1SUMMARY = "Secure Socket Layer"
2DESCRIPTION = "Secure Socket Layer (SSL) binary and related cryptographic tools."
3HOMEPAGE = "http://www.openssl.org/"
4BUGTRACKER = "http://www.openssl.org/news/vulnerabilities.html"
5SECTION = "libs/network"
6
7LICENSE = "Apache-2.0"
8LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=c75985e733726beaba57bc5253e96d04"
9
10SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \
11           file://run-ptest \
12           file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \
13           file://0001-Configure-do-not-tweak-mips-cflags.patch \
14           file://0001-Added-handshake-history-reporting-when-test-fails.patch \
15           file://bti.patch \
16           file://CVE-2024-2511.patch \
17           "
18
19SRC_URI:append:class-nativesdk = " \
20           file://environment.d-openssl.sh \
21           "
22
23SRC_URI[sha256sum] = "83c7329fe52c850677d75e5d0b0ca245309b97e8ecbcfdc1dfdc4ab9fac35b39"
24
25inherit lib_package multilib_header multilib_script ptest perlnative manpages
26MULTILIB_SCRIPTS = "${PN}-bin:${bindir}/c_rehash"
27
28PACKAGECONFIG ?= ""
29PACKAGECONFIG:class-native = ""
30PACKAGECONFIG:class-nativesdk = ""
31
32PACKAGECONFIG[cryptodev-linux] = "enable-devcryptoeng,disable-devcryptoeng,cryptodev-linux,,cryptodev-module"
33PACKAGECONFIG[no-tls1] = "no-tls1"
34PACKAGECONFIG[no-tls1_1] = "no-tls1_1"
35PACKAGECONFIG[manpages] = ""
36
37B = "${WORKDIR}/build"
38do_configure[cleandirs] = "${B}"
39
40#| ./libcrypto.so: undefined reference to `getcontext'
41#| ./libcrypto.so: undefined reference to `setcontext'
42#| ./libcrypto.so: undefined reference to `makecontext'
43EXTRA_OECONF:append:libc-musl = " no-async"
44EXTRA_OECONF:append:libc-musl:powerpc64 = " no-asm"
45
46# adding devrandom prevents openssl from using getrandom() which is not available on older glibc versions
47# (native versions can be built with newer glibc, but then relocated onto a system with older glibc)
48EXTRA_OECONF:class-native = "--with-rand-seed=os,devrandom"
49EXTRA_OECONF:class-nativesdk = "--with-rand-seed=os,devrandom"
50
51# Relying on hardcoded built-in paths causes openssl-native to not be relocateable from sstate.
52CFLAGS:append:class-native = " -DOPENSSLDIR=/not/builtin -DENGINESDIR=/not/builtin"
53CFLAGS:append:class-nativesdk = " -DOPENSSLDIR=/not/builtin -DENGINESDIR=/not/builtin"
54
55# This allows disabling deprecated or undesirable crypto algorithms.
56# The default is to trust upstream choices.
57DEPRECATED_CRYPTO_FLAGS ?= ""
58
59do_configure () {
60	# When we upgrade glibc but not uninative we see obtuse failures in openssl. Make
61	# the issue really clear that perl isn't functional due to symbol mismatch issues.
62	cat <<- EOF > ${WORKDIR}/perltest
63	#!/usr/bin/env perl
64	use POSIX;
65	EOF
66	chmod a+x ${WORKDIR}/perltest
67	${WORKDIR}/perltest
68
69	os=${HOST_OS}
70	case $os in
71	linux-gnueabi |\
72	linux-gnuspe |\
73	linux-musleabi |\
74	linux-muslspe |\
75	linux-musl )
76		os=linux
77		;;
78	*)
79		;;
80	esac
81	target="$os-${HOST_ARCH}"
82	case $target in
83	linux-arc | linux-microblaze*)
84		target=linux-latomic
85		;;
86	linux-arm*)
87		target=linux-armv4
88		;;
89	linux-aarch64*)
90		target=linux-aarch64
91		;;
92	linux-i?86 | linux-viac3)
93		target=linux-x86
94		;;
95	linux-gnux32-x86_64 | linux-muslx32-x86_64 )
96		target=linux-x32
97		;;
98	linux-gnu64-x86_64)
99		target=linux-x86_64
100		;;
101	linux-loongarch64)
102		target=linux64-loongarch64
103		;;
104	linux-mips | linux-mipsel)
105		# specifying TARGET_CC_ARCH prevents openssl from (incorrectly) adding target architecture flags
106		target="linux-mips32 ${TARGET_CC_ARCH}"
107		;;
108	linux-gnun32-mips*)
109		target=linux-mips64
110		;;
111	linux-*-mips64 | linux-mips64 | linux-*-mips64el | linux-mips64el)
112		target=linux64-mips64
113		;;
114	linux-nios2* | linux-sh3 | linux-sh4 | linux-arc*)
115		target=linux-generic32
116		;;
117	linux-powerpc)
118		target=linux-ppc
119		;;
120	linux-powerpc64)
121		target=linux-ppc64
122		;;
123	linux-powerpc64le)
124		target=linux-ppc64le
125		;;
126	linux-riscv32)
127		target=linux32-riscv32
128		;;
129	linux-riscv64)
130		target=linux64-riscv64
131		;;
132	linux-sparc | linux-supersparc)
133		target=linux-sparcv9
134		;;
135	mingw32-x86_64)
136		target=mingw64
137		;;
138	esac
139
140	useprefix=${prefix}
141	if [ "x$useprefix" = "x" ]; then
142		useprefix=/
143	fi
144	# WARNING: do not set compiler/linker flags (-I/-D etc.) in EXTRA_OECONF, as they will fully replace the
145	# environment variables set by bitbake. Adjust the environment variables instead.
