debian_cflags}::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL DES_RISC2:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", +"debian-netbsd-i386", "gcc:-DL_ENDIAN -DTERMIOS ${debian_cflags} -m486::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${no_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", +"debian-netbsd-m68k", "gcc:-DB_ENDIAN -DTERMIOS ${debian_cflags}::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL:${no_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", +"debian-netbsd-sparc", "gcc:-DB_ENDIAN -DTERMIOS ${debian_cflags} -mv8::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL:${no_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/man-dir.patch b/poky/meta/recipes-connectivity/openssl/openssl10/debian/man-dir.patch index 4085e3b1d..4085e3b1d 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/man-dir.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/debian/man-dir.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/man-section.patch b/poky/meta/recipes-connectivity/openssl/openssl10/debian/man-section.patch index 21c1d1a4e..21c1d1a4e 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/man-section.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/debian/man-section.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/no-rpath.patch b/poky/meta/recipes-connectivity/openssl/openssl10/debian/no-rpath.patch index 1ccb3b86e..1ccb3b86e 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/no-rpath.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/debian/no-rpath.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/no-symbolic.patch b/poky/meta/recipes-connectivity/openssl/openssl10/debian/no-symbolic.patch index cc4408ab7..cc4408ab7 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/no-symbolic.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/debian/no-symbolic.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/pic.patch b/poky/meta/recipes-connectivity/openssl/openssl10/debian/pic.patch index bfda3888b..bfda3888b 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian/pic.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/debian/pic.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian1.0.2/block_digicert_malaysia.patch b/poky/meta/recipes-connectivity/openssl/openssl10/debian1.0.2/block_digicert_malaysia.patch index c43bcd1c7..c43bcd1c7 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian1.0.2/block_digicert_malaysia.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/debian1.0.2/block_digicert_malaysia.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian1.0.2/block_diginotar.patch b/poky/meta/recipes-connectivity/openssl/openssl10/debian1.0.2/block_diginotar.patch index d81e22cd8..d81e22cd8 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian1.0.2/block_diginotar.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/debian1.0.2/block_diginotar.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian1.0.2/soname.patch b/poky/meta/recipes-connectivity/openssl/openssl10/debian1.0.2/soname.patch index 09dd9eaf8..09dd9eaf8 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian1.0.2/soname.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/debian1.0.2/soname.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian1.0.2/version-script.patch b/poky/meta/recipes-connectivity/openssl/openssl10/debian1.0.2/version-script.patch index e404ee331..e404ee331 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/debian1.0.2/version-script.