summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/openssl
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-connectivity/openssl')
-rw-r--r--meta/recipes-connectivity/openssl/files/environment.d-openssl.sh25
-rw-r--r--meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch367
-rw-r--r--meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch39
-rw-r--r--meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch34
-rw-r--r--meta/recipes-connectivity/openssl/openssl/0001-skip-test_symbol_presence.patch46
-rw-r--r--meta/recipes-connectivity/openssl/openssl/afalg.patch31
-rw-r--r--meta/recipes-connectivity/openssl/openssl/reproducible.patch32
-rw-r--r--meta/recipes-connectivity/openssl/openssl/run-ptest19
-rw-r--r--meta/recipes-connectivity/openssl/openssl_1.1.1i.bb235
-rw-r--r--meta/recipes-connectivity/openssl/openssl_3.5.0.bb283
10 files changed, 746 insertions, 365 deletions
diff --git a/meta/recipes-connectivity/openssl/files/environment.d-openssl.sh b/meta/recipes-connectivity/openssl/files/environment.d-openssl.sh
index b9cc24a7ac..71d378734c 100644
--- a/meta/recipes-connectivity/openssl/files/environment.d-openssl.sh
+++ b/meta/recipes-connectivity/openssl/files/environment.d-openssl.sh
@@ -1 +1,24 @@
1export OPENSSL_CONF="$OECORE_NATIVE_SYSROOT/usr/lib/ssl/openssl.cnf" 1export OPENSSL_CONF="$OECORE_NATIVE_SYSROOT/usr/lib/ssl-3/openssl.cnf"
2export OPENSSL_MODULES="$OECORE_NATIVE_SYSROOT/usr/lib/ossl-modules/"
3export OPENSSL_ENGINES="$OECORE_NATIVE_SYSROOT/usr/lib/engines-3"
4export BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS:-} OPENSSL_CONF OPENSSL_MODULES OPENSSL_ENGINES"
5
6# Respect host env SSL_CERT_FILE/SSL_CERT_DIR first, then auto-detected host cert, then cert in buildtools
7# CAFILE/CAPATH is auto-deteced when source buildtools
8if [ -z "$SSL_CERT_FILE" ]; then
9 if [ -n "$CAFILE" ];then
10 export SSL_CERT_FILE="$CAFILE"
11 elif [ -e "${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/ca-certificates.crt" ];then
12 export SSL_CERT_FILE="$OECORE_NATIVE_SYSROOT/usr/lib/ssl-3/certs/ca-certificates.crt"
13 fi
14fi
15
16if [ -z "$SSL_CERT_DIR" ]; then
17 if [ -n "$CAPATH" ];then
18 export SSL_CERT_DIR="$CAPATH"
19 elif [ -e "${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/ca-certificates.crt" ];then
20 export SSL_CERT_DIR="$OECORE_NATIVE_SYSROOT/usr/lib/ssl-3/certs"
21 fi
22fi
23
24export BB_ENV_PASSTHROUGH_ADDITIONS="${BB_ENV_PASSTHROUGH_ADDITIONS:-} SSL_CERT_DIR SSL_CERT_FILE"
diff --git a/meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch b/meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch
new file mode 100644
index 0000000000..5b7365a353
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/0001-Added-handshake-history-reporting-when-test-fails.patch
@@ -0,0 +1,367 @@
1From 5ba65051fea0513db0d997f0ab7cafb9826ed74a Mon Sep 17 00:00:00 2001
2From: William Lyu <William.Lyu@windriver.com>
3Date: Fri, 20 Oct 2023 16:22:37 -0400
4Subject: [PATCH] Added handshake history reporting when test fails
5
6Upstream-Status: Submitted [https://github.com/openssl/openssl/pull/22481]
7
8Signed-off-by: William Lyu <William.Lyu@windriver.com>
9---
10 test/helpers/handshake.c | 137 +++++++++++++++++++++++++++++----------
11 test/helpers/handshake.h | 70 +++++++++++++++++++-
12 test/ssl_test.c | 44 +++++++++++++
13 3 files changed, 217 insertions(+), 34 deletions(-)
14
15diff --git a/test/helpers/handshake.c b/test/helpers/handshake.c
16index f611b3a..5703b48 100644
17--- a/test/helpers/handshake.c
18+++ b/test/helpers/handshake.c
19@@ -25,6 +25,102 @@
20 #include <netinet/sctp.h>
21 #endif
22
23+/* Shamelessly copied from test/helpers/ssl_test_ctx.c */
24+/* Maps string names to various enumeration type */
25+typedef struct {
26+ const char *name;
27+ int value;
28+} enum_name_map;
29+
30+static const enum_name_map connect_phase_names[] = {
31+ {"Handshake", HANDSHAKE},
32+ {"RenegAppData", RENEG_APPLICATION_DATA},
33+ {"RenegSetup", RENEG_SETUP},
34+ {"RenegHandshake", RENEG_HANDSHAKE},
35+ {"AppData", APPLICATION_DATA},
36+ {"Shutdown", SHUTDOWN},
37+ {"ConnectionDone", CONNECTION_DONE}
38+};
39+
40+static const enum_name_map peer_status_names[] = {
41+ {"PeerSuccess", PEER_SUCCESS},
42+ {"PeerRetry", PEER_RETRY},
43+ {"PeerError", PEER_ERROR},
44+ {"PeerWaiting", PEER_WAITING},
45+ {"PeerTestFail", PEER_TEST_FAILURE}
46+};
47+
48+static const enum_name_map handshake_status_names[] = {
49+ {"HandshakeSuccess", HANDSHAKE_SUCCESS},
50+ {"ClientError", CLIENT_ERROR},
51+ {"ServerError", SERVER_ERROR},
52+ {"InternalError", INTERNAL_ERROR},
53+ {"HandshakeRetry", HANDSHAKE_RETRY}
54+};
55+
56+/* Shamelessly copied from test/helpers/ssl_test_ctx.c */
57+static const char *enum_name(const enum_name_map *enums, size_t num_enums,
58+ int value)
59+{
60+ size_t i;
61+ for (i = 0; i < num_enums; i++) {
62+ if (enums[i].value == value) {
63+ return enums[i].name;
64+ }
65+ }
66+ return "InvalidValue";
67+}
68+
69+const char *handshake_connect_phase_name(connect_phase_t phase)
70+{
71+ return enum_name(connect_phase_names, OSSL_NELEM(connect_phase_names),
72+ (int)phase);
73+}
74+
75+const char *handshake_status_name(handshake_status_t handshake_status)
76+{
77+ return enum_name(handshake_status_names, OSSL_NELEM(handshake_status_names),
78+ (int)handshake_status);
79+}
80+
81+const char *handshake_peer_status_name(peer_status_t peer_status)
82+{
83+ return enum_name(peer_status_names, OSSL_NELEM(peer_status_names),
84+ (int)peer_status);
85+}
86+
87+static void save_loop_history(HANDSHAKE_HISTORY *history,
88+ connect_phase_t phase,
89+ handshake_status_t handshake_status,
90+ peer_status_t server_status,
91+ peer_status_t client_status,
92+ int client_turn_count,
93+ int is_client_turn)
94+{
95+ HANDSHAKE_HISTORY_ENTRY *new_entry = NULL;
96+
97+ /*
98+ * Create a new history entry for a handshake loop with statuses given in
99+ * the arguments. Potentially evicting the oldest entry when the
100+ * ring buffer is full.
