projects / openwrt / staging / stintel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
armsr: armv8: enable serial console for Renesas platforms
[openwrt/staging/stintel.git] / package / system / apk / patches / 0002-mbedtls-support.patch
1 From 74ea482102e1a7c1845b3eec19cbdb21264836d4 Mon Sep 17 00:00:00 2001
2 From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
3 Date: Fri, 5 Apr 2024 12:06:56 +0300
4 Subject: [PATCH 1/4] add alternate url wget implementation
5
6 ---
7 .gitlab-ci.yml | 16 ++++-
8 meson.build | 6 +-
9 meson_options.txt | 1 +
10 src/io_url_wget.c | 150 ++++++++++++++++++++++++++++++++++++++++++++++
11 src/meson.build | 4 +-
12 5 files changed, 173 insertions(+), 4 deletions(-)
13 create mode 100644 src/io_url_wget.c
14
15 diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
16 index 7fc86563..b7e00008 100644
17 --- a/.gitlab-ci.yml
18 +++ b/.gitlab-ci.yml
19 @@ -24,7 +24,19 @@ test:alpine:
20 script:
21 - apk update
22 - apk add make gcc git musl-dev openssl-dev linux-headers zlib-dev zstd-dev lua5.3-dev lua5.3-lzlib meson zlib-static zstd-static openssl-libs-static
23 - - meson build
24 + - meson setup build -Dstatic_apk=true
25 + - ninja -C build
26 + tags:
27 + - docker-alpine
28 + - x86_64
29 +
30 +test:alpine-alt-config:
31 + image: alpine
32 + stage: test
33 + script:
34 + - apk update
35 + - apk add make gcc git musl-dev openssl-dev linux-headers zlib-dev lua5.3-dev lua5.3-lzlib meson
36 + - meson setup build -Durl_backend=wget -Dzstd=false
37 - ninja -C build
38 tags:
39 - docker-alpine
40 @@ -38,7 +50,7 @@ test:debian:
41 - apt-get install -y make gcc git libssl-dev zlib1g-dev libzstd-dev lua5.3-dev lua5.2 lua-zlib-dev sudo meson
42 - unlink /bin/sh
43 - ln -s /bin/bash /bin/sh
44 - - meson build
45 + - meson setup build
46 - ninja -C build
47 tags:
48 - docker-alpine
49 diff --git a/meson.build b/meson.build
50 index 1a44c11f..9a14cac0 100644
51 --- a/meson.build
52 +++ b/meson.build
53 @@ -33,6 +33,10 @@ subproject = meson.is_subproject()
54
55 subdir('doc')
56 subdir('portability')
57 -subdir('libfetch')
58 +if get_option('url_backend') == 'libfetch'
59 + subdir('libfetch')
60 +else
61 + libfetch_dep = dependency('', required: false)
62 +endif
63 subdir('src')
64 subdir('tests')
65 diff --git a/meson_options.txt b/meson_options.txt
66 index 693f46ec..940fe9a4 100644
67 --- a/meson_options.txt
68 +++ b/meson_options.txt
69 @@ -5,5 +5,6 @@ option('help', description: 'Build help into apk binaries, needs lua', type: 'fe
70 option('lua', description: 'Build luaapk (lua bindings)', type: 'feature', value: 'auto')
71 option('lua_version', description: 'Lua version to build against', type: 'string', value: '5.3')
72 option('static_apk', description: 'Also build apk.static', type: 'boolean', value: false)
73 +option('url_backend', description: 'URL backend', type: 'combo', choices: ['libfetch', 'wget'], value: 'libfetch')
74 option('uvol_db_target', description: 'Default target for uvol database layer', type: 'string')
75 option('zstd', description: 'Build with zstd support', type: 'boolean', value: true)
76 diff --git a/src/io_url_wget.c b/src/io_url_wget.c
77 new file mode 100644
78 index 00000000..9a929222
79 --- /dev/null
80 +++ b/src/io_url_wget.c
81 @@ -0,0 +1,150 @@
82 +/* io_url_wget.c - Alpine Package Keeper (APK)
83 + *
84 + * Copyright (C) 2005-2008 Natanael Copa <n@tanael.org>
85 + * Copyright (C) 2008-2011 Timo Teräs <timo.teras@iki.fi>
86 + * All rights reserved.
