From fcf6c877881626ee2ac94fc77051c79e3f7ae7ce Mon Sep 17 00:00:00 2001 From: Jonas 'Sortie' Termansen Date: Sun, 3 Oct 2021 13:33:16 +0200 Subject: [PATCH 0001/1283] Support operating systems without some non-POSIX headers The arpa/nameser.h, netinet/ip.h, and resolv.h headers are not crucial to building LibreSSL. The netinet/ip.h header is used in nc(1) for optional IPTOS_ features that can be ifdef'd on systems without support. The endian.h header is the upcoming standard header and should be used whenever available and correct. The machine/endian.h header is non-standard and doesn't have to exist on POSIX systems. Fix the check for getpagesize(3) not forward declaring the function, such that CFLAGS with -Werror=implicit-function-declaration doesn't cause the check to fail. --- include/compat/arpa/nameser.h | 2 ++ include/compat/machine/endian.h | 2 +- include/compat/netinet/ip.h | 2 ++ include/compat/resolv.h | 2 +- m4/check-libc.m4 | 6 ++---- 5 files changed, 8 insertions(+), 6 deletions(-) diff --git a/include/compat/arpa/nameser.h b/include/compat/arpa/nameser.h index 0126a604a5..eff3b0d90b 100644 --- a/include/compat/arpa/nameser.h +++ b/include/compat/arpa/nameser.h @@ -4,7 +4,9 @@ */ #ifndef _WIN32 +#ifdef HAVE_ARPA_NAMESER_H #include_next +#endif #else #include diff --git a/include/compat/machine/endian.h b/include/compat/machine/endian.h index 4dcb60d37a..bb22f5b208 100644 --- a/include/compat/machine/endian.h +++ b/include/compat/machine/endian.h @@ -21,7 +21,7 @@ #define BYTE_ORDER BIG_ENDIAN #endif -#elif defined(__linux__) || defined(__midipix__) +#elif defined(HAVE_ENDIAN_H) #include #elif defined(__sun) || defined(_AIX) || defined(__hpux) diff --git a/include/compat/netinet/ip.h b/include/compat/netinet/ip.h index 6019f7dcd1..29f17f3f74 100644 --- a/include/compat/netinet/ip.h +++ b/include/compat/netinet/ip.h @@ -8,7 +8,9 @@ #endif #ifndef _WIN32 +#ifdef HAVE_NETINET_IP_H #include_next +#endif #else #include #endif diff --git a/include/compat/resolv.h b/include/compat/resolv.h index 42dec07b64..b8044605c1 100644 --- a/include/compat/resolv.h +++ b/include/compat/resolv.h @@ -12,7 +12,7 @@ #else #include <../include/resolv.h> #endif -#else +#elif defined(HAVE_RESOLV_H) #include_next #endif diff --git a/m4/check-libc.m4 b/m4/check-libc.m4 index e511f6d0db..cca97c3fe9 100644 --- a/m4/check-libc.m4 +++ b/m4/check-libc.m4 @@ -1,6 +1,7 @@ AC_DEFUN([CHECK_LIBC_COMPAT], [ # Check for libc headers AC_CHECK_HEADERS([err.h readpassphrase.h]) +AC_CHECK_HEADERS([arpa/nameser.h endian.h netinet/ip.h resolv.h]) # Check for general libc functions AC_CHECK_FUNCS([asprintf freezero memmem]) AC_CHECK_FUNCS([readpassphrase reallocarray recallocarray]) @@ -9,10 +10,7 @@ AC_CHECK_FUNCS([timegm _mkgmtime timespecsub]) AC_CHECK_FUNCS([getprogname syslog syslog_r]) AC_CACHE_CHECK([for getpagesize], ac_cv_func_getpagesize, [ AC_LINK_IFELSE([AC_LANG_PROGRAM([[ -// Since Android NDK v16 getpagesize is defined as inline inside unistd.h -#ifdef __ANDROID__ -# include -#endif +#include ]], [[ getpagesize(); ]])], From 6318b4ec48582ac85aaf12bc3ad5b82dbbc989d3 Mon Sep 17 00:00:00 2001 From: Cameron Lowell Palmer Date: Fri, 15 Oct 2021 09:29:03 +0200 Subject: [PATCH 0002/1283] Add the option to support an Apple-style xcframework for tls, ssl, and crypto --- CMakeLists.txt | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index f1616532b3..bba29bfa35 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -352,6 +352,19 @@ if(LIBRESSL_APPS AND LIBRESSL_TESTS) add_subdirectory(tests) endif() +if (BUILD_APPLE_XCFRAMEWORK) + # Create the super library from object libraries + add_library(LibreSSL_xcframework + $ $ $) + set_target_properties(LibreSSL_xcframework PROPERTIES + OUTPUT_NAME ressl) + + if(ENABLE_LIBRESSL_INSTALL) + install(TARGETS LibreSSL_xcframework + LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}) + endif(ENABLE_LIBRESSL_INSTALL) +endif(BUILD_APPLE_XCFRAMEWORK) + if(NOT MSVC) # Create pkgconfig files. set(prefix ${CMAKE_INSTALL_PREFIX}) From 2d853ecfc3f56954ed8f2dfb2065d90dfb84d95e Mon Sep 17 00:00:00 2001 From: Tobias Heider Date: Sat, 6 Nov 2021 23:31:26 +0100 Subject: [PATCH 0003/1283] Don't install pkgconfig if ENABLE_LIBRESSL_INSTALL is disabled. --- CMakeLists.txt | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index f1616532b3..84c2a56c67 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -352,25 +352,27 @@ if(LIBRESSL_APPS AND LIBRESSL_TESTS) add_subdirectory(tests) endif() -if(NOT MSVC) - # Create pkgconfig files. - set(prefix ${CMAKE_INSTALL_PREFIX}) - set(exec_prefix \${prefix}) - set(libdir \${exec_prefix}/${CMAKE_INSTALL_LIBDIR}) - set(includedir \${prefix}/include) - if(PLATFORM_LIBS) - string(REGEX REPLACE ";" " -l" PLATFORM_LDADD ";${PLATFORM_LIBS}") +if(ENABLE_LIBRESSL_INSTALL) + if(NOT MSVC) + # Create pkgconfig files. + set(prefix ${CMAKE_INSTALL_PREFIX}) + set(exec_prefix \${prefix}) + set(libdir \${exec_prefix}/${CMAKE_INSTALL_LIBDIR}) + set(includedir \${prefix}/include) + if(PLATFORM_LIBS) + string(REGEX REPLACE ";" " -l" PLATFORM_LDADD ";${PLATFORM_LIBS}") + endif() + file(STRINGS "VERSION" VERSION LIMIT_COUNT 1) + file(GLOB OPENSSL_PKGCONFIGS "*.pc.in") + foreach(file ${OPENSSL_PKGCONFIGS}) + get_filename_component(filename ${file} NAME) + string(REPLACE ".in" "" new_file "${filename}") + configure_file(${filename} pkgconfig/${new_file} @ONLY) + endforeach() + install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/pkgconfig + DESTINATION ${CMAKE_INSTALL_LIBDIR}) endif() - file(STRINGS "VERSION" VERSION LIMIT_COUNT 1) - file(GLOB OPENSSL_PKGCONFIGS "*.pc.in") - foreach(file ${OPENSSL_PKGCONFIGS}) - get_filename_component(filename ${file} NAME) - string(REPLACE ".in" "" new_file "${filename}") - configure_file(${filename} pkgconfig/${new_file} @ONLY) - endforeach() - install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/pkgconfig - DESTINATION ${CMAKE_INSTALL_LIBDIR}) -endif() +endif(ENABLE_LIBRESSL_INSTALL) if(NOT "${OPENSSLDIR}" STREQUAL "") set(CONF_DIR "${OPENSSLDIR}") From 04ab1061f305d11ba292668e7405dd73008a2c1e Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 8 Nov 2021 07:33:50 -0600 Subject: [PATCH 0004/1283] build updates --- crypto/CMakeLists.txt | 6 ++++++ crypto/Makefile.am | 1 + ssl/CMakeLists.txt | 2 +- ssl/Makefile.am | 3 ++- tests/CMakeLists.txt | 3 +-- tests/Makefile.am | 3 +-- 6 files changed, 12 insertions(+), 6 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index b1ded85bdb..b01afa91bd 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -1,3 +1,5 @@ +add_definitions(-DLIBRESSL_CRYPTO_INTERNAL) + if(HOST_ASM_ELF_ARMV4) set( ASM_ARMV4_ELF_SRC @@ -726,9 +728,11 @@ set( x509/pcy_map.c x509/pcy_node.c x509/pcy_tree.c + x509/x509_addr.c x509/x509_akey.c x509/x509_akeya.c x509/x509_alt.c + x509/x509_asid.c x509/x509_att.c x509/x509_bcons.c x509/x509_bitst.c @@ -982,6 +986,7 @@ target_include_directories(crypto_obj ecdsa evp modes + x509 ../include/compat PUBLIC ../include) @@ -998,6 +1003,7 @@ target_include_directories(crypto ecdsa evp modes + x509 ../include/compat PUBLIC ../include) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 4030eaebe2..35148e38f2 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -7,6 +7,7 @@ AM_CPPFLAGS += -I$(top_srcdir)/crypto/ecdh AM_CPPFLAGS += -I$(top_srcdir)/crypto/ecdsa AM_CPPFLAGS += -I$(top_srcdir)/crypto/evp AM_CPPFLAGS += -I$(top_srcdir)/crypto/modes +AM_CPPFLAGS += -I$(top_srcdir)/crypto/x509 AM_CPPFLAGS += -I$(top_srcdir)/crypto noinst_LTLIBRARIES = libcompat.la diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index a772d12294..a8e0a25917 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -36,11 +36,11 @@ set( ssl_versions.c t1_enc.c t1_lib.c + tls_buffer.c tls_content.c tls12_key_schedule.c tls12_lib.c tls12_record_layer.c - tls13_buffer.c tls13_client.c tls13_error.c tls13_handshake.c diff --git a/ssl/Makefile.am b/ssl/Makefile.am index f266122057..d12928e444 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -58,11 +58,11 @@ libssl_la_SOURCES += ssl_txt.c libssl_la_SOURCES += ssl_versions.c libssl_la_SOURCES += t1_enc.c libssl_la_SOURCES += t1_lib.c +libssl_la_SOURCES += tls_buffer.c libssl_la_SOURCES += tls_content.c libssl_la_SOURCES += tls12_key_schedule.c libssl_la_SOURCES += tls12_lib.c libssl_la_SOURCES += tls12_record_layer.c -libssl_la_SOURCES += tls13_buffer.c libssl_la_SOURCES += tls13_client.c libssl_la_SOURCES += tls13_error.c libssl_la_SOURCES += tls13_handshake.c @@ -82,6 +82,7 @@ noinst_HEADERS += ssl_locl.h noinst_HEADERS += ssl_sigalgs.h noinst_HEADERS += ssl_tlsext.h noinst_HEADERS += tls_content.h +noinst_HEADERS += tls_internal.h noinst_HEADERS += tls13_internal.h noinst_HEADERS += tls13_handshake.h noinst_HEADERS += tls13_record.h diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index efe5126076..f0df7b00fe 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -4,7 +4,6 @@ include_directories( ../crypto/asn1 ../crypto/x509 ../ssl - ../tls ../apps/openssl ../apps/openssl/compat ../include/compat @@ -284,6 +283,7 @@ if(NOT BUILD_SHARED_LIBS) add_executable(keypairtest keypairtest.c) target_link_libraries(keypairtest ${LIBTLS_LIBS}) + target_include_directories(keypairtest BEFORE PUBLIC ../tls) add_test(keypairtest keypairtest ${CMAKE_CURRENT_SOURCE_DIR}/ca.pem ${CMAKE_CURRENT_SOURCE_DIR}/server.pem @@ -595,4 +595,3 @@ if(BUILD_SHARED_LIBS) "${CMAKE_CURRENT_BINARY_DIR}" COMMENT "Copying DLLs for regression tests") endif() - diff --git a/tests/Makefile.am b/tests/Makefile.am index f43bd8580c..f1086b3d13 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -4,7 +4,6 @@ AM_CPPFLAGS += -I $(top_srcdir)/crypto/modes AM_CPPFLAGS += -I $(top_srcdir)/crypto/asn1 AM_CPPFLAGS += -I $(top_srcdir)/crypto/x509 AM_CPPFLAGS += -I $(top_srcdir)/ssl -AM_CPPFLAGS += -I $(top_srcdir)/tls AM_CPPFLAGS += -I $(top_srcdir)/apps/openssl AM_CPPFLAGS += -I $(top_srcdir)/apps/openssl/compat AM_CPPFLAGS += -D_PATH_SSL_CA_FILE=\"$(top_srcdir)/apps/openssl/cert.pem\" @@ -101,7 +100,6 @@ bn_to_string_SOURCES = bn_to_string.c # buffertest TESTS += buffertest -buffertest_CPPFLAGS = $(AM_CPPFLAGS) check_PROGRAMS += buffertest buffertest_SOURCES = buffertest.c @@ -272,6 +270,7 @@ igetest_SOURCES = igetest.c # keypairtest TESTS += keypairtest.sh +keypairtest_CPPFLAGS = -I $(top_srcdir)/tls check_PROGRAMS += keypairtest keypairtest_SOURCES = keypairtest.c EXTRA_DIST += keypairtest.sh From 642e2ab1837c371015a8b945b4b0d054de8eb481 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 8 Nov 2021 07:35:00 -0600 Subject: [PATCH 0005/1283] update man links --- man/links | 98 +++++++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 91 insertions(+), 7 deletions(-) diff --git a/man/links b/man/links index 44f6a59b38..7c5225e65f 100644 --- a/man/links +++ b/man/links @@ -26,6 +26,7 @@ ASN1_STRING_length.3,ASN1_STRING_dup.3 ASN1_STRING_length.3,ASN1_STRING_get0_data.3 ASN1_STRING_length.3,ASN1_STRING_length_set.3 ASN1_STRING_length.3,ASN1_STRING_set.3 +ASN1_STRING_length.3,ASN1_STRING_set0.3 ASN1_STRING_length.3,ASN1_STRING_to_UTF8.3 ASN1_STRING_length.3,ASN1_STRING_type.3 ASN1_STRING_new.3,ASN1_BIT_STRING_free.3 @@ -101,6 +102,12 @@ ASN1_item_d2i.3,ASN1_item_print.3 ASN1_item_d2i.3,d2i_ASN1_TYPE.3 ASN1_item_d2i.3,i2d_ASN1_TYPE.3 ASN1_item_new.3,ASN1_item_free.3 +ASN1_item_sign.3,ASN1_item_sign_ctx.3 +ASN1_mbstring_copy.3,ASN1_STRING_get_default_mask.3 +ASN1_mbstring_copy.3,ASN1_STRING_set_by_NID.3 +ASN1_mbstring_copy.3,ASN1_STRING_set_default_mask.3 +ASN1_mbstring_copy.3,ASN1_STRING_set_default_mask_asc.3 +ASN1_mbstring_copy.3,ASN1_mbstring_ncopy.3 ASN1_parse_dump.3,ASN1_parse.3 ASN1_put_object.3,ASN1_put_eoc.3 ASN1_time_parse.3,ASN1_TIME_set_tm.3 @@ -944,6 +951,7 @@ EVP_EncryptInit.3,EVP_rc2_ecb.3 EVP_EncryptInit.3,EVP_rc2_ofb.3 EVP_OpenInit.3,EVP_OpenFinal.3 EVP_OpenInit.3,EVP_OpenUpdate.3 +EVP_PKCS82PKEY.3,EVP_PKEY2PKCS8.3 EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_ctrl_str.3 EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_get0_ecdh_kdf_ukm.3 EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_get1_id.3 @@ -968,6 +976,14 @@ EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_set_signature_md.3 EVP_PKEY_CTX_new.3,EVP_PKEY_CTX_dup.3 EVP_PKEY_CTX_new.3,EVP_PKEY_CTX_free.3 EVP_PKEY_CTX_new.3,EVP_PKEY_CTX_new_id.3 +EVP_PKEY_add1_attr.3,EVP_PKEY_add1_attr_by_NID.3 +EVP_PKEY_add1_attr.3,EVP_PKEY_add1_attr_by_OBJ.3 +EVP_PKEY_add1_attr.3,EVP_PKEY_add1_attr_by_txt.3 +EVP_PKEY_add1_attr.3,EVP_PKEY_delete_attr.3 +EVP_PKEY_add1_attr.3,EVP_PKEY_get_attr.3 +EVP_PKEY_add1_attr.3,EVP_PKEY_get_attr_by_NID.3 +EVP_PKEY_add1_attr.3,EVP_PKEY_get_attr_by_OBJ.3 +EVP_PKEY_add1_attr.3,EVP_PKEY_get_attr_count.3 EVP_PKEY_asn1_get_count.3,EVP_PKEY_asn1_find.3 EVP_PKEY_asn1_get_count.3,EVP_PKEY_asn1_find_str.3 EVP_PKEY_asn1_get_count.3,EVP_PKEY_asn1_get0.3 @@ -1429,6 +1445,9 @@ PKCS7_set_content.3,PKCS7_content_new.3 PKCS7_set_type.3,PKCS7_set0_type_other.3 PKCS7_verify.3,PKCS7_get0_signers.3 PKCS8_PRIV_KEY_INFO_new.3,PKCS8_PRIV_KEY_INFO_free.3 +PKCS8_pkey_set0.3,PKCS8_pkey_add1_attr_by_NID.3 +PKCS8_pkey_set0.3,PKCS8_pkey_get0.3 +PKCS8_pkey_set0.3,PKCS8_pkey_get0_attrs.3 PKEY_USAGE_PERIOD_new.3,PKEY_USAGE_PERIOD_free.3 POLICYINFO_new.3,CERTIFICATEPOLICIES_free.3 POLICYINFO_new.3,CERTIFICATEPOLICIES_new.3 @@ -1678,6 +1697,8 @@ SSL_CTX_set_generate_session_id.3,SSL_set_generate_session_id.3 SSL_CTX_set_info_callback.3,SSL_CTX_get_info_callback.3 SSL_CTX_set_info_callback.3,SSL_get_info_callback.3 SSL_CTX_set_info_callback.3,SSL_set_info_callback.3 +SSL_CTX_set_keylog_callback.3,SSL_CTX_get_keylog_callback.3 +SSL_CTX_set_keylog_callback.3,SSL_CTX_keylog_cb_func.3 SSL_CTX_set_max_cert_list.3,SSL_CTX_get_max_cert_list.3 SSL_CTX_set_max_cert_list.3,SSL_get_max_cert_list.3 SSL_CTX_set_max_cert_list.3,SSL_set_max_cert_list.3 @@ -1696,6 +1717,9 @@ SSL_CTX_set_mode.3,SSL_set_mode.3 SSL_CTX_set_msg_callback.3,SSL_CTX_set_msg_callback_arg.3 SSL_CTX_set_msg_callback.3,SSL_set_msg_callback.3 SSL_CTX_set_msg_callback.3,SSL_set_msg_callback_arg.3 +SSL_CTX_set_num_tickets.3,SSL_CTX_get_num_tickets.3 +SSL_CTX_set_num_tickets.3,SSL_get_num_tickets.3 +SSL_CTX_set_num_tickets.3,SSL_set_num_tickets.3 SSL_CTX_set_options.3,SSL_CTX_clear_options.3 SSL_CTX_set_options.3,SSL_CTX_get_options.3 SSL_CTX_set_options.3,SSL_clear_options.3 @@ -1816,6 +1840,8 @@ SSL_new.3,SSL_up_ref.3 SSL_num_renegotiations.3,SSL_clear_num_renegotiations.3 SSL_num_renegotiations.3,SSL_total_renegotiations.3 SSL_read.3,SSL_peek.3 +SSL_read.3,SSL_peek_ex.3 +SSL_read.3,SSL_read_ex.3 SSL_read_early_data.3,SSL_CTX_get_max_early_data.3 SSL_read_early_data.3,SSL_CTX_set_max_early_data.3 SSL_read_early_data.3,SSL_SESSION_get_max_early_data.3 @@ -1837,6 +1863,7 @@ SSL_set_connect_state.3,SSL_set_accept_state.3 SSL_set_fd.3,SSL_set_rfd.3 SSL_set_fd.3,SSL_set_wfd.3 SSL_set_max_send_fragment.3,SSL_CTX_set_max_send_fragment.3 +SSL_set_psk_use_session_callback.3,SSL_psk_use_session_cb_func.3 SSL_set_shutdown.3,SSL_get_shutdown.3 SSL_set_tmp_ecdh.3,SSL_CTX_set_ecdh_auto.3 SSL_set_tmp_ecdh.3,SSL_CTX_set_tmp_ecdh.3 @@ -1848,6 +1875,7 @@ SSL_want.3,SSL_want_nothing.3 SSL_want.3,SSL_want_read.3 SSL_want.3,SSL_want_write.3 SSL_want.3,SSL_want_x509_lookup.3 +SSL_write.3,SSL_write_ex.3 SXNET_new.3,SXNETID_free.3 SXNET_new.3,SXNETID_new.3 SXNET_new.3,SXNET_free.3 @@ -1930,12 +1958,25 @@ X509_ALGOR_dup.3,X509_ALGOR_get0.3 X509_ALGOR_dup.3,X509_ALGOR_new.3 X509_ALGOR_dup.3,X509_ALGOR_set0.3 X509_ALGOR_dup.3,X509_ALGOR_set_md.3 +X509_ATTRIBUTE_get0_object.3,X509_ATTRIBUTE_count.3 +X509_ATTRIBUTE_get0_object.3,X509_ATTRIBUTE_get0_data.3 +X509_ATTRIBUTE_get0_object.3,X509_ATTRIBUTE_get0_type.3 +X509_ATTRIBUTE_new.3,X509_ATTRIBUTE_create.3 +X509_ATTRIBUTE_new.3,X509_ATTRIBUTE_dup.3 X509_ATTRIBUTE_new.3,X509_ATTRIBUTE_free.3 +X509_ATTRIBUTE_set1_object.3,X509_ATTRIBUTE_create_by_NID.3 +X509_ATTRIBUTE_set1_object.3,X509_ATTRIBUTE_create_by_OBJ.3 +X509_ATTRIBUTE_set1_object.3,X509_ATTRIBUTE_create_by_txt.3 +X509_ATTRIBUTE_set1_object.3,X509_ATTRIBUTE_set1_data.3 X509_CINF_new.3,X509_CERT_AUX_free.3 X509_CINF_new.3,X509_CERT_AUX_new.3 X509_CINF_new.3,X509_CINF_free.3 X509_CINF_new.3,X509_VAL_free.3 X509_CINF_new.3,X509_VAL_new.3 +X509_CRL_METHOD_new.3,X509_CRL_METHOD_free.3 +X509_CRL_METHOD_new.3,X509_CRL_get_meth_data.3 +X509_CRL_METHOD_new.3,X509_CRL_set_default_method.3 +X509_CRL_METHOD_new.3,X509_CRL_set_meth_data.3 X509_CRL_get0_by_serial.3,X509_CRL_add0_revoked.3 X509_CRL_get0_by_serial.3,X509_CRL_get0_by_cert.3 X509_CRL_get0_by_serial.3,X509_CRL_get_REVOKED.3 @@ -1948,6 +1989,7 @@ X509_CRL_new.3,X509_CRL_up_ref.3 X509_CRL_print.3,X509_CRL_print_fp.3 X509_EXTENSION_set_object.3,X509_EXTENSION_create_by_NID.3 X509_EXTENSION_set_object.3,X509_EXTENSION_create_by_OBJ.3 +X509_EXTENSION_set_object.3,X509_EXTENSION_dup.3 X509_EXTENSION_set_object.3,X509_EXTENSION_free.3 X509_EXTENSION_set_object.3,X509_EXTENSION_get_critical.3 X509_EXTENSION_set_object.3,X509_EXTENSION_get_data.3 @@ -2010,6 +2052,7 @@ X509_OBJECT_get0_X509.3,X509_OBJECT_idx_by_subject.3 X509_OBJECT_get0_X509.3,X509_OBJECT_retrieve_by_subject.3 X509_OBJECT_get0_X509.3,X509_OBJECT_retrieve_match.3 X509_OBJECT_get0_X509.3,X509_OBJECT_up_ref_count.3 +X509_PKEY_new.3,X509_PKEY_free.3 X509_PUBKEY_new.3,X509_PUBKEY_free.3 X509_PUBKEY_new.3,X509_PUBKEY_get.3 X509_PUBKEY_new.3,X509_PUBKEY_get0.3 @@ -2019,9 +2062,11 @@ X509_PUBKEY_new.3,X509_PUBKEY_set0_param.3 X509_PUBKEY_new.3,d2i_PUBKEY.3 X509_PUBKEY_new.3,d2i_PUBKEY_bio.3 X509_PUBKEY_new.3,d2i_PUBKEY_fp.3 +X509_PUBKEY_new.3,d2i_X509_PUBKEY.3 X509_PUBKEY_new.3,i2d_PUBKEY.3 X509_PUBKEY_new.3,i2d_PUBKEY_bio.3 X509_PUBKEY_new.3,i2d_PUBKEY_fp.3 +X509_PUBKEY_new.3,i2d_X509_PUBKEY.3 X509_PURPOSE_set.3,X509_PURPOSE_add.3 X509_PURPOSE_set.3,X509_PURPOSE_cleanup.3 X509_PURPOSE_set.3,X509_PURPOSE_get0.3 @@ -2032,15 +2077,33 @@ X509_PURPOSE_set.3,X509_PURPOSE_get_by_sname.3 X509_PURPOSE_set.3,X509_PURPOSE_get_count.3 X509_PURPOSE_set.3,X509_PURPOSE_get_id.3 X509_PURPOSE_set.3,X509_PURPOSE_get_trust.3 +X509_REQ_add1_attr.3,X509_REQ_add1_attr_by_NID.3 +X509_REQ_add1_attr.3,X509_REQ_add1_attr_by_OBJ.3 +X509_REQ_add1_attr.3,X509_REQ_add1_attr_by_txt.3 +X509_REQ_add1_attr.3,X509_REQ_delete_attr.3 +X509_REQ_add1_attr.3,X509_REQ_get_attr.3 +X509_REQ_add1_attr.3,X509_REQ_get_attr_by_NID.3 +X509_REQ_add1_attr.3,X509_REQ_get_attr_by_OBJ.3 +X509_REQ_add1_attr.3,X509_REQ_get_attr_count.3 +X509_REQ_add_extensions.3,X509_REQ_add_extensions_nid.3 +X509_REQ_add_extensions.3,X509_REQ_extension_nid.3 +X509_REQ_add_extensions.3,X509_REQ_get_extension_nids.3 +X509_REQ_add_extensions.3,X509_REQ_get_extensions.3 +X509_REQ_add_extensions.3,X509_REQ_set_extension_nids.3 X509_REQ_new.3,X509_REQ_INFO_free.3 X509_REQ_new.3,X509_REQ_INFO_new.3 +X509_REQ_new.3,X509_REQ_dup.3 X509_REQ_new.3,X509_REQ_free.3 +X509_REQ_new.3,X509_to_X509_REQ.3 +X509_REQ_print_ex.3,X509_REQ_print.3 +X509_REQ_print_ex.3,X509_REQ_print_fp.3 X509_REVOKED_new.3,X509_REVOKED_dup.3 X509_REVOKED_new.3,X509_REVOKED_free.3 X509_REVOKED_new.3,X509_REVOKED_get0_revocationDate.3 X509_REVOKED_new.3,X509_REVOKED_get0_serialNumber.3 X509_REVOKED_new.3,X509_REVOKED_set_revocationDate.3 X509_REVOKED_new.3,X509_REVOKED_set_serialNumber.3 +X509_SIG_get0.3,X509_SIG_getm.3 X509_SIG_new.3,X509_SIG_free.3 X509_STORE_CTX_get_error.3,X509_STORE_CTX_get0_chain.3 X509_STORE_CTX_get_error.3,X509_STORE_CTX_get0_current_crl.3 @@ -2107,19 +2170,21 @@ X509_TRUST_set.3,X509_TRUST_get_by_id.3 X509_TRUST_set.3,X509_TRUST_get_count.3 X509_TRUST_set.3,X509_TRUST_get_flags.3 X509_TRUST_set.3,X509_TRUST_get_trust.3 +X509_VERIFY_PARAM_new.3,X509_VERIFY_PARAM_add0_table.3 +X509_VERIFY_PARAM_new.3,X509_VERIFY_PARAM_free.3 +X509_VERIFY_PARAM_new.3,X509_VERIFY_PARAM_get0.3 +X509_VERIFY_PARAM_new.3,X509_VERIFY_PARAM_get_count.3 +X509_VERIFY_PARAM_new.3,X509_VERIFY_PARAM_inherit.3 +X509_VERIFY_PARAM_new.3,X509_VERIFY_PARAM_lookup.3 +X509_VERIFY_PARAM_new.3,X509_VERIFY_PARAM_set1.3 +X509_VERIFY_PARAM_new.3,X509_VERIFY_PARAM_table_cleanup.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_add0_policy.3 -X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_add0_table.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_add1_host.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_clear_flags.3 -X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_free.3 -X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get0.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get0_name.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get0_peername.3 -X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get_count.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get_depth.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get_flags.3 -X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_lookup.3 -X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_new.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set1_email.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set1_host.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set1_ip.3 @@ -2131,7 +2196,6 @@ X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set_hostflags.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set_purpose.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set_time.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set_trust.3 -X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_table_cleanup.3 X509_add1_trust_object.3,X509_add1_reject_object.3 X509_add1_trust_object.3,X509_reject_clear.3 X509_add1_trust_object.3,X509_trust_clear.3 @@ -2139,6 +2203,7 @@ X509_check_host.3,X509_check_email.3 X509_check_host.3,X509_check_ip.3 X509_check_host.3,X509_check_ip_asc.3 X509_check_private_key.3,X509_REQ_check_private_key.3 +X509_check_trust.3,X509_TRUST_set_default.3 X509_cmp.3,X509_CRL_cmp.3 X509_cmp.3,X509_CRL_match.3 X509_cmp.3,X509_NAME_cmp.3 @@ -2180,7 +2245,10 @@ X509_get0_signature.3,X509_get_signature_nid.3 X509_get0_signature.3,X509_get_signature_type.3 X509_get1_email.3,X509_email_free.3 X509_get1_email.3,X509_get1_ocsp.3 +X509_get_extension_flags.3,X509_get_extended_key_usage.3 +X509_get_extension_flags.3,X509_get_key_usage.3 X509_get_pubkey.3,X509_REQ_extract_key.3 +X509_get_pubkey.3,X509_REQ_get0_pubkey.3 X509_get_pubkey.3,X509_REQ_get_pubkey.3 X509_get_pubkey.3,X509_REQ_set_pubkey.3 X509_get_pubkey.3,X509_extract_key.3 @@ -2205,6 +2273,7 @@ X509_get_version.3,X509_set_version.3 X509_keyid_set1.3,X509_alias_get0.3 X509_keyid_set1.3,X509_alias_set1.3 X509_keyid_set1.3,X509_keyid_get0.3 +X509_new.3,X509_REQ_to_X509.3 X509_new.3,X509_chain_up_ref.3 X509_new.3,X509_dup.3 X509_new.3,X509_free.3 @@ -2229,6 +2298,14 @@ X509_sign.3,X509_REQ_verify.3 X509_sign.3,X509_sign_ctx.3 X509_sign.3,X509_verify.3 X509_signature_dump.3,X509_signature_print.3 +X509at_add1_attr.3,X509at_add1_attr_by_NID.3 +X509at_add1_attr.3,X509at_add1_attr_by_OBJ.3 +X509at_add1_attr.3,X509at_add1_attr_by_txt.3 +X509at_add1_attr.3,X509at_delete_attr.3 +X509at_get_attr.3,X509at_get0_data_by_OBJ.3 +X509at_get_attr.3,X509at_get_attr_by_NID.3 +X509at_get_attr.3,X509at_get_attr_by_OBJ.3 +X509at_get_attr.3,X509at_get_attr_count.3 X509v3_get_ext_by_NID.3,X509_CRL_add_ext.3 X509v3_get_ext_by_NID.3,X509_CRL_delete_ext.3 X509v3_get_ext_by_NID.3,X509_CRL_get_ext.3 @@ -2501,6 +2578,8 @@ d2i_PrivateKey.3,d2i_PublicKey.3 d2i_PrivateKey.3,i2d_PKCS8PrivateKeyInfo_bio.3 d2i_PrivateKey.3,i2d_PKCS8PrivateKeyInfo_fp.3 d2i_PrivateKey.3,i2d_PrivateKey.3 +d2i_PrivateKey.3,i2d_PrivateKey_bio.3 +d2i_PrivateKey.3,i2d_PrivateKey_fp.3 d2i_PrivateKey.3,i2d_PublicKey.3 d2i_RSAPublicKey.3,d2i_Netscape_RSA.3 d2i_RSAPublicKey.3,d2i_RSAPrivateKey.3 @@ -2564,7 +2643,12 @@ d2i_X509.3,i2d_X509_CINF.3 d2i_X509.3,i2d_X509_VAL.3 d2i_X509.3,i2d_X509_bio.3 d2i_X509.3,i2d_X509_fp.3 +d2i_X509.3,i2d_re_X509_CRL_tbs.3 +d2i_X509.3,i2d_re_X509_REQ_tbs.3 +d2i_X509.3,i2d_re_X509_tbs.3 +d2i_X509_ALGOR.3,d2i_X509_ALGORS.3 d2i_X509_ALGOR.3,i2d_X509_ALGOR.3 +d2i_X509_ALGOR.3,i2d_X509_ALGORS.3 d2i_X509_ATTRIBUTE.3,i2d_X509_ATTRIBUTE.3 d2i_X509_CRL.3,d2i_X509_CRL_INFO.3 d2i_X509_CRL.3,d2i_X509_CRL_bio.3 From 9243262fef25687500393b47acde3f8f42995de4 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 8 Nov 2021 07:43:11 -0600 Subject: [PATCH 0006/1283] add x509req_ext --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index f0df7b00fe..2cdd683308 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -586,6 +586,11 @@ add_executable(x509name x509name.c) target_link_libraries(x509name ${OPENSSL_LIBS}) add_test(x509name x509name) +# x509req_ext +add_executable(x509req_ext x509req_ext.c) +target_link_libraries(x509req_ext ${OPENSSL_LIBS}) +add_test(x509req_ext x509req_ext) + if(BUILD_SHARED_LIBS) add_custom_command(TARGET x25519test POST_BUILD COMMAND "${CMAKE_COMMAND}" -E copy diff --git a/tests/Makefile.am b/tests/Makefile.am index f1086b3d13..cfeb0aeb50 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -520,3 +520,8 @@ x509_info_SOURCES = x509_info.c TESTS += x509name check_PROGRAMS += x509name x509name_SOURCES = x509name.c + +# x509req_ext +TESTS += x509req_ext +check_PROGRAMS += x509req_ext +x509req_ext_SOURCES = x509req_ext.c From 69a50462c7772fc2af40dbc7c08107000f7ae231 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 8 Nov 2021 13:09:53 -0600 Subject: [PATCH 0007/1283] add o_fips --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index b01afa91bd..5733746484 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -233,6 +233,7 @@ set( malloc-wrapper.c mem_clr.c mem_dbg.c + o_fips.c o_init.c o_str.c o_time.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 35148e38f2..f2ef1512ed 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -265,6 +265,7 @@ libcrypto_la_SOURCES += ex_data.c libcrypto_la_SOURCES += malloc-wrapper.c libcrypto_la_SOURCES += mem_clr.c libcrypto_la_SOURCES += mem_dbg.c +libcrypto_la_SOURCES += o_fips.c libcrypto_la_SOURCES += o_init.c libcrypto_la_SOURCES += o_str.c libcrypto_la_SOURCES += o_time.c From aef899cf7c2203e8a82902164a2efe4f3db434b3 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 8 Nov 2021 13:29:50 -0600 Subject: [PATCH 0008/1283] prepend tls dir to AM_CPPFLAGS --- tests/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/Makefile.am b/tests/Makefile.am index cfeb0aeb50..b426ad0deb 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -270,7 +270,7 @@ igetest_SOURCES = igetest.c # keypairtest TESTS += keypairtest.sh -keypairtest_CPPFLAGS = -I $(top_srcdir)/tls +keypairtest_CPPFLAGS = -I $(top_srcdir)/tls $(AM_CPPFLAGS) check_PROGRAMS += keypairtest keypairtest_SOURCES = keypairtest.c EXTRA_DIST += keypairtest.sh From f69066726257d07257fce6c5f076bbf27f49b376 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 9 Nov 2021 22:34:58 -0600 Subject: [PATCH 0009/1283] Autoconf updates Move machine/endian.h to endian.h, use AC_HEADER_RESOLV over individual header checks, and include prerequisites for netinet/ip.h check. --- include/Makefile.am | 3 +-- include/compat/{machine => }/endian.h | 7 ++----- m4/check-libc.m4 | 8 ++++++-- 3 files changed, 9 insertions(+), 9 deletions(-) rename include/compat/{machine => }/endian.h (90%) diff --git a/include/Makefile.am b/include/Makefile.am index 4184cf8814..aed67211e9 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -7,6 +7,7 @@ SUBDIRS = openssl noinst_HEADERS = pqueue.h noinst_HEADERS += compat/dirent.h noinst_HEADERS += compat/dirent_msvc.h +noinst_HEADERS += compat/endian.h noinst_HEADERS += compat/err.h noinst_HEADERS += compat/fcntl.h noinst_HEADERS += compat/limits.h @@ -26,8 +27,6 @@ noinst_HEADERS += compat/win32netcompat.h noinst_HEADERS += compat/arpa/inet.h noinst_HEADERS += compat/arpa/nameser.h -noinst_HEADERS += compat/machine/endian.h - noinst_HEADERS += compat/netinet/in.h noinst_HEADERS += compat/netinet/ip.h noinst_HEADERS += compat/netinet/tcp.h diff --git a/include/compat/machine/endian.h b/include/compat/endian.h similarity index 90% rename from include/compat/machine/endian.h rename to include/compat/endian.h index bb22f5b208..1ed255e8ba 100644 --- a/include/compat/machine/endian.h +++ b/include/compat/endian.h @@ -1,6 +1,6 @@ /* * Public domain - * machine/endian.h compatibility shim + * endian.h compatibility shim */ #ifndef LIBCRYPTOCOMPAT_BYTE_ORDER_H_ @@ -22,7 +22,7 @@ #endif #elif defined(HAVE_ENDIAN_H) -#include +#include_next #elif defined(__sun) || defined(_AIX) || defined(__hpux) #include @@ -32,9 +32,6 @@ #include #include -#else -#include_next - #endif #ifndef __STRICT_ALIGNMENT diff --git a/m4/check-libc.m4 b/m4/check-libc.m4 index cca97c3fe9..40df67f778 100644 --- a/m4/check-libc.m4 +++ b/m4/check-libc.m4 @@ -1,7 +1,11 @@ AC_DEFUN([CHECK_LIBC_COMPAT], [ # Check for libc headers -AC_CHECK_HEADERS([err.h readpassphrase.h]) -AC_CHECK_HEADERS([arpa/nameser.h endian.h netinet/ip.h resolv.h]) +AC_CHECK_HEADERS([endian.h err.h readpassphrase.h]) +AC_CHECK_HEADERS([netinet/ip.h], [], [], +[#include +#include +]) +AC_HEADER_RESOLV # Check for general libc functions AC_CHECK_FUNCS([asprintf freezero memmem]) AC_CHECK_FUNCS([readpassphrase reallocarray recallocarray]) From 2ac3d32ec532b9e62efe20f3e7d03245cd2b09c3 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 9 Nov 2021 23:04:29 -0600 Subject: [PATCH 0010/1283] Update CMake for new header checks --- CMakeLists.txt | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index 8338ab9310..ef9070baae 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -286,11 +286,21 @@ if(HAVE_MEMMEM) add_definitions(-DHAVE_MEMMEM) endif() +check_include_files(endian.h HAVE_ENDIAN_H) +if(HAVE_ENDIAN_H) + add_definitions(-DHAVE_ENDIAN_H) +endif() + check_include_files(err.h HAVE_ERR_H) if(HAVE_ERR_H) add_definitions(-DHAVE_ERR_H) endif() +check_include_files(netinet/ip.h HAVE_NETINET_IP_H) +if(HAVE_NETINET_IP_H) + add_definitions(-DHAVE_NETINET_IP_H) +endif() + if(ENABLE_ASM) if("${CMAKE_C_COMPILER_ABI}" STREQUAL "ELF") if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64)") From 2f3066df94e794dc91a1ddb6425755ed0d8c9dd0 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Tue, 23 Nov 2021 13:27:17 +0900 Subject: [PATCH 0011/1283] Set IA-64 compiler flag only if it is HP-UX with IA-64 Compiler switch -mlp64 (GCC) or +DD64(HP CC) gives build failure with platform HP-UX other than IA-64. This avoids build break on HP-UX with PA-RISC platform. Suggested from Larkin Nickle (me larbob org) by libressl ML. --- m4/check-os-options.m4 | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/m4/check-os-options.m4 b/m4/check-os-options.m4 index 644bf714a6..8080dcbafe 100644 --- a/m4/check-os-options.m4 +++ b/m4/check-os-options.m4 @@ -68,10 +68,15 @@ char buf[1]; getentropy(buf, 1); ;; *hpux*) HOST_OS=hpux; - if test "`echo $CC | cut -d ' ' -f 1`" = "gcc" ; then - CFLAGS="$CFLAGS -mlp64" - else - CFLAGS="-g -O2 +DD64 +Otype_safety=off $USER_CFLAGS" + if test "`echo $host_os | cut -c 1-4`" = "ia64" ; then + if test "`echo $CC | cut -d ' ' -f 1`" = "gcc" ; then + CFLAGS="$CFLAGS -mlp64" + else + CFLAGS="+DD64" + fi + fi + if ! test "`echo $CC | cut -d ' ' -f 1`" = "gcc" ; then + CFLAGS="-g -O2 +Otype_safety=off $CFLAGS $USER_CFLAGS" fi CPPFLAGS="$CPPFLAGS -D_XOPEN_SOURCE=600 -D__STRICT_ALIGNMENT" ;; From 870a1ebbc20324c3276842c494756e219801a738 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Sat, 27 Nov 2021 20:57:14 +0900 Subject: [PATCH 0012/1283] Build static library for regression tests when shared build with CMake --- CMakeLists.txt | 9 + crypto/CMakeLists.txt | 22 +++ ssl/CMakeLists.txt | 13 ++ tests/CMakeLists.txt | 371 ++++++++++++++++++------------------------ tls/CMakeLists.txt | 14 ++ 5 files changed, 218 insertions(+), 211 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index ef9070baae..bcd17f77e4 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -347,6 +347,15 @@ add_definitions(-DSIZEOF_TIME_T=${SIZEOF_TIME_T}) set(OPENSSL_LIBS ssl crypto ${PLATFORM_LIBS}) set(LIBTLS_LIBS tls ${PLATFORM_LIBS}) +# libraries for regression test +if(BUILD_SHARED_LIBS) + set(OPENSSL_TEST_LIBS ssl-static crypto-static ${PLATFORM_LIBS}) + set(LIBTLS_TEST_LIBS tls-static ${PLATFORM_LIBS}) +else() + set(OPENSSL_TEST_LIBS ssl crypto ${PLATFORM_LIBS}) + set(LIBTLS_TEST_LIBS tls ${PLATFORM_LIBS}) +endif() + add_subdirectory(crypto) add_subdirectory(ssl) if(LIBRESSL_APPS) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 5733746484..62324a8b93 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -1028,3 +1028,25 @@ if(ENABLE_LIBRESSL_INSTALL) RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} ) endif(ENABLE_LIBRESSL_INSTALL) + +# build static library for regression test +if(BUILD_SHARED_LIBS) + add_library(crypto-static STATIC $) + target_include_directories(crypto-static + PRIVATE + . + asn1 + bn + dsa + ec + ecdh + ecdsa + evp + modes + x509 + ../include/compat + PUBLIC + ../include) + target_link_libraries(crypto-static ${PLATFORM_LIBS}) +endif() + diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index a8e0a25917..e4a3d95546 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -89,3 +89,16 @@ if(ENABLE_LIBRESSL_INSTALL) RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} ) endif(ENABLE_LIBRESSL_INSTALL) + +# build static library for regression test +if(BUILD_SHARED_LIBS) + add_library(ssl-static STATIC $) + target_include_directories(ssl-static + PRIVATE + . + ../include/compat + PUBLIC + ../include) + target_link_libraries(ssl-static crypto-static ${PLATFORM_LIBS}) +endif() + diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 2cdd683308..ff1ab5163d 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -15,201 +15,183 @@ file(TO_NATIVE_PATH ${CMAKE_CURRENT_SOURCE_DIR} TEST_SOURCE_DIR) # aeadtest add_executable(aeadtest aeadtest.c) -target_link_libraries(aeadtest ${OPENSSL_LIBS}) +target_link_libraries(aeadtest ${OPENSSL_TEST_LIBS}) add_test(aeadtest aeadtest ${CMAKE_CURRENT_SOURCE_DIR}/aeadtests.txt) # aes_wrap add_executable(aes_wrap aes_wrap.c) -target_link_libraries(aes_wrap ${OPENSSL_LIBS}) +target_link_libraries(aes_wrap ${OPENSSL_TEST_LIBS}) add_test(aes_wrap aes_wrap) # arc4randomforktest # Windows/mingw does not have fork, but Cygwin does. if(NOT (WIN32 OR (CMAKE_SYSTEM_NAME MATCHES "MINGW"))) add_executable(arc4randomforktest arc4randomforktest.c) - target_link_libraries(arc4randomforktest ${OPENSSL_LIBS}) + target_link_libraries(arc4randomforktest ${OPENSSL_TEST_LIBS}) add_test(arc4randomforktest ${CMAKE_CURRENT_SOURCE_DIR}/arc4randomforktest.sh) endif() # asn1evp add_executable(asn1evp asn1evp.c) -target_link_libraries(asn1evp ${OPENSSL_LIBS}) +target_link_libraries(asn1evp ${OPENSSL_TEST_LIBS}) add_test(asn1evp asn1evp) # asn1test add_executable(asn1test asn1test.c) -target_link_libraries(asn1test ${OPENSSL_LIBS}) +target_link_libraries(asn1test ${OPENSSL_TEST_LIBS}) add_test(asn1test asn1test) # asn1time add_executable(asn1time asn1time.c) -target_link_libraries(asn1time ${OPENSSL_LIBS}) +target_link_libraries(asn1time ${OPENSSL_TEST_LIBS}) add_test(asn1time asn1time) # base64test add_executable(base64test base64test.c) -target_link_libraries(base64test ${OPENSSL_LIBS}) +target_link_libraries(base64test ${OPENSSL_TEST_LIBS}) add_test(base64test base64test) # bftest add_executable(bftest bftest.c) -target_link_libraries(bftest ${OPENSSL_LIBS}) +target_link_libraries(bftest ${OPENSSL_TEST_LIBS}) add_test(bftest bftest) # biotest # the BIO tests rely on resolver results that are OS and environment-specific if(ENABLE_EXTRATESTS) add_executable(biotest biotest.c) - target_link_libraries(biotest ${OPENSSL_LIBS}) + target_link_libraries(biotest ${OPENSSL_TEST_LIBS}) add_test(biotest biotest) endif() # bnaddsub add_executable(bnaddsub bnaddsub.c) -target_link_libraries(bnaddsub ${OPENSSL_LIBS}) +target_link_libraries(bnaddsub ${OPENSSL_TEST_LIBS}) add_test(bnaddsub bnaddsub) # bn_rand_interval -if(NOT BUILD_SHARED_LIBS) - add_executable(bn_rand_interval bn_rand_interval.c) - target_link_libraries(bn_rand_interval ${OPENSSL_LIBS}) - add_test(bn_rand_interval bn_rand_interval) -endif() +add_executable(bn_rand_interval bn_rand_interval.c) +target_link_libraries(bn_rand_interval ${OPENSSL_TEST_LIBS}) +add_test(bn_rand_interval bn_rand_interval) # bntest -if(NOT BUILD_SHARED_LIBS) - add_executable(bntest bntest.c) - set_source_files_properties(bntest.c PROPERTIES COMPILE_FLAGS - -ULIBRESSL_INTERNAL) - target_link_libraries(bntest ${OPENSSL_LIBS}) - add_test(bntest bntest) -endif() +add_executable(bntest bntest.c) +set_source_files_properties(bntest.c PROPERTIES COMPILE_FLAGS + -ULIBRESSL_INTERNAL) +target_link_libraries(bntest ${OPENSSL_TEST_LIBS}) +add_test(bntest bntest) # bn_to_string -if(NOT BUILD_SHARED_LIBS) - add_executable(bn_to_string bn_to_string.c) - target_link_libraries(bn_to_string ${OPENSSL_LIBS}) - add_test(bn_to_string bn_to_string) -endif() +add_executable(bn_to_string bn_to_string.c) +target_link_libraries(bn_to_string ${OPENSSL_TEST_LIBS}) +add_test(bn_to_string bn_to_string) # buffertest -if(NOT BUILD_SHARED_LIBS) - add_executable(buffertest buffertest.c) - target_link_libraries(buffertest ${OPENSSL_LIBS}) - add_test(buffertest buffertest) -endif() +add_executable(buffertest buffertest.c) +target_link_libraries(buffertest ${OPENSSL_TEST_LIBS}) +add_test(buffertest buffertest) # bytestringtest -if(NOT BUILD_SHARED_LIBS) - add_executable(bytestringtest bytestringtest.c) - target_link_libraries(bytestringtest ${OPENSSL_LIBS}) - add_test(bytestringtest bytestringtest) -endif() +add_executable(bytestringtest bytestringtest.c) +target_link_libraries(bytestringtest ${OPENSSL_TEST_LIBS}) +add_test(bytestringtest bytestringtest) # casttest add_executable(casttest casttest.c) -target_link_libraries(casttest ${OPENSSL_LIBS}) +target_link_libraries(casttest ${OPENSSL_TEST_LIBS}) add_test(casttest casttest) # chachatest add_executable(chachatest chachatest.c) -target_link_libraries(chachatest ${OPENSSL_LIBS}) +target_link_libraries(chachatest ${OPENSSL_TEST_LIBS}) add_test(chachatest chachatest) # cipher_list -if(NOT BUILD_SHARED_LIBS) - add_executable(cipher_list cipher_list.c) - target_link_libraries(cipher_list ${OPENSSL_LIBS}) - add_test(cipher_list cipher_list) -endif() +add_executable(cipher_list cipher_list.c) +target_link_libraries(cipher_list ${OPENSSL_TEST_LIBS}) +add_test(cipher_list cipher_list) -if(NOT BUILD_SHARED_LIBS) - # cipherstest - add_executable(cipherstest cipherstest.c) - target_link_libraries(cipherstest ${OPENSSL_LIBS}) - add_test(cipherstest cipherstest) -endif() +# cipherstest +add_executable(cipherstest cipherstest.c) +target_link_libraries(cipherstest ${OPENSSL_TEST_LIBS}) +add_test(cipherstest cipherstest) # clienttest add_executable(clienttest clienttest.c) -target_link_libraries(clienttest ${OPENSSL_LIBS}) +target_link_libraries(clienttest ${OPENSSL_TEST_LIBS}) add_test(clienttest clienttest) # cmstest add_executable(cmstest cmstest.c) -target_link_libraries(cmstest ${OPENSSL_LIBS}) +target_link_libraries(cmstest ${OPENSSL_TEST_LIBS}) add_test(cmstest cmstest) # configtest add_executable(configtest configtest.c) -target_link_libraries(configtest ${LIBTLS_LIBS}) +target_link_libraries(configtest ${LIBTLS_TEST_LIBS}) add_test(configtest configtest) # constraints -if(NOT BUILD_SHARED_LIBS) - add_executable(constraints constraints.c) - target_link_libraries(constraints ${OPENSSL_LIBS}) - add_test(constraints constraints) -endif() +add_executable(constraints constraints.c) +target_link_libraries(constraints ${OPENSSL_TEST_LIBS}) +add_test(constraints constraints) # cts128test add_executable(cts128test