summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/openssl
AgeCommit message (Collapse)Author
2024-07-19openssl: rewrite ptest installationRoss Burton
Rewrite (again) the openssl test suite installation. Depend on and reuse already installed libraries and modules instead of installing them twice. Be more selective when installing from the build tree so we don't install intermediate .c .d .o files. This further reduces the size of openssl-dbg from ~120MB to ~18MB. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-19openssl: strip the test suiteRoss Burton
The test suite is huge because every test binary is statically linked to libssl and/or libcrypto. This bloats the size of the -dbg package hugely, so strip the test suite before packaging. This reduces the size of openssl-dbg by 90% from ~1.2GB to ~120MB, and reduces the size of the build tree from ~1.9GB to ~800MB. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-07-18openssl: disable tests unless ptest is enabledRoss Burton
The upstream Makefile always builds the tests unless they're explicitly disabled. Whilst this doesn't make a difference to the final package and sysroot output, disabling the tests for openssl-native reduces the size of the build tree from 659M to 78M and reduces the CPU time used by 30%. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-06-25openssl: Remove patch already upstreamedClément Péron
Since the bump to OpenSSL 3.3.1, riscv32 doesn't build anymore due to the folowing error: crypto/riscv32cpuid.s:77: Error: symbol `riscv_vlen_asm' is already defined This is due to the patch beeing already applied upstream: Commit: 8702320db98d1346c230aff1282ade3ecdca681a Signed-off-by: Clément Péron <peron.clem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2024-06-06openssl: Upgrade 3.3.0 -> 3.3.1Peter Marko
Handles CVE-2024-4741 Removed included backports. Release information: https://github.com/openssl/openssl/blob/openssl-3.3/NEWS.md#major-changes-between-openssl-330-and-openssl-331-4-jun-2024 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-06-04openssl: Add passthrough variables to work with bitbakeRichard Purdie
Now that bitbake uses websockets over SSL as hashserv and is correctly limiting hash equivalence only to things in the orginal SDK, bitbake builds from buildtools can fail due to broken SSL from buildtools. The issue is that the relocation variables are being removed from the environment. This could be fixed within bitbake or it could be fixed within the SDK environment. This patch does the latter for now. We really need to improve openssl relocation within the SDK in general. Fixing this has become more urgent to fix failing builds in automated testing. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-05-23openssl: Fix build on riscvKhem Raj
GCC-14 unearths this bug which is already fixed upstream so backport it Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-05-22openssl: patch CVE-2024-4603Peter Marko
Advisory: https://github.com/advisories/GHSA-85xr-ghj6-6m46 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-05-09openssl: fix pkgconfig path problemsRoss Burton
OpenSSL 3.3.0 introduced new pkgconfig generators which interact badly with our incorrect setting of --libdir, which is documented as being the name of the directory _under $prefix_, not an absolute path. This resulted in the pkgconfig files have libdir=/usr which mostly works as the actual library directory is on the search path, but can break other recipes (such as tpm2-openssl). Pass the correct value for --libdir, and also remove the odd handling of an empty ${prefix} which is very historical[1] and can't happen anymore as all build variations have a prefix. [1] Added in oe-classic f725a81c, 2009 Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-05-02recipes: Update WORKDIR references to UNPACKDIRRichard Purdie
Since we want to be able to stop unpacking to WORKDIR, correct the WORKDIR references in recipe do_compile/do_install tasks to use UNPACKDIR in the appropraite places instead. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-04-25openssl: upgrade 3.2.1 -> 3.3.0Wang Mingyu
CVE-2024-2511.patch revmoed since it's included in 3.3.0 Changelog: https://github.com/openssl/openssl/blob/openssl-3.3.0/NEWS.md Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-04-16openssl: openssl: patch CVE-2024-2511Peter Marko
