From c91359697ee19639ea1025940821b0e332e02174 Mon Sep 17 00:00:00 2001 From: Erwan GAUTRON Date: Fri, 15 May 2020 16:02:09 +0200 Subject: [PATCH] package/gnutls: add options to enable/disable legacy features GnuTls implements old, unsafe or unused protocols and cyphers Secure embedded systems shall disable them in order to be certified. This patch allows to select/deselect SSLv2 protocol and gost cipher. Signed-off-by: Erwan GAUTRON [Peter: default options to 'n', move next to _GNUTLS_TOOLS, explicit --enable] Signed-off-by: Peter Korsgaard --- package/gnutls/Config.in | 10 ++++++++++ package/gnutls/gnutls.mk | 4 +++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/package/gnutls/Config.in b/package/gnutls/Config.in index cd83b375aa..d57bb8d135 100644 --- a/package/gnutls/Config.in +++ b/package/gnutls/Config.in @@ -27,6 +27,16 @@ config BR2_PACKAGE_GNUTLS_TOOLS Install GnuTLS command line tools for various cryptographic tasks. +config BR2_PACKAGE_GNUTLS_ENABLE_SSL2 + bool "enable SSLv2" + help + Enable SSLv2 protocol. + +config BR2_PACKAGE_GNUTLS_ENABLE_GOST + bool "enable GOST" + help + Enable GOST cipher. + endif comment "gnutls needs a toolchain w/ wchar, dynamic library" diff --git a/package/gnutls/gnutls.mk b/package/gnutls/gnutls.mk index 11c2d81e7d..dbf7593854 100644 --- a/package/gnutls/gnutls.mk +++ b/package/gnutls/gnutls.mk @@ -29,7 +29,9 @@ GNUTLS_CONF_OPTS = \ --with-librt-prefix=$(STAGING_DIR) \ --without-tpm \ $(if $(BR2_PACKAGE_GNUTLS_OPENSSL),--enable,--disable)-openssl-compatibility \ - $(if $(BR2_PACKAGE_GNUTLS_TOOLS),--enable-tools,--disable-tools) + $(if $(BR2_PACKAGE_GNUTLS_TOOLS),--enable-tools,--disable-tools) \ + $(if $(BR2_PACKAGE_GNUTLS_ENABLE_SSL2),--enable,--disable)-ssl2-support \ + $(if $(BR2_PACKAGE_GNUTLS_ENABLE_GOST),--enable,--disable)-gost GNUTLS_CONF_ENV = gl_cv_socket_ipv6=yes \ ac_cv_header_wchar_h=$(if $(BR2_USE_WCHAR),yes,no) \ gt_cv_c_wchar_t=$(if $(BR2_USE_WCHAR),yes,no) \