summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/openssl
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-connectivity/openssl')
-rw-r--r--meta/recipes-connectivity/openssl/files/environment.d-openssl.sh25
-rw-r--r--meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch367
-rw-r--r--meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch39
-rw-r--r--meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch34
-rw-r--r--meta/recipes-connectivity/openssl/openssl/0001-skip-test_symbol_presence.patch46
-rw-r--r--meta/recipes-connectivity/openssl/openssl/afalg.patch31
-rw-r--r--meta/recipes-connectivity/openssl/openssl/reproducible.patch32
-rw-r--r--meta/recipes-connectivity/openssl/openssl/run-ptest19
-rw-r--r--meta/recipes-connectivity/openssl/openssl_1.1.1g.bb215
-rw-r--r--meta/recipes-connectivity/openssl/openssl_3.5.0.bb283
10 files changed, 746 insertions, 345 deletions
diff --git a/meta/recipes-connectivity/openssl/files/environment.d-openssl.sh b/meta/recipes-connectivity/openssl/files/environment.d-openssl.sh
index b9cc24a7ac..71d378734c 100644
--- a/meta/recipes-connectivity/openssl/files/environment.d-openssl.sh
+++ b/meta/recipes-connectivity/openssl/files/environment.d-openssl.sh
@@ -1 +1,24 @@
1export OPENSSL_CONF="$OECORE_NATIVE_SYSROOT/usr/lib/ssl/openssl.cnf" 1export OPENSSL_CONF="$OECORE_NATIVE_SYSROOT/usr/lib/ssl-3/openssl.cnf"
2export OPENSSL_MODULES="$OECORE_NATIVE_SYSROOT/usr/lib/ossl-modules/"
3export OPENSSL_ENGINES="$OECORE_NATIVE_SYSROOT/usr/lib/engines-3"
4export BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS:-} OPENSSL_CONF OPENSSL_MODULES OPENSSL_ENGINES"
5
6# Respect host env SSL_CERT_FILE/SSL_CERT_DIR first, then auto-detected host cert, then cert in buildtools
7# CAFILE/CAPATH is auto-deteced when source buildtools
8if [ -z "$SSL_CERT_FILE" ]; then
9 if [ -n "$CAFILE" ];then
10 export SSL_CERT_FILE="$CAFILE"
11 elif [ -e "${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/ca-certificates.crt" ];then
12 export SSL_CERT_FILE="$OECORE_NATIVE_SYSROOT/usr/lib/ssl-3/certs/ca-certificates.crt"
13 fi
14fi
15
16if [ -z "$SSL_CERT_DIR" ]; then
17 if [ -n "$CAPATH" ];then
18 export SSL_CERT_DIR="$CAPATH"
19 elif [ -e "${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/ca-certificates.crt" ];then
20 export SSL_CERT_DIR="$OECORE_NATIVE_SYSROOT/usr/lib/ssl-3/certs"
21 fi
22fi
23
24export BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS:-} SSL_CERT_DIR SSL_CERT_FILE"
diff --git a/meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch b/meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch
new file mode 100644
index 0000000000..5b7365a353
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch
@@ -0,0 +1,367 @@
1From 5ba65051fea0513db0d997f0ab7cafb9826ed74a Mon Sep 17 00:00:00 2001
2From: William Lyu <William.Lyu@windriver.com>
3Date: Fri, 20 Oct 2023 16:22:37 -0400
4Subject: [PATCH] Added handshake history reporting when test fails
5
6Upstream-Status: Submitted [https://github.com/openssl/openssl/pull/22481]
7
8Signed-off-by: William Lyu <William.Lyu@windriver.com>
9---
10 test/helpers/handshake.c | 137 +++++++++++++++++++++++++++++----------
11 test/helpers/handshake.h | 70 +++++++++++++++++++-
12 test/ssl_test.c | 44 +++++++++++++
13 3 files changed, 217 insertions(+), 34 deletions(-)
14
15diff --git a/test/helpers/handshake.c b/test/helpers/handshake.c
16index f611b3a..5703b48 100644
17--- a/test/helpers/handshake.c
18+++ b/test/helpers/handshake.c
19@@ -25,6 +25,102 @@
20 #include <netinet/sctp.h>
21 #endif
22
23+/* Shamelessly copied from test/helpers/ssl_test_ctx.c */
24+/* Maps string names to various enumeration type */
25+typedef struct {
26+ const char *name;
27+ int value;
28+} enum_name_map;
29+
30+static const enum_name_map connect_phase_names[] = {
31+ {"Handshake", HANDSHAKE},
32+ {"RenegAppData", RENEG_APPLICATION_DATA},
33+ {"RenegSetup", RENEG_SETUP},
34+ {"RenegHandshake", RENEG_HANDSHAKE},
35+ {"AppData", APPLICATION_DATA},
36+ {"Shutdown", SHUTDOWN},
37+ {"ConnectionDone", CONNECTION_DONE}
38+};
39+
40+static const enum_name_map peer_status_names[] = {
41+ {"PeerSuccess", PEER_SUCCESS},
42+ {"PeerRetry", PEER_RETRY},
43+ {"PeerError", PEER_ERROR},
44+ {"PeerWaiting", PEER_WAITING},
45+ {"PeerTestFail", PEER_TEST_FAILURE}
46+};
47+
48+static const enum_name_map handshake_status_names[] = {
49+ {"HandshakeSuccess", HANDSHAKE_SUCCESS},
50+ {"ClientError", CLIENT_ERROR},
51+ {"ServerError", SERVER_ERROR},
52+ {"InternalError", INTERNAL_ERROR},
53+ {"HandshakeRetry", HANDSHAKE_RETRY}
54+};
55+
56+/* Shamelessly copied from test/helpers/ssl_test_ctx.c */
57+static const char *enum_name(const enum_name_map *enums, size_t num_enums,
58+ int value)
59+{
60+ size_t i;
61+ for (i = 0; i < num_enums; i++) {
62+ if (enums[i].value == value) {
63+ return enums[i].name;
64+ }
65+ }
66+ return "InvalidValue";
67+}
68+
69+const char *handshake_connect_phase_name(connect_phase_t phase)
70+{
71+ return enum_name(connect_phase_names, OSSL_NELEM(connect_phase_names),
72+ (int)phase);
73+}
74+
75+const char *handshake_status_name(handshake_status_t handshake_status)
76+{
77+ return enum_name(handshake_status_names, OSSL_NELEM(handshake_status_names),
78+ (int)handshake_status);
79+}
80+
81+const char *handshake_peer_status_name(peer_status_t peer_status)
82+{
83+ return enum_name(peer_status_names, OSSL_NELEM(peer_status_names),
84+ (int)peer_status);
85+}
86+
87+static void save_loop_history(HANDSHAKE_HISTORY *history,
88+ connect_phase_t phase,
89+ handshake_status_t handshake_status,
90+ peer_status_t server_status,
91+ peer_status_t client_status,
92+ int client_turn_count,
93+ int is_client_turn)
94+{
95+ HANDSHAKE_HISTORY_ENTRY *new_entry = NULL;
96+
97+ /*
98+ * Create a new history entry for a handshake loop with statuses given in
99+ * the arguments. Potentially evicting the oldest entry when the
100+ * ring buffer is full.
