Add LibreSSL support

PATCH Ruslan Babayev 3 participants 7 messages Nov 3, 2015 – Nov 4, 2015

lore

Share & tools

lore

Ruslan Babayev

author

2015-11-03 22:34 UTC #0 lore raw

Please find attached the patch to add support for LibreSSL.

OpenSSL is still preferred, so you'd have add these to your local.conf

PREFERRED_PROVIDER_openssl ?= "openssl" PREFERRED_PROVIDER_openssl-native ?= "openssl-native" PREFERRED_PROVIDER_nativesdk-openssl ?= "nativesdk-openssl"

From db63d8224c0779d6de466014adf10e0a092a210c Mon Sep 17 00:00:00 2001
From: Ruslan Babayev <[email protected]>
Date: Mon, 2 Nov 2015 17:56:27 -0800
Subject: [PATCH] Add LibreSSL

---
 meta/conf/distro/include/default-providers.inc       |  3 +++
 .../libressl/files/gnuc_prereq.patch                 | 13 +++++++++++++
 meta/recipes-connectivity/libressl/libressl.inc      | 20 ++++++++++++++++++++
 meta/recipes-connectivity/libressl/libressl_2.2.4.bb |  6 ++++++
 4 files changed, 42 insertions(+)
 create mode 100644 meta/recipes-connectivity/libressl/files/gnuc_prereq.patch
 create mode 100644 meta/recipes-connectivity/libressl/libressl.inc
 create mode 100644 meta/recipes-connectivity/libressl/libressl_2.2.4.bb

meta/conf/distro/include/default-providers.inc +3 -0

index 9f84d5c..205f1cd 100644
@@ -49,3 +49,6 @@ PREFERRED_PROVIDER_bluez-hcidump ?= "${@bb.utils.contains('DISTRO_FEATURES','blu
 # Alternative is ltp-ddt in meta-oe: meta-oe/recipes-devtools/ltp-ddt/ltp-ddt_0.0.4.bb
 PREFERRED_PROVIDER_ltp ?= "ltp"
 PREFERRED_PROVIDER_getopt ?= "util-linux-getopt"
+PREFERRED_PROVIDER_openssl ?= "openssl"
+PREFERRED_PROVIDER_openssl-native ?= "openssl-native"
+PREFERRED_PROVIDER_nativesdk-openssl ?= "nativesdk-openssl"

meta/recipes-connectivity/libressl/files/gnuc_prereq.patch new file +13 -0

new file mode 100644
index 0000000..61fa51a
@@ -0,0 +1,13 @@
+Index: libressl-2.2.4/crypto/bn/bn_lcl.h
+===================================================================
+--- libressl-2.2.4.orig/crypto/bn/bn_lcl.h
++++ libressl-2.2.4/crypto/bn/bn_lcl.h
+@@ -259,7 +259,7 @@ extern "C" {
+ #  endif
+ # elif defined(__mips) && defined(_LP64)
+ #  if defined(__GNUC__) && __GNUC__>=2
+-#   if __GNUC__>=4 && __GNUC_MINOR__>=4 /* "h" constraint is no more since 4.4 */
++#   if __GNUC_PREREQ(4,4) /* "h" constraint is no more since 4.4 */
+ #     define BN_UMULT_HIGH(a,b)		 (((__uint128_t)(a)*(b))>>64)
+ #     define BN_UMULT_LOHI(low,high,a,b) ({	\
+ 	__uint128_t ret=(__uint128_t)(a)*(b);	\

meta/recipes-connectivity/libressl/libressl.inc new file +20 -0

new file mode 100644
index 0000000..d0acdc4
@@ -0,0 +1,20 @@
+SUMMARY = "LibreSSL fork of OpenSSL"
+DESCRIPTION = "Secure Socket Layer (SSL) binary and related cryptographic tools."
+HOMEPAGE = "http://www.libressl.org/"
+SECTION = "libs/network"
+
+LICENSE = "openssl"
+LIC_FILES_CHKSUM = "file://COPYING;md5=01f9bb4d275f5eeea905377bef3de622"
+
+SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${PV}.tar.gz"
+
+S = "${WORKDIR}/libressl-${PV}"
+
+inherit pkgconfig autotools
+
+PROVIDES += "openssl"
+
+RPROVIDES_${PN} += "openssl"
+RCONFLICTS_${PN} += "openssl"
+
+BBCLASSEXTEND = "native nativesdk"