101+ */
102+ ++(history->last_idx);
103+ history->last_idx &= MAX_HANDSHAKE_HISTORY_ENTRY_IDX_MASK;
104+
105+ new_entry = &((history->entries)[history->last_idx]);
106+ new_entry->phase = phase;
107+ new_entry->handshake_status = handshake_status;
108+ new_entry->server_status = server_status;
109+ new_entry->client_status = client_status;
110+ new_entry->client_turn_count = client_turn_count;
111+ new_entry->is_client_turn = is_client_turn;
112+
113+ /* Evict the oldest handshake loop entry when the ring buffer is full. */
114+ if (history->entry_count < MAX_HANDSHAKE_HISTORY_ENTRY) {
115+ ++(history->entry_count);
116+ }
117+}
118+
119 HANDSHAKE_RESULT *HANDSHAKE_RESULT_new(void)
120 {
121 HANDSHAKE_RESULT *ret;
122@@ -726,15 +822,6 @@ static void configure_handshake_ssl(SSL *server, SSL *client,
123 SSL_set_post_handshake_auth(client, 1);
124 }
125
126-/* The status for each connection phase. */
127-typedef enum {
128- PEER_SUCCESS,
129- PEER_RETRY,
130- PEER_ERROR,
131- PEER_WAITING,
132- PEER_TEST_FAILURE
133-} peer_status_t;
134-
135 /* An SSL object and associated read-write buffers. */
136 typedef struct peer_st {
137 SSL *ssl;
138@@ -1081,17 +1168,6 @@ static void do_shutdown_step(PEER *peer)
139 }
140 }
141
142-typedef enum {
143- HANDSHAKE,
144- RENEG_APPLICATION_DATA,
145- RENEG_SETUP,
146- RENEG_HANDSHAKE,
147- APPLICATION_DATA,
148- SHUTDOWN,
149- CONNECTION_DONE
150-} connect_phase_t;
151-
152-
153 static int renegotiate_op(const SSL_TEST_CTX *test_ctx)
154 {
155 switch (test_ctx->handshake_mode) {
156@@ -1169,19 +1245,6 @@ static void do_connect_step(const SSL_TEST_CTX *test_ctx, PEER *peer,
157 }
158 }
159
160-typedef enum {
161- /* Both parties succeeded. */
162- HANDSHAKE_SUCCESS,
163- /* Client errored. */
164- CLIENT_ERROR,
165- /* Server errored. */
166- SERVER_ERROR,
167- /* Peers are in inconsistent state. */
168- INTERNAL_ERROR,
169- /* One or both peers not done. */
170- HANDSHAKE_RETRY
171-} handshake_status_t;
172-
173 /*
174 * Determine the handshake outcome.
175 * last_status: the status of the peer to have acted last.
176@@ -1546,6 +1609,10 @@ static HANDSHAKE_RESULT *do_handshake_internal(
177
178 start = time(NULL);
179
180+ save_loop_history(&(ret->history),
181+ phase, status, server.status, client.status,
182+ client_turn_count, client_turn);
183+
184 /*
185 * Half-duplex handshake loop.
186 * Client and server speak to each other synchronously in the same process.
187@@ -1567,6 +1634,10 @@ static HANDSHAKE_RESULT *do_handshake_internal(
188 0 /* server went last */);
189 }
190
191+ save_loop_history(&(ret->history),
192+ phase, status, server.status, client.status,
193+ client_turn_count, client_turn);
194+
195 switch (status) {
196 case HANDSHAKE_SUCCESS:
197 client_turn_count = 0;
198diff --git a/test/helpers/handshake.h b/test/helpers/handshake.h
199index 78b03f9..b9967c2 100644
200--- a/test/helpers/handshake.h
201+++ b/test/helpers/handshake.h
202@@ -1,5 +1,5 @@
203 /*
204- * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
205+ * Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.
206 *
207 * Licensed under the Apache License 2.0 (the "License"). You may not use
208 * this file except in compliance with the License. You can obtain a copy
209@@ -12,6 +12,11 @@
210
211 #include "ssl_test_ctx.h"
212
213+#define MAX_HANDSHAKE_HISTORY_ENTRY_BIT 4
214+#define MAX_HANDSHAKE_HISTORY_ENTRY (1 << MAX_HANDSHAKE_HISTORY_ENTRY_BIT)
215+#define MAX_HANDSHAKE_HISTORY_ENTRY_IDX_MASK \
216+ ((1 << MAX_HANDSHAKE_HISTORY_ENTRY_BIT) - 1)
217+
218 typedef struct ctx_data_st {
219 unsigned char *npn_protocols;
220 size_t npn_protocols_len;
221@@ -22,6 +27,63 @@ typedef struct ctx_data_st {
222 char *session_ticket_app_data;
223 } CTX_DATA;
224
225+typedef enum {
226+ HANDSHAKE,
227+ RENEG_APPLICATION_DATA,
228+ RENEG_SETUP,
229+ RENEG_HANDSHAKE,
230+ APPLICATION_DATA,
231+ SHUTDOWN,
232+ CONNECTION_DONE
233+} connect_phase_t;
234+
235+/* The status for each connection phase. */
236+typedef enum {
237+ PEER_SUCCESS,
238+ PEER_RETRY,
239+ PEER_ERROR,
240+ PEER_WAITING,
241+ PEER_TEST_FAILURE
242+} peer_status_t;
243+
244+typedef enum {
245+ /* Both parties succeeded. */
246+ HANDSHAKE_SUCCESS,
247+ /* Client errored. */
248+ CLIENT_ERROR,
249+ /* Server errored. */
250+ SERVER_ERROR,
251+ /* Peers are in inconsistent state. */
252+ INTERNAL_ERROR,
253+ /* One or both peers not done. */
254+ HANDSHAKE_RETRY
255+} handshake_status_t;
256+
257+/* Stores the various status information in a handshake loop. */
258+typedef struct handshake_history_entry_st {
259+ connect_phase_t phase;
260+ handshake_status_t handshake_status;
261+ peer_status_t server_status;
262+ peer_status_t client_status;
263+ int client_turn_count;
264+ int is_client_turn;
265+} HANDSHAKE_HISTORY_ENTRY;
266+
267+typedef struct handshake_history_st {
268+ /* Implemented using ring buffer. */
269+ /*
270+ * The valid entries are |entries[last_idx]|, |entries[last_idx-1]|,
271+ * ..., etc., going up to |entry_count| number of entries. Note that when
272+ * the index into the array |entries| becomes < 0, we wrap around to
273+ * the end of |entries|.
