Received-SPF: pass (google.com: domain of
 bounce+53652+229+1686473+6695773@lists.yoctoproject.org designates
 66.175.222.108 as permitted sender) client-ip=66.175.222.108;
From: "Shachar Menashe" <shachar@vdoo.com>
To: "yocto-security@lists.yoctoproject.org"
	<yocto-security@lists.yoctoproject.org>
Subject: [yocto-security] [PATCH] openssl: drop support for deprecated
 algorithms
Thread-Topic: [PATCH] openssl: drop support for deprecated algorithms
Thread-Index: AdbWHlrVfB78095ZTc64dfQve/9rEwAAiJVw
Date: Sat, 19 Dec 2020 16:04:30 +0000
Message-ID: 
 <AM0PR08MB361713C43176BFA1C7295477C5C20@AM0PR08MB3617.eurprd08.prod.outlook.com>
References: 
 <AM0PR08MB3617B053AC97B2A4AF7305D4C5C20@AM0PR08MB3617.eurprd08.prod.outlook.com>
In-Reply-To: 
 <AM0PR08MB3617B053AC97B2A4AF7305D4C5C20@AM0PR08MB3617.eurprd08.prod.outlook.com>
Accept-Language: en-US
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id:
 07bac3be-1786-4065-1cb5-08d8a437c4e8
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Dec 2020 16:04:30.5868
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: a81b5702-409b-4c2e-9bda-9307e6e5c027
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname:
 TWnyVLA5tcW3mjojumsCtirXScbMe5GQFA7aBpK3YgjevmWoG70YQWU1kduY+jIhY4MTVxH8PzrxKEpISIasng==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9PR08MB5939
Precedence: Bulk
List-Unsubscribe: <https://lists.yoctoproject.org/g/yocto-security/unsub>
Sender: yocto-security@lists.yoctoproject.org
List-Id: <yocto-security.lists.yoctoproject.org>
Mailing-List: list yocto-security@lists.yoctoproject.org; contact
 yocto-security+owner@lists.yoctoproject.org
Delivered-To: mailing list yocto-security@lists.yoctoproject.org
List-Post: <mailto:yocto-security@lists.yoctoproject.org>
Content-Type: multipart/mixed; boundary="jO9GfYyJPTga3ENA8FBN"
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;
 d=lists.yoctoproject.org; q=dns/txt; s=20140610; t=1608393874;
 bh=TDWw7f8oCnjjewb0VEu1EbjkR9BrTRXzrDfJuovFyQ0=;
 h=Content-Type:Date:From:Subject:To;
 b=g96NXeOzNbfx9UffyNGsM/5EJRr5HbgFmT1qEDkHCSLqA5BQ8FLWIuFGQ3+vMzBkD5z
 kljpEP9+QjBIpUoJ88b6tW89RKyexVTKMcEzW28QDuSpLK01Naj5HdlF0sxy9kvGbPOzO
 sXy8uaaLcbt0a3cAOT2EVZ2B6D5dfkz7aEI=
X-Virus-Scanned: clamav-milter 0.102.3 at dan
X-Virus-Status: Clean


--jO9GfYyJPTga3ENA8FBN
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

1. Drop support for many deprecated algorithms by default
2. Allow dropping support for TLS 1.0/1.1 via PACKAGECONFIG

Signed-off-by: Shachar Menashe <shachar@vdoo.com>
---
 meta/recipes-connectivity/openssl/openssl_1.1.1g.bb | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/meta/recipes-connectivity/openssl/openssl_1.1.1g.bb b/meta/rec=
ipes-connectivity/openssl/openssl_1.1.1g.bb
index 8159558..f9764bd 100644
--- a/meta/recipes-connectivity/openssl/openssl_1.1.1g.bb
+++ b/meta/recipes-connectivity/openssl/openssl_1.1.1g.bb
@@ -33,6 +33,8 @@ PACKAGECONFIG_class-native =3D ""
 PACKAGECONFIG_class-nativesdk =3D ""
=20
 PACKAGECONFIG[cryptodev-linux] =3D "enable-devcryptoeng,disable-devcryptoe=
ng,cryptodev-linux,,cryptodev-module"
+PACKAGECONFIG[no-tls1] =3D "no-tls1"
+PACKAGECONFIG[no-tls1_1] =3D "no-tls1_1"
=20
 B =3D "${WORKDIR}/build"
 do_configure[cleandirs] =3D "${B}"
@@ -52,6 +54,10 @@ EXTRA_OECONF_class-nativesdk =3D "--with-rand-seed=3Dos,=
devrandom"
 CFLAGS_append_class-native =3D " -DOPENSSLDIR=3D/not/builtin -DENGINESDIR=
=3D/not/builtin"
 CFLAGS_append_class-nativesdk =3D " -DOPENSSLDIR=3D/not/builtin -DENGINESD=
IR=3D/not/builtin"
=20
+# Disable deprecated crypto algorithms
+# Retained for compatibilty - des (curl), dh (python-ssl), dsa (rpm)
+DEPRECATED_CRYPTO_FLAGS =3D " no-ssl no-idea no-psk no-rc2 no-rc4 no-rc5 n=
o-md2 no-md4 no-srp no-camellia no-bf no-mdc2 no-scrypt no-seed no-siphash =
no-sm2 no-sm3 no-sm4 no-whirlpool"
+
 do_configure () {
 	os=3D${HOST_OS}
 	case $os in
@@ -122,7 +128,7 @@ do_configure () {
 	# WARNING: do not set compiler/linker flags (-I/-D etc.) in EXTRA_OECONF,=
 as they will fully replace the
 	# environment variables set by bitbake. Adjust the environment variables =
instead.
 	HASHBANGPERL=3D"/usr/bin/env perl" PERL=3Dperl PERL5LIB=3D"${S}/external/=
perl/Text-Template-1.46/lib/" \
-	perl ${S}/Configure ${EXTRA_OECONF} ${PACKAGECONFIG_CONFARGS} --prefix=3D=
$useprefix --openssldir=3D${libdir}/ssl-1.1 --libdir=3D${libdir} $target
+	perl ${S}/Configure ${EXTRA_OECONF} ${PACKAGECONFIG_CONFARGS} ${DEPRECATE=
D_CRYPTO_FLAGS} --prefix=3D$useprefix --openssldir=3D${libdir}/ssl-1.1 --li=
bdir=3D${libdir} $target
 	perl ${B}/configdata.pm --dump
 }
=20
--=20
2.17.1

--jO9GfYyJPTga3ENA8FBN
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable


-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-
Links: You receive all messages sent to this group.
View/Reply Online (#229): https://lists.yoctoproject.org/g/yocto-security/=
message/229
Mute This Topic: https://lists.yoctoproject.org/mt/79085238/1686473
Group Owner: yocto-security+owner@lists.yoctoproject.org
Unsubscribe: https://lists.yoctoproject.org/g/yocto-security/unsub [richar=
d.purdie@linuxfoundation.org]
-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-


--jO9GfYyJPTga3ENA8FBN--