NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1f0a550b6d
kumquat-buildroot/package/mbedtls/mbedtls.mk

76 lines
2.5 KiB
Makefile
Raw Normal View History

mbedtls: new package Add the mbed TLS library, formerly known as PolarSSL. The 2.0+ version can live side-by-side with polarssl since it was renamed, hence can be added with no conflict. Use the Apache-2.0 license variant since it's somewhat more flexible, the codebase is the same as the GPLv2 variant, just copyright headers/license file changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-29 16:03:07 +01:00
################################################################################
#
# mbedtls
#
################################################################################
package/mbedtls: bump to version 2.28.0 2.16.12 was the last release of the 2.16 long-time support branch. Users who want a long-time branch should move to mbedtls-2.28, which is backward-compatible and will be supported for at least 3 years. Use LICENSE file as apache-2.0.txt was dropped with https://github.com/ARMmbed/mbedtls/commit/c76a54554ca8bffedf0e78a1cbdb64451e4ae957 https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-08 16:19:54 +01:00
MBEDTLS_VERSION = 2.28.0
package/mbedtls: security bump to version 2.16.8 Fix a "Local side channel attack on classical CBC decryption in (D)TLS" a.k.a. CVE-2020-16150: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-1 as well as a "Local side channel attack on RSA and static Diffie-Hellman" (no CVE): https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-2 Also change MBEDTLS_SITE and retrieve hash provided by upstream https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.8 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-09-01 20:15:03 +02:00
MBEDTLS_SITE = $(call github,ARMmbed,mbedtls,v$(MBEDTLS_VERSION))
mbedtls: new package Add the mbed TLS library, formerly known as PolarSSL. The 2.0+ version can live side-by-side with polarssl since it was renamed, hence can be added with no conflict. Use the Apache-2.0 license variant since it's somewhat more flexible, the codebase is the same as the GPLv2 variant, just copyright headers/license file changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-29 16:03:07 +01:00
MBEDTLS_CONF_OPTS = \
package/mbedtls: fix build with gcc 4.8 Fix the following build failure with gcc 4.8 raised since bump to version 2.28.0 in commit 0f8aab08e762742d753d5920718f31c629d0f8d7: /usr/lfs/hdd_v1/rc-buildroot-test/scripts/instance-0/output-1/build/mbedtls-2.28.0/library/bignum.c: In function 'mpi_select': /usr/lfs/hdd_v1/rc-buildroot-test/scripts/instance-0/output-1/build/mbedtls-2.28.0/library/bignum.c:1994:5: error: 'for' loop initial declarations are only allowed in C99 mode for( size_t i = 0; i < T_size; i++ ) ^ /usr/lfs/hdd_v1/rc-buildroot-test/scripts/instance-0/output-1/build/mbedtls-2.28.0/library/bignum.c:1994:5: note: use option -std=c99 or -std=gnu99 to compile your code Fixes: - http://autobuild.buildroot.org/results/56ac0a8726d09eed8f45f865934fa7781a0e667a Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-10 18:44:11 +01:00
-DCMAKE_C_FLAGS="$(TARGET_CFLAGS) -std=c99" \
mbedtls: new package Add the mbed TLS library, formerly known as PolarSSL. The 2.0+ version can live side-by-side with polarssl since it was renamed, hence can be added with no conflict. Use the Apache-2.0 license variant since it's somewhat more flexible, the codebase is the same as the GPLv2 variant, just copyright headers/license file changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-29 16:03:07 +01:00
-DENABLE_PROGRAMS=$(if $(BR2_PACKAGE_MBEDTLS_PROGRAMS),ON,OFF) \
package/mbedtls: disable MBEDTLS_FATAL_WARNINGS Disable MBEDTLS_FATAL_WARNINGS to avoid the following build failure since bump to version 2.28.0 in commit 0f8aab08e762742d753d5920718f31c629d0f8d7: /home/buildroot/autobuild/instance-0/output-1/host/arm-buildroot-linux-gnueabihf/sysroot/usr/include/features.h:412:4: error: #warning _FORTIFY_SOURCE requires compiling with optimization (-O) [-Werror=cpp] 412 | # warning _FORTIFY_SOURCE requires compiling with optimization (-O) | ^~~~~~~ Fixes: - http://autobuild.buildroot.org/results/af017382bb5772de7383d71ed7b8af44717981f9 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-09 19:06:57 +01:00
