[From nobody Thu Jun 25 05:55:08 2020 Received: from sonic310-21.consmr.mail.gq1.yahoo.com ([98.137.69.147]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1hGURg-0003lq-HW for openwrt-devel@lists.openwrt.org; Tue, 16 Apr 2019 20:12:45 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1555445553; bh=hha9nuWAqaBei4ePQd4i6itQs3OnMuSPniU0MVM2pQk=; h=From:To:Cc:Subject:Date:From:Subject; b=Mkd8PwoKYNxVt3rV+OhTacw4gFs6Nu2QAqN+9vj1ffQaeZJWb/RpXfvySaSE8scupCOv02liH4NTieLREhX2uSjIsboSAr9NG3iFjyCHrrl7Lb7UQxxRUkofD4/ZrI9O8wWedxHmZHhORWPRsjrMLigezJb60BvG1oMgKJAI0pD3c/vgQYau7MnnE9eSZLYW4YlN7puEbkOvzSAggz7P9CmEeBj4PlTT1Zwn9Dnb4nt4CwamapJZhaL4l1TfqaZwVb8Kqsf5xFTKNGgmCv64IdUjhl8ZrgSaZLr0iYJiToYsTOD5L4NvXimwyoToUY8rRlT20zOOTu5Ob9BO+hNoiQ== X-YMail-OSG: xZ6jzGMVM1n1ecYvMXUYOGukF3V36crSwDSCaTAT.UTXqdTTcfEKojgnFhJScIX 0_jK6VOsuP1kyjAuIppHkPIkAYdeyabO4FZ.PQYlTWL4li2kplUE2bPB7nN5WIelvcsPWyaW9tr1 QYs4xAFUNwY10qtaNxCLM1Ns9NGwbRwLitUAqyXzztWFZ0rPyd3XFiy0r9ucbWqP79l3xI9ihCny WxyQPhuXwipe_lOZfkEbnFy6QF9wlpcUnLvY48cEEhZKipqUWibBCreSMeZjJYqM7MVJsjMmX9Cz C38mnTtsBfEdSdr7zZcV2VxzFcU65hVa0ldJnQFzBFxtE8MKZQeOwNtf5v.6ImY36SThstOlhrbp ruoGbc1aYoqqaV1tHIdUV5p50O3bGt7F8ukHyVQwhf9mE5iuGPjjrXRZFG4adbxWfbfBzLwneoEf YZiJ.R4rx6.BsFO7YOng_H3ZN5VsBzcutmKS_0QSQ1r9j3ucneiSB5NlvroqzFOBfs7DXAr3O1_P fOQuHsoptGSuciBqdCnyhRDz7IoOLcaaa2NJ84HIg89rFPG8eCDc_tg4kKn6Z5V.g.NMnBa.LvAU HC_xFDq8VQh2tqRhw7PT96X4rLbqGeYXHMOrO9B6c.l3UxzL4Xr9kjexAtSReMbAWH8ZpI2m9XZo jOlVaKGJCKw05feMpXVl_2df6Y0kMIXQ9UXNh1ERjGK4r_L57EcGypGvjibZJ83Q1KAM75rRPQqm UwzCNX71JFliB5I7z7wWOM6fHhAKV8nz6dLikrCEjHJj0UX_.5U7ldkdsYd4xRfNo9CypROL7aKb BtxIY3X44vOnc4tMRzYsAgXK2RP6tfHc5Meec9.tGmcEmtU.U.xwVR8SxGopLUBkpJgNzt8qZiNY Bm4zNPvW9wbNU8PHIEjLXU3HP6_ErIDs32Ke5qshYNp54idxeXE5vZmO_jFe.cYYg6tEg1JjYzv6 LQCGZAe60CqgjYGtrD86DM1eOQEHINiFrVr.2Z7_wn3D4uxdgl2mHdoEiu86sQWJaq0q1X667Ec. GXVbafQumm8adw3ls3IJcbtVzKfQ4JfWrR50m8AePqz4C7MIq54lWfg-- Received: from sonic.gate.mail.ne1.yahoo.com by sonic310.consmr.mail.gq1.yahoo.com with HTTP; Tue, 16 Apr 2019 20:12:33 +0000 Received: from 18.175.75.177.infopasa.com.br (EHLO gateway.troianet.com.br) ([177.75.175.18]) by smtp414.mail.gq1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 4cba7b2bd28030cb47f50297f1200fc4; Tue, 16 Apr 2019 20:12:31 +0000 (UTC) From: Eneas U de Queiroz <cote2004-github@yahoo.com> To: openwrt-devel@lists.openwrt.org Cc: Eneas U de Queiroz <cote2004-github@yahoo.com> Subject: [PATCH v2] openssl: change defaults: ENGINE:on, NPN:off, misc Date: Tue, 16 Apr 2019 17:12:15 -0300 Message-Id: <20190416201215.9828-1-cote2004-github@yahoo.com> X-Mailer: git-send-email 2.21.