mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-30 05:51:45 -09:00
a4c97ab343
Since the mbedtls bump to v3.6 [1] the ustream-ssl package is failling
on the autobuilder with the following error:
```
In file included from /home/buildroot/instance-0/output-1/build/ustream-ssl-68d09243b6fd4473004b27ff6483352e76e6af1a/ustream-internal.h:25,
from /home/buildroot/instance-0/output-1/build/ustream-ssl-68d09243b6fd4473004b27ff6483352e76e6af1a/ustream-ssl.c:25:
/home/buildroot/instance-0/output-1/build/ustream-ssl-68d09243b6fd4473004b27ff6483352e76e6af1a/ustream-mbedtls.h:24:10: fatal error: mbedtls/certs.h: No such file or directory
24 | #include <mbedtls/certs.h>
| ^~~~~~~~~~~~~~~~~
compilation terminated.
```
This error can be reproduced with the following config:
```
cat <<EOF >.config
BR2_arm=y
BR2_cortex_a7=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_PACKAGE_MBEDTLS=y
BR2_PACKAGE_USTREAM_SSL=y
EOF
make olddefconfig
make
```
This patch backport upstream commit that address the compatibility with
mbedtls v3.6.
- [2] rename the `_random` function used by the mbedtls functions
- [3] update `mbedtls_pk_parse_keyfile` function to support new mbedtls
definition and use `mbedtls_pk_get_type`.
[1] 3481a9643f package/mbedtls: bump to version 3.6.3.1
[2] 0001-ustream-mbedtls-use-getrandom-instead-of-dev-urandom.patch
[3] 0002-ustream-mbedtls-add-compatibility-with-mbed-tls-3-0-0.patch
Fixes: https://autobuild.buildroot.org/results/c20/c20dac7cbe5def2c6036d2e1d06de0bfea68b57c
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d28ae8b00b)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
89 lines
2.5 KiB
Diff
89 lines
2.5 KiB
Diff
From 498f6e268d4d2b0ad33b430f4ba1abe397d31496 Mon Sep 17 00:00:00 2001
|
|
From: Hauke Mehrtens <hauke@hauke-m.de>
|
|
Date: Sun, 19 Feb 2023 21:11:12 +0100
|
|
Subject: [PATCH] ustream-mbedtls: Use getrandom() instead of /dev/urandom
|
|
|
|
Instead of keeping a file descriptor open just use the getrandom syscall
|
|
to get random data. This is supported by musl libc, glibc and Linux for
|
|
some time now.
|
|
|
|
This also improves the error handling in case this function returns not
|
|
as many bytes as expected.
|
|
|
|
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
|
|
Reviewed-by: Torsten Duwe <duwe@lst.de>
|
|
Upstream: https://git.openwrt.org/?p=project/ustream-ssl.git;a=commit;h=498f6e268d4d2b0ad33b430f4ba1abe397d31496
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
---
|
|
ustream-mbedtls.c | 25 ++++++-------------------
|
|
1 file changed, 6 insertions(+), 19 deletions(-)
|
|
|
|
diff --git a/ustream-mbedtls.c b/ustream-mbedtls.c
|
|
index e79e37b..7fc7874 100644
|
|
--- a/ustream-mbedtls.c
|
|
+++ b/ustream-mbedtls.c
|
|
@@ -17,6 +17,7 @@
|
|
*/
|
|
|
|
#include <sys/types.h>
|
|
+#include <sys/random.h>
|
|
#include <fcntl.h>
|
|
#include <unistd.h>
|
|
#include <stdlib.h>
|
|
@@ -25,8 +26,6 @@
|
|
#include "ustream-ssl.h"
|
|
#include "ustream-internal.h"
|
|
|
|
-static int urandom_fd = -1;
|
|
-
|
|
static int s_ustream_read(void *ctx, unsigned char *buf, size_t len)
|
|
{
|
|
struct ustream *s = ctx;
|
|
@@ -66,21 +65,12 @@ __hidden void ustream_set_io(struct ustream_ssl_ctx *ctx, void *ssl, struct ustr
|
|
mbedtls_ssl_set_bio(ssl, conn, s_ustream_write, s_ustream_read, NULL);
|
|
}
|
|
|
|
-static bool urandom_init(void)
|
|
+static int _random(void *ctx, unsigned char *out, size_t len)
|
|
{
|
|
- if (urandom_fd > -1)
|
|
- return true;
|
|
+ ssize_t ret;
|
|
|
|
- urandom_fd = open("/dev/urandom", O_RDONLY);
|
|
- if (urandom_fd < 0)
|
|
- return false;
|
|
-
|
|
- return true;
|
|
-}
|
|
-
|
|
-static int _urandom(void *ctx, unsigned char *out, size_t len)
|
|
-{
|
|
- if (read(urandom_fd, out, len) < 0)
|
|
+ ret = getrandom(out, len, 0);
|
|
+ if (ret < 0 || (size_t)ret != len)
|
|
return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
|
|
|
|
return 0;
|
|
@@ -134,9 +124,6 @@ __ustream_ssl_context_new(bool server)
|
|
mbedtls_ssl_config *conf;
|
|
int ep;
|
|
|
|
- if (!urandom_init())
|
|
- return NULL;
|
|
-
|
|
ctx = calloc(1, sizeof(*ctx));
|
|
if (!ctx)
|
|
return NULL;
|
|
@@ -159,7 +146,7 @@ __ustream_ssl_context_new(bool server)
|
|
|
|
mbedtls_ssl_config_defaults(conf, ep, MBEDTLS_SSL_TRANSPORT_STREAM,
|
|
MBEDTLS_SSL_PRESET_DEFAULT);
|
|
- mbedtls_ssl_conf_rng(conf, _urandom, NULL);
|
|
+ mbedtls_ssl_conf_rng(conf, _random, NULL);
|
|
|
|
if (server) {
|
|
mbedtls_ssl_conf_authmode(conf, MBEDTLS_SSL_VERIFY_NONE);
|
|
--
|
|
2.30.2
|