lede/package/libs/mbedtls/Makefile

164 lines
4.7 KiB
Makefile
Raw Normal View History

2017-09-06 11:19:45 +00:00
#
# Copyright (C) 2011-2015 OpenWrt.org
#
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.
#
include $(TOPDIR)/rules.mk
PKG_NAME:=mbedtls
PKG_VERSION:=2.28.2
PKG_RELEASE:=1
2017-09-06 11:19:45 +00:00
PKG_USE_MIPS16:=0
mbedtls: update to 2.16.7 (#5377) Mbed TLS 2.16.7 is a maintenance release of the Mbed TLS 2.16 branch, and provides bug fixes and minor enhancements. This release includes fixes for security issues and the most severe one is described in more detail in a security advisory: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-07 * Fix a side channel vulnerability in modular exponentiation that could reveal an RSA private key used in a secure enclave. * Fix side channel in mbedtls_ecp_check_pub_priv() and mbedtls_pk_parse_key() / mbedtls_pk_parse_keyfile() (when loading a private key that didn't include the uncompressed public key), as well as mbedtls_ecp_mul() / mbedtls_ecp_mul_restartable() when called with a NULL f_rng argument. An attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave) could fully recover the ECC private key. * Fix issue in Lucky 13 counter-measure that could make it ineffective when hardware accelerators were used (using one of the MBEDTLS_SHAxxx_ALT macros). Due to Mbed TLS moving from ARMmbed to the Trusted Firmware project, some changes to the download URLs are required. For the time being, the ARMmbed/mbedtls Github repository is the canonical source for Mbed TLS. Signed-off-by: Magnus Kroken <mkroken@gmail.com> [Use https://codeload.github.com and new tar.gz file] Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Co-authored-by: Magnus Kroken <mkroken@gmail.com>
2020-08-30 13:17:26 +00:00
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/ARMmbed/mbedtls/tar.gz/v$(PKG_VERSION)?
PKG_HASH:=bc55232bf71fd66045122ba9050a29ea7cb2e8f99b064a9e6334a82f715881a0
2017-09-06 11:19:45 +00:00
PKG_LICENSE:=GPL-2.0-or-later
PKG_LICENSE_FILES:=gpl-2.0.txt
2018-01-15 10:26:41 +00:00
PKG_CPE_ID:=cpe:/a:arm:mbed_tls
2017-09-06 11:19:45 +00:00
sync with upstream (#10562) * package: sync with upstream Removed: package/libs/libselinux/bcm27xx-userland (Already in package/utils/bcm27xx-userland) Signed-off-by: Linhui Liu <liulinhui36@gmail.com> * uclibc++: remove No package here depends on it. Furthermore, uClibc++ is a fairly buggy C++ library and seems to be relatively inactive upstream. It also lacks proper support for modern C++11 features. The main benefit of it is size: 66.6 KB vs 287.3 KB on mips24kc. Static linking and LTO can help bring the size down of packages that need it. Added warning message to uclibc++.mk Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Hauke Mehrtens <hauke@hauke-m.de> * target: sync with upstream Signed-off-by: Linhui Liu <liulinhui36@gmail.com> * toolchain: gcc: Remove gcc 10.x support This compiler is old and was never used by default in OpenWrt. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> * ucode: update to latest Git HEAD 46d93c9 tests: fixup testcases 4c654df types: adjust double printing format eac2add compiler: fix bytecode for logical assignments of properties 3903b18 fs: add `realpath()` function 8366102 math: add isnan() function eef83d3 tests: relax sleep() test 394e901 lib: uc_json(): accept trailing whitespace when parsing strings 1867c8b uloop: terminate parent uloop in task child processes d2cc003 uci: auto-load package in `ctx.foreach()` and `ctx.get_first()` 6c5ee53 compiler: ensure that arrow functions with block bodies return no value fdc9b6a compiler: fix `??