c4658ede71
[Medium] A fix was added, but still under review for completeness, for a Bleichenbacher style attack, leading to being able to decrypt a saved TLS connection and potentially forge a signature after probing with a large number of trial connections. This issue is around RSA decryption and affects static RSA cipher suites on the server side, which are not recommended to be used and are off by default. Static RSA cipher suites were also removed from the TLS 1.3 protocol and only present in TLS 1.2 and lower. All padding versions of RSA decrypt are affected since the code under review is outside of the padding processing. Information about the private keys is NOT compromised in affected code. It's recommended to disable static RSA cipher suites and update the version of wolfSSL used if using RSA private decryption alone outside of TLS. https://github.com/wolfSSL/wolfssl/releases/tag/v5.6.4-stable Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
57 lines
1.5 KiB
Makefile
57 lines
1.5 KiB
Makefile
################################################################################
|
|
#
|
|
# wolfssl
|
|
#
|
|
################################################################################
|
|
|
|
WOLFSSL_VERSION = 5.6.4
|
|
WOLFSSL_SITE = $(call github,wolfSSL,wolfssl,v$(WOLFSSL_VERSION)-stable)
|
|
WOLFSSL_INSTALL_STAGING = YES
|
|
|
|
WOLFSSL_LICENSE = GPL-2.0+
|
|
WOLFSSL_LICENSE_FILES = COPYING LICENSING
|
|
WOLFSSL_CPE_ID_VENDOR = wolfssl
|
|
WOLFSSL_CONFIG_SCRIPTS = wolfssl-config
|
|
WOLFSSL_DEPENDENCIES = host-pkgconf
|
|
|
|
# wolfssl's source code is released without a configure
|
|
# script, so we need autoreconf
|
|
WOLFSSL_AUTORECONF = YES
|
|
|
|
WOLFSSL_CONF_OPTS = --disable-examples --disable-crypttests
|
|
|
|
ifeq ($(BR2_PACKAGE_WOLFSSL_ALL),y)
|
|
WOLFSSL_CONF_OPTS += --enable-all
|
|
else
|
|
WOLFSSL_CONF_OPTS += --disable-all
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_WOLFSSL_SSLV3),y)
|
|
WOLFSSL_CONF_OPTS += --enable-sslv3
|
|
else
|
|
WOLFSSL_CONF_OPTS += --disable-sslv3
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_WOLFSSL_ASM_SUPPORTS),y)
|
|
WOLFSSL_CONF_OPTS += --enable-asm
|
|
else
|
|
WOLFSSL_CONF_OPTS += --disable-asm
|
|
endif
|
|
|
|
# enable ARMv8 hardware acceleration
|
|
ifeq ($(BR2_aarch64),y)
|
|
WOLFSSL_CONF_OPTS += --enable-armasm
|
|
# the flag -mstrict-align is needed to prevent build errors caused by
|
|
# some inline assembly in parts of the AES structure using the "m"
|
|
# constraint
|
|
WOLFSSL_CONF_ENV += CPPFLAGS="$(TARGET_CPPFLAGS) -mstrict-align"
|
|
else
|
|
WOLFSSL_CONF_OPTS += --disable-armasm
|
|
endif
|
|
|
|
ifeq ($(BR2_ARM_INSTRUCTIONS_THUMB),y)
|
|
WOLFSSL_CONF_OPTS += --with-arm-target=thumb
|
|
endif
|
|
|
|
$(eval $(autotools-package))
|