cts128test.c) -target_link_libraries(cts128test ${OPENSSL_LIBS}) +target_link_libraries(cts128test ${OPENSSL_TEST_LIBS}) add_test(cts128test cts128test) # destest add_executable(destest destest.c) -target_link_libraries(destest ${OPENSSL_LIBS}) +target_link_libraries(destest ${OPENSSL_TEST_LIBS}) add_test(destest destest) # dhtest add_executable(dhtest dhtest.c) -target_link_libraries(dhtest ${OPENSSL_LIBS}) +target_link_libraries(dhtest ${OPENSSL_TEST_LIBS}) add_test(dhtest dhtest) # dsatest add_executable(dsatest dsatest.c) -target_link_libraries(dsatest ${OPENSSL_LIBS}) +target_link_libraries(dsatest ${OPENSSL_TEST_LIBS}) add_test(dsatest dsatest) # dtlstest -if(NOT BUILD_SHARED_LIBS AND NOT WIN32) +if(NOT WIN32) add_executable(dtlstest dtlstest.c) - target_link_libraries(dtlstest ${OPENSSL_LIBS}) + target_link_libraries(dtlstest ${OPENSSL_TEST_LIBS}) add_test(NAME dtlstest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/dtlstest.sh) set_tests_properties(dtlstest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") endif() -if(NOT BUILD_SHARED_LIBS) # ec_point_conversion add_executable(ec_point_conversion ec_point_conversion.c) -target_link_libraries(ec_point_conversion ${OPENSSL_LIBS}) +target_link_libraries(ec_point_conversion ${OPENSSL_TEST_LIBS}) add_test(ec_point_conversion ec_point_conversion) # ecdhtest add_executable(ecdhtest ecdhtest.c) -target_link_libraries(ecdhtest ${OPENSSL_LIBS}) +target_link_libraries(ecdhtest ${OPENSSL_TEST_LIBS}) add_test(ecdhtest ecdhtest) # ecdsatest add_executable(ecdsatest ecdsatest.c) -target_link_libraries(ecdsatest ${OPENSSL_LIBS}) +target_link_libraries(ecdsatest ${OPENSSL_TEST_LIBS}) add_test(ecdsatest ecdsatest) # ectest add_executable(ectest ectest.c) -target_link_libraries(ectest ${OPENSSL_LIBS}) +target_link_libraries(ectest ${OPENSSL_TEST_LIBS}) add_test(ectest ectest) -endif() # enginetest add_executable(enginetest enginetest.c) -target_link_libraries(enginetest ${OPENSSL_LIBS}) +target_link_libraries(enginetest ${OPENSSL_TEST_LIBS}) add_test(enginetest enginetest) # evptest add_executable(evptest evptest.c) -target_link_libraries(evptest ${OPENSSL_LIBS}) +target_link_libraries(evptest ${OPENSSL_TEST_LIBS}) add_test(evptest evptest ${CMAKE_CURRENT_SOURCE_DIR}/evptests.txt) # explicit_bzero @@ -220,95 +202,89 @@ if(NOT WIN32) else() add_executable(explicit_bzero explicit_bzero.c compat/memmem.c) endif() - target_link_libraries(explicit_bzero ${OPENSSL_LIBS}) + target_link_libraries(explicit_bzero ${OPENSSL_TEST_LIBS}) add_test(explicit_bzero explicit_bzero) endif() # exptest -if(NOT BUILD_SHARED_LIBS) - add_executable(exptest exptest.c) - set_source_files_properties(exptest.c PROPERTIES COMPILE_FLAGS - -ULIBRESSL_INTERNAL) - target_link_libraries(exptest ${OPENSSL_LIBS}) - add_test(exptest exptest) -endif() +add_executable(exptest exptest.c) +set_source_files_properties(exptest.c PROPERTIES COMPILE_FLAGS + -ULIBRESSL_INTERNAL) +target_link_libraries(exptest ${OPENSSL_TEST_LIBS}) +add_test(exptest exptest) # freenull add_executable(freenull freenull.c) -target_link_libraries(freenull ${OPENSSL_LIBS}) +target_link_libraries(freenull ${OPENSSL_TEST_LIBS}) add_test(freenull freenull) # gcm128test add_executable(gcm128test gcm128test.c) -target_link_libraries(gcm128test ${OPENSSL_LIBS}) +target_link_libraries(gcm128test ${OPENSSL_TEST_LIBS}) add_test(gcm128test gcm128test) # gost2814789t add_executable(gost2814789t gost2814789t.c) -target_link_libraries(gost2814789t ${OPENSSL_LIBS}) +target_link_libraries(gost2814789t ${OPENSSL_TEST_LIBS}) add_test(gost2814789t gost2814789t) # handshake_table -if(NOT BUILD_SHARED_LIBS) - add_executable(handshake_table handshake_table.c) - target_link_libraries(handshake_table ${OPENSSL_LIBS}) - add_test(handshake_table handshake_table) -endif() +add_executable(handshake_table handshake_table.c) +target_link_libraries(handshake_table ${OPENSSL_TEST_LIBS}) +add_test(handshake_table handshake_table) # hkdf_test add_executable(hkdf_test hkdf_test.c) -target_link_libraries(hkdf_test ${OPENSSL_LIBS}) +target_link_libraries(hkdf_test ${OPENSSL_TEST_LIBS}) add_test(hkdf_test hkdf_test) # hmactest add_executable(hmactest hmactest.c) -target_link_libraries(hmactest ${OPENSSL_LIBS}) +target_link_libraries(hmactest ${OPENSSL_TEST_LIBS}) add_test(hmactest hmactest) # ideatest add_executable(ideatest ideatest.c) -target_link_libraries(ideatest ${OPENSSL_LIBS}) +target_link_libraries(ideatest ${OPENSSL_TEST_LIBS}) add_test(ideatest ideatest) # igetest add_executable(igetest igetest.c) -target_link_libraries(igetest ${OPENSSL_LIBS}) +target_link_libraries(igetest ${OPENSSL_TEST_LIBS}) add_test(igetest igetest) # keypairtest -if(NOT BUILD_SHARED_LIBS) - add_executable(key_schedule key_schedule.c) - target_link_libraries(key_schedule ${OPENSSL_LIBS}) - add_test(key_schedule key_schedule) - - add_executable(keypairtest keypairtest.c) - target_link_libraries(keypairtest ${LIBTLS_LIBS}) - target_include_directories(keypairtest BEFORE PUBLIC ../tls) - add_test(keypairtest keypairtest - ${CMAKE_CURRENT_SOURCE_DIR}/ca.pem - ${CMAKE_CURRENT_SOURCE_DIR}/server.pem - ${CMAKE_CURRENT_SOURCE_DIR}/server.pem) -endif() +add_executable(key_schedule key_schedule.c) +target_link_libraries(key_schedule ${OPENSSL_TEST_LIBS}) +add_test(key_schedule key_schedule) + +add_executable(keypairtest keypairtest.c) +target_link_libraries(keypairtest ${LIBTLS_TEST_LIBS}) +target_include_directories(keypairtest BEFORE PUBLIC ../tls) +add_test(keypairtest keypairtest + ${CMAKE_CURRENT_SOURCE_DIR}/ca.pem + ${CMAKE_CURRENT_SOURCE_DIR}/server.pem + ${CMAKE_CURRENT_SOURCE_DIR}/server.pem) # md4test add_executable(md4test md4test.c) -target_link_libraries(md4test ${OPENSSL_LIBS}) +target_link_libraries(md4test ${OPENSSL_TEST_LIBS}) add_test(md4test md4test) # md5test add_executable(md5test md5test.c) -target_link_libraries(md5test ${OPENSSL_LIBS}) +target_link_libraries(md5test ${OPENSSL_TEST_LIBS}) add_test(md5test md5test) # mont add_executable(mont mont.c) -target_link_libraries(mont ${OPENSSL_LIBS}) +target_link_libraries(mont ${OPENSSL_TEST_LIBS}) add_test(mont mont) # ocsp_test if(ENABLE_EXTRATESTS) add_executable(ocsp_test ocsp_test.c) - target_link_libraries(ocsp_test ${OPENSSL_LIBS}) + target_link_libraries(ocsp_test ${OPENSSL_TEST_LIBS}) if(NOT MSVC) add_test(NAME ocsptest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ocsptest.sh) else() @@ -318,12 +294,12 @@ endif() # optionstest add_executable(optionstest optionstest.c) -target_link_libraries(optionstest ${OPENSSL_LIBS}) +target_link_libraries(optionstest ${OPENSSL_TEST_LIBS}) add_test(optionstest optionstest) # pbkdf2 add_executable(pbkdf2 pbkdf2.c) -target_link_libraries(pbkdf2 ${OPENSSL_LIBS}) +target_link_libraries(pbkdf2 ${OPENSSL_TEST_LIBS}) add_test(pbkdf2 pbkdf2) # pidwraptest @@ -331,68 +307,59 @@ add_test(pbkdf2 pbkdf2) # awkward on systems with slow fork if(ENABLE_EXTRATESTS AND NOT MSVC) add_executable(pidwraptest pidwraptest.c) - target_link_libraries(pidwraptest ${OPENSSL_LIBS}) + target_link_libraries(pidwraptest ${OPENSSL_TEST_LIBS}) add_test(pidwraptest ${CMAKE_CURRENT_SOURCE_DIR}/pidwraptest.sh) endif() # pkcs7test add_executable(pkcs7test pkcs7test.c) -target_link_libraries(pkcs7test ${OPENSSL_LIBS}) +target_link_libraries(pkcs7test ${OPENSSL_TEST_LIBS}) add_test(pkcs7test pkcs7test) # poly1305test add_executable(poly1305test poly1305test.c) -target_link_libraries(poly1305test ${OPENSSL_LIBS}) +target_link_libraries(poly1305test ${OPENSSL_TEST_LIBS}) add_test(poly1305test poly1305test) # pq_test -if(NOT BUILD_SHARED_LIBS) - add_executable(pq_test pq_test.c) - target_link_libraries(pq_test ${OPENSSL_LIBS}) - if(NOT MSVC) - add_test(NAME pq_test COMMAND - ${CMAKE_CURRENT_SOURCE_DIR}/pq_test.sh) - else() - add_test(NAME pq_test COMMAND - ${CMAKE_CURRENT_SOURCE_DIR}/pq_test.bat - $) - endif() - set_tests_properties(pq_test PROPERTIES ENVIRONMENT - "srcdir=${TEST_SOURCE_DIR}") +add_executable(pq_test pq_test.c) +target_link_libraries(pq_test ${OPENSSL_TEST_LIBS}) +if(NOT MSVC) + add_test(NAME pq_test COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/pq_test.sh) +else() + add_test(NAME pq_test COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/pq_test.bat + $) endif() +set_tests_properties(pq_test PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # randtest add_executable(randtest randtest.c) -target_link_libraries(randtest ${OPENSSL_LIBS}) +target_link_libraries(randtest ${OPENSSL_TEST_LIBS}) add_test(randtest randtest) # rc2test add_executable(rc2test rc2test.c) -target_link_libraries(rc2test ${OPENSSL_LIBS}) +target_link_libraries(rc2test ${OPENSSL_TEST_LIBS}) add_test(rc2test rc2test) # rc4test add_executable(rc4test rc4test.c) -target_link_libraries(rc4test ${OPENSSL_LIBS}) +target_link_libraries(rc4test ${OPENSSL_TEST_LIBS}) add_test(rc4test rc4test) # recordtest -if(NOT BUILD_SHARED_LIBS) - add_executable(recordtest recordtest.c) - target_link_libraries(recordtest ${OPENSSL_LIBS}) - add_test(recordtest recordtest) -endif() +add_executable(recordtest recordtest.c) +target_link_libraries(recordtest ${OPENSSL_TEST_LIBS}) +add_test(recordtest recordtest) # record_layer_test -if(NOT BUILD_SHARED_LIBS) - add_executable(record_layer_test record_layer_test.c) - target_link_libraries(record_layer_test ${OPENSSL_LIBS}) - add_test(record_layer_test record_layer_test) -endif() +add_executable(record_layer_test record_layer_test.c) +target_link_libraries(record_layer_test ${OPENSSL_TEST_LIBS}) +add_test(record_layer_test record_layer_test) # rfc5280time add_executable(rfc5280time rfc5280time.c) -target_link_libraries(rfc5280time ${OPENSSL_LIBS}) +target_link_libraries(rfc5280time ${OPENSSL_TEST_LIBS}) if(SMALL_TIME_T) add_test(rfc5280time ${CMAKE_CURRENT_SOURCE_DIR}/rfc5280time_small.test) else() @@ -401,68 +368,64 @@ endif() # rmdtest add_executable(rmdtest rmdtest.c) -target_link_libraries(rmdtest ${OPENSSL_LIBS}) +target_link_libraries(rmdtest ${OPENSSL_TEST_LIBS}) add_test(rmdtest rmdtest) # rsa_test add_executable(rsa_test rsa_test.c) -target_link_libraries(rsa_test ${OPENSSL_LIBS}) +target_link_libraries(rsa_test ${OPENSSL_TEST_LIBS}) add_test(rsa_test rsa_test) # servertest -if(NOT BUILD_SHARED_LIBS) - add_executable(servertest servertest.c) - target_link_libraries(servertest ${OPENSSL_LIBS}) - if(NOT MSVC) - add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.sh) - else() - add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.bat $) - endif() - set_tests_properties(servertest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") +add_executable(servertest servertest.c) +target_link_libraries(servertest ${OPENSSL_TEST_LIBS}) +if(NOT MSVC) + add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.sh) +else() + add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.bat $) endif() +set_tests_properties(servertest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # sha1test add_executable(sha1test sha1test.c) -target_link_libraries(sha1test ${OPENSSL_LIBS}) +target_link_libraries(sha1test ${OPENSSL_TEST_LIBS}) add_test(sha1test sha1test) # sha256test add_executable(sha256test sha256test.c) -target_link_libraries(sha256test ${OPENSSL_LIBS}) +target_link_libraries(sha256test ${OPENSSL_TEST_LIBS}) add_test(sha256test sha256test) # sha512test add_executable(sha512test sha512test.c) -target_link_libraries(sha512test ${OPENSSL_LIBS}) +target_link_libraries(sha512test ${OPENSSL_TEST_LIBS}) add_test(sha512test sha512test) # sm3test add_executable(sm3test sm3test.c) -target_link_libraries(sm3test ${OPENSSL_LIBS}) +target_link_libraries(sm3test ${OPENSSL_TEST_LIBS}) add_test(sm3test sm3test) # sm4test add_executable(sm4test sm4test.c) -target_link_libraries(sm4test ${OPENSSL_LIBS}) +target_link_libraries(sm4test ${OPENSSL_TEST_LIBS}) add_test(sm4test sm4test) # ssl_get_shared_ciphers add_executable(ssl_get_shared_ciphers ssl_get_shared_ciphers.c) set_source_files_properties(ssl_get_shared_ciphers.c PROPERTIES COMPILE_FLAGS -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") -target_link_libraries(ssl_get_shared_ciphers ${OPENSSL_LIBS}) +target_link_libraries(ssl_get_shared_ciphers ${OPENSSL_TEST_LIBS}) add_test(ssl_get_shared_ciphers ssl_get_shared_ciphers) # ssl_versions -if(NOT BUILD_SHARED_LIBS) - add_executable(ssl_versions ssl_versions.c) - target_link_libraries(ssl_versions ${OPENSSL_LIBS}) - add_test(ssl_versions ssl_versions) -endif() +add_executable(ssl_versions ssl_versions.c) +target_link_libraries(ssl_versions ${OPENSSL_TEST_LIBS}) +add_test(ssl_versions ssl_versions) # ssltest add_executable(ssltest ssltest.c) -target_link_libraries(ssltest ${OPENSSL_LIBS}) +target_link_libraries(ssltest ${OPENSSL_TEST_LIBS}) if(NOT MSVC) add_test(NAME ssltest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssltest.sh) else() @@ -496,19 +459,17 @@ set_tests_properties(testrsa PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # timingsafe add_executable(timingsafe timingsafe.c) -target_link_libraries(timingsafe ${OPENSSL_LIBS}) +target_link_libraries(timingsafe ${OPENSSL_TEST_LIBS}) add_test(timingsafe timingsafe) # tlsexttest -if(NOT BUILD_SHARED_LIBS) - add_executable(tlsexttest tlsexttest.c) - target_link_libraries(tlsexttest ${OPENSSL_LIBS}) - add_test(tlsexttest tlsexttest) -endif() +add_executable(tlsexttest tlsexttest.c) +target_link_libraries(tlsexttest ${OPENSSL_TEST_LIBS}) +add_test(tlsexttest tlsexttest) # tlslegacytest add_executable(tlslegacytest tlslegacytest.c) -target_link_libraries(tlslegacytest ${OPENSSL_LIBS}) +target_link_libraries(tlslegacytest ${OPENSSL_TEST_LIBS}) add_test(tlslegacytest tlslegacytest) # tlstest @@ -522,7 +483,7 @@ if(NOT CMAKE_SYSTEM_NAME MATCHES "WindowsStore") endif() add_executable(tlstest ${TLSTEST_SRC}) - target_link_libraries(tlstest ${LIBTLS_LIBS}) + target_link_libraries(tlstest ${LIBTLS_TEST_LIBS}) if(NOT MSVC) add_test(NAME tlstest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/tlstest.sh) else() @@ -532,71 +493,59 @@ if(NOT CMAKE_SYSTEM_NAME MATCHES "WindowsStore") endif() # tls_ext_alpn -if(NOT BUILD_SHARED_LIBS) - add_executable(tls_ext_alpn tls_ext_alpn.c) - target_link_libraries(tls_ext_alpn ${OPENSSL_LIBS}) - add_test(tls_ext_alpn tls_ext_alpn) -endif() +add_executable(tls_ext_alpn tls_ext_alpn.c) +target_link_libraries(tls_ext_alpn ${OPENSSL_TEST_LIBS}) +add_test(tls_ext_alpn tls_ext_alpn) # tls_prf -if(NOT BUILD_SHARED_LIBS) - add_executable(tls_prf tls_prf.c) - target_link_libraries(tls_prf ${OPENSSL_LIBS}) - add_test(tls_prf tls_prf) -endif() +add_executable(tls_prf tls_prf.c) +target_link_libraries(tls_prf ${OPENSSL_TEST_LIBS}) +add_test(tls_prf tls_prf) # utf8test -if(NOT BUILD_SHARED_LIBS) - add_executable(utf8test utf8test.c) - target_link_libraries(utf8test ${OPENSSL_LIBS}) - add_test(utf8test utf8test) -endif() +add_executable(utf8test utf8test.c) +target_link_libraries(utf8test ${OPENSSL_TEST_LIBS}) +add_test(utf8test utf8test) # valid_handshakes_terminate -if(NOT BUILD_SHARED_LIBS) - add_executable(valid_handshakes_terminate valid_handshakes_terminate.c) - target_link_libraries(valid_handshakes_terminate ${OPENSSL_LIBS}) - add_test(valid_handshakes_terminate valid_handshakes_terminate) -endif() +add_executable(valid_handshakes_terminate valid_handshakes_terminate.c) +target_link_libraries(valid_handshakes_terminate ${OPENSSL_TEST_LIBS}) +add_test(valid_handshakes_terminate valid_handshakes_terminate) # verifytest -if(NOT BUILD_SHARED_LIBS) - add_executable(verifytest verifytest.c) - target_link_libraries(verifytest ${LIBTLS_LIBS}) - add_test(verifytest verifytest) -endif() +add_executable(verifytest verifytest.c) +target_link_libraries(verifytest ${LIBTLS_TEST_LIBS}) +add_test(verifytest verifytest) # x25519test add_executable(x25519test x25519test.c) -target_link_libraries(x25519test ${OPENSSL_LIBS}) +target_link_libraries(x25519test ${OPENSSL_TEST_LIBS}) add_test(x25519test x25519test) # x509attribute add_executable(x509attribute x509attribute.c) -target_link_libraries(x509attribute ${OPENSSL_LIBS}) +target_link_libraries(x509attribute ${OPENSSL_TEST_LIBS}) add_test(x509attribute x509attribute) # x509_info add_executable(x509_info x509_info.c) -target_link_libraries(x509_info ${OPENSSL_LIBS}) +target_link_libraries(x509_info ${OPENSSL_TEST_LIBS}) add_test(x509_info x509_info) # x509name add_executable(x509name x509name.c) -target_link_libraries(x509name ${OPENSSL_LIBS}) +target_link_libraries(x509name ${OPENSSL_TEST_LIBS}) add_test(x509name x509name) # x509req_ext add_executable(x509req_ext x509req_ext.c) -target_link_libraries(x509req_ext ${OPENSSL_LIBS}) +target_link_libraries(x509req_ext ${OPENSSL_TEST_LIBS}) add_test(x509req_ext x509req_ext) -if(BUILD_SHARED_LIBS) - add_custom_command(TARGET x25519test POST_BUILD - COMMAND "${CMAKE_COMMAND}" -E copy - "$" - "$" - "$" - "${CMAKE_CURRENT_BINARY_DIR}" - COMMENT "Copying DLLs for regression tests") -endif() +add_custom_command(TARGET x25519test POST_BUILD + COMMAND "${CMAKE_COMMAND}" -E copy + "$" + "$" + "$" + "${CMAKE_CURRENT_BINARY_DIR}" + COMMENT "Copying DLLs for regression tests") diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 9aa10e1ba6..17aedf058c 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -74,3 +74,17 @@ if(ENABLE_LIBRESSL_INSTALL) RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} ) endif(ENABLE_LIBRESSL_INSTALL) + +# build static library for regression test +if(BUILD_SHARED_LIBS) + add_library(tls-static STATIC $ + $ $) + target_include_directories(tls-static + PRIVATE + . + ../include/compat + PUBLIC + ../include) + target_link_libraries(tls-static ${PLATFORM_LIBS}) +endif() + From 954948159a6ccdf47666f42b4d92f0ba77ca942c Mon Sep 17 00:00:00 2001 From: kinichiro Date: Sat, 27 Nov 2021 22:12:11 +0900 Subject: [PATCH 0013/1283] Add ct --- crypto/CMakeLists.txt | 10 ++++++++++ crypto/Makefile.am | 15 +++++++++++++++ update.sh | 3 ++- 3 files changed, 27 insertions(+), 1 deletion(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 5733746484..2aac0510b1 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -412,6 +412,16 @@ set( conf/conf_mall.c conf/conf_mod.c conf/conf_sap.c + ct/ct_b64.c + ct/ct_err.c + ct/ct_log.c + ct/ct_oct.c + ct/ct_policy.c + ct/ct_prn.c + ct/ct_sct.c + ct/ct_sct_ctx.c + ct/ct_vfy.c + ct/ct_x509v3.c curve25519/curve25519-generic.c curve25519/curve25519.c des/cbc_cksm.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index f2ef1512ed..ceab62875e 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -1,5 +1,7 @@ include $(top_srcdir)/Makefile.am.common +AM_CPPFLAGS += -DLIBRESSL_CRYPTO_INTERNAL + AM_CPPFLAGS += -I$(top_srcdir)/crypto/asn1 AM_CPPFLAGS += -I$(top_srcdir)/crypto/bn AM_CPPFLAGS += -I$(top_srcdir)/crypto/ec @@ -500,6 +502,19 @@ libcrypto_la_SOURCES += conf/conf_mod.c libcrypto_la_SOURCES += conf/conf_sap.c noinst_HEADERS += conf/conf_def.h +# ct +libcrypto_la_SOURCES += ct/ct_b64.c +libcrypto_la_SOURCES += ct/ct_err.c +libcrypto_la_SOURCES += ct/ct_log.c +libcrypto_la_SOURCES += ct/ct_oct.c +libcrypto_la_SOURCES += ct/ct_policy.c +libcrypto_la_SOURCES += ct/ct_prn.c +libcrypto_la_SOURCES += ct/ct_sct.c +libcrypto_la_SOURCES += ct/ct_sct_ctx.c +libcrypto_la_SOURCES += ct/ct_vfy.c +libcrypto_la_SOURCES += ct/ct_x509v3.c +noinst_HEADERS += ct/ct_local.h + # curve25519 libcrypto_la_SOURCES += curve25519/curve25519-generic.c libcrypto_la_SOURCES += curve25519/curve25519.c diff --git a/update.sh b/update.sh index fe91b51ecf..311ce4e4a9 100755 --- a/update.sh +++ b/update.sh @@ -122,7 +122,8 @@ copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h md4/md4.h ripemd/ripemd.h whrlpool/whrlpool.h idea/idea.h rc2/rc2.h rc4/rc4.h ui/ui_compat.h txt_db/txt_db.h sm3/sm3.h sm4/sm4.h chacha/chacha.h evp/evp.h poly1305/poly1305.h - camellia/camellia.h gost/gost.h curve25519/curve25519.h" + camellia/camellia.h gost/gost.h curve25519/curve25519.h + ct/ct.h ct/cterr.h" copy_hdrs $libssl_src "srtp.h ssl.h ssl2.h ssl3.h ssl23.h tls1.h dtls1.h" From e8ea73c247069e4e5592b31c0888a8ceb35f7773 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Sat, 27 Nov 2021 22:46:42 +0900 Subject: [PATCH 0014/1283] remove LIBRESSL_CRYPTO_INTERNAL --- crypto/CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 62324a8b93..72fe5a4779 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -1,4 +1,4 @@ -add_definitions(-DLIBRESSL_CRYPTO_INTERNAL) +#add_definitions(-DLIBRESSL_CRYPTO_INTERNAL) if(HOST_ASM_ELF_ARMV4) set( From 31724a737ab8f877c1ee03887e9acf06c7c61119 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 29 Nov 2021 07:40:25 -0600 Subject: [PATCH 0015/1283] Revert "remove LIBRESSL_CRYPTO_INTERNAL" This reverts commit e8ea73c247069e4e5592b31c0888a8ceb35f7773. --- crypto/CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 8cfa9fe49c..7adb31cb2a 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -1,4 +1,4 @@ -#add_definitions(-DLIBRESSL_CRYPTO_INTERNAL) +add_definitions(-DLIBRESSL_CRYPTO_INTERNAL) if(HOST_ASM_ELF_ARMV4) set( From 549ead1f94a2c2168cd162a331c399f5b3963803 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 30 Nov 2021 10:58:12 -0600 Subject: [PATCH 0016/1283] adjust cmake check to include dependencies for netinet/ip.h --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index bcd17f77e4..b24e9304d5 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -296,7 +296,7 @@ if(HAVE_ERR_H) add_definitions(-DHAVE_ERR_H) endif() -check_include_files(netinet/ip.h HAVE_NETINET_IP_H) +check_include_files("sys/types.h;arpa/inet.h;netinet/ip.h" HAVE_NETINET_IP_H) if(HAVE_NETINET_IP_H) add_definitions(-DHAVE_NETINET_IP_H) endif() From 9f9a5a0577b7153a99ae710ca03341a80fbcd03b Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 30 Nov 2021 11:00:50 -0600 Subject: [PATCH 0017/1283] update man links --- man/links | 43 ++++++++++++++++++++++++++++++++++++++----- 1 file changed, 38 insertions(+), 5 deletions(-) diff --git a/man/links b/man/links index 7c5225e65f..684e9b5b3b 100644 --- a/man/links +++ b/man/links @@ -6,14 +6,22 @@ AES_encrypt.3,AES_cbc_encrypt.3 AES_encrypt.3,AES_decrypt.3 AES_encrypt.3,AES_set_decrypt_key.3 AES_encrypt.3,AES_set_encrypt_key.3 +ASN1_BIT_STRING_num_asc.3,ASN1_BIT_STRING_name_print.3 +ASN1_BIT_STRING_num_asc.3,ASN1_BIT_STRING_set_asc.3 +ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_check.3 +ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_get_bit.3 +ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_set_bit.3 ASN1_INTEGER_get.3,ASN1_ENUMERATED_get.3 ASN1_INTEGER_get.3,ASN1_ENUMERATED_set.3 ASN1_INTEGER_get.3,ASN1_ENUMERATED_to_BN.3 +ASN1_INTEGER_get.3,ASN1_INTEGER_cmp.3 +ASN1_INTEGER_get.3,ASN1_INTEGER_dup.3 ASN1_INTEGER_get.3,ASN1_INTEGER_set.3 ASN1_INTEGER_get.3,ASN1_INTEGER_to_BN.3 ASN1_INTEGER_get.3,BN_to_ASN1_ENUMERATED.3 ASN1_INTEGER_get.3,BN_to_ASN1_INTEGER.3 -ASN1_INTEGER_get.3,i2a_ASN1_INTEGER.3 +ASN1_NULL_new.3,ASN1_NULL_free.3 +ASN1_OBJECT_new.3,ASN1_OBJECT_create.3 ASN1_OBJECT_new.3,ASN1_OBJECT_free.3 ASN1_STRING_TABLE_add.3,ASN1_STRING_TABLE_cleanup.3 ASN1_STRING_TABLE_add.3,ASN1_STRING_TABLE_get.3 @@ -21,6 +29,7 @@ ASN1_STRING_length.3,ASN1_OCTET_STRING_cmp.3 ASN1_STRING_length.3,ASN1_OCTET_STRING_dup.3 ASN1_STRING_length.3,ASN1_OCTET_STRING_set.3 ASN1_STRING_length.3,ASN1_STRING_cmp.3 +ASN1_STRING_length.3,ASN1_STRING_copy.3 ASN1_STRING_length.3,ASN1_STRING_data.3 ASN1_STRING_length.3,ASN1_STRING_dup.3 ASN1_STRING_length.3,ASN1_STRING_get0_data.3 @@ -77,6 +86,7 @@ ASN1_TIME_set.3,ASN1_GENERALIZEDTIME_set.3 ASN1_TIME_set.3,ASN1_GENERALIZEDTIME_set_string.3 ASN1_TIME_set.3,ASN1_TIME_adj.3 ASN1_TIME_set.3,ASN1_TIME_check.3 +ASN1_TIME_set.3,ASN1_TIME_diff.3 ASN1_TIME_set.3,ASN1_TIME_print.3 ASN1_TIME_set.3,ASN1_TIME_set_string.3 ASN1_TIME_set.3,ASN1_TIME_to_generalizedtime.3 @@ -88,9 +98,13 @@ ASN1_TIME_set.3,ASN1_UTCTIME_set.3 ASN1_TIME_set.3,ASN1_UTCTIME_set_string.3 ASN1_TYPE_get.3,ASN1_TYPE_cmp.3 ASN1_TYPE_get.3,ASN1_TYPE_free.3 +ASN1_TYPE_get.3,ASN1_TYPE_get_int_octetstring.3 +ASN1_TYPE_get.3,ASN1_TYPE_get_octetstring.3 ASN1_TYPE_get.3,ASN1_TYPE_new.3 ASN1_TYPE_get.3,ASN1_TYPE_set.3 ASN1_TYPE_get.3,ASN1_TYPE_set1.3 +ASN1_TYPE_get.3,ASN1_TYPE_set_int_octetstring.3 +ASN1_TYPE_get.3,ASN1_TYPE_set_octetstring.3 ASN1_generate_nconf.3,ASN1_generate_v3.3 ASN1_item_d2i.3,ASN1_item_d2i_bio.3 ASN1_item_d2i.3,ASN1_item_d2i_fp.3 @@ -98,10 +112,12 @@ ASN1_item_d2i.3,ASN1_item_dup.3 ASN1_item_d2i.3,ASN1_item_i2d.3 ASN1_item_d2i.3,ASN1_item_i2d_bio.3 ASN1_item_d2i.3,ASN1_item_i2d_fp.3 +ASN1_item_d2i.3,ASN1_item_ndef_i2d.3 ASN1_item_d2i.3,ASN1_item_print.3 ASN1_item_d2i.3,d2i_ASN1_TYPE.3 ASN1_item_d2i.3,i2d_ASN1_TYPE.3 ASN1_item_new.3,ASN1_item_free.3 +ASN1_item_pack.3,ASN1_item_unpack.3 ASN1_item_sign.3,ASN1_item_sign_ctx.3 ASN1_mbstring_copy.3,ASN1_STRING_get_default_mask.3 ASN1_mbstring_copy.3,ASN1_STRING_set_by_NID.3 @@ -164,6 +180,7 @@ BIO_f_ssl.3,BIO_set_ssl_renegotiate_bytes.3 BIO_f_ssl.3,BIO_set_ssl_renegotiate_timeout.3 BIO_f_ssl.3,BIO_ssl_copy_session_id.3 BIO_f_ssl.3,BIO_ssl_shutdown.3 +BIO_find_type.3,BIO_method_name.3 BIO_find_type.3,BIO_method_type.3 BIO_find_type.3,BIO_next.3 BIO_get_data.3,BIO_get_shutdown.3 @@ -2000,9 +2017,6 @@ X509_EXTENSION_set_object.3,X509_EXTENSION_set_data.3 X509_INFO_new.3,X509_INFO_free.3 X509_LOOKUP_hash_dir.3,X509_LOOKUP_file.3 X509_LOOKUP_hash_dir.3,X509_LOOKUP_mem.3 -X509_LOOKUP_hash_dir.3,X509_load_cert_crl_file.3 -X509_LOOKUP_hash_dir.3,X509_load_cert_file.3 -X509_LOOKUP_hash_dir.3,X509_load_crl_file.3 X509_LOOKUP_new.3,X509_LOOKUP_add_dir.3 X509_LOOKUP_new.3,X509_LOOKUP_add_mem.3 X509_LOOKUP_new.3,X509_LOOKUP_by_alias.3 @@ -2045,10 +2059,12 @@ X509_NAME_new.3,X509_NAME_free.3 X509_NAME_print_ex.3,X509_NAME_oneline.3 X509_NAME_print_ex.3,X509_NAME_print.3 X509_NAME_print_ex.3,X509_NAME_print_ex_fp.3 +X509_OBJECT_get0_X509.3,X509_OBJECT_free.3 X509_OBJECT_get0_X509.3,X509_OBJECT_free_contents.3 X509_OBJECT_get0_X509.3,X509_OBJECT_get0_X509_CRL.3 X509_OBJECT_get0_X509.3,X509_OBJECT_get_type.3 X509_OBJECT_get0_X509.3,X509_OBJECT_idx_by_subject.3 +X509_OBJECT_get0_X509.3,X509_OBJECT_new.3 X509_OBJECT_get0_X509.3,X509_OBJECT_retrieve_by_subject.3 X509_OBJECT_get0_X509.3,X509_OBJECT_retrieve_match.3 X509_OBJECT_get0_X509.3,X509_OBJECT_up_ref_count.3 @@ -2115,7 +2131,11 @@ X509_STORE_CTX_get_error.3,X509_STORE_CTX_get_chain.3 X509_STORE_CTX_get_error.3,X509_STORE_CTX_get_current_cert.3 X509_STORE_CTX_get_error.3,X509_STORE_CTX_get_error_depth.3 X509_STORE_CTX_get_error.3,X509_STORE_CTX_get_explicit_policy.3 +X509_STORE_CTX_get_error.3,X509_STORE_CTX_get_num_untrusted.3 +X509_STORE_CTX_get_error.3,X509_STORE_CTX_set0_verified_chain.3 +X509_STORE_CTX_get_error.3,X509_STORE_CTX_set_current_cert.3 X509_STORE_CTX_get_error.3,X509_STORE_CTX_set_error.3 +X509_STORE_CTX_get_error.3,X509_STORE_CTX_set_error_depth.3 X509_STORE_CTX_get_error.3,X509_verify_cert_error_string.3 X509_STORE_CTX_get_ex_new_index.3,X509_STORE_CTX_get_app_data.3 X509_STORE_CTX_get_ex_new_index.3,X509_STORE_CTX_get_ex_data.3 @@ -2141,7 +2161,11 @@ X509_STORE_CTX_set_flags.3,X509_STORE_CTX_set_depth.3 X509_STORE_CTX_set_flags.3,X509_STORE_CTX_set_purpose.3 X509_STORE_CTX_set_flags.3,X509_STORE_CTX_set_time.3 X509_STORE_CTX_set_flags.3,X509_STORE_CTX_set_trust.3 +X509_STORE_CTX_set_verify.3,X509_STORE_CTX_get_verify.3 +X509_STORE_CTX_set_verify_cb.3,X509_STORE_CTX_get_verify_cb.3 X509_STORE_get_by_subject.3,X509_STORE_CTX_get1_issuer.3 +X509_STORE_get_by_subject.3,X509_STORE_CTX_get_by_subject.3 +X509_STORE_get_by_subject.3,X509_STORE_CTX_get_obj_by_subject.3 X509_STORE_get_by_subject.3,X509_STORE_get1_certs.3 X509_STORE_get_by_subject.3,X509_STORE_get1_crls.3 X509_STORE_load_locations.3,X509_STORE_add_lookup.3 @@ -2161,7 +2185,6 @@ X509_STORE_set1_param.3,X509_STORE_set_flags.3 X509_STORE_set1_param.3,X509_STORE_set_purpose.3 X509_STORE_set1_param.3,X509_STORE_set_trust.3 X509_STORE_set_verify_cb_func.3,X509_STORE_set_verify_cb.3 -X509_STORE_set_verify_cb_func.3,X509_STORE_set_verify_func.3 X509_TRUST_set.3,X509_TRUST_add.3 X509_TRUST_set.3,X509_TRUST_cleanup.3 X509_TRUST_set.3,X509_TRUST_get0.3 @@ -2211,6 +2234,7 @@ X509_cmp.3,X509_issuer_and_serial_cmp.3 X509_cmp.3,X509_issuer_name_cmp.3 X509_cmp.3,X509_subject_name_cmp.3 X509_cmp_time.3,X509_cmp_current_time.3 +X509_cmp_time.3,X509_gmtime_adj.3 X509_cmp_time.3,X509_time_adj.3 X509_cmp_time.3,X509_time_adj_ex.3 X509_digest.3,PKCS7_ISSUER_AND_SERIAL_digest.3 @@ -2273,12 +2297,15 @@ X509_get_version.3,X509_set_version.3 X509_keyid_set1.3,X509_alias_get0.3 X509_keyid_set1.3,X509_alias_set1.3 X509_keyid_set1.3,X509_keyid_get0.3 +X509_load_cert_file.3,X509_load_cert_crl_file.3 +X509_load_cert_file.3,X509_load_crl_file.3 X509_new.3,X509_REQ_to_X509.3 X509_new.3,X509_chain_up_ref.3 X509_new.3,X509_dup.3 X509_new.3,X509_free.3 X509_new.3,X509_up_ref.3 X509_policy_check.3,X509_policy_tree_free.3 +X509_policy_tree_get0_policies.3,X509_policy_tree_get0_user_policies.3 X509_policy_tree_level_count.3,X509_policy_level_get0_node.3 X509_policy_tree_level_count.3,X509_policy_level_node_count.3 X509_policy_tree_level_count.3,X509_policy_node_get0_parent.3 @@ -2363,6 +2390,7 @@ bn_dump.3,bn_wexpand.3 bn_dump.3,mul.3 bn_dump.3,mul_add.3 bn_dump.3,sqr.3 +d2i_ASN1_BOOLEAN.3,i2d_ASN1_BOOLEAN.3 d2i_ASN1_NULL.3,i2d_ASN1_NULL.3 d2i_ASN1_OBJECT.3,i2d_ASN1_OBJECT.3 d2i_ASN1_OCTET_STRING.3,d2i_ASN1_BIT_STRING.3 @@ -2699,6 +2727,11 @@ get_rfc3526_prime_8192.3,get_rfc3526_prime_2048.3 get_rfc3526_prime_8192.3,get_rfc3526_prime_3072.3 get_rfc3526_prime_8192.3,get_rfc3526_prime_4096.3 get_rfc3526_prime_8192.3,get_rfc3526_prime_6144.3 +i2a_ASN1_STRING.3,a2i_ASN1_ENUMERATED.3 +i2a_ASN1_STRING.3,a2i_ASN1_INTEGER.3 +i2a_ASN1_STRING.3,a2i_ASN1_STRING.3 +i2a_ASN1_STRING.3,i2a_ASN1_ENUMERATED.3 +i2a_ASN1_STRING.3,i2a_ASN1_INTEGER.3 lh_new.3,DECLARE_LHASH_OF.3 lh_new.3,LHASH_COMP_FN_TYPE.3 lh_new.3,LHASH_DOALL_ARG_FN_TYPE.3 From 38181ad3988e823731719df67dc64cafb6437ed5 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 30 Nov 2021 16:49:15 -0600 Subject: [PATCH 0018/1283] add asn1x509 test --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index ff1ab5163d..4bbc5128f0 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -46,6 +46,11 @@ add_executable(asn1time asn1time.c) target_link_libraries(asn1time ${OPENSSL_TEST_LIBS}) add_test(asn1time asn1time) +# asn1x509 +add_executable(asn1x509 asn1x509.c) +target_link_libraries(asn1x509 ${OPENSSL_TEST_LIBS}) +add_test(asn1x509 asn1x509) + # base64test add_executable(base64test base64test.c) target_link_libraries(base64test ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index b426ad0deb..f4da81457f 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -59,6 +59,11 @@ TESTS += asn1time check_PROGRAMS += asn1time asn1time_SOURCES = asn1time.c +# asn1x509 +TESTS += asn1x509 +check_PROGRAMS += asn1x509 +asn1x509_SOURCES = asn1x509.c + # base64test TESTS += base64test check_PROGRAMS += base64test From f2026bb3246cb45bb2fe0d3d93461149862d8d0b Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 30 Nov 2021 16:51:11 -0600 Subject: [PATCH 0019/1283] update man links --- man/links | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/man/links b/man/links index 684e9b5b3b..6c665c0088 100644 --- a/man/links +++ b/man/links @@ -124,7 +124,9 @@ ASN1_mbstring_copy.3,ASN1_STRING_set_by_NID.3 ASN1_mbstring_copy.3,ASN1_STRING_set_default_mask.3 ASN1_mbstring_copy.3,ASN1_STRING_set_default_mask_asc.3 ASN1_mbstring_copy.3,ASN1_mbstring_ncopy.3 +ASN1_mbstring_copy.3,ASN1_tag2bit.3 ASN1_parse_dump.3,ASN1_parse.3 +ASN1_put_object.3,ASN1_object_size.3 ASN1_put_object.3,ASN1_put_eoc.3 ASN1_time_parse.3,ASN1_TIME_set_tm.3 ASN1_time_parse.3,ASN1_time_tm_cmp.3 @@ -157,6 +159,11 @@ BIO_ctrl.3,bio_info_cb.3 BIO_dump.3,BIO_dump_fp.3 BIO_dump.3,BIO_dump_indent.3 BIO_dump.3,BIO_dump_indent_fp.3 +BIO_f_asn1.3,BIO_asn1_get_prefix.3 +BIO_f_asn1.3,BIO_asn1_get_suffix.3 +BIO_f_asn1.3,BIO_asn1_set_prefix.3 +BIO_f_asn1.3,BIO_asn1_set_suffix.3 +BIO_f_asn1.3,asn1_ps_func.3 BIO_f_buffer.3,BIO_get_buffer_num_lines.3 BIO_f_buffer.3,BIO_set_buffer_read_data.3 BIO_f_buffer.3,BIO_set_buffer_size.3 From c211d97ecb351254a1020f2a9eecd47e65ad5484 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Sat, 4 Dec 2021 10:49:59 +0900 Subject: [PATCH 0020/1283] Remove unneeded target_include_directories with cmake This could remove recurring of the same statement for include directories. Instead of this removals, apps/* and tests should have include path that had been provided by INTERFACE_INCLUDE_DIRECTORIES of target libs and internal static libs. --- apps/nc/CMakeLists.txt | 1 + apps/ocspcheck/CMakeLists.txt | 1 + apps/openssl/CMakeLists.txt | 1 + crypto/CMakeLists.txt | 30 ------------------------------ ssl/CMakeLists.txt | 12 ------------ tests/CMakeLists.txt | 1 + tls/CMakeLists.txt | 12 ------------ 7 files changed, 4 insertions(+), 54 deletions(-) diff --git a/apps/nc/CMakeLists.txt b/apps/nc/CMakeLists.txt index a241637d5e..e873de870e 100644 --- a/apps/nc/CMakeLists.txt +++ b/apps/nc/CMakeLists.txt @@ -44,6 +44,7 @@ else() endif() add_executable(nc ${NC_SRC}) +target_include_directories(nc PUBLIC ../../include) target_include_directories(nc PRIVATE . ./compat ../../include/compat) target_link_libraries(nc ${LIBTLS_LIBS}) diff --git a/apps/ocspcheck/CMakeLists.txt b/apps/ocspcheck/CMakeLists.txt index 43b091a5e5..249f0f4a19 100644 --- a/apps/ocspcheck/CMakeLists.txt +++ b/apps/ocspcheck/CMakeLists.txt @@ -28,6 +28,7 @@ else() endif() add_executable(ocspcheck ${OCSPCHECK_SRC}) +target_include_directories(ocspcheck PUBLIC ../../include) target_include_directories(ocspcheck PRIVATE . ./compat ../../include/compat) target_link_libraries(ocspcheck tls ${OPENSSL_LIBS}) diff --git a/apps/openssl/CMakeLists.txt b/apps/openssl/CMakeLists.txt index c5cfbe2383..bb058e1294 100644 --- a/apps/openssl/CMakeLists.txt +++ b/apps/openssl/CMakeLists.txt @@ -77,6 +77,7 @@ if(CMAKE_SYSTEM_NAME MATCHES "Darwin") endif() add_executable(openssl ${OPENSSL_SRC}) +target_include_directories(openssl PUBLIC ../../include) target_include_directories(openssl PRIVATE . ../../include/compat) target_link_libraries(openssl ${OPENSSL_LIBS}) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 7adb31cb2a..75db747219 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -1003,21 +1003,6 @@ target_include_directories(crypto_obj ../include) add_library(crypto $) -target_include_directories(crypto - PRIVATE - . - asn1 - bn - dsa - ec - ecdh - ecdsa - evp - modes - x509 - ../include/compat - PUBLIC - ../include) export_symbol(crypto ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym) target_link_libraries(crypto ${PLATFORM_LIBS}) @@ -1042,21 +1027,6 @@ endif(ENABLE_LIBRESSL_INSTALL) # build static library for regression test if(BUILD_SHARED_LIBS) add_library(crypto-static STATIC $) - target_include_directories(crypto-static - PRIVATE - . - asn1 - bn - dsa - ec - ecdh - ecdsa - evp - modes - x509 - ../include/compat - PUBLIC - ../include) target_link_libraries(crypto-static ${PLATFORM_LIBS}) endif() diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index e4a3d95546..039ef686cf 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -63,12 +63,6 @@ target_include_directories(ssl_obj ../include) add_library(ssl $) -target_include_directories(ssl - PRIVATE - . - ../include/compat - PUBLIC - ../include) export_symbol(ssl ${CMAKE_CURRENT_SOURCE_DIR}/ssl.sym) target_link_libraries(ssl crypto ${PLATFORM_LIBS}) @@ -93,12 +87,6 @@ endif(ENABLE_LIBRESSL_INSTALL) # build static library for regression test if(BUILD_SHARED_LIBS) add_library(ssl-static STATIC $) - target_include_directories(ssl-static - PRIVATE - . - ../include/compat - PUBLIC - ../include) target_link_libraries(ssl-static crypto-static ${PLATFORM_LIBS}) endif() diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 4bbc5128f0..d3725d16ba 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -6,6 +6,7 @@ include_directories( ../ssl ../apps/openssl ../apps/openssl/compat + ../include ../include/compat ) diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 17aedf058c..15e5127698 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -48,12 +48,6 @@ target_include_directories(tls_obj add_library(tls $ $ $) -target_include_directories(tls - PRIVATE - . - ../include/compat - PUBLIC - ../include) export_symbol(tls ${CMAKE_CURRENT_BINARY_DIR}/tls.sym) target_link_libraries(tls ${PLATFORM_LIBS}) @@ -79,12 +73,6 @@ endif(ENABLE_LIBRESSL_INSTALL) if(BUILD_SHARED_LIBS) add_library(tls-static STATIC $ $ $) - target_include_directories(tls-static - PRIVATE - . - ../include/compat - PUBLIC - ../include) target_link_libraries(tls-static ${PLATFORM_LIBS}) endif() From b51803910f138df275f0e97fe846ebbdc786f870 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Sat, 4 Dec 2021 20:55:26 +0900 Subject: [PATCH 0021/1283] Add regress ssl_methods --- tests/CMakeLists.txt | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index d3725d16ba..955f90ef06 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -424,6 +424,11 @@ set_source_files_properties(ssl_get_shared_ciphers.c PROPERTIES COMPILE_FLAGS target_link_libraries(ssl_get_shared_ciphers ${OPENSSL_TEST_LIBS}) add_test(ssl_get_shared_ciphers ssl_get_shared_ciphers) +# ssl_methods +add_executable(ssl_methods ssl_methods.c) +target_link_libraries(ssl_methods ${OPENSSL_TEST_LIBS}) +add_test(ssl_methods ssl_methods) + # ssl_versions add_executable(ssl_versions ssl_versions.c) target_link_libraries(ssl_versions ${OPENSSL_TEST_LIBS}) From 87c45af9e0ed85856ac582e08fc31368f05b4713 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Sat, 4 Dec 2021 20:56:08 +0900 Subject: [PATCH 0022/1283] Sort regress key_schedule --- tests/Makefile.am | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/Makefile.am b/tests/Makefile.am index f4da81457f..93dba92dc9 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -273,6 +273,11 @@ TESTS += igetest check_PROGRAMS += igetest igetest_SOURCES = igetest.c +# key_schedule +TESTS += key_schedule +check_PROGRAMS += key_schedule +key_schedule_SOURCES = key_schedule.c + # keypairtest TESTS += keypairtest.sh keypairtest_CPPFLAGS = -I $(top_srcdir)/tls $(AM_CPPFLAGS) @@ -280,11 +285,6 @@ check_PROGRAMS += keypairtest keypairtest_SOURCES = keypairtest.c EXTRA_DIST += keypairtest.sh -# key_schedule -TESTS += key_schedule -check_PROGRAMS += key_schedule -key_schedule_SOURCES = key_schedule.c - # md4test TESTS += md4test check_PROGRAMS += md4test From 7fe1bf86e1e6bad7af99174c351d17e6f8d40144 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Sat, 4 Dec 2021 20:58:44 +0900 Subject: [PATCH 0023/1283] Fix _PATH_SSL_CA_FILE for ocsp_test --- tests/CMakeLists.txt | 2 +- tests/Makefile.am | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 955f90ef06..5b9652e756 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -10,7 +10,7 @@ include_directories( ../include/compat ) -add_definitions(-D_PATH_SSL_CA_FILE=\"${CMAKE_CURRENT_SOURCE_DIR}/../apps/openssl/cert.pem\") +add_definitions(-D_PATH_SSL_CA_FILE=\"${CMAKE_CURRENT_SOURCE_DIR}/../cert.pem\") file(TO_NATIVE_PATH ${CMAKE_CURRENT_SOURCE_DIR} TEST_SOURCE_DIR) diff --git a/tests/Makefile.am b/tests/Makefile.am index 93dba92dc9..ec87028035 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -6,7 +6,7 @@ AM_CPPFLAGS += -I $(top_srcdir)/crypto/x509 AM_CPPFLAGS += -I $(top_srcdir)/ssl AM_CPPFLAGS += -I $(top_srcdir)/apps/openssl AM_CPPFLAGS += -I $(top_srcdir)/apps/openssl/compat -AM_CPPFLAGS += -D_PATH_SSL_CA_FILE=\"$(top_srcdir)/apps/openssl/cert.pem\" +AM_CPPFLAGS += -D_PATH_SSL_CA_FILE=\"$(top_srcdir)/cert.pem\" LDADD = $(abs_top_builddir)/tls/.libs/libtls.a LDADD += $(abs_top_builddir)/ssl/.libs/libssl.a From a3a03842f68732cc08c0241c40cf99fd11a8a3a4 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Thu, 9 Dec 2021 19:59:29 +0900 Subject: [PATCH 0024/1283] Consolidate d2i_pr.c/i2d_pr.c into a_pkey.c and consolidate d2i_pu.c/i2d_pu.c into a_pubkey.c --- crypto/CMakeLists.txt | 6 ++---- crypto/Makefile.am | 6 ++---- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 75db747219..670df8347f 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -255,6 +255,8 @@ set( asn1/a_mbstr.c asn1/a_object.c asn1/a_octet.c + asn1/a_pkey.c + asn1/a_pubkey.c asn1/a_print.c asn1/a_sign.c asn1/a_strex.c @@ -274,14 +276,10 @@ set( asn1/asn_pack.c asn1/bio_asn1.c asn1/bio_ndef.c - asn1/d2i_pr.c - asn1/d2i_pu.c asn1/evp_asn1.c asn1/f_enum.c asn1/f_int.c asn1/f_string.c - asn1/i2d_pr.c - asn1/i2d_pu.c asn1/n_pkey.c asn1/nsseq.c asn1/p5_pbe.