openwrt-mirror/openwrt
1
0 Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2026-10-14 13:08:30 +04:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
openwrt/package/libs/mbedtls/Makefile
T
Magnus Kroken 5d8a8a33dc mbedtls: update to 3.6.7 
This version fixes security issues and bugs.

Security fixes:
* Fix a side channel in RSA PKCS#1 v1.5 decryption. (CVE-2026-50587)
* Fix a bug where transcript-hash computation errors during TLS 1.2 extended master secret calculation could be ignored instead of causing the handshake to fail. (CVE-2026-50581)
* Fix a TLS 1.3 server-side error-handling bug affecting session ticket generation. (CVE-2026-50640)
* Fix renegotiation failing and potentially causing a buffer overflow in DTLS when badmac_limit is enabled. (CVE-2026-50713)
* Reject ChaCha20 operations that would make the 32-bit block counter wrap around, which could otherwise reuse keystream and compromise confidentiality. (CVE-2026-50584)
* Fixed a TLS 1.3 record-boundary validation issue that could allow unauthenticated plaintext data to be processed across a key change.
* Fix a possible buffer overflow in mbedtls_ecdh_calc_secret() (CVE-2026-35336)
* Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when CBC is disabled. (CVE-ID-50580)
* Fix a side channel in ECC computations that allows a powerful local attacker (typically, untrusted OS attacking a secure enclave) to fully recover long-term secret keys). (CVE-2026-54435)
* Fix a potential information disclosure in TLS 1.2 servers using session tickets. (CVE-2026-50586)
* Fix timing side channel in RSA key generation, prime generation and primality testing, on platforms where division is not constant-time.
* Fix a 1-byte buffer overread when parsing a malformed ECC public key in the PK module. (CVE-2026-50583)
* Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange messages. (CVE-2026-50588)
* Fix a use-after-free/double-free risk in mbedtls_pkcs7_free() when reusing an mbedtls_pkcs7 context across parse -> free -> parse -> free cycles. (CVE-2026-50579)
* PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224, SHA3-224) on signature verification.
* Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that this function only sets signature algorithms that are enforced during TLS key exchange and not on certificate verification. (CVE-2026-54441)
* Ensure 'dtls_srtp_info' field from 'mbedtls_ssl_context' is properly zeroized when mbedtls_ssl_session_reset() is called. (CVE-2026-50585)
* Fix a bug where mbedtls_ssl_read() and mbedtls_ssl_write() could return 1 instead of an error code if the random generator failed when a server called these functions before the end of a TLS 1.3 handshake.
* Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was not advertised in the original ClientHello. (CVE-2026-25832)
* Fix two bugs in the X.509 certificate parser that caused some inputs with a malformed basicConstraints extension to be accepted. (CVE-2026-49300)

Full release notes: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.7

Remove backported upstream patches that are included in this release.

Signed-off-by: Magnus Kroken <mkroken@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24131
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-08-12 02:09:37 +02:00

