[Buildroot] [git commit] package/mbedtls: fix zlib support
Thomas Petazzoni
thomas.petazzoni at free-electrons.com
Mon Feb 6 12:53:01 UTC 2017
commit: https://git.buildroot.net/buildroot/commit/?id=c1a77961c1aca6cd50e3ad44b5b39350f1070286
branch: https://git.buildroot.net/buildroot/commit/?id=refs/heads/master
To enable compression support using zlib it is necessary to uncomment
the define for MBEDTLS_ZLIB_SUPPORT in config.h [1].
Note, that enabling TLS compression may make mbedTLS vulnerable to the
CRIME attack [1]. It should not be enabled unless is is sure CRIME and
similar attacks are not applicable to the particulare situation.
As zlib is probably enabled in most systems, maybe it is best to make
the compression support a user choice and add the warning from [1]?
[1] https://tls.mbed.org/kb/how-to/deflate-compression-in-ssl-tls
Signed-off-by: Jörg Krause <joerg.krause at embedded.rocks>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni at free-electrons.com>
---
package/mbedtls/mbedtls.mk | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/package/mbedtls/mbedtls.mk b/package/mbedtls/mbedtls.mk
index a8bd61f..7171af9 100644
--- a/package/mbedtls/mbedtls.mk
+++ b/package/mbedtls/mbedtls.mk
@@ -42,6 +42,11 @@ endif
ifeq ($(BR2_PACKAGE_ZLIB),y)
MBEDTLS_CONF_OPTS += -DENABLE_ZLIB_SUPPORT=ON
MBEDTLS_DEPENDENCIES += zlib
+define MBEDTLS_ENABLE_ZLIB
+ $(SED) "s://#define MBEDTLS_ZLIB_SUPPORT:#define MBEDTLS_ZLIB_SUPPORT:" \
+ $(@D)/include/mbedtls/config.h
+endef
+MBEDTLS_POST_PATCH_HOOKS += MBEDTLS_ENABLE_ZLIB
else
MBEDTLS_CONF_OPTS += -DENABLE_ZLIB_SUPPORT=OFF
endif
More information about the buildroot
mailing list