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index ceab62875e..34bdd4310c 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -300,6 +300,8 @@ libcrypto_la_SOURCES += asn1/a_int.c libcrypto_la_SOURCES += asn1/a_mbstr.c libcrypto_la_SOURCES += asn1/a_object.c libcrypto_la_SOURCES += asn1/a_octet.c +libcrypto_la_SOURCES += asn1/a_pkey.c +libcrypto_la_SOURCES += asn1/a_pubkey.c libcrypto_la_SOURCES += asn1/a_print.c libcrypto_la_SOURCES += asn1/a_sign.c libcrypto_la_SOURCES += asn1/a_strex.c @@ -319,14 +321,10 @@ libcrypto_la_SOURCES += asn1/asn_moid.c libcrypto_la_SOURCES += asn1/asn_pack.c libcrypto_la_SOURCES += asn1/bio_asn1.c libcrypto_la_SOURCES += asn1/bio_ndef.c -libcrypto_la_SOURCES += asn1/d2i_pr.c -libcrypto_la_SOURCES += asn1/d2i_pu.c libcrypto_la_SOURCES += asn1/evp_asn1.c libcrypto_la_SOURCES += asn1/f_enum.c libcrypto_la_SOURCES += asn1/f_int.c libcrypto_la_SOURCES += asn1/f_string.c -libcrypto_la_SOURCES += asn1/i2d_pr.c -libcrypto_la_SOURCES += asn1/i2d_pu.c libcrypto_la_SOURCES += asn1/n_pkey.c libcrypto_la_SOURCES += asn1/nsseq.c libcrypto_la_SOURCES += asn1/p5_pbe.c From b10ff615ebb1ceca423a8ad34792aa7952b8ee3a Mon Sep 17 00:00:00 2001 From: kinichiro Date: Sat, 11 Dec 2021 21:00:55 +0900 Subject: [PATCH 0025/1283] Add crypto/bytestring with autotools --- crypto/Makefile.am | 7 +++++++ ssl/Makefile.am | 14 +++++++++----- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 34bdd4310c..83531dbf19 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -4,6 +4,7 @@ AM_CPPFLAGS += -DLIBRESSL_CRYPTO_INTERNAL AM_CPPFLAGS += -I$(top_srcdir)/crypto/asn1 AM_CPPFLAGS += -I$(top_srcdir)/crypto/bn +AM_CPPFLAGS += -I$(top_srcdir)/crypto/bytestring AM_CPPFLAGS += -I$(top_srcdir)/crypto/ec AM_CPPFLAGS += -I$(top_srcdir)/crypto/ecdh AM_CPPFLAGS += -I$(top_srcdir)/crypto/ecdsa @@ -439,6 +440,12 @@ noinst_HEADERS += bn/bn_prime.h libcrypto_la_SOURCES += buffer/buf_err.c libcrypto_la_SOURCES += buffer/buf_str.c libcrypto_la_SOURCES += buffer/buffer.c +noinst_HEADERS += bytestring/bytestring.h + +# bytestring +libcrypto_la_SOURCES += bytestring/bs_ber.c +libcrypto_la_SOURCES += bytestring/bs_cbb.c +libcrypto_la_SOURCES += bytestring/bs_cbs.c # camellia libcrypto_la_SOURCES += camellia/cmll_cfb.c diff --git a/ssl/Makefile.am b/ssl/Makefile.am index d12928e444..8a778cae4a 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -1,7 +1,9 @@ include $(top_srcdir)/Makefile.am.common +noinst_LTLIBRARIES = libbs.la + if ENABLE_LIBTLS_ONLY -noinst_LTLIBRARIES = libssl.la +noinst_LTLIBRARIES += libssl.la else lib_LTLIBRARIES = libssl.la endif @@ -21,11 +23,14 @@ libssl_la_objects.mk: Makefile libssl_la_LDFLAGS = -version-info @LIBSSL_VERSION@ -no-undefined -export-symbols $(top_srcdir)/ssl/ssl.sym libssl_la_LIBADD = $(abs_top_builddir)/crypto/libcrypto.la $(PLATFORM_LDADD) +libssl_la_LIBADD += libbs.la + +libbs_la_SOURCES = bs_ber.c +libbs_la_SOURCES += bs_cbb.c +libbs_la_SOURCES += bs_cbs.c +noinst_HEADERS = bytestring.h libssl_la_SOURCES = bio_ssl.c -libssl_la_SOURCES += bs_ber.c -libssl_la_SOURCES += bs_cbb.c -libssl_la_SOURCES += bs_cbs.c libssl_la_SOURCES += d1_both.c libssl_la_SOURCES += d1_lib.c libssl_la_SOURCES += d1_pkt.c @@ -75,7 +80,6 @@ libssl_la_SOURCES += tls13_record.c libssl_la_SOURCES += tls13_record_layer.c libssl_la_SOURCES += tls13_server.c -noinst_HEADERS = bytestring.h noinst_HEADERS += srtp.h noinst_HEADERS += dtls_locl.h noinst_HEADERS += ssl_locl.h From 244fd5608f9796909a7149f43a81d84e15d36d96 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Sat, 11 Dec 2021 21:03:06 +0900 Subject: [PATCH 0026/1283] Add crypto/bytestring with cmake --- crypto/CMakeLists.txt | 4 ++++ ssl/CMakeLists.txt | 22 ++++++++++++++++++---- 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 670df8347f..4e8a05a474 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -371,6 +371,9 @@ set( buffer/buf_err.c buffer/buf_str.c buffer/buffer.c + bytestring/bs_ber.c + bytestring/bs_cbb.c + bytestring/bs_cbs.c camellia/cmll_cfb.c camellia/cmll_ctr.c camellia/cmll_ecb.c @@ -989,6 +992,7 @@ target_include_directories(crypto_obj . asn1 bn + bytestring dsa ec ecdh diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 039ef686cf..f34627424e 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -1,9 +1,6 @@ set( SSL_SRC bio_ssl.c - bs_ber.c - bs_cbb.c - bs_cbs.c d1_both.c d1_lib.c d1_pkt.c @@ -54,6 +51,13 @@ set( tls13_server.c ) +set( + BS_SRC + bs_ber.c + bs_cbb.c + bs_cbs.c +) + add_library(ssl_obj OBJECT ${SSL_SRC}) target_include_directories(ssl_obj PRIVATE @@ -62,7 +66,17 @@ target_include_directories(ssl_obj PUBLIC ../include) -add_library(ssl $) +add_library(bs_obj OBJECT ${BS_SRC}) +target_include_directories(bs_obj + PRIVATE + . + ../include/compat) + +if(BUILD_SHARED_LIBS) + add_library(ssl $ $) +else() + add_library(ssl $) +endif() export_symbol(ssl ${CMAKE_CURRENT_SOURCE_DIR}/ssl.sym) target_link_libraries(ssl crypto ${PLATFORM_LIBS}) From 858628bc77594d37076f5ba059ee07370adb485b Mon Sep 17 00:00:00 2001 From: kinichiro Date: Sun, 12 Dec 2021 14:37:35 +0900 Subject: [PATCH 0027/1283] Remove bytestring objects from static libssl with autotools --- ssl/Makefile.am | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 8a778cae4a..66d6b48c08 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -8,6 +8,8 @@ else lib_LTLIBRARIES = libssl.la endif +noinst_DATA = remove_bs_objects + EXTRA_DIST = VERSION EXTRA_DIST += CMakeLists.txt EXTRA_DIST += ssl.sym @@ -21,6 +23,11 @@ libssl_la_objects.mk: Makefile | sed 's/ */ $$\(abs_top_builddir\)\/ssl\//g' \ > libssl_la_objects.mk +.PHONY: remove_bs_objects +remove_bs_objects: libssl.la + $(AR) dv $(abs_top_builddir)/ssl/.libs/libssl.a \ + bs_ber.o bs_cbb.o bs_cbs.o + libssl_la_LDFLAGS = -version-info @LIBSSL_VERSION@ -no-undefined -export-symbols $(top_srcdir)/ssl/ssl.sym libssl_la_LIBADD = $(abs_top_builddir)/crypto/libcrypto.la $(PLATFORM_LDADD) libssl_la_LIBADD += libbs.la From 755afbe5e465c4f3b67abe3d053dd3e6e0da3104 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Mon, 13 Dec 2021 20:25:46 +0900 Subject: [PATCH 0028/1283] Ignore ar command error 'ar d' command gets error on macos if specified object not exist. --- ssl/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 66d6b48c08..6f44e484f8 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -25,7 +25,7 @@ libssl_la_objects.mk: Makefile .PHONY: remove_bs_objects remove_bs_objects: libssl.la - $(AR) dv $(abs_top_builddir)/ssl/.libs/libssl.a \ + -$(AR) dv $(abs_top_builddir)/ssl/.libs/libssl.a \ bs_ber.o bs_cbb.o bs_cbs.o libssl_la_LDFLAGS = -version-info @LIBSSL_VERSION@ -no-undefined -export-symbols $(top_srcdir)/ssl/ssl.sym From 26ed65c0b1ed923cd8203b85563c81c946083ad0 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 15 Dec 2021 03:32:25 -0600 Subject: [PATCH 0029/1283] add hmac_local.h --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 2 ++ 2 files changed, 3 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 4e8a05a474..d1be1a839a 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -998,6 +998,7 @@ target_include_directories(crypto_obj ecdh ecdsa evp + hmac modes x509 ../include/compat diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 83531dbf19..d7b13a5d51 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -9,6 +9,7 @@ AM_CPPFLAGS += -I$(top_srcdir)/crypto/ec AM_CPPFLAGS += -I$(top_srcdir)/crypto/ecdh AM_CPPFLAGS += -I$(top_srcdir)/crypto/ecdsa AM_CPPFLAGS += -I$(top_srcdir)/crypto/evp +AM_CPPFLAGS += -I$(top_srcdir)/crypto/hmac AM_CPPFLAGS += -I$(top_srcdir)/crypto/modes AM_CPPFLAGS += -I$(top_srcdir)/crypto/x509 AM_CPPFLAGS += -I$(top_srcdir)/crypto @@ -747,6 +748,7 @@ libcrypto_la_SOURCES += hkdf/hkdf.c libcrypto_la_SOURCES += hmac/hm_ameth.c libcrypto_la_SOURCES += hmac/hm_pmeth.c libcrypto_la_SOURCES += hmac/hmac.c +noinst_HEADERS += hmac/hmac_local.h # idea libcrypto_la_SOURCES += idea/i_cbc.c From 1b95c5d584c5db4f08160299f5bf66acf654875d Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 19 Dec 2021 20:31:26 -0600 Subject: [PATCH 0030/1283] update for asn1 changes --- crypto/CMakeLists.txt | 11 ++++------- crypto/Makefile.am | 11 ++++------- 2 files changed, 8 insertions(+), 14 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index d1be1a839a..12bc8aea2d 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -245,7 +245,6 @@ set( aes/aes_ofb.c aes/aes_wrap.c asn1/a_bitstr.c - asn1/a_bool.c asn1/a_d2i_fp.c asn1/a_digest.c asn1/a_dup.c @@ -256,10 +255,11 @@ set( asn1/a_object.c asn1/a_octet.c asn1/a_pkey.c - asn1/a_pubkey.c asn1/a_print.c + asn1/a_pubkey.c asn1/a_sign.c asn1/a_strex.c + asn1/a_string.c asn1/a_strnid.c asn1/a_time.c asn1/a_time_tm.c @@ -269,23 +269,20 @@ set( asn1/ameth_lib.c asn1/asn1_err.c asn1/asn1_gen.c - asn1/asn1_lib.c + asn1/asn1_old_lib.c asn1/asn1_par.c + asn1/asn1_types.c asn1/asn_mime.c asn1/asn_moid.c asn1/asn_pack.c asn1/bio_asn1.c asn1/bio_ndef.c asn1/evp_asn1.c - asn1/f_enum.c - asn1/f_int.c - asn1/f_string.c asn1/n_pkey.c asn1/nsseq.c asn1/p5_pbe.c asn1/p5_pbev2.c asn1/p8_pkey.c - asn1/t_bitst.c asn1/t_crl.c asn1/t_pkey.c asn1/t_req.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index d7b13a5d51..155df5937a 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -292,7 +292,6 @@ noinst_HEADERS += aes/aes_locl.h # asn1 libcrypto_la_SOURCES += asn1/a_bitstr.c -libcrypto_la_SOURCES += asn1/a_bool.c libcrypto_la_SOURCES += asn1/a_d2i_fp.c libcrypto_la_SOURCES += asn1/a_digest.c libcrypto_la_SOURCES += asn1/a_dup.c @@ -303,10 +302,11 @@ libcrypto_la_SOURCES += asn1/a_mbstr.c libcrypto_la_SOURCES += asn1/a_object.c libcrypto_la_SOURCES += asn1/a_octet.c libcrypto_la_SOURCES += asn1/a_pkey.c -libcrypto_la_SOURCES += asn1/a_pubkey.c libcrypto_la_SOURCES += asn1/a_print.c +libcrypto_la_SOURCES += asn1/a_pubkey.c libcrypto_la_SOURCES += asn1/a_sign.c libcrypto_la_SOURCES += asn1/a_strex.c +libcrypto_la_SOURCES += asn1/a_string.c libcrypto_la_SOURCES += asn1/a_strnid.c libcrypto_la_SOURCES += asn1/a_time.c libcrypto_la_SOURCES += asn1/a_time_tm.c @@ -316,23 +316,20 @@ libcrypto_la_SOURCES += asn1/a_verify.c libcrypto_la_SOURCES += asn1/ameth_lib.c libcrypto_la_SOURCES += asn1/asn1_err.c libcrypto_la_SOURCES += asn1/asn1_gen.c -libcrypto_la_SOURCES += asn1/asn1_lib.c +libcrypto_la_SOURCES += asn1/asn1_old_lib.c libcrypto_la_SOURCES += asn1/asn1_par.c +libcrypto_la_SOURCES += asn1/asn1_types.c libcrypto_la_SOURCES += asn1/asn_mime.c libcrypto_la_SOURCES += asn1/asn_moid.c libcrypto_la_SOURCES += asn1/asn_pack.c libcrypto_la_SOURCES += asn1/bio_asn1.c libcrypto_la_SOURCES += asn1/bio_ndef.c libcrypto_la_SOURCES += asn1/evp_asn1.c -libcrypto_la_SOURCES += asn1/f_enum.c -libcrypto_la_SOURCES += asn1/f_int.c -libcrypto_la_SOURCES += asn1/f_string.c libcrypto_la_SOURCES += asn1/n_pkey.c libcrypto_la_SOURCES += asn1/nsseq.c libcrypto_la_SOURCES += asn1/p5_pbe.c libcrypto_la_SOURCES += asn1/p5_pbev2.c libcrypto_la_SOURCES += asn1/p8_pkey.c -libcrypto_la_SOURCES += asn1/t_bitst.c libcrypto_la_SOURCES += asn1/t_crl.c libcrypto_la_SOURCES += asn1/t_pkey.c libcrypto_la_SOURCES += asn1/t_req.c From adde656bb7a859fb4cc334cb89a00840a7023c2e Mon Sep 17 00:00:00 2001 From: kinichiro Date: Sun, 26 Dec 2021 15:42:47 +0900 Subject: [PATCH 0031/1283] Add strtonum to compat library and export it crypto library requires strtonum now, and add it to compat library. remove it from applications compat/ directories. --- apps/nc/CMakeLists.txt | 8 -------- apps/nc/Makefile.am | 4 ---- apps/ocspcheck/CMakeLists.txt | 8 -------- apps/ocspcheck/Makefile.am | 4 ---- apps/openssl/CMakeLists.txt | 8 -------- apps/openssl/Makefile.am | 4 ---- crypto/CMakeLists.txt | 5 +++++ crypto/Makefile.am | 7 +++++++ tests/optionstest.c | 1 - update.sh | 4 +--- 10 files changed, 13 insertions(+), 40 deletions(-) diff --git a/apps/nc/CMakeLists.txt b/apps/nc/CMakeLists.txt index e873de870e..bd59211f3a 100644 --- a/apps/nc/CMakeLists.txt +++ b/apps/nc/CMakeLists.txt @@ -29,14 +29,6 @@ else() set(NC_SRC ${NC_SRC} compat/readpassphrase.c) endif() -check_function_exists(strtonum HAVE_STRTONUM) -if(HAVE_STRTONUM AND CMAKE_SYSTEM_NAME MATCHES "Darwin" AND - CMAKE_HOST_SYSTEM_VERSION VERSION_GREATER_EQUAL 20) - add_definitions(-DHAVE_STRTONUM) -else() - set(NC_SRC ${NC_SRC} compat/strtonum.c) -endif() - if(NOT "${OPENSSLDIR}" STREQUAL "") add_definitions(-DDEFAULT_CA_FILE=\"${OPENSSLDIR}/cert.pem\") else() diff --git a/apps/nc/Makefile.am b/apps/nc/Makefile.am index 58b5c01188..e9db6e592b 100644 --- a/apps/nc/Makefile.am +++ b/apps/nc/Makefile.am @@ -43,8 +43,4 @@ if !HAVE_READPASSPHRASE nc_SOURCES += compat/readpassphrase.c endif -if !HAVE_STRTONUM -nc_SOURCES += compat/strtonum.c -endif - endif diff --git a/apps/ocspcheck/CMakeLists.txt b/apps/ocspcheck/CMakeLists.txt index 249f0f4a19..2dddb6e2e4 100644 --- a/apps/ocspcheck/CMakeLists.txt +++ b/apps/ocspcheck/CMakeLists.txt @@ -13,14 +13,6 @@ else() set(OCSPCHECK_SRC ${OCSPCHECK_SRC} compat/memmem.c) endif() -check_function_exists(strtonum HAVE_STRTONUM) -if(HAVE_STRTONUM AND CMAKE_SYSTEM_NAME MATCHES "Darwin" AND - CMAKE_HOST_SYSTEM_VERSION VERSION_GREATER_EQUAL 20) - add_definitions(-DHAVE_STRTONUM) -else() - set(OCSPCHECK_SRC ${OCSPCHECK_SRC} compat/strtonum.c) -endif() - if(NOT "${OPENSSLDIR}" STREQUAL "") add_definitions(-DDEFAULT_CA_FILE=\"${OPENSSLDIR}/cert.pem\") else() diff --git a/apps/ocspcheck/Makefile.am b/apps/ocspcheck/Makefile.am index 71a73ea4f6..7c7b454313 100644 --- a/apps/ocspcheck/Makefile.am +++ b/apps/ocspcheck/Makefile.am @@ -22,7 +22,3 @@ noinst_HEADERS = http.h if !HAVE_MEMMEM ocspcheck_SOURCES += compat/memmem.c endif - -if !HAVE_STRTONUM -ocspcheck_SOURCES += compat/strtonum.c -endif diff --git a/apps/openssl/CMakeLists.txt b/apps/openssl/CMakeLists.txt index bb058e1294..2a84178f22 100644 --- a/apps/openssl/CMakeLists.txt +++ b/apps/openssl/CMakeLists.txt @@ -61,14 +61,6 @@ if(WIN32) set(OPENSSL_SRC ${OPENSSL_SRC} compat/poll_win.c) endif() -check_function_exists(strtonum HAVE_STRTONUM) -if(HAVE_STRTONUM AND CMAKE_SYSTEM_NAME MATCHES "Darwin" AND - CMAKE_HOST_SYSTEM_VERSION VERSION_GREATER_EQUAL 20) - add_definitions(-DHAVE_STRTONUM) -else() - set(OPENSSL_SRC ${OPENSSL_SRC} compat/strtonum.c) -endif() - if(CMAKE_SYSTEM_NAME MATCHES "Darwin") check_function_exists(clock_gettime HAVE_CLOCK_GETTIME) if(NOT HAVE_CLOCK_GETTIME) diff --git a/apps/openssl/Makefile.am b/apps/openssl/Makefile.am index b98e08db1a..7cbac48ae6 100644 --- a/apps/openssl/Makefile.am +++ b/apps/openssl/Makefile.am @@ -84,10 +84,6 @@ openssl_SOURCES += compat/clock_gettime_osx.c endif endif -if !HAVE_STRTONUM -openssl_SOURCES += compat/strtonum.c -endif - noinst_HEADERS = apps.h noinst_HEADERS += progs.h noinst_HEADERS += s_apps.h diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 12bc8aea2d..196ae4ae20 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -888,6 +888,11 @@ if(NOT HAVE_STRSEP) set(EXTRA_EXPORT ${EXTRA_EXPORT} strsep) endif() +if(NOT HAVE_STRTONUM) + set(CRYPTO_SRC ${CRYPTO_SRC} compat/strtonum.c) + set(EXTRA_EXPORT ${EXTRA_EXPORT} strtonum) +endif() + if(NOT HAVE_SYSLOG_R) set(CRYPTO_SRC ${CRYPTO_SRC} compat/syslog_r.c) endif() diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 155df5937a..42d0dd9d81 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -76,6 +76,9 @@ endif if !HAVE_STRSEP -echo strsep >> crypto_portable.sym endif +if !HAVE_STRTONUM + -echo strtonum >> crypto_portable.sym +endif if !HAVE_TIMEGM -echo timegm >> crypto_portable.sym endif @@ -175,6 +178,10 @@ if !HAVE_STRSEP libcompat_la_SOURCES += compat/strsep.c endif +if !HAVE_STRTONUM +libcompat_la_SOURCES += compat/strtonum.c +endif + if !HAVE_ASPRINTF libcompat_la_SOURCES += compat/bsd-asprintf.c endif diff --git a/tests/optionstest.c b/tests/optionstest.c index e860f0d9d9..af9dc1ef74 100644 --- a/tests/optionstest.c +++ b/tests/optionstest.c @@ -24,7 +24,6 @@ #include #include -#include /* Needed to keep apps.c happy... */ BIO *bio_err; diff --git a/update.sh b/update.sh index 311ce4e4a9..265afabbb6 100755 --- a/update.sh +++ b/update.sh @@ -82,6 +82,7 @@ for i in crypto/compat; do $libc_src/crypt/chacha_private.h \ $libc_src/stdlib/reallocarray.c \ $libc_src/stdlib/recallocarray.c \ + $libc_src/stdlib/strtonum.c \ $libc_src/string/explicit_bzero.c \ $libc_src/string/strcasecmp.c \ $libc_src/string/strlcpy.c \ @@ -243,7 +244,6 @@ echo "copying nc(1) source" $CP $bin_src/nc/nc.1 apps/nc rm -f apps/nc/*.c apps/nc/*.h $CP_LIBC $libc_src/net/base64.c apps/nc/compat -$CP_LIBC $libc_src/stdlib/strtonum.c apps/nc/compat for i in `awk '/SOURCES|HEADERS|MANS/ { print $3 }' apps/nc/Makefile.am` ; do if [ -e $bin_src/nc/$i ]; then $CP $bin_src/nc/$i apps/nc @@ -255,7 +255,6 @@ echo "copying ocspcheck(1) source" $CP $sbin_src/ocspcheck/ocspcheck.8 apps/ocspcheck rm -f apps/ocspcheck/*.c apps/ocspcheck/*.h $CP_LIBC $libc_src/string/memmem.c apps/ocspcheck/compat -$CP_LIBC $libc_src/stdlib/strtonum.c apps/ocspcheck/compat for i in `awk '/SOURCES|HEADERS|MANS/ { print $3 }' apps/ocspcheck/Makefile.am` ; do if [ -e $sbin_src/ocspcheck/$i ]; then $CP $sbin_src/ocspcheck/$i apps/ocspcheck @@ -265,7 +264,6 @@ done # copy openssl(1) source echo "copying openssl(1) source" $CP $bin_src/openssl/openssl.1 apps/openssl -$CP_LIBC $libc_src/stdlib/strtonum.c apps/openssl/compat $CP $libcrypto_src/cert.pem . $CP $libcrypto_src/openssl.cnf . $CP $libcrypto_src/x509v3.cnf . From e66edcb58f03ba6d6f8e93d71660c4b2ca1114a3 Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Mon, 27 Dec 2021 12:31:17 +0500 Subject: [PATCH 0032/1283] enable scheduled Coverity scan --- .github/workflows/coverity.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 .github/workflows/coverity.yml diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml new file mode 100644 index 0000000000..1f5cee9617 --- /dev/null +++ b/.github/workflows/coverity.yml @@ -0,0 +1,27 @@ +name: Coverity + +on: + schedule: + - cron: "0 0 * * *" + +jobs: + scan: + runs-on: ubuntu-latest + if: ${{ github.repository_owner == 'libressl-portable' }} + env: + COVERITY_SCAN_PROJECT_NAME: 'libressl-portable/portable' + COVERITY_SCAN_BRANCH_PATTERN: '*' + COVERITY_SCAN_NOTIFICATION_EMAIL: 'chipitsine@gmail.com' + COVERITY_SCAN_BUILD_COMMAND_PREPEND: "./autogen.sh && ./configure && make dist && tar zxf libressl-*.tar.gz && rm libressl-*.tar.gz && cd libressl-* && mkdir build-static && mkdir build-shared && cmake -GNinja -DBUILD_SHARED_LIBS=ON .." + COVERITY_SCAN_BUILD_COMMAND: "ninja" + steps: + - uses: actions/checkout@v2 + - name: Install apt dependencies + run: | + sudo apt-get update + sudo apt-get install -y cmake ninja-build + - name: Run Coverity Scan + env: + COVERITY_SCAN_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }} + run: | + curl -fsSL "https://scan.coverity.com/scripts/travisci_build_coverity_scan.sh" | bash || true \ No newline at end of file From 29a743d597880a511107818a04a118c832927ed8 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Sat, 4 Dec 2021 18:55:26 +0900 Subject: [PATCH 0033/1283] Add regress asn1api, asn1basic, asn1complex, asn1string_copy and ec_asn1_test --- .gitignore | 6 ++++++ tests/CMakeLists.txt | 25 +++++++++++++++++++++++++ tests/Makefile.am | 25 +++++++++++++++++++++++++ 3 files changed, 56 insertions(+) diff --git a/.gitignore b/.gitignore index 04cfc1e66f..2a2e1a2fa2 100644 --- a/.gitignore +++ b/.gitignore @@ -57,8 +57,13 @@ test-driver *.trs tests/aes_wrap* tests/arc4random_fork* +tests/asn1api* +tests/asn1basic* +tests/asn1complex* +tests/asn1string_copy* tests/asn1evp* tests/asn1time* +tests/asn1x509* tests/bnaddsub* tests/bn_rand_interval* tests/bn_to_string* @@ -89,6 +94,7 @@ tests/verify* tests/x509_info* tests/x509attribute* tests/x509name* +tests/x509req_ext* !tests/optionstest.c !tests/*.test tests/client.c diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 5b9652e756..0ddbc74de8 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -32,11 +32,31 @@ if(NOT (WIN32 OR (CMAKE_SYSTEM_NAME MATCHES "MINGW"))) add_test(arc4randomforktest ${CMAKE_CURRENT_SOURCE_DIR}/arc4randomforktest.sh) endif() +# asn1api +add_executable(asn1api asn1api.c) +target_link_libraries(asn1api ${OPENSSL_TEST_LIBS}) +add_test(asn1api asn1api) + +# asn1basic +add_executable(asn1basic asn1basic.c) +target_link_libraries(asn1basic ${OPENSSL_TEST_LIBS}) +add_test(asn1basic asn1basic) + +# asn1complex +add_executable(asn1complex asn1complex.c) +target_link_libraries(asn1complex ${OPENSSL_TEST_LIBS}) +add_test(asn1complex asn1complex) + # asn1evp add_executable(asn1evp asn1evp.c) target_link_libraries(asn1evp ${OPENSSL_TEST_LIBS}) add_test(asn1evp asn1evp) +# asn1string_copy +add_executable(asn1string_copy asn1string_copy.c) +target_link_libraries(asn1string_copy ${OPENSSL_TEST_LIBS}) +add_test(asn1string_copy asn1string_copy) + # asn1test add_executable(asn1test asn1test.c) target_link_libraries(asn1test ${OPENSSL_TEST_LIBS}) @@ -170,6 +190,11 @@ if(NOT WIN32) set_tests_properties(dtlstest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") endif() +# ec_asn1_test +add_executable(ec_asn1_test ec_asn1_test.c) +target_link_libraries(ec_asn1_test ${OPENSSL_TEST_LIBS}) +add_test(ec_asn1_test ec_asn1_test) + # ec_point_conversion add_executable(ec_point_conversion ec_point_conversion.c) target_link_libraries(ec_point_conversion ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index ec87028035..eb10eec8d6 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -44,11 +44,31 @@ arc4randomforktest_SOURCES = arc4randomforktest.c endif EXTRA_DIST += arc4randomforktest.sh +# asn1api +TESTS += asn1api +check_PROGRAMS += asn1api +asn1api_SOURCES = asn1api.c + +# asn1basic +TESTS += asn1basic +check_PROGRAMS += asn1basic +asn1basic_SOURCES = asn1basic.c + +# asn1complex +TESTS += asn1complex +check_PROGRAMS += asn1complex +asn1complex_SOURCES = asn1complex.c + # asn1evp TESTS += asn1evp check_PROGRAMS += asn1evp asn1evp_SOURCES = asn1evp.c +# asn1string_copy +TESTS += asn1string_copy +check_PROGRAMS += asn1string_copy +asn1string_copy_SOURCES = asn1string_copy.c + # asn1test TESTS += asn1test check_PROGRAMS += asn1test @@ -182,6 +202,11 @@ dtlstest_SOURCES = dtlstest.c endif EXTRA_DIST += dtlstest.sh +# ec_asn1_test +TESTS += ec_asn1_test +check_PROGRAMS += ec_asn1_test +ec_asn1_test_SOURCES = ec_asn1_test.c + # ec_point_conversion TESTS += ec_point_conversion check_PROGRAMS += ec_point_conversion From 7f5ad60d69c5ade1d3b86c91858b16a78a23c751 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 28 Dec 2021 10:57:19 -0600 Subject: [PATCH 0034/1283] update notification email --- .github/workflows/coverity.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 1f5cee9617..40e7a07673 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -11,7 +11,7 @@ jobs: env: COVERITY_SCAN_PROJECT_NAME: 'libressl-portable/portable' COVERITY_SCAN_BRANCH_PATTERN: '*' - COVERITY_SCAN_NOTIFICATION_EMAIL: 'chipitsine@gmail.com' + COVERITY_SCAN_NOTIFICATION_EMAIL: 'libressl-security@openbsd.org' COVERITY_SCAN_BUILD_COMMAND_PREPEND: "./autogen.sh && ./configure && make dist && tar zxf libressl-*.tar.gz && rm libressl-*.tar.gz && cd libressl-* && mkdir build-static && mkdir build-shared && cmake -GNinja -DBUILD_SHARED_LIBS=ON .." COVERITY_SCAN_BUILD_COMMAND: "ninja" steps: @@ -24,4 +24,4 @@ jobs: env: COVERITY_SCAN_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }} run: | - curl -fsSL "https://scan.coverity.com/scripts/travisci_build_coverity_scan.sh" | bash || true \ No newline at end of file + curl -fsSL "https://scan.coverity.com/scripts/travisci_build_coverity_scan.sh" | bash || true From 71f437de629735e3f54eb0660e419ccc11f7cb7b Mon Sep 17 00:00:00 2001 From: kinichiro Date: Wed, 12 Jan 2022 20:04:53 +0900 Subject: [PATCH 0035/1283] Follow upstream file changes and fix build - Add asn1_lib.c - Consolidation of ASN.1 code Add asn1_item.c asn1_old.c Remove a_d2i_fp.c a_digest.c a_dup.c a_i2d_fp.c a_sign.c a_verify.c - Merge evp_asn1.c into a_type.c - Merge asn_pack.c into asn1_item.c - Rename tls13_key_share.c to tls_key_share.c - Add bio/bio_local.h dh/dh_local.h ocsp/ocsp_local.h - Add comp/comp_local.h - Add define LIBRESSL_CRYPTO_INTERNAL to regress build --- crypto/CMakeLists.txt | 15 +++++++-------- crypto/Makefile.am | 20 ++++++++++++-------- ssl/CMakeLists.txt | 2 +- ssl/Makefile.am | 2 +- tests/CMakeLists.txt | 5 ++++- tests/Makefile.am | 5 ++++- 6 files changed, 29 insertions(+), 20 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 196ae4ae20..4e68731b7e 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -245,11 +245,7 @@ set( aes/aes_ofb.c aes/aes_wrap.c asn1/a_bitstr.c - asn1/a_d2i_fp.c - asn1/a_digest.c - asn1/a_dup.c asn1/a_enum.c - asn1/a_i2d_fp.c asn1/a_int.c asn1/a_mbstr.c asn1/a_object.c @@ -257,7 +253,6 @@ set( asn1/a_pkey.c asn1/a_print.c asn1/a_pubkey.c - asn1/a_sign.c asn1/a_strex.c asn1/a_string.c asn1/a_strnid.c @@ -265,19 +260,19 @@ set( asn1/a_time_tm.c asn1/a_type.c asn1/a_utf8.c - asn1/a_verify.c asn1/ameth_lib.c asn1/asn1_err.c asn1/asn1_gen.c + asn1/asn1_item.c + asn1/asn1_lib.c + asn1/asn1_old.c asn1/asn1_old_lib.c asn1/asn1_par.c asn1/asn1_types.c asn1/asn_mime.c asn1/asn_moid.c - asn1/asn_pack.c asn1/bio_asn1.c asn1/bio_ndef.c - asn1/evp_asn1.c asn1/n_pkey.c asn1/nsseq.c asn1/p5_pbe.c @@ -993,8 +988,10 @@ target_include_directories(crypto_obj PRIVATE . asn1 + bio bn bytestring + dh dsa ec ecdh @@ -1002,6 +999,8 @@ target_include_directories(crypto_obj evp hmac modes + ocsp + rsa x509 ../include/compat PUBLIC diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 42d0dd9d81..ced4ed87b7 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -3,14 +3,19 @@ include $(top_srcdir)/Makefile.am.common AM_CPPFLAGS += -DLIBRESSL_CRYPTO_INTERNAL AM_CPPFLAGS += -I$(top_srcdir)/crypto/asn1 +AM_CPPFLAGS += -I$(top_srcdir)/crypto/bio AM_CPPFLAGS += -I$(top_srcdir)/crypto/bn AM_CPPFLAGS += -I$(top_srcdir)/crypto/bytestring +AM_CPPFLAGS += -I$(top_srcdir)/crypto/dh +AM_CPPFLAGS += -I$(top_srcdir)/crypto/dsa AM_CPPFLAGS += -I$(top_srcdir)/crypto/ec AM_CPPFLAGS += -I$(top_srcdir)/crypto/ecdh AM_CPPFLAGS += -I$(top_srcdir)/crypto/ecdsa AM_CPPFLAGS += -I$(top_srcdir)/crypto/evp AM_CPPFLAGS += -I$(top_srcdir)/crypto/hmac AM_CPPFLAGS += -I$(top_srcdir)/crypto/modes +AM_CPPFLAGS += -I$(top_srcdir)/crypto/ocsp +AM_CPPFLAGS += -I$(top_srcdir)/crypto/rsa AM_CPPFLAGS += -I$(top_srcdir)/crypto/x509 AM_CPPFLAGS += -I$(top_srcdir)/crypto @@ -299,11 +304,7 @@ noinst_HEADERS += aes/aes_locl.h # asn1 libcrypto_la_SOURCES += asn1/a_bitstr.c -libcrypto_la_SOURCES += asn1/a_d2i_fp.c -libcrypto_la_SOURCES += asn1/a_digest.c -libcrypto_la_SOURCES += asn1/a_dup.c libcrypto_la_SOURCES += asn1/a_enum.c -libcrypto_la_SOURCES += asn1/a_i2d_fp.c libcrypto_la_SOURCES += asn1/a_int.c libcrypto_la_SOURCES += asn1/a_mbstr.c libcrypto_la_SOURCES += asn1/a_object.c @@ -311,7 +312,6 @@ libcrypto_la_SOURCES += asn1/a_octet.c libcrypto_la_SOURCES += asn1/a_pkey.c libcrypto_la_SOURCES += asn1/a_print.c libcrypto_la_SOURCES += asn1/a_pubkey.c -libcrypto_la_SOURCES += asn1/a_sign.c libcrypto_la_SOURCES += asn1/a_strex.c libcrypto_la_SOURCES += asn1/a_string.c libcrypto_la_SOURCES += asn1/a_strnid.c @@ -319,19 +319,19 @@ libcrypto_la_SOURCES += asn1/a_time.c libcrypto_la_SOURCES += asn1/a_time_tm.c libcrypto_la_SOURCES += asn1/a_type.c libcrypto_la_SOURCES += asn1/a_utf8.c -libcrypto_la_SOURCES += asn1/a_verify.c libcrypto_la_SOURCES += asn1/ameth_lib.c libcrypto_la_SOURCES += asn1/asn1_err.c libcrypto_la_SOURCES += asn1/asn1_gen.c +libcrypto_la_SOURCES += asn1/asn1_item.c +libcrypto_la_SOURCES += asn1/asn1_lib.c +libcrypto_la_SOURCES += asn1/asn1_old.c libcrypto_la_SOURCES += asn1/asn1_old_lib.c libcrypto_la_SOURCES += asn1/asn1_par.c libcrypto_la_SOURCES += asn1/asn1_types.c libcrypto_la_SOURCES += asn1/asn_mime.c libcrypto_la_SOURCES += asn1/asn_moid.c -libcrypto_la_SOURCES += asn1/asn_pack.c libcrypto_la_SOURCES += asn1/bio_asn1.c libcrypto_la_SOURCES += asn1/bio_ndef.c -libcrypto_la_SOURCES += asn1/evp_asn1.c libcrypto_la_SOURCES += asn1/n_pkey.c libcrypto_la_SOURCES += asn1/nsseq.c libcrypto_la_SOURCES += asn1/p5_pbe.c @@ -408,6 +408,7 @@ endif libcrypto_la_SOURCES += bio/bss_mem.c libcrypto_la_SOURCES += bio/bss_null.c libcrypto_la_SOURCES += bio/bss_sock.c +noinst_HEADERS += bio/bio_local.h # bn libcrypto_la_SOURCES += bn/bn_add.c @@ -501,6 +502,7 @@ libcrypto_la_SOURCES += comp/c_rle.c libcrypto_la_SOURCES += comp/c_zlib.c libcrypto_la_SOURCES += comp/comp_err.c libcrypto_la_SOURCES += comp/comp_lib.c +noinst_HEADERS += comp/comp_local.h # conf libcrypto_la_SOURCES += conf/conf_api.c @@ -569,6 +571,7 @@ libcrypto_la_SOURCES += dh/dh_key.c libcrypto_la_SOURCES += dh/dh_lib.c libcrypto_la_SOURCES += dh/dh_pmeth.c libcrypto_la_SOURCES += dh/dh_prn.c +noinst_HEADERS += dh/dh_local.h # dsa libcrypto_la_SOURCES += dsa/dsa_ameth.c @@ -806,6 +809,7 @@ libcrypto_la_SOURCES += ocsp/ocsp_lib.c libcrypto_la_SOURCES += ocsp/ocsp_prn.c libcrypto_la_SOURCES += ocsp/ocsp_srv.c libcrypto_la_SOURCES += ocsp/ocsp_vfy.c +noinst_HEADERS += ocsp/ocsp_local.h # pem libcrypto_la_SOURCES += pem/pem_all.c diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index f34627424e..a20cb04232 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -35,6 +35,7 @@ set( t1_lib.c tls_buffer.c tls_content.c + tls_key_share.c tls12_key_schedule.c tls12_lib.c tls12_record_layer.c @@ -43,7 +44,6 @@ set( tls13_handshake.c tls13_handshake_msg.c tls13_key_schedule.c - tls13_key_share.c tls13_legacy.c tls13_lib.c tls13_record.c diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 6f44e484f8..227dfdf187 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -72,6 +72,7 @@ libssl_la_SOURCES += t1_enc.c libssl_la_SOURCES += t1_lib.c libssl_la_SOURCES += tls_buffer.c libssl_la_SOURCES += tls_content.c +libssl_la_SOURCES += tls_key_share.c libssl_la_SOURCES += tls12_key_schedule.c libssl_la_SOURCES += tls12_lib.c libssl_la_SOURCES += tls12_record_layer.c @@ -80,7 +81,6 @@ libssl_la_SOURCES += tls13_error.c libssl_la_SOURCES += tls13_handshake.c libssl_la_SOURCES += tls13_handshake_msg.c libssl_la_SOURCES += tls13_key_schedule.c -libssl_la_SOURCES += tls13_key_share.c libssl_la_SOURCES += tls13_legacy.c libssl_la_SOURCES += tls13_lib.c libssl_la_SOURCES += tls13_record.c diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 0ddbc74de8..d4c36cce47 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -1,7 +1,10 @@ +add_definitions(-DLIBRESSL_CRYPTO_INTERNAL) + include_directories( . - ../crypto/modes ../crypto/asn1 + ../crypto/bio + ../crypto/modes ../crypto/x509 ../ssl ../apps/openssl diff --git a/tests/Makefile.am b/tests/Makefile.am index eb10eec8d6..2737ebb8f8 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -1,7 +1,10 @@ include $(top_srcdir)/Makefile.am.common -AM_CPPFLAGS += -I $(top_srcdir)/crypto/modes +AM_CPPFLAGS += -DLIBRESSL_CRYPTO_INTERNAL + AM_CPPFLAGS += -I $(top_srcdir)/crypto/asn1 +AM_CPPFLAGS += -I $(top_srcdir)/crypto/bio +AM_CPPFLAGS += -I $(top_srcdir)/crypto/modes AM_CPPFLAGS += -I $(top_srcdir)/crypto/x509 AM_CPPFLAGS += -I $(top_srcdir)/ssl AM_CPPFLAGS += -I $(top_srcdir)/apps/openssl From 5372a1c07acf182d6336d9fb9215c8a70c953283 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Thu, 13 Jan 2022 19:29:31 +0900 Subject: [PATCH 0036/1283] Use Previous VS2019 image with Appveyor --- appveyor.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/appveyor.yml b/appveyor.yml index 6c6ba16296..8e4d7ced8c 100644 --- a/appveyor.yml +++ b/appveyor.yml @@ -1,26 +1,26 @@ image: - - Visual Studio 2019 + - Previous Visual Studio 2019 environment: PATH: C:\msys64\usr\bin;C:\msys64\mingw64\bin;C:\Windows\System32;C:\Windows;%PATH% matrix: - - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2019 + - APPVEYOR_BUILD_WORKER_IMAGE: Previous Visual Studio 2019 GENERATOR: Visual Studio 16 2019 ARCHITECTURE: Win32 CONFIG: Release SHARED_LIBS: ON - - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2019 + - APPVEYOR_BUILD_WORKER_IMAGE: Previous Visual Studio 2019 GENERATOR: Visual Studio 16 2019 ARCHITECTURE: Win32 CONFIG: Release SHARED_LIBS: OFF - - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2019 + - APPVEYOR_BUILD_WORKER_IMAGE: Previous Visual Studio 2019 GENERATOR: Visual Studio 16 2019 ARCHITECTURE: x64 CONFIG: Release SHARED_LIBS: ON - - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2019 + - APPVEYOR_BUILD_WORKER_IMAGE: Previous Visual Studio 2019 GENERATOR: Visual Studio 16 2019 ARCHITECTURE: x64 CONFIG: Release From ea53dcd569c3a7aed1d9ad65b520488599120ded Mon Sep 17 00:00:00 2001 From: kinichiro Date: Fri, 14 Jan 2022 21:44:08 +0900 Subject: [PATCH 0037/1283] Fix build - Remove pem/pem_seal.c asn1/x_nx509.c asn1/n_pkey.c - Remove evp/m_dss.c evp/m_dss1.c evp/m_ecdsa.c - Add include path crypto/bio to libssl for bio_local.h --- crypto/CMakeLists.txt | 6 ------ crypto/Makefile.am | 6 ------ ssl/CMakeLists.txt | 1 + ssl/Makefile.am | 2 ++ 4 files changed, 3 insertions(+), 12 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 4e68731b7e..9b66d9f69a 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -273,7 +273,6 @@ set( asn1/asn_moid.c asn1/bio_asn1.c asn1/bio_ndef.c - asn1/n_pkey.c asn1/nsseq.c asn1/p5_pbe.c asn1/p5_pbev2.c @@ -299,7 +298,6 @@ set( asn1/x_info.c asn1/x_long.c asn1/x_name.c - asn1/x_nx509.c asn1/x_pkey.c asn1/x_pubkey.c asn1/x_req.c @@ -556,9 +554,6 @@ set( evp/evp_lib.c evp/evp_pbe.c evp/evp_pkey.c - evp/m_dss.c - evp/m_dss1.c - evp/m_ecdsa.c evp/m_gost2814789.c evp/m_gostr341194.c evp/m_md4.c @@ -642,7 +637,6 @@ set( pem/pem_oth.c pem/pem_pk8.c pem/pem_pkey.c - pem/pem_seal.c pem/pem_sign.c pem/pem_x509.c pem/pem_xaux.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index ced4ed87b7..0f39753c46 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -332,7 +332,6 @@ libcrypto_la_SOURCES += asn1/asn_mime.c libcrypto_la_SOURCES += asn1/asn_moid.c libcrypto_la_SOURCES += asn1/bio_asn1.c libcrypto_la_SOURCES += asn1/bio_ndef.c -libcrypto_la_SOURCES += asn1/n_pkey.c libcrypto_la_SOURCES += asn1/nsseq.c libcrypto_la_SOURCES += asn1/p5_pbe.c libcrypto_la_SOURCES += asn1/p5_pbev2.c @@ -358,7 +357,6 @@ libcrypto_la_SOURCES += asn1/x_exten.c libcrypto_la_SOURCES += asn1/x_info.c libcrypto_la_SOURCES += asn1/x_long.c libcrypto_la_SOURCES += asn1/x_name.c -libcrypto_la_SOURCES += asn1/x_nx509.c libcrypto_la_SOURCES += asn1/x_pkey.c libcrypto_la_SOURCES += asn1/x_pubkey.c libcrypto_la_SOURCES += asn1/x_req.c @@ -700,9 +698,6 @@ libcrypto_la_SOURCES += evp/evp_key.c libcrypto_la_SOURCES += evp/evp_lib.c libcrypto_la_SOURCES += evp/evp_pbe.c libcrypto_la_SOURCES += evp/evp_pkey.c -libcrypto_la_SOURCES += evp/m_dss.c -libcrypto_la_SOURCES += evp/m_dss1.c -libcrypto_la_SOURCES += evp/m_ecdsa.c libcrypto_la_SOURCES += evp/m_gost2814789.c libcrypto_la_SOURCES += evp/m_gostr341194.c libcrypto_la_SOURCES += evp/m_md4.c @@ -819,7 +814,6 @@ libcrypto_la_SOURCES += pem/pem_lib.c libcrypto_la_SOURCES += pem/pem_oth.c libcrypto_la_SOURCES += pem/pem_pk8.c libcrypto_la_SOURCES += pem/pem_pkey.c -libcrypto_la_SOURCES += pem/pem_seal.c libcrypto_la_SOURCES += pem/pem_sign.c libcrypto_la_SOURCES += pem/pem_x509.c libcrypto_la_SOURCES += pem/pem_xaux.c diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index a20cb04232..cec241705c 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -62,6 +62,7 @@ add_library(ssl_obj OBJECT ${SSL_SRC}) target_include_directories(ssl_obj PRIVATE . + ../crypto/bio ../include/compat PUBLIC ../include) diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 227dfdf187..7eb0ccd03e 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -1,5 +1,7 @@ include $(top_srcdir)/Makefile.am.common +AM_CPPFLAGS += -I$(top_srcdir)/crypto/bio + noinst_LTLIBRARIES = libbs.la if ENABLE_LIBTLS_ONLY From 9a18f4247e2eef970c491969afaaec0e07d3c5d1 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Mon, 17 Jan 2022 19:04:23 +0900 Subject: [PATCH 0038/1283] Add libmd as platform specific libraries for Solaris --- CMakeLists.txt | 2 +- m4/check-os-options.m4 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index b24e9304d5..03963a59f6 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -98,7 +98,7 @@ if(CMAKE_SYSTEM_NAME MATCHES "SunOS") set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -D_XOPEN_SOURCE=600") set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DBSD_COMP") set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fpic") - set(PLATFORM_LIBS ${PLATFORM_LIBS} nsl socket) + set(PLATFORM_LIBS ${PLATFORM_LIBS} dl md nsl socket) endif() add_definitions(-DLIBRESSL_INTERNAL) diff --git a/m4/check-os-options.m4 b/m4/check-os-options.m4 index 8080dcbafe..bd389384b9 100644 --- a/m4/check-os-options.m4 +++ b/m4/check-os-options.m4 @@ -123,7 +123,7 @@ char buf[1]; getentropy(buf, 1); HOST_OS=solaris HOST_ABI=elf CPPFLAGS="$CPPFLAGS -D__EXTENSIONS__ -D_XOPEN_SOURCE=600 -DBSD_COMP" - AC_SUBST([PLATFORM_LDADD], ['-ldl -lnsl -lsocket']) + AC_SUBST([PLATFORM_LDADD], ['-ldl -lmd -lnsl -lsocket']) ;; *) ;; esac From 0a6a5119fdca5c1b44f0215dac52ae0ae7f8ea46 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 18 Jan 2022 04:57:50 -0600 Subject: [PATCH 0039/1283] update man links --- man/links | 40 +++++++++++++++++++++++++++++++++------- 1 file changed, 33 insertions(+), 7 deletions(-) diff --git a/man/links b/man/links index 6c665c0088..b81e55dd42 100644 --- a/man/links +++ b/man/links @@ -245,6 +245,7 @@ BIO_printf.3,BIO_vprintf.3 BIO_printf.3,BIO_vsnprintf.3 BIO_push.3,BIO_pop.3 BIO_read.3,BIO_gets.3 +BIO_read.3,BIO_indent.3 BIO_read.3,BIO_puts.3 BIO_read.3,BIO_write.3 BIO_s_accept.3,BIO_do_accept.3 @@ -326,14 +327,22 @@ BN_add.3,BN_exp.3 BN_add.3,BN_gcd.3 BN_add.3,BN_mod.3 BN_add.3,BN_mod_add.3 +BN_add.3,BN_mod_add_quick.3 BN_add.3,BN_mod_exp.3 +BN_add.3,BN_mod_lshift.3 +BN_add.3,BN_mod_lshift1.3 +BN_add.3,BN_mod_lshift1_quick.3 +BN_add.3,BN_mod_lshift_quick.3 BN_add.3,BN_mod_mul.3 BN_add.3,BN_mod_sqr.3 BN_add.3,BN_mod_sub.3 +BN_add.3,BN_mod_sub_quick.3 BN_add.3,BN_mul.3 BN_add.3,BN_nnmod.3 BN_add.3,BN_sqr.3 BN_add.3,BN_sub.3 +BN_add.3,BN_uadd.3 +BN_add.3,BN_usub.3 BN_add_word.3,BN_div_word.3 BN_add_word.3,BN_mod_word.3 BN_add_word.3,BN_mul_word.3 @@ -351,6 +360,7 @@ BN_bn2bin.3,BN_lebin2bn.3 BN_bn2bin.3,BN_mpi2bn.3 BN_bn2bin.3,BN_print.3 BN_bn2bin.3,BN_print_fp.3 +BN_cmp.3,BN_abs_is_word.3 BN_cmp.3,BN_is_odd.3 BN_cmp.3,BN_is_one.3 BN_cmp.3,BN_is_word.3 @@ -378,6 +388,7 @@ BN_mod_mul_montgomery.3,BN_MONT_CTX_free.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_init.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_new.