Turn OpenSSL into a virtual package

similarity index 100%
rename from package/openssl/0001-Dont-waste-time-building-manpages-if-we-re-not-going.patch
rename to package/libopenssl/0001-Dont-waste-time-building-manpages-if-we-re-not-going.patch

similarity index 100%
rename from package/openssl/0002-cryptodev-Fix-issue-with-signature-generation.patch
rename to package/libopenssl/0002-cryptodev-Fix-issue-with-signature-generation.patch

similarity index 100%
rename from package/openssl/openssl.hash
rename to package/libopenssl/libopenssl.hash

171 lines not on this page · raw message

62 lines not on this page · raw message

168 lines not on this page · raw message

index 55e5426775..191b09a650 100644
@@ -3,8 +3,9 @@ config BR2_PACKAGE_SOFTETHER
 	depends on BR2_TOOLCHAIN_HAS_THREADS
 	depends on BR2_USE_MMU # fork()
 	depends on BR2_USE_WCHAR
+	depends on BR2_PACKAGE_LIBOPENSSL
 	select BR2_PACKAGE_LIBICONV if !BR2_ENABLE_LOCALE
-	select BR2_PACKAGE_OPENSSL
+
 	select BR2_PACKAGE_READLINE
 	help
 	  The SoftEther Server is a fully integrated implementation of the SSTP,

@@ -24,4 +25,5 @@ config BR2_PACKAGE_SOFTETHER
 
 comment "softether needs a toolchain w/ wchar, threads"
 	depends on BR2_USE_MMU
+	depends on BR2_PACKAGE_LIBOPENSSL
 	depends on !(BR2_USE_WCHAR && BR2_TOOLCHAIN_HAS_THREADS)

index 01de10714b..ec6e0603d7 100644
@@ -1,2 +1,3 @@
 # Locally computed
-sha256 a34dca9bdb940f9384ae50096f6485448ca539c557e36b3a7f6f810831ee5946 softether-e9006faf0c8739147ab97e27fe11c5cdd20ed9e6.tar.gz
+sha256 8e6310d36e579ea07171ce5fcb9ebe31235d218444c4e4836ca6c32aa49c1f93 softether-v4.22-9634-beta.tar.gz
+sha256 7aeb873293fa0e44425dabf68a8e46e26c848fe58efcfd3ac7c90a3386f3edd1 LICENSE

index 5868438db0..05d2f20fe5 100644
@@ -4,11 +4,11 @@
 #
 ################################################################################
 
-SOFTETHER_VERSION = e9006faf0c8739147ab97e27fe11c5cdd20ed9e6
+SOFTETHER_VERSION = v4.22-9634-beta
 SOFTETHER_SITE = $(call github,SoftEtherVPN,SoftEtherVPN,$(SOFTETHER_VERSION))
 SOFTETHER_LICENSE = GPL-2.0
 SOFTETHER_LICENSE_FILES = LICENSE
-SOFTETHER_DEPENDENCIES = host-softether openssl readline
+SOFTETHER_DEPENDENCIES = host-softether libopenssl readline
 SOFTETHER_AUTORECONF = YES
 
 ifeq ($(BR2_ENABLE_LOCALE),)

@@ -26,7 +26,7 @@ SOFTETHER_CONF_OPTS = \
 	--with-zlib="$(STAGING_DIR)/usr"
 
 # host-libiconv does not exist, therefore we need this extra line
-HOST_SOFTETHER_DEPENDENCIES = host-pkgconf host-openssl host-readline
+HOST_SOFTETHER_DEPENDENCIES = host-pkgconf host-libopenssl host-readline
 
 # target build creates the file hamcore.se2 which needs the host variant of
 # hamcorebuilder, for details see http://www.vpnusers.com/viewtopic.php?p=5426