101+ */
102+ ++(history->last_idx);
103+ history->last_idx &= MAX_HANDSHAKE_HISTORY_ENTRY_IDX_MASK;
104+
105+ new_entry = &((history->entries)[history->last_idx]);
106+ new_entry->phase = phase;
107+ new_entry->handshake_status = handshake_status;
108+ new_entry->server_status = server_status;
109+ new_entry->client_status = client_status;
110+ new_entry->client_turn_count = client_turn_count;
111+ new_entry->is_client_turn = is_client_turn;
112+
113+ /* Evict the oldest handshake loop entry when the ring buffer is full. */
114+ if (history->entry_count < MAX_HANDSHAKE_HISTORY_ENTRY) {
115+ ++(history->entry_count);
116+ }
117+}
118+
119 HANDSHAKE_RESULT *HANDSHAKE_RESULT_new(void)
120 {
121 HANDSHAKE_RESULT *ret;
122@@ -726,15 +822,6 @@ static void configure_handshake_ssl(SSL *server, SSL *client,
123 SSL_set_post_handshake_auth(client, 1);
124 }
125
126-/* The status for each connection phase. */
127-typedef enum {
128- PEER_SUCCESS,
129- PEER_RETRY,
130- PEER_ERROR,
131- PEER_WAITING,
132- PEER_TEST_FAILURE
133-} peer_status_t;
134-
135 /* An SSL object and associated read-write buffers. */
136 typedef struct peer_st {
137 SSL *ssl;
138@@ -1081,17 +1168,6 @@ static void do_shutdown_step(PEER *peer)
139 }
140 }
141
142-typedef enum {
143- HANDSHAKE,
144- RENEG_APPLICATION_DATA,
145- RENEG_SETUP,
146- RENEG_HANDSHAKE,
147- APPLICATION_DATA,
148- SHUTDOWN,
149- CONNECTION_DONE
150-} connect_phase_t;
151-
152-
153 static int renegotiate_op(const SSL_TEST_CTX *test_ctx)
154 {
155 switch (test_ctx->handshake_mode) {
156@@ -1169,19 +1245,6 @@ static void do_connect_step(const SSL_TEST_CTX *test_ctx, PEER *peer,
157 }
158 }
159
160-typedef enum {
161- /* Both parties succeeded. */
162- HANDSHAKE_SUCCESS,
163- /* Client errored. */
164- CLIENT_ERROR,
165- /* Server errored. */
166- SERVER_ERROR,
167- /* Peers are in inconsistent state. */
168- INTERNAL_ERROR,
169- /* One or both peers not done. */
170- HANDSHAKE_RETRY
171-} handshake_status_t;
172-
173 /*
174 * Determine the handshake outcome.
175 * last_status: the status of the peer to have acted last.
176@@ -1546,6 +1609,10 @@ static HANDSHAKE_RESULT *do_handshake_internal(
177
178 start = time(NULL);
179
180+ save_loop_history(&(ret->history),
181+ phase, status, server.status, client.status,
182+ client_turn_count, client_turn);
183+
184 /*
185 * Half-duplex handshake loop.
186 * Client and server speak to each other synchronously in the same process.
187@@ -1567,6 +1634,10 @@ static HANDSHAKE_RESULT *do_handshake_internal(
188 0 /* server went last */);
189 }
190
191+ save_loop_history(&(ret->history),
192+ phase, status, server.status, client.status,
193+ client_turn_count, client_turn);
194+
195 switch (status) {
196 case HANDSHAKE_SUCCESS:
197 client_turn_count = 0;
198diff --git a/test/helpers/handshake.h b/test/helpers/handshake.h
199index 78b03f9..b9967c2 100644
200--- a/test/helpers/handshake.h
201+++ b/test/helpers/handshake.h
202@@ -1,5 +1,5 @@
203 /*
204- * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
205+ * Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.
206 *
207 * Licensed under the Apache License 2.0 (the "License"). You may not use
208 * this file except in compliance with the License. You can obtain a copy
209@@ -12,6 +12,11 @@
210
211 #include "ssl_test_ctx.h"
212
213+#define MAX_HANDSHAKE_HISTORY_ENTRY_BIT 4
214+#define MAX_HANDSHAKE_HISTORY_ENTRY (1 << MAX_HANDSHAKE_HISTORY_ENTRY_BIT)
215+#define MAX_HANDSHAKE_HISTORY_ENTRY_IDX_MASK \
216+ ((1 << MAX_HANDSHAKE_HISTORY_ENTRY_BIT) - 1)
217+
218 typedef struct ctx_data_st {
219 unsigned char *npn_protocols;
220 size_t npn_protocols_len;
221@@ -22,6 +27,63 @@ typedef struct ctx_data_st {
222 char *session_ticket_app_data;
223 } CTX_DATA;
224
225+typedef enum {
226+ HANDSHAKE,
227+ RENEG_APPLICATION_DATA,
228+ RENEG_SETUP,
229+ RENEG_HANDSHAKE,
230+ APPLICATION_DATA,
231+ SHUTDOWN,
232+ CONNECTION_DONE
233+} connect_phase_t;
234+
235+/* The status for each connection phase. */
236+typedef enum {
237+ PEER_SUCCESS,
238+ PEER_RETRY,
239+ PEER_ERROR,
240+ PEER_WAITING,
241+ PEER_TEST_FAILURE
242+} peer_status_t;
243+
244+typedef enum {
245+ /* Both parties succeeded. */
246+ HANDSHAKE_SUCCESS,
247+ /* Client errored. */
248+ CLIENT_ERROR,
249+ /* Server errored. */
250+ SERVER_ERROR,
251+ /* Peers are in inconsistent state. */
252+ INTERNAL_ERROR,
253+ /* One or both peers not done. */
254+ HANDSHAKE_RETRY
255+} handshake_status_t;
256+
257+/* Stores the various status information in a handshake loop. */
258+typedef struct handshake_history_entry_st {
259+ connect_phase_t phase;
260+ handshake_status_t handshake_status;
261+ peer_status_t server_status;
262+ peer_status_t client_status;
263+ int client_turn_count;
264+ int is_client_turn;
265+} HANDSHAKE_HISTORY_ENTRY;
266+
267+typedef struct handshake_history_st {
268+ /* Implemented using ring buffer. */
269+ /*
270+ * The valid entries are |entries[last_idx]|, |entries[last_idx-1]|,
271+ * ..., etc., going up to |entry_count| number of entries. Note that when
272+ * the index into the array |entries| becomes < 0, we wrap around to
273+ * the end of |entries|.
