[meta-oe][PATCH 1/3] libtommath: add recipe for LibTomMath used by dropbear

[meta-oe][PATCH 1/3] libtommath: add recipe for LibTomMath used by dropbear

[Martin Jansa]

* When system-libtom PACKAGECONFIG is used, both libtomcrypt and libtommath
  are used from system and we need a recipes for both.

* libtomcrypt was already added to meta-oe in langdale and PACKAGECONFIG
  was added in dropbear in:
  https://git.openembedded.org/openembedded-core/commit/?id=b7c2edd2d6ded287d8b34dd047ae84d3fd69d4c6

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
---
 .../libtommath/libtommath_1.2.0.bb            | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 meta-oe/recipes-support/libtommath/libtommath_1.2.0.bb

diff --git a/meta-oe/recipes-support/libtommath/libtommath_1.2.0.bb b/meta-oe/recipes-support/libtommath/libtommath_1.2.0.bb
new file mode 100644
index 0000000000..05fe6d079b
--- /dev/null
+++ b/meta-oe/recipes-support/libtommath/libtommath_1.2.0.bb
@@ -0,0 +1,26 @@
+SUMMARY = "LibTomMath is a number theoretic multiple-precision integer library"
+HOMEPAGE = "https://www.libtom.net/LibTomMath"
+SECTION = "libs"
+LICENSE = "Unlicense"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=23e7e0a32e53a2b1d35f5fd9ef053402"
+
+SRC_URI = "git://github.com/libtom/libtommath.git;protocol=https;branch=master"
+
+SRCREV = "6ca6898bf37f583c4cc9943441cd60dd69f4b8f2"
+
+S = "${WORKDIR}/git"
+
+# For libtomcrypt to use libtommath.a and avoid:
+# http://errors.yoctoproject.org/Errors/Details/720465/
+# ld: TOPDIR/tmp-glibc/work/core2-64-oe-linux/libtomcrypt/1.18.2-r0/recipe-sysroot/usr/lib/libtommath.a(bn_mp_cnt_lsb.o): relocation R_X86_64_32S against `.rodata' can not be used when making a shared object; recompile with -fPIC
+CFLAGS += "-fPIC"
+
+EXTRA_OEMAKE = "'PREFIX=${prefix}' 'DESTDIR=${D}' 'LIBPATH=${libdir}' 'CFLAGS=${CFLAGS}'"
+
+do_compile() {
+    oe_runmake -f makefile.shared
+}
+
+do_install() {
+    oe_runmake -f makefile.shared install
+}
-- 
2.41.0

[meta-oe][PATCH 2/3] libtomcrypt: backport a fix for CVE-2019-17362

[Martin Jansa]

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
---
 .../libtomcrypt/CVE-2019-17362.patch          | 25 +++++++++++++++++++
 .../libtomcrypt/libtomcrypt_1.18.2.bb         |  4 ++-
 2 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 meta-oe/recipes-crypto/libtomcrypt/libtomcrypt/CVE-2019-17362.patch

diff --git a/meta-oe/recipes-crypto/libtomcrypt/libtomcrypt/CVE-2019-17362.patch b/meta-oe/recipes-crypto/libtomcrypt/libtomcrypt/CVE-2019-17362.patch
new file mode 100644
index 0000000000..8b7348a11f
--- /dev/null
+++ b/meta-oe/recipes-crypto/libtomcrypt/libtomcrypt/CVE-2019-17362.patch
@@ -0,0 +1,25 @@
+From 25c26a3b7a9ad8192ccc923e15cf62bf0108ef94 Mon Sep 17 00:00:00 2001
+From: werew <werew@ret2libc.com>
+Date: Thu, 3 Oct 2019 19:57:10 +0200
+Subject: [PATCH] Fixes #507
+
+Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
+---
+Upstream-Status: Backport [https://github.com/libtom/libtomcrypt/commit/64d1153e5a515740ab56f39c46baf4cf6991a9d3]
+
+ src/pk/asn1/der/utf8/der_decode_utf8_string.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/pk/asn1/der/utf8/der_decode_utf8_string.c b/src/pk/asn1/der/utf8/der_decode_utf8_string.c
+index 94555b99f..d3ed82bea 100644
+--- a/src/pk/asn1/der/utf8/der_decode_utf8_string.c
++++ b/src/pk/asn1/der/utf8/der_decode_utf8_string.c
+@@ -65,7 +65,7 @@ int der_decode_utf8_string(const unsigned char *in,  unsigned long inlen,
+       /* count number of bytes */
+       for (z = 0; (tmp & 0x80) && (z <= 4); z++, tmp = (tmp << 1) & 0xFF);
+ 
+-      if (z > 4 || (x + (z - 1) > inlen)) {
++      if (z == 1 || z > 4 || (x + (z - 1) > inlen)) {
+          return CRYPT_INVALID_PACKET;
+       }
+ 
diff --git a/meta-oe/recipes-crypto/libtomcrypt/libtomcrypt_1.18.2.bb b/meta-oe/recipes-crypto/libtomcrypt/libtomcrypt_1.18.2.bb
index b144338921..8b73cdda85 100644
--- a/meta-oe/recipes-crypto/libtomcrypt/libtomcrypt_1.18.2.bb
+++ b/meta-oe/recipes-crypto/libtomcrypt/libtomcrypt_1.18.2.bb
@@ -6,7 +6,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=71baacc459522324ef3e2b9e052e8180"
 
