NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
0dea780436
kumquat-buildroot/package/mbedtls/mbedtls.mk

73 lines
2.4 KiB
Makefile
Raw Normal View History

mbedtls: new package Add the mbed TLS library, formerly known as PolarSSL. The 2.0+ version can live side-by-side with polarssl since it was renamed, hence can be added with no conflict. Use the Apache-2.0 license variant since it's somewhat more flexible, the codebase is the same as the GPLv2 variant, just copyright headers/license file changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-29 16:03:07 +01:00
################################################################################
#
# mbedtls
#
################################################################################
MBEDTLS_SITE = https://tls.mbed.org/code/releases
mbedtls: security bump to verison 2.4.2 Fixes: CVE-2017-2784 - Freeing of memory allocated on stack when validating a public key with a secp224k1 curve. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-03-15 19:08:36 +01:00
MBEDTLS_VERSION = 2.4.2
mbedtls: new package Add the mbed TLS library, formerly known as PolarSSL. The 2.0+ version can live side-by-side with polarssl since it was renamed, hence can be added with no conflict. Use the Apache-2.0 license variant since it's somewhat more flexible, the codebase is the same as the GPLv2 variant, just copyright headers/license file changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-29 16:03:07 +01:00
MBEDTLS_SOURCE = mbedtls-$(MBEDTLS_VERSION)-apache.tgz
MBEDTLS_CONF_OPTS = \
-DENABLE_PROGRAMS=$(if $(BR2_PACKAGE_MBEDTLS_PROGRAMS),ON,OFF) \
-DENABLE_TESTING=OFF
MBEDTLS_INSTALL_STAGING = YES
MBEDTLS_LICENSE = Apache-2.0
MBEDTLS_LICENSE_FILES = apache-2.0.txt
# This is mandatory for hiawatha
ifeq ($(BR2_TOOLCHAIN_HAS_THREADS),y)
define MBEDTLS_ENABLE_THREADING
$(SED) "s://#define MBEDTLS_THREADING_C:#define MBEDTLS_THREADING_C:" \
$(@D)/include/mbedtls/config.h
$(SED) "s://#define MBEDTLS_THREADING_PTHREAD:#define MBEDTLS_THREADING_PTHREAD:" \
$(@D)/include/mbedtls/config.h
endef
MBEDTLS_POST_PATCH_HOOKS += MBEDTLS_ENABLE_THREADING
mbedtls: fix companion programs static build Set LINK_WITH_PTHREAD to explicitly add pthread to the list of libraries. Fixes: http://autobuild.buildroot.net/results/e08/e087dfa2a6057b18209cd6adff2760026a9ca1db/ http://autobuild.buildroot.net/results/615/61565f1a88b7d6eea03a355ccf8dd3fe6585c4ab/ http://autobuild.buildroot.net/results/6b2/6b267b9cba37655e7d8e6d78821f96d9a8dd7d2e/ Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-04-12 20:46:00 +02:00
ifeq ($(BR2_STATIC_LIBS),y)
MBEDTLS_CONF_OPTS += -DLINK_WITH_PTHREAD=ON
endif
mbedtls: new package Add the mbed TLS library, formerly known as PolarSSL. The 2.0+ version can live side-by-side with polarssl since it was renamed, hence can be added with no conflict. Use the Apache-2.0 license variant since it's somewhat more flexible, the codebase is the same as the GPLv2 variant, just copyright headers/license file changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-29 16:03:07 +01:00
endif
ifeq ($(BR2_STATIC_LIBS),y)
MBEDTLS_CONF_OPTS += \
-DUSE_SHARED_MBEDTLS_LIBRARY=OFF -DUSE_STATIC_MBEDTLS_LIBRARY=ON
else ifeq ($(BR2_SHARED_STATIC_LIBS),y)
MBEDTLS_CONF_OPTS += \
-DUSE_SHARED_MBEDTLS_LIBRARY=ON -DUSE_STATIC_MBEDTLS_LIBRARY=ON
else ifeq ($(BR2_SHARED_LIBS),y)
MBEDTLS_CONF_OPTS += \
-DUSE_SHARED_MBEDTLS_LIBRARY=ON -DUSE_STATIC_MBEDTLS_LIBRARY=OFF
endif
package/mbedtls: make compression support a config option Enabling TLS compression may make mbedTLS vulnerable to the CRIME attack [1]. It should not be enabled unless is is sure CRIME and similar attacks are not applicable to the particulare situation. As zlib is probably enabled in most systems, the user might end up with a vulnerable system without knowing. So, instead of enabling compression support if the zlib package is available, we make the compression support a config option. This way, the user has to explicitly enable compression support and is warned by the help text about the risk. [1] https://tls.mbed.org/kb/how-to/deflate-compression-in-ssl-tls Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-02-06 21:01:23 +01:00
ifeq ($(BR2_PACKAGE_MBEDTLS_COMPRESSION),y)
mbedtls: new package Add the mbed TLS library, formerly known as PolarSSL. The 2.0+ version can live side-by-side with polarssl since it was renamed, hence can be added with no conflict. Use the Apache-2.0 license variant since it's somewhat more flexible, the codebase is the same as the GPLv2 variant, just copyright headers/license file changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-29 16:03:07 +01:00
MBEDTLS_CONF_OPTS += -DENABLE_ZLIB_SUPPORT=ON
MBEDTLS_DEPENDENCIES += zlib
package/mbedtls: fix zlib support To enable compression support using zlib it is necessary to uncomment the define for MBEDTLS_ZLIB_SUPPORT in config.h [1]. Note, that enabling TLS compression may make mbedTLS vulnerable to the CRIME attack [1]. It should not be enabled unless is is sure CRIME and similar attacks are not applicable to the particulare situation. As zlib is probably enabled in most systems, maybe it is best to make the compression support a user choice and add the warning from [1]? [1] https://tls.mbed.org/kb/how-to/deflate-compression-in-ssl-tls Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-01-29 22:15:11 +01:00
define MBEDTLS_ENABLE_ZLIB
$(SED) "s://#define MBEDTLS_ZLIB_SUPPORT:#define MBEDTLS_ZLIB_SUPPORT:" \
$(@D)/include/mbedtls/config.h
endef
MBEDTLS_POST_PATCH_HOOKS += MBEDTLS_ENABLE_ZLIB
mbedtls: new package Add the mbed TLS library, formerly known as PolarSSL. The 2.0+ version can live side-by-side with polarssl since it was renamed, hence can be added with no conflict. Use the Apache-2.0 license variant since it's somewhat more flexible, the codebase is the same as the GPLv2 variant, just copyright headers/license file changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-29 16:03:07 +01:00
else
MBEDTLS_CONF_OPTS += -DENABLE_ZLIB_SUPPORT=OFF
endif
mbedtls: disable assembly for some scenarios It's affected in the same way as polarssl, but use an enhanced trick compared to 130ca81b since it's required by the codebase. Fixes: http://autobuild.buildroot.net/results/584/584d1d12be9f2bbf45ccbdf93b6b442524059dcc/ http://autobuild.buildroot.net/results/d13/d13a06ba3fc0d7f08a03c04fcb484761da7af3f7/ Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-30 13:07:03 +01:00
define MBEDTLS_DISABLE_ASM
$(SED) '/^#define MBEDTLS_AESNI_C/d' \
$(@D)/include/mbedtls/config.h
$(SED) '/^#define MBEDTLS_HAVE_ASM/d' \
$(@D)/include/mbedtls/config.h
$(SED) '/^#define MBEDTLS_PADLOCK_C/d' \
$(@D)/include/mbedtls/config.h
endef
# ARM in thumb mode breaks debugging with asm optimizations
# Microblaze asm optimizations are broken in general
# MIPS R6 asm is not yet supported
ifeq ($(BR2_ENABLE_DEBUG)$(BR2_ARM_INSTRUCTIONS_THUMB)$(BR2_ARM_INSTRUCTIONS_THUMB2),yy)
MBEDTLS_POST_CONFIGURE_HOOKS += MBEDTLS_DISABLE_ASM
MIPS: replace every BR2_mips_* with the new MIPS CPU options Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2016-09-30 11:36:49 +02:00
else ifeq ($(BR2_microblaze)$(BR2_MIPS_CPU_MIPS32R6)$(BR2_MIPS_CPU_MIPS64R6),y)
mbedtls: disable assembly for some scenarios It's affected in the same way as polarssl, but use an enhanced trick compared to 130ca81b since it's required by the codebase. Fixes: http://autobuild.buildroot.net/results/584/584d1d12be9f2bbf45ccbdf93b6b442524059dcc/ http://autobuild.buildroot.net/results/d13/d13a06ba3fc0d7f08a03c04fcb484761da7af3f7/ Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-30 13:07:03 +01:00
MBEDTLS_POST_CONFIGURE_HOOKS += MBEDTLS_DISABLE_ASM
endif
mbedtls: new package Add the mbed TLS library, formerly known as PolarSSL. The 2.0+ version can live side-by-side with polarssl since it was renamed, hence can be added with no conflict. Use the Apache-2.0 license variant since it's somewhat more flexible, the codebase is the same as the GPLv2 variant, just copyright headers/license file changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-29 16:03:07 +01:00
$(eval $(cmake-package))
Reference in New Issue Copy Permalink