openwrt-mirror/packages
1
0 Fork 0
mirror of https://github.com/openwrt/packages.git synced 2026-11-01 17:19:09 +04:00
Code Issues Packages Projects Releases Wiki Activity
Files
5ce254fd8e4136fbb3d385f4e55e2cdae0d6eb39
packages/libs/gnutls/Makefile
T
Antonio Flores 1170831077 gnutls: update to v3.8.0 
Fixes: https://github.com/openwrt/openwrt/issues/12542
The detailed list of changes follows:

* Version 3.8.0 (released 2023-02-09)

** libgnutls: Fix a Bleichenbacher oracle in the TLS RSA key exchange.
Reported by Hubert Kario (#1050). Fix developed by Alexander Sosedkin.
[GNUTLS-SA-2020-07-14, CVSS: medium] [CVE-2023-0361]

** libgnutls: C++ library is now header only. All definitions from
gnutlsxx.c have been moved into gnutlsxx.h. Users of the C++
interface have two options:
1. include gnutlsxx.h in their application and link against
the C library. (default)
2. include gnutlsxx.h in their application, compile with
GNUTLS_GNUTLSXX_NO_HEADERONLY macro defined and link
against the C++ library.

** libgnutls: GNUTLS_NO_STATUS_REQUEST flag and %NO_STATUS_REQUEST
priority modifier have been added to allow disabling of the
status_request TLS extension in the client side.

** libgnutls: TLS heartbeat is disabled by default.
The heartbeat extension in TLS (RFC 6520) is not widely used given
other implementations dropped support for it. To enable back
support for it, supply --enable-heartbeat-support to configure
script.

** libgnutls: SRP authentication is now disabled by default.
It is disabled because the SRP authentication in TLS is not up to
date with the latest TLS standards and its ciphersuites are based
on the CBC mode and SHA-1. To enable it back, supply
--enable-srp-authentication option to configure script.

** libgnutls: All code has been indented using "indent -ppi1 -linux".
CI/CD has been adjusted to catch regressions. This is implemented
through devel/indent-gnutls, devel/indent-maybe and .gitlab-ci.yml’s
commit-check. You may run devel/indent-gnutls to fix any
indentation issues if you make code modifications.

** guile: Guile-bindings removed.
They have been extracted into a separate project to reduce complexity
and to simplify maintenance, see <https://gitlab.com/gnutls/guile/>.

** minitasn1: Upgraded to libtasn1 version 4.19.

** API and ABI modifications:
GNUTLS_NO_STATUS_REQUEST: New flag
GNUTLS_SRTP_AEAD_AES_128_GCM: New gnutls_srtp_profile_t enum member
GNUTLS_SRTP_AEAD_AES_256_GCM: New gnutls_srtp_profile_t enum member

Signed-off-by: Antonio Flores <antflores627@gmail.com>
2023-05-07 22:46:32 +08:00

