aboutsummaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/openssl
AgeCommit message (Collapse)Author
2016-01-30openssl: Security fix CVE-2016-0701Armin Kuster
CVE-2016-0701 OpenSSL: DH small subgroups Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-30openssl: Security fix CVE-2015-3197Armin Kuster
CVE-2015-3197 OpenSSL: SSLv2 doesn't block disabled ciphers Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-13openssl: fix for CVE-2015-3195Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-01-13openssl: fix for CVE-2015-3194Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com>
2016-01-13openssl: fix for CVE-2015-3193Armin Kuster
Signed-off-by: Armin Kuster <akuster@mvista.com>
2015-12-27openssl: sanity check that the bignum module is presentRoss Burton
The crypto_use_bigint_in_x86-64_perl patch uses the "bigint" module to transparently support 64-bit integers on 32-bit hosts. Whilst bigint (part of bignum) is a core Perl module not all distributions install it (notable Fedora 23). As the error message when bignum isn't installed is obscure, add a task to check that it is available and alert the user if it isn't. [ YOCTO #8562 ] (From OE-Core master rev: 2f9a2fbc46aa435a0a7f7662bb62029ac714f25a) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2015-09-29openssl: fix ptest failuresMaxin B. John
Remove dependencies for test targets. Otherwise, during ptest execution, "make" tries to rebuild those executables and fails there. [YOCTO #8059] Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-09-28openssl: Add mapping for nios2Marek Vasut
Map nios2 architecture to linux-generic32 target. Signed-off-by: Marek Vasut <marex@denx.de> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-07-10openssl: upgrade to 1.0.2dJan Wetter
This upgrade fixes CVE-2015-1793 Removed openssl-fix-link.patch. The linking issue has been fixed in openssl. Signed-off-by: Jan Wetter <jan.wetter@mikrom.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-07-01openssl: upgrade to 1.0.2cRoy Li
upgrade to fix the CVE: CVE-2015-1788..CVE-2015-1792 and CVE-2014-8176 remove a backport patch update the c_rehash-compat.patch Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-06-23openssl: fix building on x32 systemsCristian Iorga
Fix build on Fedora 21 i686. When building on x32 systems where the default type is 32bit, make sure that 64bit integers can be represented transparently. Signed-off-by: Cristian Iorga <cristian.iorga@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-05-30openssl: Backport upstreamed version of patch to fix build on mips64Khem Raj
Previous patch had a concern as well and this is a direct backport of the patch fixing the problem. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-05-23openssl: Fix build with gcc5 on mips64Khem Raj
Patch is submitted upstream as well Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-05-23openssl: drop the padlock_conf.patchRoy Li
padlock_conf.patch will enable the padlock engine by default, but this engine does not work on some 32bit machine, and lead to openssl unable to work Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-05-14openssl/orc: virtclass-native -> class-nativeRobert Yang
The virtclass-native is out of date. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-30openssl: remove 3 patchesRobert Yang
Removed: - openssl-avoid-NULL-pointer-dereference-in-dh_pub_encode.patch - upgate-vegsion-script-for-1.0.2.patch Since they are already in the source. - make-targets.patch It removed test dir from DIRS, which is not needed any more since we need build it. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-15crypto: use bigint in x86-64 perlArmin Kuster
on some hosts openssl fails to build with this error: ghash-x86_64.s: Assembler messages: ghash-x86_64.s:890: Error: junk '.15473355479995e+19' after expression backported fix from community. Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-03-24openssl: 1.0.2 -> 1.0.2aRichard Purdie
Patch updated to drop TERMIO flags since these are the default on Linux anyway (see https://git.openssl.org/?p=openssl.git;a=commit;h=64e6bf64b36136d487e2fbf907f09612e69ae911) Also drop patch merged upstream. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-03-09openssl: Upgrade to 1.0.2Saul Wold
Rebased numerous patches removed aarch64 initial work since it's part of upstream now Imported a few additional patches from Debian to support the version-script and blacklist additional bad certificates. Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-02-23Revert "openssl: fix and enable parallel build"Richard Purdie