=`, `||=` and `&&=` logical assignment semantics 88dcca7 add cmake to install requires for debian Signed-off-by: Jo-Philipp Wich <jo@mein.io> * firewall4: update to latest Git HEAD 700a925 fw4: prevent null access when no ipsets are defined 6443ec7 config: drop input traffic by default 119ee1a ruleset: drop ctstate invalid traffic for masq-enabled zones Signed-off-by: Jo-Philipp Wich <jo@mein.io> * ustream-ssl: update to Git version 2022-12-07 9217ab4 ustream-openssl: Disable renegotiation in TLSv1.2 and earlier 2ce1d48 ci: fix building with i.MX6 SDK 584f1f6 ustream-openssl: wolfSSL: provide detailed information in debug builds aa8c48e cmake: add a possibility to set library version Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> * tools/mpfr: import patch fixing macro bug Co-authored-by: Nick Hainke <vincent@systemli.org> Signed-off-by: Linhui Liu <liulinhui36@gmail.com> Signed-off-by: Linhui Liu <liulinhui36@gmail.com> Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Signed-off-by: Jo-Philipp Wich <jo@mein.io> Co-authored-by: Rosen Penev <rosenp@gmail.com> Co-authored-by: Hauke Mehrtens <hauke@hauke-m.de> Co-authored-by: Jo-Philipp Wich <jo@mein.io> Co-authored-by: Nick Hainke <vincent@systemli.org>
2022-12-08 06:20:57 +00:00
MBEDTLS_BUILD_OPTS_CURVES= \
CONFIG_MBEDTLS_ECP_DP_SECP192R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP224R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP384R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP521R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP192K1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP224K1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP256K1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_BP256R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_BP384R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_BP512R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_CURVE25519_ENABLED \
CONFIG_MBEDTLS_ECP_DP_CURVE448_ENABLED
MBEDTLS_BUILD_OPTS_CIPHERS= \
CONFIG_MBEDTLS_AES_C \
CONFIG_MBEDTLS_CAMELLIA_C \
CONFIG_MBEDTLS_CCM_C \
CONFIG_MBEDTLS_CMAC_C \
CONFIG_MBEDTLS_DES_C \
CONFIG_MBEDTLS_GCM_C \
CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \
CONFIG_MBEDTLS_NIST_KW_C \
CONFIG_MBEDTLS_RIPEMD160_C \
CONFIG_MBEDTLS_RSA_NO_CRT \
CONFIG_MBEDTLS_XTEA_C
MBEDTLS_BUILD_OPTS= \
$(MBEDTLS_BUILD_OPTS_CURVES) \
$(MBEDTLS_BUILD_OPTS_CIPHERS) \
CONFIG_MBEDTLS_CERTS_C \
CONFIG_MBEDTLS_CIPHER_MODE_OFB \
CONFIG_MBEDTLS_CIPHER_MODE_XTS \
CONFIG_MBEDTLS_DEBUG_C \
CONFIG_MBEDTLS_ENTROPY_FORCE_SHA256 \
CONFIG_MBEDTLS_HKDF_C \
CONFIG_MBEDTLS_PLATFORM_C \
CONFIG_MBEDTLS_SELF_TEST \
CONFIG_MBEDTLS_SSL_RENEGOTIATION \
CONFIG_MBEDTLS_SSL_TRUNCATED_HMAC \
CONFIG_MBEDTLS_VERSION_C \
CONFIG_MBEDTLS_VERSION_FEATURES
PKG_CONFIG_DEPENDS := $(MBEDTLS_BUILD_OPTS)
2017-09-06 11:19:45 +00:00
include $(INCLUDE_DIR)/package.mk
include $(INCLUDE_DIR)/cmake.mk
define Package/mbedtls/Default
TITLE:=Embedded SSL
URL:=https://tls.mbed.org
endef
define Package/mbedtls/Default/description
The aim of the mbedtls project is to provide a quality, open-source
cryptographic library written in C and targeted at embedded systems.
