2 files changed, 99 insertions, 27 deletions

diff --git a/meta-networking/recipes-protocols/mdns/mdns/0001-mDNSPosix-Rework-mbedtls-for-compatibility-with-mbed.patch b/meta-networking/recipes-protocols/mdns/mdns/0001-mDNSPosix-Rework-mbedtls-for-compatibility-with-mbed.patch
new file mode 100644
index 0000000000..a561fd232f
--- /dev/null
+++ b/meta-networking/recipes-protocols/mdns/mdns/0001-mDNSPosix-Rework-mbedtls-for-compatibility-with-mbed.patch
@@ -0,0 +1,57 @@
+From f4f5039eb90918b5248bd6266afdad0b33b2d010 Mon Sep 17 00:00:00 2001
+From: Alex Kiernan <alex.kiernan@gmail.com>
+Date: Thu, 30 Apr 2026 08:21:19 +0100
+Subject: [PATCH] mDNSPosix: Rework mbedtls for compatibility with mbedtls4
+
+Upstream-Status: Inactive-Upstream [Upstream does not take patches]
+Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
+---
+ mDNSPosix/mbedtls.c | 21 +++++----------------
+ 1 file changed, 5 insertions(+), 16 deletions(-)
+
+diff --git a/mDNSPosix/mbedtls.c b/mDNSPosix/mbedtls.c
+index 6726ef9b9145..c4b7fd4edfff 100644
+--- a/mDNSPosix/mbedtls.c
++++ b/mDNSPosix/mbedtls.c
+@@ -29,14 +29,10 @@
+ #include <errno.h>
+ #include <unistd.h>
+ 
++#include <psa/crypto.h>
++
+ #include <mbedtls/error.h>
+-#include <mbedtls/pk.h>
+-#include <mbedtls/ecp.h>
+-#include <mbedtls/ecdsa.h>
+-#include <mbedtls/entropy.h>
+-#include <mbedtls/ctr_drbg.h>
+-#include <mbedtls/sha256.h>
+-#include <mbedtls/base64.h>
++#include <mbedtls/psa_util.h>
+ 
+ #include <mbedtls/x509.h>
+ #include <mbedtls/ssl.h>
+@@ -53,21 +49,14 @@ struct TLSServerContext_struct {
+     mbedtls_ssl_config config;
+ };
+ 
+-// Context that is shared amongs all TLS connections, regardless of which server cert/key is in use.
+-static mbedtls_entropy_context entropy;
+-static mbedtls_ctr_drbg_context ctr_drbg;
+-
+ mDNSBool
+ mDNSPosixTLSInit(void)
+ {
+     int status;
+ 
+-    mbedtls_entropy_init(&entropy);
+-    mbedtls_ctr_drbg_init(&ctr_drbg);
+-
+-    status = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0);
++    status = psa_crypto_init();
+     if (status != 0) {
+-        LogRedact(MDNS_LOG_CATEGORY_DEFAULT, MDNS_LOG_ERROR, "Unable to seed RNG: %x", -status);
++        LogRedact(MDNS_LOG_CATEGORY_DEFAULT, MDNS_LOG_ERROR, "PSA crypto init failed: %x", -status);
+         return mDNSfalse;
+     }
+     return mDNStrue;
diff --git a/meta-networking/recipes-protocols/mdns/mdns_2881.100.56.0.1.bb b/meta-networking/recipes-protocols/mdns/mdns_2881.100.56.0.1.bb
index 10560d795a..4bbf012b83 100644
--- a/meta-networking/recipes-protocols/mdns/mdns_2881.100.56.0.1.bb
+++ b/meta-networking/recipes-protocols/mdns/mdns_2881.100.56.0.1.bb
@@ -15,6 +15,7 @@ SRC_URI = "git://github.com/apple-oss-distributions/mDNSResponder;protocol=https
            file://0001-Fix-build-with-gcc-15.patch \
            file://mdns.service \
            file://0007-mDNSShared-Make-Apple-Wireless-Direct-Link-depend-on.patch \
+           file://0001-mDNSPosix-Rework-mbedtls-for-compatibility-with-mbed.patch \
            "
 BRANCH = "rel/mDNSResponder-2881"
 SRCREV = "ea3902cfeff86a04b4c684753c80e425edbd1a21"
@@ -26,7 +27,10 @@ PACKAGECONFIG ?= "tls \
 PACKAGECONFIG[debug] = "DEBUG=1,DEBUG=0"
 PACKAGECONFIG[ipv6] = "HAVE_IPV6=1,HAVE_IPV6=0"
 PACKAGECONFIG[manpages] = ""
+PACKAGECONFIG[idlesleepcontrol] = ""
+PACKAGECONFIG[spc] = ""
 PACKAGECONFIG[tls] = ",tls=no,mbedtls"
+PACKAGECONFIG[unicast] = ""
 