This reverts commit 7502fa5febdd7a2281d626f7040782fb1f9af59e. We keep seeing parallel make failures in openssl :( Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-02-19openssl: disable SSLv3 by defaultBrendan Le Foll
Because of the SSLv3 POODLE vulnerability, it's preferred to simply disable SSLv3 even if patched with the TLS_FALLBACK_SCSV Signed-off-by: Brendan Le Foll <brendan.le.foll@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-02-15openssl: upgrade to 1.0.1kMaxin B. John
Upgrade includes 8 CVE bug fixes Signed-off-by: Maxin B. John <maxin.john@enea.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-02-14openssl: fix and enable parallel buildRobert Yang
Fixed: Cannot create directory image/usr: File exists make: *** [install_sw] Error 17 Create /usr to avoid race issues. Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
2015-02-14openssl: Add mapping for microblaze architectureNathan Rossi
Map the microblaze architecture to the linux-generic32 target. Signed-off-by: Nathan Rossi <nathan.rossi@xilinx.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-01-07openssl: fix hard paths in native opensslAndré Draszik
This causes the package to not be relocateable from sstate The OpenSSL binaries respect a few environment variables for determining locations of files, so we now use these to point the binaries to the relocated locations. [YOCTO #6827] Signed-off-by: André Draszik <adraszik@digisoft.tv> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2014-10-18openssl: upgrade to 1.0.1jRoss Burton
Signed-off-by: Ross Burton <ross.burton@intel.com>
2014-08-27openssl: Re-add linux-uclibc tupleKhem Raj
With last restructuring for musl, some of uclibc targets got ignored fsl/ppc and ARM worked ok since they use special target triplets which were already considered but other like mips, x86 and so on failed Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-08-23openssl: add DEPENDS on openssl-native for rehashJackie Huang
'make rehash' used the compiled openssl to get hash value for files, it always failed when cross compiling: /path/to/openssl/1.0.1i-r0/openssl-1.0.1i/util/shlib_wrap.sh: line 96: /path/to/openssl/1.0.1i-r0/openssl-1.0.1i/util/../apps/openssl: cannot execute binary file so add DEPENDS on openssl-native for target package and use it instead of the one compiled from target package. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-08-16openssl: Repace if-else with case and add musl tripletKhem Raj
Simplifies the code and adds knowlwdge about musl targets Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-08-11openssl: upgrade to 1.0.1iPaul Eggleton
Removed one patch merged upstream. Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-09openssl: fix ptestsPaul Eggleton
Add some missing dependencies and fix the Makefile in order to get most of the ptest tests working (specifically test_bn, test_verify, test_cms, test_srp and test_heartbeat). test_verify still fails for unknown reasons (perhaps some of the now expired certificates weren't meant to have expired as far as the test is concerned?) but at least it has the certificates to run now. Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
2014-06-09openssl: upgrade to 1.0.1hPaul Eggleton
Fixes the following security issues: * CVE-2014-0224 * CVE-2014-0221 * CVE-2014-0195 * CVE-2014-3470 The patch for CVE-2010-5298, CVE-2014-0198 and a fix for building the documentation are integrated upstream in this release and so were dropped. Additionally, a patch from upstream was added in order to fix a failure during do_compile_ptest_base. A similar upgrade was also submitted by Yao Xinpan <yaoxp@cn.fujitsu.com> and Lei Maohui <leimaohui@cn.fujitsu.com>. Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
2014-05-29openssl: add openssl-CVE-2010-5298.patch SRC_URIRoy Li
make openssl-CVE-2010-5298.patch truely work Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-05-21openssl: fix for CVE-2010-5298Yue Tao
Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-5298 Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2014-05-08openssl: update upstream status for a patchCristiana Voicu
The patch is not included in 1.0.1g, but it is included on 1.0.2 branch. Signed-off-by: Cristiana Voicu <cristiana.voicu@intel.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2014-05-08openssl: fix CVE-2014-0198Maxin B. John
A null pointer dereference bug was discovered in do_ssl3_write(). An attacker could possibly use this to cause OpenSSL to crash, resulting in a denial of service. https://access.redhat.com/security/cve/CVE-2014-0198 Signed-off-by: Maxin B. John <maxin.john@enea.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2014-04-28openssl: enable ptest supportMaxin B. John
