Bug 13181

Summary:	libopenssl package enables Cryptodev engine even if BR2_PACKAGE_LIBOPENSSL_ENGINES is disabled
Product:	buildroot	Reporter:	Bradley Gamble <bradley.gamble>
Component:	Other	Assignee:	unassigned
Status:	RESOLVED MOVED
Severity:	normal	CC:	buildroot, yann.morin.1998
Priority:	P5
Version:	2020.02
Target Milestone:	---
Hardware:	All
OS:	Linux
Host:		Target:
Build:

Description Bradley Gamble 2020-09-07 13:30:33 UTC

OpenSSL builds a number of seperate engines that provide cryptographic API and hardware offload support. This is currently configured from Buildroot via the BR2_PACKAGE_LIBOPENSSL_ENGINES option.

Previously disabling this option would remove these engines from the completed filesystem, disabling their use. However, recent versions of OpenSSL build the devcrypto engine in to libcrypto as default, rather than as a dynamic library. This can lead to Cryptodev being used even if it was not intended.

The libopenssl.mk file currently checks if BR2_PACKAGE_HAS_CRYPTODEV is set and will enable the Cryptodev engine via the "enable-devcryptoeng" configure flag if true. This is a manual override as all the other engines can be specified in a similar manner (ie enable-afalgeng) but Buildroot seems to imply that enabling the Cryptodev Package should also force OpenSSL to use it (which is incorrect).

OpenSSL's Cryptodev engine should either be overridden by the additional engines option (disabling it if BR2_PACKAGE_LIBOPENSSL_ENGINES is not set) or should be a manual override due to it's ability to be built statically in to libcrypto.

Comment 1 Thomas Petazzoni 2020-09-07 20:45:12 UTC

Thanks for your bug report.

It is pretty common in Buildroot to enable an optional feature in a package (here OpenSSL) if the dependencies needed for that feature (here cryptodev) are available.

Do you have a practical situation where one cryptodev implementation (BR2_PACKAGE_CRYPTODEV_LINUX or BR2_PACKAGE_OCF_LINUX) is enabled, but for some reason OpenSSL cannot / should not use cryptodev ?

Comment 2 Yann E. MORIN 2024-06-15 14:55:06 UTC

Thank you for your report.

The issue tracker for the Buildroot project has been moved to
the Gitlab.com issue tracker:
    https://gitlab.com/buildroot.org/buildroot/-/issues

We are taking this opportunity to close old issues in this old
tracker. If you believe your issue is still relevant, please
open one in the new issue tracker.

Thank you!