274+ */
275+ HANDSHAKE_HISTORY_ENTRY entries[MAX_HANDSHAKE_HISTORY_ENTRY];
276+ /* The number of valid entries in |entries| array. */
277+ size_t entry_count;
278+ /* The index of the last valid entry in the |entries| array. */
279+ size_t last_idx;
280+} HANDSHAKE_HISTORY;
281+
282 typedef struct handshake_result {
283 ssl_test_result_t result;
284 /* These alerts are in the 2-byte format returned by the info_callback. */
285@@ -77,6 +139,8 @@ typedef struct handshake_result {
286 char *cipher;
287 /* session ticket application data */
288 char *result_session_ticket_app_data;
289+ /* handshake loop history */
290+ HANDSHAKE_HISTORY history;
291 } HANDSHAKE_RESULT;
292
293 HANDSHAKE_RESULT *HANDSHAKE_RESULT_new(void);
294@@ -95,4 +159,8 @@ int configure_handshake_ctx_for_srp(SSL_CTX *server_ctx, SSL_CTX *server2_ctx,
295 CTX_DATA *server2_ctx_data,
296 CTX_DATA *client_ctx_data);
297
298+const char *handshake_connect_phase_name(connect_phase_t phase);
299+const char *handshake_status_name(handshake_status_t handshake_status);
300+const char *handshake_peer_status_name(peer_status_t peer_status);
301+
302 #endif /* OSSL_TEST_HANDSHAKE_HELPER_H */
303diff --git a/test/ssl_test.c b/test/ssl_test.c
304index ea60851..9d6b093 100644
305--- a/test/ssl_test.c
306+++ b/test/ssl_test.c
307@@ -26,6 +26,44 @@ static OSSL_LIB_CTX *libctx = NULL;
308 /* Currently the section names are of the form test-<number>, e.g. test-15. */
309 #define MAX_TESTCASE_NAME_LENGTH 100
310
311+static void print_handshake_history(const HANDSHAKE_HISTORY *history)
312+{
313+ size_t first_idx;
314+ size_t i;
315+ size_t cur_idx;
316+ const HANDSHAKE_HISTORY_ENTRY *cur_entry;
317+ const char header_template[] = "|%14s|%16s|%16s|%16s|%17s|%14s|";
318+ const char body_template[] = "|%14s|%16s|%16s|%16s|%17d|%14s|";
319+
320+ TEST_info("The following is the server/client state "
321+ "in the most recent %d handshake loops.",
322+ MAX_HANDSHAKE_HISTORY_ENTRY);
323+
324+ TEST_note("=================================================="
325+ "==================================================");
326+ TEST_note(header_template,
327+ "phase", "handshake status", "server status",
328+ "client status", "client turn count", "is client turn");
329+ TEST_note("+--------------+----------------+----------------"
330+ "+----------------+-----------------+--------------+");
331+
332+ first_idx = (history->last_idx - history->entry_count + 1) &
333+ MAX_HANDSHAKE_HISTORY_ENTRY_IDX_MASK;
334+ for (i = 0; i < history->entry_count; ++i) {
335+ cur_idx = (first_idx + i) & MAX_HANDSHAKE_HISTORY_ENTRY_IDX_MASK;
336+ cur_entry = &(history->entries)[cur_idx];
337+ TEST_note(body_template,
338+ handshake_connect_phase_name(cur_entry->phase),
339+ handshake_status_name(cur_entry->handshake_status),
340+ handshake_peer_status_name(cur_entry->server_status),
341+ handshake_peer_status_name(cur_entry->client_status),
342+ cur_entry->client_turn_count,
343+ cur_entry->is_client_turn ? "true" : "false");
344+ }
345+ TEST_note("=================================================="
346+ "==================================================");
347+}
348+
349 static const char *print_alert(int alert)
350 {
351 return alert ? SSL_alert_desc_string_long(alert) : "no alert";
352@@ -388,6 +426,12 @@ static int check_test(HANDSHAKE_RESULT *result, SSL_TEST_CTX *test_ctx)
353 ret &= check_client_sign_type(result, test_ctx);
354 ret &= check_client_ca_names(result, test_ctx);
355 }
356+
357+ /* Print handshake loop history if any check fails. */
358+ if (!ret) {
359+ print_handshake_history(&(result->history));
360+ }
361+
362 return ret;
363 }
364
365--
3662.25.1
367
diff --git a/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch b/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch
new file mode 100644
index 0000000000..7043188973
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch
@@ -0,0 +1,39 @@
1From 0377f0d5b5c1079e3b9a80881f4dcc891cbe9f9a Mon Sep 17 00:00:00 2001
2From: Alexander Kanavin <alex@linutronix.de>
3Date: Tue, 30 May 2023 09:11:27 -0700
4Subject: [PATCH] Configure: do not tweak mips cflags
5
6This conflicts with mips machine definitons from yocto,
7e.g.
8| Error: -mips3 conflicts with the other architecture options, which imply -mips64r2
9
10Upstream-Status: Inappropriate [oe-core specific]
11Signed-off-by: Alexander Kanavin <alex@linutronix.de>
12
13Refreshed for openssl-3.1.1
14Signed-off-by: Tim Orling <tim.orling@konsulko.com>
15---
16 Configure | 10 ----------
17 1 file changed, 10 deletions(-)
18
19diff --git a/Configure b/Configure
20index fff97bd..5ee54c1 100755
21--- a/Configure
22+++ b/Configure
23@@ -1551,16 +1551,6 @@ if ($target =~ /^mingw/ && `$config{CC} --target-help 2>&1` =~ m/-mno-cygwin/m)
24 push @{$config{shared_ldflag}}, "-mno-cygwin";
25 }
26
27-if ($target =~ /linux.*-mips/ && !$disabled{asm}
28- && !grep { $_ =~ /-m(ips|arch=)/ } (@{$config{CFLAGS}})) {
29- # minimally required architecture flags for assembly modules
30- my $value;
31- $value = '-mips2' if ($target =~ /mips32/);
32- $value = '-mips3' if ($target =~ /mips64/);
33- unshift @{$config{cflags}}, $value;
34- unshift @{$config{cxxflags}}, $value if $config{CXX};
35-}
36-
37 # If threads aren't disabled, check how possible they are
38 unless ($disabled{threads}) {
39 if ($auto_threads) {
diff --git a/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch b/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch
index 949c788344..687d682976 100644
--- a/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch
+++ b/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch
@@ -1,4 +1,4 @@
1From 3e1d00481093e10775eaf69d619c45b32a4aa7dc Mon Sep 17 00:00:00 2001 1From 5985253f2c9025d7c127443a3a9938946f80c2a1 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Martin=20Hundeb=C3=B8ll?= <martin@geanix.com> 2From: =?UTF-8?q?Martin=20Hundeb=C3=B8ll?= <martin@geanix.com>
3Date: Tue, 6 Nov 2018 14:50:47 +0100 3Date: Tue, 6 Nov 2018 14:50:47 +0100
4Subject: [PATCH] buildinfo: strip sysroot and debug-prefix-map from compiler 4Subject: [PATCH] buildinfo: strip sysroot and debug-prefix-map from compiler
@@ -21,34 +21,43 @@ https://patchwork.openembedded.org/patch/147229/
21Upstream-Status: Inappropriate [OE specific] 21Upstream-Status: Inappropriate [OE specific]
22Signed-off-by: Martin Hundebøll <martin@geanix.com> 22Signed-off-by: Martin Hundebøll <martin@geanix.com>
23 23
24
25Update to fix buildpaths qa issue for '-fmacro-prefix-map'. 24Update to fix buildpaths qa issue for '-fmacro-prefix-map'.
26 25
27Signed-off-by: Kai Kang <kai.kang@windriver.com> 26Signed-off-by: Kai Kang <kai.kang@windriver.com>
27
28Update to fix buildpaths qa issue for '-ffile-prefix-map'.
