summaryrefslogtreecommitdiff
path: root/Configure
Commit message (Collapse)AuthorAgeFilesLines
...
* build.info: Add the possibility to add dependencies on raw targetsRichard Levitte2021-03-031-6/+16
| | | | | | | | | | We need to add something for the 'tests' target to depend on, so a special syntax for those is introduced: DEPEND[|tests|]=fipsmodule.cnf Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14320)
* Deprecate the low level SRP APIsMatt Caswell2021-02-121-4/+3
| | | | | | | | | The OTC decided that all low level APIs should be deprecated. This extends to SRP, even though at the current time there is no "EVP" interface to it. This could be added in a future release. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14132)
* Add a configure time option to disable the fetch cache.Pauli2021-02-121-0/+1
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14126)
* Stop disabling TLSv1.3 if ec and dh are disabledMatt Caswell2021-02-051-2/+0
| | | | | | | | | | Even if EC and DH are disabled then we may still be able to use TLSv1.3 if we have groups that have been plugged in by an external provider. Fixes #13767 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
* Update copyright yearRichard Levitte2021-01-281-1/+1
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13999)
* Configure: warn about duplicate GENERATE declarations in build.info filesRichard Levitte2021-01-121-1/+4
| | | | | | | | This sort of duplication is permitted, as the end result will be a single item anyway, but we might as well warn to avoid future confusion. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13824)
* Configure: clean away perl syntax faultsRichard Levitte2021-01-121-2/+2
| | | | | | | The faults aren't fatal (i.e. perl just shrugs), but are curious. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13824)
* Configure: Check all SOURCE declarations, to ensure consistencyRichard Levitte2021-01-121-5/+69
| | | | | | | | | | If the given sources are GENERATEd, we check those generators as well. This ensures that the declarations in the diverse build.info files are consistent with existing files. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13824)
* Drop OPENSSL_NO_RSA everywhereRichard Levitte2020-12-201-2/+2
| | | | | | | | The configuration option 'no-rsa' was dropped with OpenSSL 1.1.0, so this is simply a cleanup of the remains. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13700)
* GitHub CI: Separate no-deprecated job from minimal jobRichard Levitte2020-12-191-1/+1
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13706)
* {.travis,ci,appveyor}.yml: Make minimal config consistent, add no-deprecated ↵Dr. David von Oheimb2020-12-041-1/+18
| | | | | | | | | no-ec no-ktls no-siv This works nicely by addin a new no-bulk option to Configure. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13110)
* Fix no-engineMatt Caswell2020-11-271-1/+1
| | | | | | | | | | If we specify no-engine then this should cascade to also mean no-dynamic-engine. The store test was only checking whether dynamic-engine was disabled, meaning that some tests were failing in a no-engine build. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13502)
* Configure: handle undefined shared_target.Richard Levitte2020-09-291-2/+2
| | | | | | | | | | | | | | Some very basic config targets don't defined the 'shared_target' attribute at all. This wasn't handled well enough in Configure. This also cleans away an explicit reference to the ossltest engine in Configurations/unix-Makefile.tmpl, which isn't necessary since the build.info attributes were added. Fixes openssl/web#197 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13031)
* Configure: Show 'enable' and 'disable' config attributesRichard Levitte2020-09-241-0/+2
| | | | | | | This makes a difference for './Configure HASH' and './Configure TABLE' Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12933)
* Add 'fips-securitychecks' option and plumb this into the actual fips checksShane Lontis2020-09-181-0/+1
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12745)
* deprecate engines in 3.0Pauli2020-07-161-2/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12226)
* Configure: fix minor typo in apitable commentDaniel Bevenius2020-07-151-1/+1
| | | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12398)
* Fix many MarkDown issues in {NOTES*,README*,HACKING,LICENSE}.md filesDr. David von Oheimb2020-07-051-1/+1
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12109)
* Rename NOTES*, README*, VERSION, HACKING, LICENSE to .md or .txtDr. David von Oheimb2020-07-051-3/+3
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12109)
* Configure: fix handling of build.info attributes with valueRichard Levitte2020-07-031-3/+3