87 + *
88 + * SPDX-License-Identifier: GPL-2.0-only
89 + */
90 +
91 +#include <spawn.h>
92 +#include <unistd.h>
93 +#include <sys/wait.h>
94 +#include "apk_io.h"
95 +
96 +static char wget_timeout[16];
97 +static char wget_no_check_certificate;
98 +
99 +static int wget_translate_status(int status)
100 +{
101 + if (!WIFEXITED(status)) return -EFAULT;
102 + switch (WEXITSTATUS(status)) {
103 + case 0: return 0;
104 + case 3: return -EIO;
105 + case 4: return -ENETUNREACH;
106 + case 5: return -EACCES;
107 + case 6: return -EACCES;
108 + case 7: return -EPROTO;
109 + default: return -APKE_REMOTE_IO;
110 + }
111 +}
112 +
113 +struct apk_wget_istream {
114 + struct apk_istream is;
115 + int fd;
116 + pid_t pid;
117 +};
118 +
119 +static int wget_spawn(const char *url, pid_t *pid, int *fd)
120 +{
121 + int i = 0, r, pipefds[2];
122 + posix_spawn_file_actions_t act;
123 + char *argv[16];
124 +
125 + argv[i++] = "wget";
126 + argv[i++] = "-q";
127 + argv[i++] = "-T";
128 + argv[i++] = wget_timeout;
129 + if (wget_no_check_certificate) argv[i++] = "--no-check-certificate";
130 + argv[i++] = (char *) url;
131 + argv[i++] = "-O";
132 + argv[i++] = "-";
133 + argv[i++] = 0;
134 +
135 + if (pipe2(pipefds, O_CLOEXEC) != 0) return -errno;
136 +
137 + posix_spawn_file_actions_init(&act);
138 + posix_spawn_file_actions_adddup2(&act, pipefds[1], STDOUT_FILENO);
139 + r = posix_spawnp(pid, "wget", &act, 0, argv, environ);
140 + posix_spawn_file_actions_destroy(&act);
141 + if (r != 0) return -r;
142 + close(pipefds[1]);
143 + *fd = pipefds[0];
144 + return 0;
145 +}
146 +
147 +static int wget_check_exit(struct apk_wget_istream *wis)
148 +{
149 + int status;
150 +
151 + if (wis->pid == 0) return apk_istream_error(&wis->is, 0);
152 + if (waitpid(wis->pid, &status, 0) == wis->pid) {
153 + wis->pid = 0;
154 + return apk_istream_error(&wis->is, wget_translate_status(status));
155 + }
156 + return 0;
157 +}
158 +
159 +static void wget_get_meta(struct apk_istream *is, struct apk_file_meta *meta)
160 +{
161 +}
162 +
163 +static ssize_t wget_read(struct apk_istream *is, void *ptr, size_t size)
164 +{
165 + struct apk_wget_istream *wis = container_of(is, struct apk_wget_istream, is);
166 + ssize_t r;
167 +
168 + r = read(wis->fd, ptr, size);
169 + if (r < 0) return -errno;
170 + if (r == 0) return wget_check_exit(wis);
171 + return r;
172 +}
173 +
174 +static int wget_close(struct apk_istream *is)
175 +{
176 + int r = is->err;
177 + struct apk_wget_istream *wis = container_of(is, struct apk_wget_istream, is);
178 +
179 + while (wis->pid != 0)
180 + wget_check_exit(wis);
181 +
182 + close(wis->fd);
183 + free(wis);
184 + return r < 0 ? r : 0;
185 +}
186 +
187 +static const struct apk_istream_ops wget_istream_ops = {
188 + .get_meta = wget_get_meta,
189 + .read = wget_read,
190 + .close = wget_close,
191 +};
192 +
193 +struct apk_istream *apk_io_url_istream(const char *url, time_t since)
194 +{
195 + struct apk_wget_istream *wis;
196 + int r;
197 +
198 + wis = malloc(sizeof(*wis) + apk_io_bufsize);
199 + if (wis == NULL) return ERR_PTR(-ENOMEM);
200 +
201 + *wis = (struct apk_wget_istream) {
202 + .is.ops = &wget_istream_ops,
203 + .is.buf = (uint8_t *)(wis + 1),
204 + .is.buf_size = apk_io_bufsize,
205 + };
206 + r = wget_spawn(url, &wis->pid, &wis->fd);
207 + if (r != 0) {
208 + free(wis);
209 + return ERR_PTR(r);
210 + }
211 +
212 + return &wis->is;
213 +}
214 +
215 +void apk_io_url_no_check_certificate(void)
216 +{
217 + wget_no_check_certificate = 1;
218 +}
219 +
220 +void apk_io_url_set_timeout(int timeout)
221 +{
222 + snprintf(wget_timeout, sizeof wget_timeout, "%d", timeout);
223 +}
224 +
225 +void apk_io_url_set_redirect_callback(void (*cb)(int, const char *))
226 +{
227 +}
228 +
229 +void apk_io_url_init(void)
230 +{
231 +}
232 diff --git a/src/meson.build b/src/meson.build
233 index c1aae550..38e9d3b0 100644
234 --- a/src/meson.build
235 +++ b/src/meson.build
236 @@ -1,3 +1,5 @@
237 +url_backend = get_option('url_backend')
238 +
239 libapk_so_version = '2.99.0'
240 libapk_src = [
241 'adb.c',
242 @@ -22,8 +24,8 @@ libapk_src = [
243 'fs_uvol.c',
244 'hash.c',
245 'io.c',
246 - 'io_url_libfetch.c',
247 'io_gunzip.c',
248 + 'io_url_@0@.c'.format(url_backend),
249 'package.c',
250 'pathbuilder.c',
251 'print.c',
252 --
253 GitLab
254
255
256 From b9fe78fbf19bb10e1d0b8eb1cb1de123bee2ed7e Mon Sep 17 00:00:00 2001
257 From: Christian Marangi <ansuelsmth@gmail.com>
258 Date: Tue, 16 Apr 2024 17:55:15 +0200
259 Subject: [PATCH 2/4] add option to configure url backend in legacy make build
260 system
261
262 Can be configured by setting URL_BACKEND. If not set libfetch is
263 selected by default.