29
30Signed-off-by: Khem Raj <raj.khem@gmail.com>
31
28--- 32---
29 Configurations/unix-Makefile.tmpl | 10 +++++++++- 33 Configurations/unix-Makefile.tmpl | 16 +++++++++++++++-
30 crypto/build.info | 2 +- 34 crypto/build.info | 2 +-
31 2 files changed, 10 insertions(+), 2 deletions(-) 35 2 files changed, 16 insertions(+), 2 deletions(-)
32 36
33diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl 37diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
34index 16af4d2087..54c162784c 100644 38index 09303c4..011bda1 100644
35--- a/Configurations/unix-Makefile.tmpl 39--- a/Configurations/unix-Makefile.tmpl
36+++ b/Configurations/unix-Makefile.tmpl 40+++ b/Configurations/unix-Makefile.tmpl
37@@ -317,13 +317,22 @@ BIN_LDFLAGS={- join(' ', $target{bin_lflags} || (), 41@@ -502,13 +502,27 @@ BIN_LDFLAGS={- join(' ', $target{bin_lflags} || (),
38 '$(CNF_LDFLAGS)', '$(LDFLAGS)') -} 42 '$(CNF_LDFLAGS)', '$(LDFLAGS)') -}
39 BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS) 43 BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS)
40 44
41-# CPPFLAGS_Q is used for one thing only: to build up buildinf.h 45-# CPPFLAGS_Q is used for one thing only: to build up buildinf.h
42+# *_Q variables are used for one thing only: to build up buildinf.h 46+# *_Q variables are used for one thing only: to build up buildinf.h
43 CPPFLAGS_Q={- $cppflags1 =~ s|([\\"])|\\$1|g; 47 CPPFLAGS_Q={- $cppflags1 =~ s|([\\"])|\\$1|g;
48+ $cppflags1 =~ s|-isystem/[^ ]+/usr/include||g;
44 $cppflags2 =~ s|([\\"])|\\$1|g; 49 $cppflags2 =~ s|([\\"])|\\$1|g;
50+ $cppflags2 =~ s|-isystem/[^ ]+/usr/include||g;
45 $lib_cppflags =~ s|([\\"])|\\$1|g; 51 $lib_cppflags =~ s|([\\"])|\\$1|g;
52+ $lib_cppflags =~ s|-isystem/[^ ]+/usr/include||g;
46 join(' ', $lib_cppflags || (), $cppflags2 || (), 53 join(' ', $lib_cppflags || (), $cppflags2 || (),
47 $cppflags1 || ()) -} 54 $cppflags1 || ()) -}
48 55
49+CFLAGS_Q={- for (@{$config{CFLAGS}}) { 56+CFLAGS_Q={- for (@{$config{CFLAGS}}) {
50+ s|-fdebug-prefix-map=[^ ]+|-fdebug-prefix-map=|g; 57+ s|-fdebug-prefix-map=[^ ]+|-fdebug-prefix-map=|g;
51+ s|-fmacro-prefix-map=[^ ]+|-fmacro-prefix-map=|g; 58+ s|-fmacro-prefix-map=[^ ]+|-fmacro-prefix-map=|g;
59+ s|-ffile-prefix-map=[^ ]+|-ffile-prefix-map=|g;
60+ s|-isystem/[^ ]+/usr/include ||g;
52+ } 61+ }
53+ join(' ', @{$config{CFLAGS}}) -} 62+ join(' ', @{$config{CFLAGS}}) -}
54+ 63+
@@ -59,18 +68,15 @@ index 16af4d2087..54c162784c 100644
59 68
60 # For x86 assembler: Set PROCESSOR to 386 if you want to support 69 # For x86 assembler: Set PROCESSOR to 386 if you want to support
61diff --git a/crypto/build.info b/crypto/build.info 70diff --git a/crypto/build.info b/crypto/build.info
62index b515b7318e..8c9cee2a09 100644 71index aee5c46..95c9577 100644
63--- a/crypto/build.info 72--- a/crypto/build.info
64+++ b/crypto/build.info 73+++ b/crypto/build.info
65@@ -10,7 +10,7 @@ EXTRA= ../ms/uplink-x86.pl ../ms/uplink.c ../ms/applink.c \ 74@@ -115,7 +115,7 @@ DEFINE[../libcrypto]=$UPLINKDEF
66 ppccpuid.pl pariscid.pl alphacpuid.pl arm64cpuid.pl armv4cpuid.pl
67 75
76 DEPEND[info.o]=buildinf.h
68 DEPEND[cversion.o]=buildinf.h 77 DEPEND[cversion.o]=buildinf.h
69-GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(LIB_CFLAGS) $(CPPFLAGS_Q)" "$(PLATFORM)" 78-GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(LIB_CFLAGS) $(CPPFLAGS_Q)" "$(PLATFORM)"
70+GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC_Q) $(CFLAGS_Q) $(CPPFLAGS_Q)" "$(PLATFORM)" 79+GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC_Q) $(CFLAGS_Q) $(CPPFLAGS_Q)" "$(PLATFORM)"
71 DEPEND[buildinf.h]=../configdata.pm
72 80
73 GENERATE[uplink-x86.s]=../ms/uplink-x86.pl $(PERLASM_SCHEME) 81 GENERATE[uplink-x86.S]=../ms/uplink-x86.pl
74-- 82 GENERATE[uplink-x86_64.s]=../ms/uplink-x86_64.pl
752.19.1
76
diff --git a/meta/recipes-connectivity/openssl/openssl/0001-skip-test_symbol_presence.patch b/meta/recipes-connectivity/openssl/openssl/0001-skip-test_symbol_presence.patch
deleted file mode 100644
index d8d9651b64..0000000000
--- a/meta/recipes-connectivity/openssl/openssl/0001-skip-test_symbol_presence.patch
+++ /dev/null
@@ -1,46 +0,0 @@
1From a9401b2289656c5a36dd1b0ecebf0d23e291ce70 Mon Sep 17 00:00:00 2001
2From: Hongxu Jia <hongxu.jia@windriver.com>
3Date: Tue, 2 Oct 2018 23:58:24 +0800
4Subject: [PATCH] skip test_symbol_presence
5
6We cannot skip `01-test_symbol_presence.t' by configuring option `no-shared'
7as INSTALL told us the shared libraries will not be built.
8
9[INSTALL snip]
10 Notes on shared libraries
11 -------------------------
12
13 For most systems the OpenSSL Configure script knows what is needed to
14 build shared libraries for libcrypto and libssl. On these systems
15 the shared libraries will be created by default. This can be suppressed and
16 only static libraries created by using the "no-shared" option. On systems
17 where OpenSSL does not know how to build shared libraries the "no-shared"
18 option will be forced and only static libraries will be created.
19[INSTALL snip]
20
21Hence directly modification the case to skip it.
22
23Upstream-Status: Inappropriate [OE Specific]
24
25Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
26---
27 test/recipes/01-test_symbol_presence.t | 3 +--
28 1 file changed, 1 insertion(+), 2 deletions(-)
29
30diff --git a/test/recipes/01-test_symbol_presence.t b/test/recipes/01-test_symbol_presence.t
31index 7f2a2d7..0b93745 100644
32--- a/test/recipes/01-test_symbol_presence.t
33+++ b/test/recipes/01-test_symbol_presence.t
34@@ -14,8 +14,7 @@ use OpenSSL::Test::Utils;
35
36 setup("test_symbol_presence");
37
38-plan skip_all => "Only useful when building shared libraries"
39- if disabled("shared");
40+plan skip_all => "The case needs debug symbols then we just disable it";
41
42 my @libnames = ("crypto", "ssl");
43 my $testcount = scalar @libnames;
44--
452.7.4
46
diff --git a/meta/recipes-connectivity/openssl/openssl/afalg.patch b/meta/recipes-connectivity/openssl/openssl/afalg.patch
deleted file mode 100644
index b7c0e9697f..0000000000
--- a/meta/recipes-connectivity/openssl/openssl/afalg.patch
+++ /dev/null
@@ -1,31 +0,0 @@
1Don't refuse to build afalgeng if cross-compiling or the host kernel is too old.
