abelian424
commented
11 months ago @stangri I've been trying to build other TLS libraries to look for something slimmer than OpenSSL - I saw that 'checking size of size_t' complete successfully when I was building cmake. What is your build environment? I've been using Alpine because OpenWrt on GCC 13 doesn't work in Debian-unstable. Here's the Dockerfile:
FROM alpine:latest
ENV GCC_COLORS='error=01;31:warning=01;35:note=01;36:caret=01;32:locus=01:quote=01'
WORKDIR /workdir
RUN apk add \
'argp-standalone' \
'asciidoc' \
'bash' \
'bc' \
'binutils' \
'bzip2' \
'cdrkit' \
'coreutils' \
'diffutils' \
'elfutils-dev' \
'findutils' \
'flex' \
'g++' \
'gawk' \
'gettext' \
'git' \
'grep' \
'gzip' \
'intltool' \
'libxslt' \
'linux-headers' \
'musl-fts-dev' \
'musl-libintl' \
'musl-obstack-dev' \
'ncurses-dev' \
'openssl-dev' \
'patch' \
'perl' \
'python3-dev' \
'rsync' \
'unzip' \
'util-linux' \
'zlib-dev' \
'curl' 'build-base' 'wget' 'gnupg' 'perl-utils' 'tar' \
'nano' 'expat' 'zsh' 'zsh-theme-powerlevel10k'
RUN curl -LO https://raw.githubusercontent.com/miyagawa/cpanminus/master/cpanm \
&& chmod +x cpanm \
&& ./cpanm App::cpanminus \
&& rm -fr ./cpanm /root/.cpanm
ENV PERL_CPANM_OPT --verbose --mirror https://cpan.metacpan.org --mirror-only
RUN cpanm Digest::SHA Module::Signature && rm -rf ~/.cpanm
ENV PERL_CPANM_OPT $PERL_CPANM_OPT --verify
RUN ln -s '/usr/lib/libncurses.so' '/usr/lib/libtinfo.so' && \
addgroup 'buildbot' && \
adduser -s '/bin/bash' -G 'buildbot' -D 'buildbot'
USER buildbot
#optional
#RUN mkdir -p ~/.local/share/zsh/plugins && \
# ln -s /usr/share/zsh/plugins/powerlevel10k ~/.local/share/zsh/plugins/ && \
# echo "alias make='make -j$(nproc)' && alias cp='cp -i'" >> ~/.zshrc \
# && ln -s /usr/lib/perl5/core_perl/ /workdir/{openwrt_dir}/staging_dir/hostpkg/usr/lib/perl5/{perl_ver}/
#ENV PERL5LIB='/workdir/{openwrt_dir}/staging_dir/hostpkg/usr/lib/perl5/{perl_ver}/'You should symlink /usr/lib/perl5/core_perl/* to /workdir/{openwrt_dir}/staging_dir/hostpkg/usr/lib/perl5/{perl_ver}/ to bypass having to install perl inside the buildroot. If that doesn't work, prefixing PERL5LIB=/workdir/{openwrt_dir}/staging_dir/hostpkg/usr/lib/perl5/{perl_ver}/before make will do the trick (you might have to symlink into PERL5LIB directory any missing files).
Mind, I've gotten stuck on building ngtcp2 but that error is due to trying to build with libressl not being recognized as an openssl/quictls replacement. libcurl shows an error with ngtcp2 not being accepted due to lack of quic support. If you want you can wait until I verify that libcurl successully builds - I just need to figure out how to tell ngtcp2 to locate libressl in staging_dir/host/lib.
EDIT: You should hold off on trying to build with OpenSSL 3.2.
EDIT: Using quictls is still the best turnkey option for now. Libressl should be possible in the next few days or weeks with the release of version 1.2.0 of ngtcp2. Rustls+MbedTLS might be a good combo (Rustls doesn't allow self-signed certificates for even local networks). And h2o looks very interesting. I'll probably try to fit that in or WolfSSL if it proves too difficult.
stangri
sbwml
ryuuzake
liudongmiao
micfogas
Maintainer: @stangri
Hi,
cURL OpenWrt package currently does not support HTTP/3 support but should. This protocol is now widely used everywhere, is supported in all major browsers, and has many advantages over HTTPS/2 including speed and privacy.
For example https-dns-proxy can now use HTTP/3 for DNS resolvers that use it. DNS is extremely latency sensitive in which a faster protocol would benefit it and be noticeable on pageload and responsiveness on OpenWrt connected devices.