264
265 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
266 ---
267 src/Makefile | 20 ++++++++++++++------
268 1 file changed, 14 insertions(+), 6 deletions(-)
269
270 diff --git a/src/Makefile b/src/Makefile
271 index f7873cb1..efdc68df 100644
272 --- a/src/Makefile
273 +++ b/src/Makefile
274 @@ -9,8 +9,8 @@ else
275 $(error Lua interpreter not found. Please specify LUA interpreter, or use LUA=no to build without help.)
276 endif
277
278 -OPENSSL_CFLAGS := $(shell $(PKG_CONFIG) --cflags openssl)
279 -OPENSSL_LIBS := $(shell $(PKG_CONFIG) --libs openssl)
280 +OPENSSL_CFLAGS := $(shell $(PKG_CONFIG) --cflags openssl)
281 +OPENSSL_LIBS := $(shell $(PKG_CONFIG) --libs openssl)
282
283 ZLIB_CFLAGS := $(shell $(PKG_CONFIG) --cflags zlib)
284 ZLIB_LIBS := $(shell $(PKG_CONFIG) --libs zlib)
285 @@ -21,10 +21,18 @@ libapk_so := $(obj)/libapk.so.$(libapk_soname)
286 libapk.so.$(libapk_soname)-objs := \
287 adb.o adb_comp.o adb_walk_adb.o adb_walk_genadb.o adb_walk_gentext.o adb_walk_text.o apk_adb.o \
288 atom.o blob.o commit.o common.o context.o crypto.o crypto_openssl.o ctype.o database.o hash.o \
289 - extract_v2.o extract_v3.o fs_fsys.o fs_uvol.o io.o io_gunzip.o io_url_libfetch.o \
290 - tar.o package.o pathbuilder.o print.o solver.o trust.o version.o
291 + extract_v2.o extract_v3.o fs_fsys.o fs_uvol.o io.o io_gunzip.o tar.o package.o pathbuilder.o \
292 + print.o solver.o trust.o version.o
293
294 -libapk.so.$(libapk_soname)-libs := libfetch/libfetch.a
295 +libapk.so.$(libapk_soname)-libs :=
296 +
297 +ifeq ($(URL_BACKEND),wget)
298 +libapk.so.$(libapk_soname)-objs += io_url_wget.o
299 +else
300 +CFLAGS_ALL += -Ilibfetch
301 +libapk.so.$(libapk_soname)-objs += io_url_libfetch.o
302 +libapk.so.$(libapk_soname)-libs += libfetch/libfetch.a
303 +endif
304
305 # ZSTD support can be disabled
306 ifneq ($(ZSTD),no)
307 @@ -79,7 +87,7 @@ LIBS_apk := -lapk
308 LIBS_apk-test := -lapk
309 LIBS_apk.so := -L$(obj) -lapk
310
311 -CFLAGS_ALL += -D_ATFILE_SOURCE -Ilibfetch -Iportability
312 +CFLAGS_ALL += -D_ATFILE_SOURCE -Iportability
313 CFLAGS_apk.o := -DAPK_VERSION=\"$(VERSION)\"
314 CFLAGS_apk-static.o := -DAPK_VERSION=\"$(VERSION)\" -DOPENSSL_NO_ENGINE
315 CFLAGS_apk-test.o := -DAPK_VERSION=\"$(VERSION)\" -DOPENSSL_NO_ENGINE -DTEST_MODE
316 --
317 GitLab
318
319
320 From 0418b684898403c49905c1f0e4b7c5ca522b2d50 Mon Sep 17 00:00:00 2001
321 From: Jonas Jelonek <jelonek.jonas@gmail.com>
322 Date: Sun, 14 Apr 2024 00:20:14 +0200
323 Subject: [PATCH 3/4] crypto: add support for mbedtls as backend
324
325 backend is selected at compile-time with crypto_backend option
326
327 Co-developed-by: Christian Marangi <ansuelsmth@gmail.com>
328 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
329 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
330 ---
331 libfetch/meson.build | 2 +-
332 meson.build | 14 +-
333 meson_options.txt | 1 +
334 portability/getrandom.c | 19 +++
335 portability/meson.build | 3 +-
336 portability/sys/random.h | 6 +
337 src/apk_crypto.h | 5 +
338 src/apk_crypto_mbedtls.h | 30 +++++
339 src/crypto_mbedtls.c | 285 +++++++++++++++++++++++++++++++++++++++
340 src/meson.build | 21 ++-
341 10 files changed, 373 insertions(+), 13 deletions(-)
342 create mode 100644 portability/getrandom.c
343 create mode 100644 portability/sys/random.h
344 create mode 100644 src/apk_crypto_mbedtls.h
345 create mode 100644 src/crypto_mbedtls.c
346
347 diff --git a/libfetch/meson.build b/libfetch/meson.build
348 index 431ba197..e24f95eb 100644
349 --- a/libfetch/meson.build
350 +++ b/libfetch/meson.build
351 @@ -40,7 +40,7 @@ libfetch = static_library(
352 c_args: libfetch_cargs,
353 dependencies: [
354 libportability_dep.partial_dependency(compile_args: true, includes: true),
355 - openssl_dep.partial_dependency(compile_args: true, includes: true)
356 + crypto_dep.partial_dependency(compile_args: true, includes: true)
357 ],
358 )
359
360 diff --git a/meson.build b/meson.build
361 index 9a14cac0..3a83f4e1 100644
362 --- a/meson.build
363 +++ b/meson.build
364 @@ -13,15 +13,21 @@ apk_libdir = get_option('libdir')
365 lua_bin = find_program('lua' + get_option('lua_version'), required: get_option('help'))
366 lua_dep = dependency('lua' + get_option('lua_version'), required: get_option('lua'))
367 scdoc_dep = dependency('scdoc', version: '>=1.10', required: get_option('docs'))
368 -openssl_dep = dependency('openssl')
369 -openssl_static_dep = dependency('openssl', static: true)
370 zlib_dep = dependency('zlib')
371 zlib_static_dep = dependency('zlib', static: true)
372 libzstd_dep = dependency('libzstd', required: get_option('zstd'))
373 libzstd_static_dep = dependency('libzstd', required: get_option('zstd'), static: true)
374
375 -shared_deps = [ openssl_dep, zlib_dep, libzstd_dep ]
376 -static_deps = [ openssl_static_dep, zlib_static_dep, libzstd_static_dep ]
377 +if get_option('crypto_backend') == 'openssl'
378 + crypto_dep = dependency('openssl')
379 + crypto_static_dep = dependency('openssl', static: true)
380 +elif get_option('crypto_backend') == 'mbedtls'
381 + crypto_dep = [ dependency('mbedtls'), dependency('mbedcrypto') ]
382 + crypto_static_dep = [ dependency('mbedtls', static: true), dependency('mbedcrypto', static: true) ]
383 +endif
384 +
385 +shared_deps = [ crypto_dep, zlib_dep, libzstd_dep ]
386 +static_deps = [ crypto_static_dep, zlib_static_dep, libzstd_static_dep ]
387
388 add_project_arguments('-D_GNU_SOURCE', language: 'c')
389
390 diff --git a/meson_options.txt b/meson_options.txt
391 index 940fe9a4..df0b07dc 100644
392 --- a/meson_options.txt
393 +++ b/meson_options.txt
394 @@ -1,4 +1,5 @@
395 option('arch_prefix', description: 'Define a custom arch prefix for default arch', type: 'string')
396 +option('crypto_backend', description: 'Crypto backend', type: 'combo', choices: ['openssl', 'mbedtls'], value: 'openssl')
397 option('compressed-help', description: 'Compress help database, needs lua-zlib', type: 'boolean', value: true)
398 option('docs', description: 'Build manpages with scdoc', type: 'feature', value: 'auto')
399 option('help', description: 'Build help into apk binaries, needs lua', type: 'feature', value: 'auto')
400 diff --git a/portability/getrandom.c b/portability/getrandom.c
401 new file mode 100644
402 index 00000000..b2f4a07c
403 --- /dev/null
404 +++ b/portability/getrandom.c
405 @@ -0,0 +1,19 @@
406 +#include <sys/random.h>
407 +#include <sys/types.h>
408 +#include <unistd.h>
409 +#include <fcntl.h>
410 +
411 +ssize_t getrandom(void *buf, size_t buflen, unsigned int flags)
412 +{
413 + int fd;
414 + ssize_t ret;
415 +
416 + fd = open("/dev/urandom", O_RDONLY|O_CLOEXEC);
417 + if (fd < 0)
418 + return -1;
419 +
420 + ret = read(fd, buf, buflen);
421 + close(fd);
422 + return ret;
423 +}
424 +
425 diff --git a/portability/meson.build b/portability/meson.build
426 index 89957c3c..3172044e 100644
427 --- a/portability/meson.build
428 +++ b/portability/meson.build
429 @@ -3,7 +3,8 @@ cc = meson.get_compiler('c')
430 libportability_src = []
431
432 check_symbols = [
433 - ['memrchr', 'memrchr.c', 'NEED_MEMRCHR', 'string.h'],
434 + ['getrandom', 'getrandom.c', 'NEED_GETRANDOM', 'sys/random.h'],
435 + ['memrchr', 'memrchr.c', 'NEED_MEMRCHR', 'string.h'],
436 ['mknodat', 'mknodat.c', 'NEED_MKNODAT', 'sys/stat.h'],
437 ['pipe2', 'pipe2.c', 'NEED_PIPE2', 'unistd.h'],
438 ['qsort_r', 'qsort_r.c', 'NEED_QSORT_R', 'stdlib.h'],
439 diff --git a/portability/sys/random.h b/portability/sys/random.h
440 new file mode 100644
441 index 00000000..02d5b1ca
442 --- /dev/null
443 +++ b/portability/sys/random.h
444 @@ -0,0 +1,6 @@
445 +#include_next <sys/random.h>
446 +#include <sys/types.h>
447 +
448 +#ifdef NEED_GETRANDOM
449 +ssize_t getrandom(void *buf, size_t buflen, unsigned int flags);
450 +#endif
451 diff --git a/src/apk_crypto.h b/src/apk_crypto.h
452 index 7de88dfc..5cae3bfe 100644
453 --- a/src/apk_crypto.h
454 +++ b/src/apk_crypto.h
455 @@ -12,7 +12,12 @@
456 #include <string.h>
457 #include "apk_defines.h"
458 #include "apk_blob.h"
459 +
460 +#if defined(CRYPTO_USE_OPENSSL)
461 #include "apk_crypto_openssl.h"
462 +#elif defined(CRYPTO_USE_MBEDTLS)
463 +#include "apk_crypto_mbedtls.h"
464 +#endif
465
466 // Digest
467
468 diff --git a/src/apk_crypto_mbedtls.h b/src/apk_crypto_mbedtls.h
469 new file mode 100644
470 index 00000000..5481d149
471 --- /dev/null
472 +++ b/src/apk_crypto_mbedtls.h
473 @@ -0,0 +1,30 @@
474 +/* apk_crypto_mbedtls.h - Alpine Package Keeper (APK)
475 + *
476 + * Copyright (C) 2024
477 + * All rights reserved.
478 + *
479 + * SPDX-License-Identifier: GPL-2.0-only
480 + */
481 +
482 +#ifndef APK_CRYPTO_MBEDTLS_H
483 +#define APK_CRYPTO_MBEDTLS_H
484 +
485 +#include <mbedtls/md.h>
486 +#include <mbedtls/pk.h>
487 +#include <mbedtls/bignum.h>
488 +
489 +struct apk_pkey {
490 + uint8_t id[16];
491 + mbedtls_pk_context key;
492 +};
493 +
494 +struct apk_digest_ctx {
495 + mbedtls_md_context_t mdctx;
496 + struct apk_pkey *sigver_key;
497 + uint8_t alg;
498 +};
499 +
500 +/* based on mbedtls' internal pkwrite.h calculations */
501 +#define APK_ENC_KEY_MAX_LENGTH (38 + 2 * MBEDTLS_MPI_MAX_SIZE)
502 +
503 +#endif
504 diff --git a/src/crypto_mbedtls.c b/src/crypto_mbedtls.c
505 new file mode 100644
506 index 00000000..73d60e9d
507 --- /dev/null
508 +++ b/src/crypto_mbedtls.c
509 @@ -0,0 +1,285 @@
510 +#include <errno.h>
511 +#include <stdio.h>
512 +#include <stdlib.h>
513 +#include <fcntl.h>
514 +#include <sys/random.h>
515 +#include <sys/stat.h>
516 +#include <unistd.h>
517 +
518 +#include <mbedtls/platform.h>
519 +#include <mbedtls/md.h>
520 +#include <mbedtls/pk.h>
521 +#include <mbedtls/entropy.h>
522 +
523 +#ifdef MBEDTLS_PSA_CRYPTO_C
524 +#include <psa/crypto.h>
525 +#endif
526 +
527 +#include "apk_crypto.h"
528 +
529 +static inline const mbedtls_md_type_t apk_digest_alg_to_mbedtls_type(uint8_t alg) {
530 + switch (alg) {
531 + case APK_DIGEST_NONE: return MBEDTLS_MD_NONE;
532 + case APK_DIGEST_MD5: return MBEDTLS_MD_MD5;
533 + case APK_DIGEST_SHA1: return MBEDTLS_MD_SHA1;
534 + case APK_DIGEST_SHA256_160:
535 + case APK_DIGEST_SHA256: return MBEDTLS_MD_SHA256;
536 + case APK_DIGEST_SHA512: return MBEDTLS_MD_SHA512;
537 + default:
538 + assert(alg);
539 + return MBEDTLS_MD_NONE;
540 + }
541 +}
542 +
543 +static inline const mbedtls_md_info_t *apk_digest_alg_to_mdinfo(uint8_t alg)
544 +{
545 + return mbedtls_md_info_from_type(
546 + apk_digest_alg_to_mbedtls_type(alg)
547 + );
548 +}
549 +
550 +int apk_digest_calc(struct apk_digest *d, uint8_t alg, const void *ptr, size_t sz)
551 +{
552 + if (mbedtls_md(apk_digest_alg_to_mdinfo(alg), ptr, sz, d->data))
553 + return -APKE_CRYPTO_ERROR;
554 +
555 + apk_digest_set(d, alg);
556 + return 0;
557 +}
558 +
559 +int apk_digest_ctx_init(struct apk_digest_ctx *dctx, uint8_t alg)
560 +{
561 + dctx->alg = alg;
562 +
563 + mbedtls_md_init(&dctx->mdctx);
564 + if (alg == APK_DIGEST_NONE) return 0;
565 + if (mbedtls_md_setup(&dctx->mdctx, apk_digest_alg_to_mdinfo(alg), 0) ||
566 + mbedtls_md_starts(&dctx->mdctx))
567 + return -APKE_CRYPTO_ERROR;
568 +
569 + return 0;
570 +}
571 +
572 +int apk_digest_ctx_reset(struct apk_digest_ctx *dctx)
573 +{
574 + if (dctx->alg == APK_DIGEST_NONE) return 0;
575 + if (mbedtls_md_starts(&dctx->mdctx)) return -APKE_CRYPTO_ERROR;
576 + return 0;
577 +}
578 +
579 +int apk_digest_ctx_reset_alg(struct apk_digest_ctx *dctx, uint8_t alg)
580 +{
581 + mbedtls_md_free(&dctx->mdctx);
582 +
583 + dctx->alg = alg;
584 + if (alg == APK_DIGEST_NONE) return 0;
585 + if (mbedtls_md_setup(&dctx->mdctx, apk_digest_alg_to_mdinfo(alg), 0) ||
586 + mbedtls_md_starts(&dctx->mdctx))
587 + return -APKE_CRYPTO_ERROR;
588 +
589 + return 0;
590 +}
591 +
592 +void apk_digest_ctx_free(struct apk_digest_ctx *dctx)
593 +{
594 + mbedtls_md_free(&dctx->mdctx);
595 +}
596 +
597 +int apk_digest_ctx_update(struct apk_digest_ctx *dctx, const void *ptr, size_t sz)
598 +{
599 + if (dctx->alg == APK_DIGEST_NONE) return 0;
600 + return mbedtls_md_update(&dctx->mdctx, ptr, sz) == 0 ? 0 : -APKE_CRYPTO_ERROR;
601 +}
602 +
603 +int apk_digest_ctx_final(struct apk_digest_ctx *dctx, struct apk_digest *d)
604 +{
605 + if (mbedtls_md_finish(&dctx->mdctx, d->data)) {
606 + apk_digest_reset(d);
607 + return -APKE_CRYPTO_ERROR;
608 + }
609 +
610 + d->alg = dctx->alg;
611 + d->len = apk_digest_alg_len(d->alg);
612 + return 0;
613 +}
614 +
615 +static int apk_load_file_at(int dirfd, const char *fn, unsigned char **buf, size_t *n)
616 +{
617 + struct stat stats;
618 + size_t size;
619 + int fd;
620 +
621 + if ((fd = openat(dirfd, fn, O_RDONLY|O_CLOEXEC)) < 0)
622 + return -errno;
623 +
624 + if (fstat(fd, &stats)) {
625 + close(fd);
626 + return -errno;
627 + }
628 +
629 + size = (size_t)stats.st_size;
630 + *n = size;
631 +
632 + if (size == 0 || (*buf = mbedtls_calloc(1, size + 1)) == NULL)
633 + return MBEDTLS_ERR_PK_ALLOC_FAILED;
634 +
635 + if (read(fd, *buf, size) != size) {
636 + close(fd);
637 +
638 + mbedtls_platform_zeroize(*buf, size);
639 + mbedtls_free(*buf);
640 +
641 + return MBEDTLS_ERR_PK_FILE_IO_ERROR;
642 + }
643 + close(fd);
644 +
645 + (*buf)[size] = '\0';
646 +
647 + if (strstr((const char *) *buf, "-----BEGIN ") != NULL) {
648 + ++*n;
649 + }
650 +
651 + return 0;
652 +}
653 +
654 +static int apk_pkey_init(struct apk_pkey *pkey)
655 +{
656 + unsigned char dig[APK_DIGEST_MAX_LENGTH];
657 + unsigned char pub[APK_ENC_KEY_MAX_LENGTH] = {};
658 + unsigned char *c;
659 + int len, r = -APKE_CRYPTO_ERROR;
660 +
661 + c = pub + APK_ENC_KEY_MAX_LENGTH;
662 +
663 + // key is written backwards into pub starting at c!
664 + if ((len = mbedtls_pk_write_pubkey(&c, pub, &pkey->key)) < 0) return -APKE_CRYPTO_ERROR;
665 + if (!mbedtls_md(apk_digest_alg_to_mdinfo(APK_DIGEST_SHA512), c, len, dig)) {
666 + memcpy(pkey->id, dig, sizeof pkey->id);
667 + r = 0;
668 + }
669 +
670 + return r;
671 +}
672 +
673 +void apk_pkey_free(struct apk_pkey *pkey)
674 +{
675 + mbedtls_pk_free(&pkey->key);
676 +}
677 +
678 +static int apk_random(void *ctx, unsigned char *out, size_t len)
679 +{
680 + return (int)getrandom(out, len, 0);
681 +}
682 +
683 +#if MBEDTLS_VERSION_NUMBER >= 0x03000000
684 +static inline int apk_mbedtls_parse_privkey(struct apk_pkey *pkey, const unsigned char *buf, size_t blen)
685 +{
686 + return mbedtls_pk_parse_key(&pkey->key, buf, blen, NULL, 0, apk_random, NULL);
687 +}
688 +static inline int apk_mbedtls_sign(struct apk_digest_ctx *dctx, struct apk_digest *dig,
689 + unsigned char *sig, size_t *sig_len)
690 +{
691 + return mbedtls_pk_sign(&dctx->sigver_key->key, apk_digest_alg_to_mbedtls_type(dctx->alg),
692 + (const unsigned char *)&dig->data, dig->len, sig, sizeof *sig, sig_len,
693 + apk_random, NULL);
694 +}
695 +#else
696 +static inline int apk_mbedtls_parse_privkey(struct apk_pkey *pkey, const unsigned char *buf, size_t blen)
697 +{
698 + return mbedtls_pk_parse_key(&pkey->key, buf, blen, NULL, 0);
699 +}
700 +static inline int apk_mbedtls_sign(struct apk_digest_ctx *dctx, struct apk_digest *dig,
701 + unsigned char *sig, size_t *sig_len)
702 +{
703 + return mbedtls_pk_sign(&dctx->sigver_key->key, apk_digest_alg_to_mbedtls_type(dctx->alg),