endef
define Package/libmbedtls
$(call Package/mbedtls/Default)
SECTION:=libs
CATEGORY:=Libraries
SUBMENU:=SSL
2017-09-06 11:19:45 +00:00
TITLE+= (library)
ABI_VERSION:=12
sync with upstream (#10562) * package: sync with upstream Removed: package/libs/libselinux/bcm27xx-userland (Already in package/utils/bcm27xx-userland) Signed-off-by: Linhui Liu <liulinhui36@gmail.com> * uclibc++: remove No package here depends on it. Furthermore, uClibc++ is a fairly buggy C++ library and seems to be relatively inactive upstream. It also lacks proper support for modern C++11 features. The main benefit of it is size: 66.6 KB vs 287.3 KB on mips24kc. Static linking and LTO can help bring the size down of packages that need it. Added warning message to uclibc++.mk Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Hauke Mehrtens <hauke@hauke-m.de> * target: sync with upstream Signed-off-by: Linhui Liu <liulinhui36@gmail.com> * toolchain: gcc: Remove gcc 10.x support This compiler is old and was never used by default in OpenWrt. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> * ucode: update to latest Git HEAD 46d93c9 tests: fixup testcases 4c654df types: adjust double printing format eac2add compiler: fix bytecode for logical assignments of properties 3903b18 fs: add `realpath()` function 8366102 math: add isnan() function eef83d3 tests: relax sleep() test 394e901 lib: uc_json(): accept trailing whitespace when parsing strings 1867c8b uloop: terminate parent uloop in task child processes d2cc003 uci: auto-load package in `ctx.foreach()` and `ctx.get_first()` 6c5ee53 compiler: ensure that arrow functions with block bodies return no value fdc9b6a compiler: fix `??=`, `||=` and `&&=` logical assignment semantics 88dcca7 add cmake to install requires for debian Signed-off-by: Jo-Philipp Wich <jo@mein.io> * firewall4: update to latest Git HEAD 700a925 fw4: prevent null access when no ipsets are defined 6443ec7 config: drop input traffic by default 119ee1a ruleset: drop ctstate invalid traffic for masq-enabled zones Signed-off-by: Jo-Philipp Wich <jo@mein.io> * ustream-ssl: update to Git version 2022-12-07 9217ab4 ustream-openssl: Disable renegotiation in TLSv1.2 and earlier 2ce1d48 ci: fix building with i.MX6 SDK 584f1f6 ustream-openssl: wolfSSL: provide detailed information in debug builds aa8c48e cmake: add a possibility to set library version Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> * tools/mpfr: import patch fixing macro bug Co-authored-by: Nick Hainke <vincent@systemli.org> Signed-off-by: Linhui Liu <liulinhui36@gmail.com> Signed-off-by: Linhui Liu <liulinhui36@gmail.com> Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Signed-off-by: Jo-Philipp Wich <jo@mein.io> Co-authored-by: Rosen Penev <rosenp@gmail.com> Co-authored-by: Hauke Mehrtens <hauke@hauke-m.de> Co-authored-by: Jo-Philipp Wich <jo@mein.io> Co-authored-by: Nick Hainke <vincent@systemli.org>
2022-12-08 06:20:57 +00:00
MENU:=1
endef
define Package/libmbedtls/config
sync with upstream (#10562) * package: sync with upstream Removed: package/libs/libselinux/bcm27xx-userland (Already in package/utils/bcm27xx-userland) Signed-off-by: Linhui Liu <liulinhui36@gmail.com> * uclibc++: remove No package here depends on it. Furthermore, uClibc++ is a fairly buggy C++ library and seems to be relatively inactive upstream. It also lacks proper support for modern C++11 features. The main benefit of it is size: 66.6 KB vs 287.3 KB on mips24kc. Static linking and LTO can help bring the size down of packages that need it. Added warning message to uclibc++.mk Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Hauke Mehrtens <hauke@hauke-m.de> * target: sync with upstream Signed-off-by: Linhui Liu <liulinhui36@gmail.com> * toolchain: gcc: Remove gcc 10.x support This compiler is old and was never used by default in OpenWrt. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> * ucode: update to latest Git HEAD 46d93c9 tests: fixup testcases 4c654df types: adjust double printing format eac2add compiler: fix bytecode for logical assignments of properties 3903b18 fs: add `realpath()` function 8366102 math: add isnan() function eef83d3 tests: relax sleep() test 394e901 lib: uc_json(): accept trailing whitespace when parsing strings 1867c8b uloop: terminate parent uloop in task child processes d2cc003 uci: auto-load package in `ctx.foreach()` and `ctx.get_first()` 6c5ee53 compiler: ensure that arrow functions with block bodies return no value fdc9b6a compiler: fix `??=`, `||=` and `&&=` logical assignment semantics 88dcca7 add cmake to install requires for debian Signed-off-by: Jo-Philipp Wich <jo@mein.io> * firewall4: update to latest Git HEAD 700a925 fw4: prevent null access when no ipsets are defined 6443ec7 config: drop input traffic by default 119ee1a ruleset: drop ctstate invalid traffic for masq-enabled zones Signed-off-by: Jo-Philipp Wich <jo@mein.io> * ustream-ssl: update to Git version 2022-12-07 9217ab4 ustream-openssl: Disable renegotiation in TLSv1.2 and earlier 2ce1d48 ci: fix building with i.MX6 SDK 584f1f6 ustream-openssl: wolfSSL: provide detailed information in debug builds aa8c48e cmake: add a possibility to set library version Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> * tools/mpfr: import patch fixing macro bug Co-authored-by: Nick Hainke <vincent@systemli.org> Signed-off-by: Linhui Liu <liulinhui36@gmail.com> Signed-off-by: Linhui Liu <liulinhui36@gmail.com> Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Signed-off-by: Jo-Philipp Wich <jo@mein.io> Co-authored-by: Rosen Penev <rosenp@gmail.com> Co-authored-by: Hauke Mehrtens <hauke@hauke-m.de> Co-authored-by: Jo-Philipp Wich <jo@mein.io> Co-authored-by: Nick Hainke <vincent@systemli.org>
2022-12-08 06:20:57 +00:00
source "$(SOURCE)/Config.in"
2017-09-06 11:19:45 +00:00
endef
define Package/mbedtls-util
$(call Package/mbedtls/Default)
SECTION:=utils
CATEGORY:=Utilities
TITLE+= (utilities)
DEPENDS:=+libmbedtls
endef
2017-09-06 11:19:45 +00:00
define Package/libmbedtls/description
$(call Package/mbedtls/Default/description)
This package contains the mbedtls library.
endef
define Package/mbedtls-util/description
$(call Package/mbedtls/Default/description)
This package contains mbedtls helper programs for private key and
CSR generation (gen_key, cert_req)
endef
2017-09-06 11:19:45 +00:00
TARGET_CFLAGS += -ffunction-sections -fdata-sections
2018-09-07 05:43:55 +00:00
TARGET_CFLAGS := $(filter-out -O%,$(TARGET_CFLAGS))
2017-09-06 11:19:45 +00:00
CMAKE_OPTIONS += \
-DCMAKE_POSITION_INDEPENDENT_CODE=ON \
2017-09-06 11:19:45 +00:00
-DUSE_SHARED_MBEDTLS_LIBRARY:Bool=ON \
-DENABLE_TESTING:Bool=OFF \
-DENABLE_PROGRAMS:Bool=ON
2017-09-06 11:19:45 +00:00