Patch: https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08 News: https://github.com/openssl/openssl/commit/b7acb6731a96b073d6150465bd090e2052a595c2 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-03-30openssl: fix crash on aarch64 if BTI is enabled but no Crypto instructionsRoss Burton
On aarch64, if the processor doesn't have the Crypto instructions then OpenSSL will fall back onto the "bit-sliced" assembler routines. When branch protection (BTI) was enabled in OpenSSL these routines were missed, so if BTI is available libssl will immediately abort when it enters this assembler. Backport a patch submitted upstream to add the required call target annotations so that BTI doesn't believe the code is being exploited. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-02-27openssl: Match target name for loongarch64Xiaotian Wu
This is updated in openssl [1] since opensssl 3.2.0-alpha1 onwards [1] https://github.com/openssl/openssl/commit/b625e21e67666213ffd3ba6b1f2cd8a847ba6b66 Signed-off-by: Xiaotian Wu <wuxiaotian@loongson.cn> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-02-24meta: Remove some not needed CVE_STATUSSimone Weiß
CVE_STATUS was set for those components, but meanwhile databases are updated with corrected information, so setting the CVE_STATUS is not needed anymore. Signed-off-by: Simone Weiß <simone.p.weiss@posteo.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-02-05openssl: Upgrade 3.2.0 -> 3.2.1Peter Marko
Fixes CVE-2024-0727 and CVE-2023-6237 Removed included patch backports. New module was implemented in tests and needs to be installed to successfully pass 04-test_provider.t test. Release information: https://github.com/openssl/openssl/blob/openssl-3.2/NEWS.md#major-changes-between-openssl-320-and-openssl-321-30-jan-2024 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-02-02openssl: backport fix for CVE-2023-6129Ross Burton
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-01-19openssl: Fix build on riscvKhem Raj
Backport a typo fix RISCV_HAS_ZKND_ZKNE -> RISCV_HAS_ZKND_AND_ZKNE Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-12-21openssl: mark assembler sections as call targets for PAC/BTI support on aarch64Ross Burton
The assembler sections in OpenSSL were not marked as valid call targets, so branch protection could not be enabled for libcrypto.so. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-12-04openssl: upgrade to 3.2.0Lee Chee Yang
upgrade include fix for CVE-2023-5678. Changes in 3.2.0 https://www.openssl.org/news/cl32.txt drop upstreamed 0001-Link-libatomic-on-riscv32.patch. drop fix_random_labels.patch as fixed by https://github.com/openssl/openssl/commit/0fbc50ef0cb8894973d4739af62e95be825b7ccf Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-11-05openssl: improve handshake test error reportingWilliam Lyu
Fixes [YOCTO #15225] Yocto Bug #15255 is not reproducible. To obtain more useful information for debugging, the OpenSSL test code is improved so that more detailed state information in the handshake loop is printed when an error occurs. Signed-off-by: William Lyu <William.Lyu@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2023-10-26openssl: Upgrade 3.1.3 -> 3.1.4Peter Marko
https://github.com/openssl/openssl/blob/openssl-3.1/NEWS.md#major-changes-between-openssl-313-and-openssl-314-24-oct-2023 Major changes between OpenSSL 3.1.3 and OpenSSL 3.1.4 [24 Oct 2023] * Mitigate incorrect resize handling for symmetric cipher keys and IVs. (CVE-2023-5363) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-10-25openssl: Inherit riscv32 config from latomic config on linuxKhem Raj
We still need this option for riscv32, the patch is also submitted upstream Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-10-23openssl: Match target name for riscv64/riscv32Khem Raj
This is updated in openssl [1] [2] since opensssl 3.2 onwards [1] https://github.com/openssl/openssl/commit/42ee6e7be43c57136d71e5612fed22a06f7f5d0e [2] https://github.com/openssl/openssl/commit/c29554245ae107c87d71c8463eef0134391da318 Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2023-09-22openssl: Upgrade 3.1.2 -> 3.1.3Peter Marko
https://github.com/openssl/openssl/blob/openssl-3.1/NEWS.md#major-changes-between-openssl-312-and-openssl-313-19-sep-2023 Major changes between OpenSSL 3.1.2 and OpenSSL 3.1.3 [19 Sep 2023] * Fix POLY1305 MAC implementation corrupting XMM registers on Windows (CVE-2023-4807) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-09-18openssl: ensure all ptest fails are caughtAlexander Kanavin