 DEPENDS += "libtool-cross"
 
-SRC_URI = "git://github.com/libtom/libtomcrypt.git;protocol=https;branch=master"
+SRC_URI = "git://github.com/libtom/libtomcrypt.git;protocol=https;branch=master \
+   file://CVE-2019-17362.patch \
+"
 
 SRCREV = "7e7eb695d581782f04b24dc444cbfde86af59853"
 
-- 
2.41.0

[meta-oe][PATCH 3/3] libtomcrypt: add PACKAGECONFIG for ltm enabled by default

[Martin Jansa]

* enabled by default, because that's what dropbear expects and fails
  without as shown in:
  http://errors.yoctoproject.org/Errors/Details/720460/
  dropbear/2022.83-r0/crypto_desc.c:72: undefined reference to `ltm_desc'

* add comment about the LICENSE
* use EXTRA_OEMAKE

* FYI: if you need to use this in dunfell (for whatever reason e.g. to
  avoid CVE-2019-17362 in dropbear which contains bundled libtomcrypt),
  then you need to add:

  # Only needed for dunfell, fixed in kirkstone with:
  # https://git.openembedded.org/openembedded-core/commit/?h=kirkstone&id=4b308773eca7570ce5007e8f953b56252c17fdb1
  DEPENDS += "libtool-cross"
  EXTRA_OEMAKE += "'LIBTOOL=${HOST_SYS}-libtool'"

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
---
 .../libtomcrypt/libtomcrypt_1.18.2.bb         | 21 ++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/meta-oe/recipes-crypto/libtomcrypt/libtomcrypt_1.18.2.bb b/meta-oe/recipes-crypto/libtomcrypt/libtomcrypt_1.18.2.bb
index 8b73cdda85..274f94356f 100644
--- a/meta-oe/recipes-crypto/libtomcrypt/libtomcrypt_1.18.2.bb
+++ b/meta-oe/recipes-crypto/libtomcrypt/libtomcrypt_1.18.2.bb
@@ -1,11 +1,18 @@
 SUMMARY = "LibTomCrypt is a public domain open source cryptographic toolkit"
 HOMEPAGE = "https://www.libtom.net/LibTomCrypt"
 SECTION = "libs"
+# Unlicense isn't very accurate for this revision, it was WTFPL in 0.18.0-rc1:
+# https://github.com/libtom/libtomcrypt/commit/77e31fb6a980212e90b9a50f116dc5a7bd91e527
+# then updated to dual license PD and WTFPL also in 0.18.0-rc1:
+# https://github.com/libtom/libtomcrypt/commit/412b2ee1fccc3a0df58f93f372c90d6d0f93bfc9
+# and then updated again to Unlicense after the 0.18.2 tag (it's only in develop branch):
+# https://github.com/libtom/libtomcrypt/commit/3630bee6fc0f73dd9c7923fd43f8ae15a2c0fb70
+# but keep using Unlicense to avoid triggering people with WTFPL license:
+# https://groups.google.com/g/libtom/c/17Z7xkECULM
+# and this comment can be removed next time libtomcrypt is updated
 LICENSE = "Unlicense"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=71baacc459522324ef3e2b9e052e8180"
 
-DEPENDS += "libtool-cross"
-
 SRC_URI = "git://github.com/libtom/libtomcrypt.git;protocol=https;branch=master \
    file://CVE-2019-17362.patch \
 "
@@ -14,10 +21,18 @@ SRCREV = "7e7eb695d581782f04b24dc444cbfde86af59853"
 
 S = "${WORKDIR}/git"
 
+PACKAGECONFIG ??= "ltm"
+PACKAGECONFIG[ltm] = ",,libtommath"
+
+CFLAGS += "${@bb.utils.contains('PACKAGECONFIG', 'ltm', '-DUSE_LTM -DLTM_DESC', '', d)}"
+
+EXTRA_OEMAKE = "'PREFIX=${prefix}' 'DESTDIR=${D}' 'LIBPATH=${libdir}' 'CFLAGS=${CFLAGS}'"
+EXTRA_OEMAKE += "${@bb.utils.contains('PACKAGECONFIG', 'ltm', 'EXTRALIBS=${STAGING_LIBDIR}/libtommath.a', '', d)}"
+
 do_compile() {
     oe_runmake -f makefile.shared
 }
 
 do_install() {
-    oe_runmake -f makefile.shared 'PREFIX=${prefix}' 'DESTDIR=${D}' 'LIBPATH=${libdir}' install
+    oe_runmake -f makefile.shared install
 }
-- 
2.41.0