[PATCH] kernel: backport mtk_soc_eth fixes from v5.13

2021-04-23 Thread Ilya Lipnitskiy
Fixes logic that leads to this error when booting mt7621 and other
devices that use the mediatek ethernet driver:
  [   23.144378] mtk_soc_eth 1e10.ethernet: PPE table busy

The rest are mostly moved from pending-5.10 to backport-5.10 with a
couple of cleanups and improvements from upstream.

Refresh patches.

Links:
https://git.kernel.org/netdev/net-next/c/c5d66587b890
https://git.kernel.org/netdev/net-next/c/3f57d8c40fea
https://git.kernel.org/netdev/net-next/c/5196c4178549
https://git.kernel.org/netdev/net-next/c/787082ab9f7b
https://git.kernel.org/netdev/net-next/c/c30c4a827390
https://git.kernel.org/netdev/net-next/c/3630d519d7c3
https://git.kernel.org/netdev/net-next/c/16ef670789b2
https://git.kernel.org/netdev/net-next/c/59555a8d0dd3
https://git.kernel.org/netdev/net-next/c/6b4423b258b9
https://git.kernel.org/netdev/net-next/c/e9229ffd550b
https://git.kernel.org/netdev/net-next/c/4e6bf609569c
https://git.kernel.org/netdev/net-next/c/816ac3e6e67b
https://git.kernel.org/netdev/net-next/c/16769a8923fa
https://git.kernel.org/netdev/net-next/c/db2c7b353db3
https://git.kernel.org/netdev/net-next/c/fa817272c37e
https://git.kernel.org/netdev/net-next/c/3bc8e0aff23b

Fixes: f07fe36f22fc ("kernel: update flow offload patches to upstream version")
Cc: Felix Fietkau 
Signed-off-by: Ilya Lipnitskiy 
---
 ...rnet-mediatek-ppe-fix-busy-wait-loop.patch |  72 
 ...net-mtk_eth_soc-fix-RX-VLAN-offload.patch} |  17 ++-
 ...eth_soc-unmap-RX-data-before-callin.patch} |  26 ++---
 ...et-mtk_eth_soc-fix-build_skb-cleanup.patch |  38 ++
 ...et-mtk_eth_soc-use-napi_consume_skb.patch} |  13 ++-
 ...eth_soc-reduce-MDIO-bus-access-late.patch} |  10 +-
 ...eth_soc-remove-unnecessary-TX-queue.patch} |  16 ++-
 ...eth_soc-use-larger-burst-size-for-Q.patch} |  13 ++-
 ...mtk_eth_soc-increase-DMA-ring-sizes.patch} |  11 +-
 ...eth_soc-implement-dynamic-interrupt.patch} |  58 ++---
 ...eth_soc-cache-HW-pointer-of-last-fr.patch} |  24 ++--
 ...eth_soc-only-read-the-full-RX-descr.patch} |  11 +-
 ...eth_soc-reduce-unnecessary-interrup.patch} |  12 +-
 ...et-mtk_eth_soc-rework-NAPI-callbacks.patch | 110 ++
 ...eth_soc-set-PPE-flow-hash-as-skb-ha.patch} |  16 ++-
 ..._eth_soc-use-iopoll.h-macro-for-DMA-.patch |  71 +++
 ...ethernet-mediatek-support-net-labels.patch |   4 +-
 17 files changed, 445 insertions(+), 77 deletions(-)
 create mode 100644 
target/linux/generic/backport-5.10/610-v5.13-35-net-ethernet-mediatek-ppe-fix-busy-wait-loop.patch
 rename 
target/linux/generic/{pending-5.10/770-02-net-ethernet-mtk_eth_soc-fix-rx-vlan-offload.patch
 => 
backport-5.10/610-v5.13-37-net-ethernet-mtk_eth_soc-fix-RX-VLAN-offload.patch} 
(56%)
 rename 
target/linux/generic/{pending-5.10/770-10-net-ethernet-mtk_eth_soc-unmap-rx-data-before-callin.patch
 => 
backport-5.10/610-v5.13-38-net-ethernet-mtk_eth_soc-unmap-RX-data-before-callin.patch}
 (56%)
 create mode 100644 
target/linux/generic/backport-5.10/610-v5.13-39-net-ethernet-mtk_eth_soc-fix-build_skb-cleanup.patch
 rename 
target/linux/generic/{pending-5.10/770-00-net-ethernet-mtk_eth_soc-use-napi_consume_skb.patch
 => 
backport-5.10/610-v5.13-40-net-ethernet-mtk_eth_soc-use-napi_consume_skb.patch} 
(77%)
 rename 
target/linux/generic/{pending-5.10/770-01-net-ethernet-mtk_eth_soc-significantly-reduce-mdio-b.patch
 => 
backport-5.10/610-v5.13-41-net-ethernet-mtk_eth_soc-reduce-MDIO-bus-access-late.patch}
 (65%)
 rename 
target/linux/generic/{pending-5.10/770-03-net-ethernet-mtk_eth_soc-fix-unnecessary-tx-queue-st.patch
 => 
backport-5.10/610-v5.13-42-net-ethernet-mtk_eth_soc-remove-unnecessary-TX-queue.patch}
 (68%)
 rename 
target/linux/generic/{pending-5.10/770-04-net-ethernet-mtk_eth_soc-use-larger-burst-size-for-q.patch
 => 
backport-5.10/610-v5.13-43-net-ethernet-mtk_eth_soc-use-larger-burst-size-for-Q.patch}
 (67%)
 rename 
target/linux/generic/{pending-5.10/770-05-net-ethernet-mtk_eth_soc-increase-DMA-ring-sizes.patch
 => 
backport-5.10/610-v5.13-44-net-ethernet-mtk_eth_soc-increase-DMA-ring-sizes.patch}
 (62%)
 rename 
target/linux/generic/{pending-5.10/770-06-net-ethernet-mtk_eth_soc-implement-dynamic-interrupt.patch
 => 
backport-5.10/610-v5.13-45-net-ethernet-mtk_eth_soc-implement-dynamic-interrupt.patch}
 (76%)
 rename 
target/linux/generic/{pending-5.10/770-08-net-ethernet-mtk_eth_soc-cache-hardware-pointer-of-l.patch
 => 
backport-5.10/610-v5.13-46-net-ethernet-mtk_eth_soc-cache-HW-pointer-of-last-fr.patch}
 (70%)
 rename 
target/linux/generic/{pending-5.10/770-09-net-ethernet-mtk_eth_soc-only-read-the-full-rx-descr.patch
 => 
backport-5.10/610-v5.13-47-net-ethernet-mtk_eth_soc-only-read-the-full-RX-descr.patch}
 (77%)
 rename 
target/linux/generic/{pending-5.10/770-11-net-ethernet-mtk_eth_soc-avoid-rearming-interrupt-if.patch
 => 
backport-5.10/610-v5.13-48-net-ethernet-mtk_eth_soc-reduce-unnecessary-interrup.patch}
 (61%)
 create mode 100644 

[PATCH v2] treewide: consolidate named GPIO patch into hack-5.10

2021-04-23 Thread Ilya Lipnitskiy
ath79, lantiq, ipq40xx, ramips all use the OpenWrt-specific gpio-export
functionality. Consolidate the patch that adds it under hack-5.10 since
this logic is obviously not target-specific. For those who want to
disable it, unsetting CONFIG_GPIO_SYSFS symbol will disable this code.

Signed-off-by: Ilya Lipnitskiy 
---
 .../0036-GPIO-add-named-gpio-exports.patch| 165 -
 .../800-GPIO-add-named-gpio-exports.patch |  81 -
 .../0030-GPIO-add-named-gpio-exports.patch| 169 --
 3 files changed, 39 insertions(+), 376 deletions(-)
 delete mode 100644 
target/linux/ath79/patches-5.10/0036-GPIO-add-named-gpio-exports.patch
 rename target/linux/{ramips/patches-5.10 => 
generic/hack-5.10}/800-GPIO-add-named-gpio-exports.patch (90%)
 delete mode 100644 
target/linux/lantiq/patches-5.10/0030-GPIO-add-named-gpio-exports.patch

diff --git 
a/target/linux/ath79/patches-5.10/0036-GPIO-add-named-gpio-exports.patch 
b/target/linux/ath79/patches-5.10/0036-GPIO-add-named-gpio-exports.patch
deleted file mode 100644
index c7899cc7115b..
--- a/target/linux/ath79/patches-5.10/0036-GPIO-add-named-gpio-exports.patch
+++ /dev/null
@@ -1,165 +0,0 @@
-From 4267880319bc1a2270d352e0ded6d6386242a7ef Mon Sep 17 00:00:00 2001
-From: John Crispin 
-Date: Tue, 12 Aug 2014 20:49:27 +0200
-Subject: [PATCH 24/53] GPIO: add named gpio exports
-
-Signed-off-by: John Crispin 

- drivers/gpio/gpiolib-of.c |   68 +
- drivers/gpio/gpiolib-sysfs.c  |   10 +-
- include/asm-generic/gpio.h|6 
- include/linux/gpio/consumer.h |8 +
- 4 files changed, 91 insertions(+), 1 deletion(-)
-
 a/drivers/gpio/gpiolib-of.c
-+++ b/drivers/gpio/gpiolib-of.c
-@@ -19,6 +19,8 @@
- #include 
- #include 
- #include 
-+#include 
-+#include 
- 
- #include "gpiolib.h"
- #include "gpiolib-of.h"
-@@ -1039,3 +1041,68 @@ void of_gpiochip_remove(struct gpio_chip
- {
-   of_node_put(chip->of_node);
- }
-+
-+static struct of_device_id gpio_export_ids[] = {
-+  { .compatible = "gpio-export" },
-+  { /* sentinel */ }
-+};
-+
-+static int of_gpio_export_probe(struct platform_device *pdev)
-+{
-+  struct device_node *np = pdev->dev.of_node;
-+  struct device_node *cnp;
-+  u32 val;
-+  int nb = 0;
-+
-+  for_each_child_of_node(np, cnp) {
-+  const char *name = NULL;
-+  int gpio;
-+  bool dmc;
-+  int max_gpio = 1;
-+  int i;
-+
-+  of_property_read_string(cnp, "gpio-export,name", );
-+
-+  if (!name)
-+  max_gpio = of_gpio_count(cnp);
-+
-+  for (i = 0; i < max_gpio; i++) {
-+  unsigned flags = 0;
-+  enum of_gpio_flags of_flags;
-+
-+  gpio = of_get_gpio_flags(cnp, i, _flags);
-+  if (!gpio_is_valid(gpio))
-+  return gpio;
-+
-+  if (of_flags == OF_GPIO_ACTIVE_LOW)
-+  flags |= GPIOF_ACTIVE_LOW;
-+
-+  if (!of_property_read_u32(cnp, "gpio-export,output", 
))
-+  flags |= val ? GPIOF_OUT_INIT_HIGH : 
GPIOF_OUT_INIT_LOW;
-+  else
-+  flags |= GPIOF_IN;
-+
-+  if (devm_gpio_request_one(>dev, gpio, flags, name 
? name : of_node_full_name(np)))
-+  continue;
-+
-+  dmc = of_property_read_bool(cnp, 
"gpio-export,direction_may_change");
-+  gpio_export_with_name(gpio, dmc, name);
-+  nb++;
-+  }
-+  }
-+
-+  dev_info(>dev, "%d gpio(s) exported\n", nb);
-+
-+  return 0;
-+}
-+
-+static struct platform_driver gpio_export_driver = {
-+  .driver = {
-+  .name   = "gpio-export",
-+  .owner  = THIS_MODULE,
-+  .of_match_table = of_match_ptr(gpio_export_ids),
-+  },
-+  .probe  = of_gpio_export_probe,
-+};
-+
-+module_platform_driver(gpio_export_driver);
 a/drivers/gpio/gpiolib-sysfs.c
-+++ b/drivers/gpio/gpiolib-sysfs.c
-@@ -572,7 +572,7 @@ static struct class gpio_class = {
-  *
-  * Returns zero on success, else an error.
-  */
--int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
-+int __gpiod_export(struct gpio_desc *desc, bool direction_may_change, const 
char *name)
- {
-   struct gpio_chip*chip;
-   struct gpio_device  *gdev;
-@@ -634,6 +634,8 @@ int gpiod_export(struct gpio_desc *desc,
-   offset = gpio_chip_hwgpio(desc);
-   if (chip->names && chip->names[offset])
-   ioname = chip->names[offset];
-+  if (name)
-+  ioname = name;
- 
-   dev = device_create_with_groups(_class, >dev,
-   MKDEV(0, 0), data, gpio_groups,
-@@ -655,6 +657,12 @@ err_unlock:

[PATCH 2/2] blob: fix exceeding maximum buffer length

2021-04-23 Thread Zefir Kurtisi
Currently there is no measure in place to prevent the blob buffer
to exceed its maximum allowed length of 16MB. Continuously
calling blob_add() will expand the buffer until it exceeds
BLOB_ATTR_LEN_MASK and after that will return valid blob_attr
pointer without increasing the buflen.

A test program was added in the previous commit, this one fixes
the issue by asserting that the new bufflen after grow does not
exceed BLOB_ATTR_LEN_MASK.

Signed-off-by: Zefir Kurtisi 
---
 blob.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/blob.c b/blob.c
index 433becb..bd66d78 100644
--- a/blob.c
+++ b/blob.c
@@ -58,6 +58,8 @@ blob_buf_grow(struct blob_buf *buf, int required)
 {
int offset_head = attr_to_offset(buf, buf->head);
 
+   if ((buf->buflen + required) > BLOB_ATTR_LEN_MASK)
+   return false;
if (!buf->grow || !buf->grow(buf, required))
return false;
 
-- 
2.17.1


___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel


[PATCH 1/2] tests: add blob-buffer overflow test

2021-04-23 Thread Zefir Kurtisi
The blob buffer has no limitation in place
to prevent buflen to exceed maximum size.

This commit adds a test to demonstrate how
a blob increases past the maximum allowd
size of 16MB. It continuously adds chunks
of 64KB and with the 255th one blob_add()
returns a valid attribute pointer but the
blob's buflen does not increase.

The test is used to demonstrate the
failure, which is fixed with a follow-up
commit.

Signed-off-by: Zefir Kurtisi 
---
 tests/test-blob-buffer.c | 32 
 1 file changed, 32 insertions(+)
 create mode 100644 tests/test-blob-buffer.c

diff --git a/tests/test-blob-buffer.c b/tests/test-blob-buffer.c
new file mode 100644
index 000..ee2f8a2
--- /dev/null
+++ b/tests/test-blob-buffer.c
@@ -0,0 +1,32 @@
+#include 
+
+#include "blobmsg.h"
+
+/* chunks of 64KB to be added to blob-buffer */
+#define BUFF_SIZE  0x1
+/* exceed maximum blob buff-length */
+#define BUFF_CHUNKS(((BLOB_ATTR_LEN_MASK + 1) / BUFF_SIZE) + 1)
+
+int main(int argc, char **argv)
+{
+   int i;
+   static struct blob_buf buf;
+   blobmsg_buf_init();
+   int prev_len = buf.buflen;
+
+   for (i = 0; i < BUFF_CHUNKS; i++) {
+   struct blob_attr *attr = blob_new(, 0, BUFF_SIZE);
+   if (!attr) {
+   fprintf(stderr, "SUCCESS: failed to allocate 
attribute\n");
+   break;
+   }
+   fprintf(stderr, "i=%d, len=%d, buff=%p\n", i, buf.buflen, attr);
+   if (prev_len < buf.buflen) {
+   prev_len = buf.buflen;
+   continue;
+   }
+   fprintf(stderr, "ERROR: buffer length did not increase\n");
+   return -1;
+   }
+   return 0;
+}
-- 
2.17.1


___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel


[PATCH 0/2] blob: detect and fix buflen overflow

2021-04-23 Thread Zefir Kurtisi
The current implementation of the blob buffer misses a mechanism
to prevent the buflen to exceed its maximum allowed size of 16MB
(given by BLOB_ATTR_LEN_MASK). Instead of aborting and returning
false in blob_buf_grow() when the limit is reached, blob_add()
succeeds providing valid blob_attr pointers without increasing
the blob's buflen.

This series provides two commits with
* the first one adding a simple test to demonstrate the effect
* the second providing the fix


NOTE: obviously having blobs with buffers of more than 16MB does
not really make sense, especially in embedded systems. The issue
was detected not by working with huge buffers, but within a loop
expanding the blob buffer until blob_add() returned NULL, which
actually never happened.


Zefir Kurtisi (2):
  tests: add blob-buffer overflow test
  blob: fix exceeding maximum buffer length

 blob.c   |  2 ++
 tests/test-blob-buffer.c | 32 
 2 files changed, 34 insertions(+)
 create mode 100644 tests/test-blob-buffer.c

-- 
2.17.1


___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel


[PATCH 21.02] kernel: backport "mvmdio avoid error message for optional IRQ"

2021-04-23 Thread Daniel González Cabanelas
Rid of kernel error message: 
  [0.780828] orion-mdio d0072004.mdio: IRQ index 0 not found

on Marvell targets backporting the kernel commit fa2632f74e57

Signed-off-by: Daniel González Cabanelas 
---
 ...avoid-error-message-for-optional-IRQ.patch | 35 +++
 1 file changed, 35 insertions(+)
 create mode 100644 
target/linux/generic/backport-5.4/751-v5.6-net-mvmdio-avoid-error-message-for-optional-IRQ.patch

diff --git 
a/target/linux/generic/backport-5.4/751-v5.6-net-mvmdio-avoid-error-message-for-optional-IRQ.patch
 
b/target/linux/generic/backport-5.4/751-v5.6-net-mvmdio-avoid-error-message-for-optional-IRQ.patch
new file mode 100644
index 000..4a631a4
--- /dev/null
+++ 
b/target/linux/generic/backport-5.4/751-v5.6-net-mvmdio-avoid-error-message-for-optional-IRQ.patch
@@ -0,0 +1,35 @@
+From fa2632f74e57bbc869c8ad37751a11b6147a3acc Mon Sep 17 00:00:00 2001
+From: Chris Packham 
+Date: Mon, 16 Mar 2020 20:49:07 +1300
+Subject: [PATCH] net: mvmdio: avoid error message for optional IRQ
+
+Per the dt-binding the interrupt is optional so use
+platform_get_irq_optional() instead of platform_get_irq(). Since
+commit 7723f4c5ecdb ("driver core: platform: Add an error message to
+platform_get_irq*()") platform_get_irq() produces an error message
+
+  orion-mdio f1072004.mdio: IRQ index 0 not found
+
+which is perfectly normal if one hasn't specified the optional property
+in the device tree.
+
+Signed-off-by: Chris Packham 
+Reviewed-by: Andrew Lunn 
+Signed-off-by: David S. Miller 
+---
+ drivers/net/ethernet/marvell/mvmdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvmdio.c 
b/drivers/net/ethernet/marvell/mvmdio.c
+index 0b9e851f3da4fb..d14762d93640ac 100644
+--- a/drivers/net/ethernet/marvell/mvmdio.c
 b/drivers/net/ethernet/marvell/mvmdio.c
+@@ -347,7 +347,7 @@ static int orion_mdio_probe(struct platform_device *pdev)
+   }
+ 
+ 
+-  dev->err_interrupt = platform_get_irq(pdev, 0);
++  dev->err_interrupt = platform_get_irq_optional(pdev, 0);
+   if (dev->err_interrupt > 0 &&
+   resource_size(r) < MVMDIO_ERR_INT_MASK + 4) {
+   dev_err(>dev,
-- 
2.31.1





___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel


Re: [PATCH] package: openssl: Enable built engines per default

2021-04-23 Thread Eneas U de Queiroz
On Fri, Apr 23, 2021 at 3:11 AM Florian Eckert  wrote:
> How about if we create a uci default script and check on the running
> system what is installed?
> And then we could generate a file and add or remove an include line form
> the openssl.cnf [1]?

Hi Florian, Daniel

I think we can manage something like that.  The .include option can
load all files in a directory (/etc/ssl/engines.d/), and won't fail if
there aren't any files--the directory itself must exist.  Each engine
package can install its own file there, ahd have a post-install script
that adds a line to an "engines.cnf" file if there isn't any:

add_engine() {
# $1 = engine name (engine .so file without the .so extension)
grep -q "$1=$1" /etc/ssl/engines.d/engines.cnf && return
echo "$1=$1" >> /etc/ssl/engines.d/engines.cnf
}

/etc/ssl/engines.d/engines.cnf would start out with just the [engines]
header and some comments explaining its use and warning not to edit
something that would break things.

What do you think?

Cheers,

Eneas

___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel


commit 2683eeb627 breaks buffalo wzr600dhp

2021-04-23 Thread Russell Senior


Building master (182eaa4916) with kernel 5.10 and booting, I get:

[...]
[0.706515] spi-nor spi0.0: mx25l12805d (16384 Kbytes)
[0.716193] spi-nor spi0.1: unrecognized JEDEC id bytes: 20 18 c2 20 18 c2
[0.723165] spi-nor: probe of spi0.1 failed with error -2
[0.730576] libphy: Fixed MDIO Bus: probed
[0.737716] ag71xx 1900.eth: invalid MAC address, using random address
[1.062573] libphy: ag71xx_mdio: probed
[1.069024] switch0: Atheros AR8316 rev. 1 switch registered on mdio.0
[1.077657] ag71xx 1900.eth: connected to PHY at fixed-0:00 
[uid=, driver=Generic PHY]
[1.087283] eth0: Atheros AG71xx at 0xb900, irq 4, mode: rgmii
[1.093851] ag71xx 1a00.eth: invalid MAC address, using random address
[1.164292] random: fast init done
[1.417471] ar8316: Using port 4 as PHY
[2.470428] ag71xx 1a00.eth: connected to PHY at mdio.0:04 
[uid=004dd041, driver=Atheros AR8216/AR8236/AR8316]
[2.481391] eth1: Atheros AG71xx at 0xba00, irq 5, mode: rgmii
[2.487813] i2c /dev entries driver
[2.492936] NET: Registered protocol family 10
[2.502467] Segment Routing with IPv6
[2.506307] NET: Registered protocol family 17
[2.510841] 8021q: 802.1Q VLAN Support v1.8
[2.518597] /dev/root: Can't open blockdev
[2.522754] VFS: Cannot open root device "(null)" or unknown-block(0,0): 
error -6
[2.530242] Please append a correct "root=" boot option; here are the 
available partitions:
[2.538600] 1f00   16384 mtdblock0
[2.538604]  (driver?)
[2.545140] Kernel panic - not syncing: VFS: Unable to mount root fs on 
unknown-block(0,0)
[2.553386] Rebooting in 1 seconds..

Reverting 2683eeb627 lets it work again.


-- 
Russell Senior, President
russ...@personaltelco.net

___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel


Re: [PATCH v2] netfilter: remove no-op kconfig symbols

2021-04-23 Thread Rui Salvaterra
Hi, Jason,

On Fri, 23 Apr 2021 at 03:15, Jason A. Donenfeld  wrote:
>
> https://git.zx2c4.com/wireguard-linux/commit/?h=backport-5.4.y=ac8265d3b26e7c2674e066af6451c5a61d3f2e7a
>
> This will be included in the patchset next time I push a refresh of those.

Ok, I'll drop the patch changes and send a v3, then.

Thanks,
Rui

___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel


Re: [PATCH] package: openssl: Enable built engines per default

2021-04-23 Thread Florian Eckert

Hello Daniel,
Hello Eneas,

On 2021-04-23 01:36, Eneas U de Queiroz wrote:
On Thu, Apr 22, 2021 at 3:55 AM Daniel Danzberger  
wrote:


Automatically enable an engine in the openssl.cnf if it has been 
build.

Before this change, /etc/openssl.cnf had to be edited manually on the
system to enable the engine.




+define Package/libopenssl-conf/enable
+   $(if $(CONFIG_PACKAGE_libopenssl-$(2)),sed -i 
s/^\#*$(2)=$(2)/$(2)=$(2)/ $(1)/etc/ssl/openssl.cnf)

+endef



 define Package/libopenssl-conf/install
$(INSTALL_DIR) $(1)/etc/ssl
$(CP) $(PKG_INSTALL_DIR)/etc/ssl/openssl.cnf $(1)/etc/ssl/
+   $(call Package/libopenssl-conf/enable,$(1),devcrypto)
+   $(call Package/libopenssl-conf/enable,$(1),afalg)
+   $(call Package/libopenssl-conf/enable,$(1),padlock)




I do like the idea, though. My first thought was to add an install
script to the engine packages.  The problem is that the config file
may have been changed in a way that sed may produce unwanted results.


How about if we create a uci default script and check on the running 
system what is installed?
And then we could generate a file and add or remove an include line form 
the openssl.cnf [1]?



Another option, which may be the easiest and safest, is to use your
approach, but only uncomment the engines built into the firmware (=y),
and not the ones built as modules.


I think this is not an option, because not all want to have all engines 
installed.


That is my opinion.
Thanks florian

[1] https://github.com/openssl/openssl/blob/master/apps/openssl.cnf#L10

___
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel