summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/openssl
AgeCommit message (Collapse)Author
2021-08-26openssl: upgrade from 1.1.1k to 1.1.1lRandy MacLeod
Includes fixes for: CVE: CVE-2021-3711 CVE: CVE-2021-3712 as described by: https://www.openssl.org/news/secadv/20210824.txt Ptest results on qemux86-64 with kvm: All tests successful. Files=158, Tests=2532, 137 wallclock secs \ ( 2.59 usr 0.33 sys + 104.71 cusr 44.19 csys = 151.82 CPU) Result: PASS DURATION: 137 Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-07-30Convert to new override syntaxRichard Purdie
This is the result of automated script conversion: scripts/contrib/convert-overrides.py <oe-core directory> converting the metadata to use ":" as the override character instead of "_". Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-05-01openssl: Filter out -ffile-prefix-map as wellKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-03-28openssl: update to 1.1.1k to fix CVE-2021-3450 and CVE-2021-3449Mikko Rapeli
Only security issues fixed in this release according to https://www.openssl.org/news/cl111.txt Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-03-11openssl: Enable building for RISC-V 32-bitAlistair Francis
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-03-02openssl: address ptest failures caused by perl 5.32.1Alexander Kanavin
For some reason the new perl no longer has . in list of directories searched in 'require', and so the file needs to be copied where perl can find it. Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-02-23openssl: upgrade 1.1.1i -> 1.1.1jWang Mingyu
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-02-06openssl: re-enable whirlpoolAndreas Müller
* it breaks KDE's qca and dependencies * it is not deprecated. Openssl 3.0 (currently alpha) will deprecate whirlpool [1] https://www.openssl.org/news/changelog.html#openssl-30 Signed-off-by: Andreas Müller <schnitzeltony@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-02-03openssl: set CVE_VERSION_SUFFIXLee Chee Yang
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-01-27openssl: Enable srp algorithmakuster
This is still needed by libest in meta-security Signed-off-by: Armin Kuster <akuster808@gmail.com> Cc: Shachar Menashe <shachar@vdoo.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-01-12openssl: Enable psk for qtbaseKhem Raj
TLS 1.3 implementation in qt5 uses psk so retain it for now Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-01-12openssl: Enable rc4/rc2/bf/md4 algorithmsKhem Raj
They are still needed by several packages in meta-openembedded Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Shachar Menashe <shachar@vdoo.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-01-12openssl: drop support for deprecated algorithmsShachar Menashe
1. Drop support for many deprecated algorithms by default 2. Allow dropping support for TLS 1.0/1.1 via PACKAGECONFIG Signed-off-by: Shachar Menashe <shachar@vdoo.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-12-18openssl: add support for mingw64 as targetDeepak Rawat
Engines are installed in a slightly different path, and the host type doesn't precisely match in x86_64 Co-authored-by: Paul Eggleton <paul.eggleton@microsoft.com> Co-authored-by: Deepak Rawat <derawa@microsoft.com> Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-12-18openssl: Update 1.1.1h -> 1.1.1iKhairul Rohaizzat Jamaluddin
update version to 1.1.1i openssl 1.1.1i Fixed NULL pointer deref in GENERAL_NAME_cmp (CVE-2020-1971) updates include fix for CVE: CVE-2020-1971 Signed-off-by: Khairul Rohaizzat Jamaluddin <khairul.rohaizzat.jamaluddin@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-11-11openssl: Add c_rehash to misc package and add perl runtime dependencyFederico Pellegrin
The following changes since commit f075071761172c69f8ae2be5868d51ef9ef646e7: conf: update for release 3.2 (2020-11-09 13:16:13 +0000) are available in the Git repository at: git://push.yoctoproject.org/poky-contrib fedepell/bug14083 Federico Pellegrin (1): openssl: Add c_rehash to misc package and add perl runtime dependency c_rehash implemented in perl is back (in history was moved to shell for some time), so handle it inside the -misc package so just that one will carry the heavy runtime dependency on perl and not the whole openssl package. Note: in misc there were already before a few perl files (tsget.pl and CA.pl) so the added perl dependency will fix those too. [YOCTO #14083] Signed-off-by: Federico Pellegrin <fede@evolware.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-11-03openssl: upgrade 1.1.1g -> 1.1.1hAlexander Kanavin
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-07-19openssl: openssl-bin requires openssl-conf to runRobert Yang
Fixed: $ dnf install openssl-bin $ openssl req -new -x509 -keyout lighttpd.pem -out lighttpd.pem -days 365 -nodes -batch Can't open /usr/lib/ssl-1.1/openssl.cnf for reading, No such file or directory Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-07-08openssl: move ${libdir}/[...]/openssl.cnf to ${PN}-confHannu Lounento