270 lines
6.4 KiB
Makefile
Raw Blame History

# SPDX-Identifier-License: GPL-2.0-only
#
# Copyright (C) 2005-2016 OpenWrt.org
#
include $(TOPDIR)/rules.mk
PKG_NAME:=gnutls
PKG_VERSION:=3.8.0
PKG_RELEASE:=1
PKG_BUILD_FLAGS:=no-mips16
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8
PKG_HASH:=0ea0d11a1660a1e63f960f157b197abe6d0c8cb3255be24e1fb3815930b9bdc5
PKG_MAINTAINER:=Nikos Mavrogiannopoulos <nmav@gnutls.org>
PKG_LICENSE:=LGPL-2.1-or-later
PKG_LICENSE_FILES:=LICENSE
PKG_CPE_ID:=cpe:/a:gnu:gnutls
PKG_BUILD_DEPENDS:=gettext-full/host
PKG_BUILD_PARALLEL:=1
PKG_FIXUP:=autoreconf gettext-version
PKG_INSTALL:=1
PKG_LIBTOOL_PATHS:=. lib
PKG_CONFIG_DEPENDS:= \
CONFIG_GNUTLS_ALPN \
CONFIG_GNUTLS_ANON \
CONFIG_GNUTLS_CRYPTODEV \
CONFIG_GNUTLS_DTLS_SRTP \
CONFIG_GNUTLS_EXT_LIBTASN1 \
CONFIG_GNUTLS_HEARTBEAT \
CONFIG_GNUTLS_OCSP \
CONFIG_GNUTLS_PKCS11 \
CONFIG_GNUTLS_PSK \
CONFIG_GNUTLS_SRP \
CONFIG_GNUTLS_TPM \
CONFIG_LIBNETTLE_MINI \
CONFIG_PACKAGE_libgnutls-dane \
include $(INCLUDE_DIR)/package.mk
define Package/gnutls/Default
SUBMENU:=SSL
SECTION:=libs
CATEGORY:=Libraries
TITLE:=GNU TLS
URL:=http://www.gnutls.org/
endef
define Package/gnutls/Default/description
GnuTLS is a secure communications library implementing the SSL, TLS
and DTLS protocols and technologies around them. It provides a simple
C language application programming interface (API) to access the secure
communications protocols as well as APIs to parse and write X.509, PKCS12,
OpenPGP and other required structures. It is aimed to be portable and
efficient with focus on security and interoperability.
endef
define Package/certtool
$(call Package/gnutls/Default)
SECTION:=utils
CATEGORY:=Utilities
SUBMENU:=Encryption
TITLE+= (certool utility)
DEPENDS+= +libgnutls
endef
define Package/certtool/description
$(call Package/gnutls/Default/description)
This package contains the GnuTLS certtool utility.
endef
define Package/gnutls-utils
$(call Package/gnutls/Default)
SECTION:=utils
CATEGORY:=Utilities
SUBMENU:=Encryption
TITLE+= (utilities)
DEPENDS+= +libgnutls +PACKAGE_libgnutls-dane:libgnutls-dane
endef
define Package/gnutls-utils/description
$(call Package/gnutls/Default/description)
This package contains the GnuTLS gnutls-cli, gnutls-serv, psktool,
and srptool utilities.
endef
define Package/libgnutls/config
source "$(SOURCE)/Config.in"
endef
define Package/libgnutls
$(call Package/gnutls/Default)
TITLE+= (library)
DEPENDS+= +libnettle +!LIBNETTLE_MINI:libgmp +GNUTLS_EXT_LIBTASN1:libtasn1 +GNUTLS_PKCS11:p11-kit +GNUTLS_CRYPTODEV:kmod-cryptodev +libatomic
endef
define Package/libgnutls-dane
$(call Package/gnutls/Default)
TITLE+= (libgnutls-dane library)
DEPENDS:= +libgnutls +PACKAGE_libgnutls-dane:libunbound
endef
define Package/libgnutls/description
$(call Package/gnutls/Default/description)
This package contains the GnuTLS shared library, needed by other programs.
endef
# We disable the configuration file (system-priority-file) because
# the use of configuration increases the non-shared memory used by
# the library and we don't provide an openwrt-specific configuration
# anyway.
CONFIGURE_ARGS+= \
--enable-shared \
--enable-static \
--disable-doc \
--disable-gcc-warnings \
--disable-guile \