-DENABLE_TESTING=OFF \
-DMBEDTLS_FATAL_WARNINGS=OFF
mbedtls: new package Add the mbed TLS library, formerly known as PolarSSL. The 2.0+ version can live side-by-side with polarssl since it was renamed, hence can be added with no conflict. Use the Apache-2.0 license variant since it's somewhat more flexible, the codebase is the same as the GPLv2 variant, just copyright headers/license file changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-29 16:03:07 +01:00
MBEDTLS_INSTALL_STAGING = YES
MBEDTLS_LICENSE = Apache-2.0
package/mbedtls: bump to version 2.28.0 2.16.12 was the last release of the 2.16 long-time support branch. Users who want a long-time branch should move to mbedtls-2.28, which is backward-compatible and will be supported for at least 3 years. Use LICENSE file as apache-2.0.txt was dropped with https://github.com/ARMmbed/mbedtls/commit/c76a54554ca8bffedf0e78a1cbdb64451e4ae957 https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-08 16:19:54 +01:00
MBEDTLS_LICENSE_FILES = LICENSE
package/mbedtls: add CPE variables cpe:2.3:a:arm:mbed_tls is a valid CPE identifier for this package: https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aarm%3Ambed_tls Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-01-24 00:13:54 +01:00
MBEDTLS_CPE_ID_VENDOR = arm
MBEDTLS_CPE_ID_PRODUCT = mbed_tls
mbedtls: new package Add the mbed TLS library, formerly known as PolarSSL. The 2.0+ version can live side-by-side with polarssl since it was renamed, hence can be added with no conflict. Use the Apache-2.0 license variant since it's somewhat more flexible, the codebase is the same as the GPLv2 variant, just copyright headers/license file changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-29 16:03:07 +01:00
# This is mandatory for hiawatha
ifeq ($(BR2_TOOLCHAIN_HAS_THREADS),y)
define MBEDTLS_ENABLE_THREADING
$(SED) "s://#define MBEDTLS_THREADING_C:#define MBEDTLS_THREADING_C:" \
$(@D)/include/mbedtls/config.h
$(SED) "s://#define MBEDTLS_THREADING_PTHREAD:#define MBEDTLS_THREADING_PTHREAD:" \
$(@D)/include/mbedtls/config.h
endef
MBEDTLS_POST_PATCH_HOOKS += MBEDTLS_ENABLE_THREADING
mbedtls: fix companion programs static build Set LINK_WITH_PTHREAD to explicitly add pthread to the list of libraries. Fixes: http://autobuild.buildroot.net/results/e08/e087dfa2a6057b18209cd6adff2760026a9ca1db/ http://autobuild.buildroot.net/results/615/61565f1a88b7d6eea03a355ccf8dd3fe6585c4ab/ http://autobuild.buildroot.net/results/6b2/6b267b9cba37655e7d8e6d78821f96d9a8dd7d2e/ Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-04-12 20:46:00 +02:00
ifeq ($(BR2_STATIC_LIBS),y)
MBEDTLS_CONF_OPTS += -DLINK_WITH_PTHREAD=ON
endif
mbedtls: new package Add the mbed TLS library, formerly known as PolarSSL. The 2.0+ version can live side-by-side with polarssl since it was renamed, hence can be added with no conflict. Use the Apache-2.0 license variant since it's somewhat more flexible, the codebase is the same as the GPLv2 variant, just copyright headers/license file changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-29 16:03:07 +01:00
endif
ifeq ($(BR2_STATIC_LIBS),y)
MBEDTLS_CONF_OPTS += \
-DUSE_SHARED_MBEDTLS_LIBRARY=OFF -DUSE_STATIC_MBEDTLS_LIBRARY=ON
else ifeq ($(BR2_SHARED_STATIC_LIBS),y)
MBEDTLS_CONF_OPTS += \
-DUSE_SHARED_MBEDTLS_LIBRARY=ON -DUSE_STATIC_MBEDTLS_LIBRARY=ON
else ifeq ($(BR2_SHARED_LIBS),y)
MBEDTLS_CONF_OPTS += \
-DUSE_SHARED_MBEDTLS_LIBRARY=ON -DUSE_STATIC_MBEDTLS_LIBRARY=OFF
endif
package/mbedtls: make compression support a config option Enabling TLS compression may make mbedTLS vulnerable to the CRIME attack [1]. It should not be enabled unless is is sure CRIME and similar attacks are not applicable to the particulare situation. As zlib is probably enabled in most systems, the user might end up with a vulnerable system without knowing. So, instead of enabling compression support if the zlib package is available, we make the compression support a config option. This way, the user has to explicitly enable compression support and is warned by the help text about the risk. [1] https://tls.mbed.org/kb/how-to/deflate-compression-in-ssl-tls Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-02-06 21:01:23 +01:00