Install openssl test suite and run it as ptest. Signed-off-by: Maxin B. John <maxin.john@enea.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2014-04-25Globally replace 'base_contains' calls with 'bb.utils.contains'Otavio Salvador
The base_contains is kept as a compatibility method and we ought to not use it in OE-Core so we can remove it from base metadata in future. Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-24cryptodev-linux: move to recipes-kernel to be shared with module and testsDenys Dmytriyenko
Signed-off-by: Denys Dmytriyenko <denys@ti.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-08openssl: Upgrade to v1.0.1gCristiana Voicu
The trigger for the upgrade was the serious "heartbleed" vulnerability (CVE-2014-0160). More information: http://www.itnews.com.au/News/382068,serious-openssl-bug-renders-websites-wide-open.aspx Dropped obsolete patches, because the new version contains them: 0001-Fix-for-TLS-record-tampering-bug-CVE-2013-4353.patch 0001-Fix-DTLS-retransmission-from-previous-session.patch 0001-Use-version-in-SSL_METHOD-not-SSL-structure.patch Modified 2 patches (small changes), in order to apply properly: initial-aarch64-bits.patch openssl-fix-doc.patch Addresses CVEs: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0076 Signed-off-by: Cristiana Voicu <cristiana.voicu@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-01openssl: Fix pod2man des.pod error on Ubuntu 12.04Baogen Shang
This is a formatting fix, '=back' is required before '=head1' on Ubuntu 12.04. Signed-off-by: Baogen Shang <baogen.shang@windriver.com> Signed-off-by: Jeff Polk <jeff.polk@windriver.com> Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-03-27ocf-linux: remove recipeKai Kang
ocf-linux only provides header file and no kernel module is built. We can't use ocf-linux without its implementation. And linux-yocto uses an alternative project cryptodev-linux, so we remove ocf-linux and use cryptodev-linux instead. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-03-27openssl: replace dependency ocf-linux with cryptodev-linuxKai Kang
ocf-linux only provides header files but no implementation in kernel. And Yocto kernel linux-yocto use cryptodev-linux to implement /dev/crypto interface. So replace dependency ocf-linux with cryptodev-linux for openssl. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-03-27cryptodev-linux: add recipeKai Kang
Yocto kernel linux-yocto uses cryptodev-linux to use device /dev/crypto. So add cryptodev-linux which is one alternative of ocf-linux and then remove ocf-linux later. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-03-26Security Advisory - openssl - CVE-2013-6449Yue Tao
The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client. Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-03-26Security Advisory - openssl - CVE-2013-6450Yue Tao
The DTLS retransmission implementation in OpenSSL through 0.9.8y and 1.x through 1.0.1e does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c. Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-03-26Security Advisory - openssl - CVE-2013-4353Yue Tao
The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Next Protocol Negotiation record in a TLS handshake. Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-02-17openssl: Fix build on uclibcKhem Raj
we need to map OS string correctly to include linux-uclibcspe which is what we use with ppc+spe on uclibc, additionally move gnuspe triplet mapping to same code as well Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-01-02Replace one-line DESCRIPTION with SUMMARYPaul Eggleton
A lot of our recipes had short one-line DESCRIPTION values and no SUMMARY value set. In this case it's much better to just set SUMMARY since DESCRIPTION is defaulted from SUMMARY anyway and then the SUMMARY is at least useful. I also took the opportunity to fix up a lot of the new SUMMARY values, making them concisely explain the function of the recipe / package where possible. Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
2013-12-21openssl: use PACKAGECONFIG to disable perl bitsSaul Wold
Adding perl to the RDEPENDS caused a performance hit to the overall build time since this was the only package that depended on perl. The openssl-misc package is not installed by default so use a PACKAGECONFIG which can be overridden to allow the perl scripts along with perl to be installed. Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-19 00:25:37 +0000