NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
b2a7ad665d
kumquat-buildroot/package/libnss/0001-cross-compile.patch

49 lines
1.3 KiB
Diff
Raw Normal View History

package: add libnss NSS is the Network Security Services library developed as part of the Mozilla project. It provides similar functions to OpenSSL but allows MPL, GPL and LGPL licensing. [Peter: fix target install] Signed-off-by: Will Newton <will.newton@imgtec.com> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2011-07-08 15:19:16 +02:00
This patch allows us to set a value for the cross compiler via TARGETCC without
setting CC on the command line. CC is used for host tools as well as cross
compiled code so we cannot define it on the command line without breaking
the host tools build.
libnss: security bump to version 3.16.1 Fixes: CVE-2014-1492 - The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate. CVE-2014-1491 - Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value. CVE-2014-1490 - Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket. CVE-2013-1740 - The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-06-18 16:46:20 +02:00
[Gustavo: update for nss 3.16.1]
libnss: don't use target CFLAGS with host toolchain The OPTIMIZER variable is used to construct CFLAGS for host toolchain. This breaks the build since we set it to TARGET_CFLAGS, and these may not be supported by host toolchain. Augment the cross-compile patch to handle OPTIMIZER so that we can initialize it to TARGET_OPTIMIZER, and override it when used with host toolchain. Fixes: http://autobuild.buildroot.net/results/3f1/3f1afc1b58cb6fe53c438b55f169e2a78238806d/ Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-07-01 05:36:56 +02:00
[baruch: add OPTIMIZER handling]
package: add libnss NSS is the Network Security Services library developed as part of the Mozilla project. It provides similar functions to OpenSSL but allows MPL, GPL and LGPL licensing. [Peter: fix target install] Signed-off-by: Will Newton <will.newton@imgtec.com> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2011-07-08 15:19:16 +02:00
Signed-off-by: Will Newton <will.newton@imgtec.com>
libnss: don't use target CFLAGS with host toolchain The OPTIMIZER variable is used to construct CFLAGS for host toolchain. This breaks the build since we set it to TARGET_CFLAGS, and these may not be supported by host toolchain. Augment the cross-compile patch to handle OPTIMIZER so that we can initialize it to TARGET_OPTIMIZER, and override it when used with host toolchain. Fixes: http://autobuild.buildroot.net/results/3f1/3f1afc1b58cb6fe53c438b55f169e2a78238806d/ Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-07-01 05:36:56 +02:00
diff -Nuar nss-3.16.1-orig/nss/coreconf/Linux.mk nss-3.16.1/nss/coreconf/Linux.mk
--- nss-3.16.1-orig/nss/coreconf/Linux.mk 2014-05-02 06:27:18.000000000 +0300
+++ nss-3.16.1/nss/coreconf/Linux.mk 2014-07-01 02:38:18.701480512 +0300
libnss: security bump to version 3.16.1 Fixes: CVE-2014-1492 - The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate. CVE-2014-1491 - Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value. CVE-2014-1490 - Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket. CVE-2013-1740 - The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-06-18 16:46:20 +02:00
@@ -16,9 +16,13 @@
package: add libnss NSS is the Network Security Services library developed as part of the Mozilla project. It provides similar functions to OpenSSL but allows MPL, GPL and LGPL licensing. [Peter: fix target install] Signed-off-by: Will Newton <will.newton@imgtec.com> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2011-07-08 15:19:16 +02:00
IMPL_STRATEGY = _PTH
endif
-CC = gcc
-CCC = g++
-RANLIB = ranlib
+TARGETCC = gcc
+TARGETCCC = g++
+TARGETRANLIB = ranlib
+
+CC = $(TARGETCC)
+CCC = $(TARGETCCC)
+RANLIB = $(TARGETRANLIB)
DEFAULT_COMPILER = gcc
libnss: don't use target CFLAGS with host toolchain The OPTIMIZER variable is used to construct CFLAGS for host toolchain. This breaks the build since we set it to TARGET_CFLAGS, and these may not be supported by host toolchain. Augment the cross-compile patch to handle OPTIMIZER so that we can initialize it to TARGET_OPTIMIZER, and override it when used with host toolchain. Fixes: http://autobuild.buildroot.net/results/3f1/3f1afc1b58cb6fe53c438b55f169e2a78238806d/ Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-07-01 05:36:56 +02:00
@@ -125,6 +129,7 @@
endif
endif
+OPTIMIZER = $(TARGET_OPTIMIZER)
ifeq ($(USE_PTHREADS),1)
OS_PTHREAD = -lpthread
diff -Nuar nss-3.16.1-orig/nss/coreconf/nsinstall/Makefile nss-3.16.1/nss/coreconf/nsinstall/Makefile
--- nss-3.16.1-orig/nss/coreconf/nsinstall/Makefile 2014-05-02 06:27:18.000000000 +0300
+++ nss-3.16.1/nss/coreconf/nsinstall/Makefile 2014-07-01 02:38:48.102185011 +0300
@@ -31,6 +31,7 @@
ifdef NATIVE_FLAGS
OS_CFLAGS=$(NATIVE_FLAGS)
+OPTIMIZER=
endif
include $(DEPTH)/coreconf/rules.mk
Reference in New Issue Copy Permalink