Piping results through sed may mask failures that sed isn't catching. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-09-18openssl: parallelize testsAlexander Kanavin
This brings them from 15 minutes to just over 4. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-09-07openssl: build and install manpages only if they are enabledAlexander Kanavin
This significantly speeds up the build by default. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-08-16openssl: Upgrade 3.1.1 -> 3.1.2Peter Marko
https://github.com/openssl/openssl/blob/openssl-3.1/NEWS.md#major-changes-between-openssl-311-and-openssl-312-1-aug-2023 Major changes between OpenSSL 3.1.1 and OpenSSL 3.1.2 [1 Aug 2023] * Fix excessive time spent checking DH q parameter value (CVE-2023-3817) * Fix DH_check() excessive time with over sized modulus (CVE-2023-3446) * Do not ignore empty associated data entries with AES-SIV (CVE-2023-2975) * When building with the enable-fips option and using the resulting FIPS provider, TLS 1.2 will, by default, mandate the use of an extended master secret and the Hash and HMAC DRBGs will not operate with truncated digests. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-07-21cve_check: convert CVE_CHECK_IGNORE to CVE_STATUSAndrej Valek
- Try to add convert and apply statuses for old CVEs - Drop some obsolete ignores, while they are not relevant for current version Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Reviewed-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2023-07-14openssl: use a glob on the PERLEXTERNAL to track updates on the pathJose Quaresma
The Text-Template was updated from 1.46 to 1.56 | ERROR: openssl-native-3.1.1-r0 do_configure: PERLEXTERNAL '/build/tmp/work/x86_64-linux/openssl-native/3.1.1-r0/openssl-3.1.1/external/perl/Text-Template-1.46/lib' not found! Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-07-14openssl: add PERLEXTERNAL path to test its existenceJose Quaresma
When upstream change is better to fail or removing the PERL5LIB if they are not need anymore. Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-06-06openssl: fix building on riscv32Dmitry Baryshkov
On riscv32 configurations OpenSSL fails to build with "undefined reference to `__atomic_foo'" kind of errors. Change OpenSSL recipe to use linux-latomic configuration instead of linux-generic32. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-06-01openssl: upgrade 3.1.0 -> 3.1.1Tim Orling
* Drop CVE-2023-0464.patch (merged upstream). * Refresh 0001-Configure-do-not-tweak-mips-cflags.patch https://github.com/openssl/openssl/blob/openssl-3.1.1/NEWS.md Major changes between OpenSSL 3.1.0 and OpenSSL 3.1.1 [30 May 2023] * Mitigate for very slow OBJ_obj2txt() performance with gigantic OBJECT IDENTIFIER sub-identities. (CVE-2023-2650) * Fixed buffer overread in AES-XTS decryption on ARM 64 bit platforms (CVE-2023-1255) * Fixed documentation of X509_VERIFY_PARAM_add0_policy() (CVE-2023-0466) * Fixed handling of invalid certificate policies in leaf certificates (CVE-2023-0465) * Limited the number of nodes created in a policy tree (CVE-2023-0464) Security Advisory: https://www.openssl.org/news/secadv/20230530.txt CVE: CVE-2023-2650 CVE: CVE-2023-1255 CVE: CVE-2023-0466 CVE: CVE-2023-0465 CVE: CVE-2023-0464 Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-03-26OpenSSL: Security fix for CVE-2023-0464Siddharth Doshi
Upstream-Status: Backport from [https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545] Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2023-03-16openssl: Fix reproducibility issueRichard Purdie
Fix an issue introduced in the new openssl version where an assembler file isn't generated in a reproducible way by seeding the perl random number generator consistently. It has no crypto impact, it is just used to avoid function name clashes. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-03-16openssl: update from 3.0.8 to 3.1.0Randy MacLeod
>From the NEWS.md file: ### Major changes between OpenSSL 3.0 and OpenSSL 3.1.0 [14 Mar 2023] * SSL 3, TLS 1.0, TLS 1.1, and DTLS 1.0 only work at security level 0. * Performance enhancements and new platform support including new assembler code algorithm implementations. * Deprecated LHASH statistics functions. * FIPS 140-3 compliance changes. Drop the upstreamed afalg.patch: c425e365f4 Configure: don't try to be clever when configuring afalgeng Signed-off-by: Randy MacLeod <randy.macleod@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-02-20openssl: Upgrade 3.0.7 -> 3.0.8Siddharth Doshi
OpenSSL 3.0.8 fixes 1 HIGH level security vulnerability and 7 MODERATE level security vulnerability [1]. Upgrade the recipe to point to 3.0.8. CVE-2022-3996 is reported fixed in 3.0.8, so drop the patch for that as well. [1] https://www.openssl.org/news/vulnerabilities.html CVEs Fixed: https://www.openssl.org/news/secadv/20230207.txt Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-02-01openssl: fix CVE-2022-3996 double locking leads to denial of serviceVivek Kumbhar
Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-11-02openssl: Upgrade 3.0.5 -> 3.0.7Ed Tanous
OpenSSL 3.0.5 includes a HIGH level security vulnerability [1]. Upgrade the recipe to point to 3.0.7. CVE-2022-3358 is reported fixed in 3.0.6, so drop the patch for that as well. [1] https://www.openssl.org/news/vulnerabilities.html Fixes CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buffer Overflows https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/ Signed-off-by: Ed Tanous <edtanous@google.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26openssl: Fix SSL_CERT_FILE to match ca-certs locationRichard Purdie
In OE-Core d6b15d1e70b99185cf245d829ada5b6fb99ec1af, "openssl: export necessary env vars in SDK", the value added for SSL_CERT_FILE was in conflict with the value used elsewhere, such as in buildtools. This makes them match and fixes buildtools testsdk failures. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26openssl: CVE-2022-3358 Using a Custom Cipher with NID_undef may lead to NULL ↵Hitendra Prajapati
encryption Upstream-Status: Backport from https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=5485c56679d7c49b96e8fc8ca708b0b7e7c03c4b] Description: CVE-2022-3358 openssl: Using a Custom Cipher with NID_undef may lead to NULL encryption. Affects "openssl < 3.0.6" Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2022-10-25openssl: export necessary env vars in SDKChen Qi
In current SDK, when running the following command in python shell, we get an error. $ python3 >>> from cryptography.hazmat.backends import openssl The error message is as below: cryptography.exceptions.InternalError: Unknown OpenSSL error. We could set OPENSSL_MODULES explicitly in nativesdk-openssl package so that when SDK is set up, it's in environment and we can get rid of the above error. Also, there are other env vars that need to be exported. And we export all of them to keep sync with openssl-native.bbclass. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-28openssl: Move microblaze to linux-latomic configMark Hatle
When building with the previous a number of atomic functions come back as undefined. Switching to linux-latomic fixes this. Signed-off-by: Mark Hatle <mark.hatle@kernel.crashing.org> Signed-off-by: Mark Hatle <mark.hatle@amd.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-08openssl: update 3.0.4 -> 3.0.5Alexander Kanavin
CVEs fixed: https://www.openssl.org/news/secadv/20220705.txt Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-01openssl: Upgrade 3.0.3 -> 3.0.4Richard Purdie
Includes a fix for CVE-2022-2068. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-02openssl: Backport fix for ptest cert expiryRichard Purdie
ptests in in openssl have started failing as one of the test certificates has expired. Backport a fix for this from upstream, replacing the test certificate to allow the ptests to pass again. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-15openssl: minor security upgrade 3.0.2 -> 3.0.3Davide Gardenal
This minor version include fixes for several CVEs CVE: CVE-2022-1292 CVE: CVE-2022-1343 CVE: CVE-2022-1434 CVE: CVE-2022-1473 Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-04-20openssl: extract legacy provider module to a separate packagePeter Marko
This module contains legacy cipher suites from libcrypto. We should not need to include base package because we want to use this part of libcrypto. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-03-16openssl: upgrade to 3.0.2Ross Burton
* Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever for non-prime moduli ([CVE-2022-0778]) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-09-20 10:10:51 +0000