linux/poky.git/meta/recipes-connectivity/openssl, branch 2.3_M2

openssl: Use linux-aarch64 target for aarch64

2017-01-19T22:47:21+00:00

aarch64 target was being configured for linux-generic64 but openssl has linux-aarch64 target. Change to use linux-aarch64 as default. (From OE-Core rev: 13e9a692510151383bc3243c3917154896b0e049) Signed-off-by: Fabio Berton Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

openssl: Add support for many MIPS configurations

2016-12-22T08:50:16+00:00

Add more case statements to catch MIPS tune configurations (From OE-Core rev: cd1f6fbf9a2113cf510c25de2eb3895468e79149) Signed-off-by: Zubair Lutfullah Kakakhel Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

openssl-native: Compile with -fPIC

2016-12-20T15:22:16+00:00

Fixes | /usr/bin/ld: libcrypto.a(sha1-x86_64.o): relocation R_X86_64_PC32 against undefined symbol `OPENSSL_ia32cap_P' can not be used when making a shared object; recompile with -fPIC | /usr/bin/ld: final link failed: Bad value (From OE-Core rev: 0a19e72081771fca8ed94fb2a2a8996fd3dce00c) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie

openssl: Security fix CVE-2016-7055

2016-11-23T11:10:14+00:00

There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure that handles input lengths divisible by, but longer than 256 bits. External References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7055 https://www.openssl.org/news/secadv/20161110.txt Patch from: https://github.com/openssl/openssl/commit/57c4b9f6a2f800b41ce2836986fe33640f6c3f8a (From OE-Core rev: 07cfa9e2bceb07f3baf40681f8c57f4d3da0aee5) Signed-off-by: Yi Zhao Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

OpenSSL: CVE-2004-2761 replace MD5 hash algorithm

2016-11-23T11:10:14+00:00

Use SHA256 as default digest for OpenSSL instead of MD5. CVE: CVE-2004-2761 The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate. Upstream-Status: Backport Backport from OpenSSL 2.0 to OpenSSL 1.0.2 Commit f8547f62c212837dbf44fb7e2755e5774a59a57b Reviewed-by: Viktor Dukhovni (From OE-Core rev: f924428cf0c22a0b62769f8f31f11f173f25014f) Signed-off-by: Zhang Xiao Signed-off-by: T.O. Radzy Radzykewycz Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

openssl: fix bashism in c_rehash shell script

2016-11-23T11:10:12+00:00

This script claims to be a /bin/sh script, but it uses a bashism: from checkbashisms: possible bashism in meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh line 151 (should be 'b = a'): if [ "x/" == "x$( echo ${FILE} | cut -c1 -)" ] This causes build issues on systems that don't have /bin/sh symlinked to bash: Updating certificates in ${WORKDIR}/rootfs/etc/ssl/certs... /tmp/sysroots/x86_64-linux/usr/bin/c_rehash: 151: [: x/: unexpected operator ... Fix this by using POSIX shell syntax for the comparison. (From OE-Core rev: 0526524c74d4c9019fb014a2984119987f6ce9d3) Signed-off-by: André Draszik Reviewed-by: Sylvain Lemieux Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

openssl: rehash actual mozilla certificates inside rootfs

2016-11-06T23:35:32+00:00

The c_rehash utility is supposed to be run in the folder /etc/ssl/certs of a rootfs where the package ca-certificates puts symlinks to various CA certificates stored in /usr/share/ca-certificates/mozilla/. These symlinks are absolute. This means that when c_rehash is run at rootfs creation time it can't hash the actual files since they actually reside in the build host's directory $SYSROOT/usr/share/ca-certificates/mozilla/. This problem doesn't reproduce when building on Debian or Ubuntu hosts though, because these OSs have the certificates installed in the same /usr/share/ca-certificates/mozilla/ folder. Images built in other distros, e.g. Fedora, have problems with connecting to https servers when using e.g. python's http lib. The patch fixes c_rehash to check if it runs on a build host by testing $SYSROOT and to translate the paths to certificates accordingly. (From OE-Core rev: 5199b990edf4d9784c19137d0ce9ef141cd85e46) Signed-off-by: Dmitry Rozhkov Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

openssl: Upgrade 1.0.2i -> 1.0.2j

2016-09-28T09:16:04+00:00

Deals with a CVE issue Drops a patch applied upstream and no longer needed. (From OE-Core rev: ee590ac736ca2a378605fa1272a1c57a1dbc7a57) Signed-off-by: Richard Purdie

openssl.inc: avoid random ptest failures

2016-09-24T06:30:09+00:00

"make alltests" is sensitive to the timestamps of the installed files. Depending on the order in which cp copies files, .o and/or executables may end up with time stamps older than the source files. Running tests then triggers recompilation attempts, which typically will fail because dev tools and files are not installed. "cp -a" is not enough because the files also have to be newer than the installed header files. Setting the file time stamps to the current time explicitly after copying solves the problem because do_install_ptest_base is guaranteed to run after do_install. (From OE-Core rev: 101e2a5e0b7822ca3de3d3a73369405c05ab3c5b) Signed-off-by: Patrick Ohly Signed-off-by: Richard Purdie

openssl: update to 1.0.2i (CVE-2016-6304 and more)

2016-09-24T06:30:09+00:00

This update fixes several CVEs: * OCSP Status Request extension unbounded memory growth (CVE-2016-6304) * SWEET32 Mitigation (CVE-2016-2183) * OOB write in MDC2_Update() (CVE-2016-6303) * Malformed SHA512 ticket DoS (CVE-2016-6302) * OOB write in BN_bn2dec() (CVE-2016-2182) * OOB read in TS_OBJ_print_bio() (CVE-2016-2180) * DTLS buffered message DoS (CVE-2016-2179) * DTLS replay protection DoS (CVE-2016-2181) * Certificate message OOB reads (CVE-2016-6306) Of these, only CVE-2016-6304 is considered of high severity. Everything else is low. CVE-2016-2177 and CVE-2016-2178 were already fixed via local patches, which can be removed now. See https://www.openssl.org/news/secadv/20160922.txt for details. Some patches had to be refreshed and one compile error fix from upstream's OpenSSL_1_0_2-stable was required. The server.pem file is needed for test_dtls. (From OE-Core rev: d6b69279b5d1370d9c4982d5b1842a471cfd2b0e) Signed-off-by: Patrick Ohly Signed-off-by: Richard Purdie