deepcrayon/buildroot
deepcrayon/buildroot
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

package/uacme: don't allow ualpn with mbedTLS

Browse source 
ualpn requires mbedTLS to be configured and built with
MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
which is not the default and can be a security risk.

Therefore make BR2_PACKAGE_UACME_UALPN depend on
BR2_PACKAGE_OPENSSL || BR2_PACKAGE_GNUTLS.

Fixes http://autobuild.buildroot.net/results/d241121f8155bad9b6b25c16234576abb7fc940b

See also

https://github.com/ndilieto/uacme/issues/23
https://github.com/ARMmbed/mbedtls/issues/3241
https://github.com/ARMmbed/mbedtls/pull/3243
http://lists.busybox.net/pipermail/buildroot/2020-April/281059.html
http://lists.busybox.net/pipermail/buildroot/2020-April/281108.html

Signed-off-by: Nicola Di Lieto <nicola.dilieto@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This commit is contained in:
Nicola Di Lieto 2020-05-09 11:08:08 +02:00 committed by Thomas Petazzoni
parent 3bf545da78
commit 96c3b52132
2 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
package/uacme/Config.in
View file

@ -19,6 +19,7 @@ if BR2_PACKAGE_UACME
config BR2_PACKAGE_UACME_UALPN
bool "enable ualpn"
depends on BR2_TOOLCHAIN_HAS_THREADS
depends on BR2_PACKAGE_OPENSSL || BR2_PACKAGE_GNUTLS
select BR2_PACKAGE_LIBEV
help
Build and install ualpn, the transparent proxying tls-alpn-01
@ -27,4 +28,7 @@ config BR2_PACKAGE_UACME_UALPN
comment "ualpn needs a toolchain w/ threads"
depends on !BR2_TOOLCHAIN_HAS_THREADS
comment "ualpn needs either OpenSSL or GnuTLS"
depends on !(BR2_PACKAGE_OPENSSL || BR2_PACKAGE_GNUTLS)
endif

6
package/uacme/uacme.mk
View file

@ -18,12 +18,12 @@ UACME_CONF_ENV = ac_cv_prog_cc_c99='-std=gnu99'
ifeq ($(BR2_PACKAGE_GNUTLS),y)
UACME_CONF_OPTS += --with-gnutls
UACME_DEPENDENCIES += gnutls
else ifeq ($(BR2_PACKAGE_MBEDTLS),y)
UACME_CONF_OPTS += --with-mbedtls
UACME_DEPENDENCIES += mbedtls
else ifeq ($(BR2_PACKAGE_OPENSSL),y)
UACME_CONF_OPTS += --with-openssl
UACME_DEPENDENCIES += openssl
else ifeq ($(BR2_PACKAGE_MBEDTLS),y)
UACME_CONF_OPTS += --with-mbedtls
UACME_DEPENDENCIES += mbedtls
endif
ifeq ($(BR2_PACKAGE_UACME_UALPN),y)