2
3Upstream-Status: Submitted [hhttps://github.com/openssl/openssl/pull/7688]
4Signed-off-by: Ross Burton <ross.burton@intel.com>
5
6diff --git a/Configure b/Configure
7index 3baa8ce..9ef52ed 100755
8--- a/Configure
9+++ b/Configure
10@@ -1550,20 +1550,7 @@ unless ($disabled{"crypto-mdebug-backtrace"})
11 unless ($disabled{afalgeng}) {
12 $config{afalgeng}="";
13 if (grep { $_ eq 'afalgeng' } @{$target{enable}}) {
14- my $minver = 4*10000 + 1*100 + 0;
15- if ($config{CROSS_COMPILE} eq "") {
16- my $verstr = `uname -r`;
17- my ($ma, $mi1, $mi2) = split("\\.", $verstr);
18- ($mi2) = $mi2 =~ /(\d+)/;
19- my $ver = $ma*10000 + $mi1*100 + $mi2;
20- if ($ver < $minver) {
21- disable('too-old-kernel', 'afalgeng');
22- } else {
23- push @{$config{engdirs}}, "afalg";
24- }
25- } else {
26- disable('cross-compiling', 'afalgeng');
27- }
28+ push @{$config{engdirs}}, "afalg";
29 } else {
30 disable('not-linux', 'afalgeng');
31 }
diff --git a/meta/recipes-connectivity/openssl/openssl/reproducible.patch b/meta/recipes-connectivity/openssl/openssl/reproducible.patch
deleted file mode 100644
index a24260c95d..0000000000
--- a/meta/recipes-connectivity/openssl/openssl/reproducible.patch
+++ /dev/null
@@ -1,32 +0,0 @@
1The value for perl_archname can vary depending on the host, e.g.
2x86_64-linux-gnu-thread-multi or x86_64-linux-thread-multi which
3makes the ptest package non-reproducible. Its unused other than
4these references so drop it.
5
6RP 2020/2/6
7
8Upstream-Status: Pending
9Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
10
11Index: openssl-1.1.1d/Configure
12===================================================================
13--- openssl-1.1.1d.orig/Configure
14+++ openssl-1.1.1d/Configure
15@@ -286,7 +286,7 @@ if (defined env($local_config_envname))
16 # Save away perl command information
17 $config{perl_cmd} = $^X;
18 $config{perl_version} = $Config{version};
19-$config{perl_archname} = $Config{archname};
20+#$config{perl_archname} = $Config{archname};
21
22 $config{prefix}="";
23 $config{openssldir}="";
24@@ -2517,7 +2517,7 @@ _____
25 @{$config{perlargv}}), "\n";
26 print "\nPerl information:\n\n";
27 print ' ',$config{perl_cmd},"\n";
28- print ' ',$config{perl_version},' for ',$config{perl_archname},"\n";
29+ print ' ',$config{perl_version},"\n";
30 }
31 if ($dump || $options) {
32 my $longest = 0;
diff --git a/meta/recipes-connectivity/openssl/openssl/run-ptest b/meta/recipes-connectivity/openssl/openssl/run-ptest
index 3fb22471f8..cd29bb1446 100644
--- a/meta/recipes-connectivity/openssl/openssl/run-ptest
+++ b/meta/recipes-connectivity/openssl/openssl/run-ptest
@@ -1,12 +1,19 @@
1#!/bin/sh 1#!/bin/sh
2 2
3set -e 3set -eu
4 4
5# Optional arguments are 'list' to lists all tests, or the test name (base name 5# Optional arguments are 'list' to lists the tests, or the test name (base name
6# ie test_evp, not 03_test_evp.t). 6# ie test_evp, not 03_test_evp.t). Without any arguments we run all tests.
7
8if test $# -gt 0; then
9 TESTS=$*
10else
11 # Skip test_symbol_presence as this is for developers
12 TESTS="alltests -test_symbol_presence"
13fi
7 14
8export TOP=. 15export TOP=.
9# OPENSSL_ENGINES is relative from the test binaries 16# Run four jobs in parallel
10export OPENSSL_ENGINES=../engines 17export HARNESS_JOBS=4
11 18
12perl ./test/run_tests.pl $* | perl -0pe 's#(.*) \.*.ok#PASS: \1#g; s#(.*) \.*.skipped: (.*)#SKIP: \1 (\2)#g; s#(.*) \.*.\nDubious#FAIL: \1#;' 19{ perl ./test/run_tests.pl $TESTS || echo "FAIL: openssl" ; } | sed -u -r -e '/(.*) \.*.ok/ s/^/PASS: /g' -r -e '/Dubious(.*)/ s/^/FAIL: /g' -e '/(.*) \.*.skipped: (.*)/ s/^/SKIP: /g'
diff --git a/meta/recipes-connectivity/openssl/openssl_1.1.1g.bb b/meta/recipes-connectivity/openssl/openssl_1.1.1g.bb
deleted file mode 100644
index 815955837b..0000000000
--- a/meta/recipes-connectivity/openssl/openssl_1.1.1g.bb
+++ /dev/null
@@ -1,215 +0,0 @@
1SUMMARY = "Secure Socket Layer"
2DESCRIPTION = "Secure Socket Layer (SSL) binary and related cryptographic tools."
3HOMEPAGE = "http://www.openssl.org/"
4BUGTRACKER = "http://www.openssl.org/news/vulnerabilities.html"
5SECTION = "libs/network"
6
7# "openssl" here actually means both OpenSSL and SSLeay licenses apply
8# (see meta/files/common-licenses/OpenSSL to which "openssl" is SPDXLICENSEMAPped)
9LICENSE = "openssl"
10LIC_FILES_CHKSUM = "file://LICENSE;md5=d343e62fc9c833710bbbed25f27364c8"
11
12DEPENDS = "hostperl-runtime-native"
13
14SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \
15 file://run-ptest \
16 file://0001-skip-test_symbol_presence.patch \
17 file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \
18 file://afalg.patch \
19 file://reproducible.patch \
20 "
21
22SRC_URI_append_class-nativesdk = " \
23 file://environment.d-openssl.sh \
24 "
25
26SRC_URI[sha256sum] = "ddb04774f1e32f0c49751e21b67216ac87852ceb056b75209af2443400636d46"
27
28inherit lib_package multilib_header multilib_script ptest
29MULTILIB_SCRIPTS = "${PN}-bin:${bindir}/c_rehash"
30
31PACKAGECONFIG ?= ""
32PACKAGECONFIG_class-native = ""
33PACKAGECONFIG_class-nativesdk = ""
34
35PACKAGECONFIG[cryptodev-linux] = "enable-devcryptoeng,disable-devcryptoeng,cryptodev-linux,,cryptodev-module"
36
37B = "${WORKDIR}/build"
38do_configure[cleandirs] = "${B}"
39
40#| ./libcrypto.so: undefined reference to `getcontext'
41#| ./libcrypto.so: undefined reference to `setcontext'
42#| ./libcrypto.so: undefined reference to `makecontext'
43EXTRA_OECONF_append_libc-musl = " no-async"
44EXTRA_OECONF_append_libc-musl_powerpc64 = " no-asm"
45
46# adding devrandom prevents openssl from using getrandom() which is not available on older glibc versions
47# (native versions can be built with newer glibc, but then relocated onto a system with older glibc)
48EXTRA_OECONF_class-native = "--with-rand-seed=os,devrandom"
49EXTRA_OECONF_class-nativesdk = "--with-rand-seed=os,devrandom"
50
51# Relying on hardcoded built-in paths causes openssl-native to not be relocateable from sstate.