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190416_131244_608074_F1869B4A X-CRM114-Status: UNSURE ( 7.03 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -0.2 (/) X-Spam-Report: SpamAssassin version 3.4.2 on bombadil.infradead.org summary: Content analysis details: (-0.2 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [98.137.69.147 listed in list.dnswl.org] 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (cote2004-github[at]yahoo.com) -0.0 SPF_PASS SPF: sender matches SPF record 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature Enable engine support by default. Right now, some packages require this, so it is always enabled by the bots. Many packages will compile differently when engine support is detected, needing engine symbols from the libraries. However, being off by default, a user compiling its own image will fail to run some popular packages from the official repo. Note that disabling engines did not work in 1.0.2, so this problem never showed up before. NPN support has been removed in major browsers & servers, and has become a small bloat, so it does not make sense to leave it on by default. Remove deprecated CONFIG_ENGINE_CRYPTO symbol that is no longer needed. Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com> --- ChangeLog: v2: increase PKG_RELEASE diff --git a/package/libs/openssl/Config.in b/package/libs/openssl/Config.in index ecb9eea389..49f136e845 100644 --- a/package/libs/openssl/Config.in +++ b/package/libs/openssl/Config.in @@ -96,7 +96,6 @@ config OPENSSL_WITH_DTLS config OPENSSL_WITH_NPN bool - default y prompt "Enable NPN support" help NPN is a TLS extension, obsoleted and replaced with ALPN, @@ -246,10 +245,15 @@ comment "Engine/Hardware Support" config OPENSSL_ENGINE bool "Enable engine support" + default y help This enables alternative cryptography implementations, most commonly for interfacing with external crypto devices, or supporting new/alternative ciphers and digests. + If you compile the library with this option disabled, packages built + using an engine-enabled library (i.e. from the official repo) may + fail to run. Compile and install the packages with engine support + disabled, and you should be fine. Note that you need to enable KERNEL_AIO to be able to build the afalg engine package. @@ -271,12 +275,6 @@ config OPENSSL_ENGINE_BUILTIN_AFALG This enables use of hardware acceleration through the AF_ALG kernel interface. -config OPENSSL_ENGINE_CRYPTO - # This symbol is deprecated. Currently it is used by the openssh package. - # Once openwrt/packages#8272 is merged, this can be safely removed. - bool - default OPENSSL_ENGINE_BUILTIN_DEVCRYPTO || PACKAGE_libopenssl-devcrypto - config OPENSSL_ENGINE_BUILTIN_DEVCRYPTO bool prompt "Acceleration support through /dev/crypto" diff --git a/package/libs/openssl/Makefile b/package/libs/openssl/Makefile index cb25c5557c..49cea8e45a 100644 --- a/package/libs/openssl/Makefile +++ b/package/libs/openssl/Makefile @@ -11,7 +11,7 @@ PKG_NAME:=openssl PKG_BASE:=1.1.1 PKG_BUGFIX:=b PKG_VERSION:=$(PKG_BASE)$(PKG_BUGFIX) -PKG_RELEASE:=3 +PKG_RELEASE:=4 PKG_USE_MIPS16:=0 ENGINES_DIR=engines-1.1 ]