diff options
| author | Eneas U de Queiroz <cotequeiroz@gmail.com> | 2023-03-14 18:51:45 -0300 |
|---|---|---|
| committer | Eneas U de Queiroz <cotequeiroz@gmail.com> | 2023-04-05 08:24:49 -0300 |
| commit | 0b70d55a64c39da4144cc15aa7d6de70a3957ccb (patch) | |
| tree | 1c1b0fdc037de5386abdd581d2039b5f3db30db2 /package/libs/openssl | |
| parent | 975036f6f9c8b12fbf82854ea006b4951c5be783 (diff) | |
| download | upstream-0b70d55a64c39da4144cc15aa7d6de70a3957ccb.tar.gz upstream-0b70d55a64c39da4144cc15aa7d6de70a3957ccb.tar.bz2 upstream-0b70d55a64c39da4144cc15aa7d6de70a3957ccb.zip | |
openssl: make UCI config aware of built-in engines
Engines that are built into the main libcrypto OpenSSL library can't be
disabled through UCI. Add a 'builtin' setting to signal that the engine
can't be disabled through UCI, and show a message explaining this in
case buitin=1 and enabled=0.
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
Diffstat (limited to 'package/libs/openssl')
| -rw-r--r-- | package/libs/openssl/Makefile | 26 | ||||
| -rwxr-xr-x | package/libs/openssl/files/openssl.init | 25 |
2 files changed, 43 insertions, 8 deletions
diff --git a/package/libs/openssl/Makefile b/package/libs/openssl/Makefile index b076a9c1fa..66872d5436 100644 --- a/package/libs/openssl/Makefile +++ b/package/libs/openssl/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=openssl PKG_VERSION:=3.0.8 -PKG_RELEASE:=5 +PKG_RELEASE:=6 PKG_BUILD_FLAGS:=no-mips16 gc-sections PKG_BUILD_PARALLEL:=1 @@ -138,6 +138,30 @@ $(call Package/openssl/Default/description) This package installs the OpenSSL configuration file /etc/ssl/openssl.cnf. endef +ifneq ($(CONFIG_OPENSSL_ENGINE_BUILTIN_PADLOCK)$(CONFIG_OPENSSL_ENGINE_BUILTIN_DEVCRYPTO),) +define Package/libopenssl-conf/postinst +#!/bin/sh +OPENSSL_UCI="$${IPKG_INSTROOT}/etc/config/openssl" + +add_engine_config() { + if [ -z "$${IPKG_INSTROOT}" ] && uci -q get "openssl.$$1" >/dev/null; then + [ "$$(uci -q get "openssl.$$1.builtin")" = 1 ] && return + uci set "openssl.$$1.builtin=1" && uci commit openssl + return + fi + { + echo "engine '$$1'" + echo " option enabled '1'" + echo " option builtin '1'" + echo + } >>"$${OPENSSL_UCI}" +} + +$(if $(CONFIG_OPENSSL_ENGINE_BUILTIN_DEVCRYPTO),add_engine_config devcrypto) +$(if $(CONFIG_OPENSSL_ENGINE_BUILTIN_PADLOCK),add_engine_config padlock) +endef +endif + $(eval $(call Package/openssl/add-engine,afalg)) define Package/libopenssl-afalg $(call Package/openssl/Default) diff --git a/package/libs/openssl/files/openssl.init b/package/libs/openssl/files/openssl.init index 21e253e7a5..f895b9878c 100755 --- a/package/libs/openssl/files/openssl.init +++ b/package/libs/openssl/files/openssl.init @@ -6,15 +6,26 @@ ENGINES_CNF="/var/etc/ssl/engines.cnf" ENGINES_DIR="%ENGINES_DIR%" config_engine() { - local enabled force + local builtin enabled force + + config_get_bool builtin "$1" builtin 0 config_get_bool enabled "$1" enabled 1 config_get_bool force "$1" force 0 - [ "$enabled" = 0 ] && return - if [ "$force" = 0 ] && \ - [ ! -f "${ENGINES_CNF_D}/$1.cnf" ] && \ - [ ! -f "${ENGINES_DIR}/$1.so" ]; then - echo Skipping engine "$1": not installed - return + + if [ "$enabled" = 0 ]; then + [ "$builtin" != 1 ] && return 1 + echo "Engine $1 is built into the libcrypto library and can't be disabled through UCI." && \ + echo "If the engine was not built-in, remove 'config builtin' from /etc/config/openssl." + elif [ "$force" = 1 ]; then + printf "[Forced] " + elif ! grep -q "\\[ *$1 *]" "${ENGINES_CNF_D}"/*; then + echo "$1: Could not find section [$1] in config files." + return 1 + elif [ "$builtin" = 1 ]; then + printf "[Builtin] " + elif [ ! -f "${ENGINES_DIR}/$1.so" ];then + echo "$1: ${ENGINES_DIR}/$1.so not found." + return 1 fi echo Enabling engine "$1" echo "$1=$1" >> "${ENGINES_CNF}" |