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/debian1.0.2/version-script.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/engines-install-in-libdir-ssl.patch b/poky/meta/recipes-connectivity/openssl/openssl10/engines-install-in-libdir-ssl.patch index a5746483e..a5746483e 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/engines-install-in-libdir-ssl.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/engines-install-in-libdir-ssl.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/oe-ldflags.patch b/poky/meta/recipes-connectivity/openssl/openssl10/oe-ldflags.patch index 292e13dc5..292e13dc5 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/oe-ldflags.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/oe-ldflags.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/openssl-c_rehash.sh b/poky/meta/recipes-connectivity/openssl/openssl10/openssl-c_rehash.sh index 6620fdcb5..6620fdcb5 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/openssl-c_rehash.sh +++ b/poky/meta/recipes-connectivity/openssl/openssl10/openssl-c_rehash.sh diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/openssl-fix-des.pod-error.patch b/poky/meta/recipes-connectivity/openssl/openssl10/openssl-fix-des.pod-error.patch index de49729e5..de49729e5 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/openssl-fix-des.pod-error.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/openssl-fix-des.pod-error.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/openssl_fix_for_x32.patch b/poky/meta/recipes-connectivity/openssl/openssl10/openssl_fix_for_x32.patch index 0f08a642f..0f08a642f 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/openssl_fix_for_x32.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/openssl_fix_for_x32.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/parallel.patch b/poky/meta/recipes-connectivity/openssl/openssl10/parallel.patch index 41abf3d6b..41abf3d6b 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/parallel.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/parallel.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/ptest-deps.patch b/poky/meta/recipes-connectivity/openssl/openssl10/ptest-deps.patch index ef6d17934..ef6d17934 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/ptest-deps.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/ptest-deps.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/ptest_makefile_deps.patch b/poky/meta/recipes-connectivity/openssl/openssl10/ptest_makefile_deps.patch index 4202e61d1..4202e61d1 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/ptest_makefile_deps.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/ptest_makefile_deps.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/reproducible-cflags.patch b/poky/meta/recipes-connectivity/openssl/openssl10/reproducible-cflags.patch index 2803cb039..2803cb039 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/reproducible-cflags.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/reproducible-cflags.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/reproducible-mkbuildinf.patch b/poky/meta/recipes-connectivity/openssl/openssl10/reproducible-mkbuildinf.patch index b55673121..b55673121 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/reproducible-mkbuildinf.