new file mode 100644
index 0000000000..5e8d7afeff
@@ -0,0 +1,38 @@
+From 85c1ae0865c7221af98a60cc678c03c78d443389 Mon Sep 17 00:00:00 2001
+From: Aric Belsito <[email protected]>
+Date: Fri, 4 Aug 2017 13:02:17 -0400
+Subject: [PATCH] fix libressl support
+
+From: https://github.com/gentoo/libressl/blob/master/net-wireless/hostapd/files/hostapd-2.6-libressl.patch
+
+Original Author: Aric Belsito <[email protected]>
+Signed-off-by: Adam Duskett <[email protected]>
+---
+ src/crypto/crypto_openssl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/crypto/crypto_openssl.c b/src/crypto/crypto_openssl.c
+index 19e0e2b..b3d1b07 100644
+--- a/src/crypto/crypto_openssl.c
++++ b/src/crypto/crypto_openssl.c
+@@ -611,7 +611,7 @@ void crypto_cipher_deinit(struct crypto_cipher *ctx)
+ 
+ void * dh5_init(struct wpabuf **priv, struct wpabuf **publ)
+ {
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ 	DH *dh;
+ 	struct wpabuf *pubkey = NULL, *privkey = NULL;
+ 	size_t publen, privlen;
+@@ -712,7 +712,7 @@ err:
+ 
+ void * dh5_init_fixed(const struct wpabuf *priv, const struct wpabuf *publ)
+ {
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ 	DH *dh;
+ 
+ 	dh = DH_new();
+-- 
+2.13.3
+

new file mode 100644
index 0000000000..5dc2595acf
@@ -0,0 +1,74 @@
+From b02b11af7f0697a43f6c92011eaca7f914bd3bf1 Mon Sep 17 00:00:00 2001
+From: Aric Belsito <[email protected]>
+Date: Fri, 4 Aug 2017 13:06:15 -0400
+Subject: [PATCH] fix libressl support
+
+From: https://github.com/gentoo/libressl/blob/master/media-video/ffmpeg/files/ffmpeg-3.3-libressl.patch
+
+Original author: Aric Belsito <[email protected]>
+Signed-off-by: Adam Duskett <[email protected]>
+---
+ libavformat/tls_openssl.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/libavformat/tls_openssl.c b/libavformat/tls_openssl.c
+index 38af8a2..0599544 100644
+--- a/libavformat/tls_openssl.c
++++ b/libavformat/tls_openssl.c
+@@ -43,7 +43,7 @@ typedef struct TLSContext {
+     TLSShared tls_shared;
+     SSL_CTX *ctx;
+     SSL *ssl;
+-#if OPENSSL_VERSION_NUMBER >= 0x1010000fL
++#if OPENSSL_VERSION_NUMBER >= 0x1010000fL && !defined(LIBRESSL_VERSION_NUMBER)
+     BIO_METHOD* url_bio_method;
+ #endif
+ } TLSContext;
+@@ -68,7 +68,7 @@ static unsigned long openssl_thread_id(void)
+ 
+ static int url_bio_create(BIO *b)
+ {
+-#if OPENSSL_VERSION_NUMBER >= 0x1010000fL
++#if OPENSSL_VERSION_NUMBER >= 0x1010000fL && !defined(LIBRESSL_VERSION_NUMBER)
+     BIO_set_init(b, 1);
+     BIO_set_data(b, NULL);
+     BIO_set_flags(b, 0);
+@@ -85,7 +85,7 @@ static int url_bio_destroy(BIO *b)
+     return 1;
+ }
+ 
+-#if OPENSSL_VERSION_NUMBER >= 0x1010000fL
++#if OPENSSL_VERSION_NUMBER >= 0x1010000fL && !defined(LIBRESSL_VERSION_NUMBER)
+ #define GET_BIO_DATA(x) BIO_get_data(x)
+ #else
+ #define GET_BIO_DATA(x) (x)->ptr
+@@ -129,7 +129,7 @@ static int url_bio_bputs(BIO *b, const char *str)
+     return url_bio_bwrite(b, str, strlen(str));
+ }
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x1010000fL
++#if OPENSSL_VERSION_NUMBER < 0x1010000fL || defined(LIBRESSL_VERSION_NUMBER)
+ static BIO_METHOD url_bio_method = {
+     .type = BIO_TYPE_SOURCE_SINK,
+     .name = "urlprotocol bio",
+@@ -208,7 +208,7 @@ static int tls_close(URLContext *h)
+         SSL_CTX_free(c->ctx);
+     if (c->tls_shared.tcp)
+         ffurl_close(c->tls_shared.tcp);
+-#if OPENSSL_VERSION_NUMBER >= 0x1010000fL
++#if OPENSSL_VERSION_NUMBER >= 0x1010000fL && !defined(LIBRESSL_VERSION_NUMBER)
+     if (c->url_bio_method)
+         BIO_meth_free(c->url_bio_method);
+ #endif
+@@ -266,7 +266,7 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op
+         ret = AVERROR(EIO);
+         goto fail;
+     }
+-#if OPENSSL_VERSION_NUMBER >= 0x1010000fL
++#if OPENSSL_VERSION_NUMBER >= 0x1010000fL && !defined(LIBRESSL_VERSION_NUMBER)
+     p->url_bio_method = BIO_meth_new(BIO_TYPE_SOURCE_SINK, "urlprotocol bio");
+     BIO_meth_set_write(p->url_bio_method, url_bio_bwrite);
+     BIO_meth_set_read(p->url_bio_method, url_bio_bread);
+-- 
+2.13.3
+