| | | | | | | | | | | | | | This line wasn't properly handled: SCRIPTS{misc,linkname=tsget}=tsget.pl It generated an attribute "linkname=tsget" with the value 1, instead of what it should have, an attribute "linkname" with the value "tsget". Fixes #12341 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12344)
* Configure: Check source and build dir equality a little more thoroughlyRichard Levitte2020-07-021-2/+33
| | | | | | | | | | | | | | | | | | | | | | | | | 'absolutedir' does a thorough job ensuring that we have a "real" path to both source and build directory, unencumbered by symbolic links. However, that isn't enough on case insensitive file systems on Unix flavored platforms, where it's possible to stand in, for example, /PATH/TO/Work/openssl, and then do this: perl ../../work/openssl/Configure ... and thereby having it look like the source directory and the build directory aren't the same. We solve this by having a closer look at the computed source and build directories, and making sure they are exactly the same strings if they are in fact the same directory. This is especially important when making symbolic links based on this directories, but may have other ramifications as well. Fixes #12323 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12337)
* Add --fips-key configuration parameter to fipsinstall application.Rich Salz2020-06-291-0/+13
| | | | | | | | | | | | | | Change default FIPS HMAC KEY from all-zero's Use default FIPSKEY if not given on command line. Make all -macopt in fipsinstall optional Make all tests, except fipsinstall, use the default -macopt and -mac_name flags. Define and use FIPSDIR variable on VMS/MMS. Also use SRCDIR/BLDDIR in SRCTOP/BLDTOP. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12235)
* DOC: Mention Configure consistentlyRichard Levitte2020-06-281-1/+0
| | | | | | | | 'config' is now a mere wrapper for backward compatibility. All documentation is changed accordingly. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11230)
* Configure: pick up options from older 'config'Richard Levitte2020-06-281-1/+24
| | | | | | | | | These options were coded in util/perl/OpenSSL/config.pm, but that got removed when the OpenSSL::config::main() function was removed. We're not putting them back, but in 'Configure'. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11230)
* util/perl/OpenSSL/config.pm: refactor map_guess()Richard Levitte2020-06-281-2/+18
| | | | | | | | | | | | | | map_guess() is now table driven, just like get_system(). Additionally, it now takes a config hash table and returns one of its own. This way, 'Configure' can pass whatever it has already found to OpenSSL::config::get_platform(), and easily merge the returned hash table into its %config. This also gets rid of variables that we no longer need. That includes $PERL and all the $__CNF_ environment variables. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11230)
* util/perl/OpenSSL/config.pm, Configure: move check of target with compilerRichard Levitte2020-06-281-1/+18
| | | | | | | | Previously, ./config would check if "$target-$CC", then "$target" exists and choose the one that does. This is now moved to Configure. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11230)
* Add ACVP fips module testsShane Lontis2020-06-171-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | For FIPS validation purposes - Automated Cryptographic Validation Protocol (ACVP) tests need to be performed. (See https://github.com/usnistgov/ACVP). These tests are very similiar to the old CAVS tests. This PR uses a hardwired subset of these test vectors to perform similiar operations, to show the usage and prove that the API's are able to perform the required operations. It may also help with communication with the lab (i.e- The lab could add a test here to show a unworking use case - which we can then address). The EVP layer performs these tests instead of calling lower level API's as was done in the old FOM. Some of these tests require access to internals that are not normally allowed/required. The config option 'acvp_tests' (enabled by default) has been added so that this access may be removed. The mechanism has been implemented as additional OSSL_PARAM values that can be set and get. A callback mechanism did not seem to add any additional benefit. These params will not be added to the gettables lists. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11572)
* Fix egd and devrandom source configsBernd Edlinger2020-05-201-0/+3
| | | | | | | | | | | | | | | | | ./config --with-rand-seed=egd need to defines OPENSSL_RAND_SEED_EGD and OPENSSL_NO_EGD so get rid of OPENSSL_NO_EGD (compiles but I did not really test EGD) ./config --with-rand-seed=devrandom does not work since wait_random_seeded works under the assumption that OPENSSL_RAND_SEED_GETRANDOM is supposed to be enabled as well, that is usually the case, but not when only devrandom is enabled. Skip the wait code in this special case. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11848)
* Configure: avoid perl regexp bugsRichard Levitte2020-05-061-32/+26
| | | | | | | | | | | | | | | It seems that in older perl versions '(?P' doesn't interact very well with '(?|' or '(?:'. Since we make extensive use of '(?P' in build.info parsing, we avoid combining that with '(?|' and '(?:' when parsing build.info variables, and end up parsing variable modifier twice (first generally, and then parse that result into the modifier components). Fixes #11694 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11737)
* Configure: change all references to INSTALL to INSTALL.mdRichard Levitte2020-04-281-6/+7
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11657)
* Configure: Allow quoted values in VERSIONRichard Levitte2020-04-251-1/+7
| | | | | | | | Fixes #11618 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11624)
* Update copyright yearMatt Caswell2020-04-231-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11616)
* GOST2012 TLS Supported Groups Identifiers SupportNikolay Morozov2020-04-221-1/+1
| | | | | | | | | For GOST2012-GOST8912-GOST8912 IANA introduce TLS Supported Groups Identifiers https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11568)
* config, Configure: move the check of removed crypto/ sub-systemsRichard Levitte2020-03-041-0/+13
| | | | | | | | | | | | | | | | The 'config' script checked for a bunch of crypto/ sub-system directories, and added 'no-' options if they weren't there. We move it to 'Configure' in an effort to simplify 'config' for further work. Note: this is pretty much a historical thing. In modern OpenSSL, it's much simpler to edit the SUBDIRS statement in crypto/build.info. However, it's been claimed the there are those who still remove some of these sub-system sources. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11217)
* Configure: Diverse cleanupsRichard Levitte2020-03-021-23/+10
| | | | | | | | There were some remaining old code and comments that don't serve a purpose any longer. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11185)
* build.info: Implement simply substitutions in variable valuesRichard Levitte2020-03-021-5/+44
| | | | | | | | | | | | | | Use case: having a variable with multiple source files in its value, and wanting to refer to the corresponding object file. $SRCS=foo.c bar.c SOURCE[program]=$SRCS DEPEND[${SRCS/.c/.o}]=prog.h GENERATE[prog.h]=... Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11185)
* build.info: Make it possible to have more than one item in KEYWORD[]Richard Levitte2020-03-021-71/+75
| | | | | | | | | | So far, the "index" part of KEYWORD[whatever] could only handle one item. There are cases, however, where we want to add the exact same value to multiple items. This is especially helpful if a variable that may have multi-item values are used in the "index" part. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11185)
* Make secure-memory be a config optionRich Salz2020-02-141-0/+1
| | | | | | | | | | | Adding support for "no-secure-memory" was simple, a one-liner. Fixing all the "ifdef OPENSSL_SECURE_MEMORY" to be "ifndef NO_xxx" was a bit more work. My original goof, for not following the OpenSSL pattern "ifndef NO_" used everywhere else. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/11023)
* Configure: Add easy to use disabled deprecated functionality indicatorsRichard Levitte2020-02-071-3/+11
| | | | | | | | | | | | | | | | | In C, we have macros like OPENSSL_NO_DEPRECATED_3_0 to check if some section of code should be disabled to simulate a removal of things deprecated in the version. In perl, we had to check $disabled{deprecated} and compare $config{api} with the proper version code, which is doable but tedious and error prone. This change adds $disabled{'deprecated-x.y'} (x.y being a version number) which directly corresponds to OPENSSL_NO_DEPRECATED_x_y, for use in build.info conditions, test recipes and other perl stuff. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11027)
* Configure: Better detection of '-static' in @{$config{LDFLAGS}}Richard Levitte2020-01-231-1/+1
| | | | | | | | | | | @{$config{LDFLAGS}} isn't necessarily split up in pieces, so we need to check for '-static' with a regexp rather than with an exact string match. Fixes #10867 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10878)
* Configure: use $list_separator_re only for defines and includesRichard Levitte2020-01-131-2/+6
| | | | | | | | | | This regexp was used a bit too uncontrolled, which had it split flag values where it should not have. Fixes #10792 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10793)
* Deprecate the low level AES functionsMatt Caswell2020-01-061-0/+5
| | | | | | | | | | | | Use of the low level AES functions has been informally discouraged for a long time. We now formally deprecate them. Applications should instead use the EVP APIs, e.g. EVP_EncryptInit_ex, EVP_EncryptUpdate, EVP_EncryptFinal_ex, and the equivalently named decrypt functions. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10580)
* Deprecated crypto-mdebug-backtraceRich Salz2019-12-141-1/+1
| | | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10572)
* Deprecate most of debug-memoryRich Salz2019-12-141-18/+1
| | | | | | | | | | | | | | | | | | | | | Fixes #8322 The leak-checking (and backtrace option, on some platforms) provided by crypto-mdebug and crypto-mdebug-backtrace have been mostly neutered; only the "make malloc fail" capability remains. OpenSSL recommends using the compiler's leak-detection instead. The OPENSSL_DEBUG_MEMORY environment variable is no longer used. CRYPTO_mem_ctrl(), CRYPTO_set_mem_debug(), CRYPTO_mem_leaks(), CRYPTO_mem_leaks_fp() and CRYPTO_mem_leaks_cb() return a failure code. CRYPTO_mem_debug_{malloc,realloc,free}() have been removed. All of the above are now deprecated. Merge (now really small) mem_dbg.c into mem.c Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10572)
* Configure: use ELFv2 ABI on some ppc64 big endian systemsAndy Polyakov2019-12-111-3/+7
| | | | | | | | | If _CALL_ELF is defined to be 2, it's an ELFv2 system. Conditionally switch to the v2 perlasm scheme. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8883)
* Configuration: compute openssl_other_defines and related info laterRichard Levitte2019-12-101-44/+46
| | | | | | | | The computation of macros and configdata.pm related data from %disabled was done much too early, leaving later disablings without real support. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10566)
* Disable devcryptoeng on newer OpenBSD versionsRichard Levitte2019-12-101-0/+15
| | | | | | | | | It's reported that /dev/crypto support has been dropped in OpenBSD 5.7. Fixes #10552 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10566)
* Configure: make it possible to have generated generatorsRichard Levitte2019-11-291-3/+11
| | | | | | | | | | | This makes it possible to chain GENERATOR statements, which allows constructs like this: GENERATE[something.html]=something.pod GENERATE[something.pod]=something.pod.in Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6236)
* Add the possibility to generate documentation at build timeRichard Levitte2019-11-291-3/+35
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6236)
* Change the logic and behaviour surrounding '--api' and 'no-deprecated'Richard Levitte2019-11-071-22/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | At some point in time, there was a 'no-deprecated' configuration option, which had the effect of hiding all declarations of deprecated stuff, i.e. make the public API look like they were all removed. At some point in time, there was a '--api' configuration option, which had the effect of having the public API look like it did in the version given as value, on a best effort basis. In practice, this was used to get different implementations of BN_zero(), depending on the desired API compatibility level. At some later point in time, '--api' was changed to mean the same as 'no-deprecated', but only for the deprecations up to and including the desired API compatibility level. BN_zero() has been set to the pre-1.0.0 implementation ever since, unless 'no-deprecation' has been given. This change turns these options back to their original meaning, but with the slight twist that when combined, i.e. both '--api' and 'no-deprecated' is given, the declarations that are marked deprecated up to an including the desired API compatibility level are hidden, simulating that they have been removed. If no desired API compatibility level has been given, then configuration sets the current OpenSSL version by default. Furthermore, the macro OPENSSL_API_LEVEL is now used exclusively to check what API compatibility level is desired. For checking in code if `no-deprecated` has been configured for the desired API compatibility level, macros for each supported level is generated, such as OPENSSL_NO_DEPRECATED_1_1_1, corresponding to the use of DEPRECATEDIN_ macros, such as DEPRECATEDIN_1_1_1(). Just like before, to set an API compatibility level when building an application, define OPENSSL_API_COMPAT with an appropriate value. If it's desirable to hide deprecated functions up to and including that level, additionally define OPENSSL_NO_DEPRECATED (the value is ignored). Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
View Lorry Controller Status