summaryrefslogtreecommitdiffstats
path: root/Configure
AgeCommit message (Collapse)Author
7 daysAdd support for integrity-only cipher suites for TLS v1.3Rajeev Ranjan
- add test vectors for tls1_3 integrity-only ciphers - recmethod_local.h: add new member for MAC - tls13_meth.c: add MAC only to tls 1.3 - tls13_enc.c: extend function to add MAC only - ssl_local.h: add ssl_cipher_get_evp_md_mac() - s3_lib.c: add the new ciphers and add #ifndef OPENSSL_NO_INTEGRITY_ONLY_CIPHERS - ssl_ciph.c : add ssl_cipher_get_evp_md_mac() and use it - tls13secretstest.c: add dummy test function - Configure: add integrity-only-ciphers option - document the new ciphers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22903)
2024-05-06Security hardening: Expose Build flags for Position Independed Execution (PIE)Craig Lorentzen
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22596)
2024-04-12disable http3 demo on windowsNeil Horman
The external nghttp3 library seems to have a linking issue on windows (several missing symbols). Disable that build in windows for now until its fixed Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/24047)
2024-04-12fix all the warnings in our demos and make them enableableNeil Horman
Fix up the warnings in the demos and make them configurable with enable-demos Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/24047)
2024-04-09Copyright year updatesRichard Levitte
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes (cherry picked from commit 0ce7d1f355c1240653e320a3f6f8109c1f05f8c0) Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24034)
2024-03-06Enable qlog support by defaultHugo Landau
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23744)
2024-02-08Configure: Fix ordering bug when processing split DEPENDsRichard Levitte
Configure was recently made to process this sort of line: DEPEND[generated]=util/perl|OpenSSL/something.pm Unfortunately, in processing such lines, the order in which paths were recomputed caused some resulting paths to be faulty under some circumstances. This change fixes that. Fixes #22853 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23500) (cherry picked from commit 64cae4064405384cf7fe130a1e0189725db5e877)
2024-02-02QLOG: Editorial fixes (QLOG is spelled 'qlog')Hugo Landau
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22037)
2024-02-02Configure: Add warning when enabling QLOGHugo Landau
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22037)
2024-02-02QLOG: ConfigurationHugo Landau
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22037)
2024-02-01Add atexit configuration option to using atexit() in libcrypto at build-time.Randall S. Becker
This fixes an issue with a mix of atexit() usage in DLL and statically linked libcrypto that came out in the test suite on NonStop, which has slightly different DLL unload processing semantics compared to Linux. The change allows a build configuration to select whether to register OPENSSL_cleanup() with atexit() or not, so avoid situations where atexit() registration causes SIGSEGV. INSTALL.md and CHANGES.md have been modified to include and describe this option. The no-atexit option has been added to .github/workflows/run-checker-daily.yml. Fixes: #23135 Signed-of-by: Randall S. Becker <randall.becker@nexbridge.ca> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/23394)
2024-01-08Fail the Configure script with no ConfigurationsWill Sackfield
* Print a message about why the failure is happening. * Send the usage information. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22855)
2023-12-07Configure: Refuse to make directories in the source treeRichard Levitte
Fixes #22907 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/22908)
2023-11-15Configure: do not check for an absolute prefix in cross-buildsViktor Szakats
The check is always made according to the host platform's rules, which may not be true for true when the target platform is different, e.g. when cross-building for Windows on a Linux machine. So skip this check when used together with the `--cross-compile-prefix=` option. Fixes https://github.com/openssl/openssl/issues/9520 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22723)
2023-09-07Copyright year updatesMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2023-08-25ch_init(): Add braces to appease older clang compilersTomas Mraz
They produce a warning `suggest braces around initialization of subobject` otherwise. Add -Wno-missing-braces to silence old clang compilers And drop unnecessary braces in zeroing initializers. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21823)
2023-08-24Optimize SM2 on aarch64Xu Yizhou
Signed-off-by: Xu Yizhou <xuyizhou1@huawei.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20754)
2023-07-17no-module should not imply disabling DSO loading supportTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21459)
2023-07-06Disable QUIC if TLSv1.3 is disabledMatt Caswell
QUIC depends on TLSv1.3, so if the latter is disabled then we must do the same for QUIC. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21332)
