[Buildroot] [PATCH 1/2] package/drogon: fix optional TLS dependency

[Buildroot] [PATCH 1/2] package/drogon: fix optional TLS dependency

[Dario Binacchi]

The trantor library bundled in drogon looks for a TLS library at
configure time, and uses OpenSSL or Botan if it finds one. Since
drogon.mk does not declare any dependency on them, TLS support ends up
depending on whether OpenSSL or Botan happens to be built before
drogon.

Select the TLS library explicitly, following the same order as trantor,
so that OpenSSL is preferred over Botan.

host-drogon only provides drogon_ctl, which does not need TLS, so
disable it there to avoid picking up the TLS libraries of the build
machine.

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
---
 package/drogon/drogon.mk | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/package/drogon/drogon.mk b/package/drogon/drogon.mk
index 03cba45ceb34..8c51d16ac0d7 100644
--- a/package/drogon/drogon.mk
+++ b/package/drogon/drogon.mk
@@ -21,7 +21,8 @@ DROGON_CONF_OPTS = \
 HOST_DROGON_CONF_OPTS = \
 	-DBUILD_CTL=ON \
 	-DBUILD_EXAMPLES=OFF \
-	-DBUILD_TESTS=OFF
+	-DBUILD_TESTS=OFF \
+	-DTRANTOR_USE_TLS=none
 
 ifeq ($(BR2_PACKAGE_DROGON_BROTLI),y)
 DROGON_DEPENDENCIES += brotli
@@ -57,6 +58,16 @@ else
 DROGON_CONF_OPTS += -DBUILD_ORM=OFF
 endif
 
+ifeq ($(BR2_PACKAGE_OPENSSL),y)
+DROGON_DEPENDENCIES += openssl
+DROGON_CONF_OPTS += -DTRANTOR_USE_TLS=openssl
+else ifeq ($(BR2_PACKAGE_BOTAN),y)
+DROGON_DEPENDENCIES += botan
+DROGON_CONF_OPTS += -DTRANTOR_USE_TLS=botan
+else
+DROGON_CONF_OPTS += -DTRANTOR_USE_TLS=none
+endif
+
 ifeq ($(BR2_PACKAGE_DROGON_YAML_CONFIG),y)
 DROGON_DEPENDENCIES += yaml-cpp
 DROGON_CONF_OPTS += -DBUILD_YAML_CONFIG=ON
-- 
2.43.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 2/2] package/drogon: fix build with LibreSSL

[Dario Binacchi]

The trantor library bundled in drogon 1.9.14 fails to build against
LibreSSL, because it uses SSL_CTX_set_cert_cb(), which LibreSSL does
not provide.

Add the patch submitted upstream, which disables that call when
building against LibreSSL. The patch description explains the details.

Fixes:
 - https://autobuild.buildroot.org/results/f1c7a336f3fabb2d2a2793930573b69bc47c3ee7
 - https://autobuild.buildroot.org/results/795c9ab125a029f0d90a267147cb6d6d80887688

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
---
 ...0001-trantor-fix-build-with-LibreSSL.patch | 73 +++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 package/drogon/0001-trantor-fix-build-with-LibreSSL.patch

diff --git a/package/drogon/0001-trantor-fix-build-with-LibreSSL.patch b/package/drogon/0001-trantor-fix-build-with-LibreSSL.patch
new file mode 100644
index 000000000000..d608efbc23cb
--- /dev/null
+++ b/package/drogon/0001-trantor-fix-build-with-LibreSSL.patch
@@ -0,0 +1,73 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Date: Tue, 27 Oct 2026 11:39:26 +0100
+Subject: [PATCH] Fix build with LibreSSL
+
+The Buildroot autobuilders reported that trantor, built as part of
+drogon, fails to compile against LibreSSL [1]. This patch fixes the
+two errors below.
+
+1) SSL_CTX_set_cert_cb() is not declared
+
+OpenSSLProvider.cc:1623:9: error: 'SSL_CTX_set_cert_cb' was not declared in this scope
+
+Commit 7d3aac802ff5 ("Fixes and update to TLS subsystem (#411)") calls
+SSL_CTX_set_cert_cb() to choose the server certificate during the TLS
+handshake but LibreSSL does not provide this function.
+
+The same commit also registers a servername callback, which LibreSSL
+supports and which chooses the server certificate as well, but only
+when the client sends SNI. With LibreSSL, clients that do not send SNI
+therefore get no certificate.
+
+2) lastOpenSSLError() is defined but not used
+
+OpenSSLProvider.cc:261:20: error: 'std::string internal::lastOpenSSLError()' defined but not used [-Werror=unused-function]
+
+lastOpenSSLError() is only called by code that is not built with
+LibreSSL. With LibreSSL the function is unused, and -Werror turns the
+resulting warning into an error.
+
+[1] https://autobuild.buildroot.org/results/f1c7a336f3fabb2d2a2793930573b69bc47c3ee7
+
+Upstream: https://github.com/an-tao/trantor/pull/422
+Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+---
+ trantor/net/inner/tlsprovider/OpenSSLProvider.cc | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/trantor/trantor/net/inner/tlsprovider/OpenSSLProvider.cc b/trantor/trantor/net/inner/tlsprovider/OpenSSLProvider.cc
+index e876ee97faf1..7b6f42d88d32 100644
+--- a/trantor/trantor/net/inner/tlsprovider/OpenSSLProvider.cc
++++ b/trantor/trantor/net/inner/tlsprovider/OpenSSLProvider.cc
+@@ -258,6 +258,7 @@ static bool isDirectory(const std::string &path)
+ #endif
+ }
+ 
++#ifndef LIBRESSL_VERSION_NUMBER
+ static std::string lastOpenSSLError()
+ {
+     const auto error = ERR_get_error();
+@@ -267,6 +268,7 @@ static std::string lastOpenSSLError()
+     ERR_error_string_n(error, message.data(), message.size());
+     return message.data();
+ }
++#endif
+ 
+ static void freeCertificateNames(STACK_OF(X509_NAME) * names)
+ {
+@@ -1620,9 +1622,14 @@ SSLContextPtr trantor::newSSLContext(const TLSPolicy &policy, bool isServer)
+             ctx->ctx(),
+             static_cast<int (*)(SSL *, int *, void *)>(
+                 &OpenSSLProvider::selectServerCertificate));
++#ifndef LIBRESSL_VERSION_NUMBER
++        // LibreSSL lacks SSL_CTX_set_cert_cb(). There, the certificate is
++        // selected by the servername callback only, so clients not sending
++        // SNI won't get a certificate.
+         SSL_CTX_set_cert_cb(ctx->ctx(),
+                             &OpenSSLProvider::configureServerCertificate,
+                             nullptr);
++#endif
+         // A resumed handshake may not select a certificate at all. Do not
+         // resume one without consulting the current runtime provider.
+         SSL_CTX_set_session_cache_mode(ctx->ctx(), SSL_SESS_CACHE_OFF);
-- 
2.43.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/2] package/drogon: fix optional TLS dependency