Some openssl command line operations like creating an X.509 CSR require the file /usr/lib/ssl-1.1/openssl.cnf to exist and fail if it doesn't root@qemux86-64:~# openssl req -out my.csr -new -newkey rsa:2048 -nodes -keyout my.key Can't open /usr/lib/ssl-1.1/openssl.cnf for reading, No such file or directory 140289168594176:error:02001002:system library:fopen:No such file or directory:../openssl-1.1.1g/crypto/bio/bss_file.c:69:fopen('/usr/lib/ssl-1.1/openssl.cnf','r') 140289168594176:error:2006D080:BIO routines:BIO_new_file:no such file:../openssl-1.1.1g/crypto/bio/bss_file.c:76: which is the case e.g. in core-image-minimal with just the package openssl-bin added to the image by declaring IMAGE_INSTALL_append = " openssl-bin" e.g. in local.conf. The file did not exist in the aforementioned image / configuration because it was packaged to the main openssl package FILES_${PN} =+ "${libdir}/ssl-1.1/*" (there is no other FILES specification that would match the file either) and path/to/poky/build$ rpm --query --package --list tmp/deploy/rpm/core2_64/openssl-1.1.1g-r0.core2_64.rpm [...] /usr/lib/ssl-1.1/openssl.cnf [...] Hence move /usr/lib/ssl-1.1/openssl.cnf (and openssl.cnf.dist as it seems closely related) to the ${PN}-conf package to have it installed with ${PN}-bin, which already (indirectly) depends on ${PN}-conf. Note that the openssl recipe has the comment Add the openssl.cnf file to the openssl-conf package. Make the libcrypto package RRECOMMENDS on this package. This will enable the configuration file to be installed for both the openssl-bin package and the libcrypto package since the openssl-bin package depends on the libcrypto package. but openssl-conf only contained /etc/ssl/openssl.cnf path/to/poky/build$ rpm --query --package --list tmp/deploy/rpm/core2_64/openssl-conf-1.1.1g-r0.core2_64.rpm /etc /etc/ssl /etc/ssl/openssl.cnf /usr/lib/ssl-1.1/openssl.cnf is actually only a symlink that points to ../../../etc/ssl/openssl.cnf. Other files and directories in /usr/lib/ssl-1.1/ were considered as well because they seem to be configuration files and / or related to (symlinks pointing to) /etc. They were not moved though, because based on our use case and testing moving the openssl.cnf symlink is sufficient for fixing the immediate problem and we lack knowledge about the other files in order to make a decision to change their packaging. Signed-off-by: Hannu Lounento <hannu.lounento@vaisala.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-05-02openssl: upgrade 1.1.1f -> 1.1.1gJan Luebbe
This also fixes CVE-2020-1967. Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-04-01openssl: update to 1.1.1fAlexander Kanavin
This also un-breaks python3 ptest which got broken with 1.1.1e update. Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-03-23openssl: Upgrade 1.1.1d -> 1.1.1eAdrian Bunk
Backported patch removed. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-03-08openssl: fix perl shebang in c_rehashMartin Jansa
* passing PERL=perl breaks c_rehash calls from dash (works fine with bash) dash doesn't like #!perl shebang PERL="/usr/bin/env perl" unfortunately just passing PERL like this doesn't pass do_configure: Creating Makefile sh: 1: /usr/bin/env perl: not found WARNING: exit code 1 from a shell command. But passing it as: HASHBANGPERL="/usr/bin/env perl" PERL=perl seems to work. Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-03-08openssl: recommend cryptodev-module for corresponding PACKAGECONFIGDenys Dmytriyenko
Signed-off-by: Denys Dmytriyenko <denys@ti.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-03-06openssl: pass PERL=perl environment variable to configuratorRuslan Bilovol
In our build environment we use wrapper script for perl in non-standard configuration with extra variables set (provided by custom buildtools-tarball). In this case openssl fails to build because by default it's Configure script detects and uses perl executable directly (with absolute path) obviously missing extra settings from wrapper script. Pass PERL=perl environment variable to Configure, so it won't try to use perl executable directly but will use what is provided from environment. Signed-off-by: Ruslan Bilovol <rbilovol@cisco.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-08openssl: Fix reproducibility issueRichard Purdie
There was a build architecture leaking into the target ptest which could vary depending upon host. Remove it as its cosmetic. [YOCTO #13770] Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-19openssl: Add powerpc64 LE supportKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-12-16openssl: fix CVE-2019-1551Anuj Mittal
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-12-09openssl: Whitelist CVE-2019-0190Adrian Bunk
This is only a problem with older Apache versions. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-23openssl: make OPENSSL_ENGINES match install pathGeorge McCollister
Set OPENSSL_ENGINES to the path where engines are actually installed. Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-09-18openssl: Enable os option for with-rand-seed as wellKhem Raj