182 lines
5.5 KiB
Makefile
Raw Permalink Blame History

#
# Copyright (C) 2011-2015 OpenWrt.org
#
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.
#
include $(TOPDIR)/rules.mk
PKG_NAME:=mbedtls
PKG_VERSION:=3.6.7
PKG_RELEASE:=1
PKG_BUILD_FLAGS:=no-mips16 gc-sections no-lto
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL=https://github.com/Mbed-TLS/$(PKG_NAME)/releases/download/$(PKG_NAME)-$(PKG_VERSION)
PKG_HASH:=a7e8bcbec0e6f761b4af24f25677626b35f762f68eef79c08677a363212d11f6
PKG_LICENSE:=GPL-2.0-or-later
PKG_LICENSE_FILES:=LICENSE
PKG_CPE_ID:=cpe:/a:arm:mbed_tls
MBEDTLS_BUILD_OPTS_CURVES= \
CONFIG_MBEDTLS_ECP_DP_SECP192R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP224R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP384R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP521R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP192K1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP224K1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_SECP256K1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_BP256R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_BP384R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_BP512R1_ENABLED \
CONFIG_MBEDTLS_ECP_DP_CURVE25519_ENABLED \
CONFIG_MBEDTLS_ECP_DP_CURVE448_ENABLED
MBEDTLS_BUILD_OPTS_CIPHERS= \
CONFIG_MBEDTLS_AES_C \
CONFIG_MBEDTLS_ARIA_C \
CONFIG_MBEDTLS_CAMELLIA_C \
CONFIG_MBEDTLS_CCM_C \
CONFIG_MBEDTLS_CMAC_C \
CONFIG_MBEDTLS_DES_C \
CONFIG_MBEDTLS_GCM_C \
CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED \
CONFIG_MBEDTLS_NIST_KW_C \
CONFIG_MBEDTLS_RIPEMD160_C \
CONFIG_MBEDTLS_RSA_NO_CRT \
CONFIG_MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED \
CONFIG_MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
CONFIG_MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
MBEDTLS_BUILD_OPTS= \
$(MBEDTLS_BUILD_OPTS_CURVES) \
$(MBEDTLS_BUILD_OPTS_CIPHERS) \
CONFIG_MBEDTLS_CIPHER_MODE_OFB \
CONFIG_MBEDTLS_CIPHER_MODE_XTS \
CONFIG_MBEDTLS_DEBUG_C \
CONFIG_MBEDTLS_ENTROPY_FORCE_SHA256 \
CONFIG_MBEDTLS_HKDF_C \
CONFIG_MBEDTLS_PLATFORM_C \
CONFIG_MBEDTLS_SELF_TEST \
CONFIG_MBEDTLS_SSL_RENEGOTIATION \
CONFIG_MBEDTLS_THREADING_C \
CONFIG_MBEDTLS_THREADING_PTHREAD \
CONFIG_MBEDTLS_VERSION_C \
CONFIG_MBEDTLS_VERSION_FEATURES \
CONFIG_MBEDTLS_PSA_CRYPTO_CLIENT \
CONFIG_MBEDTLS_DEPRECATED_WARNING \
CONFIG_MBEDTLS_SSL_PROTO_TLS1_2 \
CONFIG_MBEDTLS_SSL_PROTO_TLS1_3 \
CONFIG_MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
PKG_CONFIG_DEPENDS := $(MBEDTLS_BUILD_OPTS)
include $(INCLUDE_DIR)/package.mk
include $(INCLUDE_DIR)/cmake.mk
define Package/mbedtls/Default
TITLE:=Embedded SSL
URL:=https://www.trustedfirmware.org/projects/mbed-tls/
endef
define Package/mbedtls/Default/description
The aim of the mbedtls project is to provide a quality, open-source
cryptographic library written in C and targeted at embedded systems.
endef
define Package/libmbedtls
$(call Package/mbedtls/Default)
SECTION:=libs
CATEGORY:=Libraries
SUBMENU:=SSL
TITLE+= (library)
ABI_VERSION:=21
MENU:=1
endef
define Package/libmbedtls/config
source "$(SOURCE)/Config.in"
endef
define Package/mbedtls-util
$(call Package/mbedtls/Default)
SECTION:=utils
CATEGORY:=Utilities
TITLE+= (utilities)
DEPENDS:=+libmbedtls
endef
define Package/libmbedtls/description
$(call Package/mbedtls/Default/description)
This package contains the mbedtls library.
endef
define Package/mbedtls-util/description
$(call Package/mbedtls/Default/description)
This package contains mbedtls helper programs for private key and
CSR generation (gen_key, cert_req)
endef
TARGET_CFLAGS := $(filter-out -O%,$(TARGET_CFLAGS)) -Wno-unterminated-string-initialization
CMAKE_OPTIONS += \
-DCMAKE_POSITION_INDEPENDENT_CODE=ON \
-DUSE_SHARED_MBEDTLS_LIBRARY:Bool=ON \
-DENABLE_TESTING:Bool=OFF \
-DENABLE_PROGRAMS:Bool=ON
define Build/Configure
$(call Build/Configure/Default)
$(if $(strip $(foreach opt,$(MBEDTLS_BUILD_OPTS),$($(opt)))),
$(foreach opt,$(MBEDTLS_BUILD_OPTS),
$(PKG_BUILD_DIR)/scripts/config.py \
-f $(PKG_BUILD_DIR)/include/mbedtls/mbedtls_config.h \
$(if $($(opt)),set,unset) $(patsubst CONFIG_%,%,$(opt))),)
endef
define Build/InstallDev
$(INSTALL_DIR) $(1)/usr/include
$(CP) \
$(PKG_INSTALL_DIR)/usr/include/mbedtls \
$(PKG_INSTALL_DIR)/usr/include/psa \
$(1)/usr/include/
$(INSTALL_DIR) $(1)/usr/lib
$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.so* $(1)/usr/lib/
$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.a $(1)/usr/lib/
$(CP) $(PKG_INSTALL_DIR)/usr/lib/cmake $(1)/usr/lib/
$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
$(CP) \
$(PKG_INSTALL_DIR)/usr/lib/pkgconfig/mbedcrypto.pc \
$(PKG_INSTALL_DIR)/usr/lib/pkgconfig/mbedtls.pc \
$(PKG_INSTALL_DIR)/usr/lib/pkgconfig/mbedx509.pc \
$(1)/usr/lib/pkgconfig/
endef
define Package/libmbedtls/install
$(INSTALL_DIR) $(1)/usr/lib
$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.so.* $(1)/usr/lib/
endef
define Package/mbedtls-util/install
$(INSTALL_DIR) $(1)/usr/bin
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/gen_key $(1)/usr/bin/
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/cert_req $(1)/usr/bin/
endef
$(eval $(call BuildPackage,libmbedtls))
$(eval $(call BuildPackage,mbedtls-util))
Reference in new issue View Git Blame Copy Permalink