mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-11-13 03:58:55 -10:00
7f665c8977
Since OpenSSL 3.5, commit fed9be39ffec ("Make RFC8422 deprecated TLS EC
curves disablable"), OpenSSL has the option to disable support
for legacy TLS EC groups that were deprecated in RFC8422.
In OpenSSL 4.0, the option will be removed again and instead there will
be an option to _enable_ the legacy curves.
Add a Kconfig option to enable the deprecated curves. Use positive logic
already, i.e. the Kconfig option enables them.
Signed-off-by: Konrad Vité <konrad.vite@cherry.de>
Acked-by: Quentin Schulz <quentin.schulz@cherry.de>
[Arnout: clarify that enabling this option is dangerous]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
188 lines
6.5 KiB
Makefile
188 lines
6.5 KiB
Makefile
################################################################################
|
|
#
|
|
# libopenssl
|
|
#
|
|
################################################################################
|
|
|
|
LIBOPENSSL_VERSION = 3.6.5
|
|
LIBOPENSSL_SITE = https://github.com/openssl/openssl/releases/download/openssl-$(LIBOPENSSL_VERSION)
|
|
LIBOPENSSL_SOURCE = openssl-$(LIBOPENSSL_VERSION).tar.gz
|
|
LIBOPENSSL_LICENSE = Apache-2.0
|
|
LIBOPENSSL_LICENSE_FILES = LICENSE.txt
|
|
LIBOPENSSL_INSTALL_STAGING = YES
|
|
LIBOPENSSL_DEPENDENCIES = zlib
|
|
HOST_LIBOPENSSL_DEPENDENCIES = host-zlib
|
|
LIBOPENSSL_TARGET_ARCH = $(call qstrip,$(BR2_PACKAGE_LIBOPENSSL_TARGET_ARCH))
|
|
LIBOPENSSL_CFLAGS = $(TARGET_CFLAGS)
|
|
LIBOPENSSL_PROVIDES = openssl
|
|
LIBOPENSSL_CPE_ID_VENDOR = $(LIBOPENSSL_PROVIDES)
|
|
LIBOPENSSL_CPE_ID_PRODUCT = $(LIBOPENSSL_PROVIDES)
|
|
|
|
ifeq ($(BR2_m68k_cf),y)
|
|
# relocation truncated to fit: R_68K_GOT16O
|
|
LIBOPENSSL_CFLAGS += -mxgot
|
|
# resolves an assembler "out of range error" with blake2 and sha512 algorithms
|
|
LIBOPENSSL_CFLAGS += -DOPENSSL_SMALL_FOOTPRINT
|
|
# disable atomic operations
|
|
ifeq ($(BR2_TOOLCHAIN_HAS_ATOMIC),)
|
|
LIBOPENSSL_CFLAGS += -DBROKEN_CLANG_ATOMICS
|
|
endif
|
|
endif
|
|
|
|
ifeq ($(BR2_USE_MMU),)
|
|
LIBOPENSSL_CFLAGS += -DHAVE_FORK=0 -DHAVE_MADVISE=0
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_CRYPTODEV_LINUX),y)
|
|
LIBOPENSSL_DEPENDENCIES += cryptodev-linux
|
|
endif
|
|
|
|
# fixes the following build failures:
|
|
#
|
|
# - musl
|
|
# ./libcrypto.so: undefined reference to `getcontext'
|
|
# ./libcrypto.so: undefined reference to `setcontext'
|
|
# ./libcrypto.so: undefined reference to `makecontext'
|
|
#
|
|
# - uclibc:
|
|
# crypto/async/arch/../arch/async_posix.h:32:5: error: unknown type name 'ucontext_t'
|
|
#
|
|
|
|
ifeq ($(BR2_TOOLCHAIN_USES_MUSL),y)
|
|
LIBOPENSSL_CFLAGS += -DOPENSSL_NO_ASYNC
|
|
endif
|
|
ifeq ($(BR2_TOOLCHAIN_HAS_UCONTEXT),)
|
|
LIBOPENSSL_CFLAGS += -DOPENSSL_NO_ASYNC
|
|
endif
|
|
|
|
define HOST_LIBOPENSSL_CONFIGURE_CMDS
|
|
cd $(@D); \
|
|
$(HOST_CONFIGURE_OPTS) \
|
|
./config \
|
|
--prefix=$(HOST_DIR) \
|
|
--openssldir=$(HOST_DIR)/etc/ssl \
|
|
no-docs \
|
|
no-tests \
|
|
no-fuzz-libfuzzer \
|
|
no-fuzz-afl \
|
|
shared \
|
|
zlib-dynamic
|
|
endef
|
|
|
|
define LIBOPENSSL_CONFIGURE_CMDS
|
|
cd $(@D); \
|
|
$(TARGET_CONFIGURE_ARGS) \
|
|
$(TARGET_CONFIGURE_OPTS) \
|
|
CFLAGS="$(LIBOPENSSL_CFLAGS)" \
|
|
./Configure \
|
|
$(LIBOPENSSL_TARGET_ARCH) \
|
|
--prefix=/usr \
|
|
--openssldir=/etc/ssl \
|
|
$(if $(BR2_TOOLCHAIN_HAS_THREADS),threads,no-threads) \
|
|
$(if $(BR2_STATIC_LIBS),no-shared,shared) \
|
|
$(if $(BR2_PACKAGE_CRYPTODEV_LINUX),enable-devcryptoeng) \
|
|
no-rc5 \
|
|
enable-camellia \
|
|
no-docs \
|
|
no-tests \
|
|
no-fuzz-libfuzzer \
|
|
no-fuzz-afl \
|
|