with openSSL 1.1.1d we start seeing errors like Error Generating Key 139979727451584:error:2406C06E:random number generator:RAND_DRBG_instantiate:error retrieving entropy:../openssl-1.1.1d/crypto/rand/drbg_lib.c:342: when using openssl from openssl-native on build hosts, this is due to limiting the random seed to devrandom, to support older hosts, since the option allows to have a comma separated list of methods to try, we can try the default first and if that fails then fallback to devrandom, this will ensure that it keeps working with build systems which dont support getrandom() Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Adrian Bunk <bunk@stusta.de> Cc: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-16openssl: Upgrade 1.1.1c -> 1.1.1dAdrian Bunk
Backported patches removed. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-20openssl: fix valgrind errors on v1.1.1cBonnans, Laurent
Running valgrind against code using Openssl v1.1.1c reports a large number of uninitialized memory errors. This fix from upstream solves this problem. Signed-off-by: Laurent Bonnans <laurent.bonnans@here.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-18openssl: set CVE vendor to opensslAnuj Mittal
Differentiate it from openssl gem for Ruby. Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-11openssl: fix multilib files conflictKai Kang
Inherit multilib_script to fix openssl multilib files conflict issue: | Error: Transaction check error: | file /usr/bin/c_rehash conflicts between attempted installs of | lib32-openssl-bin-1.1.1c-r0.core2_32 and openssl-bin-1.1.1c-r0.core2_64 Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-06-18openssl: Fix a build bug on aarch64BE.Lei Maohui
Fix bug as following on aarch64BE: Error: operand 1 must be an integer register -- `rev v31.16b,v31.16b' Signed-off-by: Lei Maohui <leimaohui@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-06-18openssl: fix failure of ptest test_shlibloadKai Kang
It fails to run ptest case test_shlibload which requires libcrypto.so and libssl.so with version numbers now. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-06-07openssl: Upgrade 1.1.1b -> 1.1.1cAdrian Bunk
Backported patch removed. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-05-15openssl: Remove openssl10Adrian Bunk
OpenSSL 1.0 has been replaced by 1.1, and it would be harder to security-support after the upstream EOL at the end of 2019. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-29openssl: follow OE's rule for specifying CVE IDChen Qi
Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-19openssl10: Upgrade 1.0.2q -> 1.0.2rOtavio Salvador
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-19openssl: Upgrade 1.1.1a -> 1.1.1bOtavio Salvador
License-Update: copyright years updated Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-19openssl: Remove the c_rehash shell re-implementationOtavio Salvador
We had a c_rehash shell re-implementation being used for the native package however the ca-certificates now uses the openssl rehash internal application so there is no use for the c_rehash anymore. Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-18openssl: fix CVE-2019-1543Ross Burton
Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-04openssl: Add cryptodev-linux PACKAGECONFIGOvidiu Panait
The old bsd cryptodev engine was removed in https://github.com/openssl/openssl/pull/3699 and the new one added in: https://github.com/openssl/openssl/pull/3744 It can be enabled by configuring with "enable-devcryptoeng". Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-03-03openssl10: Fix mutliple include assumptions for des.h in opensslconf.hDenys Dmytriyenko
The fix is heavily based on Khem's previous fix for bn.h/BN_LLONG breakage: https://git.openembedded.org/openembedded-core/commit/?id=f787b0bb9b0626ddbf2ac94cb206c76716a3773d Signed-off-by: Denys Dmytriyenko <denys@ti.com> Cc: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-28openssl: drop Python 2.x dependency in -ptestAlexander Kanavin
It is only needed by 95-test_external_pyca_data which is actually skipped on the target. [YOCTO #13204] Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-27openssl: Fix ptest test output translationRichard Purdie
openssl-ptest was recording now results, despite most tests passing. Fix so that the successes/skips/failures are reported correctly. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-25openssl: move c_rehash pkg to avoid perl depBrad Bishop
Perl and its dependencies have a decent footprint impact. On my xz compressed filesystem: 634880: /usr/lib/libperl.so.5.24.4 Put c_rehash in the openssl-misc package so the dependency can be avoided where it isn't needed. Change-Id: Iae9bccabfb1c8cfa1401ca6785abc39713d3fdf0 Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-02-15openssl: update patch to fix buildpaths qa issue for -fmacro-prefix-mapKai Kang
Gcc option '-fmacro-prefix-map' is added to DEBUG_PREFIX_MAP. It has a patch to deal option '-fdebug-prefix-map' already. Update the patch 0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch to fix buildpaths qa issue for '-fmacro-prefix-map' too. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-27 09:06:57 +0000