From 4303a92337ecbc57cbd49e718eaf66792ba7c42c Mon Sep 17 00:00:00 2001 From: CN_SZTL Date: Sat, 14 Mar 2020 02:50:12 +0800 Subject: [PATCH] openssl: bump to v1.1.1e-dev --- package/libs/openssl/Config.in | 4 +++- package/libs/openssl/Makefile | 22 +++++++++---------- .../patches/100-Configure-afalg-support.patch | 4 +--- .../openssl/patches/110-openwrt_targets.patch | 3 --- .../120-strip-cflags-from-binary.patch | 4 +--- .../patches/130-dont-build-tests-fuzz.patch | 6 ++--- .../patches/140-allow-prefer-chacha20.patch | 8 ++----- ...o-save-ioctl-if-EVP_MD_.FLAG_ONESHOT.patch | 6 ++--- ..._devcrypto-add-configuration-options.patch | 21 ++++++++---------- ...ypto-add-command-to-dump-driver-info.patch | 16 ++++++-------- ...o-make-the-dev-crypto-engine-dynamic.patch | 2 +- ...default-to-not-use-digests-in-engine.patch | 4 +--- ...to-ignore-error-when-closing-session.patch | 4 +--- 13 files changed, 40 insertions(+), 64 deletions(-) diff --git a/package/libs/openssl/Config.in b/package/libs/openssl/Config.in index 20b2e597bf..ecfd2834b6 100644 --- a/package/libs/openssl/Config.in +++ b/package/libs/openssl/Config.in @@ -40,7 +40,7 @@ config OPENSSL_WITH_SSE2 bool default y if x86_64 || i386 && !TARGET_x86_legacy prompt "Enable use of x86 SSE2 instructions" - depends on OPENSSL_WITH_ASM && i386 + depends on OPENSSL_WITH_ASM && x86_64 || i386 help Use of SSE2 instructions greatly increase performance (up to 3x faster) with a minimum (~0.2%, or 23KB) increase in package @@ -234,6 +234,7 @@ comment "Engine/Hardware Support" config OPENSSL_ENGINE bool "Enable engine support" default y + select PACKAGE_libopenssl-devcrypto help This enables alternative cryptography implementations, most commonly for interfacing with external crypto devices, @@ -267,6 +268,7 @@ config OPENSSL_ENGINE_BUILTIN_AFALG config OPENSSL_ENGINE_BUILTIN_DEVCRYPTO bool + default y prompt "Acceleration support through /dev/crypto" depends on OPENSSL_ENGINE_BUILTIN select PACKAGE_libopenssl-conf diff --git a/package/libs/openssl/Makefile b/package/libs/openssl/Makefile index ca393be88f..5c154a9054 100644 --- a/package/libs/openssl/Makefile +++ b/package/libs/openssl/Makefile @@ -9,23 +9,21 @@ include $(TOPDIR)/rules.mk PKG_NAME:=openssl PKG_BASE:=1.1.1 -PKG_BUGFIX:=d +PKG_BUGFIX:=e-dev PKG_VERSION:=$(PKG_BASE)$(PKG_BUGFIX) -PKG_RELEASE:=3 +PKG_RELEASE:=2 + +PKG_SOURCE_PROTO:=git +PKG_SOURCE_URL:=https://github.com/openssl/openssl.git +PKG_SOURCE_VERSION:=22623e0cc26a11908253206a721873d4101cd466 +PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION) +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz +PKG_HASH:=63006d1af7096683206b617667d5f5b00f1f9e3cb82ca25e00e7f01319a4abb4 + PKG_USE_MIPS16:=0 ENGINES_DIR=engines-1.1 - PKG_BUILD_PARALLEL:=1 -PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz -PKG_SOURCE_URL:= \ - http://ftp.fi.muni.cz/pub/openssl/source/ \ - http://ftp.linux.hr/pub/openssl/source/ \ - ftp://ftp.pca.dfn.de/pub/tools/net/openssl/source/ \ - http://www.openssl.org/source/ \ - http://www.openssl.org/source/old/$(PKG_BASE)/ -PKG_HASH:=1e3a91bc1f9dfce01af26026f856e064eab4c8ee0a8f457b5ae30b40b8b711f2 - PKG_LICENSE:=OpenSSL PKG_LICENSE_FILES:=LICENSE PKG_MAINTAINER:=Eneas U de Queiroz diff --git a/package/libs/openssl/patches/100-Configure-afalg-support.patch b/package/libs/openssl/patches/100-Configure-afalg-support.patch index 0f91a9d5da..457e238959 100644 --- a/package/libs/openssl/patches/100-Configure-afalg-support.patch +++ b/package/libs/openssl/patches/100-Configure-afalg-support.patch @@ -8,11 +8,9 @@ version to disable building the AFALG engine on openwrt targets. Signed-off-by: Eneas U de Queiroz -diff --git a/Configure b/Configure -index 5a699836f3..74d057c219 100755 --- a/Configure +++ b/Configure -@@ -1532,7 +1532,9 @@ unless ($disabled{"crypto-mdebug-backtrace"}) +@@ -1532,7 +1532,9 @@ unless ($disabled{"crypto-mdebug-backtra unless ($disabled{afalgeng}) { $config{afalgeng}=""; diff --git a/package/libs/openssl/patches/110-openwrt_targets.patch b/package/libs/openssl/patches/110-openwrt_targets.patch index d0530b4661..b2786e8fee 100644 --- a/package/libs/openssl/patches/110-openwrt_targets.patch +++ b/package/libs/openssl/patches/110-openwrt_targets.patch @@ -7,9 +7,6 @@ Targets are named: linux-$(CONFIG_ARCH)-openwrt Signed-off-by: Eneas U de Queiroz -diff --git a/Configurations/25-openwrt.conf b/Configurations/25-openwrt.conf -new file mode 100644 -index 0000000000..86a86d31e4 --- /dev/null +++ b/Configurations/25-openwrt.conf @@ -0,0 +1,48 @@ diff --git a/package/libs/openssl/patches/120-strip-cflags-from-binary.patch b/package/libs/openssl/patches/120-strip-cflags-from-binary.patch index 7faec9ab88..4a7dce366b 100644 --- a/package/libs/openssl/patches/120-strip-cflags-from-binary.patch +++ b/package/libs/openssl/patches/120-strip-cflags-from-binary.patch @@ -8,11 +8,9 @@ OpenSSL_version(OPENSSL_CFLAGS), or running openssl version -a Signed-off-by: Eneas U de Queiroz -diff --git a/crypto/build.info b/crypto/build.info -index 2c619c62e8..893128345a 100644 --- a/crypto/build.info +++ b/crypto/build.info -@@ -10,7 +10,7 @@ EXTRA= ../ms/uplink-x86.pl ../ms/uplink.c ../ms/applink.c \ +@@ -10,7 +10,7 @@ EXTRA= ../ms/uplink-x86.pl ../ms/uplink ppccpuid.pl pariscid.pl alphacpuid.pl arm64cpuid.pl armv4cpuid.pl DEPEND[cversion.o]=buildinf.h diff --git a/package/libs/openssl/patches/130-dont-build-tests-fuzz.patch b/package/libs/openssl/patches/130-dont-build-tests-fuzz.patch index fa79cc6022..98d1865aed 100644 --- a/package/libs/openssl/patches/130-dont-build-tests-fuzz.patch +++ b/package/libs/openssl/patches/130-dont-build-tests-fuzz.patch @@ -7,11 +7,9 @@ This shortens build time. Signed-off-by: Eneas U de Queiroz -diff --git a/Configure b/Configure -index 74d057c219..5813e9f8fe 100755 --- a/Configure +++ b/Configure -@@ -296,7 +296,7 @@ my $auto_threads=1; # enable threads automatically? true by default +@@ -308,7 +308,7 @@ my $auto_threads=1; # enable threads my $default_ranlib; # Top level directories to build @@ -20,7 +18,7 @@ index 74d057c219..5813e9f8fe 100755 # crypto/ subdirectories to build $config{sdirs} = [ "objects", -@@ -308,7 +308,7 @@ $config{sdirs} = [ +@@ -320,7 +320,7 @@ $config{sdirs} = [ "cms", "ts", "srp", "cmac", "ct", "async", "kdf", "store" ]; # test/ subdirectories to build diff --git a/package/libs/openssl/patches/140-allow-prefer-chacha20.patch b/package/libs/openssl/patches/140-allow-prefer-chacha20.patch index b293db28f7..71c7c72881 100644 --- a/package/libs/openssl/patches/140-allow-prefer-chacha20.patch +++ b/package/libs/openssl/patches/140-allow-prefer-chacha20.patch @@ -14,8 +14,6 @@ when the client has it on top of its ciphersuite preference. Signed-off-by: Eneas U de Queiroz -diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h -index 6724ccf2d2..96d959427e 