meta/recipes-connectivity/libressl/libressl_2.2.4.bb new file +6 -0

new file mode 100644
index 0000000..f2f6fc2
@@ -0,0 +1,6 @@
+require libressl.inc
+
+SRC_URI += " file://gnuc_prereq.patch"
+
+SRC_URI[md5sum] = "bae037598bd63987666302f9644de237"
+SRC_URI[sha256sum] = "6b409859be8654afc3862549494e097017e64c8d167f12584383586306ef9a7e"

Signature · 1 line

2.6.2

Burton, Ross

2015-11-03 22:38 UTC #1 lore raw

Quoted 2 lines · Ruslan Babayev

Please find attached the patch to add support for LibreSSL.

I think I'd prefer oe-core to have just the one provider of the openssl APIs, so if oe-core sticks with openssl then libressl should go into another layer, meta-networking maybe?

Ross

Ruslan Babayev

author

2015-11-03 23:14 UTC #2 lore raw

Quoted 5 lines · Ross

I think I'd prefer oe-core to have just the one provider of the openssl APIs, so if oe-core sticks with openssl then libressl should go into another layer, meta-networking maybe?

Thanks for feedback Ross. Moved it to meta-networking.

From 5b41fed5cea2123bffd13c0d724c4ff75e8a5d8a Mon Sep 17 00:00:00 2001
From: Ruslan Babayev <[email protected]>
Date: Tue, 3 Nov 2015 15:08:34 -0800
Subject: [PATCH] meta-networking: recipes-connectivity: add libressl recipe

Signed-off-by Ruslan Babayev <[email protected]>

---
 .../libressl/files/gnuc_prereq.patch                 | 13 +++++++++++++
 .../recipes-connectivity/libressl/libressl.inc       | 20 ++++++++++++++++++++
 .../recipes-connectivity/libressl/libressl_2.2.4.bb  |  6 ++++++
 3 files changed, 39 insertions(+)
 create mode 100644 meta-networking/recipes-connectivity/libressl/files/gnuc_prereq.patch
 create mode 100644 meta-networking/recipes-connectivity/libressl/libressl.inc
 create mode 100644 meta-networking/recipes-connectivity/libressl/libressl_2.2.4.bb

meta-networking/recipes-connectivity/libressl/files/gnuc_prereq.patch new file +13 -0

new file mode 100644
index 0000000..61fa51a
@@ -0,0 +1,13 @@
+Index: libressl-2.2.4/crypto/bn/bn_lcl.h
+===================================================================
+--- libressl-2.2.4.orig/crypto/bn/bn_lcl.h
++++ libressl-2.2.4/crypto/bn/bn_lcl.h
+@@ -259,7 +259,7 @@ extern "C" {
+ #  endif
+ # elif defined(__mips) && defined(_LP64)
+ #  if defined(__GNUC__) && __GNUC__>=2
+-#   if __GNUC__>=4 && __GNUC_MINOR__>=4 /* "h" constraint is no more since 4.4 */
++#   if __GNUC_PREREQ(4,4) /* "h" constraint is no more since 4.4 */
+ #     define BN_UMULT_HIGH(a,b)		 (((__uint128_t)(a)*(b))>>64)
+ #     define BN_UMULT_LOHI(low,high,a,b) ({	\
+ 	__uint128_t ret=(__uint128_t)(a)*(b);	\

meta-networking/recipes-connectivity/libressl/libressl.inc new file +20 -0

new file mode 100644
index 0000000..d0acdc4
@@ -0,0 +1,20 @@
+SUMMARY = "LibreSSL fork of OpenSSL"
+DESCRIPTION = "Secure Socket Layer (SSL) binary and related cryptographic tools."
+HOMEPAGE = "http://www.libressl.org/"
+SECTION = "libs/network"
+
+LICENSE = "openssl"
+LIC_FILES_CHKSUM = "file://COPYING;md5=01f9bb4d275f5eeea905377bef3de622"
+
+SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${PV}.tar.gz"
+
+S = "${WORKDIR}/libressl-${PV}"
+
+inherit pkgconfig autotools
+
+PROVIDES += "openssl"
+
+RPROVIDES_${PN} += "openssl"
+RCONFLICTS_${PN} += "openssl"
+
+BBCLASSEXTEND = "native nativesdk"

