diff --git a/meta-perl/recipes-perl/libnet/libnet-ssleay-perl/0001-Fix-SSLv3-in-OpenSSL-4.0.0.patch b/meta-perl/recipes-perl/libnet/libnet-ssleay-perl/0001-Fix-SSLv3-in-OpenSSL-4.0.0.patch new file mode 100644 index 0000000000..269e39c1bf --- /dev/null +++ b/meta-perl/recipes-perl/libnet/libnet-ssleay-perl/0001-Fix-SSLv3-in-OpenSSL-4.0.0.patch @@ -0,0 +1,34 @@ +From 361b3adc1dd09f70be7bd8972992626a3240b58d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michal=20Josef=20=C5=A0pa=C4=8Dek?= +Date: Tue, 14 Apr 2026 12:37:39 +0200 +Subject: [PATCH] Fix SSLv3 in OpenSSL 4.0.0 + +Support for SSLv3 was removed. +Upstream-Status: Backport [https://github.com/radiator-software/p5-net-ssleay/pull/553] +Signed-off-by: Jaipaul Cheernam +--- + SSLeay.xs | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/SSLeay.xs b/SSLeay.xs +index 0ed7d967..5407fa1a 100644 +--- a/SSLeay.xs ++++ b/SSLeay.xs +@@ -2454,7 +2454,7 @@ SSL_CTX_v2_new() + + #endif + #endif +-#ifndef OPENSSL_NO_SSL3 ++#if !defined(OPENSSL_NO_SSL3) && OPENSSL_VERSION_NUMBER < 0x40000000L + + SSL_CTX * + SSL_CTX_v3_new() +@@ -5600,7 +5600,7 @@ SSLv2_method() + #endif + #endif + +-#ifndef OPENSSL_NO_SSL3 ++#if !defined(OPENSSL_NO_SSL3) && OPENSSL_VERSION_NUMBER < 0x40000000L + + const SSL_METHOD * + SSLv3_method() diff --git a/meta-perl/recipes-perl/libnet/libnet-ssleay-perl/0002-OpenSSL-4.0.0-remove-support-for-some-TLS-functions.patch b/meta-perl/recipes-perl/libnet/libnet-ssleay-perl/0002-OpenSSL-4.0.0-remove-support-for-some-TLS-functions.patch new file mode 100644 index 0000000000..bad83e9398 --- /dev/null +++ b/meta-perl/recipes-perl/libnet/libnet-ssleay-perl/0002-OpenSSL-4.0.0-remove-support-for-some-TLS-functions.patch @@ -0,0 +1,192 @@ +From 780c7ad4803d0fc8e755bb86e589f84898e65040 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michal=20Josef=20=C5=A0pa=C4=8Dek?= +Date: Tue, 14 Apr 2026 14:08:00 +0200 +Subject: [PATCH] OpenSSL 4.0.0 remove support for some TLS functions + +Removes fixed version TLS methods +(https://github.com/openssl/openssl/pull/30128) +Upstream-Status: Backport [https://github.com/radiator-software/p5-net-ssleay/pull/553] +Signed-off-by: Jaipaul Cheernam +--- + SSLeay.xs | 51 ++++++++++++++++++++++++++++++++++++++++------ + lib/Net/SSLeay.pod | 17 +++++++++------- + 2 files changed, 55 insertions(+), 13 deletions(-) + +diff --git a/SSLeay.xs b/SSLeay.xs +index 5407fa1a..ad996d5c 100644 +--- a/SSLeay.xs ++++ b/SSLeay.xs +@@ -2472,7 +2472,7 @@ SSL_CTX_v23_new() + OUTPUT: + RETVAL + +-#if !defined(OPENSSL_NO_TLS1_METHOD) ++#if !defined(OPENSSL_NO_TLS1_METHOD) && OPENSSL_VERSION_NUMBER < 0x40000000L + + SSL_CTX * + SSL_CTX_tlsv1_new() +@@ -2481,9 +2481,22 @@ SSL_CTX_tlsv1_new() + OUTPUT: + RETVAL + ++#elif OPENSSL_VERSION_NUMBER >= 0x40000000L ++ ++SSL_CTX * ++SSL_CTX_tlsv1_new() ++ CODE: ++ RETVAL = SSL_CTX_new(TLS_method()); ++ if (RETVAL) { ++ SSL_CTX_set_min_proto_version(RETVAL, TLS1_VERSION); ++ SSL_CTX_set_max_proto_version(RETVAL, TLS1_VERSION); ++ } ++ OUTPUT: ++ RETVAL ++ + #endif + +-#if (OPENSSL_VERSION_NUMBER >= 0x10001001L && !defined(OPENSSL_NO_TLS1_1_METHOD)) /* OpenSSL 1.0.1-beta1 */ ++#if (OPENSSL_VERSION_NUMBER >= 0x10001001L && OPENSSL_VERSION_NUMBER < 0x40000000L && !defined(OPENSSL_NO_TLS1_1_METHOD)) /* OpenSSL 1.0.1-beta1 */ + + SSL_CTX * + SSL_CTX_tlsv1_1_new() +@@ -2492,9 +2505,22 @@ SSL_CTX_tlsv1_1_new() + OUTPUT: + RETVAL + ++#elif OPENSSL_VERSION_NUMBER >= 0x40000000L ++ ++SSL_CTX * ++SSL_CTX_tlsv1_1_new() ++ CODE: ++ RETVAL = SSL_CTX_new(TLS_method()); ++ if (RETVAL) { ++ SSL_CTX_set_min_proto_version(RETVAL, TLS1_1_VERSION); ++ SSL_CTX_set_max_proto_version(RETVAL, TLS1_1_VERSION); ++ } ++ OUTPUT: ++ RETVAL ++ + #endif + +-#if (OPENSSL_VERSION_NUMBER >= 0x10001001L && !defined(OPENSSL_NO_TLS1_2_METHOD)) /* OpenSSL 1.0.1-beta1 */ ++#if (OPENSSL_VERSION_NUMBER >= 0x10001001L && OPENSSL_VERSION_NUMBER < 0x40000000L && !defined(OPENSSL_NO_TLS1_2_METHOD)) /* OpenSSL 1.0.1-beta1 */ + + SSL_CTX * + SSL_CTX_tlsv1_2_new() +@@ -2503,6 +2529,19 @@ SSL_CTX_tlsv1_2_new() + OUTPUT: + RETVAL + ++#elif OPENSSL_VERSION_NUMBER >= 0x40000000L ++ ++SSL_CTX * ++SSL_CTX_tlsv1_2_new() ++ CODE: ++ RETVAL = SSL_CTX_new(TLS_method()); ++ if (RETVAL) { ++ SSL_CTX_set_min_proto_version(RETVAL, TLS1_2_VERSION); ++ SSL_CTX_set_max_proto_version(RETVAL, TLS1_2_VERSION); ++ } ++ OUTPUT: ++ RETVAL ++ + #endif + + SSL_CTX * +@@ -5616,7 +5655,7 @@ SSLv23_server_method() + const SSL_METHOD * + SSLv23_client_method() + +-#if !defined(OPENSSL_NO_TLS1_METHOD) ++#if !defined(OPENSSL_NO_TLS1_METHOD) && OPENSSL_VERSION_NUMBER < 0x40000000L + + const SSL_METHOD * + TLSv1_method() +@@ -5629,7 +5668,7 @@ TLSv1_client_method() + + #endif + +-#if (OPENSSL_VERSION_NUMBER >= 0x10001001L && !defined(OPENSSL_NO_TLS1_1_METHOD)) /* OpenSSL 1.0.1-beta1 */ ++#if (OPENSSL_VERSION_NUMBER >= 0x10001001L && OPENSSL_VERSION_NUMBER < 0x40000000L && !defined(OPENSSL_NO_TLS1_1_METHOD)) /* OpenSSL 1.0.1-beta1 */ + + const SSL_METHOD * + TLSv1_1_method() +@@ -5642,7 +5681,7 @@ TLSv1_1_client_method() + + #endif + +-#if (OPENSSL_VERSION_NUMBER >= 0x10001001L && !defined(OPENSSL_NO_TLS1_2_METHOD)) /* OpenSSL 1.0.1-beta1 */ ++#if (OPENSSL_VERSION_NUMBER >= 0x10001001L && OPENSSL_VERSION_NUMBER < 0x40000000L && !defined(OPENSSL_NO_TLS1_2_METHOD)) /* OpenSSL 1.0.1-beta1 */ + + const SSL_METHOD * + TLSv1_2_method() +diff --git a/lib/Net/SSLeay.pod b/lib/Net/SSLeay.pod +index 