 CVE_PRODUCT = "apple:mdnsresponder"
 
@@ -47,49 +51,55 @@ EXTRA_OEMAKE = "os=linux 'CC=${CCLD}' 'LD=${CCLD}' 'LINKOPTS=${LDFLAGS}' STRIP=:
 
 # MDNS_VERSIONSTR_NODTS disables __DATE__ and __TIME__ in the version string,
 # which are fixed anyway for build reproducibility.
-TARGET_CPPFLAGS += "-DMDNS_VERSIONSTR_NODTS"
+#
+# IDLESLEEPCONTROL_DISABLED - disables sleep control for Bonjour Sleep Proxy clients
+# UNICAST_DISABLED - disables unicast DNS functionality, including Wide Area Bonjour
+# SPC_DISABLED - disables Bonjour Sleep Proxy client
+TARGET_CPPFLAGS += "-DmDNSResponderVersion=${PV} \
+                    -DMDNS_VERSIONSTR_NODTS \
+                    ${@bb.utils.contains('PACKAGECONFIG','idlesleepcontrol','','-DIDLESLEEPCONTROL_DISABLED', d)} \
+                    ${@bb.utils.contains('PACKAGECONFIG','unicast','','-DUNICAST_DISABLED', d)} \
+                    ${@bb.utils.contains('PACKAGECONFIG','spc','','-DSPC_DISABLED', d)}"
 
 TARGET_CC_ARCH += "${LDFLAGS}"
 
 MDNS_BUILDDIR = "build/${@bb.utils.contains('PACKAGECONFIG','debug','debug','prod', d)}"
 
 do_install () {
-        cd mDNSPosix
-
+        install -d ${D}${bindir}
+        install -d ${D}${includedir}
+        install -d ${D}${libdir}
+        install -d ${D}${mandir}/man5
+        install -d ${D}${mandir}/man8
         install -d ${D}${sbindir}
-        install ${MDNS_BUILDDIR}/mdnsd ${D}${sbindir}
+        install -d ${D}${sysconfdir}
+        install -d ${D}${systemd_system_unitdir}
+        install -d ${D}${INIT_D_DIR}
 
-        install -d ${D}${libdir}
-        install -m 0644 ${MDNS_BUILDDIR}/libdns_sd.so ${D}${libdir}/libdns_sd.so.1
-        ln -s libdns_sd.so.1 ${D}${libdir}/libdns_sd.so
+        install ${B}/mDNSPosix/${MDNS_BUILDDIR}/mdnsd ${D}${sbindir}
+        install ${B}/mDNSPosix/${MDNS_BUILDDIR}/mDNSClientPosix ${D}${bindir}
+        install ${B}/mDNSPosix/${MDNS_BUILDDIR}/mDNSNetMonitor ${D}${bindir}
+        install ${B}/mDNSPosix/${MDNS_BUILDDIR}/mDNSProxyResponderPosix ${D}${bindir}
+        install ${B}/mDNSPosix/${MDNS_BUILDDIR}/mDNSResponderPosix ${D}${bindir}
 