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h @@ -173,9 +173,15 @@ extern "C" { @@ -37,11 +35,9 @@ index 6724ccf2d2..96d959427e 100644 # else # define TLS_DEFAULT_CIPHERSUITES "TLS_AES_256_GCM_SHA384:" \ "TLS_AES_128_GCM_SHA256" -diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c -index 27a1b2ec68..7039811323 100644 --- a/ssl/ssl_ciph.c +++ b/ssl/ssl_ciph.c -@@ -1467,11 +1467,29 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, +@@ -1467,11 +1467,29 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_ ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail); @@ -71,7 +67,7 @@ index 27a1b2ec68..7039811323 100644 /* * ...and generally, our preferred cipher is AES. -@@ -1527,7 +1545,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, +@@ -1527,7 +1545,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_ * Within each group, ciphers remain sorted by strength and previous * preference, i.e., * 1) ECDHE > DHE diff --git a/package/libs/openssl/patches/400-eng_devcrypto-save-ioctl-if-EVP_MD_.FLAG_ONESHOT.patch b/package/libs/openssl/patches/400-eng_devcrypto-save-ioctl-if-EVP_MD_.FLAG_ONESHOT.patch index 84c68b16a2..57962ec9c7 100644 --- a/package/libs/openssl/patches/400-eng_devcrypto-save-ioctl-if-EVP_MD_.FLAG_ONESHOT.patch +++ b/package/libs/openssl/patches/400-eng_devcrypto-save-ioctl-if-EVP_MD_.FLAG_ONESHOT.patch @@ -14,8 +14,6 @@ Reviewed-by: Matthias St. Pierre Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/7585) -diff --git a/crypto/engine/eng_devcrypto.c b/crypto/engine/eng_devcrypto.c -index a727c6f646..a2c9a966f7 100644 --- a/crypto/engine/eng_devcrypto.c +++ b/crypto/engine/eng_devcrypto.c @@ -461,6 +461,7 @@ struct digest_ctx { @@ -26,7 +24,7 @@ index a727c6f646..a2c9a966f7 100644 }; static const struct digest_data_st { -@@ -564,12 +565,15 @@ static int digest_update(EVP_MD_CTX *ctx, const void *data, size_t count) +@@ -564,12 +565,15 @@ static int digest_update(EVP_MD_CTX *ctx if (digest_ctx == NULL) return 0; @@ -46,7 +44,7 @@ index a727c6f646..a2c9a966f7 100644 } static int digest_final(EVP_MD_CTX *ctx, unsigned char *md) -@@ -579,7 +583,10 @@ static int digest_final(EVP_MD_CTX *ctx, unsigned char *md) +@@ -579,7 +583,10 @@ static int digest_final(EVP_MD_CTX *ctx, if (md == NULL || digest_ctx == NULL) return 0; diff --git a/package/libs/openssl/patches/410-eng_devcrypto-add-configuration-options.patch b/package/libs/openssl/patches/410-eng_devcrypto-add-configuration-options.patch index 8745364cf2..12fe7b4199 100644 --- a/package/libs/openssl/patches/410-eng_devcrypto-add-configuration-options.patch +++ b/package/libs/openssl/patches/410-eng_devcrypto-add-configuration-options.patch @@ -13,8 +13,6 @@ Reviewed-by: Matthias St. Pierre Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/7585) -diff --git a/crypto/engine/eng_devcrypto.c b/crypto/engine/eng_devcrypto.c -index a2c9a966f7..5ec38ca8f3 100644 --- a/crypto/engine/eng_devcrypto.c +++ b/crypto/engine/eng_devcrypto.c @@ -16,6 +16,7 @@ @@ -80,7 +78,7 @@ index a2c9a966f7..5ec38ca8f3 100644 /* * Code further down must make sure that only NIDs in the table above -@@ -333,19 +367,40 @@ static int cipher_cleanup(EVP_CIPHER_CTX *ctx) +@@ -333,19 +367,40 @@ static int cipher_cleanup(EVP_CIPHER_CTX } /* @@ -186,7 +184,7 @@ index a2c9a966f7..5ec38ca8f3 100644 static const EVP_CIPHER *get_cipher_method(int nid) { size_t i = get_cipher_data_index(nid); -@@ -438,6 +520,36 @@ static int devcrypto_ciphers(ENGINE *e, const EVP_CIPHER **cipher, +@@ -438,6 +520,36 @@ static int devcrypto_ciphers(ENGINE *e, return *cipher != NULL; } @@ -247,7 +245,7 @@ index a2c9a966f7..5ec38ca8f3 100644 /* * Code further down must make sure that only NIDs in the table above -@@ -516,8 +637,8 @@ static const struct digest_data_st *get_digest_data(int nid) +@@ -516,8 +637,8 @@ static const struct digest_data_st *get_ } /* @@ -258,7 +256,7 @@ index a2c9a966f7..5ec38ca8f3 100644 */ static int digest_init(EVP_MD_CTX *ctx) -@@ -630,52 +751,94 @@ static int digest_cleanup(EVP_MD_CTX *ctx) +@@ -630,52 +751,94 @@ static int digest_cleanup(EVP_MD_CTX *ct return clean_devcrypto_session(&digest_ctx->sess); } @@ -403,7 +401,7 @@ index a2c9a966f7..5ec38ca8f3 100644 } } -@@ -739,8 +909,154 @@ static int devcrypto_digests(ENGINE *e, const EVP_MD **digest, +@@ -739,7 +909,153 @@ static int devcrypto_digests(ENGINE *e, return *digest != NULL; } @@ -479,8 +477,8 @@ index a2c9a966f7..5ec38ca8f3 100644 + "DIGESTS", + "either ALL, NONE, or a comma-separated list of digests to enable [default=ALL]", + ENGINE_CMD_FLAG_STRING}, - #endif - ++#endif ++ + {0, NULL, NULL, 0} +}; + @@ -504,7 +502,7 @@ index a2c9a966f7..5ec38ca8f3 100644 + use_softdrivers = i; +#ifdef IMPLEMENT_DIGEST + rebuild_known_digest_nids(e); -+#endif + #endif + rebuild_known_cipher_nids(e); + return 1; +#endif /* CIOCGSESSINFO */ @@ -554,10 +552,9 @@ index a2c9a966f7..5ec38ca8f3 100644 + } + return 0; +} -+ + /****************************************************************************** * - * LOAD / UNLOAD @@ -793,6 +1109,8 @@ void engine_load_devcrypto_int() if (!ENGINE_set_id(e, "devcrypto") diff --git a/package/libs/openssl/patches/420-eng_devcrypto-add-command-to-dump-driver-info.patch b/package/libs/openssl/patches/420-eng_devcrypto-add-command-to-dump-driver-info.patch index ad83a51a10..b7e1f6a411 100644 --- a/package/libs/openssl/patches/420-eng_devcrypto-add-command-to-dump-driver-info.patch +++ b/package/libs/openssl/patches/420-eng_devcrypto-add-command-to-dump-driver-info.patch @@ -11,11 +11,9 @@ Reviewed-by: Matthias St. Pierre Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/7585) -diff --git a/crypto/engine/eng_devcrypto.c b/crypto/engine/eng_devcrypto.c -index 5ec38ca8f3..64dc6b891d 100644 --- a/crypto/engine/eng_devcrypto.c +++ b/crypto/engine/eng_devcrypto.c -@@ -50,16 +50,20 @@ static int use_softdrivers = DEVCRYPTO_DEFAULT_USE_SOFDTRIVERS; +@@ -50,16 +50,20 @@ static int use_softdrivers = DEVCRYPTO_D */ struct driver_info_st { enum devcrypto_status_t { @@ -82,7 +80,7 @@ index 5ec38ca8f3..64dc6b891d 100644 #endif /* CIOCGSESSINFO */ } ioctl(cfd, CIOCFSESSION, &sess.ses); -@@ -505,8 +514,11 @@ static void destroy_all_cipher_methods(void) +@@ -505,8 +514,11 @@ static void destroy_all_cipher_methods(v { size_t i; @@ -95,7 +93,7 @@ index 5ec38ca8f3..64dc6b891d 100644 } static int devcrypto_ciphers(ENGINE *e, const EVP_CIPHER **cipher, -@@ -550,6 +562,40 @@ static int cryptodev_select_cipher_cb(const char *str, int len, void *usr) +@@ -550,6 +562,40 @@ static int cryptodev_select_cipher_cb(co return 1; } @@ -190,7 +188,7 @@ index 5ec38ca8f3..64dc6b891d 100644 EVP_MD_meth_free(known_digest_methods[i]); known_digest_methods[i] = NULL; goto finish; -@@ -894,8 +945,11 @@ static void destroy_all_digest_methods(void) +@@ -894,8 +945,11 @@ static void destroy_all_digest_methods(v { size_t i; @@ -203,7 +201,7 @@ index 5ec38ca8f3..64dc6b891d 100644 } static int devcrypto_digests(ENGINE *e, const EVP_MD **digest, -@@ -939,6 +993,43 @@ static int cryptodev_select_digest_cb(const char *str, int len, void *usr) +@@ -939,6 +993,43 @@ static int cryptodev_select_digest_cb(co return 1; } @@ -247,7 +245,7 @@ index 5ec38ca8f3..64dc6b891d 100644 #endif /****************************************************************************** -@@ -983,6 +1074,11 @@ static const ENGINE_CMD_DEFN devcrypto_cmds[] = { +@@ -983,6 +1074,11 @@ static const ENGINE_CMD_DEFN devcrypto_c ENGINE_CMD_FLAG_STRING}, #endif @@ -259,7 +257,7 @@ index 5ec38ca8f3..64dc6b891d 100644 {0, NULL, NULL, 0} }; -@@ -1051,6 +1147,13 @@ static int devcrypto_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f) (void)) +@@ -1051,6 +1147,13 @@ static int devcrypto_ctrl(ENGINE *e, int return 1; #endif /* IMPLEMENT_DIGEST */ diff --git a/package/libs/openssl/patches/430-e_devcrypto-make-the-dev-crypto-engine-dynamic.patch b/package/libs/openssl/patches/430-e_devcrypto-make-the-dev-crypto-engine-dynamic.patch index ee33942426..f9b88ab84a 100644 --- a/package/libs/openssl/patches/430-e_devcrypto-make-the-dev-crypto-engine-dynamic.patch +++ b/package/libs/openssl/patches/430-e_devcrypto-make-the-dev-crypto-engine-dynamic.patch @@ -132,7 +132,7 @@ index 64dc6b891d..fb5c6e1636 100644 #include #include --#include "internal/engine.h" +-#include "crypto/engine.h" - /* #define ENGINE_DEVCRYPTO_DEBUG */ diff --git a/package/libs/openssl/patches/500-e_devcrypto-default-to-not-use-digests-in-engine.patch b/package/libs/openssl/patches/500-e_devcrypto-default-to-not-use-digests-in-engine.patch index 89385fa477..e8239c2888 100644 --- a/package/libs/openssl/patches/500-e_devcrypto-default-to-not-use-digests-in-engine.patch +++ b/package/libs/openssl/patches/500-e_devcrypto-default-to-not-use-digests-in-engine.patch @@ -19,8 +19,6 @@ turn them on if it is safe and fast enough. Signed-off-by: Eneas U de Queiroz -diff --git a/engines/e_devcrypto.c b/engines/e_devcrypto.c -index fb5c6e1636..7741138b82 100644 --- a/engines/e_devcrypto.c +++ b/engines/e_devcrypto.c @@ -854,7 +854,7 @@ static void prepare_digest_methods(void) @@ -32,7 +30,7 @@ index fb5c6e1636..7741138b82 100644 /* * Check that the digest is usable -@@ -1074,7 +1074,7 @@ static const ENGINE_CMD_DEFN devcrypto_cmds[] = { +@@ -1074,7 +1074,7 @@ static const ENGINE_CMD_DEFN devcrypto_c #ifdef IMPLEMENT_DIGEST {DEVCRYPTO_CMD_DIGESTS, "DIGESTS", diff --git a/package/libs/openssl/patches/510-e_devcrypto-ignore-error-when-closing-session.patch b/package/libs/openssl/patches/510-e_devcrypto-ignore-error-when-closing-session.patch index 087994376d..0cbe5e7e50 100644 --- a/package/libs/openssl/patches/510-e_devcrypto-ignore-error-when-closing-session.patch +++ b/package/libs/openssl/patches/510-e_devcrypto-ignore-error-when-closing-session.patch @@ -8,11 +8,9 @@ session. It may have been closed by another process after a fork. Signed-off-by: Eneas U de Queiroz -diff --git a/engines/e_devcrypto.c b/engines/e_devcrypto.c -index 7741138b82..2480bdbd57 100644 --- a/engines/e_devcrypto.c +++ b/engines/e_devcrypto.c -@@ -197,9 +197,8 @@ static int cipher_init(EVP_CIPHER_CTX *ctx, const unsigned char *key, +@@ -197,9 +197,8 @@ static int cipher_init(EVP_CIPHER_CTX *c get_cipher_data(EVP_CIPHER_CTX_nid(ctx)); /* cleanup a previous session */