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_set.3 +BN_mod_mul_montgomery.3,BN_MONT_CTX_set_locked.3 BN_mod_mul_montgomery.3,BN_from_montgomery.3 BN_mod_mul_montgomery.3,BN_to_montgomery.3 BN_mod_mul_reciprocal.3,BN_RECP_CTX_free.3 @@ -403,10 +414,12 @@ BN_set_bit.3,BN_rshift.3 BN_set_bit.3,BN_rshift1.3 BN_set_flags.3,BN_get_flags.3 BN_set_negative.3,BN_is_negative.3 +BN_swap.3,BN_consttime_swap.3 BN_zero.3,BN_get_word.3 BN_zero.3,BN_one.3 BN_zero.3,BN_set_word.3 BN_zero.3,BN_value_one.3 +BN_zero.3,BN_zero_ex.3 BUF_MEM_new.3,BUF_MEM_free.3 BUF_MEM_new.3,BUF_MEM_grow.3 BUF_MEM_new.3,BUF_MEM_grow_clean.3 @@ -835,6 +848,8 @@ ESS_SIGNING_CERT_new.3,ESS_ISSUER_SERIAL_free.3 ESS_SIGNING_CERT_new.3,ESS_ISSUER_SERIAL_new.3 ESS_SIGNING_CERT_new.3,ESS_SIGNING_CERT_free.3 EVP_AEAD_CTX_init.3,EVP_AEAD_CTX_cleanup.3 +EVP_AEAD_CTX_init.3,EVP_AEAD_CTX_free.3 +EVP_AEAD_CTX_init.3,EVP_AEAD_CTX_new.3 EVP_AEAD_CTX_init.3,EVP_AEAD_CTX_open.3 EVP_AEAD_CTX_init.3,EVP_AEAD_CTX_seal.3 EVP_AEAD_CTX_init.3,EVP_AEAD_key_length.3 @@ -869,8 +884,6 @@ EVP_DigestInit.3,EVP_MD_block_size.3 EVP_DigestInit.3,EVP_MD_pkey_type.3 EVP_DigestInit.3,EVP_MD_size.3 EVP_DigestInit.3,EVP_MD_type.3 -EVP_DigestInit.3,EVP_dss.3 -EVP_DigestInit.3,EVP_dss1.3 EVP_DigestInit.3,EVP_get_digestbyname.3 EVP_DigestInit.3,EVP_get_digestbynid.3 EVP_DigestInit.3,EVP_get_digestbyobj.3 @@ -1190,11 +1203,9 @@ GENERAL_NAME_new.3,GENERAL_NAMES_new.3 GENERAL_NAME_new.3,GENERAL_NAME_free.3 GENERAL_NAME_new.3,OTHERNAME_free.3 GENERAL_NAME_new.3,OTHERNAME_new.3 -HMAC.3,HMAC_CTX_cleanup.3 HMAC.3,HMAC_CTX_copy.3 HMAC.3,HMAC_CTX_free.3 HMAC.3,HMAC_CTX_get_md.3 -HMAC.3,HMAC_CTX_init.3 HMAC.3,HMAC_CTX_new.3 HMAC.3,HMAC_CTX_reset.3 HMAC.3,HMAC_CTX_set_flags.3 @@ -1202,7 +1213,6 @@ HMAC.3,HMAC_Final.3 HMAC.3,HMAC_Init.3 HMAC.3,HMAC_Init_ex.3 HMAC.3,HMAC_Update.3 -HMAC.3,HMAC_cleanup.3 HMAC.3,HMAC_size.3 MD5.3,MD4.3 MD5.3,MD4_Final.3 @@ -1214,9 +1224,23 @@ MD5.3,MD5_Update.3 NAME_CONSTRAINTS_new.3,GENERAL_SUBTREE_free.3 NAME_CONSTRAINTS_new.3,GENERAL_SUBTREE_new.3 NAME_CONSTRAINTS_new.3,NAME_CONSTRAINTS_free.3 -OBJ_nid2obj.3,OBJ_cleanup.3 +OBJ_NAME_add.3,OBJ_NAME_cleanup.3 +OBJ_NAME_add.3,OBJ_NAME_do_all.3 +OBJ_NAME_add.3,OBJ_NAME_do_all_sorted.3 +OBJ_NAME_add.3,OBJ_NAME_get.3 +OBJ_NAME_add.3,OBJ_NAME_init.3 +OBJ_NAME_add.3,OBJ_NAME_new_index.3 +OBJ_NAME_add.3,OBJ_NAME_remove.3 +OBJ_add_sigid.3,OBJ_find_sigid_algs.3 +OBJ_add_sigid.3,OBJ_find_sigid_by_algs.3 +OBJ_add_sigid.3,OBJ_sigid_free.3 +OBJ_create.3,OBJ_add_object.3 +OBJ_create.3,OBJ_cleanup.3 +OBJ_create.3,OBJ_create_objects.3 +OBJ_create.3,OBJ_new_nid.3 +OBJ_create.3,check_defer.3 +OBJ_create.3,obj_cleanup_defer.3 OBJ_nid2obj.3,OBJ_cmp.3 -OBJ_nid2obj.3,OBJ_create.3 OBJ_nid2obj.3,OBJ_dup.3 OBJ_nid2obj.3,OBJ_ln2nid.3 OBJ_nid2obj.3,OBJ_nid2ln.3 @@ -2418,6 +2442,7 @@ d2i_ASN1_OCTET_STRING.3,d2i_ASN1_UTF8STRING.3 d2i_ASN1_OCTET_STRING.3,d2i_ASN1_VISIBLESTRING.3 d2i_ASN1_OCTET_STRING.3,d2i_DIRECTORYSTRING.3 d2i_ASN1_OCTET_STRING.3,d2i_DISPLAYTEXT.3 +d2i_ASN1_OCTET_STRING.3,i2c_ASN1_INTEGER.3 d2i_ASN1_OCTET_STRING.3,i2d_ASN1_BIT_STRING.3 d2i_ASN1_OCTET_STRING.3,i2d_ASN1_BMPSTRING.3 d2i_ASN1_OCTET_STRING.3,i2d_ASN1_ENUMERATED.3 @@ -2759,6 +2784,7 @@ lh_new.3,lh_error.3 lh_new.3,lh_free.3 lh_new.3,lh_insert.3 lh_new.3,lh_retrieve.3 +lh_new.3,lh_strhash.3 lh_stats.3,lh_node_stats.3 lh_stats.3,lh_node_stats_bio.3 lh_stats.3,lh_node_usage_stats.3 From 3412032b52902c1c9bc890ad62abb44388c6b2bc Mon Sep 17 00:00:00 2001 From: kinichiro Date: Wed, 26 Jan 2022 21:24:18 +0900 Subject: [PATCH 0040/1283] Add tls/tls_signer.c --- tls/CMakeLists.txt | 1 + tls/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 15e5127698..7827a5ebae 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -7,6 +7,7 @@ set( tls_conninfo.c tls_keypair.c tls_server.c + tls_signer.c tls_ocsp.c tls_peer.c tls_util.c diff --git a/tls/Makefile.am b/tls/Makefile.am index 4cea3a266d..4d31c9282f 100644 --- a/tls/Makefile.am +++ b/tls/Makefile.am @@ -30,6 +30,7 @@ libtls_la_SOURCES += tls_config.c libtls_la_SOURCES += tls_conninfo.c libtls_la_SOURCES += tls_keypair.c libtls_la_SOURCES += tls_server.c +libtls_la_SOURCES += tls_signer.c libtls_la_SOURCES += tls_ocsp.c libtls_la_SOURCES += tls_peer.c libtls_la_SOURCES += tls_util.c From 298b1e58344657b790abec69188bf524a219bbf6 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Mon, 31 Jan 2022 19:28:39 +0900 Subject: [PATCH 0041/1283] Add regress evp_pkey_check --- .gitignore | 1 + tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 3 files changed, 11 insertions(+) diff --git a/.gitignore b/.gitignore index 2a2e1a2fa2..cd7e2ec6a6 100644 --- a/.gitignore +++ b/.gitignore @@ -70,6 +70,7 @@ tests/bn_to_string* tests/cipher* tests/constraints* tests/ec_point_conversion* +tests/evp_pkey_check* tests/explicit_bzero* tests/freenull* tests/gost2814789t* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index d4c36cce47..8df7f09b6c 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -223,6 +223,11 @@ add_executable(enginetest enginetest.c) target_link_libraries(enginetest ${OPENSSL_TEST_LIBS}) add_test(enginetest enginetest) +# evp_pkey_check +add_executable(evp_pkey_check evp_pkey_check.c) +target_link_libraries(evp_pkey_check ${OPENSSL_TEST_LIBS}) +add_test(evp_pkey_check evp_pkey_check) + # evptest add_executable(evptest evptest.c) target_link_libraries(evptest ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 2737ebb8f8..4dc97e601b 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -235,6 +235,11 @@ TESTS += enginetest check_PROGRAMS += enginetest enginetest_SOURCES = enginetest.c +# evp_pkey_check +TESTS += evp_pkey_check +check_PROGRAMS += evp_pkey_check +evp_pkey_check_SOURCES = evp_pkey_check.c + # evptest TESTS += evptest.sh check_PROGRAMS += evptest From e70d8cba5c448f2229cb1114efa2684fc4e5d4f7 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Mon, 27 Dec 2021 19:17:45 +0900 Subject: [PATCH 0042/1283] Add regress rfc3779 --- .gitignore | 1 + tests/CMakeLists.txt | 6 ++++++ tests/Makefile.am | 6 ++++++ 3 files changed, 13 insertions(+) diff --git a/.gitignore b/.gitignore index cd7e2ec6a6..5e09e1b6a7 100644 --- a/.gitignore +++ b/.gitignore @@ -76,6 +76,7 @@ tests/freenull* tests/gost2814789t* tests/key_schedule* tests/mont* +tests/rfc3779* tests/rfc5280time* tests/ssl_get_shared_ciphers* tests/ssl_methods* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 8df7f09b6c..58895ada91 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -396,6 +396,12 @@ add_executable(record_layer_test record_layer_test.c) target_link_libraries(record_layer_test ${OPENSSL_TEST_LIBS}) add_test(record_layer_test record_layer_test) +# rfc3779 +add_executable(rfc3779 rfc3779.c) +set_source_files_properties(rfc3779.c PROPERTIES COMPILE_FLAGS -D__unused=) +target_link_libraries(rfc3779 ${OPENSSL_TEST_LIBS}) +add_test(rfc3779 rfc3779) + # rfc5280time add_executable(rfc5280time rfc5280time.c) target_link_libraries(rfc5280time ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 4dc97e601b..6ba51ba350 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -403,6 +403,12 @@ TESTS += record_layer_test check_PROGRAMS += record_layer_test record_layer_test_SOURCES = record_layer_test.c +# rfc3779 +TESTS += rfc3779 +rfc3779_CPPFLAGS = $(AM_CPPFLAGS) -D__unused= +check_PROGRAMS += rfc3779 +rfc3779_SOURCES = rfc3779.c + # rfc5280time check_PROGRAMS += rfc5280time rfc5280time_SOURCES = rfc5280time.c From a27642bf418cb1d464d2d19226e5a13007068cf6 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 6 Feb 2022 21:11:52 -0600 Subject: [PATCH 0043/1283] rebase patches --- patches/speed.c.patch | 22 +++++++++++----------- patches/tlsexttest.c.patch | 16 ++++++++-------- 2 files changed, 19 insertions(+), 19 deletions(-) diff --git a/patches/speed.c.patch b/patches/speed.c.patch index 28b060bc15..11f9f03a36 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -1,6 +1,6 @@ ---- apps/openssl/speed.c.orig Tue Jul 2 21:58:28 2019 -+++ apps/openssl/speed.c Sun Jul 14 19:39:44 2019 -@@ -159,7 +159,16 @@ static void +--- apps/openssl/speed.c.orig Sun Feb 6 20:37:16 2022 ++++ apps/openssl/speed.c Sun Feb 6 21:07:42 2022 +@@ -159,7 +159,16 @@ pkey_print_message(const char *str, const char *str2, long num, int bits, int sec); static void print_result(int alg, int run_no, int count, double time_used); @@ -17,7 +17,7 @@ #define ALGOR_NUM 32 #define SIZE_NUM 5 -@@ -466,8 +475,10 @@ speed_main(int argc, char **argv) +@@ -466,8 +475,10 @@ const EVP_CIPHER *evp_cipher = NULL; const EVP_MD *evp_md = NULL; int decrypt = 0; @@ -28,7 +28,7 @@ if (single_execution) { if (pledge("stdio proc", NULL) == -1) { -@@ -544,6 +555,7 @@ speed_main(int argc, char **argv) +@@ -544,6 +555,7 @@ j--; /* Otherwise, -decrypt gets confused with an * algorithm. */ } @@ -36,7 +36,7 @@ else if ((argc > 0) && (strcmp(*argv, "-multi") == 0)) { argc--; argv++; -@@ -559,6 +571,7 @@ speed_main(int argc, char **argv) +@@ -559,6 +571,7 @@ j--; /* Otherwise, -multi gets confused with an * algorithm. */ } @@ -44,7 +44,7 @@ else if (argc > 0 && !strcmp(*argv, "-mr")) { mr = 1; j--; /* Otherwise, -mr gets confused with an -@@ -921,7 +934,9 @@ speed_main(int argc, char **argv) +@@ -921,7 +934,9 @@ BIO_printf(bio_err, "-evp e use EVP e.\n"); BIO_printf(bio_err, "-decrypt time decryption instead of encryption (only EVP).\n"); BIO_printf(bio_err, "-mr produce machine readable output.\n"); @@ -54,7 +54,7 @@ goto end; } argc--; -@@ -929,8 +944,10 @@ speed_main(int argc, char **argv) +@@ -929,8 +944,10 @@ j++; } @@ -65,7 +65,7 @@ if (j == 0) { for (i = 0; i < ALGOR_NUM; i++) { -@@ -1771,7 +1788,9 @@ speed_main(int argc, char **argv) +@@ -1807,7 +1824,9 @@ ecdh_doit[j] = 0; } } @@ -75,7 +75,7 @@ if (!mr) { fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION)); fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON)); -@@ -1944,11 +1963,15 @@ pkey_print_message(const char *str, const char *str2, +@@ -1980,11 +1999,15 @@ static void print_result(int alg, int run_no, int count, double time_used) { @@ -91,7 +91,7 @@ static char * sstrsep(char **string, const char *delim) { -@@ -2155,4 +2178,5 @@ do_multi(int multi) +@@ -2191,4 +2214,5 @@ free(fds); return 1; } diff --git a/patches/tlsexttest.c.patch b/patches/tlsexttest.c.patch index f81c196e51..be73102808 100644 --- a/patches/tlsexttest.c.patch +++ b/patches/tlsexttest.c.patch @@ -1,5 +1,5 @@ ---- tests/tlsexttest.c.orig Mon Apr 5 01:40:26 2021 -+++ tests/tlsexttest.c Thu Apr 8 04:17:13 2021 +--- tests/tlsexttest.c.orig Sun Feb 6 20:37:16 2022 ++++ tests/tlsexttest.c Sun Feb 6 21:07:42 2022 @@ -1658,7 +1658,9 @@ }; @@ -10,7 +10,7 @@ static int test_tlsext_sni_client(void) -@@ -1821,9 +1823,9 @@ +@@ -1843,9 +1845,9 @@ if (!CBB_finish(&cbb, &data, &dlen)) errx(1, "failed to finish CBB"); @@ -22,7 +22,7 @@ goto err; } -@@ -1832,14 +1834,14 @@ +@@ -1854,14 +1856,14 @@ fprintf(stderr, "received:\n"); hexdump(data, dlen); fprintf(stderr, "test data:\n"); @@ -39,7 +39,7 @@ if (!tlsext_sni_client_parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) { FAIL("failed to parse server SNI\n"); goto err; -@@ -2723,7 +2725,10 @@ +@@ -2746,7 +2748,10 @@ 0x04, 0x03, 0x02, 0x01, 0x02, 0x03, }; @@ -51,9 +51,9 @@ static int test_tlsext_clienthello_build(void) -@@ -2791,18 +2796,18 @@ - if (!CBB_finish(&cbb, &data, &dlen)) - errx(1, "failed to finish CBB"); +@@ -2823,18 +2828,18 @@ + goto err; + } - if (dlen != sizeof(tlsext_clienthello_disabled)) { + if (dlen != sizeof_tlsext_clienthello_disabled) { From 2a4b84081f151b577c5457991ee60f02c4f0711b Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Sat, 12 Feb 2022 09:55:39 +0500 Subject: [PATCH 0044/1283] CI: enable ASAN on Linux --- .github/workflows/linux_test_asan.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .github/workflows/linux_test_asan.yml diff --git a/.github/workflows/linux_test_asan.yml b/.github/workflows/linux_test_asan.yml new file mode 100644 index 0000000000..90270246bf --- /dev/null +++ b/.github/workflows/linux_test_asan.yml @@ -0,0 +1,23 @@ +name: linux_ci_asan + +on: [push, pull_request] + +jobs: + build-native: + strategy: + matrix: + os: [ubuntu-latest] + compiler: [gcc] + runs-on: ${{ matrix.os }} + continue-on-error: false + env: + CC: ${{ matrix.compiler }} + ARCH: native + CFLAGS: "-ggdb -fsanitize=address" + LDFLAGS: "-fsanitize=address" + CTEST_OUTPUT_ON_FAILURE: 1 + name: ${{ matrix.compiler }} - ${{ matrix.os }} + steps: + - uses: actions/checkout@v2 + - name: Run CI script + run: ./scripts/test From 314555aa93eeab326beccc37cc61b2139b563946 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 13 Feb 2022 20:57:51 +0100 Subject: [PATCH 0045/1283] LibreSSL 3.5.0 initial changelog --- ChangeLog | 234 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 234 insertions(+) diff --git a/ChangeLog b/ChangeLog index 83a8946a99..8c73750c59 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,6 +28,240 @@ history is also available from Git. LibreSSL Portable Release Notes: +3.5.0 - Development release + * New Features + - libtls has a new tls_signer interface to help privsep daemons + separate their secrets from the network facing processes. + Documentation will follow. + - The RFC 3779 API was ported from OpenSSL. Many bugs were fixed, + regression tests were added and the code was cleaned up. + - Certificate Transparency was ported from OpenSSL. Many internal + improvements were made, resulting in cleaner and safer code. + Regress coverage was added. libssl does not yet make use of it. + * Portable Improvements + - Fixed various POSIX compliance and other portability issues + found by the port to the Sortix operating system. + * Compatibility Changes + - Most structs that were previously defined in the following headers + are now opaque as they are in OpenSSL 1.1: + bio.h, bn.h, comp.h, dh.h, dsa.h, evp.h, hmac.h, ocsp.h, rsa.h, + x509.h, x509v3.h, x509_vfy.h + - Switch TLSv1.3 cipher names from AEAD- to OpenSSL's TLS_ + OpenSSL added the TLSv1.3 ciphersuites with "RFC names" instead + of using something consistent with the previous naming. Various + test suites expect these names (instead of checking for the much + more sensible cipher numbers). The old names are still accepted + as aliases. + - Subject alternative names and name constraints are now validated + when they are added to certificates. Various interoperability + problems with stacks that validate certificates more strictly + than OpenSSL can be avoided this way. + - Attempt to opportunistically use the host name for SNI in s_client + * Bug fixes + - In some situations, the verifier would discard the error on an + unvalidated certificate chain. This would happen when the + verification callback was in use, instructing the verifier to + continue unconditionally. This could lead to incorrect decisions + being made in software. + - Avoid an infinite loop in SSL_shutdown() + - Fix another return 0 bug in SSL_shutdown() + - Handle zero byte reads/writes that trigger handshakes in the + TLSv1.3 stack + - A long standing memleak in libtls CRL handling was fixed + * Internal Improvements + - Cache the SHA-512 hash instead of the SHA-1 hash and cache + notBefore and notAfter times when X.509 certificates are parsed. + - The X.509 lookup code has been simplified and cleaned up. + - Fixed numerous issues flagged by coverity and the cryptofuzz + project + - Increased the number of Miller-Rabin checks in DH and DSA + key/parameter generation + - Started using the bytestring API in libcrypto for cleaner and + safer code + - Convert {i2d,d2i}_{,EC_,DSA_,RSA_}PUBKEY{,_bio,_fp}() to templated + ASN1 + - Convert ASN1_OBJECT_new() to calloc() + - Convert ASN1_STRING_type_new() to calloc() + - Rewrite ASN1_STRING_cmp() + - Use calloc() for X509_CRL_METHOD_new() instead of malloc() + - Convert ASN1_PCTX_new() to calloc() + - Replace asn1_tlc_clear and asn1_tlc_clear_nc macros with a + function + - Consolidate {d2i,i2d}_{pr,pu}.c + - Remove handling of a NULL BUF_MEM from asn1_collect() + - Pull the recursion depth check up to the top of asn1_collect() + - Inline collect_data() in asn1_collect() + - Convert asn1_d2i_ex_primitive()/asn1_collect() from BUF_MEM to CBB + - Clean up d2i_ASN1_BOOLEAN() and i2d_ASN1_BOOLEAN() + - Consolidate ASN.1 universal tag type data + - Rewrite ASN.1 identifier/length parsing in CBS + - Make OBJ_obj2nid() work correctly with NID_undef + - tlsext_tick_lifetime_hint is now an uint32_t + - Untangle ssl3_get_message() return values + - Rename tls13_buffer to tls_buffer + - Fold DTLS_STATE_INTERNAL into DTLS1_STATE + - Provide a way to determine our maximum legacy version + - Mop up enc_read_ctx and read_hash + - Fold SSL_SESSION_INTERNAL into SSL_SESSION + - Use ssl_force_want_read in the DTLS code + - Add record processing limit to DTLS code + - Add explicit CBS_contains_zero_byte() check in CBS_strdup() + - Improve SNI hostname validation + - Ensure SSL_set_tlsext_host_name() is given a valid hostname + - Fix a strange check in the auto DH codepath + - Factor out/rewrite DHE key exchange + - Convert server serialisation of DHE parameters/public key to new + functions + - Check DH public key in ssl_kex_peer_public_dhe() + - Move the minimum DHE key size check into ssl_kex_peer_params_dhe() + - Clean up and refactor server side DHE key exchange + - Provide CBS_get_last_u8() + - Provide CBS_get_u64() + - Provide CBS_add_u64() + - Provide various CBS_peek_* functions + - Use CBS_get_last_u8() to find the content type in TLSv1.3 records + - unifdef TLS13_USE_LEGACY_CLIENT_AUTH + - Correct SSL_get_peer_cert_chain() when used with the TLSv1.3 stack + - Only allow zero length key shares when we know we're doing HRR + - Pull key share group/length CBB code up from + tls13_key_share_public() + - Refactor ssl3_get_server_kex_ecdhe() to separate parsing and + validation + - Return 0 on failure from send/get kex functions in the legacy + stack + - Rename tls13_key_share to tls_key_share + - Allocate and free the EVP_AEAD_CTX struct in + tls13_record_protection + - Convert legacy TLS client to tls_key_share + - Convert legacy TLS server to tls_key_share + - Stop attempting to duplicate the public and private key of dh_tmp + - Rename dh_tmp to dhe_params + - Rename CERT to SSL_CERT and CERT_PKEY to SSL_CERT_PKEY + - Clean up pkey handling in ssl3_get_server_key_exchange() + - Fix GOST skip certificate verify handling + - Simplify tlsext_keyshare_server_parse() + - Plumb decode errors through key share parsing code + - Simplify SSL_get_peer_certificate() + - Cleanup/simplify ssl_cert_type() + - The S3I macro was removed + - The openssl(1) cms and smime subcommands option handling was + converted and the C source was cleaned up. + * Documentation improvements + - 45 new manual pages, most of which were written from scratch. + Documentation coverage of ASN.1 and X.509 code has been + significantly improved. + * API additions and removals + - libtls API additions + tls_config_set_sign_cb tls_signer_add_keypair_file + tls_signer_add_keypair_mem tls_signer_free tls_signer_new + tls_signer_sign + - libssl + API additions + SSL_get0_verified_chain SSL_peek_ex SSL_read_ex SSL_write_ex + API stubs for compatibility + SSL_CTX_get_keylog_callback SSL_CTX_get_num_tickets + SSL_CTX_set_keylog_callback SSL_CTX_set_num_tickets + SSL_get_num_tickets SSL_set_num_tickets + - libcrypto + added API (some of these were previously available as macros): + ASIdOrRange_free ASIdOrRange_new ASIdentifierChoice_free + ASIdentifierChoice_new ASIdentifiers_free ASIdentifiers_new + ASN1_TIME_diff ASRange_free ASRange_new BIO_get_callback_ex + BIO_get_init BIO_set_callback_ex BIO_set_next + BIO_set_retry_reason BN_GENCB_set BN_GENCB_set_old + BN_abs_is_word BN_bn2lebinpad BN_get_flags BN_is_negative + BN_is_odd BN_is_one BN_is_word BN_is_zero BN_set_flags + BN_to_montgomery BN_with_flags BN_zero_ex CTLOG_STORE_free + CTLOG_STORE_get0_log_by_id CTLOG_STORE_load_default_file + CTLOG_STORE_load_file CTLOG_STORE_new CTLOG_free + CTLOG_get0_log_id CTLOG_get0_name CTLOG_get0_public_key + CTLOG_new CTLOG_new_from_base64 CT_POLICY_EVAL_CTX_free + CT_POLICY_EVAL_CTX_get0_cert CT_POLICY_EVAL_CTX_get0_issuer + CT_POLICY_EVAL_CTX_get0_log_store CT_POLICY_EVAL_CTX_get_time + CT_POLICY_EVAL_CTX_new CT_POLICY_EVAL_CTX_set1_cert + CT_POLICY_EVAL_CTX_set1_issuer + CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE + CT_POLICY_EVAL_CTX_set_time DH_get0_g DH_get0_p DH_get0_priv_key + DH_get0_pub_key DH_get0_q DH_get_length DSA_bits DSA_get0_g + DSA_get0_p DSA_get0_priv_key DSA_get0_pub_key DSA_get0_q + ECDSA_SIG_get0_r ECDSA_SIG_get0_s EVP_AEAD_CTX_free + EVP_AEAD_CTX_new EVP_CIPHER_CTX_buf_noconst + EVP_CIPHER_CTX_get_cipher_data EVP_CIPHER_CTX_set_cipher_data + EVP_MD_CTX_md_data EVP_MD_CTX_pkey_ctx EVP_MD_CTX_set_pkey_ctx + EVP_MD_meth_dup EVP_MD_meth_free EVP_MD_meth_new + EVP_MD_meth_set_app_datasize EVP_MD_meth_set_cleanup + EVP_MD_meth_set_copy EVP_MD_meth_set_ctrl EVP_MD_meth_set_final + EVP_MD_meth_set_flags EVP_MD_meth_set_init + EVP_MD_meth_set_input_blocksize EVP_MD_meth_set_result_size + EVP_MD_meth_set_update EVP_PKEY_asn1_set_check + EVP_PKEY_asn1_set_param_check EVP_PKEY_asn1_set_public_check + EVP_PKEY_check EVP_PKEY_meth_set_check + EVP_PKEY_meth_set_param_check EVP_PKEY_meth_set_public_check + EVP_PKEY_param_check EVP_PKEY_public_check FIPS_mode + FIPS_mode_set IPAddressChoice_free IPAddressChoice_new + IPAddressFamily_free IPAddressFamily_new IPAddressOrRange_free + IPAddressOrRange_new IPAddressRange_free IPAddressRange_new + OBJ_get0_data OBJ_length OCSP_resp_get0_certs OCSP_resp_get0_id + OCSP_resp_get0_produced_at OCSP_resp_get0_respdata + OCSP_resp_get0_signature OCSP_resp_get0_signer + OCSP_resp_get0_tbs_sigalg PEM_write_bio_PrivateKey_traditional + RSA_get0_d RSA_get0_dmp1 RSA_get0_dmq1 RSA_get0_e RSA_get0_iqmp + RSA_get0_n RSA_get0_p RSA_get0_pss_params RSA_get0_q + SCT_LIST_free SCT_LIST_print SCT_LIST_validate SCT_free + SCT_get0_extensions SCT_get0_log_id SCT_get0_signature + SCT_get_log_entry_type SCT_get_signature_nid SCT_get_source + SCT_get_timestamp SCT_get_validation_status SCT_get_version + SCT_new SCT_new_from_base64 SCT_print SCT_set0_extensions + SCT_set0_log_id SCT_set0_signature SCT_set1_extensions + SCT_set1_log_id SCT_set1_signature SCT_set_log_entry_type + SCT_set_signature_nid SCT_set_source SCT_set_timestamp + SCT_set_version SCT_validate SCT_validation_status_string + X509_OBJECT_free X509_OBJECT_new X509_REQ_get0_pubkey + X509_SIG_get0 X509_SIG_getm X509_STORE_CTX_get_by_subject + X509_STORE_CTX_get_num_untrusted + X509_STORE_CTX_get_obj_by_subject X509_STORE_CTX_get_verify + X509_STORE_CTX_get_verify_cb X509_STORE_CTX_set0_verified_chain + X509_STORE_CTX_set_current_cert X509_STORE_CTX_set_error_depth + X509_STORE_CTX_set_verify X509_STORE_get_verify + X509_STORE_get_verify_cb X509_STORE_set_verify + X509_get_X509_PUBKEY X509_get_extended_key_usage + X509_get_extension_flags X509_get_key_usage + X509v3_addr_add_inherit X509v3_addr_add_prefix + X509v3_addr_add_range X509v3_addr_canonize X509v3_addr_get_afi + X509v3_addr_get_range X509v3_addr_inherits + X509v3_addr_is_canonical X509v3_addr_subset + X509v3_addr_validate_path X509v3_addr_validate_resource_set + X509v3_asid_add_id_or_range X509v3_asid_add_inherit + X509v3_asid_canonize X509v3_asid_inherits + X509v3_asid_is_canonical X509v3_asid_subset + X509v3_asid_validate_path X509v3_asid_validate_resource_set + d2i_ASIdOrRange d2i_ASIdentifierChoice d2i_ASIdentifiers + d2i_ASRange d2i_IPAddressChoice d2i_IPAddressFamily + d2i_IPAddressOrRange d2i_IPAddressRange d2i_SCT_LIST + i2d_ASIdOrRange i2d_ASIdentifierChoice i2d_ASIdentifiers + i2d_ASRange i2d_IPAddressChoice i2d_IPAddressFamily + i2d_IPAddressOrRange i2d_IPAddressRange i2d_SCT_LIST + i2d_re_X509_CRL_tbs i2d_re_X509_REQ_tbs i2d_re_X509_tbs i2o_SCT + i2o_SCT_LIST o2i_SCT o2i_SCT_LIST + removed API: + ASN1_check_infinite_end ASN1_const_check_infinite_end EVP_dss + EVP_dss1 EVP_ecdsa HMAC_CTX_cleanup HMAC_CTX_init + NETSCAPE_ENCRYPTED_PKEY_free NETSCAPE_ENCRYPTED_PKEY_new + NETSCAPE_PKEY_free NETSCAPE_PKEY_new NETSCAPE_X509_free + NETSCAPE_X509_new OBJ_bsearch_ex_ PEM_SealFinal PEM_SealInit + PEM_SealUpdate PEM_read_X509_CERT_PAIR + PEM_read_bio_X509_CERT_PAIR PEM_write_X509_CERT_PAIR + PEM_write_bio_X509_CERT_PAIR X509_CERT_PAIR_free + X509_CERT_PAIR_new X509_OBJECT_free_contents asn1_do_adb + asn1_do_lock asn1_enc_free asn1_enc_init asn1_enc_restore + asn1_enc_save asn1_ex_c2i asn1_get_choice_selector + asn1_get_field_ptr asn1_set_choice_selector check_defer + d2i_ASN1_BOOLEAN d2i_NETSCAPE_ENCRYPTED_PKEY d2i_NETSCAPE_PKEY + d2i_NETSCAPE_X509 d2i_Netscape_RSA d2i_RSA_NET + d2i_X509_CERT_PAIR i2d_ASN1_BOOLEAN i2d_NETSCAPE_ENCRYPTED_PKEY + i2d_NETSCAPE_PKEY i2d_NETSCAPE_X509 i2d_Netscape_RSA i2d_RSA_NET + i2d_X509_CERT_PAIR name_cmp obj_cleanup_defer + 3.4.1 - Stable release * New Features From f026757d12bb4c17cec63993d6062ab36050403c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 17 Feb 2022 21:39:54 +0100 Subject: [PATCH 0046/1283] Don't mention tls_signer yet. It's not ready yet. --- ChangeLog | 3 --- 1 file changed, 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 8c73750c59..ba84b2b85e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -30,9 +30,6 @@ LibreSSL Portable Release Notes: 3.5.0 - Development release * New Features - - libtls has a new tls_signer interface to help privsep daemons - separate their secrets from the network facing processes. - Documentation will follow. - The RFC 3779 API was ported from OpenSSL. Many bugs were fixed, regression tests were added and the code was cleaned up. - Certificate Transparency was ported from OpenSSL. Many internal From 75388d4d2bc110fc6ebac7bfcaf752884753498b Mon Sep 17 00:00:00 2001 From: kinichiro Date: Fri, 18 Feb 2022 20:49:17 +0900 Subject: [PATCH 0047/1283] Add portable improvements to changelog --- ChangeLog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ChangeLog b/ChangeLog index ba84b2b85e..60617e69e5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -38,6 +38,12 @@ LibreSSL Portable Release Notes: * Portable Improvements - Fixed various POSIX compliance and other portability issues found by the port to the Sortix operating system. + - Add libmd as platform specific libraries for Solaris. + Issue reported from (ihsan opencsw org) on libressl ML. + - Set IA-64 compiler flag only if it is HP-UX with IA-64. + Suggested from Larkin Nickle (me larbob org) by libressl ML. + - Enabled and scheduled Coverity scan. + Contributed by Ilya Shipitsin (chipitsine gmail com> on github. * Compatibility Changes - Most structs that were previously defined in the following headers are now opaque as they are in OpenSSL 1.1: From 2e9a7653b7aa2bde1da2cda15d0e278742ea29fc Mon Sep 17 00:00:00 2001 From: kinichiro Date: Fri, 18 Feb 2022 23:47:45 +0900 Subject: [PATCH 0048/1283] Update changelog --- ChangeLog | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index 60617e69e5..d68f43854b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -154,10 +154,6 @@ LibreSSL Portable Release Notes: Documentation coverage of ASN.1 and X.509 code has been significantly improved. * API additions and removals - - libtls API additions - tls_config_set_sign_cb tls_signer_add_keypair_file - tls_signer_add_keypair_mem tls_signer_free tls_signer_new - tls_signer_sign - libssl API additions SSL_get0_verified_chain SSL_peek_ex SSL_read_ex SSL_write_ex @@ -172,7 +168,7 @@ LibreSSL Portable Release Notes: ASN1_TIME_diff ASRange_free ASRange_new BIO_get_callback_ex BIO_get_init BIO_set_callback_ex BIO_set_next BIO_set_retry_reason BN_GENCB_set BN_GENCB_set_old - BN_abs_is_word BN_bn2lebinpad BN_get_flags BN_is_negative + BN_abs_is_word BN_get_flags BN_is_negative BN_is_odd BN_is_one BN_is_word BN_is_zero BN_set_flags BN_to_montgomery BN_with_flags BN_zero_ex CTLOG_STORE_free CTLOG_STORE_get0_log_by_id CTLOG_STORE_load_default_file From 6b06bed084292702ce8983dfbdad2efcb5b3db2e Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Wed, 23 Feb 2022 10:09:03 +0500 Subject: [PATCH 0049/1283] install missing dependencies for AppVeyor --- appveyor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/appveyor.yml b/appveyor.yml index 8e4d7ced8c..bdb8001a46 100644 --- a/appveyor.yml +++ b/appveyor.yml @@ -30,7 +30,7 @@ init: # update mysy2 - C:\msys64\usr\bin\bash -lc "pacman --needed --noconfirm -Sy pacman-mirrors" - C:\msys64\usr\bin\bash -lc "pacman --noconfirm -Syu" - - C:\msys64\usr\bin\bash -lc "pacman --noconfirm -Sy autoconf perl git" + - C:\msys64\usr\bin\bash -lc "pacman --noconfirm -Sy autoconf perl git automake libtool" before_build: - bash autogen.sh From 115cf2d553e6310e02a117ebe9985b33c0be6245 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 27 Feb 2022 05:37:43 -0600 Subject: [PATCH 0050/1283] rebase patches --- patches/bio.h.patch | 24 +++++++++++++----------- patches/bn_lcl.h.patch | 6 +++--- patches/tlsexttest.c.patch | 8 ++++---- patches/windows_headers.patch | 9 ++++----- 4 files changed, 24 insertions(+), 23 deletions(-) diff --git a/patches/bio.h.patch b/patches/bio.h.patch index e726e20d03..29bba0ce16 100644 --- a/patches/bio.h.patch +++ b/patches/bio.h.patch @@ -1,12 +1,12 @@ ---- include/openssl/bio.h.orig 2018-07-24 21:59:17.000000000 -0500 -+++ include/openssl/bio.h 2018-11-07 18:44:43.000000000 -0600 -@@ -713,6 +713,22 @@ - +--- include/openssl/bio.h.orig Fri Feb 18 16:30:39 2022 ++++ include/openssl/bio.h Mon Feb 21 05:39:35 2022 +@@ -666,8 +666,24 @@ + /*long BIO_ghbn_ctrl(int cmd,int iarg,char *parg);*/ - + +#ifdef __MINGW_PRINTF_FORMAT -+int -+BIO_printf(BIO *bio, const char *format, ...) + int + BIO_printf(BIO *bio, const char *format, ...) + __attribute__((__format__(__MINGW_PRINTF_FORMAT, 2, 3), __nonnull__(2))); +int +BIO_vprintf(BIO *bio, const char *format, va_list args) @@ -20,15 +20,17 @@ + __attribute__((__deprecated__, __format__(__MINGW_PRINTF_FORMAT, 3, 0), + __nonnull__(3))); +#else - int - BIO_printf(BIO *bio, const char *format, ...) ++int ++BIO_printf(BIO *bio, const char *format, ...) __attribute__((__format__(__printf__, 2, 3), __nonnull__(2))); -@@ -727,6 +743,8 @@ + int + BIO_vprintf(BIO *bio, const char *format, va_list args) +@@ -680,6 +696,8 @@ BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args) __attribute__((__deprecated__, __format__(__printf__, 3, 0), __nonnull__(3))); +#endif + - + /* BEGIN ERROR CODES */ /* The following lines are auto generated by the script mkerr.pl. Any changes diff --git a/patches/bn_lcl.h.patch b/patches/bn_lcl.h.patch index 184bbd7b9c..84835ed789 100644 --- a/patches/bn_lcl.h.patch +++ b/patches/bn_lcl.h.patch @@ -1,6 +1,6 @@ ---- ./openbsd/src/lib/libcrypto/bn/bn_lcl.h 2018-12-17 06:59:43.067523154 -0600 -+++ ./crypto/bn/bn_lcl.h 2019-01-20 19:43:53.679717457 -0600 -@@ -239,7 +239,7 @@ +--- ./crypto/bn/bn_lcl.h.orig Fri Feb 18 16:30:39 2022 ++++ ./crypto/bn/bn_lcl.h Mon Feb 21 05:39:35 2022 +@@ -283,7 +283,7 @@ : "r"(a), "r"(b)); \ ret; }) # endif /* compiler */ diff --git a/patches/tlsexttest.c.patch b/patches/tlsexttest.c.patch index be73102808..b1b86524c3 100644 --- a/patches/tlsexttest.c.patch +++ b/patches/tlsexttest.c.patch @@ -1,5 +1,5 @@ ---- tests/tlsexttest.c.orig Sun Feb 6 20:37:16 2022 -+++ tests/tlsexttest.c Sun Feb 6 21:07:42 2022 +--- tests/tlsexttest.c.orig Fri Feb 18 16:30:40 2022 ++++ tests/tlsexttest.c Mon Feb 21 05:39:35 2022 @@ -1658,7 +1658,9 @@ }; @@ -39,7 +39,7 @@ if (!tlsext_sni_client_parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) { FAIL("failed to parse server SNI\n"); goto err; -@@ -2746,7 +2748,10 @@ +@@ -2747,7 +2749,10 @@ 0x04, 0x03, 0x02, 0x01, 0x02, 0x03, }; @@ -51,7 +51,7 @@ static int test_tlsext_clienthello_build(void) -@@ -2823,18 +2828,18 @@ +@@ -2826,18 +2831,18 @@ goto err; } diff --git a/patches/windows_headers.patch b/patches/windows_headers.patch index 49e2a9738d..cfbed956b6 100644 --- a/patches/windows_headers.patch +++ b/patches/windows_headers.patch @@ -26,13 +26,12 @@ diff -u include/openssl.orig/dtls1.h include/openssl/dtls1.h #if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR) #define OPENSSLDIR "/etc/ssl" #endif -diff -u include/openssl.orig/ossl_typ.h include/openssl/ossl_typ.h ---- include/openssl.orig/ossl_typ.h Mon Dec 7 07:58:32 2015 -+++ include/openssl/ossl_typ.h Mon Dec 7 07:56:14 2015 -@@ -80,6 +80,22 @@ +--- include/openssl/ossl_typ.h.orig Fri Feb 18 16:30:39 2022 ++++ include/openssl/ossl_typ.h Mon Feb 21 05:39:35 2022 +@@ -82,6 +82,22 @@ typedef struct ASN1_ITEM_st ASN1_ITEM; typedef struct asn1_pctx_st ASN1_PCTX; - + +#if defined(_WIN32) && defined(__WINCRYPT_H__) +#ifndef LIBRESSL_INTERNAL +#ifdef _MSC_VER From 2336a535c6fabfa3222d36b15008335cc236d8ac Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 27 Feb 2022 05:40:13 -0600 Subject: [PATCH 0051/1283] update man links --- man/links | 1 - 1 file changed, 1 deletion(-) diff --git a/man/links b/man/links index b81e55dd42..d1ec90064d 100644 --- a/man/links +++ b/man/links @@ -2421,7 +2421,6 @@ bn_dump.3,bn_wexpand.3 bn_dump.3,mul.3 bn_dump.3,mul_add.3 bn_dump.3,sqr.3 -d2i_ASN1_BOOLEAN.3,i2d_ASN1_BOOLEAN.3 d2i_ASN1_NULL.3,i2d_ASN1_NULL.3 d2i_ASN1_OBJECT.3,i2d_ASN1_OBJECT.3 d2i_ASN1_OCTET_STRING.3,d2i_ASN1_BIT_STRING.3 From 56bf8d4f4191184470b1f15815b9b8de1eab1b8e Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 27 Feb 2022 06:05:41 -0600 Subject: [PATCH 0052/1283] update autotool macro deprecations fix latest round of autotool complaints --- configure.ac | 3 +-- m4/check-hardening-options.m4 | 26 ++++++++++---------------- tap-driver.sh | 2 +- 3 files changed, 12 insertions(+), 19 deletions(-) diff --git a/configure.ac b/configure.ac index fdf72eeb0c..8119508672 100644 --- a/configure.ac +++ b/configure.ac @@ -12,7 +12,7 @@ # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -AC_INIT([libressl], m4_esyscmd([tr -d '\n' < VERSION])) +AC_INIT([libressl], m4_esyscmd(tr -d '\n' < VERSION)) AC_SUBST([LIBCRYPTO_VERSION], m4_esyscmd([tr -d '\n' < crypto/VERSION])) AC_SUBST([LIBSSL_VERSION], m4_esyscmd([tr -d '\n' < ssl/VERSION])) AC_SUBST([LIBTLS_VERSION], m4_esyscmd([tr -d '\n' < tls/VERSION])) @@ -27,7 +27,6 @@ m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])]) USER_CFLAGS="$CFLAGS" AC_PROG_CC([cc gcc]) -AC_PROG_CC_STDC AM_PROG_CC_C_O LT_INIT([pic-only]) diff --git a/m4/check-hardening-options.m4 b/m4/check-hardening-options.m4 index c8ab12ea49..4b5784b627 100644 --- a/m4/check-hardening-options.m4 +++ b/m4/check-hardening-options.m4 @@ -4,16 +4,13 @@ AC_DEFUN([CHECK_CFLAG], [ AC_MSG_CHECKING([if $saved_CC supports "$1"]) old_cflags="$CFLAGS" CFLAGS="$1 -Wall -Werror" - AC_TRY_LINK([ - #include - ], - [printf("Hello")], - AC_MSG_RESULT([yes]) + AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]], [[printf("Hello")]])], + [AC_MSG_RESULT([yes]) CFLAGS=$old_cflags - HARDEN_CFLAGS="$HARDEN_CFLAGS $1", - AC_MSG_RESULT([no]) + HARDEN_CFLAGS="$HARDEN_CFLAGS $1"], + [AC_MSG_RESULT([no]) CFLAGS=$old_cflags - [$2]) + [$2]]) ]) AC_DEFUN([CHECK_LDFLAG], [ @@ -21,16 +18,13 @@ AC_DEFUN([CHECK_LDFLAG], [ AC_MSG_CHECKING([if $saved_LD supports "$1"]) old_ldflags="$LDFLAGS" LDFLAGS="$1 -Wall -Werror" - AC_TRY_LINK([ - #include - ], - [printf("Hello")], - AC_MSG_RESULT([yes]) + AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]], [[printf("Hello")]])], + [AC_MSG_RESULT([yes]) LDFLAGS=$old_ldflags - HARDEN_LDFLAGS="$HARDEN_LDFLAGS $1", - AC_MSG_RESULT([no]) + HARDEN_LDFLAGS="$HARDEN_LDFLAGS $1"], + [AC_MSG_RESULT([no]) LDFLAGS=$old_ldflags - [$2]) + [$2]]) ]) AC_DEFUN([DISABLE_AS_EXECUTABLE_STACK], [ diff --git a/tap-driver.sh b/tap-driver.sh index 0ca4903755..fea066f56e 100755 --- a/tap-driver.sh +++ b/tap-driver.sh @@ -1,5 +1,5 @@ #! /bin/sh -# Copyright (C) 2011-2020 Free Software Foundation, Inc. +# Copyright (C) 2011-2021 Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by From 74e92e5ecf40cb9736e637e6b6dc5fc023bf7204 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sat, 12 Mar 2022 11:26:23 -0600 Subject: [PATCH 0053/1283] add infinite loop fix in BN_mod_sqrt --- patches/bn_sqrt.patch | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 patches/bn_sqrt.patch diff --git a/patches/bn_sqrt.patch b/patches/bn_sqrt.patch new file mode 100644 index 0000000000..495de31208 --- /dev/null +++ b/patches/bn_sqrt.patch @@ -0,0 +1,38 @@ +--- crypto/bn/bn_sqrt.c.orig Fri Feb 18 16:30:39 2022 ++++ crypto/bn/bn_sqrt.c Sat Mar 12 11:23:53 2022 +@@ -351,21 +351,22 @@ + goto vrfy; + } + +- +- /* find smallest i such that b^(2^i) = 1 */ +- i = 1; +- if (!BN_mod_sqr(t, b, p, ctx)) +- goto end; +- while (!BN_is_one(t)) { +- i++; +- if (i == e) { +- BNerror(BN_R_NOT_A_SQUARE); +- goto end; ++ /* Find the smallest i with 0 < i < e such that b^(2^i) = 1. */ ++ for (i = 1; i < e; i++) { ++ if (i == 1) { ++ if (!BN_mod_sqr(t, b, p, ctx)) ++ goto end; ++ } else { ++ if (!BN_mod_sqr(t, t, p, ctx)) ++ goto end; + } +- if (!BN_mod_mul(t, t, t, p, ctx)) +- goto end; ++ if (BN_is_one(t)) ++ break; + } +- ++ if (i >= e) { ++ BNerror(BN_R_NOT_A_SQUARE); ++ goto end; ++ } + + /* t := y^2^(e - i - 1) */ + if (!BN_copy(t, y)) From 101a9d69f18d8411a37e942b86930b84d097666f Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 13 Mar 2022 12:04:04 -0500 Subject: [PATCH 0054/1283] add new tests --- .gitignore | 5 ++++- tests/CMakeLists.txt | 15 +++++++++++++++ tests/Makefile.am | 15 +++++++++++++++ 3 files changed, 34 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 5e09e1b6a7..ecf729c424 100644 --- a/.gitignore +++ b/.gitignore @@ -60,11 +60,13 @@ tests/arc4random_fork* tests/asn1api* tests/asn1basic* tests/asn1complex* -tests/asn1string_copy* tests/asn1evp* +tests/asn1object* +tests/asn1string_copy* tests/asn1time* tests/asn1x509* tests/bnaddsub* +tests/bn_mod_exp2_mont* tests/bn_rand_interval* tests/bn_to_string* tests/cipher* @@ -81,6 +83,7 @@ tests/rfc5280time* tests/ssl_get_shared_ciphers* tests/ssl_methods* tests/ssl_versions* +tests/string_table* tests/timingsafe* tests/tls_ext_alpn* tests/tls_prf* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 58895ada91..828ef0c1b4 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -55,6 +55,11 @@ add_executable(asn1evp asn1evp.c) target_link_libraries(asn1evp ${OPENSSL_TEST_LIBS}) add_test(asn1evp asn1evp) +# asn1object +add_executable(asn1object asn1object.c) +target_link_libraries(asn1object ${OPENSSL_TEST_LIBS}) +add_test(asn1object asn1object) + # asn1string_copy add_executable(asn1string_copy asn1string_copy.c) target_link_libraries(asn1string_copy ${OPENSSL_TEST_LIBS}) @@ -98,6 +103,11 @@ add_executable(bnaddsub bnaddsub.c) target_link_libraries(bnaddsub ${OPENSSL_TEST_LIBS}) add_test(bnaddsub bnaddsub) +# bn_mod_exp2_mont +add_executable(bn_mod_exp2_mont bn_mod_exp2_mont.c) +target_link_libraries(bn_mod_exp2_mont ${OPENSSL_TEST_LIBS}) +add_test(bn_mod_exp2_mont bn_mod_exp2_mont) + # bn_rand_interval add_executable(bn_rand_interval bn_rand_interval.c) target_link_libraries(bn_rand_interval ${OPENSSL_TEST_LIBS}) @@ -483,6 +493,11 @@ else() endif() set_tests_properties(ssltest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") +# string_table +add_executable(string_table string_table.c) +target_link_libraries(string_table ${OPENSSL_TEST_LIBS}) +add_test(string_table string_table) + # testdsa if(NOT MSVC) add_test(NAME testdsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testdsa.sh) diff --git a/tests/Makefile.am b/tests/Makefile.am index 6ba51ba350..cae0cb5e04 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -67,6 +67,11 @@ TESTS += asn1evp check_PROGRAMS += asn1evp asn1evp_SOURCES = asn1evp.c +# asn1object +TESTS += asn1object +check_PROGRAMS += asn1object +asn1object_SOURCES = asn1object.c + # asn1string_copy TESTS += asn1string_copy check_PROGRAMS += asn1string_copy @@ -110,6 +115,11 @@ TESTS += bnaddsub check_PROGRAMS += bnaddsub bnaddsub_SOURCES = bnaddsub.c +# bn_mod_exp2_mont +TESTS += bn_mod_exp2_mont +check_PROGRAMS += bn_mod_exp2_mont +bn_mod_exp2_mont_SOURCES = bn_mod_exp2_mont.c + # bn_rand_interval TESTS += bn_rand_interval check_PROGRAMS += bn_rand_interval @@ -483,6 +493,11 @@ ssltest_SOURCES = ssltest.c EXTRA_DIST += ssltest.sh ssltest.bat EXTRA_DIST += testssl testssl.bat ca.pem server.pem +# string_table +TESTS += string_table +check_PROGRAMS += string_table +string_table_SOURCES = string_table.c + # testdsa TESTS += testdsa.sh EXTRA_DIST += testdsa.sh testdsa.bat From c7fb4df08257009c3d30c32f8076036b39a4750d Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 13 Mar 2022 12:16:55 -0500 Subject: [PATCH 0055/1283] update Changelog --- ChangeLog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ChangeLog b/ChangeLog index d68f43854b..b58f52d557 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,7 +28,13 @@ history is also available from Git. LibreSSL Portable Release Notes: +3.5.1 - Security release + + * A malicious certificate can cause an infinite loop. + Reported by and fix from Tavis Ormandy and David Benjamin, Google. + 3.5.0 - Development release + * New Features - The RFC 3779 API was ported from OpenSSL. Many bugs were fixed, regression tests were added and the code was cleaned up. From a32554c65c41726737a8b457439e76cae61ff991 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 15 Mar 2022 15:23:27 -0500 Subject: [PATCH 0056/1283] remove local patch now upstream --- patches/bn_sqrt.patch | 38 -------------------------------------- 1 file changed, 38 deletions(-) delete mode 100644 patches/bn_sqrt.patch diff --git a/patches/bn_sqrt.patch b/patches/bn_sqrt.patch deleted file mode 100644 index 495de31208..0000000000 --- a/patches/bn_sqrt.patch +++ /dev/null @@ -1,38 +0,0 @@ ---- crypto/bn/bn_sqrt.c.orig Fri Feb 18 16:30:39 2022 -+++ crypto/bn/bn_sqrt.c Sat Mar 12 11:23:53 2022 -@@ -351,21 +351,22 @@ - goto vrfy; - } - -- -- /* find smallest i such that b^(2^i) = 1 */ -- i = 1; -- if (!BN_mod_sqr(t, b, p, ctx)) -- goto end; -- while (!BN_is_one(t)) { -- i++; -- if (i == e) { -- BNerror(BN_R_NOT_A_SQUARE); -- goto end; -+ /* Find the smallest i with 0 < i < e such that b^(2^i) = 1. */ -+ for (i = 1; i < e; i++) { -+ if (i == 1) { -+ if (!BN_mod_sqr(t, b, p, ctx)) -+ goto end; -+ } else { -+ if (!BN_mod_sqr(t, t, p, ctx)) -+ goto end; - } -- if (!BN_mod_mul(t, t, t, p, ctx)) -- goto end; -+ if (BN_is_one(t)) -+ break; - } -- -+ if (i >= e) { -+ BNerror(BN_R_NOT_A_SQUARE); -+ goto end; -+ } - - /* t := y^2^(e - i - 1) */ - if (!BN_copy(t, y)) From 15d1f01e0f36228c501584c858697203b34e835d Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 15 Mar 2022 16:11:05 -0500 Subject: [PATCH 0057/1283] add bn_mod_sqrt --- .gitignore | 1 + tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 3 files changed, 11 insertions(+) diff --git a/.gitignore b/.gitignore index ecf729c424..d8ba349085 100644 --- a/.gitignore +++ b/.gitignore @@ -67,6 +67,7 @@ tests/asn1time* tests/asn1x509* tests/bnaddsub* tests/bn_mod_exp2_mont* +tests/bn_mod_sqrt* tests/bn_rand_interval* tests/bn_to_string* tests/cipher* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 828ef0c1b4..fb7e499db7 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -108,6 +108,11 @@ add_executable(bn_mod_exp2_mont bn_mod_exp2_mont.c) target_link_libraries(bn_mod_exp2_mont ${OPENSSL_TEST_LIBS}) add_test(bn_mod_exp2_mont bn_mod_exp2_mont) +# bn_mod_sqrt +add_executable(bn_mod_sqrt bn_mod_sqrt.c) +target_link_libraries(bn_mod_sqrt ${OPENSSL_TEST_LIBS}) +add_test(bn_mod_sqrt bn_mod_sqrt) + # bn_rand_interval add_executable(bn_rand_interval bn_rand_interval.c) target_link_libraries(bn_rand_interval ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index cae0cb5e04..bea03b5ae0 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -120,6 +120,11 @@ TESTS += bn_mod_exp2_mont check_PROGRAMS += bn_mod_exp2_mont bn_mod_exp2_mont_SOURCES = bn_mod_exp2_mont.c +# bn_mod_sqrt +TESTS += bn_mod_sqrt +check_PROGRAMS += bn_mod_sqrt +bn_mod_sqrt_SOURCES = bn_mod_sqrt.c + # bn_rand_interval TESTS += bn_rand_interval check_PROGRAMS += bn_rand_interval From f6deadbec9bd455ef1851da07ab7ecd401a92d6d Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 16 Mar 2022 04:21:18 -0500 Subject: [PATCH 0058/1283] add vwarnx --- include/compat/err.h | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/include/compat/err.h b/include/compat/err.h index 8b5b635742..945a75d61d 100644 --- a/include/compat/err.h +++ b/include/compat/err.h @@ -72,16 +72,22 @@ warn(const char *fmt, ...) fprintf(stderr, "%s\n", strerror(sverrno)); } +static inline void +vwarnx(const char *fmt, va_list args) +{ + if (fmt != NULL) + vfprintf(stderr, fmt, args); + fprintf(stderr, "\n"); +} + static inline void warnx(const char *fmt, ...) { va_list ap; va_start(ap, fmt); - if (fmt != NULL) - vfprintf(stderr, fmt, ap); + vwarnx(fmt, ap); va_end(ap); - fprintf(stderr, "\n"); } #endif From d7bf245b0ca9002b5b22ea475095ecef89a088e3 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 21 Mar 2022 05:27:12 -0500 Subject: [PATCH 0059/1283] update patch --- patches/handshake_table.c.patch | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/patches/handshake_table.c.patch b/patches/handshake_table.c.patch index b0a9f5bcc2..f3a40044ea 100644 --- a/patches/handshake_table.c.patch +++ b/patches/handshake_table.c.patch @@ -1,6 +1,6 @@ ---- tests/handshake_table.c.orig Sat Aug 22 18:51:52 2020 -+++ tests/handshake_table.c Fri Sep 4 04:04:26 2020 -@@ -479,6 +479,7 @@ +--- tests/handshake_table.c.orig Tue Mar 15 11:37:03 2022 ++++ tests/handshake_table.c Mon Mar 21 05:26:15 2022 +@@ -518,6 +518,7 @@ unsigned int depth = 0; int ch, graphviz = 0, print = 0; @@ -8,7 +8,7 @@ while ((ch = getopt(argc, argv, "Cg")) != -1) { switch (ch) { case 'C': -@@ -496,6 +497,7 @@ +@@ -535,6 +536,7 @@ if (argc != 0) usage(); From 8ad1ac4bf176c988a9c61104a2862ed5b115b59e Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 21 Mar 2022 07:33:54 -0500 Subject: [PATCH 0060/1283] Add ASan status badge --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 31c122dc52..464da18156 100644 --- a/README.md +++ b/README.md @@ -6,6 +6,7 @@ [![Android_Build Status](https://github.com/libressl-portable/portable/actions/workflows/android_test.yml/badge.svg)](https://github.com/libressl-portable/portable/actions/workflows/android_test.yml) [![Cross_Build Status](https://github.com/libressl-portable/portable/actions/workflows/cross_test.yml/badge.svg)](https://github.com/libressl-portable/portable/actions/workflows/cross_test.yml) [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/libressl.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:libressl) +[![ASan Status](https://github.com/libressl-portable/portable/actions/workflows/linux_test_asan.yml/badge.svg)](https://github.com/libressl-portable/portable/actions/workflows/linux_test_asan.yml) LibreSSL is a fork of [OpenSSL](https://www.openssl.org) 1.0.1g developed by the [OpenBSD](https://www.openbsd.org) project. Our goal is to modernize the codebase, From e19aafe22a2bf0beee4e29c71f1288d7fa362424 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Fri, 25 Mar 2022 11:37:50 +0900 Subject: [PATCH 0061/1283] Copy ARM related files from arch/arm/ --- update.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/update.sh b/update.sh index 265afabbb6..b8f8337d35 100755 --- a/update.sh +++ b/update.sh @@ -201,9 +201,9 @@ gen_asm_stdout elf sha/asm/sha1-armv4-large.pl crypto/sha/sha1-elf-armv4.S gen_asm_stdout elf sha/asm/sha256-armv4.pl crypto/sha/sha256-elf-armv4.S gen_asm_stdout elf sha/asm/sha512-armv4.pl crypto/sha/sha512-elf-armv4.S gen_asm_stdout elf modes/asm/ghash-armv4.pl crypto/modes/ghash-elf-armv4.S -$CP $libcrypto_src/armv4cpuid.S crypto -$CP $libcrypto_src/armcap.c crypto -$CP $libcrypto_src/arm_arch.h crypto +$CP $libcrypto_src/arch/arm/armv4cpuid.S crypto +$CP $libcrypto_src/arch/arm/armcap.c crypto +$CP $libcrypto_src/arch/arm/arm_arch.h crypto for abi in elf macosx masm mingw64; do echo generating x86_64 ASM source for $abi From e5263d716312ebf13b46fc886ffbd09f96106864 Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Sat, 26 Mar 2022 21:48:14 +0500 Subject: [PATCH 0062/1283] CI: switch ASAN builds to clang --- .github/workflows/linux_test_asan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/linux_test_asan.yml b/.github/workflows/linux_test_asan.yml index 90270246bf..d6fc1e88d1 100644 --- a/.github/workflows/linux_test_asan.yml +++ b/.github/workflows/linux_test_asan.yml @@ -7,7 +7,7 @@ jobs: strategy: matrix: os: [ubuntu-latest] - compiler: [gcc] + compiler: [clang] runs-on: ${{ matrix.os }} continue-on-error: false env: From b52dc3d9b292f4f644d7506a2d62df11f2a6e269 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 4 Apr 2022 01:09:27 -0500 Subject: [PATCH 0063/1283] add evp_pkey_cleanup test --- .gitignore | 1 + tests/CMakeLists.txt | 6 ++++++ tests/Makefile.am | 6 ++++++ 3 files changed, 13 insertions(+) diff --git a/.gitignore b/.gitignore index d8ba349085..b85cf10dd3 100644 --- a/.gitignore +++ b/.gitignore @@ -74,6 +74,7 @@ tests/cipher* tests/constraints* tests/ec_point_conversion* tests/evp_pkey_check* +tests/evp_pkey_cleanup* tests/explicit_bzero* tests/freenull* tests/gost2814789t* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index fb7e499db7..7c80002059 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -4,6 +4,7 @@ include_directories( . ../crypto/asn1 ../crypto/bio + ../crypto/evp ../crypto/modes ../crypto/x509 ../ssl @@ -243,6 +244,11 @@ add_executable(evp_pkey_check evp_pkey_check.c) target_link_libraries(evp_pkey_check ${OPENSSL_TEST_LIBS}) add_test(evp_pkey_check evp_pkey_check) +# evp_pkey_cleanup +add_executable(evp_pkey_cleanup evp_pkey_cleanup.c) +target_link_libraries(evp_pkey_cleanup ${OPENSSL_TEST_LIBS}) +add_test(evp_pkey_cleanup evp_pkey_cleanup) + # evptest add_executable(evptest evptest.c) target_link_libraries(evptest ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index bea03b5ae0..e58c0c0153 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -4,6 +4,7 @@ AM_CPPFLAGS += -DLIBRESSL_CRYPTO_INTERNAL AM_CPPFLAGS += -I $(top_srcdir)/crypto/asn1 AM_CPPFLAGS += -I $(top_srcdir)/crypto/bio +AM_CPPFLAGS += -I $(top_srcdir)/crypto/evp AM_CPPFLAGS += -I $(top_srcdir)/crypto/modes AM_CPPFLAGS += -I $(top_srcdir)/crypto/x509 AM_CPPFLAGS += -I $(top_srcdir)/ssl @@ -255,6 +256,11 @@ TESTS += evp_pkey_check check_PROGRAMS += evp_pkey_check evp_pkey_check_SOURCES = evp_pkey_check.c +# evp_pkey_cleanup +TESTS += evp_pkey_cleanup +check_PROGRAMS += evp_pkey_cleanup +evp_pkey_cleanup_SOURCES = evp_pkey_cleanup.c + # evptest TESTS += evptest.sh check_PROGRAMS += evptest From b2c59887a2eeb74d331e3321e0de9e154cb8be13 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Sun, 10 Apr 2022 12:13:31 +0900 Subject: [PATCH 0064/1283] Add regress objectstest --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 7c80002059..e6cb2bcd9b 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -341,6 +341,11 @@ add_executable(mont mont.c) target_link_libraries(mont ${OPENSSL_TEST_LIBS}) add_test(mont mont) +# objectstest +add_executable(objectstest objectstest.c) +target_link_libraries(objectstest ${OPENSSL_TEST_LIBS}) +add_test(objectstest objectstest) + # ocsp_test if(ENABLE_EXTRATESTS) add_executable(ocsp_test ocsp_test.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index e58c0c0153..6c88c9046f 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -354,6 +354,11 @@ TESTS += mont check_PROGRAMS += mont mont_SOURCES = mont.c +# objectstest +TESTS += objectstest +check_PROGRAMS += objectstest +objectstest_SOURCES = objectstest.c + # ocsp_test if ENABLE_EXTRATESTS TESTS += ocsptest.sh From 87441bdbceeceb8eebc8d8b4d7211c890248c0c7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 15 Apr 2022 18:03:35 +0200 Subject: [PATCH 0065/1283] LibreSSL 3.5.2 ChangeLog --- ChangeLog | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/ChangeLog b/ChangeLog index b58f52d557..486b6c1d37 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,6 +28,49 @@ history is also available from Git. LibreSSL Portable Release Notes: +3.5.2 - Stable release + + * Bug fixes + - Fix NULL dereferences in openssl(1) cms option parsing. + - Do not zero the computed cofactor on ec_guess_cofactor() success. + - Bound cofactor in EC_GROUP_set_generator() to reduce the number of + bogus groups that can be described with nonsensical parameters. + - Avoid various potential segfaults in EVP_PKEY_CTX_free() in low + memory conditions. Reported for HMAC by Masaru Masuda. + - Plug leak in ASN1_TIME_adj_internal(). + - Avoid infinite loop for custom curves of order 1. + Issue reported by Hanno Boeck, comments by David Benjamin. + - Avoid an infinite loop on parsing DSA private keys by validating + that the provided parameters conform to FIPS 186-4. + Issue reported by Hanno Boeck, comments by David Benjamin. + * Internal improvements + - Suppress various compiler warnings for old gcc versions. + - Rework ASN1_STRING_set(). + - Remove const from tls1_transcript_hash_value(). + - Clean up and simplify ssl3_renegotiate{,_check}(). + - Rewrite legacy TLS and DTLS unexpected handshake message handling. + - Simplify SSL_do_handshake(). + - Rewrite ASCII/text to ASN.1 object conversion. + - Provide t2i_ASN1_OBJECT_internal() and use it for OBJ_txt2obj(). + - Split armv7 and aarch64 code into separate locations. + - Rewrote openssl(1) ts to use the new option handling and cleaned + up the C code. + - Provide asn1_get_primitive(). + - Convert {c2i,d2i}_ASN1_OBJECT() to CBS. + - Remove the minimum record length checks from dtls1_read_bytes(). + - Clean up {dtls1,ssl3}_read_bytes(). + - Be more careful with embedded and terminating NULs in the new + name constraints code. + - Check EVP_Digest* return codes in openssl(1) ts + - Various minor code cleanup in openssl(1) pkcs12 + - Use calloc() in pkey_hmac_init(). + - Simplify priv_key handling in d2i_ECPrivateKey(). + * Documentation improvements + - Update d2i_ASN1_OBJECT(3) documentation to reflect reality after + refactoring and bug fixes. + - Fixed numerous minor grammar, spelling, wording, and punctuation + issues. + 3.5.1 - Security release * A malicious certificate can cause an infinite loop. From ac053c8453d0ae1e16a15f435dbd4d3169ebbae8 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 15 Apr 2022 18:34:43 +0200 Subject: [PATCH 0066/1283] add a few more things --- ChangeLog | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/ChangeLog b/ChangeLog index 486b6c1d37..c739281883 100644 --- a/ChangeLog +++ b/ChangeLog @@ -31,6 +31,10 @@ LibreSSL Portable Release Notes: 3.5.2 - Stable release * Bug fixes + - Avoid single byte overread in asn1_parse2(). + - Allow name constraints with a leading dot. From Alex Wilson. + - Relax a check in x509_constraints_dirname() to allow prefixes. + From Alex Wilson. - Fix NULL dereferences in openssl(1) cms option parsing. - Do not zero the computed cofactor on ec_guess_cofactor() success. - Bound cofactor in EC_GROUP_set_generator() to reduce the number of @@ -43,8 +47,17 @@ LibreSSL Portable Release Notes: - Avoid an infinite loop on parsing DSA private keys by validating that the provided parameters conform to FIPS 186-4. Issue reported by Hanno Boeck, comments by David Benjamin. + * Compatibility improvements + - Allow non-standard name constraints of the form @domain.com. * Internal improvements + - Limit OID text conversion to 64 bits per arc. + - Clean up and simplify memory BIO code. + - Reduce number of memmove() calls in memory BIOs. + - Factor out alert handling code in the legacy stack. + - Add sanity checks on p and q in old_dsa_priv_decode() + - Cache the SHA-512 hash instead of the SHA-1 for CRLs. - Suppress various compiler warnings for old gcc versions. + - Remove free_cont from asn1_d2i_ex_primitive()/asn1_ex_c2i(). - Rework ASN1_STRING_set(). - Remove const from tls1_transcript_hash_value(). - Clean up and simplify ssl3_renegotiate{,_check}(). From fe903fb7c59600f7679b2afb0d33f4a0c3f93ae2 Mon Sep 17 00:00:00 2001 From: Sebastian Blunt Date: Fri, 15 Apr 2022 23:48:50 -0700 Subject: [PATCH 0067/1283] Fix unreachable nc portability shim This fixes nc failing to run on darwin due to it incorrectly setting the linux-specific SOCK_NONBLOCK flag on connect. nc already had a portability shim in apps/nc/compat/sys/socket.h, which kicks in if SOCK_NONBLOCK is undefined. But that header includes include/compat/sys/socket.h, which also has a portability shim that defines a default value for SOCK_NONBLOCK if it's undefined. Thus the first portability shim was unreachable. Fixes this by moving the NEED_SOCKET_FLAGS flag into the outer shim, and having the inner shim activate if NEED_SOCKET_FLAGS is defined. This closes https://github.com/libressl-portable/portable/issues/631 --- apps/nc/compat/sys/socket.h | 3 +-- include/compat/sys/socket.h | 1 + 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/nc/compat/sys/socket.h b/apps/nc/compat/sys/socket.h index 13eb380b42..2c7ee4fc1f 100644 --- a/apps/nc/compat/sys/socket.h +++ b/apps/nc/compat/sys/socket.h @@ -6,8 +6,7 @@ #ifndef _WIN32 #include_next -#if !defined(SOCK_NONBLOCK) || !defined(SOCK_CLOEXEC) -#define NEED_SOCKET_FLAGS +#if defined(NEED_SOCKET_FLAGS) int _socket(int domain, int type, int protocol); #ifndef SOCKET_FLAGS_PRIV #define socket(d, t, p) _socket(d, t, p) diff --git a/include/compat/sys/socket.h b/include/compat/sys/socket.h index 10eb05f672..2f0b197b35 100644 --- a/include/compat/sys/socket.h +++ b/include/compat/sys/socket.h @@ -10,6 +10,7 @@ #endif #if !defined(SOCK_NONBLOCK) || !defined(SOCK_CLOEXEC) +#define NEED_SOCKET_FLAGS #define SOCK_CLOEXEC 0x8000 /* set FD_CLOEXEC */ #define SOCK_NONBLOCK 0x4000 /* set O_NONBLOCK */ int bsd_socketpair(int domain, int type, int protocol, int socket_vector[2]); From 4458b705f4acf9265a346403f3da3cbd8afaa21a Mon Sep 17 00:00:00 2001 From: kinichiro Date: Sat, 16 Apr 2022 20:55:27 +0900 Subject: [PATCH 0068/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index c739281883..e4dc7ad1ea 100644 --- a/ChangeLog +++ b/ChangeLog @@ -58,6 +58,7 @@ LibreSSL Portable Release Notes: - Cache the SHA-512 hash instead of the SHA-1 for CRLs. - Suppress various compiler warnings for old gcc versions. - Remove free_cont from asn1_d2i_ex_primitive()/asn1_ex_c2i(). + - Rework ownership handling in x509_constraints_validate(). - Rework ASN1_STRING_set(). - Remove const from tls1_transcript_hash_value(). - Clean up and simplify ssl3_renegotiate{,_check}(). From 500d16b32ce25231e7c721363cfb5fe121e0fd81 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Fri, 29 Apr 2022 18:30:45 +0900 Subject: [PATCH 0069/1283] Add environment macos-12 to CI --- .github/workflows/macos_test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/macos_test.yml b/.github/workflows/macos_test.yml index 29e6cdc953..6e7adac6de 100644 --- a/.github/workflows/macos_test.yml +++ b/.github/workflows/macos_test.yml @@ -6,7 +6,7 @@ jobs: build-native: strategy: matrix: - os: [macos-latest] + os: [macos-12, macos-11] compiler: [clang, gcc] runs-on: ${{ matrix.os }} continue-on-error: false From 8a57de6ed06b9f0e706211b33af28b61590ab0c8 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Fri, 29 Apr 2022 18:55:44 +0900 Subject: [PATCH 0070/1283] Set max number of processes for CI --- scripts/test | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/scripts/test b/scripts/test index 80fa988f2f..f2f0cb8474 100755 --- a/scripts/test +++ b/scripts/test @@ -20,24 +20,24 @@ if [ "x$ARCH" = "xnative" ]; then # test cmake and ninja if [ `uname` = "Darwin" ]; then cmake .. - make + make -j 4 make test cd ../build-shared cmake -DBUILD_SHARED_LIBS=ON .. - make + make -j 4 make test else sudo apt-get update sudo apt-get install -y cmake ninja-build cmake -GNinja .. - ninja + ninja -j 4 ninja test cd ../build-shared cmake -GNinja -DBUILD_SHARED_LIBS=ON .. - ninja + ninja -j 4 ninja test fi @@ -58,21 +58,21 @@ elif [ "x$ARCH" = "xmingw32" -o "x$ARCH" = "xmingw64" ]; then fi ./configure --host=$CPU-w64-mingw32 - make -j + make -j 4 ( rm -fr build-static mkdir build-static cd build-static cmake -GNinja -DCMAKE_TOOLCHAIN_FILE=../scripts/$CPU-w64-mingw32.cmake .. - ninja + ninja -j 4 ) ( rm -fr build-shared mkdir build-shared cd build-shared cmake -GNinja -DCMAKE_TOOLCHAIN_FILE=../scripts/$CPU-w64-mingw32.cmake -DBUILD_SHARED_LIBS=ON .. - ninja + ninja -j 4 ) elif [ "x$ARCH" = "xarm32" -o "x$ARCH" = "xarm64" ]; then From ff798b2a33d89679ac6c25a4773b91c6a26cd015 Mon Sep 17 00:00:00 2001 From: kinichiro Date: Fri, 29 Apr 2022 19:30:07 +0900 Subject: [PATCH 0071/1283] Use current VS2019 with appveyor --- appveyor.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/appveyor.yml b/appveyor.yml index bdb8001a46..33a32daea2 100644 --- a/appveyor.yml +++ b/appveyor.yml @@ -1,26 +1,26 @@ image: - - Previous Visual Studio 2019 + - Visual Studio 2019 environment: PATH: C:\msys64\usr\bin;C:\msys64\mingw64\bin;C:\Windows\System32;C:\Windows;%PATH% matrix: - - APPVEYOR_BUILD_WORKER_IMAGE: Previous Visual Studio 2019 + - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2019 GENERATOR: Visual Studio 16 2019 ARCHITECTURE: Win32 CONFIG: Release SHARED_LIBS: ON - - APPVEYOR_BUILD_WORKER_IMAGE: Previous Visual Studio 2019 + - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2019 GENERATOR: Visual Studio 16 2019 ARCHITECTURE: Win32 CONFIG: Release SHARED_LIBS: OFF - - APPVEYOR_BUILD_WORKER_IMAGE: Previous Visual Studio 2019 + - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2019 GENERATOR: Visual Studio 16 2019 ARCHITECTURE: x64 CONFIG: Release SHARED_LIBS: ON - - APPVEYOR_BUILD_WORKER_IMAGE: Previous Visual Studio 2019 + - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2019 GENERATOR: Visual Studio 16 2019 ARCHITECTURE: x64 CONFIG: Release From 87aff644a4d5dbff48fd116ab8a2316afae3d4fd Mon Sep 17 00:00:00 2001 From: kinichiro Date: Fri, 29 Apr 2022 22:07:53 +0900 Subject: [PATCH 0072/1283] Stop disabling __attribute__ on Windows with Clang On Windows with targeting the MSVC ABI, Clang will define _MSC_VER, and does not treat __attribute__ as a macro. Clang's builtin headers (e.g. immintrin.h) use __attribute__ liberally, and do not expect it to be ifdef-ed away. Suggested from Nicholas Hutchinson by github issue. --- patches/windows_headers.patch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/patches/windows_headers.patch b/patches/windows_headers.patch index cfbed956b6..0e9428c152 100644 --- a/patches/windows_headers.patch +++ b/patches/windows_headers.patch @@ -19,7 +19,7 @@ diff -u include/openssl.orig/dtls1.h include/openssl/dtls1.h #include /* crypto/opensslconf.h.in */ -+#if defined(_MSC_VER) && !defined(__attribute__) ++#if defined(_MSC_VER) && !defined(__clang__) && !defined(__attribute__) +#define __attribute__(a) +#endif + From 5e974ea695aa57965c3037c787850012e188dfdb Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 8 May 2022 22:23:36 -0500 Subject: [PATCH 0073/1283] update for latest upstream --- crypto/CMakeLists.txt | 2 ++ crypto/Makefile.am | 5 +++++ update.sh | 2 +- 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 9b66d9f69a..2d2333287c 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -602,6 +602,8 @@ set( idea/i_ecb.c idea/i_ofb64.c idea/i_skey.c + kdf/hkdf_evp.c + kdf/kdf_err.c lhash/lh_stats.c lhash/lhash.c md4/md4_dgst.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 0f39753c46..888270b0f9 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -760,6 +760,11 @@ libcrypto_la_SOURCES += idea/i_ofb64.c libcrypto_la_SOURCES += idea/i_skey.c noinst_HEADERS += idea/idea_lcl.h +# kdf +libcrypto_la_SOURCES += kdf/hkdf_evp.c +libcrypto_la_SOURCES += kdf/kdf_err.c +noinst_HEADERS += kdf/kdf.h + # lhash libcrypto_la_SOURCES += lhash/lh_stats.c libcrypto_la_SOURCES += lhash/lhash.c diff --git a/update.sh b/update.sh index b8f8337d35..f2aaf19288 100755 --- a/update.sh +++ b/update.sh @@ -124,7 +124,7 @@ copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h rc2/rc2.h rc4/rc4.h ui/ui_compat.h txt_db/txt_db.h sm3/sm3.h sm4/sm4.h chacha/chacha.h evp/evp.h poly1305/poly1305.h camellia/camellia.h gost/gost.h curve25519/curve25519.h - ct/ct.h ct/cterr.h" + ct/ct.h" copy_hdrs $libssl_src "srtp.h ssl.h ssl2.h ssl3.h ssl23.h tls1.h dtls1.h" From 258e4c2f5ee5bf9393efe98eea1114076b614feb Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 9 May 2022 01:33:25 -0500 Subject: [PATCH 0074/1283] increase build threads --- dist.sh | 2 +- tap-driver.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dist.sh b/dist.sh index 9a2f0010a2..e367038188 100755 --- a/dist.sh +++ b/dist.sh @@ -4,4 +4,4 @@ set -e rm -f man/*.[35] include/openssl/*.h ./autogen.sh ./configure -make -j2 distcheck +make -j4 distcheck diff --git a/tap-driver.sh b/tap-driver.sh index fea066f56e..0ca4903755 100755 --- a/tap-driver.sh +++ b/tap-driver.sh @@ -1,5 +1,5 @@ #! /bin/sh -# Copyright (C) 2011-2021 Free Software Foundation, Inc. +# Copyright (C) 2011-2020 Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by From 585d02bdfe1486d8907dcc5dbe0f4db3ac2448cc Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 9 May 2022 01:34:00 -0500 Subject: [PATCH 0075/1283] update man links --- man/links | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/man/links b/man/links index d1ec90064d..b2d1783293 100644 --- a/man/links +++ b/man/links @@ -1013,6 +1013,10 @@ EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_set_signature_md.3 EVP_PKEY_CTX_new.3,EVP_PKEY_CTX_dup.3 EVP_PKEY_CTX_new.3,EVP_PKEY_CTX_free.3 EVP_PKEY_CTX_new.3,EVP_PKEY_CTX_new_id.3 +EVP_PKEY_CTX_set_hkdf_md.3,EVP_PKEY_CTX_add1_hkdf_info.3 +EVP_PKEY_CTX_set_hkdf_md.3,EVP_PKEY_CTX_hkdf_mode.3 +EVP_PKEY_CTX_set_hkdf_md.3,EVP_PKEY_CTX_set1_hkdf_key.3 +EVP_PKEY_CTX_set_hkdf_md.3,EVP_PKEY_CTX_set1_hkdf_salt.3 EVP_PKEY_add1_attr.3,EVP_PKEY_add1_attr_by_NID.3 EVP_PKEY_add1_attr.3,EVP_PKEY_add1_attr_by_OBJ.3 EVP_PKEY_add1_attr.3,EVP_PKEY_add1_attr_by_txt.3 From b07c773ca8390c137043c62a5ccd5d876920e929 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 9 May 2022 02:21:16 -0500 Subject: [PATCH 0076/1283] expose kdf.h as a public header --- crypto/Makefile.am | 1 - update.sh | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 888270b0f9..b78f4915c9 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -763,7 +763,6 @@ noinst_HEADERS += idea/idea_lcl.h # kdf libcrypto_la_SOURCES += kdf/hkdf_evp.c libcrypto_la_SOURCES += kdf/kdf_err.c -noinst_HEADERS += kdf/kdf.h # lhash libcrypto_la_SOURCES += lhash/lh_stats.c diff --git a/update.sh b/update.sh index f2aaf19288..717c6ff1e1 100755 --- a/update.sh +++ b/update.sh @@ -124,7 +124,7 @@ copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h rc2/rc2.h rc4/rc4.h ui/ui_compat.h txt_db/txt_db.h sm3/sm3.h sm4/sm4.h chacha/chacha.h evp/evp.h poly1305/poly1305.h camellia/camellia.h gost/gost.h curve25519/curve25519.h - ct/ct.h" + ct/ct.h kdf/kdf.h" copy_hdrs $libssl_src "srtp.h ssl.h ssl2.h ssl3.h ssl23.h tls1.h dtls1.h" From fbe964e97b1ab8ac0f5293d98e1da2d1e6b23053 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 22 Jun 2022 11:22:46 +0200 Subject: [PATCH 0077/1283] Update netcat patch Fixes #768 --- patches/netcat.c.patch | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/patches/netcat.c.patch b/patches/netcat.c.patch index 7d82aca1e5..d21466a6b0 100644 --- a/patches/netcat.c.patch +++ b/patches/netcat.c.patch @@ -1,5 +1,5 @@ ---- apps/nc/netcat.c.orig Sat Feb 15 11:04:42 2020 -+++ apps/nc/netcat.c Sat Feb 15 11:24:38 2020 +--- apps/nc/netcat.c.orig Wed Jun 22 11:15:52 2022 ++++ apps/nc/netcat.c Wed Jun 22 11:15:52 2022 @@ -93,9 +93,13 @@ int Dflag; /* sodebug */ int Iflag; /* TCP receive buffer size */ @@ -53,7 +53,7 @@ /* Cruft to make sure options are clean, and used properly. */ if (argc == 1 && family == AF_UNIX) { -@@ -947,7 +957,10 @@ +@@ -945,7 +955,10 @@ char *ipaddr) { struct addrinfo *res, *res0; @@ -65,7 +65,7 @@ if ((error = getaddrinfo(host, port, &hints, &res0))) errx(1, "getaddrinfo for host \"%s\" port %s: %s", host, -@@ -962,8 +975,10 @@ +@@ -960,8 +973,10 @@ if (sflag || pflag) { struct addrinfo ahints, *ares; @@ -76,7 +76,7 @@ memset(&ahints, 0, sizeof(struct addrinfo)); ahints.ai_family = res->ai_family; ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM; -@@ -1055,7 +1070,10 @@ +@@ -1053,7 +1068,10 @@ local_listen(const char *host, const char *port, struct addrinfo hints) { struct addrinfo *res, *res0; @@ -88,7 +88,7 @@ int error; /* Allow nodename to be null. */ -@@ -1076,9 +1094,11 @@ +@@ -1074,9 +1092,11 @@ res->ai_protocol)) == -1) continue; @@ -100,21 +100,21 @@ set_common_sockopts(s, res->ai_family); -@@ -1548,11 +1568,13 @@ +@@ -1545,11 +1565,13 @@ { int x = 1; +#ifdef TCP_MD5SIG if (Sflag) { if (setsockopt(s, IPPROTO_TCP, TCP_MD5SIG, - &x, sizeof(x)) == -1) + &x, sizeof(x)) == -1) err(1, NULL); } +#endif if (Dflag) { if (setsockopt(s, SOL_SOCKET, SO_DEBUG, - &x, sizeof(x)) == -1) -@@ -1563,9 +1585,16 @@ + &x, sizeof(x)) == -1) +@@ -1560,9 +1582,16 @@ IP_TOS, &Tflag, sizeof(Tflag)) == -1) err(1, "set IP ToS"); @@ -131,7 +131,7 @@ } if (Iflag) { if (setsockopt(s, SOL_SOCKET, SO_RCVBUF, -@@ -1589,13 +1618,17 @@ +@@ -1586,13 +1615,17 @@ } if (minttl != -1) { @@ -150,7 +150,7 @@ } } -@@ -1820,15 +1853,19 @@ +@@ -1817,15 +1850,19 @@ \t-P proxyuser\tUsername for proxy authentication\n\ \t-p port\t Specify local port for remote connects\n\ \t-R CAfile CA bundle\n\ From 9bd7894915812dd39d26788b1c4665707ff1c68b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 22 Jun 2022 11:43:09 +0200 Subject: [PATCH 0078/1283] Update ssl_txt.c patch --- patches/ssl_txt.c.patch | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/patches/ssl_txt.c.patch b/patches/ssl_txt.c.patch index 6f3535fd8a..7439b0d02a 100644 --- a/patches/ssl_txt.c.patch +++ b/patches/ssl_txt.c.patch @@ -1,5 +1,5 @@ ---- ssl/ssl_txt.orig Sun Jul 17 17:26:59 2016 -+++ ssl/ssl_txt.c Sun Jul 17 17:35:44 2016 +--- ssl/ssl_txt.c.orig Wed Jun 22 11:37:59 2022 ++++ ssl/ssl_txt.c Wed Jun 22 11:37:59 2022 @@ -82,6 +82,7 @@ * OTHERWISE. */ @@ -8,12 +8,14 @@ #include #include -@@ -163,7 +164,7 @@ +@@ -174,8 +174,8 @@ } if (x->time != 0) { -- if (BIO_printf(bp, "\n Start Time: %lld", (long long)x->time) <= 0) -+ if (BIO_printf(bp, "\n Start Time: %"PRId64, (int64_t)x->time) <= 0) +- if (BIO_printf(bp, "\n Start Time: %lld", +- (long long)x->time) <= 0) ++ if (BIO_printf(bp, "\n Start Time: %"PRId64, ++ (int64_t)x->time) <= 0) goto err; } - if (x->timeout != 0L) { + From 0aa9efe02bbf5b47cfbcea3ae964b5ec5843385b Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 27 Jun 2022 07:14:49 -0500 Subject: [PATCH 0079/1283] enable new tests --- tests/Makefile.am | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/tests/Makefile.am b/tests/Makefile.am index 6c88c9046f..2f2510c174 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -4,6 +4,7 @@ AM_CPPFLAGS += -DLIBRESSL_CRYPTO_INTERNAL AM_CPPFLAGS += -I $(top_srcdir)/crypto/asn1 AM_CPPFLAGS += -I $(top_srcdir)/crypto/bio +AM_CPPFLAGS += -I $(top_srcdir)/crypto/bn AM_CPPFLAGS += -I $(top_srcdir)/crypto/evp AM_CPPFLAGS += -I $(top_srcdir)/crypto/modes AM_CPPFLAGS += -I $(top_srcdir)/crypto/x509 @@ -48,6 +49,11 @@ arc4randomforktest_SOURCES = arc4randomforktest.c endif EXTRA_DIST += arc4randomforktest.sh +# asn1_string_to_utf8 +TESTS += asn1_string_to_utf8 +check_PROGRAMS += asn1_string_to_utf8 +asn1_string_to_utf8_SOURCES = asn1_string_to_utf8.c + # asn1api TESTS += asn1api check_PROGRAMS += asn1api @@ -111,6 +117,11 @@ check_PROGRAMS += biotest biotest_SOURCES = biotest.c endif +# bn_primes +TESTS += bn_primes +check_PROGRAMS += bn_primes +bn_primes_SOURCES = bn_primes.c + # bnaddsub TESTS += bnaddsub check_PROGRAMS += bnaddsub From 2518dbc9480f9e361f99cd790afe3f94f97053ff Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 10 Jul 2022 21:44:36 -0500 Subject: [PATCH 0080/1283] update for latest changes --- ssl/CMakeLists.txt | 1 + ssl/Makefile.am | 1 + tests/Makefile.am | 14 +++++++++++++- tests/ssltest.sh | 4 ++-- update.sh | 4 ++-- 5 files changed, 19 insertions(+), 5 deletions(-) diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index cec241705c..07636ad0d2 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -23,6 +23,7 @@ set( ssl_packet.c ssl_pkt.c ssl_rsa.c + ssl_seclevel.c ssl_sess.c ssl_sigalgs.c ssl_srvr.c diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 7eb0ccd03e..9cf3839ad4 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -62,6 +62,7 @@ libssl_la_SOURCES += ssl_methods.c libssl_la_SOURCES += ssl_packet.c libssl_la_SOURCES += ssl_pkt.c libssl_la_SOURCES += ssl_rsa.c +libssl_la_SOURCES += ssl_seclevel.c libssl_la_SOURCES += ssl_sess.c libssl_la_SOURCES += ssl_sigalgs.c libssl_la_SOURCES += ssl_srvr.c diff --git a/tests/Makefile.am b/tests/Makefile.am index 2f2510c174..5f768e2c00 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -518,7 +518,19 @@ TESTS += ssltest.sh check_PROGRAMS += ssltest ssltest_SOURCES = ssltest.c EXTRA_DIST += ssltest.sh ssltest.bat -EXTRA_DIST += testssl testssl.bat ca.pem server.pem +EXTRA_DIST += testssl testssl.bat +EXTRA_DIST += ca-int-ecdsa.crl ca-int-ecdsa.pem ca-int-rsa.crl ca-int-rsa.pem +EXTRA_DIST += ca-root-ecdsa.pem ca-root-rsa.pem ca.pem client.pem +EXTRA_DIST += client1-ecdsa-chain.pem client1-ecdsa.pem client1-rsa-chain.pem +EXTRA_DIST += client1-rsa.pem client2-ecdsa-chain.pem client2-ecdsa.pem +EXTRA_DIST += client2-rsa-chain.pem client2-rsa.pem client3-ecdsa-chain.pem +EXTRA_DIST += client3-ecdsa.pem client3-rsa-chain.pem client3-rsa.pem +EXTRA_DIST += server.pem server1-ecdsa-chain.pem server1-ecdsa.pem +EXTRA_DIST += server1-rsa-chain.pem server1-rsa.pem server2-ecdsa-chain.pem +EXTRA_DIST += server2-ecdsa.pem server2-rsa-chain.pem server2-rsa.pem +EXTRA_DIST += server3-ecdsa-chain.pem server3-ecdsa.pem server3-rsa-chain.pem +EXTRA_DIST += server3-rsa.pem + # string_table TESTS += string_table diff --git a/tests/ssltest.sh b/tests/ssltest.sh index 28da3acbb3..42835016e7 100755 --- a/tests/ssltest.sh +++ b/tests/ssltest.sh @@ -22,5 +22,5 @@ if [ -z $srcdir ]; then srcdir=. fi -$srcdir/testssl $srcdir/server.pem $srcdir/server.pem $srcdir/ca.pem \ - $ssltest_bin $openssl_bin +$srcdir/testssl $srcdir/server1-rsa.pem $srcdir/server1-rsa-chain.pem $srcdir/ca-root-rsa.pem + diff --git a/update.sh b/update.sh index 717c6ff1e1..2f325ca729 100755 --- a/update.sh +++ b/update.sh @@ -309,8 +309,8 @@ for i in `find $libssl_regress -name '*.c'`; do $CP "$i" tests done $CP $libssl_regress/unit/tests.h tests -$CP $libssl_regress/certs/ca.pem tests -$CP $libssl_regress/certs/server.pem tests +$CP $libssl_regress/certs/*.pem tests +$CP $libssl_regress/certs/*.crl tests $CP $libssl_regress/pqueue/expected.txt tests/pq_expected.txt # copy libtls tests From c6dea2878e5c4c04e1edba103a6223a4f4b3b58f Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 10 Jul 2022 22:11:37 -0500 Subject: [PATCH 0081/1283] fix test when openssl(1) is not in $PATH --- tests/ssltest.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tests/ssltest.sh b/tests/ssltest.sh index 42835016e7..22a8936671 100755 --- a/tests/ssltest.sh +++ b/tests/ssltest.sh @@ -22,5 +22,6 @@ if [ -z $srcdir ]; then srcdir=. fi -$srcdir/testssl $srcdir/server1-rsa.pem $srcdir/server1-rsa-chain.pem $srcdir/ca-root-rsa.pem - +$srcdir/testssl $srcdir/server1-rsa.pem $srcdir/server1-rsa-chain.pem \ + $srcdir/ca-root-rsa.pem \ + $ssltest_bin $openssl_bin From 5f5feb2bbc94a8cd8d101b6245c0d9b50f2a15ce Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 10 Jul 2022 22:13:46 -0500 Subject: [PATCH 0082/1283] update Windows certs --- tests/ssltest.bat | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/ssltest.bat b/tests/ssltest.bat index f068cb00de..5dda6bcd95 100644 --- a/tests/ssltest.bat +++ b/tests/ssltest.bat @@ -10,8 +10,8 @@ set openssl_bin=%2 set openssl_bin=%openssl_bin:/=\% if not exist %openssl_bin% exit /b 1 -%srcdir%\testssl.bat %srcdir%\server.pem %srcdir%\server.pem %srcdir%\ca.pem ^ - %ssltest_bin% %openssl_bin% +%srcdir%\testssl.bat %srcdir%\server1-rsa.pem %srcdir%\server1-rsa-chain.pem ^ + %srcdir%\ca-root-rsa.pem %ssltest_bin% %openssl_bin% if !errorlevel! neq 0 ( exit /b 1 ) From ef2d6c70daf540926d2d5fd4d50e2942633ec9bd Mon Sep 17 00:00:00 2001 From: Jiajie Chen Date: Tue, 12 Jul 2022 22:29:39 +0800 Subject: [PATCH 0083/1283] Detect machine/endian.h for macOS --- CMakeLists.txt | 5 +++++ include/compat/endian.h | 3 +++ m4/check-libc.m4 | 2 +- 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 03963a59f6..68a7c2dfe2 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -291,6 +291,11 @@ if(HAVE_ENDIAN_H) add_definitions(-DHAVE_ENDIAN_H) endif() +check_include_files(machine/endian.h HAVE_MACHINE_ENDIAN_H) +if(HAVE_MACHINE_ENDIAN_H) + add_definitions(-DHAVE_MACHINE_ENDIAN_H) +endif() + check_include_files(err.h HAVE_ERR_H) if(HAVE_ERR_H) add_definitions(-DHAVE_ERR_H) diff --git a/include/compat/endian.h b/include/compat/endian.h index 1ed255e8ba..cd85f5c48b 100644 --- a/include/compat/endian.h +++ b/include/compat/endian.h @@ -24,6 +24,9 @@ #elif defined(HAVE_ENDIAN_H) #include_next +#elif defined(HAVE_MACHINE_ENDIAN_H) +#include_next + #elif defined(__sun) || defined(_AIX) || defined(__hpux) #include #include diff --git a/m4/check-libc.m4 b/m4/check-libc.m4 index 40df67f778..68a4f88e4b 100644 --- a/m4/check-libc.m4 +++ b/m4/check-libc.m4 @@ -1,6 +1,6 @@ AC_DEFUN([CHECK_LIBC_COMPAT], [ # Check for libc headers -AC_CHECK_HEADERS([endian.h err.h readpassphrase.h]) +AC_CHECK_HEADERS([endian.h machine/endian.h err.h readpassphrase.h]) AC_CHECK_HEADERS([netinet/ip.h], [], [], [#include #include From cc613e785e9272db37991ec35785d78f50e0ca15 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 31 Jul 2022 23:31:18 -0500 Subject: [PATCH 0084/1283] updates for new files and test cases --- crypto/CMakeLists.txt | 2 ++ crypto/Makefile.am | 3 +++ ssl/CMakeLists.txt | 1 + ssl/Makefile.am | 1 + tests/CMakeLists.txt | 7 ++++++- tests/Makefile.am | 5 +++++ tests/aeadtest.sh | 8 +++++++- update.sh | 2 +- 8 files changed, 26 insertions(+), 3 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 2d2333287c..3f0c603eaf 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -333,6 +333,7 @@ set( bn/bn_add.c bn/bn_asm.c bn/bn_blind.c + bn/bn_bpsw.c bn/bn_const.c bn/bn_ctx.c bn/bn_depr.c @@ -342,6 +343,7 @@ set( bn/bn_exp2.c bn/bn_gcd.c bn/bn_gf2m.c + bn/bn_isqrt.c bn/bn_kron.c bn/bn_lib.c bn/bn_mod.