554fd119..d947ad39 100644 +--- a/lib/Net/SSLeay.pod ++++ b/lib/Net/SSLeay.pod +@@ -1575,7 +1575,7 @@ Check openssl doc L Requires OpenSSL or LibreSSL built with support for TLSv1. Server and client methods not available in Net-SSLeay-1.82 and before. ++B Requires OpenSSL or LibreSSL built with support for TLSv1. Server and client methods not available in Net-SSLeay-1.82 and before. Not available in OpenSSL 4.0.0 and later. Use L with L and L instead. + + Returns SSL_METHOD structure corresponding to TLSv1 method, the return value can be later used as a param of L. + +@@ -1587,7 +1587,7 @@ Check openssl doc L Requires OpenSSL >= 1.0.1 or LibreSSL built with support for TLSv1.1. Server and client methods not available in Net-SSLeay-1.82 and before. ++B Requires OpenSSL >= 1.0.1 or LibreSSL built with support for TLSv1.1. Server and client methods not available in Net-SSLeay-1.82 and before. Not available in OpenSSL 4.0.0 and later. Use L with L and L instead. + + Returns SSL_METHOD structure corresponding to TLSv1_1 method, the return value can be later used as a param of L. + +@@ -1599,7 +1599,7 @@ Check openssl doc L Requires OpenSSL >= 1.0.1 or LibreSSL built with support for TLSv1.2. Server and client methods not available in Net-SSLeay-1.82 and before. ++B Requires OpenSSL >= 1.0.1 or LibreSSL built with support for TLSv1.2. Server and client methods not available in Net-SSLeay-1.82 and before. Not available in OpenSSL 4.0.0 and later. Use L with L and L instead. + + Returns SSL_METHOD structure corresponding to TLSv1_2 method, the return value can be later used as a param of L. + +@@ -2998,7 +2998,7 @@ Creates a new SSL_CTX object - based on SSLv3_method() - as framework to establi + + =item * CTX_tlsv1_new + +-B Requires OpenSSL or LibreSSL built with support for TLSv1. ++B Requires OpenSSL or LibreSSL built with support for TLSv1. In OpenSSL 4.0.0 and later, this function is emulated using L with L and L for backward compatibility. It is recommended to use L with L and L instead. + + Creates a new SSL_CTX object - based on C - as a framework for establishing connections using TLSv1. + +@@ -3008,7 +3008,7 @@ Creates a new SSL_CTX object - based on C - as a framework for e + + =item * CTX_tlsv1_1_new + +-B Requires OpenSSL >= 1.0.1 or LibreSSL built with support for TLSv1.1. ++B Requires OpenSSL >= 1.0.1 or LibreSSL built with support for TLSv1.1. In OpenSSL 4.0.0 and later, this function is emulated using L with L and L for backward compatibility. It is recommended to use L with L and L instead. + + Creates a new SSL_CTX object - based on C - as a framework for establishing connections using TLSv1.1. + +@@ -3018,7 +3018,7 @@ Creates a new SSL_CTX object - based on C - as a framework for + + =item * CTX_tlsv1_2_new + +-B Requires OpenSSL >= 1.0.1 or LibreSSL built with support for TLSv1.2. ++B Requires OpenSSL >= 1.0.1 or LibreSSL built with support for TLSv1.2. In OpenSSL 4.0.0 and later, this function is emulated using L with L and L for backward compatibility. It is recommended to use L with L and L instead. + + Creates a new SSL_CTX object - based on C - as a framework for establishing connections using TLSv1.2. + +@@ -3035,7 +3035,10 @@ Creates a new SSL_CTX object based on $meth method + # + # returns: value corresponding to openssl's SSL_CTX structure (0 on failure) + +- # example ++ # example (recommended, available since OpenSSL 1.1.0) ++ my $ctx = Net::SSLeay::CTX_new_with_method(&Net::SSLeay::TLS_method); ++ ++ # example (TLSv1_method not available in OpenSSL 4.0.0+) + my $ctx = Net::SSLeay::CTX_new_with_method(&Net::SSLeay::TLSv1_method); + + Check openssl doc L diff --git a/meta-perl/recipes-perl/libnet/libnet-ssleay-perl/0003-Fix-Net-SSLeay-to-support-opaque-ASN1_STRING.patch b/meta-perl/recipes-perl/libnet/libnet-ssleay-perl/0003-Fix-Net-SSLeay-to-support-opaque-ASN1_STRING.patch new file mode 100644 index 0000000000..c1e733ac7b --- /dev/null +++ b/meta-perl/recipes-perl/libnet/libnet-ssleay-perl/0003-Fix-Net-SSLeay-to-support-opaque-ASN1_STRING.patch @@ -0,0 +1,175 @@ +From 929e8eb5ae2953fdb5231588a9d916ae6cffa939 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michal=20Josef=20=C5=A0pa=C4=8Dek?= +Date: Tue, 14 Apr 2026 14:32:27 +0200 +Subject: [PATCH] Fix Net::SSLeay to support opaque ASN1_STRING + +Upstream-Status: Backport [https://github.com/radiator-software/p5-net-ssleay/pull/553] +Signed-off-by: Jaipaul Cheernam +--- + SSLeay.xs | 95 +++++++++++++++++++++++++++++++++---------------------- + 1 file changed, 57 insertions(+), 38 deletions(-) + +diff --git a/SSLeay.xs b/SSLeay.xs +index ad996d5c..2567d81a 100644 +--- a/SSLeay.xs ++++ b/SSLeay.xs +@@ -2194,35 +2194,41 @@ int ssl_ctx_set_cert_cb_invoke(SSL *ssl, void *arg) + + time_t ASN1_TIME_timet(ASN1_TIME *asn1t, time_t *gmtoff) { + struct tm t; +- const char *p = (const char*) asn1t->data; ++#if (OPENSSL_VERSION_NUMBER >= 0x1010000f && !defined(LIBRESSL_VERSION_NUMBER)) || (LIBRESSL_VERSION_NUMBER >= 0x2070000fL) ++ const char *p = (const char*) ASN1_STRING_get0_data(asn1t); ++#else ++ const char *p = (const char*) ASN1_STRING_data(asn1t); ++#endif ++ int asn1t_length = ASN1_STRING_length(asn1t); ++ int asn1t_type = ASN1_STRING_type(asn1t); + size_t msec = 0, tz = 0, i, l; + time_t result; + int adj = 0; + +- if (asn1t->type == V_ASN1_UTCTIME) { +- if (asn1t->length<12 || asn1t->length>17) return 0; +- if (asn1t->length>12) tz = 12; ++ if (asn1t_type == V_ASN1_UTCTIME) { ++ if (asn1t_length<12 || asn1t_length>17) return 0; ++ if (asn1t_length>12) tz = 12; + } else { +- if (asn1t->length<14) return 0; +- if (asn1t->length>14) { ++ if (asn1t_length<14) return 0; ++ if (asn1t_length>14) { + if (p[14] == '.') { + msec = 14; +- for(i=msec+1;ilength && p[i]>='0' && p[i]<='9';i++) ; +- if (ilength) tz = i; ++ for(i=msec+1;i<(size_t)asn1t_length && p[i]>='0' && p[i]<='9';i++) ; ++ if (i<(size_t)asn1t_length) tz = i; + } else { + tz = 14; + } + } + } + +- l = msec ? msec : tz ? tz : asn1t->length; ++ l = msec ? msec : tz ? tz : (size_t)asn1t_length; + for(i=0;i'9') return 0; + } + + /* extract data and time */ + OPENSSL_cleanse(&t, sizeof(t)); +- if (asn1t->type == V_ASN1_UTCTIME) { /* YY - two digit year */ ++ if (asn1t_type == V_ASN1_UTCTIME) { /* YY - two digit year */ + t.tm_year = (p[0]-'0')*10 + (p[1]-'0'); + if (t.tm_year < 70) t.tm_year += 100; + i=2; +@@ -2242,11 +2248,11 @@ time_t ASN1_TIME_timet(ASN1_TIME *asn1t, time_t *gmtoff) { + if (tz) { + /* TZ is 'Z' or [+-]DDDD and after TZ the string must stop*/ + if (p[tz] == 'Z') { +- if (asn1t->length>tz+1 ) return 0; +- } else if (asn1t->lengthtz+1 ) return 0; ++ } else if ((size_t)asn1t_lengthlength>tz+5 ) return 0; ++ if ((size_t)asn1t_length>tz+5 ) return 0; + for(i=tz+1;i'9') return 0; + } +@@ -4690,7 +4696,11 @@ X509_get_subjectAltNames(cert) + EXTEND(SP, 2); + count++; + PUSHs(sv_2mortal(newSViv(subjAltNameDN->type))); +- PUSHs(sv_2mortal(newSVpv((const char*)subjAltNameDN->d.ip->data, subjAltNameDN->d.ip->length))); ++#if (OPENSSL_VERSION_NUMBER >= 0x1010000f && !defined(LIBRESSL_VERSION_NUMBER)) || (LIBRESSL_VERSION_NUMBER >= 0x2070000fL) ++ PUSHs(sv_2mortal(newSVpv((const char*)ASN1_STRING_get0_data(subjAltNameDN->d.ip), ASN1_STRING_length(subjAltNameDN->d.ip)))); ++#else ++ PUSHs(sv_2mortal(newSVpv((const char*)ASN1_STRING_data(subjAltNameDN->d.ip), ASN1_STRING_length(subjAltNameDN->d.ip)))); ++#endif + break; + + } +@@ -5229,15 +5239,20 @@ P_ASN1_TIME_get_isotime(tm) + ASN1_TIME_to_generalizedtime(tm,&tmp); + if (tmp) { + if (ASN1_GENERALIZEDTIME_check(tmp)) { +- if (strlen((char*)tmp->data)>=14 && strlen((char*)tmp->data)<200) { ++#if (OPENSSL_VERSION_NUMBER >= 0x1010000f && !defined(LIBRESSL_VERSION_NUMBER)) || (LIBRESSL_VERSION_NUMBER >= 0x2070000fL) ++ const char *tmp_data = (const char*)ASN1_STRING_get0_data(tmp); ++#else ++ const char *tmp_data = (const char*)ASN1_STRING_data(tmp); ++#endif ++ if (strlen(tmp_data)>=14 && strlen(tmp_data)<200) { + strcpy (buf,"yyyy-mm-ddThh:mm:ss"); +- strncpy(buf, (char*)tmp->data, 4); +- strncpy(buf+5, (char*)tmp->data+4, 2); +- strncpy(buf+8, (char*)tmp->data+6, 2); +- strncpy(buf+11,(char*)tmp->data+8, 2); +- strncpy(buf+14,(char*)tmp->data+10,2); +- strncpy(buf+17,(char*)tmp->data+12,2); +- if (strlen((char*)tmp->data)>14) strcat(buf+19,(char*)tmp->data+14); ++ strncpy(buf, tmp_data, 4); ++ strncpy(buf+5, tmp_data+4, 2); ++ strncpy(buf+8, tmp_data+6, 2); ++ strncpy(buf+11,tmp_data+8, 2); ++ strncpy(buf+14,tmp_data+10,2); ++ strncpy(buf+17,tmp_data+12,2); ++ if (strlen(tmp_data)>14) strcat(buf+19,tmp_data+14); + } + } + ASN1_GENERALIZEDTIME_free(tmp); +@@ -5250,7 +5265,6 @@ P_ASN1_TIME_set_isotime(tm,str) + ASN1_TIME *tm + const char *str + PREINIT: +- ASN1_TIME t; + char buf[256]; + int i,rv; + CODE: +@@ -5272,22 +5286,27 @@ P_ASN1_TIME_set_isotime(tm,str) + buf[14] = '\0'; + if (strlen(str)>19 && strlen(str)<200) strcat(buf,str+19); + +- /* WORKAROUND: ASN1_TIME_set_string() not available in 0.9.8 !!!*/ +- /* in 1.0.0 we would simply: rv = ASN1_TIME_set_string(tm,buf); */ +- t.length = strlen(buf); +- t.data = (unsigned char *)buf; +- t.flags = 0; +- t.type = V_ASN1_UTCTIME; +- if (!ASN1_TIME_check(&t)) { +- t.type = V_ASN1_GENERALIZEDTIME; +- if (!ASN1_TIME_check(&t)) XSRETURN_UNDEF; ++ /* ASN1_TIME_set_string() not available in 0.9.8 */ ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L ++ rv = ASN1_TIME_set_string(tm, buf); ++ if (!rv) XSRETURN_UNDEF; ++#else ++ { ++ ASN1_TIME t; ++ t.length = strlen(buf); ++ t.data = (unsigned char *)buf; ++ t.flags = 0; ++ t.type = V_ASN1_UTCTIME; ++ if (!ASN1_TIME_check(&t)) { ++ t.type = V_ASN1_GENERALIZEDTIME; ++ if (!ASN1_TIME_check(&t)) XSRETURN_UNDEF; ++ } ++ tm->type = t.type; ++ tm->flags = t.flags; ++ if (!ASN1_STRING_set(tm,t.data,t.length)) XSRETURN_UNDEF; ++ rv = 1; + } +- tm->type = t.type; +- tm->flags = t.flags; +- if (!ASN1_STRING_set(tm,t.data,t.length)) XSRETURN_UNDEF; +- rv = 1; +- +- /* end of ASN1_TIME_set_string() reimplementation */ ++#endif + + ST(0) = sv_newmortal(); + sv_setiv(ST(0), rv); /* 1 = success, undef = failure */ diff --git a/meta-perl/recipes-perl/libnet/libnet-ssleay-perl_1.96.bb b/meta-perl/recipes-perl/libnet/libnet-ssleay-perl_1.96.bb index d2c3bee645..e5f8718f68 100644 --- a/meta-perl/recipes-perl/libnet/libnet-ssleay-perl_1.96.bb +++ b/meta-perl/recipes-perl/libnet/libnet-ssleay-perl_1.96.bb @@ -24,7 +24,11 @@ RDEPENDS:${PN} += "\ " SRC_URI = "${CPAN_MIRROR}/authors/id/C/CH/CHRISN/Net-SSLeay-${PV}.tar.gz \ - file://run-ptest" + file://run-ptest \ + file://0001-Fix-SSLv3-in-OpenSSL-4.0.0.patch \ + file://0002-OpenSSL-4.0.0-remove-support-for-some-TLS-functions.patch \ + file://0003-Fix-Net-SSLeay-to-support-opaque-ASN1_STRING.patch \ + " SRC_URI[sha256sum] = "ab213691685fb2a576c669cbc8d9266f8165a31563ad15b7c4030b94adfc0753" S = "${UNPACKDIR}/Net-SSLeay-${PV}"