new file mode 100644
index 0000000000..8db1e58370
@@ -0,0 +1,68 @@
+From c2c5e05dc606a2f6299245004e222671cc41c625 Mon Sep 17 00:00:00 2001
+From: Adam Duskett <[email protected]>
+Date: Thu, 3 Aug 2017 14:21:14 -0400
+Subject: [PATCH] fix libressl support
+
+When a program checks for openssl 1.1 or higher, it will pass that
+check because libressl sets it's version number to 2.x.
+
+Add simple checks to see if libressl_version_number is defined.
+
+Signed-off-by: Adam Duskett <[email protected]>
+---
+ lib/net_mosq.c         | 2 +-
+ src/mosquitto_passwd.c | 4 ++--
+ src/security_default.c | 2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/lib/net_mosq.c b/lib/net_mosq.c
+index 063c4a2..cdbc83f 100644
+--- a/lib/net_mosq.c
++++ b/lib/net_mosq.c
+@@ -114,7 +114,7 @@ void _mosquitto_net_init(void)
+ void _mosquitto_net_cleanup(void)
+ {
+ #ifdef WITH_TLS
+-	#if OPENSSL_VERSION_NUMBER < 0x10100000L
++	#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ 		ERR_remove_state(0);
+ 	#endif
+ 	ENGINE_cleanup();
+diff --git a/src/mosquitto_passwd.c b/src/mosquitto_passwd.c
+index c3dd05a..6305ee0 100644
+--- a/src/mosquitto_passwd.c
++++ b/src/mosquitto_passwd.c
+@@ -90,7 +90,7 @@ int output_new_password(FILE *fptr, const char *username, const char *password)
+ 	unsigned char hash[EVP_MAX_MD_SIZE];
+ 	unsigned int hash_len;
+ 	const EVP_MD *digest;
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ 	EVP_MD_CTX context;
+ #else
+ 	EVP_MD_CTX *context;
+@@ -117,7 +117,7 @@ int output_new_password(FILE *fptr, const char *username, const char *password)
+ 		return 1;
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ 	EVP_MD_CTX_init(&context);
+ 	EVP_DigestInit_ex(&context, digest, NULL);
+ 	EVP_DigestUpdate(&context, password, strlen(password));
+diff --git a/src/security_default.c b/src/security_default.c
+index 43cd3f0..e307b7a 100644
+--- a/src/security_default.c
++++ b/src/security_default.c
+@@ -790,7 +790,7 @@ int mosquitto_psk_key_get_default(struct mosquitto_db *db, const char *hint, con
+ int _pw_digest(const char *password, const unsigned char *salt, unsigned int salt_len, unsigned char *hash, unsigned int *hash_len)
+ {
+ 	const EVP_MD *digest;
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ 	EVP_MD_CTX context;
+ 
+ 	digest = EVP_get_digestbyname("sha512");
+-- 
+2.13.3
+

new file mode 100644
index 0000000000..7965d78bfe
@@ -0,0 +1,119 @@
+From 349ddeff80bc2188b75ef3a3a9bf65203bcb9d7e Mon Sep 17 00:00:00 2001
+From: Adam Duskett <[email protected]>
+Date: Tue, 17 Oct 2017 21:14:59 -0400
+Subject: [PATCH] fix-libressl-support
+
+When a program checks for openssl 1.1 or higher, it will pass that
+check because libressl sets it's version number to 2.x.
+
+Add simple checks to see if libressl_version_number is defined.
+
+Signed-off-by: Adam Duskett <[email protected]>
+---
+ src/http.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/src/http.c b/src/http.c
+index acd0e8c..f6896c2 100644
+--- a/src/http.c
++++ b/src/http.c
+@@ -1530,7 +1530,7 @@ static long op_bio_retry_ctrl(BIO *_b,int _cmd,long _num,void *_ptr){
+   return ret;
+ }
+ 
+-# if OPENSSL_VERSION_NUMBER<0x10100000L
++# if OPENSSL_VERSION_NUMBER<0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ #  define BIO_set_data(_b,_ptr) ((_b)->ptr=(_ptr))
+ #  define BIO_set_init(_b,_init) ((_b)->init=(_init))
+ #  define ASN1_STRING_get0_data ASN1_STRING_data
+@@ -1538,7 +1538,7 @@ static long op_bio_retry_ctrl(BIO *_b,int _cmd,long _num,void *_ptr){
+ 
+ static int op_bio_retry_new(BIO *_b){
+   BIO_set_init(_b,1);
+-# if OPENSSL_VERSION_NUMBER<0x10100000L
++# if OPENSSL_VERSION_NUMBER<0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+   _b->num=0;
+ # endif
+   BIO_set_data(_b,NULL);
+@@ -1549,7 +1549,7 @@ static int op_bio_retry_free(BIO *_b){
+   return _b!=NULL;
+ }
+ 
+-# if OPENSSL_VERSION_NUMBER<0x10100000L
++# if OPENSSL_VERSION_NUMBER<0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ /*This is not const because OpenSSL doesn't allow it, even though it won't
+    write to it.*/
+ static BIO_METHOD op_bio_retry_method={
+@@ -1570,7 +1570,7 @@ static BIO_METHOD op_bio_retry_method={
+    proxying https URL requests.*/
+ static int op_http_conn_establish_tunnel(OpusHTTPStream *_stream,
+  OpusHTTPConn *_conn,op_sock _fd,SSL *_ssl_conn,BIO *_ssl_bio){
+-# if OPENSSL_VERSION_NUMBER>=0x10100000L
++# if OPENSSL_VERSION_NUMBER>=0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+   BIO_METHOD *bio_retry_method;
+ # endif
+   BIO  *retry_bio;
+@@ -1583,7 +1583,7 @@ static int op_http_conn_establish_tunnel(OpusHTTPStream *_stream,
+   ret=op_http_conn_write_fully(_conn,
+    _stream->proxy_connect.buf,_stream->proxy_connect.nbuf);
+   if(OP_UNLIKELY(ret<0))return ret;
+-# if OPENSSL_VERSION_NUMBER>=0x10100000L
++# if OPENSSL_VERSION_NUMBER>=0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+   bio_retry_method=BIO_meth_new(BIO_TYPE_NULL,"retry");
+   if(bio_retry_method==NULL)return OP_EFAULT;
+   BIO_meth_set_write(bio_retry_method,op_bio_retry_write);
+@@ -1606,7 +1606,7 @@ static int op_http_conn_establish_tunnel(OpusHTTPStream *_stream,
+   /*This shouldn't succeed, since we can't read yet.*/
+   OP_ALWAYS_TRUE(SSL_connect(_ssl_conn)<0);
+   SSL_set_bio(_ssl_conn,_ssl_bio,_ssl_bio);
+-# if OPENSSL_VERSION_NUMBER>=0x10100000L
++# if OPENSSL_VERSION_NUMBER>=0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+   BIO_meth_free(bio_retry_method);
+ # endif
+   /*Only now do we disable write coalescing, to allow the CONNECT
+@@ -1635,7 +1635,7 @@ static struct addrinfo *op_inet_pton(const char *_host){
+   return NULL;
+ }
+ 
+-# if OPENSSL_VERSION_NUMBER<0x10002000L
++# if OPENSSL_VERSION_NUMBER<0x10002000L || defined(LIBRESSL_VERSION_NUMBER)
+ /*Match a host name against a host with a possible wildcard pattern according
+    to the rules of RFC 6125 Section 6.4.3.
+   Return: 0 if the pattern doesn't match, and a non-zero value if it does.*/
+@@ -1893,7 +1893,7 @@ static int op_http_conn_start_tls(OpusHTTPStream *_stream,OpusHTTPConn *_conn,
+   SSL_set_tlsext_host_name(_ssl_conn,_stream->url.host);
+ # endif
+   skip_certificate_check=_stream->skip_certificate_check;
+-# if OPENSSL_VERSION_NUMBER>=0x10002000L
++# if OPENSSL_VERSION_NUMBER>=0x10002000L && !defined(LIBRESSL_VERSION_NUMBER)
+   /*As of version 1.0.2, OpenSSL can finally do hostname checks automatically.
+     Of course, they make it much more complicated than it needs to be.*/
+   if(!skip_certificate_check){
+@@ -1956,13 +1956,13 @@ static int op_http_conn_start_tls(OpusHTTPStream *_stream,OpusHTTPConn *_conn,
+   if(OP_UNLIKELY(ret<=0))return OP_FALSE;
+   ssl_session=_stream->ssl_session;
+   if(ssl_session==NULL
+-# if OPENSSL_VERSION_NUMBER<0x10002000L
++# if OPENSSL_VERSION_NUMBER<0x10002000L || defined(LIBRESSL_VERSION_NUMBER)
+    ||!skip_certificate_check
+ # endif
+    ){
+     ret=op_do_ssl_step(_ssl_conn,_fd,SSL_do_handshake);
+     if(OP_UNLIKELY(ret<=0))return OP_FALSE;
+-# if OPENSSL_VERSION_NUMBER<0x10002000L
++# if OPENSSL_VERSION_NUMBER<0x10002000L || defined(LIBRESSL_VERSION_NUMBER)
+     /*OpenSSL before version 1.0.2 does not do automatic hostname verification,
+        despite the fact that we just passed it the hostname above in the call
+        to SSL_set_tlsext_host_name().
+@@ -2314,7 +2314,7 @@ static int op_http_stream_open(OpusHTTPStream *_stream,const char *_url,
+     /*Initialize the SSL library if necessary.*/
+     if(OP_URL_IS_SSL(&_stream->url)&&_stream->ssl_ctx==NULL){
+       SSL_CTX *ssl_ctx;
+-# if OPENSSL_VERSION_NUMBER<0x10100000L
++# if OPENSSL_VERSION_NUMBER<0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ #  if !defined(OPENSSL_NO_LOCKING)
+       /*The documentation says SSL_library_init() is not reentrant.
+         We don't want to add our own depenencies on a threading library, and it
+-- 
+2.13.6
+