52CFLAGS_append_class-native = " -DOPENSSLDIR=/not/builtin -DENGINESDIR=/not/builtin"
53CFLAGS_append_class-nativesdk = " -DOPENSSLDIR=/not/builtin -DENGINESDIR=/not/builtin"
54
55do_configure () {
56 os=${HOST_OS}
57 case $os in
58 linux-gnueabi |\
59 linux-gnuspe |\
60 linux-musleabi |\
61 linux-muslspe |\
62 linux-musl )
63 os=linux
64 ;;
65 *)
66 ;;
67 esac
68 target="$os-${HOST_ARCH}"
69 case $target in
70 linux-arm*)
71 target=linux-armv4
72 ;;
73 linux-aarch64*)
74 target=linux-aarch64
75 ;;
76 linux-i?86 | linux-viac3)
77 target=linux-x86
78 ;;
79 linux-gnux32-x86_64 | linux-muslx32-x86_64 )
80 target=linux-x32
81 ;;
82 linux-gnu64-x86_64)
83 target=linux-x86_64
84 ;;
85 linux-mips | linux-mipsel)
86 # specifying TARGET_CC_ARCH prevents openssl from (incorrectly) adding target architecture flags
87 target="linux-mips32 ${TARGET_CC_ARCH}"
88 ;;
89 linux-gnun32-mips*)
90 target=linux-mips64
91 ;;
92 linux-*-mips64 | linux-mips64 | linux-*-mips64el | linux-mips64el)
93 target=linux64-mips64
94 ;;
95 linux-microblaze* | linux-nios2* | linux-sh3 | linux-sh4 | linux-arc*)
96 target=linux-generic32
97 ;;
98 linux-powerpc)
99 target=linux-ppc
100 ;;
101 linux-powerpc64)
102 target=linux-ppc64
103 ;;
104 linux-powerpc64le)
105 target=linux-ppc64le
106 ;;
107 linux-riscv32)
108 target=linux-generic32
109 ;;
110 linux-riscv64)
111 target=linux-generic64
112 ;;
113 linux-sparc | linux-supersparc)
114 target=linux-sparcv9
115 ;;
116 esac
117
118 useprefix=${prefix}
119 if [ "x$useprefix" = "x" ]; then
120 useprefix=/
121 fi
122 # WARNING: do not set compiler/linker flags (-I/-D etc.) in EXTRA_OECONF, as they will fully replace the
123 # environment variables set by bitbake. Adjust the environment variables instead.
124 HASHBANGPERL="/usr/bin/env perl" PERL=perl PERL5LIB="${S}/external/perl/Text-Template-1.46/lib/" \
125 perl ${S}/Configure ${EXTRA_OECONF} ${PACKAGECONFIG_CONFARGS} --prefix=$useprefix --openssldir=${libdir}/ssl-1.1 --libdir=${libdir} $target
126 perl ${B}/configdata.pm --dump
127}
128
129do_install () {
130 oe_runmake DESTDIR="${D}" MANDIR="${mandir}" MANSUFFIX=ssl install
131
132 oe_multilib_header openssl/opensslconf.h
133
134 # Create SSL structure for packages such as ca-certificates which
135 # contain hard-coded paths to /etc/ssl. Debian does the same.
136 install -d ${D}${sysconfdir}/ssl
137 mv ${D}${libdir}/ssl-1.1/certs \
138 ${D}${libdir}/ssl-1.1/private \
139 ${D}${libdir}/ssl-1.1/openssl.cnf \
140 ${D}${sysconfdir}/ssl/
141
142 # Although absolute symlinks would be OK for the target, they become
143 # invalid if native or nativesdk are relocated from sstate.
144 ln -sf ${@oe.path.relative('${libdir}/ssl-1.1', '${sysconfdir}/ssl/certs')} ${D}${libdir}/ssl-1.1/certs
145 ln -sf ${@oe.path.relative('${libdir}/ssl-1.1', '${sysconfdir}/ssl/private')} ${D}${libdir}/ssl-1.1/private
146 ln -sf ${@oe.path.relative('${libdir}/ssl-1.1', '${sysconfdir}/ssl/openssl.cnf')} ${D}${libdir}/ssl-1.1/openssl.cnf
147}
148
149do_install_append_class-native () {
150 create_wrapper ${D}${bindir}/openssl \
151 OPENSSL_CONF=${libdir}/ssl-1.1/openssl.cnf \
152 SSL_CERT_DIR=${libdir}/ssl-1.1/certs \
153 SSL_CERT_FILE=${libdir}/ssl-1.1/cert.pem \
154 OPENSSL_ENGINES=${libdir}/engines-1.1
155}
156
157do_install_append_class-nativesdk () {
158 mkdir -p ${D}${SDKPATHNATIVE}/environment-setup.d
159 install -m 644 ${WORKDIR}/environment.d-openssl.sh ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh
160 sed 's|/usr/lib/ssl/|/usr/lib/ssl-1.1/|g' -i ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh
161}
162
163PTEST_BUILD_HOST_FILES += "configdata.pm"
164PTEST_BUILD_HOST_PATTERN = "perl_version ="
165do_install_ptest () {
166 # Prune the build tree
167 rm -f ${B}/fuzz/*.* ${B}/test/*.*
168
169 cp ${S}/Configure ${B}/configdata.pm ${D}${PTEST_PATH}
170 cp -r ${S}/external ${B}/test ${S}/test ${B}/fuzz ${S}/util ${B}/util ${D}${PTEST_PATH}
171
172 # For test_shlibload
173 ln -s ${libdir}/libcrypto.so.1.1 ${D}${PTEST_PATH}/
174 ln -s ${libdir}/libssl.so.1.1 ${D}${PTEST_PATH}/
175
176 install -d ${D}${PTEST_PATH}/apps
177 ln -s ${bindir}/openssl ${D}${PTEST_PATH}/apps
178 install -m644 ${S}/apps/*.pem ${S}/apps/*.srl ${S}/apps/openssl.cnf ${D}${PTEST_PATH}/apps
179 install -m755 ${B}/apps/CA.pl ${D}${PTEST_PATH}/apps
180
181 install -d ${D}${PTEST_PATH}/engines
182 install -m755 ${B}/engines/ossltest.so ${D}${PTEST_PATH}/engines
183}
184
185# Add the openssl.cnf file to the openssl-conf package. Make the libcrypto
186# package RRECOMMENDS on this package. This will enable the configuration
187# file to be installed for both the openssl-bin package and the libcrypto
188# package since the openssl-bin package depends on the libcrypto package.
189
190PACKAGES =+ "libcrypto libssl openssl-conf ${PN}-engines ${PN}-misc"
191
192FILES_libcrypto = "${libdir}/libcrypto${SOLIBS}"
193FILES_libssl = "${libdir}/libssl${SOLIBS}"
194FILES_openssl-conf = "${sysconfdir}/ssl/openssl.cnf \
195 ${libdir}/ssl-1.1/openssl.cnf* \
196 "
197FILES_${PN}-engines = "${libdir}/engines-1.1"
198FILES_${PN}-misc = "${libdir}/ssl-1.1/misc"
199FILES_${PN} =+ "${libdir}/ssl-1.1/*"
200FILES_${PN}_append_class-nativesdk = " ${SDKPATHNATIVE}/environment-setup.d/openssl.sh"
201
202CONFFILES_openssl-conf = "${sysconfdir}/ssl/openssl.cnf"
203
204RRECOMMENDS_libcrypto += "openssl-conf"
205RDEPENDS_${PN}-ptest += "openssl-bin perl perl-modules bash"
206
207RDEPENDS_${PN}-bin += "openssl-conf"
208
209BBCLASSEXTEND = "native nativesdk"
210
211CVE_PRODUCT = "openssl:openssl"
212
213# Only affects OpenSSL >= 1.1.1 in combination with Apache < 2.4.37
214# Apache in meta-webserver is already recent enough
215CVE_CHECK_WHITELIST += "CVE-2019-0190"
diff --git a/meta/recipes-connectivity/openssl/openssl_3.5.0.bb b/meta/recipes-connectivity/openssl/openssl_3.5.0.bb
new file mode 100644
index 0000000000..0f5c28dafa
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl_3.5.0.bb
@@ -0,0 +1,283 @@
1SUMMARY = "Secure Socket Layer"
2DESCRIPTION = "Secure Socket Layer (SSL) binary and related cryptographic tools."