274+ */
275+ HANDSHAKE_HISTORY_ENTRY entries[MAX_HANDSHAKE_HISTORY_ENTRY];
276+ /* The number of valid entries in |entries| array. */
277+ size_t entry_count;
278+ /* The index of the last valid entry in the |entries| array. */
279+ size_t last_idx;
280+} HANDSHAKE_HISTORY;
281+
282 typedef struct handshake_result {
283 ssl_test_result_t result;
284 /* These alerts are in the 2-byte format returned by the info_callback. */
285@@ -77,6 +139,8 @@ typedef struct handshake_result {
286 char *cipher;
287 /* session ticket application data */
288 char *result_session_ticket_app_data;
289+ /* handshake loop history */
290+ HANDSHAKE_HISTORY history;
291 } HANDSHAKE_RESULT;
292
293 HANDSHAKE_RESULT *HANDSHAKE_RESULT_new(void);
294@@ -95,4 +159,8 @@ int configure_handshake_ctx_for_srp(SSL_CTX *server_ctx, SSL_CTX *server2_ctx,
295 CTX_DATA *server2_ctx_data,
296 CTX_DATA *client_ctx_data);
297
298+const char *handshake_connect_phase_name(connect_phase_t phase);
299+const char *handshake_status_name(handshake_status_t handshake_status);
300+const char *handshake_peer_status_name(peer_status_t peer_status);
301+
302 #endif /* OSSL_TEST_HANDSHAKE_HELPER_H */
303diff --git a/test/ssl_test.c b/test/ssl_test.c
304index ea60851..9d6b093 100644
305--- a/test/ssl_test.c
306+++ b/test/ssl_test.c
307@@ -26,6 +26,44 @@ static OSSL_LIB_CTX *libctx = NULL;
308 /* Currently the section names are of the form test-<number>, e.g. test-15. */
309 #define MAX_TESTCASE_NAME_LENGTH 100
310
311+static void print_handshake_history(const HANDSHAKE_HISTORY *history)
312+{
313+ size_t first_idx;
314+ size_t i;
315+ size_t cur_idx;
316+ const HANDSHAKE_HISTORY_ENTRY *cur_entry;
317+ const char header_template[] = "|%14s|%16s|%16s|%16s|%17s|%14s|";
318+ const char body_template[] = "|%14s|%16s|%16s|%16s|%17d|%14s|";
319+
320+ TEST_info("The following is the server/client state "
321+ "in the most recent %d handshake loops.",
322+ MAX_HANDSHAKE_HISTORY_ENTRY);
323+
324+ TEST_note("=================================================="
325+ "==================================================");
326+ TEST_note(header_template,
327+ "phase", "handshake status", "server status",
328+ "client status", "client turn count", "is client turn");
329+ TEST_note("+--------------+----------------+----------------"
330+ "+----------------+-----------------+--------------+");
331+
332+ first_idx = (history->last_idx - history->entry_count + 1) &
333+ MAX_HANDSHAKE_HISTORY_ENTRY_IDX_MASK;
334+ for (i = 0; i < history->entry_count; ++i) {
335+ cur_idx = (first_idx + i) & MAX_HANDSHAKE_HISTORY_ENTRY_IDX_MASK;
336+ cur_entry = &(history->entries)[cur_idx];
337+ TEST_note(body_template,
338+ handshake_connect_phase_name(cur_entry->phase),
339+ handshake_status_name(cur_entry->handshake_status),
340+ handshake_peer_status_name(cur_entry->server_status),
341+ handshake_peer_status_name(cur_entry->client_status),
342+ cur_entry->client_turn_count,
343+ cur_entry->is_client_turn ? "true" : "false");
344+ }
345+ TEST_note("=================================================="
346+ "==================================================");
347+}
348+
349 static const char *print_alert(int alert)
350 {
351 return alert ? SSL_alert_desc_string_long(alert) : "no alert";
352@@ -388,6 +426,12 @@ static int check_test(HANDSHAKE_RESULT *result, SSL_TEST_CTX *test_ctx)
353 ret &= check_client_sign_type(result, test_ctx);
354 ret &= check_client_ca_names(result, test_ctx);
355 }
356+
357+ /* Print handshake loop history if any check fails. */
358+ if (!ret) {
359+ print_handshake_history(&(result->history));
360+ }
361+
362 return ret;
363 }
364
365--
3662.25.1
367
diff --git a/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch b/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch
new file mode 100644
index 0000000000..7043188973
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/0001-Configure-do-not-tweak-mips-cflags.patch
@@ -0,0 +1,39 @@
1From 0377f0d5b5c1079e3b9a80881f4dcc891cbe9f9a Mon Sep 17 00:00:00 2001
2From: Alexander Kanavin <alex@linutronix.de>
3Date: Tue, 30 May 2023 09:11:27 -0700
4Subject: [PATCH] Configure: do not tweak mips cflags
5
6This conflicts with mips machine definitons from yocto,
7e.g.
8| Error: -mips3 conflicts with the other architecture options, which imply -mips64r2
9
10Upstream-Status: Inappropriate [oe-core specific]
11Signed-off-by: Alexander Kanavin <alex@linutronix.de>
12
13Refreshed for openssl-3.1.1
14Signed-off-by: Tim Orling <tim.orling@konsulko.com>
15---
16 Configure | 10 ----------
17 1 file changed, 10 deletions(-)
18
19diff --git a/Configure b/Configure
20index fff97bd..5ee54c1 100755
21--- a/Configure
22+++ b/Configure
23@@ -1551,16 +1551,6 @@ if ($target =~ /^mingw/ && `$config{CC} --target-help 2>&1` =~ m/-mno-cygwin/m)
24 push @{$config{shared_ldflag}}, "-mno-cygwin";
25 }
26
27-if ($target =~ /linux.*-mips/ && !$disabled{asm}
28- && !grep { $_ =~ /-m(ips|arch=)/ } (@{$config{CFLAGS}})) {
29- # minimally required architecture flags for assembly modules
30- my $value;
31- $value = '-mips2' if ($target =~ /mips32/);
32- $value = '-mips3' if ($target =~ /mips64/);
33- unshift @{$config{cflags}}, $value;
34- unshift @{$config{cxxflags}}, $value if $config{CXX};
35-}
36-
37 # If threads aren't disabled, check how possible they are
38 unless ($disabled{threads}) {
39 if ($auto_threads) {
diff --git a/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch b/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch
index 949c788344..687d682976 100644
--- a/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch
+++ b/meta/recipes-connectivity/openssl/openssl/0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch
@@ -1,4 +1,4 @@
1From 3e1d00481093e10775eaf69d619c45b32a4aa7dc Mon Sep 17 00:00:00 2001 1From 5985253f2c9025d7c127443a3a9938946f80c2a1 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Martin=20Hundeb=C3=B8ll?= <martin@geanix.com> 2From: =?UTF-8?q?Martin=20Hundeb=C3=B8ll?= <martin@geanix.com>
3Date: Tue, 6 Nov 2018 14:50:47 +0100 3Date: Tue, 6 Nov 2018 14:50:47 +0100
4Subject: [PATCH] buildinfo: strip sysroot and debug-prefix-map from compiler 4Subject: [PATCH] buildinfo: strip sysroot and debug-prefix-map from compiler
@@ -21,34 +21,43 @@ https://patchwork.openembedded.org/patch/147229/
21Upstream-Status: Inappropriate [OE specific] 21Upstream-Status: Inappropriate [OE specific]
22Signed-off-by: Martin Hundebøll <martin@geanix.com> 22Signed-off-by: Martin Hundebøll <martin@geanix.com>
23 23
24
25Update to fix buildpaths qa issue for '-fmacro-prefix-map'. 24Update to fix buildpaths qa issue for '-fmacro-prefix-map'.
26 25
27Signed-off-by: Kai Kang <kai.kang@windriver.com> 26Signed-off-by: Kai Kang <kai.kang@windriver.com>
27
28Update to fix buildpaths qa issue for '-ffile-prefix-map'.