ifeq ($(BR2_PACKAGE_MBEDTLS_COMPRESSION),y)
mbedtls: new package Add the mbed TLS library, formerly known as PolarSSL. The 2.0+ version can live side-by-side with polarssl since it was renamed, hence can be added with no conflict. Use the Apache-2.0 license variant since it's somewhat more flexible, the codebase is the same as the GPLv2 variant, just copyright headers/license file changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-29 16:03:07 +01:00
MBEDTLS_CONF_OPTS += -DENABLE_ZLIB_SUPPORT=ON
MBEDTLS_DEPENDENCIES += zlib
package/mbedtls: fix zlib support To enable compression support using zlib it is necessary to uncomment the define for MBEDTLS_ZLIB_SUPPORT in config.h [1]. Note, that enabling TLS compression may make mbedTLS vulnerable to the CRIME attack [1]. It should not be enabled unless is is sure CRIME and similar attacks are not applicable to the particulare situation. As zlib is probably enabled in most systems, maybe it is best to make the compression support a user choice and add the warning from [1]? [1] https://tls.mbed.org/kb/how-to/deflate-compression-in-ssl-tls Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-01-29 22:15:11 +01:00
define MBEDTLS_ENABLE_ZLIB
$(SED) "s://#define MBEDTLS_ZLIB_SUPPORT:#define MBEDTLS_ZLIB_SUPPORT:" \
$(@D)/include/mbedtls/config.h
endef
MBEDTLS_POST_PATCH_HOOKS += MBEDTLS_ENABLE_ZLIB
mbedtls: new package Add the mbed TLS library, formerly known as PolarSSL. The 2.0+ version can live side-by-side with polarssl since it was renamed, hence can be added with no conflict. Use the Apache-2.0 license variant since it's somewhat more flexible, the codebase is the same as the GPLv2 variant, just copyright headers/license file changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-29 16:03:07 +01:00
else
MBEDTLS_CONF_OPTS += -DENABLE_ZLIB_SUPPORT=OFF
endif
mbedtls: disable assembly for some scenarios It's affected in the same way as polarssl, but use an enhanced trick compared to 130ca81b since it's required by the codebase. Fixes: http://autobuild.buildroot.net/results/584/584d1d12be9f2bbf45ccbdf93b6b442524059dcc/ http://autobuild.buildroot.net/results/d13/d13a06ba3fc0d7f08a03c04fcb484761da7af3f7/ Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-30 13:07:03 +01:00
define MBEDTLS_DISABLE_ASM
$(SED) '/^#define MBEDTLS_AESNI_C/d' \
$(@D)/include/mbedtls/config.h
$(SED) '/^#define MBEDTLS_HAVE_ASM/d' \
$(@D)/include/mbedtls/config.h
$(SED) '/^#define MBEDTLS_PADLOCK_C/d' \
$(@D)/include/mbedtls/config.h
endef
# ARM in thumb mode breaks debugging with asm optimizations
# Microblaze asm optimizations are broken in general
# MIPS R6 asm is not yet supported
ifeq ($(BR2_ENABLE_DEBUG)$(BR2_ARM_INSTRUCTIONS_THUMB)$(BR2_ARM_INSTRUCTIONS_THUMB2),yy)
MBEDTLS_POST_CONFIGURE_HOOKS += MBEDTLS_DISABLE_ASM
MIPS: replace every BR2_mips_* with the new MIPS CPU options Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2016-09-30 11:36:49 +02:00
else ifeq ($(BR2_microblaze)$(BR2_MIPS_CPU_MIPS32R6)$(BR2_MIPS_CPU_MIPS64R6),y)
mbedtls: disable assembly for some scenarios It's affected in the same way as polarssl, but use an enhanced trick compared to 130ca81b since it's required by the codebase. Fixes: http://autobuild.buildroot.net/results/584/584d1d12be9f2bbf45ccbdf93b6b442524059dcc/ http://autobuild.buildroot.net/results/d13/d13a06ba3fc0d7f08a03c04fcb484761da7af3f7/ Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-30 13:07:03 +01:00
MBEDTLS_POST_CONFIGURE_HOOKS += MBEDTLS_DISABLE_ASM
endif
mbedtls: new package Add the mbed TLS library, formerly known as PolarSSL. The 2.0+ version can live side-by-side with polarssl since it was renamed, hence can be added with no conflict. Use the Apache-2.0 license variant since it's somewhat more flexible, the codebase is the same as the GPLv2 variant, just copyright headers/license file changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-29 16:03:07 +01:00
$(eval $(cmake-package))
Reference in New Issue Copy Permalink