no-afalgeng \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_BIN),,no-apps) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENGINES),,no-engine) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_CHACHA),,no-chacha) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_RC2),,no-rc2) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_RC4),,no-rc4) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_MD2),,no-md2) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_MD4),,no-md4) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_MDC2),,no-mdc2) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_BLAKE2),,no-blake2) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_IDEA),,no-idea) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_SEED),,no-seed) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_DES),,no-des) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_RMD160),,no-rmd160) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_WHIRLPOOL),,no-whirlpool) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_BLOWFISH),,no-bf) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_SSL),,no-ssl) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_SSL3),,no-ssl3) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_WEAK_SSL),,no-weak-ssl-ciphers) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_PSK),,no-psk) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_CAST),,no-cast) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_UNSECURE),,no-unit-test no-crypto-mdebug no-autoerrinit) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_DYNAMIC_ENGINE),,no-dynamic-engine ) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_COMP),,no-comp) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_ARGON2),,no-argon2) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_CACHED_FETCH),,no-cached-fetch) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_CMP),,no-cmp) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_THREAD_POOL),,no-thread-pool no-default-thread-pool) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_ECX),,no-ecx) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_LOADER_ENGINE),,no-loadereng) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_PADLOCK_ENGINE),,no-padlockeng) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_MODULE),,no-module) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_QUIC),,no-quic) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_SECURE_MEMORY),,no-secure-memory) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_SIV),,no-siv) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_SM2_PRECOMP_TABLE),,no-sm2-precomp) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_SSL_TRACE),,no-ssl-trace) \
|
|
$(if $(BR2_PACKAGE_LIBOPENSSL_ENABLE_TLS_DEPRECATED_EC),,no-tls-deprecated-ec) \
|
|
$(if $(BR2_STATIC_LIBS),zlib,zlib-dynamic) \
|
|
$(if $(BR2_STATIC_LIBS),no-dso)
|
|
endef
|
|
|
|
# libdl is not available in a static build, and this is not implied by no-dso
|
|
ifeq ($(BR2_STATIC_LIBS),y)
|
|
define LIBOPENSSL_FIXUP_STATIC_MAKEFILE
|
|
$(SED) 's#-ldl##g' $(@D)/Makefile
|
|
endef
|
|
LIBOPENSSL_POST_CONFIGURE_HOOKS += LIBOPENSSL_FIXUP_STATIC_MAKEFILE
|
|
endif
|
|
|
|
define HOST_LIBOPENSSL_BUILD_CMDS
|
|
$(HOST_MAKE_ENV) $(MAKE) -C $(@D)
|
|
endef
|
|
|
|
define LIBOPENSSL_BUILD_CMDS
|
|
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D)
|
|
endef
|
|
|
|
define LIBOPENSSL_INSTALL_STAGING_CMDS
|
|
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) DESTDIR=$(STAGING_DIR) install
|
|
endef
|
|
|
|
define HOST_LIBOPENSSL_INSTALL_CMDS
|
|
$(HOST_MAKE_ENV) $(MAKE) -C $(@D) install
|
|
endef
|
|
|
|
define LIBOPENSSL_INSTALL_TARGET_CMDS
|
|
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) DESTDIR=$(TARGET_DIR) install
|
|
$(RM) -rf $(TARGET_DIR)/usr/lib/ssl
|
|
$(RM) -f $(TARGET_DIR)/usr/bin/c_rehash
|
|
endef
|
|
|
|
# libdl has no business in a static build
|
|
ifeq ($(BR2_STATIC_LIBS),y)
|
|
define LIBOPENSSL_FIXUP_STATIC_PKGCONFIG
|
|
$(SED) 's#-ldl##' $(STAGING_DIR)/usr/lib/pkgconfig/libcrypto.pc
|
|
$(SED) 's#-ldl##' $(STAGING_DIR)/usr/lib/pkgconfig/libssl.pc
|
|
$(SED) 's#-ldl##' $(STAGING_DIR)/usr/lib/pkgconfig/openssl.pc
|
|
endef
|
|
LIBOPENSSL_POST_INSTALL_STAGING_HOOKS += LIBOPENSSL_FIXUP_STATIC_PKGCONFIG
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_PERL),)
|
|
define LIBOPENSSL_REMOVE_PERL_SCRIPTS
|
|
$(RM) -f $(TARGET_DIR)/etc/ssl/misc/{CA.pl,tsget}
|
|
endef
|
|
LIBOPENSSL_POST_INSTALL_TARGET_HOOKS += LIBOPENSSL_REMOVE_PERL_SCRIPTS
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBOPENSSL_ENGINES),)
|
|
define LIBOPENSSL_REMOVE_LIBOPENSSL_ENGINES
|
|
$(RM) -rf $(TARGET_DIR)/usr/lib/engines-3
|
|
endef
|
|
LIBOPENSSL_POST_INSTALL_TARGET_HOOKS += LIBOPENSSL_REMOVE_LIBOPENSSL_ENGINES
|
|
endif
|
|
|
|
$(eval $(generic-package))
|
|
$(eval $(host-generic-package))
|