29
30Signed-off-by: Khem Raj <raj.khem@gmail.com>
31
28--- 32---
29 Configurations/unix-Makefile.tmpl | 10 +++++++++- 33 Configurations/unix-Makefile.tmpl | 16 +++++++++++++++-
30 crypto/build.info | 2 +- 34 crypto/build.info | 2 +-
31 2 files changed, 10 insertions(+), 2 deletions(-) 35 2 files changed, 16 insertions(+), 2 deletions(-)
32 36
33diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl 37diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
34index 16af4d2087..54c162784c 100644 38index 09303c4..011bda1 100644
35--- a/Configurations/unix-Makefile.tmpl 39--- a/Configurations/unix-Makefile.tmpl
36+++ b/Configurations/unix-Makefile.tmpl 40+++ b/Configurations/unix-Makefile.tmpl
37@@ -317,13 +317,22 @@ BIN_LDFLAGS={- join(' ', $target{bin_lflags} || (), 41@@ -502,13 +502,27 @@ BIN_LDFLAGS={- join(' ', $target{bin_lflags} || (),
38 '$(CNF_LDFLAGS)', '$(LDFLAGS)') -} 42 '$(CNF_LDFLAGS)', '$(LDFLAGS)') -}
39 BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS) 43 BIN_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS)
40 44
41-# CPPFLAGS_Q is used for one thing only: to build up buildinf.h 45-# CPPFLAGS_Q is used for one thing only: to build up buildinf.h
42+# *_Q variables are used for one thing only: to build up buildinf.h 46+# *_Q variables are used for one thing only: to build up buildinf.h
43 CPPFLAGS_Q={- $cppflags1 =~ s|([\\"])|\\$1|g; 47 CPPFLAGS_Q={- $cppflags1 =~ s|([\\"])|\\$1|g;
48+ $cppflags1 =~ s|-isystem/[^ ]+/usr/include||g;
44 $cppflags2 =~ s|([\\"])|\\$1|g; 49 $cppflags2 =~ s|([\\"])|\\$1|g;
50+ $cppflags2 =~ s|-isystem/[^ ]+/usr/include||g;
45 $lib_cppflags =~ s|([\\"])|\\$1|g; 51 $lib_cppflags =~ s|([\\"])|\\$1|g;
52+ $lib_cppflags =~ s|-isystem/[^ ]+/usr/include||g;
46 join(' ', $lib_cppflags || (), $cppflags2 || (), 53 join(' ', $lib_cppflags || (), $cppflags2 || (),
47 $cppflags1 || ()) -} 54 $cppflags1 || ()) -}
48 55
49+CFLAGS_Q={- for (@{$config{CFLAGS}}) { 56+CFLAGS_Q={- for (@{$config{CFLAGS}}) {
50+ s|-fdebug-prefix-map=[^ ]+|-fdebug-prefix-map=|g; 57+ s|-fdebug-prefix-map=[^ ]+|-fdebug-prefix-map=|g;
51+ s|-fmacro-prefix-map=[^ ]+|-fmacro-prefix-map=|g; 58+ s|-fmacro-prefix-map=[^ ]+|-fmacro-prefix-map=|g;
59+ s|-ffile-prefix-map=[^ ]+|-ffile-prefix-map=|g;
60+ s|-isystem/[^ ]+/usr/include ||g;
52+ } 61+ }
53+ join(' ', @{$config{CFLAGS}}) -} 62+ join(' ', @{$config{CFLAGS}}) -}
54+ 63+
@@ -59,18 +68,15 @@ index 16af4d2087..54c162784c 100644
59 68
60 # For x86 assembler: Set PROCESSOR to 386 if you want to support 69 # For x86 assembler: Set PROCESSOR to 386 if you want to support
61diff --git a/crypto/build.info b/crypto/build.info 70diff --git a/crypto/build.info b/crypto/build.info
62index b515b7318e..8c9cee2a09 100644 71index aee5c46..95c9577 100644
63--- a/crypto/build.info 72--- a/crypto/build.info
64+++ b/crypto/build.info 73+++ b/crypto/build.info
65@@ -10,7 +10,7 @@ EXTRA= ../ms/uplink-x86.pl ../ms/uplink.c ../ms/applink.c \ 74@@ -115,7 +115,7 @@ DEFINE[../libcrypto]=$UPLINKDEF
66 ppccpuid.pl pariscid.pl alphacpuid.pl arm64cpuid.pl armv4cpuid.pl
67 75
76 DEPEND[info.o]=buildinf.h
68 DEPEND[cversion.o]=buildinf.h 77 DEPEND[cversion.o]=buildinf.h
69-GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(LIB_CFLAGS) $(CPPFLAGS_Q)" "$(PLATFORM)" 78-GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(LIB_CFLAGS) $(CPPFLAGS_Q)" "$(PLATFORM)"
70+GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC_Q) $(CFLAGS_Q) $(CPPFLAGS_Q)" "$(PLATFORM)" 79+GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC_Q) $(CFLAGS_Q) $(CPPFLAGS_Q)" "$(PLATFORM)"
71 DEPEND[buildinf.h]=../configdata.pm
72 80
73 GENERATE[uplink-x86.s]=../ms/uplink-x86.pl $(PERLASM_SCHEME) 81 GENERATE[uplink-x86.S]=../ms/uplink-x86.pl
74-- 82 GENERATE[uplink-x86_64.s]=../ms/uplink-x86_64.pl
752.19.1
76
diff --git a/meta/recipes-connectivity/openssl/openssl/0001-skip-test_symbol_presence.patch b/meta/recipes-connectivity/openssl/openssl/0001-skip-test_symbol_presence.patch
deleted file mode 100644
index d8d9651b64..0000000000
--- a/meta/recipes-connectivity/openssl/openssl/0001-skip-test_symbol_presence.patch
+++ /dev/null
@@ -1,46 +0,0 @@
1From a9401b2289656c5a36dd1b0ecebf0d23e291ce70 Mon Sep 17 00:00:00 2001
2From: Hongxu Jia <hongxu.jia@windriver.com>
3Date: Tue, 2 Oct 2018 23:58:24 +0800
4Subject: [PATCH] skip test_symbol_presence
5
6We cannot skip `01-test_symbol_presence.t' by configuring option `no-shared'
7as INSTALL told us the shared libraries will not be built.
8
9[INSTALL snip]
10 Notes on shared libraries
11 -------------------------
12
13 For most systems the OpenSSL Configure script knows what is needed to
14 build shared libraries for libcrypto and libssl. On these systems
15 the shared libraries will be created by default. This can be suppressed and
16 only static libraries created by using the "no-shared" option. On systems
17 where OpenSSL does not know how to build shared libraries the "no-shared"
18 option will be forced and only static libraries will be created.
19[INSTALL snip]
20
21Hence directly modification the case to skip it.
22
23Upstream-Status: Inappropriate [OE Specific]
24
25Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
26---
27 test/recipes/01-test_symbol_presence.t | 3 +--
28 1 file changed, 1 insertion(+), 2 deletions(-)
29
30diff --git a/test/recipes/01-test_symbol_presence.t b/test/recipes/01-test_symbol_presence.t
31index 7f2a2d7..0b93745 100644
32--- a/test/recipes/01-test_symbol_presence.t
33+++ b/test/recipes/01-test_symbol_presence.t
34@@ -14,8 +14,7 @@ use OpenSSL::Test::Utils;
35
36 setup("test_symbol_presence");
37
38-plan skip_all => "Only useful when building shared libraries"
39- if disabled("shared");
40+plan skip_all => "The case needs debug symbols then we just disable it";
41
42 my @libnames = ("crypto", "ssl");
43 my $testcount = scalar @libnames;
44--
452.7.4
46
diff --git a/meta/recipes-connectivity/openssl/openssl/afalg.patch b/meta/recipes-connectivity/openssl/openssl/afalg.patch
deleted file mode 100644
index b7c0e9697f..0000000000
--- a/meta/recipes-connectivity/openssl/openssl/afalg.patch
+++ /dev/null
@@ -1,31 +0,0 @@
1Don't refuse to build afalgeng if cross-compiling or the host kernel is too old.
2
3Upstream-Status: Submitted [hhttps://github.com/openssl/openssl/pull/7688]
4Signed-off-by: Ross Burton <ross.burton@intel.com>
5
6diff --git a/Configure b/Configure
7index 3baa8ce..9ef52ed 100755
8--- a/Configure
9+++ b/Configure
10@@ -1550,20 +1550,7 @@ unless ($disabled{"crypto-mdebug-backtrace"})
11 unless ($disabled{afalgeng}) {
12 $config{afalgeng}="";
13 if (grep { $_ eq 'afalgeng' } @{$target{enable}}) {
14- my $minver = 4*10000 + 1*100 + 0;
15- if ($config{CROSS_COMPILE} eq "") {
16- my $verstr = `uname -r`;
17- my ($ma, $mi1, $mi2) = split("\\.", $verstr);
18- ($mi2) = $mi2 =~ /(\d+)/;
19- my $ver = $ma*10000 + $mi1*100 + $mi2;
20- if ($ver < $minver) {
21- disable('too-old-kernel', 'afalgeng');
22- } else {
23- push @{$config{engdirs}}, "afalg";
24- }
25- } else {
26- disable('cross-compiling', 'afalgeng');
27- }
28+ push @{$config{engdirs}}, "afalg";
29 } else {
30 disable('not-linux', 'afalgeng');
31 }
diff --git a/meta/recipes-connectivity/openssl/openssl/reproducible.patch b/meta/recipes-connectivity/openssl/openssl/reproducible.patch
deleted file mode 100644
index a24260c95d..0000000000
--- a/meta/recipes-connectivity/openssl/openssl/reproducible.patch
+++ /dev/null
@@ -1,32 +0,0 @@
1The value for perl_archname can vary depending on the host, e.g.