704 + (const unsigned char *)&dig->data, dig->len, sig, sig_len, apk_random, NULL);
705 +}
706 +#endif
707 +
708 +int apk_pkey_load(struct apk_pkey *pkey, int dirfd, const char *fn)
709 +{
710 + unsigned char *buf = NULL;
711 + size_t blen = 0;
712 + int ret;
713 +
714 + if (apk_load_file_at(dirfd, fn, &buf, &blen))
715 + return -APKE_CRYPTO_ERROR;
716 +
717 + mbedtls_pk_init(&pkey->key);
718 + if ((ret = mbedtls_pk_parse_public_key(&pkey->key, buf, blen)) != 0)
719 + ret = apk_mbedtls_parse_privkey(pkey, buf, blen);
720 +
721 + mbedtls_platform_zeroize(buf, blen);
722 + mbedtls_free(buf);
723 + if (ret != 0)
724 + return -APKE_CRYPTO_KEY_FORMAT;
725 +
726 + return apk_pkey_init(pkey);
727 +}
728 +
729 +int apk_sign_start(struct apk_digest_ctx *dctx, uint8_t alg, struct apk_pkey *pkey)
730 +{
731 + if (apk_digest_ctx_reset_alg(dctx, alg))
732 + return -APKE_CRYPTO_ERROR;
733 +
734 + dctx->sigver_key = pkey;
735 +
736 + return 0;
737 +}
738 +
739 +int apk_sign(struct apk_digest_ctx *dctx, void *sig, size_t *len)
740 +{
741 + struct apk_digest dig;
742 + int r = 0;
743 +
744 + if (apk_digest_ctx_final(dctx, &dig))
745 + return -APKE_SIGNATURE_GEN_FAILURE;
746 +
747 + if (apk_mbedtls_sign(dctx, &dig, sig, len))
748 + r = -APKE_SIGNATURE_GEN_FAILURE;
749 +
750 + dctx->sigver_key = NULL;
751 + return r;
752 +}
753 +
754 +int apk_verify_start(struct apk_digest_ctx *dctx, uint8_t alg, struct apk_pkey *pkey)
755 +{
756 + if (apk_digest_ctx_reset_alg(dctx, alg))
757 + return -APKE_CRYPTO_ERROR;
758 +
759 + dctx->sigver_key = pkey;
760 +
761 + return 0;
762 +}
763 +
764 +int apk_verify(struct apk_digest_ctx *dctx, void *sig, size_t len)
765 +{
766 + struct apk_digest dig;
767 + int r = 0;
768 +
769 + if (apk_digest_ctx_final(dctx, &dig))
770 + return -APKE_SIGNATURE_GEN_FAILURE;
771 +
772 + if (mbedtls_pk_verify(&dctx->sigver_key->key, apk_digest_alg_to_mbedtls_type(dctx->alg),
773 + (const unsigned char *)&dig.data, dig.len, sig, len))
774 + r = -APKE_SIGNATURE_INVALID;
775 +
776 + dctx->sigver_key = NULL;
777 + return r;
778 +}
779 +
780 +static void apk_crypto_cleanup(void)
781 +{
782 +#ifdef MBEDTLS_PSA_CRYPTO_C
783 + mbedtls_psa_crypto_free();
784 +#endif
785 +}
786 +
787 +void apk_crypto_init(void)
788 +{
789 + atexit(apk_crypto_cleanup);
790 +
791 +#ifdef MBEDTLS_PSA_CRYPTO_C
792 + psa_crypto_init();
793 +#endif
794 +}
795 diff --git a/src/meson.build b/src/meson.build
796 index 38e9d3b0..e1204fc0 100644
797 --- a/src/meson.build
798 +++ b/src/meson.build
799 @@ -1,3 +1,4 @@
800 +crypto_backend = get_option('crypto_backend')
801 url_backend = get_option('url_backend')
802
803 libapk_so_version = '2.99.0'
804 @@ -15,7 +16,7 @@ libapk_src = [
805 'common.c',
806 'context.c',
807 'crypto.c',
808 - 'crypto_openssl.c',
809 + 'crypto_@0@.c'.format(crypto_backend),
810 'ctype.c',
811 'database.c',
812 'extract_v2.c',
813 @@ -40,7 +41,7 @@ libapk_headers = [
814 'apk_atom.h',
815 'apk_blob.h',
816 'apk_crypto.h',
817 - 'apk_crypto_openssl.h',
818 + 'apk_crypto_@0@.h'.format(crypto_backend),
819 'apk_ctype.h',
820 'apk_database.h',
821 'apk_defines.h',
822 @@ -89,6 +90,17 @@ apk_src = [
823 'applet.c',
824 ]
825
826 +apk_cargs = [
827 + '-DAPK_VERSION="' + meson.project_version() + '"',
828 + '-D_ATFILE_SOURCE',
829 +]
830 +
831 +if crypto_backend == 'openssl'
832 + apk_cargs += [ '-DCRYPTO_USE_OPENSSL' ]
833 +elif crypto_backend == 'mbedtls'
834 + apk_cargs += [ '-DCRYPTO_USE_MBEDTLS' ]
835 +endif
836 +
837 if lua_bin.found()
838 genhelp_script = files('genhelp.lua')
839 genhelp_args = [lua_bin, genhelp_script, '@INPUT@']
840 @@ -115,11 +127,6 @@ endif
841
842 apk_src += [ generated_help ]
843
844 -apk_cargs = [
845 - '-DAPK_VERSION="' + meson.project_version() + '"',
846 - '-D_ATFILE_SOURCE',
847 -]
848 -
849 apk_arch_prefix = get_option('arch_prefix')
850 if apk_arch_prefix != ''
851 apk_cargs += ['-DAPK_ARCH_PREFIX="@0@"'.format(apk_arch_prefix)]
852 --
853 GitLab
854
855
856 From 34bb1021284dccbf97f02b0a0bb9e751b8887cad Mon Sep 17 00:00:00 2001
857 From: Christian Marangi <ansuelsmth@gmail.com>
858 Date: Tue, 16 Apr 2024 17:56:45 +0200
859 Subject: [PATCH 4/4] add option to configure crypto backend in legacy make
860 build system
861
862 Define CRYPTO to select mbedtls as alternative crypto backend. By
863 default openssl is used.
864
865 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
866 ---
867 src/Makefile | 20 +++++++++++++++-----
868 1 file changed, 15 insertions(+), 5 deletions(-)
869
870 diff --git a/src/Makefile b/src/Makefile
871 index efdc68df..97db0e72 100644
872 --- a/src/Makefile
873 +++ b/src/Makefile
874 @@ -20,9 +20,9 @@ libapk_soname := 2.99.0
875 libapk_so := $(obj)/libapk.so.$(libapk_soname)
876 libapk.so.$(libapk_soname)-objs := \
877 adb.o adb_comp.o adb_walk_adb.o adb_walk_genadb.o adb_walk_gentext.o adb_walk_text.o apk_adb.o \
878 - atom.o blob.o commit.o common.o context.o crypto.o crypto_openssl.o ctype.o database.o hash.o \
879 - extract_v2.o extract_v3.o fs_fsys.o fs_uvol.o io.o io_gunzip.o tar.o package.o pathbuilder.o \
880 - print.o solver.o trust.o version.o
881 + atom.o blob.o commit.o common.o context.o crypto.o ctype.o database.o hash.o extract_v2.o \
882 + extract_v3.o fs_fsys.o fs_uvol.o io.o io_gunzip.o tar.o package.o pathbuilder.o print.o \
883 + solver.o trust.o version.o
884
885 libapk.so.$(libapk_soname)-libs :=
886
887 @@ -34,6 +34,16 @@ libapk.so.$(libapk_soname)-objs += io_url_libfetch.o
888 libapk.so.$(libapk_soname)-libs += libfetch/libfetch.a
889 endif
890
891 +ifeq ($(CRYPTO),mbedtls)
892 +CRYPTO_CFLAGS := $(shell $(PKG_CONFIG) --cflags mbedtls mbedcrypto) -DCRYPTO_USE_MBEDTLS
893 +CRYPTO_LIBS := $(shell $(PKG_CONFIG) --libs mbedtls mbedcrypto)
894 +libapk.so.$(libapk_soname)-objs += crypto_mbedtls.o
895 +else
896 +CRYPTO_CFLAGS := $(shell $(PKG_CONFIG) --cflags openssl) -DCRYPTO_USE_OPENSSL
897 +CRYPTO_LIBS := $(shell $(PKG_CONFIG) --libs openssl)
898 +libapk.so.$(libapk_soname)-objs += crypto_openssl.o
899 +endif
900 +
901 # ZSTD support can be disabled
902 ifneq ($(ZSTD),no)
903 ZSTD_CFLAGS := $(shell $(PKG_CONFIG) --cflags libzstd)
904 @@ -100,9 +110,9 @@ LIBS_apk.static := -Wl,--as-needed -ldl -Wl,--no-as-needed
905 LDFLAGS_apk += -L$(obj)
906 LDFLAGS_apk-test += -L$(obj)
907
908 -CFLAGS_ALL += $(OPENSSL_CFLAGS) $(ZLIB_CFLAGS) $(ZSTD_CFLAGS)
909 +CFLAGS_ALL += $(CRYPTO_CFLAGS) $(ZLIB_CFLAGS) $(ZSTD_CFLAGS)
910 LIBS := -Wl,--as-needed \
911 - $(OPENSSL_LIBS) $(ZLIB_LIBS) $(ZSTD_LIBS) \
912 + $(CRYPTO_LIBS) $(ZLIB_LIBS) $(ZSTD_LIBS) \
913 -Wl,--no-as-needed
914
915 # Help generation
916 --
917 GitLab
Staging tree of Stijn Tintel