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/reproducible-mkbuildinf.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/run-ptest b/poky/meta/recipes-connectivity/openssl/openssl10/run-ptest index 3b20fce1e..3b20fce1e 100755 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/run-ptest +++ b/poky/meta/recipes-connectivity/openssl/openssl10/run-ptest diff --git a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/shared-libs.patch b/poky/meta/recipes-connectivity/openssl/openssl10/shared-libs.patch index a7ca0a307..a7ca0a307 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl-1.0.2p/shared-libs.patch +++ b/poky/meta/recipes-connectivity/openssl/openssl10/shared-libs.patch diff --git a/poky/meta/recipes-connectivity/openssl/openssl_1.0.2p.bb b/poky/meta/recipes-connectivity/openssl/openssl10_1.0.2p.bb index 5d419772f..432594070 100644 --- a/poky/meta/recipes-connectivity/openssl/openssl_1.0.2p.bb +++ b/poky/meta/recipes-connectivity/openssl/openssl10_1.0.2p.bb @@ -11,8 +11,6 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=f475368924827d06d4b416111c8bdb77" DEPENDS = "hostperl-runtime-native" DEPENDS_append_class-target = " openssl-native" -PROVIDES += "openssl10" - SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \ file://run-ptest \ file://openssl-c_rehash.sh \ @@ -42,6 +40,7 @@ SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \ file://0001-Fix-build-with-clang-using-external-assembler.patch \ file://0001-openssl-force-soft-link-to-avoid-rare-race.patch \ file://0001-allow-manpages-to-be-disabled.patch \ + file://0001-fix-CVE-2018-0734.patch \ " SRC_URI_append_class-target = " \ @@ -56,9 +55,11 @@ SRC_URI_append_class-nativesdk = " \ SRC_URI[md5sum] = "ac5eb30bf5798aa14b1ae6d0e7da58df" SRC_URI[sha256sum] = "50a98e07b1a89eb8f6a99477f262df71c6fa7bef77df4dc83025a2845c827d00" +S = "${WORKDIR}/openssl-${PV}" + UPSTREAM_CHECK_REGEX = "openssl-(?P<pver>1\.0.+)\.tar" -inherit pkgconfig siteinfo multilib_header ptest relative_symlinks manpages +inherit pkgconfig siteinfo multilib_header ptest manpages PACKAGECONFIG ?= "cryptodev-linux" PACKAGECONFIG_class-native = "" @@ -164,7 +165,7 @@ do_configure () { linux-mips*) target=debian-mips ;; - linux-microblaze*|linux-nios2*|linux-gnu*ilp32**) + linux-microblaze* | linux-nios2* | linux-gnu*ilp32** | linux-arc*) target=linux-generic32 ;; linux-powerpc) @@ -179,10 +180,7 @@ do_configure () { linux-riscv64) target=linux-generic64 ;; - linux-supersparc) - target=linux-sparcv8 - ;; - linux-sparc) + linux-sparc | linux-supersparc) target=linux-sparcv8 ;; esac @@ -194,7 +192,7 @@ do_configure () { if [ "x$useprefix" = "x" ]; then useprefix=/ fi - libdirleaf="$(echo ${libdir} | sed s:$useprefix::)" + libdirleaf="$( echo "${libdir}" | sed "s:^$useprefix/*::" )" perl ./Configure ${EXTRA_OECONF} ${PACKAGECONFIG_CONFARGS} shared --prefix=$useprefix --openssldir=${libdir}/ssl --libdir=$libdirleaf $target } @@ -226,10 +224,11 @@ do_install () { install -d ${D}${includedir} cp --dereference -R include/openssl ${D}${includedir} + oe_multilib_header openssl/opensslconf.h + install -Dm 0755 ${WORKDIR}/openssl-c_rehash.sh ${D}${bindir}/c_rehash sed -i -e 's,/etc/openssl,${sysconfdir}/ssl,g' ${D}${bindir}/c_rehash - oe_multilib_header openssl/opensslconf.h if [ "${@bb.utils.filter('PACKAGECONFIG', 'perl', d)}" ]; then sed -i -e '1s,.*,#!${bindir}/env perl,' ${D}${libdir}/ssl/misc/CA.pl sed -i -e '1s,.*,#!${bindir}/env perl,' ${D}${libdir}/ssl/misc/tsget @@ -237,16 +236,19 @@ do_install () { rm -f ${D}${libdir}/ssl/misc/CA.pl ${D}${libdir}/ssl/misc/tsget fi - # Create SSL structure - install -d ${D}${sysconfdir}/ssl/ - mv ${D}${libdir}/ssl/openssl.cnf \ - ${D}${libdir}/ssl/certs \ + # Create SSL structure for packages such as ca-certificates which + # contain hard-coded paths to /etc/ssl. Debian does the same. + install -d ${D}${sysconfdir}/ssl + mv ${D}${libdir}/ssl/certs \ ${D}${libdir}/ssl/private \ - \ + ${D}${libdir}/ssl/openssl.cnf \ ${D}${sysconfdir}/ssl/ - ln -sf ${sysconfdir}/ssl/certs ${D}${libdir}/ssl/certs - ln -sf ${sysconfdir}/ssl/private ${D}${libdir}/ssl/private - ln -sf ${sysconfdir}/ssl/openssl.cnf ${D}${libdir}/ssl/openssl.cnf + + # Although absolute symlinks would be OK for the target, they become + # invalid if native or nativesdk are relocated from sstate. + ln -sf ${@oe.path.relative('${libdir}/ssl', '${sysconfdir}/ssl/certs')} ${D}${libdir}/ssl/certs + ln -sf ${@oe.path.relative('${libdir}/ssl', '${sysconfdir}/ssl/private')} ${D}${libdir}/ssl/private + ln -sf ${@oe.path.relative('${libdir}/ssl', '${sysconfdir}/ssl/openssl.cnf')} ${D}${libdir}/ssl/openssl.cnf # Rename man pages to prefix openssl10-* for f in `find ${D}${mandir} -type f`; do @@ -259,6 +261,19 @@ do_install () { done } +do_install_append_class-native () { + create_wrapper ${D}${bindir}/openssl \ + OPENSSL_CONF=${libdir}/ssl/openssl.cnf \ + SSL_CERT_DIR=${libdir}/ssl/certs \ + SSL_CERT_FILE=${libdir}/ssl/cert.pem \ + OPENSSL_ENGINES=${libdir}/ssl/engines +} + +do_install_append_class-nativesdk () { + mkdir -p ${D}${SDKPATHNATIVE}/environment-setup.d + install -m 644 ${WORKDIR}/environment.d-openssl.sh ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh +} + do_install_ptest () { cp -r -L Makefile.org Makefile test ${D}${PTEST_PATH} @@ -307,38 +322,40 @@ do_install_ptest () { ${D}${PTEST_PATH}/Makefile ${D}${PTEST_PATH}/Configure } -do_install_append_class-native() { - create_wrapper ${D}${bindir}/openssl \ - OPENSSL_CONF=${libdir}/ssl/openssl.cnf \ - SSL_CERT_DIR=${libdir}/ssl/certs \ - SSL_CERT_FILE=${libdir}/ssl/cert.pem \ - OPENSSL_ENGINES=${libdir}/ssl/engines -} - -do_install_append_class-nativesdk() { - mkdir -p ${D}${SDKPATHNATIVE}/environment-setup.d - install -m 644 ${WORKDIR}/environment.d-openssl.sh ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh -} - -# Add the openssl.cnf file to the openssl-conf package. Make the libcrypto -# package RRECOMMENDS on this package. This will enable the configuration +# Add the openssl.cnf file to the openssl-conf package. Make the libcrypto +# package RRECOMMENDS on this package. This will enable the configuration # file to be installed for both the base openssl package and the libcrypto # package since the base openssl package depends on the libcrypto package. -PACKAGES =+ "libcrypto libssl openssl-conf ${PN}-engines ${PN}-misc" +PACKAGES =+ "libcrypto10 libssl10 openssl10-conf ${PN}-engines ${PN}-misc" -FILES_libcrypto = "${libdir}/libcrypto${SOLIBS}" -FILES_libssl = "${libdir}/libssl${SOLIBS}" -FILES_openssl-conf = "${sysconfdir}/ssl/openssl.cnf" +FILES_libcrypto10 = "${libdir}/libcrypto${SOLIBS}" +FILES_libssl10 = "${libdir}/libssl${SOLIBS}" +FILES_openssl10-conf = "${sysconfdir}/ssl/openssl.cnf" FILES_${PN}-engines = "${libdir}/ssl/engines/*.so ${libdir}/engines" FILES_${PN}-misc = "${libdir}/ssl/misc" FILES_${PN} =+ "${libdir}/ssl/*" FILES_${PN}_append_class-nativesdk = " ${SDKPATHNATIVE}/environment-setup.d/openssl.sh" -CONFFILES_openssl-conf = "${sysconfdir}/ssl/openssl.cnf" +CONFFILES_openssl10-conf = "${sysconfdir}/ssl/openssl.cnf" -RRECOMMENDS_libcrypto += "openssl-conf" +RRECOMMENDS_libcrypto10 += "openssl10-conf" RDEPENDS_${PN}-misc = "${@bb.utils.filter('PACKAGECONFIG', 'perl', d)}" RDEPENDS_${PN}-ptest += "${PN}-misc make perl perl-module-filehandle bc" BBCLASSEXTEND = "native nativesdk" +PACKAGE_PREPROCESS_FUNCS += "openssl_package_preprocess" + +# openssl 1.0 development files and executable binaries clash with openssl 1.1 +# files when installed into target rootfs. So we don't put them into +# packages, but they continue to be provided via target sysroot for +# cross-compilation on the host, if some software still depends on openssl 1.0. +openssl_package_preprocess () { + for file in `find ${PKGD} -name *.h -o -name *.pc -o -name *.so`; do + rm $file + done + rm ${PKGD}/usr/bin/openssl + rm ${PKGD}/usr/bin/c_rehash + rmdir ${PKGD}/usr/bin + +} diff --git a/poky/meta/recipes-connectivity/openssl/openssl_1.1.0i.bb b/poky/meta/recipes-connectivity/openssl/openssl_1.1.0i.bb deleted file mode 100644 index e7006268f..000000000 --- a/poky/meta/recipes-connectivity/openssl/openssl_1.1.0i.bb +++ /dev/null @@ -1,170 +0,0 @@ -SUMMARY = "Secure Socket Layer" -DESCRIPTION = "Secure Socket Layer (SSL) binary and related cryptographic tools." -HOMEPAGE = "http://www.openssl.org/" -BUGTRACKER = "http://www.openssl.org/news/vulnerabilities.html" -SECTION = "libs/network" - -# "openssl | SSLeay" dual license -LICENSE = "openssl" -LIC_FILES_CHKSUM = "file://LICENSE;md5=d57d511030c9d66ef5f5966bee5a7eff" - -DEPENDS = "hostperl-runtime-native" - -SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \ - file://run-ptest \ - file://openssl-c_rehash.sh \ - file://0001-Take-linking-flags-from-LDFLAGS-env-var.patch \ - " - -SRC_URI_append_class-nativesdk = " \ - file://environment.d-openssl.sh \ - " - -SRC_URI[md5sum] = "9495126aafd2659d357ea66a969c3fe1" -SRC_URI[sha256sum] = "ebbfc844a8c8cc0ea5dc10b86c9ce97f401837f3fa08c17b2cdadc118253cf99" - -inherit lib_package multilib_header ptest - -#| engines/afalg/e_afalg.c: In function 'eventfd': -#| engines/afalg/e_afalg.c:110:20: error: '__NR_eventfd' undeclared (first use in this function) -#| return syscall(__NR_eventfd, n); -#| ^~~~~~~~~~~~ -EXTRA_OECONF_append_aarch64 = " no-afalgeng" - -#| ./libcrypto.so: undefined reference to `getcontext' -#| ./libcrypto.so: undefined reference to `setcontext' -#| ./libcrypto.so: undefined reference to `makecontext' -EXTRA_OECONF_append_libc-musl = " -DOPENSSL_NO_ASYNC" - -do_configure () { - os=${HOST_OS} - case $os in - linux-gnueabi |\ - linux-gnuspe |\ - linux-musleabi |\ - linux-muslspe |\ - linux-musl ) - os=linux - ;; - *) - ;; - esac - target="$os-${HOST_ARCH}" - case $target in - linux-arm) - target=linux-armv4 - ;; - linux-armeb) - target=linux-armv4 - ;; - linux-aarch64*) - target=linux-aarch64 - ;; - linux-sh3) - target=linux-generic32 - ;; - linux-sh4) - target=linux-generic32 - ;; - linux-i486) - target=linux-elf - ;; - linux-i586 | linux-viac3) - target=linux-elf - ;; - linux-i686) - target=linux-elf - ;; - linux-gnux32-x86_64 | linux-muslx32-x86_64 ) - target=linux-x32 - ;; - linux-gnu64-x86_64) - target=linux-x86_64 - ;; - linux-mips) - # specifying TARGET_CC_ARCH prevents openssl from (incorrectly) adding target architecture flags - target="linux-mips32 ${TARGET_CC_ARCH}" - ;; - linux-mipsel) - target="linux-mips32 ${TARGET_CC_ARCH}" - ;; - linux-gnun32-mips*) - target=linux-mips64 - ;; - linux-*-mips64 | linux-mips64) - target=linux64-mips64 - ;; - linux-*-mips64el | linux-mips64el) - target=linux64-mips64 - ;; - linux-microblaze*|linux-nios2*) - target=linux-generic32 - ;; - linux-powerpc) - target=linux-ppc - ;; - linux-powerpc64) - target=linux-ppc64 - ;; - linux-riscv32) - target=linux-generic32 - ;; - linux-riscv64) - target=linux-generic64 - ;; - linux-supersparc) - target=linux-sparcv9 - ;; - linux-sparc) - target=linux-sparcv9 - ;; - darwin-i386) - target=darwin-i386-cc - ;; - esac - - useprefix=${prefix} - if [ "x$useprefix" = "x" ]; then - useprefix=/ - fi - libdirleaf="$(echo ${libdir} | sed s:$useprefix::)" - perl ./Configure ${EXTRA_OECONF} ${PACKAGECONFIG_CONFARGS} --prefix=$useprefix --openssldir=${libdir}/ssl-1.1 --libdir=$libdirleaf $target -} - -do_install () { - oe_runmake DESTDIR="${D}" MANDIR="${mandir}" MANSUFFIX=ssl install - oe_multilib_header openssl/opensslconf.h -} - -do_install_append_class-native () { - # Install a custom version of c_rehash that can handle sysroots properly. - # This version is used for example when installing ca-certificates during - # image creation. - install -Dm 0755 ${WORKDIR}/openssl-c_rehash.sh ${D}${bindir}/c_rehash - sed -i -e 's,/etc/openssl,${sysconfdir}/ssl,g' ${D}${bindir}/c_rehash -} - -do_install_append_class-nativesdk () { - mkdir -p ${D}${SDKPATHNATIVE}/environment-setup.d - install -m 644 ${WORKDIR}/environment.d-openssl.sh ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh -} - -do_install_ptest() { - cp -r * ${D}${PTEST_PATH} - - # Putting .so files in ptest package will mess up the dependencies of the main openssl package - # so we rename them to .so.ptest and patch the test accordingly - mv ${D}${PTEST_PATH}/libcrypto.so ${D}${PTEST_PATH}/libcrypto.so.ptest - mv ${D}${PTEST_PATH}/libssl.so ${D}${PTEST_PATH}/libssl.so.ptest - sed -i 's/$target{shared_extension_simple}/".so.ptest"/' ${D}${PTEST_PATH}/test/recipes/90-test_shlibload.t -} - -PACKAGES =+ "${PN}-engines" - -FILES_${PN} =+ "${libdir}/ssl-1.1/*" -FILES_${PN}_append_class-nativesdk = " ${SDKPATHNATIVE}/environment-setup.d/openssl.sh" -FILES_${PN}-engines = "${libdir}/engines-1.1" - -RDEPENDS_${PN}-ptest += "perl-module-file-spec-functions bash python" - -BBCLASSEXTEND = "native nativesdk" diff --git a/poky/meta/recipes-connectivity/openssl/openssl_1.1.1.bb b/poky/meta/recipes-connectivity/openssl/openssl_1.1.1.bb new file mode 100644 index 000000000..1234b64b8 --- /dev/null +++ b/poky/meta/recipes-connectivity/openssl/openssl_1.1.1.bb @@ -0,0 +1,205 @@ +SUMMARY = "Secure Socket Layer" +DESCRIPTION = "Secure Socket Layer (SSL) binary and related cryptographic tools." +HOMEPAGE = "http://www.openssl.org/" +BUGTRACKER = "http://www.openssl.org/news/vulnerabilities.html" +SECTION = "libs/network" + +# "openssl" here actually means both OpenSSL and SSLeay licenses apply +# (see meta/files/common-licenses/OpenSSL to which "openssl" is SPDXLICENSEMAPped) +LICENSE = "openssl" +LIC_FILES_CHKSUM = "file://LICENSE;md5=d57d511030c9d66ef5f5966bee5a7eff" + +DEPENDS = "hostperl-runtime-native" + +SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \ + file://run-ptest \ + file://openssl-c_rehash.sh \ + file://0001-skip-test_symbol_presence.patch \ + file://0002-fix-CVE-2018-0734.patch \ + file://0003-fix-CVE-2018-0735.patch \ + file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \ + " + +SRC_URI_append_class-nativesdk = " \ + file://environment.d-openssl.sh \ + " + +SRC_URI[md5sum] = "7079eb017429e0ffb9efb42bf80ccb21" +SRC_URI[sha256sum] = "2836875a0f89c03d0fdf483941512613a50cfb421d6fd94b9f41d7279d586a3d" + +inherit lib_package multilib_header ptest + +B = "${WORKDIR}/build" +do_configure[cleandirs] = "${B}" + +#| ./libcrypto.so: undefined reference to `getcontext' +#| ./libcrypto.so: undefined reference to `setcontext' +#| ./libcrypto.so: undefined reference to `makecontext' +EXTRA_OECONF_append_libc-musl = " no-async" + +# This prevents openssl from using getrandom() which is not available on older glibc versions +# (native versions can be built with newer glibc, but then relocated onto a system with older glibc) +EXTRA_OECONF_class-native = "--with-rand-seed=devrandom" +EXTRA_OECONF_class-nativesdk = "--with-rand-seed=devrandom" + +# Relying on hardcoded built-in paths causes openssl-native to not be relocateable from sstate. +CFLAGS_append_class-native = " -DOPENSSLDIR=/not/builtin -DENGINESDIR=/not/builtin" +CFLAGS_append_class-nativesdk = " -DOPENSSLDIR=/not/builtin -DENGINESDIR=/not/builtin" + +do_configure () { + os=${HOST_OS} + case $os in + linux-gnueabi |\ + linux-gnuspe |\ + linux-musleabi |\ + linux-muslspe |\ + linux-musl ) + os=linux + ;; + *) + ;; + esac + target="$os-${HOST_ARCH}" + case $target in + linux-arm*) + target=linux-armv4 + ;; + linux-aarch64*) + target=linux-aarch64 + ;; + linux-i?86 | linux-viac3) + target=linux-x86 + ;; + linux-gnux32-x86_64 | linux-muslx32-x86_64 ) + target=linux-x32 + ;; + linux-gnu64-x86_64) + target=linux-x86_64 + ;; + linux-mips | linux-mipsel) + # specifying TARGET_CC_ARCH prevents openssl from (incorrectly) adding target architecture flags + target="linux-mips32 ${TARGET_CC_ARCH}" + ;; + linux-gnun32-mips*) + target=linux-mips64 + ;; + linux-*-mips64 | linux-mips64 | linux-*-mips64el | linux-mips64el) + target=linux64-mips64 + ;; + linux-microblaze* | linux-nios2* | linux-sh3 | linux-sh4 | linux-arc*) + target=linux-generic32 + ;; + linux-powerpc) + target=linux-ppc + ;; + linux-powerpc64) + target=linux-ppc64 + ;; + linux-riscv32) + target=linux-generic32 + ;; + linux-riscv64) + target=linux-generic64 + ;; + linux-sparc | linux-supersparc) + target=linux-sparcv9 + ;; + esac + + useprefix=${prefix} + if [ "x$useprefix" = "x" ]; then + useprefix=/ + fi + # WARNING: do not set compiler/linker flags (-I/-D etc.) in EXTRA_OECONF, as they will fully replace the + # environment variables set by bitbake. Adjust the environment variables instead. + PERL5LIB="${S}/external/perl/Text-Template-1.46/lib/" \ + perl ${S}/Configure ${EXTRA_OECONF} ${PACKAGECONFIG_CONFARGS} --prefix=$useprefix --openssldir=${libdir}/ssl-1.1 --libdir=${libdir} $target +} + +do_install () { + oe_runmake DESTDIR="${D}" MANDIR="${mandir}" MANSUFFIX=ssl install + + oe_multilib_header openssl/opensslconf.h + + # Create SSL structure for packages such as ca-certificates which + # contain hard-coded paths to /etc/ssl. Debian does the same. + install -d ${D}${sysconfdir}/ssl + mv ${D}${libdir}/ssl-1.1/certs \ + ${D}${libdir}/ssl-1.1/private \ + ${D}${libdir}/ssl-1.1/openssl.cnf \ + ${D}${sysconfdir}/ssl/ + + # Although absolute symlinks would be OK for the target, they become + # invalid if native or nativesdk are relocated from sstate. + ln -sf ${@oe.path.relative('${libdir}/ssl-1.1', '${sysconfdir}/ssl/certs')} ${D}${libdir}/ssl-1.1/certs + ln -sf ${@oe.path.relative('${libdir}/ssl-1.1', '${sysconfdir}/ssl/private')} ${D}${libdir}/ssl-1.1/private + ln -sf ${@oe.path.relative('${libdir}/ssl-1.1', '${sysconfdir}/ssl/openssl.cnf')} ${D}${libdir}/ssl-1.1/openssl.cnf +} + +do_install_append_class-native () { + create_wrapper ${D}${bindir}/openssl \ + OPENSSL_CONF=${libdir}/ssl-1.1/openssl.cnf \ + SSL_CERT_DIR=${libdir}/ssl-1.1/certs \ + SSL_CERT_FILE=${libdir}/ssl-1.1/cert.pem \ + OPENSSL_ENGINES=${libdir}/ssl-1.1/engines + + # Install a custom version of c_rehash that can handle sysroots properly. + # This version is used for example when installing ca-certificates during + # image creation. + install -Dm 0755 ${WORKDIR}/openssl-c_rehash.sh ${D}${bindir}/c_rehash + sed -i -e 's,/etc/openssl,${sysconfdir}/ssl,g' ${D}${bindir}/c_rehash +} + +do_install_append_class-nativesdk () { + mkdir -p ${D}${SDKPATHNATIVE}/environment-setup.d + install -m 644 ${WORKDIR}/environment.d-openssl.sh ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh + sed 's|/usr/lib/ssl/|/usr/lib/ssl-1.1/|g' -i ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh +} + +do_install_ptest () { + # Prune the build tree + rm -f ${B}/fuzz/*.* ${B}/test/*.* + + cp ${S}/Configure ${B}/configdata.pm ${D}${PTEST_PATH} + cp -r ${S}/external ${B}/test ${S}/test ${B}/fuzz ${S}/util ${B}/util ${D}${PTEST_PATH} + + # For test_shlibload + ln -s ${libdir}/libcrypto.so.1.1 ${D}${PTEST_PATH}/libcrypto.so + ln -s ${libdir}/libssl.so.1.1 ${D}${PTEST_PATH}/libssl.so + + install -d ${D}${PTEST_PATH}/apps + ln -s ${bindir}/openssl ${D}${PTEST_PATH}/apps + install -m644 ${S}/apps/*.pem ${S}/apps/*.srl ${S}/apps/openssl.cnf ${D}${PTEST_PATH}/apps + install -m755 ${B}/apps/CA.pl ${D}${PTEST_PATH}/apps + + install -d ${D}${PTEST_PATH}/engines + install -m755 ${B}/engines/ossltest.so ${D}${PTEST_PATH}/engines +} + +# Add the openssl.cnf file to the openssl-conf package. Make the libcrypto +# package RRECOMMENDS on this package. This will enable the configuration +# file to be installed for both the openssl-bin package and the libcrypto +# package since the openssl-bin package depends on the libcrypto package. + +PACKAGES =+ "libcrypto libssl openssl-conf ${PN}-engines ${PN}-misc" + +FILES_libcrypto = "${libdir}/libcrypto${SOLIBS}" +FILES_libssl = "${libdir}/libssl${SOLIBS}" +FILES_openssl-conf = "${sysconfdir}/ssl/openssl.cnf" +FILES_${PN}-engines = "${libdir}/engines-1.1" +FILES_${PN}-misc = "${libdir}/ssl-1.1/misc" +FILES_${PN} =+ "${libdir}/ssl-1.1/*" +FILES_${PN}_append_class-nativesdk = " ${SDKPATHNATIVE}/environment-setup.d/openssl.sh" + +CONFFILES_openssl-conf = "${sysconfdir}/ssl/openssl.cnf" + +RRECOMMENDS_libcrypto += "openssl-conf" +RDEPENDS_${PN}-bin = "perl" +RDEPENDS_${PN}-misc = "perl" +RDEPENDS_${PN}-ptest += "openssl-bin perl perl-modules bash python" + +RPROVIDES_openssl-conf = "openssl10-conf" +RREPLACES_openssl-conf = "openssl10-conf" +RCONFLICTS_openssl-conf = "openssl10-conf" + +BBCLASSEXTEND = "native nativesdk" |