2023-07-06Enable QUIC by defaultMatt Caswell
Ensure builds enable QUIC without explicitly having to ask for it. To disable QUIC pass "no-quic" to Configure. As a result we can remove all use of "enable-quic" from the various CI runs. We also add a CHANGES and NEWS entry for QUIC support. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21332)
2023-06-28add no-docs optionVladimír Kotal
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21240)
2023-06-23Allow to disable apps building with no-appsVladimír Kotal
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21212)
2023-06-14configure: introduce no-ecx to remove ECX related featureYi Li
This can effectively reduce the binary size for platforms that don't need ECX feature(~100KB). Signed-off-by: Yi Li <yi1.li@intel.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20781)
2023-06-08build.info: Introduce special syntax for dependencies on script modulesRichard Levitte
The DEPEND statement, when applied on files generated with GENERATE, may be used to specify script modules that the template to be generated from depends on. In short, this sort of depend: DEPEND[generated]=util/perl/OpenSSL/something.pm ... would generate a perl run that has the inclusion directory 'util/perl/OpenSSL' and 'something' as the module to be loaded. However, the package name for this module is 'OpenSSL::something', so to load it the way it's expected, the inclusion directory should be 'util/perl', and the module to be loaded should be specified as 'OpenSSL/something' (to be massaged into a proper module name by the build file template). To allow this, we introduce a file syntax, where a single '|' is used as a directory separator, to delineate what part should be used as the inclustion directory, and which part the module name to be loaded should be derived from: DEPEND[generated]=util/perl|OpenSSL/something.pm Fixes #21112 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21117)
2023-06-06allow to disable httpVladimír Kotal
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21108)
2023-04-25Added ability to pass additional ASFLAGS to ConfigureMathias Berchtold
This allows additional command line options to be passed to the assembler. For example: Configure VC-WIN64A ASFLAGS=--reproducible Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20813)
2023-03-20Fix Configure test for -mips in CFLAGSMike Gilbert
We want to add -mips2 or -mips3 only if the user hasn't already specified a mips version in CFLAGS. The existing test was a double-negative. CLA: trivial Fixes: https://github.com/openssl/openssl/issues/20214 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20273)
2023-03-17providers: add Argon2 KDFČestmír Kalina
https://datatracker.ietf.org/doc/rfc9106/ Signed-off-by: Čestmír Kalina <ckalina@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12256)
2023-02-01Use $config{build_file} instead of $target{build_file}Richard Levitte
If the user specifies an alternative build file than the default, this alternative is recorded in $config{build_file}, not $target{build_file}. Therefore, the former should be used, leaving the latter as a mere default. This is a bug. While fixing it, document it better too. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20173)
2023-01-13QUIC: Dummy Handshake Layer for PrototypingHugo Landau
This disables -Wtype-limits / -Wtautological-constant-out-of-range-compare. Since it generates warnings for valid and reasonable code, IMO this actually encourages people to write worse code. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19703)
2022-10-18Convert ZLIB defines to OPENSSL_NO_ZLIBTodd Short
Use the normal OPENSSL_NO_ prefix to enable/disable ZLIB Make `BIO_f_zlib()` always available. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18186)
2022-10-18Add ZSTD compression support (RFC8478bis)Todd Short
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18186)
2022-10-18Add brotli compression support (RFC7924)Todd Short
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18186)
2022-10-17crypto: add preemptive threading supportČestmír Kalina
Some primitives are designed to be used in a multi-threaded environment, if supported, e.g., Argon2. This patch adds support for preemptive threading and basic synchronization primitives for platforms compliant with POSIX threads or Windows CRT. Native functions are wrapped to provide a common (internal) API. Threading support can be disabled at compile time. If enabled, threading is disabled by default and needs to be explicitly enabled by the user. Thread enablement requires an explicit limit on the number of threads that OpenSSL may spawn (non-negative integer/infinity). The limit may be changed. Signed-off-by: Čestmír Kalina <ckalina@redhat.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12255)
2022-10-17Configure: add thread-pool and default-thread-poolČestmír Kalina
Signed-off-by: Čestmír Kalina <ckalina@redhat.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12255)