3HOMEPAGE = "http://www.openssl.org/"
4BUGTRACKER = "http://www.openssl.org/news/vulnerabilities.html"
5SECTION = "libs/network"
6
7LICENSE = "Apache-2.0"
8LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=c75985e733726beaba57bc5253e96d04"
9
10SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \
11 file://run-ptest \
12 file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \
13 file://0001-Configure-do-not-tweak-mips-cflags.patch \
14 file://0001-Added-handshake-history-reporting-when-test-fails.patch \
15 "
16
17SRC_URI:append:class-nativesdk = " \
18 file://environment.d-openssl.sh \
19 "
20
21SRC_URI[sha256sum] = "344d0a79f1a9b08029b0744e2cc401a43f9c90acd1044d09a530b4885a8e9fc0"
22
23inherit lib_package multilib_header multilib_script ptest perlnative manpages
24MULTILIB_SCRIPTS = "${PN}-bin:${bindir}/c_rehash"
25
26PACKAGECONFIG ?= ""
27PACKAGECONFIG:class-native = ""
28PACKAGECONFIG:class-nativesdk = ""
29
30PACKAGECONFIG[cryptodev-linux] = "enable-devcryptoeng,disable-devcryptoeng,cryptodev-linux,,cryptodev-module"
31PACKAGECONFIG[no-tls1] = "no-tls1"
32PACKAGECONFIG[no-tls1_1] = "no-tls1_1"
33PACKAGECONFIG[manpages] = ""
34PACKAGECONFIG[fips] = "enable-fips"
35
36B = "${WORKDIR}/build"
37do_configure[cleandirs] = "${B}"
38
39EXTRA_OECONF = "${@bb.utils.contains('PTEST_ENABLED', '1', '', 'no-tests', d)}"
40
41#| ./libcrypto.so: undefined reference to `getcontext'
42#| ./libcrypto.so: undefined reference to `setcontext'
43#| ./libcrypto.so: undefined reference to `makecontext'
44EXTRA_OECONF:append:libc-musl = " no-async"
45EXTRA_OECONF:append:libc-musl:powerpc64 = " no-asm"
46
47# adding devrandom prevents openssl from using getrandom() which is not available on older glibc versions
48# (native versions can be built with newer glibc, but then relocated onto a system with older glibc)
49EXTRA_OECONF:append:class-native = " --with-rand-seed=os,devrandom"
50EXTRA_OECONF:append:class-nativesdk = " --with-rand-seed=os,devrandom"
51
52# Relying on hardcoded built-in paths causes openssl-native to not be relocateable from sstate.
53EXTRA_OEMAKE:append:task-compile:class-native = ' OPENSSLDIR="/not/builtin" ENGINESDIR="/not/builtin" MODULESDIR="/not/builtin"'
54EXTRA_OEMAKE:append:task-compile:class-nativesdk = ' OPENSSLDIR="/not/builtin" ENGINESDIR="/not/builtin" MODULESDIR="/not/builtin"'
55
56#| threads_pthread.c:(.text+0x372): undefined reference to `__atomic_is_lock_free'
57EXTRA_OECONF:append:toolchain-clang:x86 = " -latomic"
58
59# This allows disabling deprecated or undesirable crypto algorithms.
60# The default is to trust upstream choices.
61DEPRECATED_CRYPTO_FLAGS ?= ""
62
63do_configure () {
64 # When we upgrade glibc but not uninative we see obtuse failures in openssl. Make
65 # the issue really clear that perl isn't functional due to symbol mismatch issues.
66 cat <<- EOF > ${WORKDIR}/perltest
67 #!/usr/bin/env perl
68 use POSIX;
69 EOF
70 chmod a+x ${WORKDIR}/perltest
71 ${WORKDIR}/perltest
72
73 os=${HOST_OS}
74 case $os in
75 linux-gnueabi |\
76 linux-gnuspe |\
77 linux-musleabi |\
78 linux-muslspe |\
79 linux-musl )
80 os=linux
81 ;;
82 *)
83 ;;
84 esac
85 target="$os-${HOST_ARCH}"
86 case $target in
87 linux-arc | linux-microblaze*)
88 target=linux-latomic
89 ;;
90 linux-arm*)
91 target=linux-armv4
92 ;;
93 linux-aarch64*)
94 target=linux-aarch64
95 ;;
96 linux-i?86 | linux-viac3)
97 target=linux-x86
98 ;;
99 linux-gnux32-x86_64 | linux-muslx32-x86_64 )
100 target=linux-x32
101 ;;
102 linux-gnu64-x86_64)
103 target=linux-x86_64
104 ;;
105 linux-loongarch64)
106 target=linux64-loongarch64
107 ;;
108 linux-mips | linux-mipsel)
109 # specifying TARGET_CC_ARCH prevents openssl from (incorrectly) adding target architecture flags
110 target="linux-mips32 ${TARGET_CC_ARCH}"
111 ;;
112 linux-gnun32-mips*)
113 target=linux-mips64
114 ;;
115 linux-*-mips64 | linux-mips64 | linux-*-mips64el | linux-mips64el)
116 target=linux64-mips64
117 ;;
118 linux-nios2* | linux-sh3 | linux-sh4 | linux-arc*)
119 target=linux-generic32
120 ;;
121 linux-powerpc)
122 target=linux-ppc
123 ;;
124 linux-powerpc64)
125 target=linux-ppc64
126 ;;
127 linux-powerpc64le)
128 target=linux-ppc64le
129 ;;
130 linux-riscv32)
131 target=linux32-riscv32
132 ;;
133 linux-riscv64)
134 target=linux64-riscv64
135 ;;
136 linux-sparc | linux-supersparc)
137 target=linux-sparcv9
138 ;;
139 mingw32-x86_64)
140 target=mingw64
141 ;;
142 esac
143
144 # WARNING: do not set compiler/linker flags (-I/-D etc.) in EXTRA_OECONF, as they will fully replace the
145 # environment variables set by bitbake. Adjust the environment variables instead.
146 PERLEXTERNAL="$(realpath ${S}/external/perl/Text-Template-*/lib)"
147 test -d "$PERLEXTERNAL" || bberror "PERLEXTERNAL '$PERLEXTERNAL' not found!"
148 HASHBANGPERL="/usr/bin/env perl" PERL=perl PERL5LIB="$PERLEXTERNAL" \
149 perl ${S}/Configure ${EXTRA_OECONF} ${PACKAGECONFIG_CONFARGS} ${DEPRECATED_CRYPTO_FLAGS} --prefix=${prefix} --openssldir=${libdir}/ssl-3 --libdir=${baselib} $target
150 perl ${B}/configdata.pm --dump
151}
152
153do_compile:append () {
154 # The test suite binaries are large and we don't need the debugging in them
155 if test -d ${B}/test; then
156 find ${B}/test -type f -executable -exec ${STRIP} {} \;
157 fi
158}
159
160do_install () {
161 oe_runmake DESTDIR="${D}" MANDIR="${mandir}" MANSUFFIX=ssl install_sw install_ssldirs \
162 ${@bb.utils.contains('PACKAGECONFIG', 'manpages', 'install_docs', '', d)} \
163 ${@bb.utils.contains('PACKAGECONFIG', 'fips', 'install_fips', '', d)}
164
165 oe_multilib_header openssl/opensslconf.h
166 oe_multilib_header openssl/configuration.h
167
168 # Create SSL structure for packages such as ca-certificates which
169 # contain hard-coded paths to /etc/ssl. Debian does the same.
170 install -d ${D}${sysconfdir}/ssl
171 mv ${D}${libdir}/ssl-3/certs \
172 ${D}${libdir}/ssl-3/private \
173 ${D}${libdir}/ssl-3/openssl.cnf \
174 ${D}${sysconfdir}/ssl/
175
176 # Although absolute symlinks would be OK for the target, they become
177 # invalid if native or nativesdk are relocated from sstate.
178 ln -sf ${@oe.path.relative('${libdir}/ssl-3', '${sysconfdir}/ssl/certs')} ${D}${libdir}/ssl-3/certs
179 ln -sf ${@oe.path.relative('${libdir}/ssl-3', '${sysconfdir}/ssl/private')} ${D}${libdir}/ssl-3/private
180 ln -sf ${@oe.path.relative('${libdir}/ssl-3', '${sysconfdir}/ssl/openssl.cnf')} ${D}${libdir}/ssl-3/openssl.cnf
181
182 # Generate fipsmodule.cnf in pkg_postinst_ontarget
183 if ${@bb.utils.contains('PACKAGECONFIG', 'fips', 'true', 'false', d)}; then
184 rm -f ${D}${libdir}/ssl-3/fipsmodule.cnf
185 fi
186}
187
188do_install:append:class-native () {
189 create_wrapper ${D}${bindir}/openssl \
190 OPENSSL_CONF=\${OPENSSL_CONF:-${libdir}/ssl-3/openssl.cnf} \
191 SSL_CERT_DIR=\${SSL_CERT_DIR:-${libdir}/ssl-3/certs} \
192 SSL_CERT_FILE=\${SSL_CERT_FILE:-${libdir}/ssl-3/cert.pem} \
193 OPENSSL_ENGINES=\${OPENSSL_ENGINES:-${libdir}/engines-3} \
194 OPENSSL_MODULES=\${OPENSSL_MODULES:-${libdir}/ossl-modules}
195}
196
197do_install:append:class-nativesdk () {
198 mkdir -p ${D}${SDKPATHNATIVE}/environment-setup.d
199 install -m 644 ${UNPACKDIR}/environment.d-openssl.sh ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh
200}
201
202PTEST_BUILD_HOST_FILES += "configdata.pm"
203PTEST_BUILD_HOST_PATTERN = "perl_version ="
204do_install_ptest() {
205 install -m644 ${S}/Configure ${B}/configdata.pm ${D}${PTEST_PATH}
206 cp -rf ${S}/Configurations ${S}/external ${D}${PTEST_PATH}/
207
208 install -d ${D}${PTEST_PATH}/apps
209 ln -s ${bindir}/openssl ${D}${PTEST_PATH}/apps
210
211 cd ${S}
212 find test/certs test/ct test/d2i-tests test/recipes test/ocsp-tests test/ssl-tests test/smime-certs -type f -exec install -m644 -D {} ${D}${PTEST_PATH}/{} \;
213 find apps test -name \*.cnf -exec install -m644 -D {} ${D}${PTEST_PATH}/{} \;
214 find apps test -name \*.der -exec install -m644 -D {} ${D}${PTEST_PATH}/{} \;
215 find apps test -name \*.pem -exec install -m644 -D {} ${D}${PTEST_PATH}/{} \;
216 find util -name \*.p[lm] -exec install -m644 -D {} ${D}${PTEST_PATH}/{} \;
217
218 cd ${B}
219 # Everything but .? (.o and .d)
220 find test -type f -name \*[^.]? -exec install -m755 -D {} ${D}${PTEST_PATH}/{} \;
221 find apps test -name \*.cnf -exec install -m644 -D {} ${D}${PTEST_PATH}/{} \;
222 find apps test -name \*.pem -exec install -m644 -D {} ${D}${PTEST_PATH}/{} \;
223 find apps test -name \*.srl -exec install -m644 -D {} ${D}${PTEST_PATH}/{} \;
224 install -m755 ${B}/util/*wrap.* ${D}${PTEST_PATH}/util/
225
226 install -m755 ${B}/apps/CA.pl ${D}${PTEST_PATH}/apps/
227 install -m755 ${S}/test/*.pl ${D}${PTEST_PATH}/test/
228 install -m755 ${S}/test/shibboleth.pfx ${D}${PTEST_PATH}/test/
229 install -m755 ${S}/test/*.bin ${D}${PTEST_PATH}/test/
230 install -m755 ${S}/test/dane*.in ${D}${PTEST_PATH}/test/
231 install -m755 ${S}/test/smcont*.txt ${D}${PTEST_PATH}/test/
232 install -m755 ${S}/test/ssl_test.tmpl ${D}${PTEST_PATH}/test/
233
234 sed 's|${S}|${PTEST_PATH}|g' -i ${D}${PTEST_PATH}/configdata.pm ${D}${PTEST_PATH}/util/wrap.pl
235
236 install -d ${D}${PTEST_PATH}/engines
237 install -m755 ${B}/engines/dasync.so ${D}${PTEST_PATH}/engines/
238 install -m755 ${B}/engines/ossltest.so ${D}${PTEST_PATH}/engines/
239 ln -s ${libdir}/engines-3/loader_attic.so ${D}${PTEST_PATH}/engines/
240 ln -s ${libdir}/ossl-modules/ ${D}${PTEST_PATH}/providers
241}
242
243pkg_postinst_ontarget:${PN}-ossl-module-fips () {
244 if test -f ${libdir}/ossl-modules/fips.so; then
245 ${bindir}/openssl fipsinstall -out ${libdir}/ssl-3/fipsmodule.cnf -module ${libdir}/ossl-modules/fips.so
246 fi
247}
248
249# Add the openssl.cnf file to the openssl-conf package. Make the libcrypto
250# package RRECOMMENDS on this package. This will enable the configuration
251# file to be installed for both the openssl-bin package and the libcrypto
252# package since the openssl-bin package depends on the libcrypto package.
253
254PACKAGES =+ "libcrypto libssl openssl-conf ${PN}-engines ${PN}-misc ${PN}-ossl-module-legacy ${PN}-ossl-module-fips"
255
256FILES:libcrypto = "${libdir}/libcrypto${SOLIBS}"
257FILES:libssl = "${libdir}/libssl${SOLIBS}"
258FILES:openssl-conf = "${sysconfdir}/ssl/openssl.cnf \
259 ${libdir}/ssl-3/openssl.cnf* \
260 "
261FILES:${PN}-engines = "${libdir}/engines-3"
262# ${prefix} comes from what we pass into --prefix at configure time (which is used for INSTALLTOP)
263FILES:${PN}-engines:append:mingw32:class-nativesdk = " ${prefix}${libdir}/engines-3"
264FILES:${PN}-misc = "${libdir}/ssl-3/misc ${bindir}/c_rehash"
265FILES:${PN}-ossl-module-legacy = "${libdir}/ossl-modules/legacy.so"
266FILES:${PN}-ossl-module-fips = "${libdir}/ossl-modules/fips.so"
267FILES:${PN} =+ "${libdir}/ssl-3/* ${libdir}/ossl-modules/"
268FILES:${PN}:append:class-nativesdk = " ${SDKPATHNATIVE}/environment-setup.d/openssl.sh"
269
270CONFFILES:openssl-conf = "${sysconfdir}/ssl/openssl.cnf"
271
272RRECOMMENDS:libcrypto += "openssl-conf ${PN}-ossl-module-legacy"
273RDEPENDS:${PN}-misc = "perl"
274RDEPENDS:${PN}-ptest += "openssl-bin perl perl-modules bash sed openssl-engines openssl-ossl-module-legacy"
275
276RDEPENDS:${PN}-bin += "openssl-conf"
277
278# The test suite is installed stripped
279INSANE_SKIP:${PN} = "already-stripped"
280
281BBCLASSEXTEND = "native nativesdk"
282
283CVE_PRODUCT = "openssl:openssl"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-06 09:48:05 +0000