--disable-rpath \
--disable-seccomp-tests \
--disable-tests \
--disable-valgrind-tests \
--disable-ssl2-support \
--disable-ssl3-support \
--enable-local-libopts \
--without-idn \
--with-default-trust-store-dir=/etc/ssl/certs/ \
--with-included-unistring \
--with-librt-prefix="$(LIBRT_ROOT_DIR)/" \
--with-pic \
--with-system-priority-file="" \
--without-brotli \
--without-zlib \
--without-zstd
ifneq ($(CONFIG_GNUTLS_EXT_LIBTASN1),y)
CONFIGURE_ARGS += --with-included-libtasn1
endif
ifneq ($(CONFIG_GNUTLS_PKCS11),y)
CONFIGURE_ARGS += --without-p11-kit
endif
ifeq ($(CONFIG_LIBNETTLE_MINI),y)
CONFIGURE_ARGS += --with-nettle-mini
endif
ifneq ($(CONFIG_GNUTLS_DTLS_SRTP),y)
CONFIGURE_ARGS += --disable-dtls-srtp-support
endif
ifneq ($(CONFIG_GNUTLS_ALPN),y)
CONFIGURE_ARGS += --disable-alpn-support
endif
ifneq ($(CONFIG_GNUTLS_HEARTBEAT),y)
CONFIGURE_ARGS += --disable-heartbeat-support
endif
ifneq ($(CONFIG_GNUTLS_SRP),y)
CONFIGURE_ARGS += --disable-srp-authentication
endif
ifneq ($(CONFIG_GNUTLS_PSK),y)
CONFIGURE_ARGS += --disable-psk-authentication
endif
ifneq ($(CONFIG_GNUTLS_ANON),y)
CONFIGURE_ARGS += --disable-anon-authentication
endif
ifneq ($(CONFIG_GNUTLS_OCSP),y)
CONFIGURE_ARGS += --disable-ocsp
endif
ifneq ($(CONFIG_GNUTLS_TPM),y)
CONFIGURE_ARGS += --without-tpm
endif
ifeq ($(CONFIG_GNUTLS_CRYPTODEV),y)
CONFIGURE_ARGS += --enable-cryptodev
endif
ifeq ($(CONFIG_PACKAGE_libgnutls-dane),)
CONFIGURE_ARGS += --disable-libdane
endif
define Build/InstallDev
$(INSTALL_DIR) $(1)/usr/include $(1)/usr/lib/pkgconfig
$(CP) \
$(PKG_INSTALL_DIR)/usr/lib/*.so* \
$(1)/usr/lib/
$(CP) \
$(PKG_INSTALL_DIR)/usr/include/gnutls \
$(1)/usr/include/
$(CP) \
$(PKG_INSTALL_DIR)/usr/lib/pkgconfig/*.pc \
$(1)/usr/lib/pkgconfig/
endef
define Package/certtool/conffiles
/etc/gnutls/certtool.cfg
endef
define Package/certtool/install
$(INSTALL_DIR) $(1)/etc/gnutls
$(INSTALL_CONF) $(PKG_BUILD_DIR)/doc/certtool.cfg $(1)/etc/gnutls/
$(INSTALL_DIR) $(1)/usr/bin
$(CP) $(PKG_INSTALL_DIR)/usr/bin/certtool $(1)/usr/bin/
endef
define Package/gnutls-utils/install
$(INSTALL_DIR) $(1)/usr/bin
ifeq ($(CONFIG_GNUTLS_OCSP),y)
ifeq ($(CONFIG_GNUTLS_ANON),y)
$(CP) \
$(PKG_INSTALL_DIR)/usr/bin/gnutls-{cli,serv} \
$(1)/usr/bin/
endif
$(CP) \
$(PKG_INSTALL_DIR)/usr/bin/ocsptool \
$(1)/usr/bin/
endif
ifeq ($(CONFIG_GNUTLS_SRP),y)
$(CP) \
$(PKG_INSTALL_DIR)/usr/bin/srptool \
$(1)/usr/bin/
endif
ifeq ($(CONFIG_GNUTLS_PSK),y)
$(CP) \
$(PKG_INSTALL_DIR)/usr/bin/psktool \
$(1)/usr/bin/
endif
ifeq ($(CONFIG_GNUTLS_PKCS11),y)
$(CP) \
$(PKG_INSTALL_DIR)/usr/bin/p11tool \
$(1)/usr/bin/
endif
ifeq ($(CONFIG_GNUTLS_TPM),y)
$(CP) \
$(PKG_INSTALL_DIR)/usr/bin/tpmtool \
$(1)/usr/bin/
endif
endef
define Package/libgnutls/install
$(INSTALL_DIR) $(1)/usr/lib
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libgnutls.so.* $(1)/usr/lib/
endef
define Package/libgnutls-dane/install
$(INSTALL_DIR) $(1)/usr/lib
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libgnutls-dane.so.* $(1)/usr/lib/
endef
$(eval $(call BuildPackage,certtool))
$(eval $(call BuildPackage,gnutls-utils))
$(eval $(call BuildPackage,libgnutls))
$(eval $(call BuildPackage,libgnutls-dane))
Reference in new issue View Git Blame Copy Permalink