2022-09-19Fix detection of ktls support in cross-compile environment on LinuxTomas Mraz
Fixes #19212 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19213)
2022-09-14Add support for loading root CAs from Windows crypto APIHugo Landau
Fixes #18020. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18070)
2022-08-23Always automatically add -DPEDANTIC with enable-ubsanTomas Mraz
To avoid reports like: #19028 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19029)
2022-07-24Don't try to make configuration leanerRichard Levitte
This partially reverts Github PR #16378: commit 764cf5b26306a8712e8b3d41599c44dc5ed07a25, titled "Configuration: only produce a new configdata.pm if it has changed contents" Unfortunately, the attempt to make configuration leaner didn't take into account all the files that may or may not affect the outcome of `configdata.pm`, and most of all, didn't take into account that `Makefile` has clauses of its own to determined when a reconfiguration is needed, all based on time stamps. Something as simple as a changed `Configurations/10-main.conf`, where the change doesn't affect the resulting `configdata.pm` gets `make` into a reconfiguration loop, because `configdata.pm` is older than `10-main.conf`. The lesson to remember is not to try to outsmart `make` in cases like this. We retain the other parts of the PR mentioned, as they are still valid. needed to be taken into account (all the Configurations/*.conf as well as all the build.info) Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/18832)
2022-06-03Configure: Add disablable for QUIC, disabled by defaultTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18307)
2022-05-22Building: For the FIPS module checksum, keep track of configuration,hRichard Levitte
The FIPS module checksum needs to know that configuration.h is generated from configuration.h.in, so that information is conserved. To make this possible, it's now possible to have attributes with the GENERATE keyword, and the attribute "skip" is added to make a keyword a no-op, which makes it informative only. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/16378)
2022-05-22Configuration: produce include/openssl/configuration.h when configuringRichard Levitte
The goal is to avoid having too much of the OpenSSL source rebuilt because include/openssl/configuration.h, or even because it was a Makefile target that was called upon (some make implementations consider the use of a target as an update of that target, even if it wasn't really updated). To resolve this, we move the production of include/openssl/configuration.h to configdata.pm, and only update it if there were any actual changes. Fixes #16377 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/16378)
2022-05-22Configuration: only produce a new configdata.pm if it has changed contentsRichard Levitte
The goal is to avoid having too much of the OpenSSL source rebuilt because configdata.pm got a new time stamp. The conditions for updating configdata.pm are now: 1. its time stamp is older than Configure's, or... 2. its contents has changed. Fixes #16377 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/16378)
2022-05-03Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2022-03-22Configure: don't try to be clever when configuring afalgengRoss Burton
If the afalgeng is enabled then Configure tries to be clever but fails, by only actually building afalgeng if it isn't being cross-compiled and if the current kernel is 4.1+. This means that everyone cross compiling, or whose builder machines are running older kernels (not uncommon for build farms), can't enable afalgeng. Instead remove the cleverness and simply enable/disable as requested. Fixes #7687 CLA: trivial Signed-off-by: Ross Burton <ross.burton@arm.com> Change-Id: I023b6cb535d5b5811823d4814fa939de3f304886 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7688)
2022-03-10Add TFO support to socket BIO and s_client/s_serverTodd Short
Supports Linux, MacOS and FreeBSD Disabled by default, enabled via `enabled-tfo` Some tests Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8692)
2022-01-05Fix typosDimitris Apostolou
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17392)
2021-12-23Fix Configure variable spillAlexandros Roussos
* Evaluating code-refs in Configure can sometimes set the default variable `$_` * Prevent spillage influencing the target property by using named variable in loop CLA: trivial Fixes gh-17321 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17322)
2021-12-09Add support for BSD-ppc, BSD-ppc64 and BSD-ppc64le configurationspkubaj
OpenSSL assumes AT_HWCAP = 16 (as on Linux), but on FreeBSD AT_HWCAP = 25 Switch to using AT_HWCAP, and setting it to 16 if it is not defined. CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17090)
2021-08-20Replace CONFIG_NOWAIT env var with -w optionRich Salz
And document the -w option Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16325)
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-21 10:07:27 +0000