[Thomas Petazzoni via buildroot]

On Tue, Oct 27, 2026 at 03:41:57PM +0100, Dario Binacchi wrote:
> The trantor library bundled in drogon looks for a TLS library at
> configure time, and uses OpenSSL or Botan if it finds one. Since
> drogon.mk does not declare any dependency on them, TLS support ends up
> depending on whether OpenSSL or Botan happens to be built before
> drogon.
> 
> Select the TLS library explicitly, following the same order as trantor,
> so that OpenSSL is preferred over Botan.
> 
> host-drogon only provides drogon_ctl, which does not need TLS, so
> disable it there to avoid picking up the TLS libraries of the build
> machine.
> 
> Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>

Applied to master after adding a Fixes: tag pointing to the commit
that added the drogon package. Thanks!

Best regards,

Thomas Petazzoni
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 2/2] package/drogon: fix build with LibreSSL

[Thomas Petazzoni via buildroot]

On Tue, Oct 27, 2026 at 03:41:58PM +0100, Dario Binacchi wrote:
> The trantor library bundled in drogon 1.9.14 fails to build against
> LibreSSL, because it uses SSL_CTX_set_cert_cb(), which LibreSSL does
> not provide.
> 
> Add the patch submitted upstream, which disables that call when
> building against LibreSSL. The patch description explains the details.
> 
> Fixes:
>  - https://autobuild.buildroot.org/results/f1c7a336f3fabb2d2a2793930573b69bc47c3ee7
>  - https://autobuild.buildroot.org/results/795c9ab125a029f0d90a267147cb6d6d80887688
> 
> Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>

I am not super comfortable applying this one, I'd really like to see
upstream's feedback before applying. Of course, if another Buildroot
maintainer is comfortable with what the patch is doing, don't hesitate
to apply.

Best regards,

Thomas Petazzoni
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 2/2] package/drogon: fix build with LibreSSL

[Dario Binacchi]

[-- Attachment #1.1: Type: text/plain, Size: 1689 bytes --]

Hi Thomas

On Tue, Oct 27, 2026 at 5:27 PM Thomas Petazzoni <
thomas.petazzoni@bootlin.com> wrote:

> On Tue, Oct 27, 2026 at 03:41:58PM +0100, Dario Binacchi wrote:
> > The trantor library bundled in drogon 1.9.14 fails to build against
> > LibreSSL, because it uses SSL_CTX_set_cert_cb(), which LibreSSL does
> > not provide.
> >
> > Add the patch submitted upstream, which disables that call when
> > building against LibreSSL. The patch description explains the details.
> >
> > Fixes:
> >  -
> https://autobuild.buildroot.org/results/f1c7a336f3fabb2d2a2793930573b69bc47c3ee7
> >  -
> https://autobuild.buildroot.org/results/795c9ab125a029f0d90a267147cb6d6d80887688
> >
> > Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
>
> I am not super comfortable applying this one, I'd really like to see
> upstream's feedback before applying. Of course, if another Buildroot
> maintainer is comfortable with what the patch is doing, don't hesitate
> to apply.
>

The fix has now been merged upstream, unchanged:
https://github.com/an-tao/trantor/commit/a77cc3651d5950f2f8aeceab80f74f31870f4017

I sent a v2 that points to the upstream commit.

Thanks and regards,
Dario


> Best regards,
>
> Thomas Petazzoni
> --
> Thomas Petazzoni, co-owner and CEO, Bootlin
> Embedded Linux and Kernel engineering and training
> https://bootlin.com
>


-- 
*Dario Binacchi*
Senior Embedded Software Engineer
M. +39 328 0625246
dario.binacchi@amarulasolutions.com
―――――――――――――――
Amarula Solutions SRL
 Via Felice Cavallotti 25D, 41012 Carpi, MO, IT
info@amarulasolutions.com
www.amarulasolutions.com

[-- Attachment #1.2: Type: text/html, Size: 4198 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot