| Message ID | 20180527221348.8716-1-rosenp@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | John Crispin |
| Headers | show |
| Series | [OpenWrt-Devel,1/2] curl: Use ca-bundle for all TLS libraries. | expand |
The sender domain has a DMARC Reject/Quarantine policy which disallows sending mailing list messages using the original "From" header. To mitigate this problem, the original message has been wrapped automatically by the mailing list software. > On 27 May 2018, at 23:13, Rosen Penev <rosenp@gmail.com> wrote: > > It simplifies the Makefile a bit. In addition, using ca-bundle > saves some space as well. > > It also fixes an issue with at least transmission, which has a dependency > on ca-bundle, but currently libcurl with OpenSSL or GnuTLS cause it not > to work. > > This has been tested on mt7621 with OpenSSL and GnuTLS just by running > 'curl https://www.google.com' and seeing if there's a verify error. > The rest are already using ca-bundle and therefore work fine. > > Signed-off-by: Rosen Penev <rosenp@gmail.com> > --- > package/network/utils/curl/Makefile | 10 ++++++---- > 1 file changed, 6 insertions(+), 4 deletions(-) > > diff --git a/package/network/utils/curl/Makefile b/package/network/utils/curl/Makefile > index 92b3cab7dd..ae8cc31edc 100644 > --- a/package/network/utils/curl/Makefile > +++ b/package/network/utils/curl/Makefile > @@ -112,13 +112,15 @@ CONFIGURE_ARGS += \ > --without-libmetalink \ > --without-librtmp \ > --without-libidn \ > + --without-ca-path \ > + --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt \ > \ > $(call autoconf_bool,CONFIG_IPV6,ipv6) \ > \ > - $(if $(CONFIG_LIBCURL_WOLFSSL),--with-cyassl="$(STAGING_DIR)/usr" --without-ca-path --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt,--without-cyassl) \ > - $(if $(CONFIG_LIBCURL_GNUTLS),--with-gnutls="$(STAGING_DIR)/usr" --without-ca-bundle --with-ca-path=/etc/ssl/certs,--without-gnutls) \ > - $(if $(CONFIG_LIBCURL_OPENSSL),--with-ssl="$(STAGING_DIR)/usr" --without-ca-bundle --with-ca-path=/etc/ssl/certs,--without-ssl) \ > - $(if $(CONFIG_LIBCURL_MBEDTLS),--with-mbedtls="$(STAGING_DIR)/usr" --without-ca-path --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt,--without-mbedtls) \ > + $(if $(CONFIG_LIBCURL_WOLFSSL),--with-cyassl="$(STAGING_DIR)/usr",--without-cyassl) \ > + $(if $(CONFIG_LIBCURL_GNUTLS),--with-gnutls="$(STAGING_DIR)/usr",--without-gnutls) \ > + $(if $(CONFIG_LIBCURL_OPENSSL),--with-ssl="$(STAGING_DIR)/usr",--without-ssl) \ > + $(if $(CONFIG_LIBCURL_MBEDTLS),--with-mbedtls="$(STAGING_DIR)/usr",--without-mbedtls) \ > \ > $(if $(CONFIG_LIBCURL_LIBIDN2),--with-libidn2="$(STAGING_DIR)/usr",--without-libidn2) \ > $(if $(CONFIG_LIBCURL_SSH2),--with-libssh2="$(STAGING_DIR)/usr",--without-libssh2) \ > -- > 2.17.0 > > > _______________________________________________ > openwrt-devel mailing list > openwrt-devel@lists.openwrt.org > http://lists.infradead.org/mailman/listinfo/openwrt-devel Works for me and has solved a long annoying issue of needing both ca-bundle & ca-certs installed (ddns-scripts v znc), hence taking twice the space in rom. Tested-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> Cheers, Kevin D-B 012C ACB2 28C6 C53E 9775 9123 B3A2 389B 9DE2 334A
diff --git a/package/network/utils/curl/Makefile b/package/network/utils/curl/Makefile index 92b3cab7dd..ae8cc31edc 100644 --- a/package/network/utils/curl/Makefile +++ b/package/network/utils/curl/Makefile @@ -112,13 +112,15 @@ CONFIGURE_ARGS += \ --without-libmetalink \ --without-librtmp \ --without-libidn \ + --without-ca-path \ + --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt \ \ $(call autoconf_bool,CONFIG_IPV6,ipv6) \ \ - $(if $(CONFIG_LIBCURL_WOLFSSL),--with-cyassl="$(STAGING_DIR)/usr" --without-ca-path --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt,--without-cyassl) \ - $(if $(CONFIG_LIBCURL_GNUTLS),--with-gnutls="$(STAGING_DIR)/usr" --without-ca-bundle --with-ca-path=/etc/ssl/certs,--without-gnutls) \ - $(if $(CONFIG_LIBCURL_OPENSSL),--with-ssl="$(STAGING_DIR)/usr" --without-ca-bundle --with-ca-path=/etc/ssl/certs,--without-ssl) \ - $(if $(CONFIG_LIBCURL_MBEDTLS),--with-mbedtls="$(STAGING_DIR)/usr" --without-ca-path --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt,--without-mbedtls) \ + $(if $(CONFIG_LIBCURL_WOLFSSL),--with-cyassl="$(STAGING_DIR)/usr",--without-cyassl) \ + $(if $(CONFIG_LIBCURL_GNUTLS),--with-gnutls="$(STAGING_DIR)/usr",--without-gnutls) \ + $(if $(CONFIG_LIBCURL_OPENSSL),--with-ssl="$(STAGING_DIR)/usr",--without-ssl) \ + $(if $(CONFIG_LIBCURL_MBEDTLS),--with-mbedtls="$(STAGING_DIR)/usr",--without-mbedtls) \ \ $(if $(CONFIG_LIBCURL_LIBIDN2),--with-libidn2="$(STAGING_DIR)/usr",--without-libidn2) \ $(if $(CONFIG_LIBCURL_SSH2),--with-libssh2="$(STAGING_DIR)/usr",--without-libssh2) \
It simplifies the Makefile a bit. In addition, using ca-bundle saves some space as well. It also fixes an issue with at least transmission, which has a dependency on ca-bundle, but currently libcurl with OpenSSL or GnuTLS cause it not to work. This has been tested on mt7621 with OpenSSL and GnuTLS just by running 'curl https://www.google.com' and seeing if there's a verify error. The rest are already using ca-bundle and therefore work fine. Signed-off-by: Rosen Penev <rosenp@gmail.com> --- package/network/utils/curl/Makefile | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)