NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/mbedtls: make compression support a config option

Browse Source 
Enabling TLS compression may make mbedTLS vulnerable to the
CRIME attack [1]. It should not be enabled unless is is sure CRIME and
similar attacks are not applicable to the particulare situation.

As zlib is probably enabled in most systems, the user might end up with
a vulnerable system without knowing. So, instead of enabling compression
support if the zlib package is available, we make the compression support
a config option. This way, the user has to explicitly enable compression
support and is warned by the help text about the risk.

[1] https://tls.mbed.org/kb/how-to/deflate-compression-in-ssl-tls

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Jörg Krause 2017-02-06 21:01:23 +01:00 committed by Peter Korsgaard
parent 3baf8217ed
commit 896ae3f961
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
package/mbedtls/Config.in
View File

@ -17,4 +17,16 @@ config BR2_PACKAGE_MBEDTLS_PROGRAMS
This option enables the installation and the build of
mbed TLS companion programs.
config BR2_PACKAGE_MBEDTLS_COMPRESSION
bool "enable compression support"
select BR2_PACKAGE_ZLIB
help
Enable support for compression of the content data before it
enters the secure channel as described in RFC 3749.
Warning: TLS compression may make you vulnerable to the CRIME
attack. You should not enable it unless you know for sure CRIME
and similar attacks are not applicable to your particular
situation.
endif

2
package/mbedtls/mbedtls.mk
View File

@ -39,7 +39,7 @@ MBEDTLS_CONF_OPTS += \
-DUSE_SHARED_MBEDTLS_LIBRARY=ON -DUSE_STATIC_MBEDTLS_LIBRARY=OFF
endif
ifeq ($(BR2_PACKAGE_ZLIB),y)
ifeq ($(BR2_PACKAGE_MBEDTLS_COMPRESSION),y)
MBEDTLS_CONF_OPTS += -DENABLE_ZLIB_SUPPORT=ON
MBEDTLS_DEPENDENCIES += zlib
define MBEDTLS_ENABLE_ZLIB