new file mode 100644
index 0000000000..8f3bf5423c
@@ -0,0 +1,104 @@
+From 8093c506228e28c5cc8db9fd90b687004712168b Mon Sep 17 00:00:00 2001
+From: Adam Duskett <[email protected]>
+Date: Thu, 3 Aug 2017 17:09:39 -0400
+Subject: [PATCH] fix libressl support
+
+When a program checks for openssl 1.1 or higher, it will pass that
+check because libressl sets it's version number to 2.x.
+
+Add simple checks to see if libressl_version_number is defined.
+
+Signed-off-by: Adam Duskett <[email protected]>
+---
+ libraries/libldap/tls_o.c | 23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
+index 2025c9f..41faf0d 100644
+--- a/libraries/libldap/tls_o.c
++++ b/libraries/libldap/tls_o.c
+@@ -47,7 +47,7 @@
+ #include <ssl.h>
+ #endif
+ 
+-#if OPENSSL_VERSION_NUMBER >= 0x10100000
++#if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
+ #define ASN1_STRING_data(x)	ASN1_STRING_get0_data(x)
+ #endif
+ 
+@@ -157,7 +157,7 @@ tlso_init( void )
+ 	(void) tlso_seed_PRNG( lo->ldo_tls_randfile );
+ #endif
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x10100000
++#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(LIBRESSL_VERSION_NUMBER)
+ 	SSL_load_error_strings();
+ 	SSL_library_init();
+ 	OpenSSL_add_all_digests();
+@@ -205,7 +205,7 @@ static void
+ tlso_ctx_ref( tls_ctx *ctx )
+ {
+ 	tlso_ctx *c = (tlso_ctx *)ctx;
+-#if OPENSSL_VERSION_NUMBER < 0x10100000
++#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(LIBRESSL_VERSION_NUMBER)
+ #define	SSL_CTX_up_ref(ctx)	CRYPTO_add( &(ctx->references), 1, CRYPTO_LOCK_SSL_CTX )
+ #endif
+ 	SSL_CTX_up_ref( c );
+@@ -464,7 +464,7 @@ tlso_session_my_dn( tls_session *sess, struct berval *der_dn )
+ 	if (!x) return LDAP_INVALID_CREDENTIALS;
+ 	
+ 	xn = X509_get_subject_name(x);
+-#if OPENSSL_VERSION_NUMBER < 0x10100000
++#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(LIBRESSL_VERSION_NUMBER)
+ 	der_dn->bv_len = i2d_X509_NAME( xn, NULL );
+ 	der_dn->bv_val = xn->bytes->data;
+ #else
+@@ -500,7 +500,7 @@ tlso_session_peer_dn( tls_session *sess, struct berval *der_dn )
+ 		return LDAP_INVALID_CREDENTIALS;
+ 
+ 	xn = X509_get_subject_name(x);
+-#if OPENSSL_VERSION_NUMBER < 0x10100000
++#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(LIBRESSL_VERSION_NUMBER)
+ 	der_dn->bv_len = i2d_X509_NAME( xn, NULL );
+ 	der_dn->bv_val = xn->bytes->data;
+ #else
+@@ -721,7 +721,7 @@ struct tls_data {
+ 	Sockbuf_IO_Desc		*sbiod;
+ };
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x10100000
++#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(LIBRESSL_VERSION_NUMBER)
+ #define BIO_set_init(b, x)	b->init = x
+ #define BIO_set_data(b, x)	b->ptr = x
+ #define BIO_clear_flags(b, x)	b->flags &= ~(x)
+@@ -822,7 +822,7 @@ tlso_bio_puts( BIO *b, const char *str )
+ 	return tlso_bio_write( b, str, strlen( str ) );
+ }
+ 
+-#if OPENSSL_VERSION_NUMBER >= 0x10100000
++#if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
+ struct bio_method_st {
+     int type;
+     const char *name;
+@@ -1187,10 +1187,17 @@ tlso_seed_PRNG( const char *randfile )
+ 		 */
+ 		randfile = RAND_file_name( buffer, sizeof( buffer ) );
+ 
+-	} else if (RAND_egd(randfile) > 0) {
++	} 
++	#ifndef OPENSSL_NO_EGD
++	else if (RAND_egd(randfile) > 0) {
+ 		/* EGD socket */
+ 		return 0;
+ 	}
++	#else
++	else {
++		return 0;
++	}
++	#endif
+ 
+ 	if (randfile == NULL) {
+ 		Debug( LDAP_DEBUG_ANY,
+-- 
+2.13.3
+

new file mode 100644
index 0000000000..0fafa4ae0b
@@ -0,0 +1,54 @@
+From aad28d30af6c3a74c522dd61943788e908860c84 Mon Sep 17 00:00:00 2001
+From: Adam Duskett <[email protected]>
+Date: Fri, 4 Aug 2017 07:22:47 -0400
+Subject: [PATCH] fix libressl support
+
+heirloom-mailx has two small issues when compiling against LibreSSL:
+  - RAND_egd is used (LibreSSL does not support RAND_egd)
+    Solution: "Guard" the code calling RAND_egd
+
+  - SSLv3_client_method function is used (LibreSSL does not support SSLv3)
+    Solution: "Guard" the code with #ifndef OPENSSL_NO_SSL3
+
+Signed-off-by: Adam Duskett <[email protected]>
+---
+ openssl.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/openssl.c b/openssl.c
+index 44fe4e5..c4a1bb7 100644
+--- a/openssl.c
++++ b/openssl.c
+@@ -137,11 +137,13 @@ ssl_rand_init(void)
+ 
+ 	if ((cp = value("ssl-rand-egd")) != NULL) {
+ 		cp = expand(cp);
++#ifndef OPENSSL_NO_EGD
+ 		if (RAND_egd(cp) == -1) {
+ 			fprintf(stderr, catgets(catd, CATSET, 245,
+ 				"entropy daemon at \"%s\" not available\n"),
+ 					cp);
+ 		} else
++#endif
+ 			state = 1;
+ 	} else if ((cp = value("ssl-rand-file")) != NULL) {
+ 		cp = expand(cp);
+@@ -216,10 +218,15 @@ ssl_select_method(const char *uhp)
+ 
+ 	cp = ssl_method_string(uhp);
+ 	if (cp != NULL) {
++		#ifndef OPENSSL_NO_SSL3
+ 		if (equal(cp, "ssl3"))
+ 			method = SSLv3_client_method();
+ 		else if (equal(cp, "tls1"))
+ 			method = TLSv1_client_method();
++		#else
++		if (equal(cp, "tls1"))
++			method = TLSv1_client_method();
++		#endif
+ 		else {
+ 			fprintf(stderr, catgets(catd, CATSET, 244,
+ 					"Invalid SSL method \"%s\"\n"), cp);
+-- 
+2.13.3
+

new file mode 100644
index 0000000000..ff4ecc3e8a
@@ -0,0 +1,31 @@
+From 10ca825cf8f52b14b6230db7de5e5df307212499 Mon Sep 17 00:00:00 2001
+From: Adam Duskett <[email protected]>
+Date: Wed, 2 Aug 2017 11:38:11 -0400
+Subject: [PATCH 1/1] add libressl support
+
+When a program checks for openssl 1.1 or higher, it will pass that
+check because libressl sets it's version number to 2.x.
+
+Add simple checks to see if libressl_version_number is defined.
+
+Signed-off-by: Adam Duskett <[email protected]>
+---
+ openssl-compat.h                     | 2 +-
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/openssl-compat.h b/openssl-compat.h
+index 69afc71..937fa4d 100644
+--- a/openssl-compat.h
++++ b/openssl-compat.h
+@@ -1,7 +1,7 @@
+ #ifndef OPENSSL_COMPAT_H
+ #define OPENSSL_COMPAT_H
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
+ 
+ static inline BIO_METHOD *BIO_meth_new(int type, const char *name)
+ {
+-- 
+2.13.3
+

new file mode 100644
index 0000000000..d6706ad48d
@@ -0,0 +1,70 @@
+From fd08ab1edce039ebefd305f7d8241cef6e4a397c Mon Sep 17 00:00:00 2001
+From: Stephan Raue <[email protected]>
+Date: Fri, 4 Aug 2017 12:51:58 -0400
+Subject: [PATCH] fix libressl support
+
+From: https://github.com/OpenELEC/OpenELEC.tv/blob/master/packages/network/wpa_supplicant/patches/wpa_supplicant-libressl.patch
+
+Original author: Stephan Raue <[email protected]>
+Signed-off-by: Adam Duskett <[email protected]>
+---
+ src/crypto/crypto_openssl.c | 4 ++--
+ src/crypto/tls_openssl.c    | 6 +++---
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/src/crypto/crypto_openssl.c b/src/crypto/crypto_openssl.c
+index 19e0e2b..b3d1b07 100644
+--- a/src/crypto/crypto_openssl.c
++++ b/src/crypto/crypto_openssl.c
+@@ -611,7 +611,7 @@ void crypto_cipher_deinit(struct crypto_cipher *ctx)
+ 
+ void * dh5_init(struct wpabuf **priv, struct wpabuf **publ)
+ {
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ 	DH *dh;
+ 	struct wpabuf *pubkey = NULL, *privkey = NULL;
+ 	size_t publen, privlen;
+@@ -712,7 +712,7 @@ err:
+ 
+ void * dh5_init_fixed(const struct wpabuf *priv, const struct wpabuf *publ)
+ {
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ 	DH *dh;
+ 
+ 	dh = DH_new();
+diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
+index 23ac64b..8ddcb7e 100644
+--- a/src/crypto/tls_openssl.c
++++ b/src/crypto/tls_openssl.c
+@@ -919,7 +919,7 @@ void * tls_init(const struct tls_config *conf)
+ 		}
+ #endif /* OPENSSL_FIPS */
+ #endif /* CONFIG_FIPS */
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ 		SSL_load_error_strings();
+ 		SSL_library_init();
+ #ifndef OPENSSL_NO_SHA256
+@@ -1043,7 +1043,7 @@ void tls_deinit(void *ssl_ctx)
+ 
+ 	tls_openssl_ref_count--;
+ 	if (tls_openssl_ref_count == 0) {
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ #ifndef OPENSSL_NO_ENGINE
+ 		ENGINE_cleanup();
+ #endif /* OPENSSL_NO_ENGINE */
+@@ -3976,7 +3976,7 @@ int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
+ 		engine_id = "pkcs11";
+ 
+ #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ 	if (params->flags & TLS_CONN_EAP_FAST) {
+ 		wpa_printf(MSG_DEBUG,
+ 			   "OpenSSL: Use TLSv1_method() for EAP-FAST");
+-- 
+2.13.3
+

index f712e7988e..735284c7a3 100644
@@ -19,6 +19,18 @@ define CA_CERTIFICATES_BUILD_CMDS
 	$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) all
 endef
 