2x86_64-linux-gnu-thread-multi or x86_64-linux-thread-multi which
3makes the ptest package non-reproducible. Its unused other than
4these references so drop it.
5
6RP 2020/2/6
7
8Upstream-Status: Pending
9Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
10
11Index: openssl-1.1.1d/Configure
12===================================================================
13--- openssl-1.1.1d.orig/Configure
14+++ openssl-1.1.1d/Configure
15@@ -286,7 +286,7 @@ if (defined env($local_config_envname))
16 # Save away perl command information
17 $config{perl_cmd} = $^X;
18 $config{perl_version} = $Config{version};
19-$config{perl_archname} = $Config{archname};
20+#$config{perl_archname} = $Config{archname};
21
22 $config{prefix}="";
23 $config{openssldir}="";
24@@ -2517,7 +2517,7 @@ _____
25 @{$config{perlargv}}), "\n";
26 print "\nPerl information:\n\n";
27 print ' ',$config{perl_cmd},"\n";
28- print ' ',$config{perl_version},' for ',$config{perl_archname},"\n";
29+ print ' ',$config{perl_version},"\n";
30 }
31 if ($dump || $options) {
32 my $longest = 0;
diff --git a/meta/recipes-connectivity/openssl/openssl/run-ptest b/meta/recipes-connectivity/openssl/openssl/run-ptest
index 3fb22471f8..cd29bb1446 100644
--- a/meta/recipes-connectivity/openssl/openssl/run-ptest
+++ b/meta/recipes-connectivity/openssl/openssl/run-ptest
@@ -1,12 +1,19 @@
1#!/bin/sh 1#!/bin/sh
2 2
3set -e 3set -eu
4 4
5# Optional arguments are 'list' to lists all tests, or the test name (base name 5# Optional arguments are 'list' to lists the tests, or the test name (base name
6# ie test_evp, not 03_test_evp.t). 6# ie test_evp, not 03_test_evp.t). Without any arguments we run all tests.
7
8if test $# -gt 0; then
9 TESTS=$*
10else
11 # Skip test_symbol_presence as this is for developers
12 TESTS="alltests -test_symbol_presence"
13fi
7 14
8export TOP=. 15export TOP=.
9# OPENSSL_ENGINES is relative from the test binaries 16# Run four jobs in parallel
10export OPENSSL_ENGINES=../engines 17export HARNESS_JOBS=4
11 18
12perl ./test/run_tests.pl $* | perl -0pe 's#(.*) \.*.ok#PASS: \1#g; s#(.*) \.*.skipped: (.*)#SKIP: \1 (\2)#g; s#(.*) \.*.\nDubious#FAIL: \1#;' 19{ perl ./test/run_tests.pl $TESTS || echo "FAIL: openssl" ; } | sed -u -r -e '/(.*) \.*.ok/ s/^/PASS: /g' -r -e '/Dubious(.*)/ s/^/FAIL: /g' -e '/(.*) \.*.skipped: (.*)/ s/^/SKIP: /g'
diff --git a/meta/recipes-connectivity/openssl/openssl_1.1.1i.bb b/meta/recipes-connectivity/openssl/openssl_1.1.1i.bb
deleted file mode 100644
index 52e96b7831..0000000000
--- a/meta/recipes-connectivity/openssl/openssl_1.1.1i.bb
+++ /dev/null
@@ -1,235 +0,0 @@
1SUMMARY = "Secure Socket Layer"
2DESCRIPTION = "Secure Socket Layer (SSL) binary and related cryptographic tools."
3HOMEPAGE = "http://www.openssl.org/"
4BUGTRACKER = "http://www.openssl.org/news/vulnerabilities.html"
5SECTION = "libs/network"
6
7# "openssl" here actually means both OpenSSL and SSLeay licenses apply
8# (see meta/files/common-licenses/OpenSSL to which "openssl" is SPDXLICENSEMAPped)
9LICENSE = "openssl"
10LIC_FILES_CHKSUM = "file://LICENSE;md5=d343e62fc9c833710bbbed25f27364c8"
11
12DEPENDS = "hostperl-runtime-native"
13
14SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \
15 file://run-ptest \
16 file://0001-skip-test_symbol_presence.patch \
17 file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \
18 file://afalg.patch \
19 file://reproducible.patch \
20 "
21
22SRC_URI_append_class-nativesdk = " \
23 file://environment.d-openssl.sh \
24 "
25
26SRC_URI[sha256sum] = "e8be6a35fe41d10603c3cc635e93289ed00bf34b79671a3a4de64fcee00d5242"
27
28inherit lib_package multilib_header multilib_script ptest
29MULTILIB_SCRIPTS = "${PN}-bin:${bindir}/c_rehash"
30
31PACKAGECONFIG ?= ""
32PACKAGECONFIG_class-native = ""
33PACKAGECONFIG_class-nativesdk = ""
34
35PACKAGECONFIG[cryptodev-linux] = "enable-devcryptoeng,disable-devcryptoeng,cryptodev-linux,,cryptodev-module"
36PACKAGECONFIG[no-tls1] = "no-tls1"
37PACKAGECONFIG[no-tls1_1] = "no-tls1_1"
38
39B = "${WORKDIR}/build"
40do_configure[cleandirs] = "${B}"
41
42#| ./libcrypto.so: undefined reference to `getcontext'
43#| ./libcrypto.so: undefined reference to `setcontext'
44#| ./libcrypto.so: undefined reference to `makecontext'
45EXTRA_OECONF_append_libc-musl = " no-async"
46EXTRA_OECONF_append_libc-musl_powerpc64 = " no-asm"
47
48# adding devrandom prevents openssl from using getrandom() which is not available on older glibc versions
49# (native versions can be built with newer glibc, but then relocated onto a system with older glibc)
50EXTRA_OECONF_class-native = "--with-rand-seed=os,devrandom"
51EXTRA_OECONF_class-nativesdk = "--with-rand-seed=os,devrandom"
52
53# Relying on hardcoded built-in paths causes openssl-native to not be relocateable from sstate.
54CFLAGS_append_class-native = " -DOPENSSLDIR=/not/builtin -DENGINESDIR=/not/builtin"
55CFLAGS_append_class-nativesdk = " -DOPENSSLDIR=/not/builtin -DENGINESDIR=/not/builtin"
56
57# Disable deprecated crypto algorithms
58# Retained for compatibilty
59# des (curl)
60# dh (python-ssl)
61# dsa (rpm)
62# md4 (cyrus-sasl freeradius hostapd)
63# bf (wvstreams postgresql x11vnc crda znc cfengine)
64# rc4 (freerdp librtorrent ettercap xrdp transmission pam-ssh-agent-auth php)
65# rc2 (mailx)
66# psk (qt5)
67DEPRECATED_CRYPTO_FLAGS = "no-ssl no-idea no-rc5 no-md2 no-srp no-camellia no-mdc2 no-scrypt no-seed no-siphash no-sm2 no-sm3 no-sm4 no-whirlpool"
68
69do_configure () {
70 os=${HOST_OS}
71 case $os in
72 linux-gnueabi |\
73 linux-gnuspe |\
74 linux-musleabi |\
75 linux-muslspe |\
76 linux-musl )
77 os=linux
78 ;;
79 *)
80 ;;
81 esac
82 target="$os-${HOST_ARCH}"
83 case $target in
84 linux-arm*)
85 target=linux-armv4
86 ;;
87 linux-aarch64*)
88 target=linux-aarch64
89 ;;
90 linux-i?86 | linux-viac3)
91 target=linux-x86
92 ;;
93 linux-gnux32-x86_64 | linux-muslx32-x86_64 )
94 target=linux-x32
95 ;;
96 linux-gnu64-x86_64)
97 target=linux-x86_64
98 ;;
99 linux-mips | linux-mipsel)
100 # specifying TARGET_CC_ARCH prevents openssl from (incorrectly) adding target architecture flags
101 target="linux-mips32 ${TARGET_CC_ARCH}"
102 ;;
103 linux-gnun32-mips*)
104 target=linux-mips64
105 ;;
106 linux-*-mips64 | linux-mips64 | linux-*-mips64el | linux-mips64el)
107 target=linux64-mips64
108 ;;
109 linux-microblaze* | linux-nios2* | linux-sh3 | linux-sh4 | linux-arc*)
110 target=linux-generic32
111 ;;
112 linux-powerpc)
113 target=linux-ppc
114 ;;
115 linux-powerpc64)
116 target=linux-ppc64
117 ;;
118 linux-powerpc64le)
119 target=linux-ppc64le
120 ;;
121 linux-riscv32)
122 target=linux-generic32
123 ;;
124 linux-riscv64)
125 target=linux-generic64
126 ;;
127 linux-sparc | linux-supersparc)
128 target=linux-sparcv9
129 ;;
130 mingw32-x86_64)
131 target=mingw64
132 ;;
133 esac
134
135 useprefix=${prefix}
136 if [ "x$useprefix" = "x" ]; then
137 useprefix=/
138 fi
139 # WARNING: do not set compiler/linker flags (-I/-D etc.) in EXTRA_OECONF, as they will fully replace the
140 # environment variables set by bitbake. Adjust the environment variables instead.
141 HASHBANGPERL="/usr/bin/env perl" PERL=perl PERL5LIB="${S}/external/perl/Text-Template-1.46/lib/" \
142 perl ${S}/Configure ${EXTRA_OECONF} ${PACKAGECONFIG_CONFARGS} ${DEPRECATED_CRYPTO_FLAGS} --prefix=$useprefix --openssldir=${libdir}/ssl-1.1 --libdir=${libdir} $target
143 perl ${B}/configdata.pm --dump
144}
145
146do_install () {
147 oe_runmake DESTDIR="${D}" MANDIR="${mandir}" MANSUFFIX=ssl install
148
149 oe_multilib_header openssl/opensslconf.h
150
151 # Create SSL structure for packages such as ca-certificates which
152 # contain hard-coded paths to /etc/ssl. Debian does the same.
153 install -d ${D}${sysconfdir}/ssl
154 mv ${D}${libdir}/ssl-1.1/certs \
155 ${D}${libdir}/ssl-1.1/private \
156 ${D}${libdir}/ssl-1.1/openssl.cnf \
157 ${D}${sysconfdir}/ssl/
158
159 # Although absolute symlinks would be OK for the target, they become
160 # invalid if native or nativesdk are relocated from sstate.
161 ln -sf ${@oe.path.relative('${libdir}/ssl-1.1', '${sysconfdir}/ssl/certs')} ${D}${libdir}/ssl-1.1/certs
162 ln -sf ${@oe.path.relative('${libdir}/ssl-1.1', '${sysconfdir}/ssl/private')} ${D}${libdir}/ssl-1.1/private
163 ln -sf ${@oe.path.relative('${libdir}/ssl-1.1', '${sysconfdir}/ssl/openssl.cnf')} ${D}${libdir}/ssl-1.1/openssl.cnf
164}
165
166do_install_append_class-native () {
167 create_wrapper ${D}${bindir}/openssl \
168 OPENSSL_CONF=${libdir}/ssl-1.1/openssl.cnf \
169 SSL_CERT_DIR=${libdir}/ssl-1.1/certs \
170 SSL_CERT_FILE=${libdir}/ssl-1.1/cert.pem \
171 OPENSSL_ENGINES=${libdir}/engines-1.1
172}
173
174do_install_append_class-nativesdk () {
175 mkdir -p ${D}${SDKPATHNATIVE}/environment-setup.d
176 install -m 644 ${WORKDIR}/environment.d-openssl.sh ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh
177 sed 's|/usr/lib/ssl/|/usr/lib/ssl-1.1/|g' -i ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh
178}
179
180PTEST_BUILD_HOST_FILES += "configdata.pm"
181PTEST_BUILD_HOST_PATTERN = "perl_version ="
182do_install_ptest () {
183 # Prune the build tree
184 rm -f ${B}/fuzz/*.* ${B}/test/*.*
185
186 cp ${S}/Configure ${B}/configdata.pm ${D}${PTEST_PATH}
187 cp -r ${S}/external ${B}/test ${S}/test ${B}/fuzz ${S}/util ${B}/util ${D}${PTEST_PATH}
188
189 # For test_shlibload
190 ln -s ${libdir}/libcrypto.so.1.1 ${D}${PTEST_PATH}/
191 ln -s ${libdir}/libssl.so.1.1 ${D}${PTEST_PATH}/
192
193 install -d ${D}${PTEST_PATH}/apps
194 ln -s ${bindir}/openssl ${D}${PTEST_PATH}/apps
195 install -m644 ${S}/apps/*.pem ${S}/apps/*.srl ${S}/apps/openssl.cnf ${D}${PTEST_PATH}/apps
196 install -m755 ${B}/apps/CA.pl ${D}${PTEST_PATH}/apps
197
198 install -d ${D}${PTEST_PATH}/engines
199 install -m755 ${B}/engines/ossltest.so ${D}${PTEST_PATH}/engines
200}
201
202# Add the openssl.cnf file to the openssl-conf package. Make the libcrypto
203# package RRECOMMENDS on this package. This will enable the configuration
204# file to be installed for both the openssl-bin package and the libcrypto
205# package since the openssl-bin package depends on the libcrypto package.
206
207PACKAGES =+ "libcrypto libssl openssl-conf ${PN}-engines ${PN}-misc"
208
209FILES_libcrypto = "${libdir}/libcrypto${SOLIBS}"
210FILES_libssl = "${libdir}/libssl${SOLIBS}"
211FILES_openssl-conf = "${sysconfdir}/ssl/openssl.cnf \
212 ${libdir}/ssl-1.1/openssl.cnf* \
213 "
214FILES_${PN}-engines = "${libdir}/engines-1.1"
215# ${prefix} comes from what we pass into --prefix at configure time (which is used for INSTALLTOP)
216FILES_${PN}-engines_append_mingw32_class-nativesdk = " ${prefix}${libdir}/engines-1_1"
217FILES_${PN}-misc = "${libdir}/ssl-1.1/misc ${bindir}/c_rehash"
218FILES_${PN} =+ "${libdir}/ssl-1.1/*"
219FILES_${PN}_append_class-nativesdk = " ${SDKPATHNATIVE}/environment-setup.d/openssl.sh"
220
221CONFFILES_openssl-conf = "${sysconfdir}/ssl/openssl.cnf"
222
223RRECOMMENDS_libcrypto += "openssl-conf"
224RDEPENDS_${PN}-misc = "perl"
225RDEPENDS_${PN}-ptest += "openssl-bin perl perl-modules bash"
226
227RDEPENDS_${PN}-bin += "openssl-conf"
228
229BBCLASSEXTEND = "native nativesdk"
230
231CVE_PRODUCT = "openssl:openssl"
232
233# Only affects OpenSSL >= 1.1.1 in combination with Apache < 2.4.37
234# Apache in meta-webserver is already recent enough
235CVE_CHECK_WHITELIST += "CVE-2019-0190"
diff --git a/meta/recipes-connectivity/openssl/openssl_3.5.0.bb b/meta/recipes-connectivity/openssl/openssl_3.5.0.bb
new file mode 100644
index 0000000000..0f5c28dafa
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl_3.5.0.bb
@@ -0,0 +1,283 @@
1SUMMARY = "Secure Socket Layer"
2DESCRIPTION = "Secure Socket Layer (SSL) binary and related cryptographic tools."
3HOMEPAGE = "http://www.openssl.org/"
4BUGTRACKER = "http://www.openssl.org/news/vulnerabilities.html"
5SECTION = "libs/network"
6
7LICENSE = "Apache-2.0"
8LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=c75985e733726beaba57bc5253e96d04"
9
10SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \
11 file://run-ptest \
12 file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \
13 file://0001-Configure-do-not-tweak-mips-cflags.patch \
14 file://0001-Added-handshake-history-reporting-when-test-fails.patch \
15 "
16
17SRC_URI:append:class-nativesdk = " \
18 file://environment.d-openssl.sh \
19 "
20
21SRC_URI[sha256sum] = "344d0a79f1a9b08029b0744e2cc401a43f9c90acd1044d09a530b4885a8e9fc0"
22
23inherit lib_package multilib_header multilib_script ptest perlnative manpages
24MULTILIB_SCRIPTS = "${PN}-bin:${bindir}/c_rehash"
25
26PACKAGECONFIG ?= ""
27PACKAGECONFIG:class-native = ""
28PACKAGECONFIG:class-nativesdk = ""
29
30PACKAGECONFIG[cryptodev-linux] = "enable-devcryptoeng,disable-devcryptoeng,cryptodev-linux,,cryptodev-module"
31PACKAGECONFIG[no-tls1] = "no-tls1"
32PACKAGECONFIG[no-tls1_1] = "no-tls1_1"
33PACKAGECONFIG[manpages] = ""
34PACKAGECONFIG[fips] = "enable-fips"
35
36B = "${WORKDIR}/build"
37do_configure[cleandirs] = "${B}"
38
39EXTRA_OECONF = "${@bb.utils.contains('PTEST_ENABLED', '1', '', 'no-tests', d)}"
40
41#| ./libcrypto.so: undefined reference to `getcontext'
42#| ./libcrypto.so: undefined reference to `setcontext'
43#| ./libcrypto.so: undefined reference to `makecontext'
44EXTRA_OECONF:append:libc-musl = " no-async"
45EXTRA_OECONF:append:libc-musl:powerpc64 = " no-asm"
46
47# adding devrandom prevents openssl from using getrandom() which is not available on older glibc versions
48# (native versions can be built with newer glibc, but then relocated onto a system with older glibc)
49EXTRA_OECONF:append:class-native = " --with-rand-seed=os,devrandom"
50EXTRA_OECONF:append:class-nativesdk = " --with-rand-seed=os,devrandom"
51
52# Relying on hardcoded built-in paths causes openssl-native to not be relocateable from sstate.
53EXTRA_OEMAKE:append:task-compile:class-native = ' OPENSSLDIR="/not/builtin" ENGINESDIR="/not/builtin" MODULESDIR="/not/builtin"'
54EXTRA_OEMAKE:append:task-compile:class-nativesdk = ' OPENSSLDIR="/not/builtin" ENGINESDIR="/not/builtin" MODULESDIR="/not/builtin"'
55
56#| threads_pthread.c:(.text+0x372): undefined reference to `__atomic_is_lock_free'
57EXTRA_OECONF:append:toolchain-clang:x86 = " -latomic"
58
59# This allows disabling deprecated or undesirable crypto algorithms.
60# The default is to trust upstream choices.
61DEPRECATED_CRYPTO_FLAGS ?= ""
62
63do_configure () {
64 # When we upgrade glibc but not uninative we see obtuse failures in openssl. Make
65 # the issue really clear that perl isn't functional due to symbol mismatch issues.
66 cat <<- EOF > ${WORKDIR}/perltest
67 #!/usr/bin/env perl
68 use POSIX;
69 EOF
70 chmod a+x ${WORKDIR}/perltest
71 ${WORKDIR}/perltest
72
73 os=${HOST_OS}
74 case $os in
75 linux-gnueabi |\
76 linux-gnuspe |\
77 linux-musleabi |\
78 linux-muslspe |\
79 linux-musl )
80 os=linux
81 ;;
82 *)
83 ;;
84 esac
85 target="$os-${HOST_ARCH}"
86 case $target in
87 linux-arc | linux-microblaze*)
88 target=linux-latomic
89 ;;
90 linux-arm*)
91 target=linux-armv4
92 ;;
93 linux-aarch64*)
94 target=linux-aarch64
95 ;;
96 linux-i?86 | linux-viac3)
97 target=linux-x86
98 ;;
99 linux-gnux32-x86_64 | linux-muslx32-x86_64 )
100 target=linux-x32
101 ;;
102 linux-gnu64-x86_64)
103 target=linux-x86_64
104 ;;
105 linux-loongarch64)
106 target=linux64-loongarch64
107 ;;
108 linux-mips | linux-mipsel)
109 # specifying TARGET_CC_ARCH prevents openssl from (incorrectly) adding target architecture flags
110 target="linux-mips32 ${TARGET_CC_ARCH}"
111 ;;
112 linux-gnun32-mips*)
113 target=linux-mips64
114 ;;
115 linux-*-mips64 | linux-mips64 | linux-*-mips64el | linux-mips64el)
116 target=linux64-mips64
117 ;;
118 linux-nios2* | linux-sh3 | linux-sh4 | linux-arc*)
119 target=linux-generic32
120 ;;
121 linux-powerpc)
122 target=linux-ppc
123 ;;
124 linux-powerpc64)
125 target=linux-ppc64
126 ;;
127 linux-powerpc64le)
128 target=linux-ppc64le
129 ;;
130 linux-riscv32)
131 target=linux32-riscv32
132 ;;
133 linux-riscv64)
134 target=linux64-riscv64
135 ;;
136 linux-sparc | linux-supersparc)
137 target=linux-sparcv9
138 ;;
139 mingw32-x86_64)
140 target=mingw64
141 ;;
142 esac
143
144 # WARNING: do not set compiler/linker flags (-I/-D etc.) in EXTRA_OECONF, as they will fully replace the
145 # environment variables set by bitbake. Adjust the environment variables instead.
146 PERLEXTERNAL="$(realpath ${S}/external/perl/Text-Template-*/lib)"
147 test -d "$PERLEXTERNAL" || bberror "PERLEXTERNAL '$PERLEXTERNAL' not found!"
148 HASHBANGPERL="/usr/bin/env perl" PERL=perl PERL5LIB="$PERLEXTERNAL" \
149 perl ${S}/Configure ${EXTRA_OECONF} ${PACKAGECONFIG_CONFARGS} ${DEPRECATED_CRYPTO_FLAGS} --prefix=${prefix} --openssldir=${libdir}/ssl-3 --libdir=${baselib} $target
150 perl ${B}/configdata.pm --dump
151}
152
153do_compile:append () {
154 # The test suite binaries are large and we don't need the debugging in them
155 if test -d ${B}/test; then
156 find ${B}/test -type f -executable -exec ${STRIP} {} \;
157 fi
158}
159
160do_install () {
161 oe_runmake DESTDIR="${D}" MANDIR="${mandir}" MANSUFFIX=ssl install_sw install_ssldirs \
162 ${@bb.utils.contains('PACKAGECONFIG', 'manpages', 'install_docs', '', d)} \
163 ${@bb.utils.contains('PACKAGECONFIG', 'fips', 'install_fips', '', d)}
164
165 oe_multilib_header openssl/opensslconf.h
166 oe_multilib_header openssl/configuration.h
167
168 # Create SSL structure for packages such as ca-certificates which
169 # contain hard-coded paths to /etc/ssl. Debian does the same.
170 install -d ${D}${sysconfdir}/ssl
171 mv ${D}${libdir}/ssl-3/certs \
172 ${D}${libdir}/ssl-3/private \
173 ${D}${libdir}/ssl-3/openssl.cnf \
174 ${D}${sysconfdir}/ssl/
175
176 # Although absolute symlinks would be OK for the target, they become
177 # invalid if native or nativesdk are relocated from sstate.
178 ln -sf ${@oe.path.relative('${libdir}/ssl-3', '${sysconfdir}/ssl/certs')} ${D}${libdir}/ssl-3/certs
179 ln -sf ${@oe.path.relative('${libdir}/ssl-3', '${sysconfdir}/ssl/private')} ${D}${libdir}/ssl-3/private
180 ln -sf ${@oe.path.relative('${libdir}/ssl-3', '${sysconfdir}/ssl/openssl.cnf')} ${D}${libdir}/ssl-3/openssl.cnf
181
182 # Generate fipsmodule.cnf in pkg_postinst_ontarget
183 if ${@bb.utils.contains('PACKAGECONFIG', 'fips', 'true', 'false', d)}; then
184 rm -f ${D}${libdir}/ssl-3/fipsmodule.cnf
185 fi
186}
187
188do_install:append:class-native () {
189 create_wrapper ${D}${bindir}/openssl \
190 OPENSSL_CONF=\${OPENSSL_CONF:-${libdir}/ssl-3/openssl.cnf} \
191 SSL_CERT_DIR=\${SSL_CERT_DIR:-${libdir}/ssl-3/certs} \
192 SSL_CERT_FILE=\${SSL_CERT_FILE:-${libdir}/ssl-3/cert.pem} \
193 OPENSSL_ENGINES=\${OPENSSL_ENGINES:-${libdir}/engines-3} \
194 OPENSSL_MODULES=\${OPENSSL_MODULES:-${libdir}/ossl-modules}
195}
196
197do_install:append:class-nativesdk () {
198 mkdir -p ${D}${SDKPATHNATIVE}/environment-setup.d
199 install -m 644 ${UNPACKDIR}/environment.d-openssl.sh ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh
200}
201
202PTEST_BUILD_HOST_FILES += "configdata.pm"
203PTEST_BUILD_HOST_PATTERN = "perl_version ="
204do_install_ptest() {
205 install -m644 ${S}/Configure ${B}/configdata.pm ${D}${PTEST_PATH}
206 cp -rf ${S}/Configurations ${S}/external ${D}${PTEST_PATH}/
207
208 install -d ${D}${PTEST_PATH}/apps
209 ln -s ${bindir}/openssl ${D}${PTEST_PATH}/apps
210
211 cd ${S}
212 find test/certs test/ct test/d2i-tests test/recipes test/ocsp-tests test/ssl-tests test/smime-certs -type f -exec install -m644 -D {} ${D}${PTEST_PATH}/{} \;
213 find apps test -name \*.cnf -exec install -m644 -D {} ${D}${PTEST_PATH}/{} \;
214 find apps test -name \*.der -exec install -m644 -D {} ${D}${PTEST_PATH}/{} \;
215 find apps test -name \*.pem -exec install -m644 -D {} ${D}${PTEST_PATH}/{} \;
216 find util -name \*.p[lm] -exec install -m644 -D {} ${D}${PTEST_PATH}/{} \;
217
218 cd ${B}
219 # Everything but .? (.o and .d)
220 find test -type f -name \*[^.]? -exec install -m755 -D {} ${D}${PTEST_PATH}/{} \;
221 find apps test -name \*.cnf -exec install -m644 -D {} ${D}${PTEST_PATH}/{} \;
222 find apps test -name \*.pem -exec install -m644 -D {} ${D}${PTEST_PATH}/{} \;
223 find apps test -name \*.srl -exec install -m644 -D {} ${D}${PTEST_PATH}/{} \;
224 install -m755 ${B}/util/*wrap.* ${D}${PTEST_PATH}/util/
225
226 install -m755 ${B}/apps/CA.pl ${D}${PTEST_PATH}/apps/
227 install -m755 ${S}/test/*.pl ${D}${PTEST_PATH}/test/
228 install -m755 ${S}/test/shibboleth.pfx ${D}${PTEST_PATH}/test/
229 install -m755 ${S}/test/*.bin ${D}${PTEST_PATH}/test/
230 install -m755 ${S}/test/dane*.in ${D}${PTEST_PATH}/test/
231 install -m755 ${S}/test/smcont*.txt ${D}${PTEST_PATH}/test/
232 install -m755 ${S}/test/ssl_test.tmpl ${D}${PTEST_PATH}/test/
233
234 sed 's|${S}|${PTEST_PATH}|g' -i ${D}${PTEST_PATH}/configdata.pm ${D}${PTEST_PATH}/util/wrap.pl
235
236 install -d ${D}${PTEST_PATH}/engines
237 install -m755 ${B}/engines/dasync.so ${D}${PTEST_PATH}/engines/
238 install -m755 ${B}/engines/ossltest.so ${D}${PTEST_PATH}/engines/
239 ln -s ${libdir}/engines-3/loader_attic.so ${D}${PTEST_PATH}/engines/
240 ln -s ${libdir}/ossl-modules/ ${D}${PTEST_PATH}/providers
241}
242
243pkg_postinst_ontarget:${PN}-ossl-module-fips () {
244 if test -f ${libdir}/ossl-modules/fips.so; then
245 ${bindir}/openssl fipsinstall -out ${libdir}/ssl-3/fipsmodule.cnf -module ${libdir}/ossl-modules/fips.so
246 fi
247}
248
249# Add the openssl.cnf file to the openssl-conf package. Make the libcrypto
250# package RRECOMMENDS on this package. This will enable the configuration
251# file to be installed for both the openssl-bin package and the libcrypto
252# package since the openssl-bin package depends on the libcrypto package.
253
254PACKAGES =+ "libcrypto libssl openssl-conf ${PN}-engines ${PN}-misc ${PN}-ossl-module-legacy ${PN}-ossl-module-fips"
255
256FILES:libcrypto = "${libdir}/libcrypto${SOLIBS}"
257FILES:libssl = "${libdir}/libssl${SOLIBS}"
258FILES:openssl-conf = "${sysconfdir}/ssl/openssl.cnf \
259 ${libdir}/ssl-3/openssl.cnf* \
260 "
261FILES:${PN}-engines = "${libdir}/engines-3"
262# ${prefix} comes from what we pass into --prefix at configure time (which is used for INSTALLTOP)
263FILES:${PN}-engines:append:mingw32:class-nativesdk = " ${prefix}${libdir}/engines-3"
264FILES:${PN}-misc = "${libdir}/ssl-3/misc ${bindir}/c_rehash"
265FILES:${PN}-ossl-module-legacy = "${libdir}/ossl-modules/legacy.so"
266FILES:${PN}-ossl-module-fips = "${libdir}/ossl-modules/fips.so"
267FILES:${PN} =+ "${libdir}/ssl-3/* ${libdir}/ossl-modules/"
268FILES:${PN}:append:class-nativesdk = " ${SDKPATHNATIVE}/environment-setup.d/openssl.sh"
269
270CONFFILES:openssl-conf = "${sysconfdir}/ssl/openssl.cnf"
271
272RRECOMMENDS:libcrypto += "openssl-conf ${PN}-ossl-module-legacy"
273RDEPENDS:${PN}-misc = "perl"
274RDEPENDS:${PN}-ptest += "openssl-bin perl perl-modules bash sed openssl-engines openssl-ossl-module-legacy"
275
276RDEPENDS:${PN}-bin += "openssl-conf"
277
278# The test suite is installed stripped
279INSANE_SKIP:${PN} = "already-stripped"
280
281BBCLASSEXTEND = "native nativesdk"
282
283CVE_PRODUCT = "openssl:openssl"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-07 10:43:40 +0000