sync with upstream (#10562) * package: sync with upstream Removed: package/libs/libselinux/bcm27xx-userland (Already in package/utils/bcm27xx-userland) Signed-off-by: Linhui Liu <liulinhui36@gmail.com> * uclibc++: remove No package here depends on it. Furthermore, uClibc++ is a fairly buggy C++ library and seems to be relatively inactive upstream. It also lacks proper support for modern C++11 features. The main benefit of it is size: 66.6 KB vs 287.3 KB on mips24kc. Static linking and LTO can help bring the size down of packages that need it. Added warning message to uclibc++.mk Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Hauke Mehrtens <hauke@hauke-m.de> * target: sync with upstream Signed-off-by: Linhui Liu <liulinhui36@gmail.com> * toolchain: gcc: Remove gcc 10.x support This compiler is old and was never used by default in OpenWrt. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> * ucode: update to latest Git HEAD 46d93c9 tests: fixup testcases 4c654df types: adjust double printing format eac2add compiler: fix bytecode for logical assignments of properties 3903b18 fs: add `realpath()` function 8366102 math: add isnan() function eef83d3 tests: relax sleep() test 394e901 lib: uc_json(): accept trailing whitespace when parsing strings 1867c8b uloop: terminate parent uloop in task child processes d2cc003 uci: auto-load package in `ctx.foreach()` and `ctx.get_first()` 6c5ee53 compiler: ensure that arrow functions with block bodies return no value fdc9b6a compiler: fix `??=`, `||=` and `&&=` logical assignment semantics 88dcca7 add cmake to install requires for debian Signed-off-by: Jo-Philipp Wich <jo@mein.io> * firewall4: update to latest Git HEAD 700a925 fw4: prevent null access when no ipsets are defined 6443ec7 config: drop input traffic by default 119ee1a ruleset: drop ctstate invalid traffic for masq-enabled zones Signed-off-by: Jo-Philipp Wich <jo@mein.io> * ustream-ssl: update to Git version 2022-12-07 9217ab4 ustream-openssl: Disable renegotiation in TLSv1.2 and earlier 2ce1d48 ci: fix building with i.MX6 SDK 584f1f6 ustream-openssl: wolfSSL: provide detailed information in debug builds aa8c48e cmake: add a possibility to set library version Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> * tools/mpfr: import patch fixing macro bug Co-authored-by: Nick Hainke <vincent@systemli.org> Signed-off-by: Linhui Liu <liulinhui36@gmail.com> Signed-off-by: Linhui Liu <liulinhui36@gmail.com> Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Signed-off-by: Jo-Philipp Wich <jo@mein.io> Co-authored-by: Rosen Penev <rosenp@gmail.com> Co-authored-by: Hauke Mehrtens <hauke@hauke-m.de> Co-authored-by: Jo-Philipp Wich <jo@mein.io> Co-authored-by: Nick Hainke <vincent@systemli.org>
2022-12-08 06:20:57 +00:00
define Build/Prepare
$(call Build/Prepare/Default)
$(if $(strip $(foreach opt,$(MBEDTLS_BUILD_OPTS),$($(opt)))),
$(foreach opt,$(MBEDTLS_BUILD_OPTS),
$(PKG_BUILD_DIR)/scripts/config.py \
-f $(PKG_BUILD_DIR)/include/mbedtls/config.h \
$(if $($(opt)),set,unset) $(patsubst CONFIG_%,%,$(opt))),)
endef
2017-09-06 11:19:45 +00:00
define Build/InstallDev
$(INSTALL_DIR) $(1)/usr/include
$(CP) $(PKG_INSTALL_DIR)/usr/include/mbedtls $(1)/usr/include/
$(INSTALL_DIR) $(1)/usr/lib
$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.so* $(1)/usr/lib/
$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.a $(1)/usr/lib/
endef
define Package/libmbedtls/install
$(INSTALL_DIR) $(1)/usr/lib
$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.so.* $(1)/usr/lib/
2017-09-06 11:19:45 +00:00
endef
define Package/mbedtls-util/install
$(INSTALL_DIR) $(1)/usr/bin
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/gen_key $(1)/usr/bin/
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/cert_req $(1)/usr/bin/
endef
2017-09-06 11:19:45 +00:00
$(eval $(call BuildPackage,libmbedtls))
2022-09-09 13:12:05 +00:00
$(eval $(call BuildPackage,mbedtls-util))