-        install -d ${D}${includedir}
-        install -m 0644 ../mDNSShared/dns_sd.h ${D}${includedir}
+        install -m 0644 ${B}/mDNSPosix/${MDNS_BUILDDIR}/libdns_sd.so ${D}${libdir}/libdns_sd.so.1
+        ln -s libdns_sd.so.1 ${D}${libdir}/libdns_sd.so
 
-        install -d ${D}${mandir}/man8
-        install -m 0644 ../mDNSShared/mDNSResponder.8 ${D}${mandir}/man8/mdnsd.8
+        install -m 0644 ${B}/mDNSShared/dns_sd.h ${D}${includedir}
+        install -m 0644 ${B}/mDNSShared/mDNSResponder.8 ${D}${mandir}/man8/mdnsd.8
 
-        install -d ${D}${bindir}
-        install -m 0755 ../Clients/build/dns-sd ${D}${bindir}
+        install -m 0755 ${B}/Clients/build/dns-sd ${D}${bindir}
 
-        install -d ${D}${libdir}
-        oe_libinstall -C ${MDNS_BUILDDIR} -so libnss_mdns-0.2 ${D}${libdir}
+        oe_libinstall -C ${B}/mDNSPosix/${MDNS_BUILDDIR} -so libnss_mdns-0.2 ${D}${libdir}
         ln -s libnss_mdns-0.2.so ${D}${libdir}/libnss_mdns.so.2
 
-        install -d ${D}${sysconfdir}
-        install -m 0644 nss_mdns.conf ${D}${sysconfdir}
-
-        install -d ${D}${mandir}/man5
-        install -m 0644 nss_mdns.conf.5 ${D}${mandir}/man5
-
-        install -d ${D}${mandir}/man8
-        install -m 0644 libnss_mdns.8 ${D}${mandir}/man8
+        install -m 0644 ${B}/mDNSPosix/nss_mdns.conf ${D}${sysconfdir}
+        install -m 0644 ${B}/mDNSPosix/nss_mdns.conf.5 ${D}${mandir}/man5
+        install -m 0644 ${B}/mDNSPosix/libnss_mdns.8 ${D}${mandir}/man8
 
-        install -d ${D}${systemd_system_unitdir}
         install -m 0644 ${UNPACKDIR}/mdns.service ${D}${systemd_system_unitdir}
 
-        install -d ${D}${INIT_D_DIR}
-        install mdnsd.sh ${D}${INIT_D_DIR}/mdns
+        install ${B}/mDNSPosix/mdnsd.sh ${D}${INIT_D_DIR}/mdns
 }
 
 pkg_postinst:${PN}-libnss-mdns () {
@@ -111,7 +121,7 @@ pkg_prerm:${PN}-libnss-mdns () {
 SYSTEMD_SERVICE:${PN} = "mdns.service"
 INITSCRIPT_NAME = "mdns"
 
-PACKAGE_BEFORE_PN = "${PN}-libnss-mdns"
+PACKAGE_BEFORE_PN = "${PN}-libnss-mdns ${PN}-clients"
 
 RRECOMMENDS:${PN}:append:libc-glibc = " ${PN}-libnss-mdns"
 
@@ -119,4 +129,9 @@ FILES_SOLIBSDEV = "${libdir}/libdns_sd.so"
 FILES:${PN}-libnss-mdns = "${sysconfdir}/nss_mdns.conf ${libdir}/libnss_mdns*.so*"
 RPROVIDES:${PN}-libnss-mdns = "libnss-mdns"
 
+FILES:${PN}-clients = "${bindir}/mDNSClientPosix \
+                       ${bindir}/mDNSNetMonitor \
+                       ${bindir}/mDNSProxyResponderPosix \
+                       ${bindir}/mDNSResponderPosix"
+
 RPROVIDES:${PN} += "libdns-sd"