meta-networking/recipes-connectivity/libressl/libressl_2.2.4.bb new file +6 -0

new file mode 100644
index 0000000..f2f6fc2
@@ -0,0 +1,6 @@
+require libressl.inc
+
+SRC_URI += " file://gnuc_prereq.patch"
+
+SRC_URI[md5sum] = "bae037598bd63987666302f9644de237"
+SRC_URI[sha256sum] = "6b409859be8654afc3862549494e097017e64c8d167f12584383586306ef9a7e"

Signature · 1 line

2.6.2

Ruslan Babayev

author

2015-11-03 22:39 UTC #3 lore raw

In reply to Ruslan Babayev

Sorry I meant this:

PREFERRED_PROVIDER_openssl ?= "libressl" PREFERRED_PROVIDER_openssl-native ?= "libressl-native" PREFERRED_PROVIDER_nativesdk-openssl ?= "nativesdk-libressl"

Quoted 7 lines · Ruslan Babayev

Please find attached the patch to add support for LibreSSL.
OpenSSL is still preferred, so you'd have add these to your local.conf
PREFERRED_PROVIDER_openssl ?= "openssl" PREFERRED_PROVIDER_openssl-native ?= "openssl-native" PREFERRED_PROVIDER_nativesdk-openssl ?= "nativesdk-openssl"

akuster808

2015-11-03 23:28 UTC #4 lore raw

In reply to Ruslan Babayev

Ruslan,

any reason version 2.3.1 was not picked?

I believe 2.2.4 is missing (CVE-2015-5333 and CVE-2015-5334)

- armin

Quoted 10 lines · Ruslan Babayev

Please find attached the patch to add support for LibreSSL.
OpenSSL is still preferred, so you'd have add these to your local.conf
PREFERRED_PROVIDER_openssl ?= "openssl" PREFERRED_PROVIDER_openssl-native ?= "openssl-native" PREFERRED_PROVIDER_nativesdk-openssl ?= "nativesdk-openssl"

Ruslan Babayev

author

2015-11-03 23:53 UTC #5 lore raw

Hi Armin,

It is the latest stable. And it looks like this patch has made it into 2.2.4

http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/007_obj2txt.patch.sig

Quoted 19 lines · akuster808 writes:

Ruslan,
any reason version 2.3.1 was not picked?
I believe 2.2.4 is missing (CVE-2015-5333 and CVE-2015-5334)
- armin
Quoted 10 lines · Ruslan Babayev
Please find attached the patch to add support for LibreSSL.
OpenSSL is still preferred, so you'd have add these to your local.conf
PREFERRED_PROVIDER_openssl ?= "openssl" PREFERRED_PROVIDER_openssl-native ?= "openssl-native" PREFERRED_PROVIDER_nativesdk-openssl ?= "nativesdk-openssl"

akuster808

2015-11-04 00:46 UTC #6 lore raw

Ruslan,

Quoted 4 lines · Ruslan Babayev

Hi Armin,
It is the latest stable. And it looks like this patch has made it into 2.2.4

Thanks for double checking.

- armin

Quoted 24 lines

http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/007_obj2txt.patch.sig
Quoted 19 lines · akuster808 writes:
Ruslan,
any reason version 2.3.1 was not picked?
I believe 2.2.4 is missing (CVE-2015-5333 and CVE-2015-5334)
- armin
Quoted 10 lines · Ruslan Babayev
Please find attached the patch to add support for LibreSSL.
OpenSSL is still preferred, so you'd have add these to your local.conf
PREFERRED_PROVIDER_openssl ?= "openssl" PREFERRED_PROVIDER_openssl-native ?= "openssl-native" PREFERRED_PROVIDER_nativesdk-openssl ?= "nativesdk-openssl"