+ifeq ($(BR2_PACKAGE_LIBOPENSSL),y)
+define CA_CERTIFICATES_CREATE_SYMLINKS
+	$(HOST_DIR)/bin/c_rehash $(TARGET_DIR)/etc/ssl/certs
+endef
+endif
+
+ifeq ($(BR2_PACKAGE_LIBRESSL),y)
+define CA_CERTIFICATES_CREATE_SYMLINKS
+	$(HOST_DIR)/bin/openssl certhash $(TARGET_DIR)/etc/ssl/certs
+endef
+endif
+
 define CA_CERTIFICATES_INSTALL_TARGET_CMDS
 	$(INSTALL) -d -m 0755 $(TARGET_DIR)/usr/share/ca-certificates
 	$(INSTALL) -d -m 0755 $(TARGET_DIR)/etc/ssl/certs

@@ -37,7 +49,7 @@ define CA_CERTIFICATES_INSTALL_TARGET_CMDS
 	done
 
 	# Create symlinks to the certificates by their hash values
-	$(HOST_DIR)/bin/c_rehash $(TARGET_DIR)/etc/ssl/certs
+	$(CA_CERTIFICATES_CREATE_SYMLINKS)
 endef
 
 $(eval $(generic-package))

index c763f48ab1..ef34cee3f0 100644
@@ -33,6 +33,11 @@ endif
 ifeq ($(BR2_PACKAGE_OPENSSL),y)
 MOSQUITTO_DEPENDENCIES += openssl
 MOSQUITTO_MAKE_OPTS += WITH_TLS=yes
+ifeq ($(BR2_PACKAGE_LIBOPENSSL),y)
+MOSQUITTO_MAKE_OPTS += WITH_TLS_PSK=yes
+else ifeq ($(BR2_PACKAGE_LIBRESSL),y)
+MOSQUITTO_MAKE_OPTS += WITH_TLS_PSK=no
+endif
 else
 MOSQUITTO_MAKE_OPTS += WITH_TLS=no
 endif

index d4cf62708a..94004098d1 100644
@@ -1029,8 +1029,6 @@ menu "Crypto"
 	source "package/libuecc/Config.in"
 	source "package/mbedtls/Config.in"
 	source "package/nettle/Config.in"
-	# libressl is a openssl replacement
-	source "package/libressl/Config.in"
 	source "package/openssl/Config.in"
 	source "package/rhash/Config.in"
 	source "package/tinydtls/Config.in"

deleted file mode 100644
index 0a1c9e273e..0000000000
@@ -1,20 +0,0 @@
-config BR2_PACKAGE_LIBRESSL
-	bool "libressl"
-	depends on !BR2_PACKAGE_OPENSSL
-	help
-	  LibreSSL is a version of the TLS/crypto stack forked from
-	  OpenSSL in 2014, with goals of modernizing the codebase,
-	  improving security, and applying best practice development
-	  processes.
-
-	  http://www.libressl.org/
-
-if BR2_PACKAGE_LIBRESSL
-
-config BR2_PACKAGE_LIBRESSL_BIN
-	bool "openssl binary"
-	help
-	  Install the openssl binary to the target file system. This is
-	  a command line tool for doing various cryptographic stuff.
-
-endif

index 1b3e852fdb..5cb2c5b758 100644
@@ -9,7 +9,7 @@ choice
 	prompt "ssl library"
 	default BR2_PACKAGE_LIBOPENSSL
 	help
-	  Select OpenSSL.
+	  Select OpenSSL or LibreSSL.
 
 config BR2_PACKAGE_LIBOPENSSL
 	bool "openssl"

@@ -41,6 +41,26 @@ config BR2_PACKAGE_LIBOPENSSL_ENGINES
 
 endif
 
+config BR2_PACKAGE_LIBRESSL
+	bool "libressl"
+	help
+	  LibreSSL is a version of the TLS/crypto stack forked from
+	  OpenSSL in 2014, with goals of modernizing the codebase,
+	  improving security, and applying best practice development
+	  processes.
+
+	  http://www.libressl.org/
+
+if BR2_PACKAGE_LIBRESSL
+
+config BR2_PACKAGE_LIBRESSL_BIN
+	bool "openssl binary"
+	help
+	  Install the openssl binary to the target file system. This is
+	  a command line tool for doing various cryptographic stuff.
+
+endif
+
 endchoice
 
 config BR2_PACKAGE_HAS_OPENSSL

@@ -49,4 +69,5 @@ config BR2_PACKAGE_HAS_OPENSSL
 config BR2_PACKAGE_PROVIDES_OPENSSL
 	string
 	default "libopenssl"  if BR2_PACKAGE_LIBOPENSSL
+	default "libressl"  if BR2_PACKAGE_LIBRESSL
 endif