146	PERLEXTERNAL="$(realpath ${S}/external/perl/Text-Template-*/lib)"
147	test -d "$PERLEXTERNAL" || bberror "PERLEXTERNAL '$PERLEXTERNAL' not found!"
148	HASHBANGPERL="/usr/bin/env perl" PERL=perl PERL5LIB="$PERLEXTERNAL" \
149	perl ${S}/Configure ${EXTRA_OECONF} ${PACKAGECONFIG_CONFARGS} ${DEPRECATED_CRYPTO_FLAGS} --prefix=$useprefix --openssldir=${libdir}/ssl-3 --libdir=${libdir} $target
150	perl ${B}/configdata.pm --dump
151}
152
153do_install () {
154	oe_runmake DESTDIR="${D}" MANDIR="${mandir}" MANSUFFIX=ssl install_sw install_ssldirs ${@bb.utils.contains('PACKAGECONFIG', 'manpages', 'install_docs', '', d)}
155
156	oe_multilib_header openssl/opensslconf.h
157	oe_multilib_header openssl/configuration.h
158
159	# Create SSL structure for packages such as ca-certificates which
160	# contain hard-coded paths to /etc/ssl. Debian does the same.
161	install -d ${D}${sysconfdir}/ssl
162	mv ${D}${libdir}/ssl-3/certs \
163	   ${D}${libdir}/ssl-3/private \
164	   ${D}${libdir}/ssl-3/openssl.cnf \
165	   ${D}${sysconfdir}/ssl/
166
167	# Although absolute symlinks would be OK for the target, they become
168	# invalid if native or nativesdk are relocated from sstate.
169	ln -sf ${@oe.path.relative('${libdir}/ssl-3', '${sysconfdir}/ssl/certs')} ${D}${libdir}/ssl-3/certs
170	ln -sf ${@oe.path.relative('${libdir}/ssl-3', '${sysconfdir}/ssl/private')} ${D}${libdir}/ssl-3/private
171	ln -sf ${@oe.path.relative('${libdir}/ssl-3', '${sysconfdir}/ssl/openssl.cnf')} ${D}${libdir}/ssl-3/openssl.cnf
172}
173
174do_install:append:class-native () {
175	create_wrapper ${D}${bindir}/openssl \
176	    OPENSSL_CONF=${libdir}/ssl-3/openssl.cnf \
177	    SSL_CERT_DIR=${libdir}/ssl-3/certs \
178	    SSL_CERT_FILE=${libdir}/ssl-3/cert.pem \
179	    OPENSSL_ENGINES=${libdir}/engines-3 \
180	    OPENSSL_MODULES=${libdir}/ossl-modules
181}
182
183do_install:append:class-nativesdk () {
184	mkdir -p ${D}${SDKPATHNATIVE}/environment-setup.d
185	install -m 644 ${WORKDIR}/environment.d-openssl.sh ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh
186	sed 's|/usr/lib/ssl/|/usr/lib/ssl-3/|g' -i ${D}${SDKPATHNATIVE}/environment-setup.d/openssl.sh
187}
188
189PTEST_BUILD_HOST_FILES += "configdata.pm"
190PTEST_BUILD_HOST_PATTERN = "perl_version ="
191do_install_ptest () {
192	install -d ${D}${PTEST_PATH}/test
193	install -m755 ${B}/test/p_test.so ${D}${PTEST_PATH}/test
194	install -m755 ${B}/test/p_minimal.so ${D}${PTEST_PATH}/test
195	install -m755 ${B}/test/provider_internal_test.cnf ${D}${PTEST_PATH}/test
196
197	# Prune the build tree
198	rm -f ${B}/fuzz/*.* ${B}/test/*.*
199
200	cp ${S}/Configure ${B}/configdata.pm ${D}${PTEST_PATH}
201	sed 's|${S}|${PTEST_PATH}|g' -i ${D}${PTEST_PATH}/configdata.pm
202	cp -r ${S}/external ${B}/test ${S}/test ${B}/fuzz ${S}/util ${B}/util ${D}${PTEST_PATH}
203
204	# For test_shlibload
205	ln -s ${libdir}/libcrypto.so.1.1 ${D}${PTEST_PATH}/
206	ln -s ${libdir}/libssl.so.1.1 ${D}${PTEST_PATH}/
207
208	install -d ${D}${PTEST_PATH}/apps
209	ln -s ${bindir}/openssl ${D}${PTEST_PATH}/apps
210	install -m644 ${S}/apps/*.pem ${S}/apps/*.srl ${S}/apps/openssl.cnf ${D}${PTEST_PATH}/apps
211	install -m755 ${B}/apps/CA.pl ${D}${PTEST_PATH}/apps
212
213	install -d ${D}${PTEST_PATH}/engines
214	install -m755 ${B}/engines/dasync.so ${D}${PTEST_PATH}/engines
215	install -m755 ${B}/engines/loader_attic.so ${D}${PTEST_PATH}/engines
216	install -m755 ${B}/engines/ossltest.so ${D}${PTEST_PATH}/engines
217
218	install -d ${D}${PTEST_PATH}/providers
219	install -m755 ${B}/providers/legacy.so ${D}${PTEST_PATH}/providers
220
221	install -d ${D}${PTEST_PATH}/Configurations
222	cp -rf ${S}/Configurations/* ${D}${PTEST_PATH}/Configurations/
223
224	# seems to be needed with perl 5.32.1
225	install -d ${D}${PTEST_PATH}/util/perl/recipes
226	cp ${D}${PTEST_PATH}/test/recipes/tconversion.pl ${D}${PTEST_PATH}/util/perl/recipes/
227
228	sed 's|${S}|${PTEST_PATH}|g' -i ${D}${PTEST_PATH}/util/wrap.pl
229}
230
231# Add the openssl.cnf file to the openssl-conf package. Make the libcrypto
232# package RRECOMMENDS on this package. This will enable the configuration
233# file to be installed for both the openssl-bin package and the libcrypto
234# package since the openssl-bin package depends on the libcrypto package.
235
236PACKAGES =+ "libcrypto libssl openssl-conf ${PN}-engines ${PN}-misc ${PN}-ossl-module-legacy"
237
238FILES:libcrypto = "${libdir}/libcrypto${SOLIBS}"
239FILES:libssl = "${libdir}/libssl${SOLIBS}"
240FILES:openssl-conf = "${sysconfdir}/ssl/openssl.cnf \
241                      ${libdir}/ssl-3/openssl.cnf* \
242                      "
243FILES:${PN}-engines = "${libdir}/engines-3"
244# ${prefix} comes from what we pass into --prefix at configure time (which is used for INSTALLTOP)
245FILES:${PN}-engines:append:mingw32:class-nativesdk = " ${prefix}${libdir}/engines-3"
246FILES:${PN}-misc = "${libdir}/ssl-3/misc ${bindir}/c_rehash"
247FILES:${PN}-ossl-module-legacy = "${libdir}/ossl-modules/legacy.so"
248FILES:${PN} =+ "${libdir}/ssl-3/* ${libdir}/ossl-modules/"
249FILES:${PN}:append:class-nativesdk = " ${SDKPATHNATIVE}/environment-setup.d/openssl.sh"
250
251CONFFILES:openssl-conf = "${sysconfdir}/ssl/openssl.cnf"
252
253RRECOMMENDS:libcrypto += "openssl-conf ${PN}-ossl-module-legacy"
254RDEPENDS:${PN}-misc = "perl"
255RDEPENDS:${PN}-ptest += "openssl-bin perl perl-modules bash sed"
256
257RDEPENDS:${PN}-bin += "openssl-conf"
258
259BBCLASSEXTEND = "native nativesdk"
260
261CVE_PRODUCT = "openssl:openssl"
262
263CVE_VERSION_SUFFIX = "alphabetical"
264
265