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index b78f4915c9..9b3672403d 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -412,6 +412,7 @@ noinst_HEADERS += bio/bio_local.h libcrypto_la_SOURCES += bn/bn_add.c libcrypto_la_SOURCES += bn/bn_asm.c libcrypto_la_SOURCES += bn/bn_blind.c +libcrypto_la_SOURCES += bn/bn_bpsw.c libcrypto_la_SOURCES += bn/bn_const.c libcrypto_la_SOURCES += bn/bn_ctx.c libcrypto_la_SOURCES += bn/bn_depr.c @@ -421,6 +422,7 @@ libcrypto_la_SOURCES += bn/bn_exp.c libcrypto_la_SOURCES += bn/bn_exp2.c libcrypto_la_SOURCES += bn/bn_gcd.c libcrypto_la_SOURCES += bn/bn_gf2m.c +libcrypto_la_SOURCES += bn/bn_isqrt.c libcrypto_la_SOURCES += bn/bn_kron.c libcrypto_la_SOURCES += bn/bn_lib.c libcrypto_la_SOURCES += bn/bn_mod.c @@ -927,6 +929,7 @@ libcrypto_la_SOURCES += ts/ts_rsp_sign.c libcrypto_la_SOURCES += ts/ts_rsp_utils.c libcrypto_la_SOURCES += ts/ts_rsp_verify.c libcrypto_la_SOURCES += ts/ts_verify_ctx.c +noinst_HEADERS += ts/ts_local.h # txt_db libcrypto_la_SOURCES += txt_db/txt_db.c diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 07636ad0d2..e4af7ca622 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -47,6 +47,7 @@ set( tls13_key_schedule.c tls13_legacy.c tls13_lib.c + tls13_quic.c tls13_record.c tls13_record_layer.c tls13_server.c diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 9cf3839ad4..42b548cadc 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -86,6 +86,7 @@ libssl_la_SOURCES += tls13_handshake_msg.c libssl_la_SOURCES += tls13_key_schedule.c libssl_la_SOURCES += tls13_legacy.c libssl_la_SOURCES += tls13_lib.c +libssl_la_SOURCES += tls13_quic.c libssl_la_SOURCES += tls13_record.c libssl_la_SOURCES += tls13_record_layer.c libssl_la_SOURCES += tls13_server.c diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index e6cb2bcd9b..efa6e045cc 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -21,7 +21,12 @@ file(TO_NATIVE_PATH ${CMAKE_CURRENT_SOURCE_DIR} TEST_SOURCE_DIR) # aeadtest add_executable(aeadtest aeadtest.c) target_link_libraries(aeadtest ${OPENSSL_TEST_LIBS}) -add_test(aeadtest aeadtest ${CMAKE_CURRENT_SOURCE_DIR}/aeadtests.txt) +if(NOT WIN32) + add_test(NAME aeadtest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/aeadtest.sh) + set_tests_properties(aeadtest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") +else() + add_test(aeadtest aeadtest aead ${CMAKE_CURRENT_SOURCE_DIR}/aeadtests.txt) +endif() # aes_wrap add_executable(aes_wrap aes_wrap.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index 5f768e2c00..3be2f3f3f0 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -34,6 +34,11 @@ check_PROGRAMS += aeadtest aeadtest_SOURCES = aeadtest.c EXTRA_DIST += aeadtest.sh EXTRA_DIST += aeadtests.txt +EXTRA_DIST += aes_128_gcm_tests.txt +EXTRA_DIST += aes_192_gcm_tests.txt +EXTRA_DIST += aes_256_gcm_tests.txt +EXTRA_DIST += chacha20_poly1305_tests.txt +EXTRA_DIST += xchacha20_poly1305_tests.txt # aes_wrap TESTS += aes_wrap diff --git a/tests/aeadtest.sh b/tests/aeadtest.sh index 132b1fd5d3..9f59595afe 100755 --- a/tests/aeadtest.sh +++ b/tests/aeadtest.sh @@ -4,4 +4,10 @@ TEST=./aeadtest if [ -e ./aeadtest.exe ]; then TEST=./aeadtest.exe fi -$TEST $srcdir/aeadtests.txt +$TEST aead $srcdir/aeadtests.txt +$TEST aes-128-gcm $srcdir/aes_128_gcm_tests.txt +$TEST aes-192-gcm $srcdir/aes_192_gcm_tests.txt +$TEST aes-256-gcm $srcdir/aes_256_gcm_tests.txt +$TEST chacha20-poly1305 $srcdir/chacha20_poly1305_tests.txt +$TEST xchacha20-poly1305 $srcdir/xchacha20_poly1305_tests.txt + diff --git a/update.sh b/update.sh index 2f325ca729..3aea129407 100755 --- a/update.sh +++ b/update.sh @@ -288,7 +288,7 @@ for i in `find $libcrypto_regress -name '*.c'`; do $CP "$i" tests done $CP $libcrypto_regress/evp/evptests.txt tests -$CP $libcrypto_regress/aead/aeadtests.txt tests +$CP $libcrypto_regress/aead/*.txt tests # generate libcrypto freenull.c awk -f $libcrypto_regress/free/freenull.awk \ From c5c6e8289f4acd6a6be92612a6dd49020ca9299f Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 31 Jul 2022 23:53:20 -0500 Subject: [PATCH 0085/1283] add new tests --- tests/CMakeLists.txt | 16 ++++++++++++++++ tests/Makefile.am | 20 +++++++++++++++----- 2 files changed, 31 insertions(+), 5 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index efa6e045cc..eb1b79c367 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -4,6 +4,7 @@ include_directories( . ../crypto/asn1 ../crypto/bio + ../crypto/bn ../crypto/evp ../crypto/modes ../crypto/x509 @@ -109,6 +110,11 @@ add_executable(bnaddsub bnaddsub.c) target_link_libraries(bnaddsub ${OPENSSL_TEST_LIBS}) add_test(bnaddsub bnaddsub) +# bn_isqrt +add_executable(bn_isqrt bn_isqrt.c) +target_link_libraries(bn_isqrt ${OPENSSL_TEST_LIBS}) +add_test(bn_isqrt bn_isqrt) + # bn_mod_exp2_mont add_executable(bn_mod_exp2_mont bn_mod_exp2_mont.c) target_link_libraries(bn_mod_exp2_mont ${OPENSSL_TEST_LIBS}) @@ -119,6 +125,11 @@ add_executable(bn_mod_sqrt bn_mod_sqrt.c) target_link_libraries(bn_mod_sqrt ${OPENSSL_TEST_LIBS}) add_test(bn_mod_sqrt bn_mod_sqrt) +# bn_primes +add_executable(bn_primes bn_primes.c) +target_link_libraries(bn_primes ${OPENSSL_TEST_LIBS}) +add_test(bn_primes bn_primes) + # bn_rand_interval add_executable(bn_rand_interval bn_rand_interval.c) target_link_libraries(bn_rand_interval ${OPENSSL_TEST_LIBS}) @@ -499,6 +510,11 @@ add_executable(ssl_methods ssl_methods.c) target_link_libraries(ssl_methods ${OPENSSL_TEST_LIBS}) add_test(ssl_methods ssl_methods) +# ssl_set_alpn_protos +add_executable(ssl_set_alpn_protos ssl_set_alpn_protos.c) +target_link_libraries(ssl_set_alpn_protos ${OPENSSL_TEST_LIBS}) +add_test(ssl_set_alpn_protos ssl_set_alpn_protos) + # ssl_versions add_executable(ssl_versions ssl_versions.c) target_link_libraries(ssl_versions ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 3be2f3f3f0..79f10fbff1 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -122,16 +122,16 @@ check_PROGRAMS += biotest biotest_SOURCES = biotest.c endif -# bn_primes -TESTS += bn_primes -check_PROGRAMS += bn_primes -bn_primes_SOURCES = bn_primes.c - # bnaddsub TESTS += bnaddsub check_PROGRAMS += bnaddsub bnaddsub_SOURCES = bnaddsub.c +# bn_isqrt +TESTS += bn_isqrt +check_PROGRAMS += bn_isqrt +bn_isqrt_SOURCES = bn_isqrt.c + # bn_mod_exp2_mont TESTS += bn_mod_exp2_mont check_PROGRAMS += bn_mod_exp2_mont @@ -142,6 +142,11 @@ TESTS += bn_mod_sqrt check_PROGRAMS += bn_mod_sqrt bn_mod_sqrt_SOURCES = bn_mod_sqrt.c +# bn_primes +TESTS += bn_primes +check_PROGRAMS += bn_primes +bn_primes_SOURCES = bn_primes.c + # bn_rand_interval TESTS += bn_rand_interval check_PROGRAMS += bn_rand_interval @@ -513,6 +518,11 @@ TESTS += ssl_methods check_PROGRAMS += ssl_methods ssl_methods_SOURCES = ssl_methods.c +# ssl_set_alpn_protos +TESTS += ssl_set_alpn_protos +check_PROGRAMS += ssl_set_alpn_protos +ssl_set_alpn_protos_SOURCES = ssl_set_alpn_protos.c + # ssl_versions TESTS += ssl_versions check_PROGRAMS += ssl_versions From e7c48bb560efd49ace610f9f8c516728366435f3 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 1 Aug 2022 00:03:34 -0500 Subject: [PATCH 0086/1283] ignore new test files --- .gitignore | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.gitignore b/.gitignore index b85cf10dd3..e00baab6dd 100644 --- a/.gitignore +++ b/.gitignore @@ -63,11 +63,14 @@ tests/asn1complex* tests/asn1evp* tests/asn1object* tests/asn1string_copy* +tests/asn1_string_to_utf8* tests/asn1time* tests/asn1x509* tests/bnaddsub* +tests/bn_isqrt* tests/bn_mod_exp2_mont* tests/bn_mod_sqrt* +tests/bn_primes* tests/bn_rand_interval* tests/bn_to_string* tests/cipher* @@ -84,6 +87,7 @@ tests/rfc3779* tests/rfc5280time* tests/ssl_get_shared_ciphers* tests/ssl_methods* +tests/ssl_set_alpn_protos* tests/ssl_versions* tests/string_table* tests/timingsafe* From 3fcde14a007bae1bf1adb9ffdd58ebb06f6dce36 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 15 Aug 2022 07:59:06 +0200 Subject: [PATCH 0087/1283] regen tlsextest patch fixes #777 --- patches/tlsexttest.c.patch | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/patches/tlsexttest.c.patch b/patches/tlsexttest.c.patch index b1b86524c3..3c93df8879 100644 --- a/patches/tlsexttest.c.patch +++ b/patches/tlsexttest.c.patch @@ -1,6 +1,6 @@ ---- tests/tlsexttest.c.orig Fri Feb 18 16:30:40 2022 -+++ tests/tlsexttest.c Mon Feb 21 05:39:35 2022 -@@ -1658,7 +1658,9 @@ +--- tests/tlsexttest.c.orig Mon Aug 15 07:54:28 2022 ++++ tests/tlsexttest.c Mon Aug 15 07:57:01 2022 +@@ -1773,7 +1773,9 @@ static unsigned char tlsext_sni_client[] = { }; static unsigned char tlsext_sni_server[] = { @@ -10,7 +10,7 @@ static int test_tlsext_sni_client(void) -@@ -1843,9 +1845,9 @@ +@@ -1971,9 +1973,9 @@ test_tlsext_sni_server(void) if (!CBB_finish(&cbb, &data, &dlen)) errx(1, "failed to finish CBB"); @@ -22,7 +22,7 @@ goto err; } -@@ -1854,14 +1856,14 @@ +@@ -1982,14 +1984,14 @@ test_tlsext_sni_server(void) fprintf(stderr, "received:\n"); hexdump(data, dlen); fprintf(stderr, "test data:\n"); @@ -36,10 +36,10 @@ - CBS_init(&cbs, tlsext_sni_server, sizeof(tlsext_sni_server)); + CBS_init(&cbs, tlsext_sni_server, sizeof_tlsext_sni_server); - if (!tlsext_sni_client_parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) { + if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) { FAIL("failed to parse server SNI\n"); goto err; -@@ -2747,7 +2749,10 @@ +@@ -3194,7 +3196,10 @@ unsigned char tlsext_clienthello_default[] = { 0x04, 0x03, 0x02, 0x01, 0x02, 0x03, }; @@ -51,7 +51,7 @@ static int test_tlsext_clienthello_build(void) -@@ -2826,18 +2831,18 @@ +@@ -3280,18 +3285,18 @@ test_tlsext_clienthello_build(void) goto err; } From 8114acb6072d7798de2cb38be69b27160ce39809 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 15 Aug 2022 08:09:10 +0200 Subject: [PATCH 0088/1283] add p12_sbag.c --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 3f0c603eaf..e74d97bf51 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -658,6 +658,7 @@ set( pkcs12/p12_npas.c pkcs12/p12_p8d.c pkcs12/p12_p8e.c + pkcs12/p12_sbag.c pkcs12/p12_utl.c pkcs12/pk12err.c pkcs7/bio_pk7.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 9b3672403d..dc4d34037d 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -839,6 +839,7 @@ libcrypto_la_SOURCES += pkcs12/p12_mutl.c libcrypto_la_SOURCES += pkcs12/p12_npas.c libcrypto_la_SOURCES += pkcs12/p12_p8d.c libcrypto_la_SOURCES += pkcs12/p12_p8e.c +libcrypto_la_SOURCES += pkcs12/p12_sbag.c libcrypto_la_SOURCES += pkcs12/p12_utl.c libcrypto_la_SOURCES += pkcs12/pk12err.c From 08895e84976efd5f63bc515856efe43aad5abffb Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 15 Aug 2022 10:43:49 +0200 Subject: [PATCH 0089/1283] MSC doesn't have getopt --- patches/bn_isqrt.c.patch | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 patches/bn_isqrt.c.patch diff --git a/patches/bn_isqrt.c.patch b/patches/bn_isqrt.c.patch new file mode 100644 index 0000000000..bf205a3163 --- /dev/null +++ b/patches/bn_isqrt.c.patch @@ -0,0 +1,18 @@ +--- tests/bn_isqrt.c.orig Mon Aug 15 10:40:29 2022 ++++ tests/bn_isqrt.c Mon Aug 15 10:41:46 2022 +@@ -304,6 +304,7 @@ main(int argc, char *argv[]) + int ch; + int failed = 0, print = 0; + ++#ifndef _MSC_VER + while ((ch = getopt(argc, argv, "C")) != -1) { + switch (ch) { + case 'C': +@@ -314,6 +315,7 @@ main(int argc, char *argv[]) + break; + } + } ++#endif + + if (print) + return check_tables(1); From ed9359727a502d5ec5162e4017f76ffccf6aaa79 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 29 Aug 2022 08:42:43 -0500 Subject: [PATCH 0090/1283] build updates for latest upstream --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 2 ++ patches/tlsexttest.c.patch | 22 ++++++++++++++++++++++ ssl/CMakeLists.txt | 1 + ssl/Makefile.am | 1 + tests/CMakeLists.txt | 11 +++++++++++ tests/Makefile.am | 6 ++++++ tests/quictest.bat | 14 ++++++++++++++ tests/quictest.sh | 13 +++++++++++++ 9 files changed, 71 insertions(+) create mode 100644 tests/quictest.bat create mode 100755 tests/quictest.sh diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index e74d97bf51..2c0268c7cb 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -999,6 +999,7 @@ target_include_directories(crypto_obj hmac modes ocsp + pkcs12 rsa x509 ../include/compat diff --git a/crypto/Makefile.am b/crypto/Makefile.am index dc4d34037d..01833d2edf 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -15,6 +15,7 @@ AM_CPPFLAGS += -I$(top_srcdir)/crypto/evp AM_CPPFLAGS += -I$(top_srcdir)/crypto/hmac AM_CPPFLAGS += -I$(top_srcdir)/crypto/modes AM_CPPFLAGS += -I$(top_srcdir)/crypto/ocsp +AM_CPPFLAGS += -I$(top_srcdir)/crypto/pkcs12 AM_CPPFLAGS += -I$(top_srcdir)/crypto/rsa AM_CPPFLAGS += -I$(top_srcdir)/crypto/x509 AM_CPPFLAGS += -I$(top_srcdir)/crypto @@ -842,6 +843,7 @@ libcrypto_la_SOURCES += pkcs12/p12_p8e.c libcrypto_la_SOURCES += pkcs12/p12_sbag.c libcrypto_la_SOURCES += pkcs12/p12_utl.c libcrypto_la_SOURCES += pkcs12/pk12err.c +noinst_HEADERS += pkcs12/pkcs12_local.h # pkcs7 libcrypto_la_SOURCES += pkcs7/bio_pk7.c diff --git a/patches/tlsexttest.c.patch b/patches/tlsexttest.c.patch index 3c93df8879..5b9ceb1b4f 100644 --- a/patches/tlsexttest.c.patch +++ b/patches/tlsexttest.c.patch @@ -1,6 +1,12 @@ +<<<<<<< HEAD --- tests/tlsexttest.c.orig Mon Aug 15 07:54:28 2022 +++ tests/tlsexttest.c Mon Aug 15 07:57:01 2022 @@ -1773,7 +1773,9 @@ static unsigned char tlsext_sni_client[] = { +======= +--- tests/tlsexttest.c.orig Mon Aug 29 06:02:26 2022 ++++ tests/tlsexttest.c Mon Aug 29 06:18:01 2022 +@@ -1773,7 +1773,9 @@ +>>>>>>> 051c15d (build updates for latest upstream) }; static unsigned char tlsext_sni_server[] = { @@ -10,7 +16,11 @@ static int test_tlsext_sni_client(void) +<<<<<<< HEAD @@ -1971,9 +1973,9 @@ test_tlsext_sni_server(void) +======= +@@ -1971,9 +1973,9 @@ +>>>>>>> 051c15d (build updates for latest upstream) if (!CBB_finish(&cbb, &data, &dlen)) errx(1, "failed to finish CBB"); @@ -22,7 +32,11 @@ goto err; } +<<<<<<< HEAD @@ -1982,14 +1984,14 @@ test_tlsext_sni_server(void) +======= +@@ -1982,14 +1984,14 @@ +>>>>>>> 051c15d (build updates for latest upstream) fprintf(stderr, "received:\n"); hexdump(data, dlen); fprintf(stderr, "test data:\n"); @@ -39,7 +53,11 @@ if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) { FAIL("failed to parse server SNI\n"); goto err; +<<<<<<< HEAD @@ -3194,7 +3196,10 @@ unsigned char tlsext_clienthello_default[] = { +======= +@@ -3196,7 +3198,10 @@ +>>>>>>> 051c15d (build updates for latest upstream) 0x04, 0x03, 0x02, 0x01, 0x02, 0x03, }; @@ -51,7 +69,11 @@ static int test_tlsext_clienthello_build(void) +<<<<<<< HEAD @@ -3280,18 +3285,18 @@ test_tlsext_clienthello_build(void) +======= +@@ -3282,18 +3287,18 @@ +>>>>>>> 051c15d (build updates for latest upstream) goto err; } diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index e4af7ca622..8e974a84cc 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -37,6 +37,7 @@ set( tls_buffer.c tls_content.c tls_key_share.c + tls_lib.c tls12_key_schedule.c tls12_lib.c tls12_record_layer.c diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 42b548cadc..d5c04665a6 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -76,6 +76,7 @@ libssl_la_SOURCES += t1_lib.c libssl_la_SOURCES += tls_buffer.c libssl_la_SOURCES += tls_content.c libssl_la_SOURCES += tls_key_share.c +libssl_la_SOURCES += tls_lib.c libssl_la_SOURCES += tls12_key_schedule.c libssl_la_SOURCES += tls12_lib.c libssl_la_SOURCES += tls12_record_layer.c diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index eb1b79c367..7e80c97f8b 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -413,6 +413,17 @@ else() endif() set_tests_properties(pq_test PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") +# quictest +set(QUICTEST_SRC quictest.c) +add_executable(quictest ${QUICTEST_SRC}) +target_link_libraries(quictest ${OPENSSL_TEST_LIBS}) +if(NOT MSVC) + add_test(NAME quictest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/quictest.sh) +else() + add_test(NAME quictest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/quictest.bat $) +endif() +set_tests_properties(quictest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") + # randtest add_executable(randtest randtest.c) target_link_libraries(randtest ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 79f10fbff1..2a48a2b740 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -425,6 +425,12 @@ pq_test_SOURCES = pq_test.c EXTRA_DIST += pq_test.sh pq_test.bat EXTRA_DIST += pq_expected.txt +# quictest +TESTS += quictest.sh +check_PROGRAMS += quictest +quictest_SOURCES = quictest.c +EXTRA_DIST += quictest.sh quictest.bat + # randtest TESTS += randtest check_PROGRAMS += randtest diff --git a/tests/quictest.bat b/tests/quictest.bat new file mode 100644 index 0000000000..cfbf2cd80e --- /dev/null +++ b/tests/quictest.bat @@ -0,0 +1,14 @@ +@echo off +setlocal enabledelayedexpansion +REM quictest.bat + +set quictest_bin=%1 +set quictest_bin=%quictest_bin:/=\% +if not exist %quictest_bin% exit /b 1 + +%quictest_bin% %srcdir%\server.pem %srcdir%\server.pem %srcdir%\ca.pem +if !errorlevel! neq 0 ( + exit /b 1 +) + +endlocal diff --git a/tests/quictest.sh b/tests/quictest.sh new file mode 100755 index 0000000000..cc1982f644 --- /dev/null +++ b/tests/quictest.sh @@ -0,0 +1,13 @@ +#!/bin/sh +set -e + +quictest_bin=./quictest +if [ -e ./quictest.exe ]; then + quictest_bin=./quictest.exe +fi + +if [ -z $srcdir ]; then + srcdir=. +fi + +$quictest_bin $srcdir/server.pem $srcdir/server.pem $srcdir/ca.pem From e76225361042de27311454adcdb5934edc6db446 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 29 Aug 2022 09:06:52 -0500 Subject: [PATCH 0091/1283] update manpage links --- man/links | 33 ++++++++++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 3 deletions(-) diff --git a/man/links b/man/links index b2d1783293..03f9c142ab 100644 --- a/man/links +++ b/man/links @@ -12,11 +12,17 @@ ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_check.3 ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_get_bit.3 ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_set_bit.3 ASN1_INTEGER_get.3,ASN1_ENUMERATED_get.3 +ASN1_INTEGER_get.3,ASN1_ENUMERATED_get_int64.3 ASN1_INTEGER_get.3,ASN1_ENUMERATED_set.3 +ASN1_INTEGER_get.3,ASN1_ENUMERATED_set_int64.3 ASN1_INTEGER_get.3,ASN1_ENUMERATED_to_BN.3 ASN1_INTEGER_get.3,ASN1_INTEGER_cmp.3 ASN1_INTEGER_get.3,ASN1_INTEGER_dup.3 +ASN1_INTEGER_get.3,ASN1_INTEGER_get_int64.3 +ASN1_INTEGER_get.3,ASN1_INTEGER_get_uint64.3 ASN1_INTEGER_get.3,ASN1_INTEGER_set.3 +ASN1_INTEGER_get.3,ASN1_INTEGER_set_int64.3 +ASN1_INTEGER_get.3,ASN1_INTEGER_set_uint64.3 ASN1_INTEGER_get.3,ASN1_INTEGER_to_BN.3 ASN1_INTEGER_get.3,BN_to_ASN1_ENUMERATED.3 ASN1_INTEGER_get.3,BN_to_ASN1_INTEGER.3 @@ -146,6 +152,7 @@ BIO_ctrl.3,BIO_eof.3 BIO_ctrl.3,BIO_flush.3 BIO_ctrl.3,BIO_get_close.3 BIO_ctrl.3,BIO_get_info_callback.3 +BIO_ctrl.3,BIO_info_cb.3 BIO_ctrl.3,BIO_int_ctrl.3 BIO_ctrl.3,BIO_pending.3 BIO_ctrl.3,BIO_ptr_ctrl.3 @@ -155,7 +162,6 @@ BIO_ctrl.3,BIO_set_close.3 BIO_ctrl.3,BIO_set_info_callback.3 BIO_ctrl.3,BIO_tell.3 BIO_ctrl.3,BIO_wpending.3 -BIO_ctrl.3,bio_info_cb.3 BIO_dump.3,BIO_dump_fp.3 BIO_dump.3,BIO_dump_indent.3 BIO_dump.3,BIO_dump_indent_fp.3 @@ -530,6 +536,7 @@ DES_set_key.3,DES_string_to_key.3 DES_set_key.3,DES_xcbc_encrypt.3 DH_generate_key.3,DH_compute_key.3 DH_generate_parameters.3,DH_check.3 +DH_generate_parameters.3,DH_check_pub_key.3 DH_generate_parameters.3,DH_generate_parameters_ex.3 DH_get0_pqg.3,DH_clear_flags.3 DH_get0_pqg.3,DH_get0_engine.3 @@ -571,6 +578,8 @@ DSA_get_ex_new_index.3,DSA_get_ex_data.3 DSA_get_ex_new_index.3,DSA_set_ex_data.3 DSA_meth_new.3,DSA_meth_dup.3 DSA_meth_new.3,DSA_meth_free.3 +DSA_meth_new.3,DSA_meth_get0_name.3 +DSA_meth_new.3,DSA_meth_set1_name.3 DSA_meth_new.3,DSA_meth_set_finish.3 DSA_meth_new.3,DSA_meth_set_sign.3 DSA_new.3,DSA_free.3 @@ -581,6 +590,7 @@ DSA_set_method.3,DSA_new_method.3 DSA_set_method.3,DSA_set_default_method.3 DSA_sign.3,DSA_sign_setup.3 DSA_sign.3,DSA_verify.3 +DSA_size.3,DSA_bits.3 ECDH_compute_key.3,ECDH_size.3 ECDSA_SIG_new.3,ECDSA_OpenSSL.3 ECDSA_SIG_new.3,ECDSA_SIG_free.3 @@ -1034,11 +1044,17 @@ EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_add0.3 EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_add_alias.3 EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_copy.3 EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_free.3 +EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_check.3 EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_ctrl.3 EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_free.3 EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_param.3 +EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_param_check.3 EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_private.3 EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_public.3 +EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_public_check.3 +EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_security_bits.3 +EVP_PKEY_check.3,EVP_PKEY_param_check.3 +EVP_PKEY_check.3,EVP_PKEY_public_check.3 EVP_PKEY_cmp.3,EVP_PKEY_cmp_parameters.3 EVP_PKEY_cmp.3,EVP_PKEY_copy_parameters.3 EVP_PKEY_cmp.3,EVP_PKEY_missing_parameters.3 @@ -1059,6 +1075,7 @@ EVP_PKEY_meth_new.3,EVP_PKEY_meth_add0.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_copy.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_find.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_free.3 +EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_check.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_cleanup.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_copy.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_ctrl.3 @@ -1067,7 +1084,9 @@ EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_derive.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_encrypt.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_init.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_keygen.3 +EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_param_check.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_paramgen.3 +EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_public_check.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_sign.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_signctx.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_verify.3 @@ -1103,12 +1122,12 @@ EVP_PKEY_set1_RSA.3,EVP_PKEY_set1_EC_KEY.3 EVP_PKEY_set1_RSA.3,EVP_PKEY_set_type.3 EVP_PKEY_set1_RSA.3,EVP_PKEY_type.3 EVP_PKEY_sign.3,EVP_PKEY_sign_init.3 +EVP_PKEY_size.3,EVP_PKEY_bits.3 +EVP_PKEY_size.3,EVP_PKEY_security_bits.3 EVP_PKEY_verify.3,EVP_PKEY_verify_init.3 EVP_PKEY_verify_recover.3,EVP_PKEY_verify_recover_init.3 EVP_SealInit.3,EVP_SealFinal.3 EVP_SealInit.3,EVP_SealUpdate.3 -EVP_SignInit.3,EVP_PKEY_bits.3 -EVP_SignInit.3,EVP_PKEY_size.3 EVP_SignInit.3,EVP_SignFinal.3 EVP_SignInit.3,EVP_SignInit_ex.3 EVP_SignInit.3,EVP_SignUpdate.3 @@ -1611,6 +1630,9 @@ RSA_print.3,DSAparams_print_fp.3 RSA_print.3,RSA_print_fp.3 RSA_private_encrypt.3,RSA_public_decrypt.3 RSA_public_encrypt.3,RSA_private_decrypt.3 +RSA_security_bits.3,BN_security_bits.3 +RSA_security_bits.3,DH_security_bits.3 +RSA_security_bits.3,DSA_security_bits.3 RSA_set_method.3,RSA_PKCS1_SSLeay.3 RSA_set_method.3,RSA_flags.3 RSA_set_method.3,RSA_get_default_method.3 @@ -1785,6 +1807,9 @@ SSL_CTX_set_read_ahead.3,SSL_CTX_get_default_read_ahead.3 SSL_CTX_set_read_ahead.3,SSL_CTX_get_read_ahead.3 SSL_CTX_set_read_ahead.3,SSL_get_read_ahead.3 SSL_CTX_set_read_ahead.3,SSL_set_read_ahead.3 +SSL_CTX_set_security_level.3,SSL_CTX_get_security_level.3 +SSL_CTX_set_security_level.3,SSL_get_security_level.3 +SSL_CTX_set_security_level.3,SSL_set_security_level.3 SSL_CTX_set_session_cache_mode.3,SSL_CTX_get_session_cache_mode.3 SSL_CTX_set_session_id_context.3,SSL_set_session_id_context.3 SSL_CTX_set_ssl_version.3,SSL_CTX_get_ssl_method.3 @@ -2243,12 +2268,14 @@ X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get0_name.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get0_peername.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get_depth.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get_flags.3 +X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get_time.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set1_email.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set1_host.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set1_ip.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set1_ip_asc.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set1_name.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set1_policies.3 +X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set_auth_level.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set_depth.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set_hostflags.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set_purpose.3 From d46266c297dc0cf9a187203a3f329d6a25bf2de6 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 29 Aug 2022 10:57:39 -0500 Subject: [PATCH 0092/1283] fix corrupted patch on merge --- patches/tlsexttest.c.patch | 22 ---------------------- 1 file changed, 22 deletions(-) diff --git a/patches/tlsexttest.c.patch b/patches/tlsexttest.c.patch index 5b9ceb1b4f..3c93df8879 100644 --- a/patches/tlsexttest.c.patch +++ b/patches/tlsexttest.c.patch @@ -1,12 +1,6 @@ -<<<<<<< HEAD --- tests/tlsexttest.c.orig Mon Aug 15 07:54:28 2022 +++ tests/tlsexttest.c Mon Aug 15 07:57:01 2022 @@ -1773,7 +1773,9 @@ static unsigned char tlsext_sni_client[] = { -======= ---- tests/tlsexttest.c.orig Mon Aug 29 06:02:26 2022 -+++ tests/tlsexttest.c Mon Aug 29 06:18:01 2022 -@@ -1773,7 +1773,9 @@ ->>>>>>> 051c15d (build updates for latest upstream) }; static unsigned char tlsext_sni_server[] = { @@ -16,11 +10,7 @@ static int test_tlsext_sni_client(void) -<<<<<<< HEAD @@ -1971,9 +1973,9 @@ test_tlsext_sni_server(void) -======= -@@ -1971,9 +1973,9 @@ ->>>>>>> 051c15d (build updates for latest upstream) if (!CBB_finish(&cbb, &data, &dlen)) errx(1, "failed to finish CBB"); @@ -32,11 +22,7 @@ goto err; } -<<<<<<< HEAD @@ -1982,14 +1984,14 @@ test_tlsext_sni_server(void) -======= -@@ -1982,14 +1984,14 @@ ->>>>>>> 051c15d (build updates for latest upstream) fprintf(stderr, "received:\n"); hexdump(data, dlen); fprintf(stderr, "test data:\n"); @@ -53,11 +39,7 @@ if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) { FAIL("failed to parse server SNI\n"); goto err; -<<<<<<< HEAD @@ -3194,7 +3196,10 @@ unsigned char tlsext_clienthello_default[] = { -======= -@@ -3196,7 +3198,10 @@ ->>>>>>> 051c15d (build updates for latest upstream) 0x04, 0x03, 0x02, 0x01, 0x02, 0x03, }; @@ -69,11 +51,7 @@ static int test_tlsext_clienthello_build(void) -<<<<<<< HEAD @@ -3280,18 +3285,18 @@ test_tlsext_clienthello_build(void) -======= -@@ -3282,18 +3287,18 @@ ->>>>>>> 051c15d (build updates for latest upstream) goto err; } From 63f45c459791eec1b67cbd56f7eaed491d5ce926 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 3 Sep 2022 19:13:50 +0200 Subject: [PATCH 0093/1283] Adjust for Joshua Sing's test replacements --- tests/CMakeLists.txt | 39 ++++++++++++--------------------------- tests/Makefile.am | 39 ++++++++++++--------------------------- 2 files changed, 24 insertions(+), 54 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 7e80c97f8b..ed2d080f1c 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -342,15 +342,10 @@ add_test(keypairtest keypairtest ${CMAKE_CURRENT_SOURCE_DIR}/server.pem ${CMAKE_CURRENT_SOURCE_DIR}/server.pem) -# md4test -add_executable(md4test md4test.c) -target_link_libraries(md4test ${OPENSSL_TEST_LIBS}) -add_test(md4test md4test) - -# md5test -add_executable(md5test md5test.c) -target_link_libraries(md5test ${OPENSSL_TEST_LIBS}) -add_test(md5test md5test) +# md_test +add_executable(md_test md_test.c) +target_link_libraries(md_test ${OPENSSL_TEST_LIBS}) +add_test(md_test md_test) # mont add_executable(mont mont.c) @@ -464,10 +459,10 @@ else() add_test(rfc5280time rfc5280time) endif() -# rmdtest -add_executable(rmdtest rmdtest.c) -target_link_libraries(rmdtest ${OPENSSL_TEST_LIBS}) -add_test(rmdtest rmdtest) +# rmd_test +add_executable(rmd_test rmd_test.c) +target_link_libraries(rmd_test ${OPENSSL_TEST_LIBS}) +add_test(rmd_test rmdtest) # rsa_test add_executable(rsa_test rsa_test.c) @@ -484,20 +479,10 @@ else() endif() set_tests_properties(servertest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") -# sha1test -add_executable(sha1test sha1test.c) -target_link_libraries(sha1test ${OPENSSL_TEST_LIBS}) -add_test(sha1test sha1test) - -# sha256test -add_executable(sha256test sha256test.c) -target_link_libraries(sha256test ${OPENSSL_TEST_LIBS}) -add_test(sha256test sha256test) - -# sha512test -add_executable(sha512test sha512test.c) -target_link_libraries(sha512test ${OPENSSL_TEST_LIBS}) -add_test(sha512test sha512test) +# sha_test +add_executable(sha_test sha_test.c) +target_link_libraries(sha_test ${OPENSSL_TEST_LIBS}) +add_test(sha_test sha_test) # sm3test add_executable(sm3test sm3test.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index 2a48a2b740..a277dd98fc 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -360,15 +360,10 @@ check_PROGRAMS += keypairtest keypairtest_SOURCES = keypairtest.c EXTRA_DIST += keypairtest.sh -# md4test -TESTS += md4test -check_PROGRAMS += md4test -md4test_SOURCES = md4test.c - -# md5test -TESTS += md5test -check_PROGRAMS += md5test -md5test_SOURCES = md5test.c +# md_test +TESTS += md_test +check_PROGRAMS += md_test +md_test_SOURCES = md_test.c # mont TESTS += mont @@ -472,10 +467,10 @@ TESTS += rfc5280time endif EXTRA_DIST += rfc5280time_small.test -# rmdtest -TESTS += rmdtest -check_PROGRAMS += rmdtest -rmdtest_SOURCES = rmdtest.c +# rmd_test +TESTS += rmd_test +check_PROGRAMS += rmd_test +rmd_test_SOURCES = rmd_test.c # rsa_test TESTS += rsa_test @@ -488,20 +483,10 @@ check_PROGRAMS += servertest servertest_SOURCES = servertest.c EXTRA_DIST += servertest.sh servertest.bat -# sha1test -TESTS += sha1test -check_PROGRAMS += sha1test -sha1test_SOURCES = sha1test.c - -# sha256test -TESTS += sha256test -check_PROGRAMS += sha256test -sha256test_SOURCES = sha256test.c - -# sha512test -TESTS += sha512test -check_PROGRAMS += sha512test -sha512test_SOURCES = sha512test.c +# sha_test +TESTS += sha_test +check_PROGRAMS += sha_test +sha_test_SOURCES = sha_test.c # sm3test TESTS += sm3test From 6e20d9ec3240cb099b38f480fd051198bd68fc4a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 3 Sep 2022 20:29:49 +0200 Subject: [PATCH 0094/1283] fix rmd_test --- tests/CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index ed2d080f1c..c76b9483fb 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -462,7 +462,7 @@ endif() # rmd_test add_executable(rmd_test rmd_test.c) target_link_libraries(rmd_test ${OPENSSL_TEST_LIBS}) -add_test(rmd_test rmdtest) +add_test(rmd_test rmd_test) # rsa_test add_executable(rsa_test rsa_test.c) From f64dbe82d25626cd0fa5f60f0f4ba1354ab8e9d3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 5 Sep 2022 21:29:38 +0200 Subject: [PATCH 0095/1283] Update for new rc4_test --- tests/CMakeLists.txt | 8 ++++---- tests/Makefile.am | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index c76b9483fb..5f9e32fe86 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -429,10 +429,10 @@ add_executable(rc2test rc2test.c) target_link_libraries(rc2test ${OPENSSL_TEST_LIBS}) add_test(rc2test rc2test) -# rc4test -add_executable(rc4test rc4test.c) -target_link_libraries(rc4test ${OPENSSL_TEST_LIBS}) -add_test(rc4test rc4test) +# rc4_test +add_executable(rc4_test rc4_test.c) +target_link_libraries(rc4_test ${OPENSSL_TEST_LIBS}) +add_test(rc4_test rc4_test) # recordtest add_executable(recordtest recordtest.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index a277dd98fc..24b46585c0 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -436,10 +436,10 @@ TESTS += rc2test check_PROGRAMS += rc2test rc2test_SOURCES = rc2test.c -# rc4test -TESTS += rc4test -check_PROGRAMS += rc4test -rc4test_SOURCES = rc4test.c +# rc4_test +TESTS += rc4_test +check_PROGRAMS += rc4_test +rc4_test_SOURCES = rc4_test.c # recordtest TESTS += recordtest From cc60b91ff244bc355ca27a14008e94ea15b5c082 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 5 Sep 2022 23:48:20 +0200 Subject: [PATCH 0096/1283] Drop long long casts that are now upstream --- patches/rfc5280.c.patch | 34 ---------------------------------- 1 file changed, 34 deletions(-) diff --git a/patches/rfc5280.c.patch b/patches/rfc5280.c.patch index 92621836fa..9807f00d52 100644 --- a/patches/rfc5280.c.patch +++ b/patches/rfc5280.c.patch @@ -46,37 +46,3 @@ { .str = "700101000000Z", .data = "700101000000Z", -@@ -273,14 +279,14 @@ - - if ((i = X509_cmp_time(gt, &att->time)) != -1) { - fprintf(stderr, "FAIL: test %i - X509_cmp_time failed - returned %d compared to %lld\n", -- test_no, i, att->time); -+ test_no, i, (long long)att->time); - goto done; - } - - att->time--; - if ((i = X509_cmp_time(gt, &att->time)) != 1) { - fprintf(stderr, "FAIL: test %i - X509_cmp_time failed - returned %d compared to %lld\n", -- test_no, i, att->time); -+ test_no, i, (long long)att->time); - goto done; - } - att->time++; -@@ -325,14 +331,14 @@ - - if ((i = X509_cmp_time(ut, &att->time)) != -1) { - fprintf(stderr, "FAIL: test %i - X509_cmp_time failed - returned %d compared to %lld\n", -- test_no, i, att->time); -+ test_no, i, (long long)att->time); - goto done; - } - - att->time--; - if ((i = X509_cmp_time(ut, &att->time)) != 1) { - fprintf(stderr, "FAIL: test %i - X509_cmp_time failed - returned %d compared to %lld\n", -- test_no, i, att->time); -+ test_no, i, (long long)att->time); - goto done; - } - att->time++; From 08e05643394af41025b0e38251bb8d50c4a93db8 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 5 Sep 2022 23:50:05 +0200 Subject: [PATCH 0097/1283] Regen tlsexttestc.c.patch --- patches/tlsexttest.c.patch | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/patches/tlsexttest.c.patch b/patches/tlsexttest.c.patch index 3c93df8879..bc81da5198 100644 --- a/patches/tlsexttest.c.patch +++ b/patches/tlsexttest.c.patch @@ -1,5 +1,5 @@ ---- tests/tlsexttest.c.orig Mon Aug 15 07:54:28 2022 -+++ tests/tlsexttest.c Mon Aug 15 07:57:01 2022 +--- tests/tlsexttest.c.orig Mon Sep 5 22:30:36 2022 ++++ tests/tlsexttest.c Mon Sep 5 22:32:52 2022 @@ -1773,7 +1773,9 @@ static unsigned char tlsext_sni_client[] = { }; @@ -39,7 +39,7 @@ if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) { FAIL("failed to parse server SNI\n"); goto err; -@@ -3194,7 +3196,10 @@ unsigned char tlsext_clienthello_default[] = { +@@ -3196,7 +3198,10 @@ unsigned char tlsext_clienthello_default[] = { 0x04, 0x03, 0x02, 0x01, 0x02, 0x03, }; @@ -51,7 +51,7 @@ static int test_tlsext_clienthello_build(void) -@@ -3280,18 +3285,18 @@ test_tlsext_clienthello_build(void) +@@ -3282,18 +3287,18 @@ test_tlsext_clienthello_build(void) goto err; } From d9ba5a5bdfdd4381716142090603fbb39e43bca2 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 5 Sep 2022 23:52:41 +0200 Subject: [PATCH 0098/1283] Regen aeadtest.c.patch --- patches/aeadtest.c.patch | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/patches/aeadtest.c.patch b/patches/aeadtest.c.patch index 4f7319d89b..b3fe052411 100644 --- a/patches/aeadtest.c.patch +++ b/patches/aeadtest.c.patch @@ -1,6 +1,6 @@ ---- tests/aeadtest.c.orig Sat Jan 26 12:39:05 2019 -+++ tests/aeadtest.c Fri Sep 4 04:04:26 2020 -@@ -79,6 +79,12 @@ +--- tests/aeadtest.c.orig Mon Sep 5 22:30:33 2022 ++++ tests/aeadtest.c Mon Sep 5 23:51:27 2022 +@@ -48,6 +48,12 @@ #define BUF_MAX 1024 From 5ecf1c62dccc6ad16b41fe11985d1d4b762ff0f0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 6 Sep 2022 01:39:41 +0200 Subject: [PATCH 0099/1283] Regen bio.h.patch --- patches/bio.h.patch | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/patches/bio.h.patch b/patches/bio.h.patch index 29bba0ce16..072bc3b052 100644 --- a/patches/bio.h.patch +++ b/patches/bio.h.patch @@ -1,6 +1,6 @@ ---- include/openssl/bio.h.orig Fri Feb 18 16:30:39 2022 -+++ include/openssl/bio.h Mon Feb 21 05:39:35 2022 -@@ -666,8 +666,24 @@ +--- include/openssl/bio.h.orig Mon Sep 5 22:30:32 2022 ++++ include/openssl/bio.h Tue Sep 6 01:38:22 2022 +@@ -666,8 +666,24 @@ void BIO_copy_next_retry(BIO *b); /*long BIO_ghbn_ctrl(int cmd,int iarg,char *parg);*/ @@ -25,12 +25,11 @@ __attribute__((__format__(__printf__, 2, 3), __nonnull__(2))); int BIO_vprintf(BIO *bio, const char *format, va_list args) -@@ -680,6 +696,8 @@ +@@ -680,6 +696,7 @@ int BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args) __attribute__((__deprecated__, __format__(__printf__, 3, 0), __nonnull__(3))); +#endif -+ - /* BEGIN ERROR CODES */ - /* The following lines are auto generated by the script mkerr.pl. Any changes + void ERR_load_BIO_strings(void); + From a43a9b57c013de76550281b656b9ae79c3076059 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 6 Sep 2022 17:43:00 +0200 Subject: [PATCH 0100/1283] Switch to new rc2_test --- tests/CMakeLists.txt | 8 ++++---- tests/Makefile.am | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 5f9e32fe86..9b10b338c6 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -424,10 +424,10 @@ add_executable(randtest randtest.c) target_link_libraries(randtest ${OPENSSL_TEST_LIBS}) add_test(randtest randtest) -# rc2test -add_executable(rc2test rc2test.c) -target_link_libraries(rc2test ${OPENSSL_TEST_LIBS}) -add_test(rc2test rc2test) +# rc2_test +add_executable(rc2_test rc2_test.c) +target_link_libraries(rc2_test ${OPENSSL_TEST_LIBS}) +add_test(rc2_test rc2_test) # rc4_test add_executable(rc4_test rc4_test.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index 24b46585c0..24e6f2ee8f 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -431,10 +431,10 @@ TESTS += randtest check_PROGRAMS += randtest randtest_SOURCES = randtest.c -# rc2test -TESTS += rc2test -check_PROGRAMS += rc2test -rc2test_SOURCES = rc2test.c +# rc2_test +TESTS += rc2_test +check_PROGRAMS += rc2_test +rc2_test_SOURCES = rc2_test.c # rc4_test TESTS += rc4_test From 2e9adeeeaec26ff0d6588d2831171676b0c9da69 Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Sat, 10 Sep 2022 09:51:13 +0500 Subject: [PATCH 0101/1283] appveyor: store entire build folder in artifacts --- appveyor.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/appveyor.yml b/appveyor.yml index 33a32daea2..59238d76c0 100644 --- a/appveyor.yml +++ b/appveyor.yml @@ -49,6 +49,5 @@ on_failure: - appveyor PushArtifact Testing.zip artifacts: - - path: build\Testing - name: Testing + - path: build type: zip From 69f2eb869e530f96ad696105938a0c28046b672b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 20 Sep 2022 12:13:40 +0200 Subject: [PATCH 0102/1283] Initial 3.6.0 ChangeLog --- ChangeLog | 138 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 138 insertions(+) diff --git a/ChangeLog b/ChangeLog index e4dc7ad1ea..043e825acc 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,6 +28,144 @@ history is also available from Git. LibreSSL Portable Release Notes: +3.6.0 - Development release + + * Internal improvements + - Avoid expensive RFC 3779 checks during cert verification. + - The templated ASN.1 decoder has been cleaned up, refactored, + modernized with parts rewritten using CBB and CBS. + - The ASN.1 time parser has been rewritten. + - Rewrite and fix ASN1_STRING_to_UTF8(). + - Use asn1_abs_set_unused_bits() rather than inlining it. + - Simplify ec_asn1_group2curve(). + - First pass at a clean up of ASN1_item_sign_ctx() + - ssl_txt.c was cleaned up. + - Internal function arguments and struct member have been changed + to size_t. + - Lots of missing error checks of EVP API were added. + - Clean up and clarify BN_kronecker(). + - Simplify ASN1_INTEGER_cmp() + - Rewrite ASN1_INTEGER_{get,set}() using CBS and CBB and reuse + the ASN1_INTEGER functions for ASN1_ENUMERATED. + - Use ASN1_INTEGER to parse and build {Z,}LONG_it + - Refactored and cleaned up group (elliptic curve) handling in + t1_lib.c. + - Simplify certificate list handling code in the legacy server. + - Make CBB_finish() fail if *out_data is not NULL. + - Remove tls_buffer_set_data() and remove/revise callers. + - Rewrite SSL{_CTX,}_set_alpn_protos() using CBS. + - Simplify tlsext_supported_groups_server_parse(). + - Remove redundant length checks in tlsext parse functions. + - Simplify tls13_server_encrypted_extensions_recv(). + - Add read and write support to tls_buffer. + - Convert TLS transcript from BUF_MEM to tls_buffer. + - Clear key on exit in PKCS12_gen_mac(). + - Minor fixes in PKCS12_parse(). + - Provide and use a primitive clear function for BIGNUM_it. + - Use ASN1_INTEGER to encode/decode BIGNUM_it. + - Add stack frames to AES-NI x86_64 assembly. + - Use named initialisers for BIGNUMs. + - Tidy up some of BN_nist_mod_*. + - Expand BLOCK_CIPHER_* and related macros. + - Avoid shadowing the cbs function parameter in + tlsext_alpn_server_parse() + - Deduplicate peer certificate chain processing code. + - Make it possible to signal an error from an i2c_* function. + - Rewrite i2c_ASN1_INTEGER() using CBB/CBS. + - Remove UINT32_MAX limitation on ChaCha() and CRYPTO_chacha_20(). + - Remove bogus length checks from EVP_aead_chacha20_poly1305(). + - Reworked DSA_size() and ECDSA_size(). + - Stop using CBIGNUM_it internal to libcrypto. + - Provide c2i_ASN1_ENUMERATED_cbs() and call it from + asn1_c2i_primitive(). + - Ensure ASN.1 types are appropriately encoded. + - Avoid recycling ASN1_STRINGs when decoding ASN.1. + - Tidy up asn1_c2i_primitive() slightly. + - Mechanically expand IMPLEMENT_BLOCK_CIPHER, IMPLEMENT_CFBR, + BLOCK_CIPHER and the looney M_do_cipher macros. + - Use correct length for EVP CFB mode ciphers. + - Provide a version of ssl_msg_callback() that takes a CBS. + - Use CBS to parse TLS alerts in the legacy stack. + - Increment the input and output position for EVP AES CFB1. + - Ensure there is no trailing data for a CCS received by the + TLSv1.3 stack. + - Use CBS when procesing a CCS message in the legacy stack. + - Be stricter with middlebox compatibility mode in the TLSv1.3 + server. + * Compatibility changes + - The ASN.1 time parser has been refactored and rewritten using CBS. + It has been made stricter in that it now enforces the rules from + RFC 5280. + - ASN1_AFLG_BROKEN was removed. + - Error check tls_session_secret_cb() like OpenSSL. + - Added ASN1_INTEGER_{get,set}_{u,}int64() + - Move leaf certificate checks to the last thing after chain + validation. + - Added -s option to openssl(1) ciphers that only shows the ciphers + supported by the specified protocol. + - Use TLS_client_method() instead of TLSv1_client_method() in + the openssl(1) ciphers command. + - Validate the protocols in SSL{_CTX,}_set_alpn_protos(). + - Made TS and PKCS12 opaque. + - Per RFC 7292, safeContentsBag is a SEQUENCE OF, not a SET OF. + - Align PKCS12_key_gen_uni() with OpenSSL + - Various PKCS12 and TS accessors were added. In particular, the + TS_RESP_CTX_set_time_cb() function was added back. + - Allow a NULL header in PEM_write{,_bio}() + - Allow empty attribute sets in CSRs. + - Adjust signatures of BIO_ctrl functions. + - Provide additional defines for EVP AEAD. + - Provide OPENSSL_cleanup(). + - Make BIO_info_cb() identical to bio_info_cb(). + * Bug fixes + - Avoid use of uninitialized in BN_mod_exp_recp(). + - Fix X509_get_extension_flags() by ensuring that EXFLAG_INVALID is + set on X509_get_purpose() failure. + - Fix HMAC() with NULL key. + - Add ERR_load_{COMP,CT,KDF}_strings() to ERR_load_crypto_strings(). + - Avoid strict aliasing violations in BN_nist_mod_*(). + - Do not return X509_V_ERR_UNSPECIFIED from X509_check_ca(). + No return value of X509_check_ca() indicates failure. Application + code should therefore issue a checked call to X509_check_purpose() + before calling X509_check_ca(). + - Rewrite and fix X509v3_asid_subset() to avoid segfaults on some + valid input. + - Call the ASN1_OP_D2I_PRE callback after ASN1_item_ex_new(). + - Fix d2i_ASN1_OBJECT to advance the *der_in pointer correctly. + - Avoid use of uninitialized in ASN1_STRING_to_UTF8(). + - Do not pass uninitialized pointer to ASN1_STRING_to_UTF8(). + - Do not refuse valid IPv6 addresses in nc(1)'s HTTP CONNECT proxy. + - Do not reject primes in trial divisions. + - Error out on negative shifts in BN_{r,l}shift() instead of + accessing arrays out of bounds. + - Fix URI name constraints, allow for URI's with no host part. + - Fix the legacy verifier callback behaviour for untrusted certs. + - Correct serfver-side handling of TLSv1.3 key updates. + - Plug leak in PKCS12_setup_mac(). + - Plug leak in X509V3_add1_i2d(). + - Only print X.509 versions we know about. + - Avoid signed integer overflow due to unary negation + - Initialize readbytes in BIO_gets(). + - Plug memory leak in CMS_add_simple_smimecap(). + - Plug memory leak in X509_REQ_print_ex(). + - Check HMAC() return value to avoid a later use of uninitialized. + - Avoid potential NULL dereference in ssl_set_pkey(). + - Check return values in ssl_print_tmp_key(). + - Switch loop bounds from size_t to int in check_hosts(). + - Avoid division by zero if no connection was made in s_time.c. + - Check sk_SSL_CIPHER_push() return value + - Avoid out-of-bounds read in ssl_cipher_process_rulestr(). + - Use LONG_MAX as the limit for ciphers with long based APIs. + * New features + - EVP API for HKDF ported from OpenSSL and subsequently cleaned up. + - The security level API (SSL_{,CTX}_{get,set}_security_level()) is + now available. Callbacks and ex_data are not supported. Sane + software will not be using this. + - Experimental support for the BoringSSL QUIC API. + - Add initial support for TS ESSCertIDv2 verification. + - LibreSSL now uses the Baillie-PSW primality test instead of + Miller-Rabin . + 3.5.2 - Stable release * Bug fixes From bf23b6b37255b232f7768555f4b6dd7153de2dce Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 26 Sep 2022 07:28:30 -0500 Subject: [PATCH 0103/1283] manpage and autotools sync --- man/links | 1 - tap-driver.sh | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/man/links b/man/links index 03f9c142ab..16e159db4a 100644 --- a/man/links +++ b/man/links @@ -2472,7 +2472,6 @@ d2i_ASN1_OCTET_STRING.3,d2i_ASN1_UTF8STRING.3 d2i_ASN1_OCTET_STRING.3,d2i_ASN1_VISIBLESTRING.3 d2i_ASN1_OCTET_STRING.3,d2i_DIRECTORYSTRING.3 d2i_ASN1_OCTET_STRING.3,d2i_DISPLAYTEXT.3 -d2i_ASN1_OCTET_STRING.3,i2c_ASN1_INTEGER.3 d2i_ASN1_OCTET_STRING.3,i2d_ASN1_BIT_STRING.3 d2i_ASN1_OCTET_STRING.3,i2d_ASN1_BMPSTRING.3 d2i_ASN1_OCTET_STRING.3,i2d_ASN1_ENUMERATED.3 diff --git a/tap-driver.sh b/tap-driver.sh index 0ca4903755..fea066f56e 100755 --- a/tap-driver.sh +++ b/tap-driver.sh @@ -1,5 +1,5 @@ #! /bin/sh -# Copyright (C) 2011-2020 Free Software Foundation, Inc. +# Copyright (C) 2011-2021 Free Software Foundation, Inc. # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by From 5f3868d96ef074dbe5bd19ad822a9209735cb742 Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Sat, 22 Oct 2022 13:11:48 +0500 Subject: [PATCH 0104/1283] CI: enable rust-openssl daily testing --- .github/rust-openssl.patch | 13 +++++++++++++ .github/workflows/regress.yml | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+) create mode 100644 .github/rust-openssl.patch create mode 100644 .github/workflows/regress.yml diff --git a/.github/rust-openssl.patch b/.github/rust-openssl.patch new file mode 100644 index 0000000000..8d8bde221e --- /dev/null +++ b/.github/rust-openssl.patch @@ -0,0 +1,13 @@ +diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs +index c2aceeec..26e0816a 100644 +--- a/openssl-sys/build/main.rs ++++ b/openssl-sys/build/main.rs +@@ -280,7 +280,7 @@ See rust-openssl documentation for more information: + (3, 4, 0) => ('3', '4', '0'), + (3, 4, _) => ('3', '4', 'x'), + (3, 5, _) => ('3', '5', 'x'), +- _ => version_error(), ++ _ => ('3', '6', 'x'), + }; + + println!("cargo:libressl=true"); diff --git a/.github/workflows/regress.yml b/.github/workflows/regress.yml new file mode 100644 index 0000000000..88ce310e0c --- /dev/null +++ b/.github/workflows/regress.yml @@ -0,0 +1,33 @@ +name: regress testing + +on: + schedule: + - cron: "0 0 * * *" + +jobs: + rust-openssl: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + - name: Install apt dependencies + run: | + sudo apt-get update + sudo apt-get install -y cargo + - name: Build LibreSSL + run: | + ./autogen.sh + ./configure + make dist + tar zxvf libressl-*.tar.gz + rm libressl-*.tar.gz + cd libressl-* + ./configure --prefix="${HOME}/opt" + make all install + - name: run rust-openssl tests + run: | + git clone https://github.com/sfackler/rust-openssl.git + cd rust-openssl + export OPENSSL_DIR=${HOME}/opt + export LD_LIBRARY_PATH=${HOME}/opt/lib + patch -p1 < ../.github/rust-openssl.patch + cargo test From 379b2f843b6e03c1d4785157cb15a0f5cd89b156 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 22 Oct 2022 17:59:16 +0200 Subject: [PATCH 0105/1283] rebase rust-openssl patch --- .github/rust-openssl.patch | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/rust-openssl.patch b/.github/rust-openssl.patch index 8d8bde221e..5821c72e02 100644 --- a/.github/rust-openssl.patch +++ b/.github/rust-openssl.patch @@ -1,11 +1,11 @@ diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs -index c2aceeec..26e0816a 100644 +index 2ca53c97..56a60161 100644 --- a/openssl-sys/build/main.rs +++ b/openssl-sys/build/main.rs -@@ -280,7 +280,7 @@ See rust-openssl documentation for more information: - (3, 4, 0) => ('3', '4', '0'), +@@ -281,7 +281,7 @@ See rust-openssl documentation for more information: (3, 4, _) => ('3', '4', 'x'), (3, 5, _) => ('3', '5', 'x'), + (3, 6, 0) => ('3', '6', '0'), - _ => version_error(), + _ => ('3', '6', 'x'), }; From 6be2433afcbe8ed12e94cd674ca5675b6163bea8 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 27 Sep 2022 05:04:22 -0500 Subject: [PATCH 0106/1283] insert 3.5.3 release notes --- ChangeLog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ChangeLog b/ChangeLog index 043e825acc..d5c4617e29 100644 --- a/ChangeLog +++ b/ChangeLog @@ -166,6 +166,12 @@ LibreSSL Portable Release Notes: - LibreSSL now uses the Baillie-PSW primality test instead of Miller-Rabin . +3.5.3 - Reliability fix + + * Fix d2i_ASN1_OBJECT(). A confusion of two CBS resulted in advancing + the passed *der_in pointer incorrectly. Thanks to Aram Sargsyan for + reporting the issue and testing the fix. + 3.5.2 - Stable release * Bug fixes From 6e1d17c2746defbf4bf9b2c72983f13a7277bab2 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 3 Nov 2022 02:43:20 +0100 Subject: [PATCH 0107/1283] rebase rust-openssl patch --- .github/rust-openssl.patch | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/rust-openssl.patch b/.github/rust-openssl.patch index 5821c72e02..56a39418b0 100644 --- a/.github/rust-openssl.patch +++ b/.github/rust-openssl.patch @@ -1,11 +1,12 @@ diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs -index 2ca53c97..56a60161 100644 +index 71b36c23..644a318d 100644 --- a/openssl-sys/build/main.rs +++ b/openssl-sys/build/main.rs -@@ -281,7 +281,7 @@ See rust-openssl documentation for more information: +@@ -281,8 +281,7 @@ See rust-openssl documentation for more information: (3, 4, _) => ('3', '4', 'x'), (3, 5, _) => ('3', '5', 'x'), (3, 6, 0) => ('3', '6', '0'), +- (3, 6, _) => ('3', '6', 'x'), - _ => version_error(), + _ => ('3', '6', 'x'), }; From a08e4fbb3f6b6c885302c133b39d36646edfab44 Mon Sep 17 00:00:00 2001 From: catatsuy Date: Thu, 3 Nov 2022 15:17:29 +0900 Subject: [PATCH 0108/1283] update config.sub and config.guess for M1 Mac config.sub and config.guess on LibreSSL are very old. To build LibreSSL on M1 Mac, we need to update config.sub. --- scripts/config.guess | 1711 ++++++++++++++++----------- scripts/config.sub | 2664 ++++++++++++++++++++++-------------------- 2 files changed, 2398 insertions(+), 1977 deletions(-) diff --git a/scripts/config.guess b/scripts/config.guess index b82ee23159..980b020838 100644 --- a/scripts/config.guess +++ b/scripts/config.guess @@ -1,12 +1,14 @@ #! /bin/sh # Attempt to guess a canonical system name. -# Copyright 1992-2015 Free Software Foundation, Inc. +# Copyright 1992-2022 Free Software Foundation, Inc. -timestamp='2015-12-14' +# shellcheck disable=SC2006,SC2268 # see below for rationale + +timestamp='2022-09-17' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 3 of the License, or +# the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, but @@ -15,7 +17,7 @@ timestamp='2015-12-14' # General Public License for more details. # # You should have received a copy of the GNU General Public License -# along with this program; if not, see . +# along with this program; if not, see . # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a @@ -27,11 +29,19 @@ timestamp='2015-12-14' # Originally written by Per Bothner; maintained since 2000 by Ben Elliston. # # You can get the latest version of this script from: -# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD +# https://git.savannah.gnu.org/cgit/config.git/plain/config.guess # # Please send patches to . +# The "shellcheck disable" line above the timestamp inhibits complaints +# about features and limitations of the classic Bourne shell that were +# superseded or lifted in POSIX. However, this script identifies a wide +# variety of pre-POSIX systems that do not have POSIX shells at all, and +# even some reasonably current systems (Solaris 10 as case-in-point) still +# have a pre-POSIX /bin/sh. + + me=`echo "$0" | sed -e 's,.*/,,'` usage="\ @@ -39,7 +49,7 @@ Usage: $0 [OPTION] Output the configuration name of the system \`$me' is run on. -Operation modes: +Options: -h, --help print this help, then exit -t, --time-stamp print date of last modification, then exit -v, --version print version number, then exit @@ -50,7 +60,7 @@ version="\ GNU config.guess ($timestamp) Originally written by Per Bothner. -Copyright 1992-2015 Free Software Foundation, Inc. +Copyright 1992-2022 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." @@ -84,7 +94,8 @@ if test $# != 0; then exit 1 fi -trap 'exit 1' 1 2 15 +# Just in case it came from the environment. +GUESS= # CC_FOR_BUILD -- compiler used by this script. Note that the use of a # compiler to aid in system detection is discouraged as it requires @@ -96,66 +107,90 @@ trap 'exit 1' 1 2 15 # Portable tmp directory creation inspired by the Autoconf team. -set_cc_for_build=' -trap "exitcode=\$?; (rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null) && exit \$exitcode" 0 ; -trap "rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null; exit 1" 1 2 13 15 ; -: ${TMPDIR=/tmp} ; - { tmp=`(umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" ; } || - { test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && mkdir $tmp) ; } || - { tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir $tmp) && echo "Warning: creating insecure temp directory" >&2 ; } || - { echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; exit 1 ; } ; -dummy=$tmp/dummy ; -tmpfiles="$dummy.c $dummy.o $dummy.rel $dummy" ; -case $CC_FOR_BUILD,$HOST_CC,$CC in - ,,) echo "int x;" > $dummy.c ; - for c in cc gcc c89 c99 ; do - if ($c -c -o $dummy.o $dummy.c) >/dev/null 2>&1 ; then - CC_FOR_BUILD="$c"; break ; - fi ; - done ; - if test x"$CC_FOR_BUILD" = x ; then - CC_FOR_BUILD=no_compiler_found ; - fi - ;; - ,,*) CC_FOR_BUILD=$CC ;; - ,*,*) CC_FOR_BUILD=$HOST_CC ;; -esac ; set_cc_for_build= ;' +tmp= +# shellcheck disable=SC2172 +trap 'test -z "$tmp" || rm -fr "$tmp"' 0 1 2 13 15 + +set_cc_for_build() { + # prevent multiple calls if $tmp is already set + test "$tmp" && return 0 + : "${TMPDIR=/tmp}" + # shellcheck disable=SC2039,SC3028 + { tmp=`(umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" ; } || + { test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && mkdir "$tmp" 2>/dev/null) ; } || + { tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir "$tmp" 2>/dev/null) && echo "Warning: creating insecure temp directory" >&2 ; } || + { echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; exit 1 ; } + dummy=$tmp/dummy + case ${CC_FOR_BUILD-},${HOST_CC-},${CC-} in + ,,) echo "int x;" > "$dummy.c" + for driver in cc gcc c89 c99 ; do + if ($driver -c -o "$dummy.o" "$dummy.c") >/dev/null 2>&1 ; then + CC_FOR_BUILD=$driver + break + fi + done + if test x"$CC_FOR_BUILD" = x ; then + CC_FOR_BUILD=no_compiler_found + fi + ;; + ,,*) CC_FOR_BUILD=$CC ;; + ,*,*) CC_FOR_BUILD=$HOST_CC ;; + esac +} # This is needed to find uname on a Pyramid OSx when run in the BSD universe. # (ghazi@noc.rutgers.edu 1994-08-24) -if (test -f /.attbin/uname) >/dev/null 2>&1 ; then +if test -f /.attbin/uname ; then PATH=$PATH:/.attbin ; export PATH fi UNAME_MACHINE=`(uname -m) 2>/dev/null` || UNAME_MACHINE=unknown UNAME_RELEASE=`(uname -r) 2>/dev/null` || UNAME_RELEASE=unknown -UNAME_SYSTEM=`(uname -s) 2>/dev/null` || UNAME_SYSTEM=unknown +UNAME_SYSTEM=`(uname -s) 2>/dev/null` || UNAME_SYSTEM=unknown UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown -case "${UNAME_SYSTEM}" in +case $UNAME_SYSTEM in Linux|GNU|GNU/*) - # If the system lacks a compiler, then just pick glibc. - # We could probably try harder. - LIBC=gnu + LIBC=unknown - eval $set_cc_for_build - cat <<-EOF > $dummy.c + set_cc_for_build + cat <<-EOF > "$dummy.c" #include #if defined(__UCLIBC__) LIBC=uclibc #elif defined(__dietlibc__) LIBC=dietlibc - #else + #elif defined(__GLIBC__) LIBC=gnu + #else + #include + /* First heuristic to detect musl libc. */ + #ifdef __DEFINED_va_list + LIBC=musl + #endif #endif EOF - eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC' | sed 's, ,,g'` + cc_set_libc=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^LIBC' | sed 's, ,,g'` + eval "$cc_set_libc" + + # Second heuristic to detect musl libc. + if [ "$LIBC" = unknown ] && + command -v ldd >/dev/null && + ldd --version 2>&1 | grep -q ^musl; then + LIBC=musl + fi + + # If the system lacks a compiler, then just pick glibc. + # We could probably try harder. + if [ "$LIBC" = unknown ]; then + LIBC=gnu + fi ;; esac # Note: order is significant - the case branches are not exclusive. -case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in +case $UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION in *:NetBSD:*:*) # NetBSD (nbsd) targets should (where applicable) match one or # more of the tuples: *-*-netbsdelf*, *-*-netbsdaout*, @@ -167,29 +202,32 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in # # Note: NetBSD doesn't particularly care about the vendor # portion of the name. We always set it to "unknown". - sysctl="sysctl -n hw.machine_arch" UNAME_MACHINE_ARCH=`(uname -p 2>/dev/null || \ - /sbin/$sysctl 2>/dev/null || \ - /usr/sbin/$sysctl 2>/dev/null || \ + /sbin/sysctl -n hw.machine_arch 2>/dev/null || \ + /usr/sbin/sysctl -n hw.machine_arch 2>/dev/null || \ echo unknown)` - case "${UNAME_MACHINE_ARCH}" in + case $UNAME_MACHINE_ARCH in + aarch64eb) machine=aarch64_be-unknown ;; armeb) machine=armeb-unknown ;; arm*) machine=arm-unknown ;; sh3el) machine=shl-unknown ;; sh3eb) machine=sh-unknown ;; sh5el) machine=sh5le-unknown ;; earmv*) - arch=`echo ${UNAME_MACHINE_ARCH} | sed -e 's,^e\(armv[0-9]\).*$,\1,'` - endian=`echo ${UNAME_MACHINE_ARCH} | sed -ne 's,^.*\(eb\)$,\1,p'` + arch=`echo "$UNAME_MACHINE_ARCH" | sed -e 's,^e\(armv[0-9]\).*$,\1,'` + endian=`echo "$UNAME_MACHINE_ARCH" | sed -ne 's,^.*\(eb\)$,\1,p'` machine=${arch}${endian}-unknown ;; - *) machine=${UNAME_MACHINE_ARCH}-unknown ;; + *) machine=$UNAME_MACHINE_ARCH-unknown ;; esac # The Operating System including object format, if it has switched - # to ELF recently, or will in the future. - case "${UNAME_MACHINE_ARCH}" in - arm*|earm*|i386|m68k|ns32k|sh3*|sparc|vax) - eval $set_cc_for_build + # to ELF recently (or will in the future) and ABI. + case $UNAME_MACHINE_ARCH in + earm*) + os=netbsdelf + ;; + arm*|i386|m68k|ns32k|sh3*|sparc|vax) + set_cc_for_build if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \ | grep -q __ELF__ then @@ -205,10 +243,10 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in ;; esac # Determine ABI tags. - case "${UNAME_MACHINE_ARCH}" in + case $UNAME_MACHINE_ARCH in earm*) expr='s/^earmv[0-9]/-eabi/;s/eb$//' - abi=`echo ${UNAME_MACHINE_ARCH} | sed -e "$expr"` + abi=`echo "$UNAME_MACHINE_ARCH" | sed -e "$expr"` ;; esac # The OS release @@ -216,43 +254,68 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in # thus, need a distinct triplet. However, they do not need # kernel version information, so it can be replaced with a # suitable tag, in the style of linux-gnu. - case "${UNAME_VERSION}" in + case $UNAME_VERSION in Debian*) release='-gnu' ;; *) - release=`echo ${UNAME_RELEASE} | sed -e 's/[-_].*//' | cut -d. -f1,2` + release=`echo "$UNAME_RELEASE" | sed -e 's/[-_].*//' | cut -d. -f1,2` ;; esac # Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM: # contains redundant information, the shorter form: # CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used. - echo "${machine}-${os}${release}${abi}" - exit ;; + GUESS=$machine-${os}${release}${abi-} + ;; *:Bitrig:*:*) UNAME_MACHINE_ARCH=`arch | sed 's/Bitrig.//'` - echo ${UNAME_MACHINE_ARCH}-unknown-bitrig${UNAME_RELEASE} - exit ;; + GUESS=$UNAME_MACHINE_ARCH-unknown-bitrig$UNAME_RELEASE + ;; *:OpenBSD:*:*) UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'` - echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE} - exit ;; + GUESS=$UNAME_MACHINE_ARCH-unknown-openbsd$UNAME_RELEASE + ;; + *:SecBSD:*:*) + UNAME_MACHINE_ARCH=`arch | sed 's/SecBSD.//'` + GUESS=$UNAME_MACHINE_ARCH-unknown-secbsd$UNAME_RELEASE + ;; + *:LibertyBSD:*:*) + UNAME_MACHINE_ARCH=`arch | sed 's/^.*BSD\.//'` + GUESS=$UNAME_MACHINE_ARCH-unknown-libertybsd$UNAME_RELEASE + ;; + *:MidnightBSD:*:*) + GUESS=$UNAME_MACHINE-unknown-midnightbsd$UNAME_RELEASE + ;; *:ekkoBSD:*:*) - echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE} - exit ;; + GUESS=$UNAME_MACHINE-unknown-ekkobsd$UNAME_RELEASE + ;; *:SolidBSD:*:*) - echo ${UNAME_MACHINE}-unknown-solidbsd${UNAME_RELEASE} - exit ;; + GUESS=$UNAME_MACHINE-unknown-solidbsd$UNAME_RELEASE + ;; + *:OS108:*:*) + GUESS=$UNAME_MACHINE-unknown-os108_$UNAME_RELEASE + ;; macppc:MirBSD:*:*) - echo powerpc-unknown-mirbsd${UNAME_RELEASE} - exit ;; + GUESS=powerpc-unknown-mirbsd$UNAME_RELEASE + ;; *:MirBSD:*:*) - echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE} - exit ;; + GUESS=$UNAME_MACHINE-unknown-mirbsd$UNAME_RELEASE + ;; *:Sortix:*:*) - echo ${UNAME_MACHINE}-unknown-sortix - exit ;; + GUESS=$UNAME_MACHINE-unknown-sortix + ;; + *:Twizzler:*:*) + GUESS=$UNAME_MACHINE-unknown-twizzler + ;; + *:Redox:*:*) + GUESS=$UNAME_MACHINE-unknown-redox + ;; + mips:OSF1:*.*) + GUESS=mips-dec-osf1 + ;; alpha:OSF1:*:*) + # Reset EXIT trap before exiting to avoid spurious non-zero exit code. + trap '' 0 case $UNAME_RELEASE in *4.0) UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $3}'` @@ -266,163 +329,158 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in # covers most systems running today. This code pipes the CPU # types through head -n 1, so we only detect the type of CPU 0. ALPHA_CPU_TYPE=`/usr/sbin/psrinfo -v | sed -n -e 's/^ The alpha \(.*\) processor.*$/\1/p' | head -n 1` - case "$ALPHA_CPU_TYPE" in + case $ALPHA_CPU_TYPE in "EV4 (21064)") - UNAME_MACHINE="alpha" ;; + UNAME_MACHINE=alpha ;; "EV4.5 (21064)") - UNAME_MACHINE="alpha" ;; + UNAME_MACHINE=alpha ;; "LCA4 (21066/21068)") - UNAME_MACHINE="alpha" ;; + UNAME_MACHINE=alpha ;; "EV5 (21164)") - UNAME_MACHINE="alphaev5" ;; + UNAME_MACHINE=alphaev5 ;; "EV5.6 (21164A)") - UNAME_MACHINE="alphaev56" ;; + UNAME_MACHINE=alphaev56 ;; "EV5.6 (21164PC)") - UNAME_MACHINE="alphapca56" ;; + UNAME_MACHINE=alphapca56 ;; "EV5.7 (21164PC)") - UNAME_MACHINE="alphapca57" ;; + UNAME_MACHINE=alphapca57 ;; "EV6 (21264)") - UNAME_MACHINE="alphaev6" ;; + UNAME_MACHINE=alphaev6 ;; "EV6.7 (21264A)") - UNAME_MACHINE="alphaev67" ;; + UNAME_MACHINE=alphaev67 ;; "EV6.8CB (21264C)") - UNAME_MACHINE="alphaev68" ;; + UNAME_MACHINE=alphaev68 ;; "EV6.8AL (21264B)") - UNAME_MACHINE="alphaev68" ;; + UNAME_MACHINE=alphaev68 ;; "EV6.8CX (21264D)") - UNAME_MACHINE="alphaev68" ;; + UNAME_MACHINE=alphaev68 ;; "EV6.9A (21264/EV69A)") - UNAME_MACHINE="alphaev69" ;; + UNAME_MACHINE=alphaev69 ;; "EV7 (21364)") - UNAME_MACHINE="alphaev7" ;; + UNAME_MACHINE=alphaev7 ;; "EV7.9 (21364A)") - UNAME_MACHINE="alphaev79" ;; + UNAME_MACHINE=alphaev79 ;; esac # A Pn.n version is a patched version. # A Vn.n version is a released version. # A Tn.n version is a released field test version. # A Xn.n version is an unreleased experimental baselevel. # 1.2 uses "1.2" for uname -r. - echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'` - # Reset EXIT trap before exiting to avoid spurious non-zero exit code. - exitcode=$? - trap '' 0 - exit $exitcode ;; - Alpha\ *:Windows_NT*:*) - # How do we know it's Interix rather than the generic POSIX subsystem? - # Should we change UNAME_MACHINE based on the output of uname instead - # of the specific Alpha model? - echo alpha-pc-interix - exit ;; - 21064:Windows_NT:50:3) - echo alpha-dec-winnt3.5 - exit ;; + OSF_REL=`echo "$UNAME_RELEASE" | sed -e 's/^[PVTX]//' | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz` + GUESS=$UNAME_MACHINE-dec-osf$OSF_REL + ;; Amiga*:UNIX_System_V:4.0:*) - echo m68k-unknown-sysv4 - exit ;; + GUESS=m68k-unknown-sysv4 + ;; *:[Aa]miga[Oo][Ss]:*:*) - echo ${UNAME_MACHINE}-unknown-amigaos - exit ;; + GUESS=$UNAME_MACHINE-unknown-amigaos + ;; *:[Mm]orph[Oo][Ss]:*:*) - echo ${UNAME_MACHINE}-unknown-morphos - exit ;; + GUESS=$UNAME_MACHINE-unknown-morphos + ;; *:OS/390:*:*) - echo i370-ibm-openedition - exit ;; + GUESS=i370-ibm-openedition + ;; *:z/VM:*:*) - echo s390-ibm-zvmoe - exit ;; + GUESS=s390-ibm-zvmoe + ;; *:OS400:*:*) - echo powerpc-ibm-os400 - exit ;; + GUESS=powerpc-ibm-os400 + ;; arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*) - echo arm-acorn-riscix${UNAME_RELEASE} - exit ;; + GUESS=arm-acorn-riscix$UNAME_RELEASE + ;; arm*:riscos:*:*|arm*:RISCOS:*:*) - echo arm-unknown-riscos - exit ;; + GUESS=arm-unknown-riscos + ;; SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*) - echo hppa1.1-hitachi-hiuxmpp - exit ;; + GUESS=hppa1.1-hitachi-hiuxmpp + ;; Pyramid*:OSx*:*:* | MIS*:OSx*:*:* | MIS*:SMP_DC-OSx*:*:*) # akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE. - if test "`(/bin/universe) 2>/dev/null`" = att ; then - echo pyramid-pyramid-sysv3 - else - echo pyramid-pyramid-bsd - fi - exit ;; + case `(/bin/universe) 2>/dev/null` in + att) GUESS=pyramid-pyramid-sysv3 ;; + *) GUESS=pyramid-pyramid-bsd ;; + esac + ;; NILE*:*:*:dcosx) - echo pyramid-pyramid-svr4 - exit ;; + GUESS=pyramid-pyramid-svr4 + ;; DRS?6000:unix:4.0:6*) - echo sparc-icl-nx6 - exit ;; + GUESS=sparc-icl-nx6 + ;; DRS?6000:UNIX_SV:4.2*:7* | DRS?6000:isis:4.2*:7*) case `/usr/bin/uname -p` in - sparc) echo sparc-icl-nx7; exit ;; - esac ;; + sparc) GUESS=sparc-icl-nx7 ;; + esac + ;; s390x:SunOS:*:*) - echo ${UNAME_MACHINE}-ibm-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` - exit ;; + SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/[^.]*//'` + GUESS=$UNAME_MACHINE-ibm-solaris2$SUN_REL + ;; sun4H:SunOS:5.*:*) - echo sparc-hal-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` - exit ;; + SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/[^.]*//'` + GUESS=sparc-hal-solaris2$SUN_REL + ;; sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*) - echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` - exit ;; + SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/[^.]*//'` + GUESS=sparc-sun-solaris2$SUN_REL + ;; i86pc:AuroraUX:5.*:* | i86xen:AuroraUX:5.*:*) - echo i386-pc-auroraux${UNAME_RELEASE} - exit ;; + GUESS=i386-pc-auroraux$UNAME_RELEASE + ;; i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*) - eval $set_cc_for_build - SUN_ARCH="i386" + set_cc_for_build + SUN_ARCH=i386 # If there is a compiler, see if it is configured for 64-bit objects. # Note that the Sun cc does not turn __LP64__ into 1 like gcc does. # This test works for both compilers. - if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then + if test "$CC_FOR_BUILD" != no_compiler_found; then if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \ - (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \ + (CCOPTS="" $CC_FOR_BUILD -m64 -E - 2>/dev/null) | \ grep IS_64BIT_ARCH >/dev/null then - SUN_ARCH="x86_64" + SUN_ARCH=x86_64 fi fi - echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` - exit ;; + SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/[^.]*//'` + GUESS=$SUN_ARCH-pc-solaris2$SUN_REL + ;; sun4*:SunOS:6*:*) # According to config.sub, this is the proper way to canonicalize # SunOS6. Hard to guess exactly what SunOS6 will be like, but # it's likely to be more like Solaris than SunOS4. - echo sparc-sun-solaris3`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` - exit ;; + SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/[^.]*//'` + GUESS=sparc-sun-solaris3$SUN_REL + ;; sun4*:SunOS:*:*) - case "`/usr/bin/arch -k`" in + case `/usr/bin/arch -k` in Series*|S4*) UNAME_RELEASE=`uname -v` ;; esac # Japanese Language versions have a version number like `4.1.3-JL'. - echo sparc-sun-sunos`echo ${UNAME_RELEASE}|sed -e 's/-/_/'` - exit ;; + SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/-/_/'` + GUESS=sparc-sun-sunos$SUN_REL + ;; sun3*:SunOS:*:*) - echo m68k-sun-sunos${UNAME_RELEASE} - exit ;; + GUESS=m68k-sun-sunos$UNAME_RELEASE + ;; sun*:*:4.2BSD:*) UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null` - test "x${UNAME_RELEASE}" = "x" && UNAME_RELEASE=3 - case "`/bin/arch`" in + test "x$UNAME_RELEASE" = x && UNAME_RELEASE=3 + case `/bin/arch` in sun3) - echo m68k-sun-sunos${UNAME_RELEASE} + GUESS=m68k-sun-sunos$UNAME_RELEASE ;; sun4) - echo sparc-sun-sunos${UNAME_RELEASE} + GUESS=sparc-sun-sunos$UNAME_RELEASE ;; esac - exit ;; + ;; aushp:SunOS:*:*) - echo sparc-auspex-sunos${UNAME_RELEASE} - exit ;; + GUESS=sparc-auspex-sunos$UNAME_RELEASE + ;; # The situation for MiNT is a little confusing. The machine name # can be virtually everything (everything which is not # "atarist" or "atariste" at least should have a processor @@ -432,44 +490,44 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in # MiNT. But MiNT is downward compatible to TOS, so this should # be no problem. atarist[e]:*MiNT:*:* | atarist[e]:*mint:*:* | atarist[e]:*TOS:*:*) - echo m68k-atari-mint${UNAME_RELEASE} - exit ;; + GUESS=m68k-atari-mint$UNAME_RELEASE + ;; atari*:*MiNT:*:* | atari*:*mint:*:* | atarist[e]:*TOS:*:*) - echo m68k-atari-mint${UNAME_RELEASE} - exit ;; + GUESS=m68k-atari-mint$UNAME_RELEASE + ;; *falcon*:*MiNT:*:* | *falcon*:*mint:*:* | *falcon*:*TOS:*:*) - echo m68k-atari-mint${UNAME_RELEASE} - exit ;; + GUESS=m68k-atari-mint$UNAME_RELEASE + ;; milan*:*MiNT:*:* | milan*:*mint:*:* | *milan*:*TOS:*:*) - echo m68k-milan-mint${UNAME_RELEASE} - exit ;; + GUESS=m68k-milan-mint$UNAME_RELEASE + ;; hades*:*MiNT:*:* | hades*:*mint:*:* | *hades*:*TOS:*:*) - echo m68k-hades-mint${UNAME_RELEASE} - exit ;; + GUESS=m68k-hades-mint$UNAME_RELEASE + ;; *:*MiNT:*:* | *:*mint:*:* | *:*TOS:*:*) - echo m68k-unknown-mint${UNAME_RELEASE} - exit ;; + GUESS=m68k-unknown-mint$UNAME_RELEASE + ;; m68k:machten:*:*) - echo m68k-apple-machten${UNAME_RELEASE} - exit ;; + GUESS=m68k-apple-machten$UNAME_RELEASE + ;; powerpc:machten:*:*) - echo powerpc-apple-machten${UNAME_RELEASE} - exit ;; + GUESS=powerpc-apple-machten$UNAME_RELEASE + ;; RISC*:Mach:*:*) - echo mips-dec-mach_bsd4.3 - exit ;; + GUESS=mips-dec-mach_bsd4.3 + ;; RISC*:ULTRIX:*:*) - echo mips-dec-ultrix${UNAME_RELEASE} - exit ;; + GUESS=mips-dec-ultrix$UNAME_RELEASE + ;; VAX*:ULTRIX*:*:*) - echo vax-dec-ultrix${UNAME_RELEASE} - exit ;; + GUESS=vax-dec-ultrix$UNAME_RELEASE + ;; 2020:CLIX:*:* | 2430:CLIX:*:*) - echo clipper-intergraph-clix${UNAME_RELEASE} - exit ;; + GUESS=clipper-intergraph-clix$UNAME_RELEASE + ;; mips:*:*:UMIPS | mips:*:*:RISCos) - eval $set_cc_for_build - sed 's/^ //' << EOF >$dummy.c + set_cc_for_build + sed 's/^ //' << EOF > "$dummy.c" #ifdef __cplusplus #include /* for printf() prototype */ int main (int argc, char *argv[]) { @@ -478,95 +536,96 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in #endif #if defined (host_mips) && defined (MIPSEB) #if defined (SYSTYPE_SYSV) - printf ("mips-mips-riscos%ssysv\n", argv[1]); exit (0); + printf ("mips-mips-riscos%ssysv\\n", argv[1]); exit (0); #endif #if defined (SYSTYPE_SVR4) - printf ("mips-mips-riscos%ssvr4\n", argv[1]); exit (0); + printf ("mips-mips-riscos%ssvr4\\n", argv[1]); exit (0); #endif #if defined (SYSTYPE_BSD43) || defined(SYSTYPE_BSD) - printf ("mips-mips-riscos%sbsd\n", argv[1]); exit (0); + printf ("mips-mips-riscos%sbsd\\n", argv[1]); exit (0); #endif #endif exit (-1); } EOF - $CC_FOR_BUILD -o $dummy $dummy.c && - dummyarg=`echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` && - SYSTEM_NAME=`$dummy $dummyarg` && + $CC_FOR_BUILD -o "$dummy" "$dummy.c" && + dummyarg=`echo "$UNAME_RELEASE" | sed -n 's/\([0-9]*\).*/\1/p'` && + SYSTEM_NAME=`"$dummy" "$dummyarg"` && { echo "$SYSTEM_NAME"; exit; } - echo mips-mips-riscos${UNAME_RELEASE} - exit ;; + GUESS=mips-mips-riscos$UNAME_RELEASE + ;; Motorola:PowerMAX_OS:*:*) - echo powerpc-motorola-powermax - exit ;; + GUESS=powerpc-motorola-powermax + ;; Motorola:*:4.3:PL8-*) - echo powerpc-harris-powermax - exit ;; + GUESS=powerpc-harris-powermax + ;; Night_Hawk:*:*:PowerMAX_OS | Synergy:PowerMAX_OS:*:*) - echo powerpc-harris-powermax - exit ;; + GUESS=powerpc-harris-powermax + ;; Night_Hawk:Power_UNIX:*:*) - echo powerpc-harris-powerunix - exit ;; + GUESS=powerpc-harris-powerunix + ;; m88k:CX/UX:7*:*) - echo m88k-harris-cxux7 - exit ;; + GUESS=m88k-harris-cxux7 + ;; m88k:*:4*:R4*) - echo m88k-motorola-sysv4 - exit ;; + GUESS=m88k-motorola-sysv4 + ;; m88k:*:3*:R3*) - echo m88k-motorola-sysv3 - exit ;; + GUESS=m88k-motorola-sysv3 + ;; AViiON:dgux:*:*) # DG/UX returns AViiON for all architectures UNAME_PROCESSOR=`/usr/bin/uname -p` - if [ $UNAME_PROCESSOR = mc88100 ] || [ $UNAME_PROCESSOR = mc88110 ] + if test "$UNAME_PROCESSOR" = mc88100 || test "$UNAME_PROCESSOR" = mc88110 then - if [ ${TARGET_BINARY_INTERFACE}x = m88kdguxelfx ] || \ - [ ${TARGET_BINARY_INTERFACE}x = x ] + if test "$TARGET_BINARY_INTERFACE"x = m88kdguxelfx || \ + test "$TARGET_BINARY_INTERFACE"x = x then - echo m88k-dg-dgux${UNAME_RELEASE} + GUESS=m88k-dg-dgux$UNAME_RELEASE else - echo m88k-dg-dguxbcs${UNAME_RELEASE} + GUESS=m88k-dg-dguxbcs$UNAME_RELEASE fi else - echo i586-dg-dgux${UNAME_RELEASE} + GUESS=i586-dg-dgux$UNAME_RELEASE fi - exit ;; + ;; M88*:DolphinOS:*:*) # DolphinOS (SVR3) - echo m88k-dolphin-sysv3 - exit ;; + GUESS=m88k-dolphin-sysv3 + ;; M88*:*:R3*:*) # Delta 88k system running SVR3 - echo m88k-motorola-sysv3 - exit ;; + GUESS=m88k-motorola-sysv3 + ;; XD88*:*:*:*) # Tektronix XD88 system running UTekV (SVR3) - echo m88k-tektronix-sysv3 - exit ;; + GUESS=m88k-tektronix-sysv3 + ;; Tek43[0-9][0-9]:UTek:*:*) # Tektronix 4300 system running UTek (BSD) - echo m68k-tektronix-bsd - exit ;; + GUESS=m68k-tektronix-bsd + ;; *:IRIX*:*:*) - echo mips-sgi-irix`echo ${UNAME_RELEASE}|sed -e 's/-/_/g'` - exit ;; + IRIX_REL=`echo "$UNAME_RELEASE" | sed -e 's/-/_/g'` + GUESS=mips-sgi-irix$IRIX_REL + ;; ????????:AIX?:[12].1:2) # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX. - echo romp-ibm-aix # uname -m gives an 8 hex-code CPU id - exit ;; # Note that: echo "'`uname -s`'" gives 'AIX ' + GUESS=romp-ibm-aix # uname -m gives an 8 hex-code CPU id + ;; # Note that: echo "'`uname -s`'" gives 'AIX ' i*86:AIX:*:*) - echo i386-ibm-aix - exit ;; + GUESS=i386-ibm-aix + ;; ia64:AIX:*:*) - if [ -x /usr/bin/oslevel ] ; then + if test -x /usr/bin/oslevel ; then IBM_REV=`/usr/bin/oslevel` else - IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE} + IBM_REV=$UNAME_VERSION.$UNAME_RELEASE fi - echo ${UNAME_MACHINE}-ibm-aix${IBM_REV} - exit ;; + GUESS=$UNAME_MACHINE-ibm-aix$IBM_REV + ;; *:AIX:2:3) if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then - eval $set_cc_for_build - sed 's/^ //' << EOF >$dummy.c + set_cc_for_build + sed 's/^ //' << EOF > "$dummy.c" #include main() @@ -577,77 +636,77 @@ EOF exit(0); } EOF - if $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy` + if $CC_FOR_BUILD -o "$dummy" "$dummy.c" && SYSTEM_NAME=`"$dummy"` then - echo "$SYSTEM_NAME" + GUESS=$SYSTEM_NAME else - echo rs6000-ibm-aix3.2.5 + GUESS=rs6000-ibm-aix3.2.5 fi elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then - echo rs6000-ibm-aix3.2.4 + GUESS=rs6000-ibm-aix3.2.4 else - echo rs6000-ibm-aix3.2 + GUESS=rs6000-ibm-aix3.2 fi - exit ;; + ;; *:AIX:*:[4567]) IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'` - if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then + if /usr/sbin/lsattr -El "$IBM_CPU_ID" | grep ' POWER' >/dev/null 2>&1; then IBM_ARCH=rs6000 else IBM_ARCH=powerpc fi - if [ -x /usr/bin/lslpp ] ; then - IBM_REV=`/usr/bin/lslpp -Lqc bos.rte.libc | + if test -x /usr/bin/lslpp ; then + IBM_REV=`/usr/bin/lslpp -Lqc bos.rte.libc | \ awk -F: '{ print $3 }' | sed s/[0-9]*$/0/` else - IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE} + IBM_REV=$UNAME_VERSION.$UNAME_RELEASE fi - echo ${IBM_ARCH}-ibm-aix${IBM_REV} - exit ;; + GUESS=$IBM_ARCH-ibm-aix$IBM_REV + ;; *:AIX:*:*) - echo rs6000-ibm-aix - exit ;; - ibmrt:4.4BSD:*|romp-ibm:BSD:*) - echo romp-ibm-bsd4.4 - exit ;; + GUESS=rs6000-ibm-aix + ;; + ibmrt:4.4BSD:*|romp-ibm:4.4BSD:*) + GUESS=romp-ibm-bsd4.4 + ;; ibmrt:*BSD:*|romp-ibm:BSD:*) # covers RT/PC BSD and - echo romp-ibm-bsd${UNAME_RELEASE} # 4.3 with uname added to - exit ;; # report: romp-ibm BSD 4.3 + GUESS=romp-ibm-bsd$UNAME_RELEASE # 4.3 with uname added to + ;; # report: romp-ibm BSD 4.3 *:BOSX:*:*) - echo rs6000-bull-bosx - exit ;; + GUESS=rs6000-bull-bosx + ;; DPX/2?00:B.O.S.:*:*) - echo m68k-bull-sysv3 - exit ;; + GUESS=m68k-bull-sysv3 + ;; 9000/[34]??:4.3bsd:1.*:*) - echo m68k-hp-bsd - exit ;; + GUESS=m68k-hp-bsd + ;; hp300:4.4BSD:*:* | 9000/[34]??:4.3bsd:2.*:*) - echo m68k-hp-bsd4.4 - exit ;; + GUESS=m68k-hp-bsd4.4 + ;; 9000/[34678]??:HP-UX:*:*) - HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'` - case "${UNAME_MACHINE}" in - 9000/31? ) HP_ARCH=m68000 ;; - 9000/[34]?? ) HP_ARCH=m68k ;; + HPUX_REV=`echo "$UNAME_RELEASE" | sed -e 's/[^.]*.[0B]*//'` + case $UNAME_MACHINE in + 9000/31?) HP_ARCH=m68000 ;; + 9000/[34]??) HP_ARCH=m68k ;; 9000/[678][0-9][0-9]) - if [ -x /usr/bin/getconf ]; then + if test -x /usr/bin/getconf; then sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null` sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null` - case "${sc_cpu_version}" in - 523) HP_ARCH="hppa1.0" ;; # CPU_PA_RISC1_0 - 528) HP_ARCH="hppa1.1" ;; # CPU_PA_RISC1_1 + case $sc_cpu_version in + 523) HP_ARCH=hppa1.0 ;; # CPU_PA_RISC1_0 + 528) HP_ARCH=hppa1.1 ;; # CPU_PA_RISC1_1 532) # CPU_PA_RISC2_0 - case "${sc_kernel_bits}" in - 32) HP_ARCH="hppa2.0n" ;; - 64) HP_ARCH="hppa2.0w" ;; - '') HP_ARCH="hppa2.0" ;; # HP-UX 10.20 + case $sc_kernel_bits in + 32) HP_ARCH=hppa2.0n ;; + 64) HP_ARCH=hppa2.0w ;; + '') HP_ARCH=hppa2.0 ;; # HP-UX 10.20 esac ;; esac fi - if [ "${HP_ARCH}" = "" ]; then - eval $set_cc_for_build - sed 's/^ //' << EOF >$dummy.c + if test "$HP_ARCH" = ""; then + set_cc_for_build + sed 's/^ //' << EOF > "$dummy.c" #define _HPUX_SOURCE #include @@ -680,13 +739,13 @@ EOF exit (0); } EOF - (CCOPTS= $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy` + (CCOPTS="" $CC_FOR_BUILD -o "$dummy" "$dummy.c" 2>/dev/null) && HP_ARCH=`"$dummy"` test -z "$HP_ARCH" && HP_ARCH=hppa fi ;; esac - if [ ${HP_ARCH} = "hppa2.0w" ] + if test "$HP_ARCH" = hppa2.0w then - eval $set_cc_for_build + set_cc_for_build # hppa2.0w-hp-hpux* has a 64-bit kernel and a compiler generating # 32-bit code. hppa64-hp-hpux* has the same kernel and a compiler @@ -697,23 +756,23 @@ EOF # $ CC_FOR_BUILD="cc +DA2.0w" ./config.guess # => hppa64-hp-hpux11.23 - if echo __LP64__ | (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | + if echo __LP64__ | (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | grep -q __LP64__ then - HP_ARCH="hppa2.0w" + HP_ARCH=hppa2.0w else - HP_ARCH="hppa64" + HP_ARCH=hppa64 fi fi - echo ${HP_ARCH}-hp-hpux${HPUX_REV} - exit ;; + GUESS=$HP_ARCH-hp-hpux$HPUX_REV + ;; ia64:HP-UX:*:*) - HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'` - echo ia64-hp-hpux${HPUX_REV} - exit ;; + HPUX_REV=`echo "$UNAME_RELEASE" | sed -e 's/[^.]*.[0B]*//'` + GUESS=ia64-hp-hpux$HPUX_REV + ;; 3050*:HI-UX:*:*) - eval $set_cc_for_build - sed 's/^ //' << EOF >$dummy.c + set_cc_for_build + sed 's/^ //' << EOF > "$dummy.c" #include int main () @@ -738,38 +797,38 @@ EOF exit (0); } EOF - $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy` && + $CC_FOR_BUILD -o "$dummy" "$dummy.c" && SYSTEM_NAME=`"$dummy"` && { echo "$SYSTEM_NAME"; exit; } - echo unknown-hitachi-hiuxwe2 - exit ;; - 9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:* ) - echo hppa1.1-hp-bsd - exit ;; + GUESS=unknown-hitachi-hiuxwe2 + ;; + 9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:*) + GUESS=hppa1.1-hp-bsd + ;; 9000/8??:4.3bsd:*:*) - echo hppa1.0-hp-bsd - exit ;; + GUESS=hppa1.0-hp-bsd + ;; *9??*:MPE/iX:*:* | *3000*:MPE/iX:*:*) - echo hppa1.0-hp-mpeix - exit ;; - hp7??:OSF1:*:* | hp8?[79]:OSF1:*:* ) - echo hppa1.1-hp-osf - exit ;; + GUESS=hppa1.0-hp-mpeix + ;; + hp7??:OSF1:*:* | hp8?[79]:OSF1:*:*) + GUESS=hppa1.1-hp-osf + ;; hp8??:OSF1:*:*) - echo hppa1.0-hp-osf - exit ;; + GUESS=hppa1.0-hp-osf + ;; i*86:OSF1:*:*) - if [ -x /usr/sbin/sysversion ] ; then - echo ${UNAME_MACHINE}-unknown-osf1mk + if test -x /usr/sbin/sysversion ; then + GUESS=$UNAME_MACHINE-unknown-osf1mk else - echo ${UNAME_MACHINE}-unknown-osf1 + GUESS=$UNAME_MACHINE-unknown-osf1 fi - exit ;; + ;; parisc*:Lites*:*:*) - echo hppa1.1-hp-lites - exit ;; + GUESS=hppa1.1-hp-lites + ;; C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*) - echo c1-convex-bsd - exit ;; + GUESS=c1-convex-bsd + ;; C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*) if getsysinfo -f scalar_acc then echo c32-convex-bsd @@ -777,139 +836,154 @@ EOF fi exit ;; C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*) - echo c34-convex-bsd - exit ;; + GUESS=c34-convex-bsd + ;; C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*) - echo c38-convex-bsd - exit ;; + GUESS=c38-convex-bsd + ;; C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*) - echo c4-convex-bsd - exit ;; + GUESS=c4-convex-bsd + ;; CRAY*Y-MP:*:*:*) - echo ymp-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/' - exit ;; + CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/'` + GUESS=ymp-cray-unicos$CRAY_REL + ;; CRAY*[A-Z]90:*:*:*) - echo ${UNAME_MACHINE}-cray-unicos${UNAME_RELEASE} \ + echo "$UNAME_MACHINE"-cray-unicos"$UNAME_RELEASE" \ | sed -e 's/CRAY.*\([A-Z]90\)/\1/' \ -e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ \ -e 's/\.[^.]*$/.X/' exit ;; CRAY*TS:*:*:*) - echo t90-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/' - exit ;; + CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/'` + GUESS=t90-cray-unicos$CRAY_REL + ;; CRAY*T3E:*:*:*) - echo alphaev5-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/' - exit ;; + CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/'` + GUESS=alphaev5-cray-unicosmk$CRAY_REL + ;; CRAY*SV1:*:*:*) - echo sv1-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/' - exit ;; + CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/'` + GUESS=sv1-cray-unicos$CRAY_REL + ;; *:UNICOS/mp:*:*) - echo craynv-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/' - exit ;; + CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.[^.]*$/.X/'` + GUESS=craynv-cray-unicosmp$CRAY_REL + ;; F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*) - FUJITSU_PROC=`uname -m | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'` - FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'` - FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'` - echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}" - exit ;; + FUJITSU_PROC=`uname -m | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz` + FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'` + FUJITSU_REL=`echo "$UNAME_RELEASE" | sed -e 's/ /_/'` + GUESS=${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL} + ;; 5000:UNIX_System_V:4.*:*) - FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'` - FUJITSU_REL=`echo ${UNAME_RELEASE} | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/ /_/'` - echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}" - exit ;; + FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'` + FUJITSU_REL=`echo "$UNAME_RELEASE" | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/ /_/'` + GUESS=sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL} + ;; i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*) - echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE} - exit ;; + GUESS=$UNAME_MACHINE-pc-bsdi$UNAME_RELEASE + ;; sparc*:BSD/OS:*:*) - echo sparc-unknown-bsdi${UNAME_RELEASE} - exit ;; + GUESS=sparc-unknown-bsdi$UNAME_RELEASE + ;; *:BSD/OS:*:*) - echo ${UNAME_MACHINE}-unknown-bsdi${UNAME_RELEASE} - exit ;; + GUESS=$UNAME_MACHINE-unknown-bsdi$UNAME_RELEASE + ;; + arm:FreeBSD:*:*) + UNAME_PROCESSOR=`uname -p` + set_cc_for_build + if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \ + | grep -q __ARM_PCS_VFP + then + FREEBSD_REL=`echo "$UNAME_RELEASE" | sed -e 's/[-(].*//'` + GUESS=$UNAME_PROCESSOR-unknown-freebsd$FREEBSD_REL-gnueabi + else + FREEBSD_REL=`echo "$UNAME_RELEASE" | sed -e 's/[-(].*//'` + GUESS=$UNAME_PROCESSOR-unknown-freebsd$FREEBSD_REL-gnueabihf + fi + ;; *:FreeBSD:*:*) UNAME_PROCESSOR=`/usr/bin/uname -p` - case ${UNAME_PROCESSOR} in + case $UNAME_PROCESSOR in amd64) - echo x86_64-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;; - *) - echo ${UNAME_PROCESSOR}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;; + UNAME_PROCESSOR=x86_64 ;; + i386) + UNAME_PROCESSOR=i586 ;; esac - exit ;; + FREEBSD_REL=`echo "$UNAME_RELEASE" | sed -e 's/[-(].*//'` + GUESS=$UNAME_PROCESSOR-unknown-freebsd$FREEBSD_REL + ;; i*:CYGWIN*:*) - echo ${UNAME_MACHINE}-pc-cygwin - exit ;; + GUESS=$UNAME_MACHINE-pc-cygwin + ;; *:MINGW64*:*) - echo ${UNAME_MACHINE}-pc-mingw64 - exit ;; + GUESS=$UNAME_MACHINE-pc-mingw64 + ;; *:MINGW*:*) - echo ${UNAME_MACHINE}-pc-mingw32 - exit ;; + GUESS=$UNAME_MACHINE-pc-mingw32 + ;; *:MSYS*:*) - echo ${UNAME_MACHINE}-pc-msys - exit ;; - i*:windows32*:*) - # uname -m includes "-pc" on this system. - echo ${UNAME_MACHINE}-mingw32 - exit ;; + GUESS=$UNAME_MACHINE-pc-msys + ;; i*:PW*:*) - echo ${UNAME_MACHINE}-pc-pw32 - exit ;; + GUESS=$UNAME_MACHINE-pc-pw32 + ;; + *:SerenityOS:*:*) + GUESS=$UNAME_MACHINE-pc-serenity + ;; *:Interix*:*) - case ${UNAME_MACHINE} in + case $UNAME_MACHINE in x86) - echo i586-pc-interix${UNAME_RELEASE} - exit ;; + GUESS=i586-pc-interix$UNAME_RELEASE + ;; authenticamd | genuineintel | EM64T) - echo x86_64-unknown-interix${UNAME_RELEASE} - exit ;; + GUESS=x86_64-unknown-interix$UNAME_RELEASE + ;; IA64) - echo ia64-unknown-interix${UNAME_RELEASE} - exit ;; + GUESS=ia64-unknown-interix$UNAME_RELEASE + ;; esac ;; - [345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*) - echo i${UNAME_MACHINE}-pc-mks - exit ;; - 8664:Windows_NT:*) - echo x86_64-pc-mks - exit ;; - i*:Windows_NT*:* | Pentium*:Windows_NT*:*) - # How do we know it's Interix rather than the generic POSIX subsystem? - # It also conflicts with pre-2.0 versions of AT&T UWIN. Should we - # UNAME_MACHINE based on the output of uname instead of i386? - echo i586-pc-interix - exit ;; i*:UWIN*:*) - echo ${UNAME_MACHINE}-pc-uwin - exit ;; + GUESS=$UNAME_MACHINE-pc-uwin + ;; amd64:CYGWIN*:*:* | x86_64:CYGWIN*:*:*) - echo x86_64-unknown-cygwin - exit ;; - p*:CYGWIN*:*) - echo powerpcle-unknown-cygwin - exit ;; + GUESS=x86_64-pc-cygwin + ;; prep*:SunOS:5.*:*) - echo powerpcle-unknown-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` - exit ;; + SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/[^.]*//'` + GUESS=powerpcle-unknown-solaris2$SUN_REL + ;; *:GNU:*:*) # the GNU system - echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-${LIBC}`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'` - exit ;; + GNU_ARCH=`echo "$UNAME_MACHINE" | sed -e 's,[-/].*$,,'` + GNU_REL=`echo "$UNAME_RELEASE" | sed -e 's,/.*$,,'` + GUESS=$GNU_ARCH-unknown-$LIBC$GNU_REL + ;; *:GNU/*:*:*) # other systems with GNU libc and userland - echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr '[A-Z]' '[a-z]'``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC} - exit ;; - i*86:Minix:*:*) - echo ${UNAME_MACHINE}-pc-minix - exit ;; + GNU_SYS=`echo "$UNAME_SYSTEM" | sed 's,^[^/]*/,,' | tr "[:upper:]" "[:lower:]"` + GNU_REL=`echo "$UNAME_RELEASE" | sed -e 's/[-(].*//'` + GUESS=$UNAME_MACHINE-unknown-$GNU_SYS$GNU_REL-$LIBC + ;; + x86_64:[Mm]anagarm:*:*|i?86:[Mm]anagarm:*:*) + GUESS="$UNAME_MACHINE-pc-managarm-mlibc" + ;; + *:[Mm]anagarm:*:*) + GUESS="$UNAME_MACHINE-unknown-managarm-mlibc" + ;; + *:Minix:*:*) + GUESS=$UNAME_MACHINE-unknown-minix + ;; aarch64:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; aarch64_be:Linux:*:*) UNAME_MACHINE=aarch64_be - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; alpha:Linux:*:*) - case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in + case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' /proc/cpuinfo 2>/dev/null` in EV5) UNAME_MACHINE=alphaev5 ;; EV56) UNAME_MACHINE=alphaev56 ;; PCA56) UNAME_MACHINE=alphapca56 ;; @@ -919,178 +993,237 @@ EOF EV68*) UNAME_MACHINE=alphaev68 ;; esac objdump --private-headers /bin/sh | grep -q ld.so.1 - if test "$?" = 0 ; then LIBC="gnulibc1" ; fi - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; - arc:Linux:*:* | arceb:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + if test "$?" = 0 ; then LIBC=gnulibc1 ; fi + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; + arc:Linux:*:* | arceb:Linux:*:* | arc32:Linux:*:* | arc64:Linux:*:*) + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; arm*:Linux:*:*) - eval $set_cc_for_build + set_cc_for_build if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \ | grep -q __ARM_EABI__ then - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC else if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \ | grep -q __ARM_PCS_VFP then - echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabi + GUESS=$UNAME_MACHINE-unknown-linux-${LIBC}eabi else - echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabihf + GUESS=$UNAME_MACHINE-unknown-linux-${LIBC}eabihf fi fi - exit ;; + ;; avr32*:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; cris:Linux:*:*) - echo ${UNAME_MACHINE}-axis-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-axis-linux-$LIBC + ;; crisv32:Linux:*:*) - echo ${UNAME_MACHINE}-axis-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-axis-linux-$LIBC + ;; e2k:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; frv:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; hexagon:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; i*86:Linux:*:*) - echo ${UNAME_MACHINE}-pc-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-pc-linux-$LIBC + ;; ia64:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; k1om:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; + loongarch32:Linux:*:* | loongarch64:Linux:*:*) + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; m32r*:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; m68*:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; mips:Linux:*:* | mips64:Linux:*:*) - eval $set_cc_for_build - sed 's/^ //' << EOF >$dummy.c + set_cc_for_build + IS_GLIBC=0 + test x"${LIBC}" = xgnu && IS_GLIBC=1 + sed 's/^ //' << EOF > "$dummy.c" #undef CPU - #undef ${UNAME_MACHINE} - #undef ${UNAME_MACHINE}el + #undef mips + #undef mipsel + #undef mips64 + #undef mips64el + #if ${IS_GLIBC} && defined(_ABI64) + LIBCABI=gnuabi64 + #else + #if ${IS_GLIBC} && defined(_ABIN32) + LIBCABI=gnuabin32 + #else + LIBCABI=${LIBC} + #endif + #endif + + #if ${IS_GLIBC} && defined(__mips64) && defined(__mips_isa_rev) && __mips_isa_rev>=6 + CPU=mipsisa64r6 + #else + #if ${IS_GLIBC} && !defined(__mips64) && defined(__mips_isa_rev) && __mips_isa_rev>=6 + CPU=mipsisa32r6 + #else + #if defined(__mips64) + CPU=mips64 + #else + CPU=mips + #endif + #endif + #endif + #if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL) - CPU=${UNAME_MACHINE}el + MIPS_ENDIAN=el #else #if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB) - CPU=${UNAME_MACHINE} + MIPS_ENDIAN= #else - CPU= + MIPS_ENDIAN= #endif #endif EOF - eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'` - test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; } + cc_set_vars=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^CPU\|^MIPS_ENDIAN\|^LIBCABI'` + eval "$cc_set_vars" + test "x$CPU" != x && { echo "$CPU${MIPS_ENDIAN}-unknown-linux-$LIBCABI"; exit; } + ;; + mips64el:Linux:*:*) + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC ;; openrisc*:Linux:*:*) - echo or1k-unknown-linux-${LIBC} - exit ;; + GUESS=or1k-unknown-linux-$LIBC + ;; or32:Linux:*:* | or1k*:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; padre:Linux:*:*) - echo sparc-unknown-linux-${LIBC} - exit ;; + GUESS=sparc-unknown-linux-$LIBC + ;; parisc64:Linux:*:* | hppa64:Linux:*:*) - echo hppa64-unknown-linux-${LIBC} - exit ;; + GUESS=hppa64-unknown-linux-$LIBC + ;; parisc:Linux:*:* | hppa:Linux:*:*) # Look for CPU level case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in - PA7*) echo hppa1.1-unknown-linux-${LIBC} ;; - PA8*) echo hppa2.0-unknown-linux-${LIBC} ;; - *) echo hppa-unknown-linux-${LIBC} ;; + PA7*) GUESS=hppa1.1-unknown-linux-$LIBC ;; + PA8*) GUESS=hppa2.0-unknown-linux-$LIBC ;; + *) GUESS=hppa-unknown-linux-$LIBC ;; esac - exit ;; + ;; ppc64:Linux:*:*) - echo powerpc64-unknown-linux-${LIBC} - exit ;; + GUESS=powerpc64-unknown-linux-$LIBC + ;; ppc:Linux:*:*) - echo powerpc-unknown-linux-${LIBC} - exit ;; + GUESS=powerpc-unknown-linux-$LIBC + ;; ppc64le:Linux:*:*) - echo powerpc64le-unknown-linux-${LIBC} - exit ;; + GUESS=powerpc64le-unknown-linux-$LIBC + ;; ppcle:Linux:*:*) - echo powerpcle-unknown-linux-${LIBC} - exit ;; + GUESS=powerpcle-unknown-linux-$LIBC + ;; + riscv32:Linux:*:* | riscv32be:Linux:*:* | riscv64:Linux:*:* | riscv64be:Linux:*:*) + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; s390:Linux:*:* | s390x:Linux:*:*) - echo ${UNAME_MACHINE}-ibm-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-ibm-linux-$LIBC + ;; sh64*:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; sh*:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; sparc:Linux:*:* | sparc64:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; tile*:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; vax:Linux:*:*) - echo ${UNAME_MACHINE}-dec-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-dec-linux-$LIBC + ;; x86_64:Linux:*:*) - echo ${UNAME_MACHINE}-pc-linux-${LIBC} - exit ;; + set_cc_for_build + CPU=$UNAME_MACHINE + LIBCABI=$LIBC + if test "$CC_FOR_BUILD" != no_compiler_found; then + ABI=64 + sed 's/^ //' << EOF > "$dummy.c" + #ifdef __i386__ + ABI=x86 + #else + #ifdef __ILP32__ + ABI=x32 + #endif + #endif +EOF + cc_set_abi=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^ABI' | sed 's, ,,g'` + eval "$cc_set_abi" + case $ABI in + x86) CPU=i686 ;; + x32) LIBCABI=${LIBC}x32 ;; + esac + fi + GUESS=$CPU-pc-linux-$LIBCABI + ;; xtensa*:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; i*86:DYNIX/ptx:4*:*) # ptx 4.0 does uname -s correctly, with DYNIX/ptx in there. # earlier versions are messed up and put the nodename in both # sysname and nodename. - echo i386-sequent-sysv4 - exit ;; + GUESS=i386-sequent-sysv4 + ;; i*86:UNIX_SV:4.2MP:2.*) # Unixware is an offshoot of SVR4, but it has its own version # number series starting with 2... # I am not positive that other SVR4 systems won't match this, # I just have to hope. -- rms. # Use sysv4.2uw... so that sysv4* matches it. - echo ${UNAME_MACHINE}-pc-sysv4.2uw${UNAME_VERSION} - exit ;; + GUESS=$UNAME_MACHINE-pc-sysv4.2uw$UNAME_VERSION + ;; i*86:OS/2:*:*) # If we were able to find `uname', then EMX Unix compatibility # is probably installed. - echo ${UNAME_MACHINE}-pc-os2-emx - exit ;; + GUESS=$UNAME_MACHINE-pc-os2-emx + ;; i*86:XTS-300:*:STOP) - echo ${UNAME_MACHINE}-unknown-stop - exit ;; + GUESS=$UNAME_MACHINE-unknown-stop + ;; i*86:atheos:*:*) - echo ${UNAME_MACHINE}-unknown-atheos - exit ;; + GUESS=$UNAME_MACHINE-unknown-atheos + ;; i*86:syllable:*:*) - echo ${UNAME_MACHINE}-pc-syllable - exit ;; + GUESS=$UNAME_MACHINE-pc-syllable + ;; i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.[02]*:*) - echo i386-unknown-lynxos${UNAME_RELEASE} - exit ;; + GUESS=i386-unknown-lynxos$UNAME_RELEASE + ;; i*86:*DOS:*:*) - echo ${UNAME_MACHINE}-pc-msdosdjgpp - exit ;; - i*86:*:4.*:* | i*86:SYSTEM_V:4.*:*) - UNAME_REL=`echo ${UNAME_RELEASE} | sed 's/\/MP$//'` + GUESS=$UNAME_MACHINE-pc-msdosdjgpp + ;; + i*86:*:4.*:*) + UNAME_REL=`echo "$UNAME_RELEASE" | sed 's/\/MP$//'` if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then - echo ${UNAME_MACHINE}-univel-sysv${UNAME_REL} + GUESS=$UNAME_MACHINE-univel-sysv$UNAME_REL else - echo ${UNAME_MACHINE}-pc-sysv${UNAME_REL} + GUESS=$UNAME_MACHINE-pc-sysv$UNAME_REL fi - exit ;; + ;; i*86:*:5:[678]*) # UnixWare 7.x, OpenUNIX and OpenServer 6. case `/bin/uname -X | grep "^Machine"` in @@ -1098,12 +1231,12 @@ EOF *Pentium) UNAME_MACHINE=i586 ;; *Pent*|*Celeron) UNAME_MACHINE=i686 ;; esac - echo ${UNAME_MACHINE}-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION} - exit ;; + GUESS=$UNAME_MACHINE-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION} + ;; i*86:*:3.2:*) if test -f /usr/options/cb.name; then UNAME_REL=`sed -n 's/.*Version //p' /dev/null >/dev/null ; then UNAME_REL=`(/bin/uname -X|grep Release|sed -e 's/.*= //')` (/bin/uname -X|grep i80486 >/dev/null) && UNAME_MACHINE=i486 @@ -1113,11 +1246,11 @@ EOF && UNAME_MACHINE=i686 (/bin/uname -X|grep '^Machine.*Pentium Pro' >/dev/null) \ && UNAME_MACHINE=i686 - echo ${UNAME_MACHINE}-pc-sco$UNAME_REL + GUESS=$UNAME_MACHINE-pc-sco$UNAME_REL else - echo ${UNAME_MACHINE}-pc-sysv32 + GUESS=$UNAME_MACHINE-pc-sysv32 fi - exit ;; + ;; pc:*:*:*) # Left here for compatibility: # uname -m prints for DJGPP always 'pc', but it prints nothing about @@ -1125,31 +1258,31 @@ EOF # Note: whatever this is, it MUST be the same as what config.sub # prints for the "djgpp" host, or else GDB configure will decide that # this is a cross-build. - echo i586-pc-msdosdjgpp - exit ;; + GUESS=i586-pc-msdosdjgpp + ;; Intel:Mach:3*:*) - echo i386-pc-mach3 - exit ;; + GUESS=i386-pc-mach3 + ;; paragon:*:*:*) - echo i860-intel-osf1 - exit ;; + GUESS=i860-intel-osf1 + ;; i860:*:4.*:*) # i860-SVR4 if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then - echo i860-stardent-sysv${UNAME_RELEASE} # Stardent Vistra i860-SVR4 + GUESS=i860-stardent-sysv$UNAME_RELEASE # Stardent Vistra i860-SVR4 else # Add other i860-SVR4 vendors below as they are discovered. - echo i860-unknown-sysv${UNAME_RELEASE} # Unknown i860-SVR4 + GUESS=i860-unknown-sysv$UNAME_RELEASE # Unknown i860-SVR4 fi - exit ;; + ;; mini*:CTIX:SYS*5:*) # "miniframe" - echo m68010-convergent-sysv - exit ;; + GUESS=m68010-convergent-sysv + ;; mc68k:UNIX:SYSTEM5:3.51m) - echo m68k-convergent-sysv - exit ;; + GUESS=m68k-convergent-sysv + ;; M680?0:D-NIX:5.3:*) - echo m68k-diab-dnix - exit ;; + GUESS=m68k-diab-dnix + ;; M68*:*:R3V[5678]*:*) test -r /sysV68 && { echo 'm68k-motorola-sysv'; exit; } ;; 3[345]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 3[34]??/*:*:4.0:3.0 | 4400:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0 | SDS2:*:4.0:3.0 | SHG2:*:4.0:3.0 | S7501*:*:4.0:3.0) @@ -1157,9 +1290,9 @@ EOF test -r /etc/.relid \ && OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid` /bin/uname -p 2>/dev/null | grep 86 >/dev/null \ - && { echo i486-ncr-sysv4.3${OS_REL}; exit; } + && { echo i486-ncr-sysv4.3"$OS_REL"; exit; } /bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \ - && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;; + && { echo i586-ncr-sysv4.3"$OS_REL"; exit; } ;; 3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*) /bin/uname -p 2>/dev/null | grep 86 >/dev/null \ && { echo i486-ncr-sysv4; exit; } ;; @@ -1168,251 +1301,444 @@ EOF test -r /etc/.relid \ && OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid` /bin/uname -p 2>/dev/null | grep 86 >/dev/null \ - && { echo i486-ncr-sysv4.3${OS_REL}; exit; } + && { echo i486-ncr-sysv4.3"$OS_REL"; exit; } /bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \ - && { echo i586-ncr-sysv4.3${OS_REL}; exit; } + && { echo i586-ncr-sysv4.3"$OS_REL"; exit; } /bin/uname -p 2>/dev/null | /bin/grep pteron >/dev/null \ - && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;; + && { echo i586-ncr-sysv4.3"$OS_REL"; exit; } ;; m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*) - echo m68k-unknown-lynxos${UNAME_RELEASE} - exit ;; + GUESS=m68k-unknown-lynxos$UNAME_RELEASE + ;; mc68030:UNIX_System_V:4.*:*) - echo m68k-atari-sysv4 - exit ;; + GUESS=m68k-atari-sysv4 + ;; TSUNAMI:LynxOS:2.*:*) - echo sparc-unknown-lynxos${UNAME_RELEASE} - exit ;; + GUESS=sparc-unknown-lynxos$UNAME_RELEASE + ;; rs6000:LynxOS:2.*:*) - echo rs6000-unknown-lynxos${UNAME_RELEASE} - exit ;; + GUESS=rs6000-unknown-lynxos$UNAME_RELEASE + ;; PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.[02]*:*) - echo powerpc-unknown-lynxos${UNAME_RELEASE} - exit ;; + GUESS=powerpc-unknown-lynxos$UNAME_RELEASE + ;; SM[BE]S:UNIX_SV:*:*) - echo mips-dde-sysv${UNAME_RELEASE} - exit ;; + GUESS=mips-dde-sysv$UNAME_RELEASE + ;; RM*:ReliantUNIX-*:*:*) - echo mips-sni-sysv4 - exit ;; + GUESS=mips-sni-sysv4 + ;; RM*:SINIX-*:*:*) - echo mips-sni-sysv4 - exit ;; + GUESS=mips-sni-sysv4 + ;; *:SINIX-*:*:*) if uname -p 2>/dev/null >/dev/null ; then UNAME_MACHINE=`(uname -p) 2>/dev/null` - echo ${UNAME_MACHINE}-sni-sysv4 + GUESS=$UNAME_MACHINE-sni-sysv4 else - echo ns32k-sni-sysv + GUESS=ns32k-sni-sysv fi - exit ;; + ;; PENTIUM:*:4.0*:*) # Unisys `ClearPath HMP IX 4000' SVR4/MP effort # says - echo i586-unisys-sysv4 - exit ;; + GUESS=i586-unisys-sysv4 + ;; *:UNIX_System_V:4*:FTX*) # From Gerald Hewes . # How about differentiating between stratus architectures? -djm - echo hppa1.1-stratus-sysv4 - exit ;; + GUESS=hppa1.1-stratus-sysv4 + ;; *:*:*:FTX*) # From seanf@swdc.stratus.com. - echo i860-stratus-sysv4 - exit ;; + GUESS=i860-stratus-sysv4 + ;; i*86:VOS:*:*) # From Paul.Green@stratus.com. - echo ${UNAME_MACHINE}-stratus-vos - exit ;; + GUESS=$UNAME_MACHINE-stratus-vos + ;; *:VOS:*:*) # From Paul.Green@stratus.com. - echo hppa1.1-stratus-vos - exit ;; + GUESS=hppa1.1-stratus-vos + ;; mc68*:A/UX:*:*) - echo m68k-apple-aux${UNAME_RELEASE} - exit ;; + GUESS=m68k-apple-aux$UNAME_RELEASE + ;; news*:NEWS-OS:6*:*) - echo mips-sony-newsos6 - exit ;; + GUESS=mips-sony-newsos6 + ;; R[34]000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*) - if [ -d /usr/nec ]; then - echo mips-nec-sysv${UNAME_RELEASE} + if test -d /usr/nec; then + GUESS=mips-nec-sysv$UNAME_RELEASE else - echo mips-unknown-sysv${UNAME_RELEASE} + GUESS=mips-unknown-sysv$UNAME_RELEASE fi - exit ;; + ;; BeBox:BeOS:*:*) # BeOS running on hardware made by Be, PPC only. - echo powerpc-be-beos - exit ;; + GUESS=powerpc-be-beos + ;; BeMac:BeOS:*:*) # BeOS running on Mac or Mac clone, PPC only. - echo powerpc-apple-beos - exit ;; + GUESS=powerpc-apple-beos + ;; BePC:BeOS:*:*) # BeOS running on Intel PC compatible. - echo i586-pc-beos - exit ;; + GUESS=i586-pc-beos + ;; BePC:Haiku:*:*) # Haiku running on Intel PC compatible. - echo i586-pc-haiku - exit ;; - x86_64:Haiku:*:*) - echo x86_64-unknown-haiku - exit ;; + GUESS=i586-pc-haiku + ;; + ppc:Haiku:*:*) # Haiku running on Apple PowerPC + GUESS=powerpc-apple-haiku + ;; + *:Haiku:*:*) # Haiku modern gcc (not bound by BeOS compat) + GUESS=$UNAME_MACHINE-unknown-haiku + ;; SX-4:SUPER-UX:*:*) - echo sx4-nec-superux${UNAME_RELEASE} - exit ;; + GUESS=sx4-nec-superux$UNAME_RELEASE + ;; SX-5:SUPER-UX:*:*) - echo sx5-nec-superux${UNAME_RELEASE} - exit ;; + GUESS=sx5-nec-superux$UNAME_RELEASE + ;; SX-6:SUPER-UX:*:*) - echo sx6-nec-superux${UNAME_RELEASE} - exit ;; + GUESS=sx6-nec-superux$UNAME_RELEASE + ;; SX-7:SUPER-UX:*:*) - echo sx7-nec-superux${UNAME_RELEASE} - exit ;; + GUESS=sx7-nec-superux$UNAME_RELEASE + ;; SX-8:SUPER-UX:*:*) - echo sx8-nec-superux${UNAME_RELEASE} - exit ;; + GUESS=sx8-nec-superux$UNAME_RELEASE + ;; SX-8R:SUPER-UX:*:*) - echo sx8r-nec-superux${UNAME_RELEASE} - exit ;; + GUESS=sx8r-nec-superux$UNAME_RELEASE + ;; + SX-ACE:SUPER-UX:*:*) + GUESS=sxace-nec-superux$UNAME_RELEASE + ;; Power*:Rhapsody:*:*) - echo powerpc-apple-rhapsody${UNAME_RELEASE} - exit ;; + GUESS=powerpc-apple-rhapsody$UNAME_RELEASE + ;; *:Rhapsody:*:*) - echo ${UNAME_MACHINE}-apple-rhapsody${UNAME_RELEASE} - exit ;; + GUESS=$UNAME_MACHINE-apple-rhapsody$UNAME_RELEASE + ;; + arm64:Darwin:*:*) + GUESS=aarch64-apple-darwin$UNAME_RELEASE + ;; *:Darwin:*:*) - UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown - eval $set_cc_for_build - if test "$UNAME_PROCESSOR" = unknown ; then - UNAME_PROCESSOR=powerpc + UNAME_PROCESSOR=`uname -p` + case $UNAME_PROCESSOR in + unknown) UNAME_PROCESSOR=powerpc ;; + esac + if command -v xcode-select > /dev/null 2> /dev/null && \ + ! xcode-select --print-path > /dev/null 2> /dev/null ; then + # Avoid executing cc if there is no toolchain installed as + # cc will be a stub that puts up a graphical alert + # prompting the user to install developer tools. + CC_FOR_BUILD=no_compiler_found + else + set_cc_for_build fi - if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then - if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then - if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \ - (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \ - grep IS_64BIT_ARCH >/dev/null - then - case $UNAME_PROCESSOR in - i386) UNAME_PROCESSOR=x86_64 ;; - powerpc) UNAME_PROCESSOR=powerpc64 ;; - esac - fi + if test "$CC_FOR_BUILD" != no_compiler_found; then + if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \ + (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \ + grep IS_64BIT_ARCH >/dev/null + then + case $UNAME_PROCESSOR in + i386) UNAME_PROCESSOR=x86_64 ;; + powerpc) UNAME_PROCESSOR=powerpc64 ;; + esac + fi + # On 10.4-10.6 one might compile for PowerPC via gcc -arch ppc + if (echo '#ifdef __POWERPC__'; echo IS_PPC; echo '#endif') | \ + (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \ + grep IS_PPC >/dev/null + then + UNAME_PROCESSOR=powerpc fi elif test "$UNAME_PROCESSOR" = i386 ; then - # Avoid executing cc on OS X 10.9, as it ships with a stub - # that puts up a graphical alert prompting to install - # developer tools. Any system running Mac OS X 10.7 or - # later (Darwin 11 and later) is required to have a 64-bit - # processor. This is not true of the ARM version of Darwin - # that Apple uses in portable devices. - UNAME_PROCESSOR=x86_64 + # uname -m returns i386 or x86_64 + UNAME_PROCESSOR=$UNAME_MACHINE fi - echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE} - exit ;; + GUESS=$UNAME_PROCESSOR-apple-darwin$UNAME_RELEASE + ;; *:procnto*:*:* | *:QNX:[0123456789]*:*) UNAME_PROCESSOR=`uname -p` - if test "$UNAME_PROCESSOR" = "x86"; then + if test "$UNAME_PROCESSOR" = x86; then UNAME_PROCESSOR=i386 UNAME_MACHINE=pc fi - echo ${UNAME_PROCESSOR}-${UNAME_MACHINE}-nto-qnx${UNAME_RELEASE} - exit ;; + GUESS=$UNAME_PROCESSOR-$UNAME_MACHINE-nto-qnx$UNAME_RELEASE + ;; *:QNX:*:4*) - echo i386-pc-qnx - exit ;; - NEO-?:NONSTOP_KERNEL:*:*) - echo neo-tandem-nsk${UNAME_RELEASE} - exit ;; + GUESS=i386-pc-qnx + ;; + NEO-*:NONSTOP_KERNEL:*:*) + GUESS=neo-tandem-nsk$UNAME_RELEASE + ;; NSE-*:NONSTOP_KERNEL:*:*) - echo nse-tandem-nsk${UNAME_RELEASE} - exit ;; - NSR-?:NONSTOP_KERNEL:*:*) - echo nsr-tandem-nsk${UNAME_RELEASE} - exit ;; + GUESS=nse-tandem-nsk$UNAME_RELEASE + ;; + NSR-*:NONSTOP_KERNEL:*:*) + GUESS=nsr-tandem-nsk$UNAME_RELEASE + ;; + NSV-*:NONSTOP_KERNEL:*:*) + GUESS=nsv-tandem-nsk$UNAME_RELEASE + ;; + NSX-*:NONSTOP_KERNEL:*:*) + GUESS=nsx-tandem-nsk$UNAME_RELEASE + ;; *:NonStop-UX:*:*) - echo mips-compaq-nonstopux - exit ;; + GUESS=mips-compaq-nonstopux + ;; BS2000:POSIX*:*:*) - echo bs2000-siemens-sysv - exit ;; + GUESS=bs2000-siemens-sysv + ;; DS/*:UNIX_System_V:*:*) - echo ${UNAME_MACHINE}-${UNAME_SYSTEM}-${UNAME_RELEASE} - exit ;; + GUESS=$UNAME_MACHINE-$UNAME_SYSTEM-$UNAME_RELEASE + ;; *:Plan9:*:*) # "uname -m" is not consistent, so use $cputype instead. 386 # is converted to i386 for consistency with other x86 # operating systems. - if test "$cputype" = "386"; then + if test "${cputype-}" = 386; then UNAME_MACHINE=i386 - else - UNAME_MACHINE="$cputype" + elif test "x${cputype-}" != x; then + UNAME_MACHINE=$cputype fi - echo ${UNAME_MACHINE}-unknown-plan9 - exit ;; + GUESS=$UNAME_MACHINE-unknown-plan9 + ;; *:TOPS-10:*:*) - echo pdp10-unknown-tops10 - exit ;; + GUESS=pdp10-unknown-tops10 + ;; *:TENEX:*:*) - echo pdp10-unknown-tenex - exit ;; + GUESS=pdp10-unknown-tenex + ;; KS10:TOPS-20:*:* | KL10:TOPS-20:*:* | TYPE4:TOPS-20:*:*) - echo pdp10-dec-tops20 - exit ;; + GUESS=pdp10-dec-tops20 + ;; XKL-1:TOPS-20:*:* | TYPE5:TOPS-20:*:*) - echo pdp10-xkl-tops20 - exit ;; + GUESS=pdp10-xkl-tops20 + ;; *:TOPS-20:*:*) - echo pdp10-unknown-tops20 - exit ;; + GUESS=pdp10-unknown-tops20 + ;; *:ITS:*:*) - echo pdp10-unknown-its - exit ;; + GUESS=pdp10-unknown-its + ;; SEI:*:*:SEIUX) - echo mips-sei-seiux${UNAME_RELEASE} - exit ;; + GUESS=mips-sei-seiux$UNAME_RELEASE + ;; *:DragonFly:*:*) - echo ${UNAME_MACHINE}-unknown-dragonfly`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` - exit ;; + DRAGONFLY_REL=`echo "$UNAME_RELEASE" | sed -e 's/[-(].*//'` + GUESS=$UNAME_MACHINE-unknown-dragonfly$DRAGONFLY_REL + ;; *:*VMS:*:*) UNAME_MACHINE=`(uname -p) 2>/dev/null` - case "${UNAME_MACHINE}" in - A*) echo alpha-dec-vms ; exit ;; - I*) echo ia64-dec-vms ; exit ;; - V*) echo vax-dec-vms ; exit ;; + case $UNAME_MACHINE in + A*) GUESS=alpha-dec-vms ;; + I*) GUESS=ia64-dec-vms ;; + V*) GUESS=vax-dec-vms ;; esac ;; *:XENIX:*:SysV) - echo i386-pc-xenix - exit ;; + GUESS=i386-pc-xenix + ;; i*86:skyos:*:*) - echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE}` | sed -e 's/ .*$//' - exit ;; + SKYOS_REL=`echo "$UNAME_RELEASE" | sed -e 's/ .*$//'` + GUESS=$UNAME_MACHINE-pc-skyos$SKYOS_REL + ;; i*86:rdos:*:*) - echo ${UNAME_MACHINE}-pc-rdos - exit ;; - i*86:AROS:*:*) - echo ${UNAME_MACHINE}-pc-aros - exit ;; + GUESS=$UNAME_MACHINE-pc-rdos + ;; + i*86:Fiwix:*:*) + GUESS=$UNAME_MACHINE-pc-fiwix + ;; + *:AROS:*:*) + GUESS=$UNAME_MACHINE-unknown-aros + ;; x86_64:VMkernel:*:*) - echo ${UNAME_MACHINE}-unknown-esx - exit ;; + GUESS=$UNAME_MACHINE-unknown-esx + ;; amd64:Isilon\ OneFS:*:*) - echo x86_64-unknown-onefs - exit ;; + GUESS=x86_64-unknown-onefs + ;; + *:Unleashed:*:*) + GUESS=$UNAME_MACHINE-unknown-unleashed$UNAME_RELEASE + ;; +esac + +# Do we have a guess based on uname results? +if test "x$GUESS" != x; then + echo "$GUESS" + exit +fi + +# No uname command or uname output not recognized. +set_cc_for_build +cat > "$dummy.c" < +#include +#endif +#if defined(ultrix) || defined(_ultrix) || defined(__ultrix) || defined(__ultrix__) +#if defined (vax) || defined (__vax) || defined (__vax__) || defined(mips) || defined(__mips) || defined(__mips__) || defined(MIPS) || defined(__MIPS__) +#include +#if defined(_SIZE_T_) || defined(SIGLOST) +#include +#endif +#endif +#endif +main () +{ +#if defined (sony) +#if defined (MIPSEB) + /* BFD wants "bsd" instead of "newsos". Perhaps BFD should be changed, + I don't know.... */ + printf ("mips-sony-bsd\n"); exit (0); +#else +#include + printf ("m68k-sony-newsos%s\n", +#ifdef NEWSOS4 + "4" +#else + "" +#endif + ); exit (0); +#endif +#endif + +#if defined (NeXT) +#if !defined (__ARCHITECTURE__) +#define __ARCHITECTURE__ "m68k" +#endif + int version; + version=`(hostinfo | sed -n 's/.*NeXT Mach \([0-9]*\).*/\1/p') 2>/dev/null`; + if (version < 4) + printf ("%s-next-nextstep%d\n", __ARCHITECTURE__, version); + else + printf ("%s-next-openstep%d\n", __ARCHITECTURE__, version); + exit (0); +#endif + +#if defined (MULTIMAX) || defined (n16) +#if defined (UMAXV) + printf ("ns32k-encore-sysv\n"); exit (0); +#else +#if defined (CMU) + printf ("ns32k-encore-mach\n"); exit (0); +#else + printf ("ns32k-encore-bsd\n"); exit (0); +#endif +#endif +#endif + +#if defined (__386BSD__) + printf ("i386-pc-bsd\n"); exit (0); +#endif + +#if defined (sequent) +#if defined (i386) + printf ("i386-sequent-dynix\n"); exit (0); +#endif +#if defined (ns32000) + printf ("ns32k-sequent-dynix\n"); exit (0); +#endif +#endif + +#if defined (_SEQUENT_) + struct utsname un; + + uname(&un); + if (strncmp(un.version, "V2", 2) == 0) { + printf ("i386-sequent-ptx2\n"); exit (0); + } + if (strncmp(un.version, "V1", 2) == 0) { /* XXX is V1 correct? */ + printf ("i386-sequent-ptx1\n"); exit (0); + } + printf ("i386-sequent-ptx\n"); exit (0); +#endif + +#if defined (vax) +#if !defined (ultrix) +#include +#if defined (BSD) +#if BSD == 43 + printf ("vax-dec-bsd4.3\n"); exit (0); +#else +#if BSD == 199006 + printf ("vax-dec-bsd4.3reno\n"); exit (0); +#else + printf ("vax-dec-bsd\n"); exit (0); +#endif +#endif +#else + printf ("vax-dec-bsd\n"); exit (0); +#endif +#else +#if defined(_SIZE_T_) || defined(SIGLOST) + struct utsname un; + uname (&un); + printf ("vax-dec-ultrix%s\n", un.release); exit (0); +#else + printf ("vax-dec-ultrix\n"); exit (0); +#endif +#endif +#endif +#if defined(ultrix) || defined(_ultrix) || defined(__ultrix) || defined(__ultrix__) +#if defined(mips) || defined(__mips) || defined(__mips__) || defined(MIPS) || defined(__MIPS__) +#if defined(_SIZE_T_) || defined(SIGLOST) + struct utsname *un; + uname (&un); + printf ("mips-dec-ultrix%s\n", un.release); exit (0); +#else + printf ("mips-dec-ultrix\n"); exit (0); +#endif +#endif +#endif + +#if defined (alliant) && defined (i860) + printf ("i860-alliant-bsd\n"); exit (0); +#endif + + exit (1); +} +EOF + +$CC_FOR_BUILD -o "$dummy" "$dummy.c" 2>/dev/null && SYSTEM_NAME=`"$dummy"` && + { echo "$SYSTEM_NAME"; exit; } + +# Apollos put the system type in the environment. +test -d /usr/apollo && { echo "$ISP-apollo-$SYSTYPE"; exit; } + +echo "$0: unable to guess system type" >&2 + +case $UNAME_MACHINE:$UNAME_SYSTEM in + mips:Linux | mips64:Linux) + # If we got here on MIPS GNU/Linux, output extra information. + cat >&2 <&2 < in order to provide the needed -information to handle your system. +our_year=`echo $timestamp | sed 's,-.*,,'` +thisyear=`date +%Y` +# shellcheck disable=SC2003 +script_age=`expr "$thisyear" - "$our_year"` +if test "$script_age" -lt 3 ; then + cat >&2 </dev/null` /usr/bin/oslevel = `(/usr/bin/oslevel) 2>/dev/null` /usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null` -UNAME_MACHINE = ${UNAME_MACHINE} -UNAME_RELEASE = ${UNAME_RELEASE} -UNAME_SYSTEM = ${UNAME_SYSTEM} -UNAME_VERSION = ${UNAME_VERSION} +UNAME_MACHINE = "$UNAME_MACHINE" +UNAME_RELEASE = "$UNAME_RELEASE" +UNAME_SYSTEM = "$UNAME_SYSTEM" +UNAME_VERSION = "$UNAME_VERSION" EOF +fi exit 1 # Local variables: -# eval: (add-hook 'write-file-hooks 'time-stamp) +# eval: (add-hook 'before-save-hook 'time-stamp) # time-stamp-start: "timestamp='" # time-stamp-format: "%:y-%02m-%02d" # time-stamp-end: "'" diff --git a/scripts/config.sub b/scripts/config.sub index 0cd701654c..baf1512b3c 100644 --- a/scripts/config.sub +++ b/scripts/config.sub @@ -1,12 +1,14 @@ #! /bin/sh # Configuration validation subroutine script. -# Copyright 1992-2015 Free Software Foundation, Inc. +# Copyright 1992-2022 Free Software Foundation, Inc. -timestamp='2015-12-14' +# shellcheck disable=SC2006,SC2268 # see below for rationale + +timestamp='2022-09-17' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 3 of the License, or +# the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, but @@ -15,7 +17,7 @@ timestamp='2015-12-14' # General Public License for more details. # # You should have received a copy of the GNU General Public License -# along with this program; if not, see . +# along with this program; if not, see . # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a @@ -33,7 +35,7 @@ timestamp='2015-12-14' # Otherwise, we print the canonical config type on stdout and succeed. # You can get the latest version of this script from: -# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD +# https://git.savannah.gnu.org/cgit/config.git/plain/config.sub # This file is supposed to be the same for all GNU packages # and recognize all the CPU types, system types and aliases @@ -50,6 +52,13 @@ timestamp='2015-12-14' # CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM # It is wrong to echo any other type of specification. +# The "shellcheck disable" line above the timestamp inhibits complaints +# about features and limitations of the classic Bourne shell that were +# superseded or lifted in POSIX. However, this script identifies a wide +# variety of pre-POSIX systems that do not have POSIX shells at all, and +# even some reasonably current systems (Solaris 10 as case-in-point) still +# have a pre-POSIX /bin/sh. + me=`echo "$0" | sed -e 's,.*/,,'` usage="\ @@ -57,7 +66,7 @@ Usage: $0 [OPTION] CPU-MFR-OPSYS or ALIAS Canonicalize a configuration name. -Operation modes: +Options: -h, --help print this help, then exit -t, --time-stamp print date of last modification, then exit -v, --version print version number, then exit @@ -67,7 +76,7 @@ Report bugs and patches to ." version="\ GNU config.sub ($timestamp) -Copyright 1992-2015 Free Software Foundation, Inc. +Copyright 1992-2022 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." @@ -89,12 +98,12 @@ while test $# -gt 0 ; do - ) # Use stdin as input. break ;; -* ) - echo "$me: invalid option $1$help" + echo "$me: invalid option $1$help" >&2 exit 1 ;; *local*) # First pass through any local machine types. - echo $1 + echo "$1" exit ;; * ) @@ -110,1234 +119,1186 @@ case $# in exit 1;; esac -# Separate what the user gave into CPU-COMPANY and OS or KERNEL-OS (if any). -# Here we must recognize all the valid KERNEL-OS combinations. -maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'` -case $maybe_os in - nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \ - linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \ - knetbsd*-gnu* | netbsd*-gnu* | netbsd*-eabi* | \ - kopensolaris*-gnu* | \ - storm-chaos* | os2-emx* | rtmk-nova*) - os=-$maybe_os - basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'` - ;; - android-linux) - os=-linux-android - basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown - ;; - *) - basic_machine=`echo $1 | sed 's/-[^-]*$//'` - if [ $basic_machine != $1 ] - then os=`echo $1 | sed 's/.*-/-/'` - else os=; fi - ;; -esac +# Split fields of configuration type +# shellcheck disable=SC2162 +saved_IFS=$IFS +IFS="-" read field1 field2 field3 field4 <&2 + exit 1 ;; - -ptx*) - basic_machine=`echo $1 | sed -e 's/86-.*/86-sequent/'` + *-*-*-*) + basic_machine=$field1-$field2 + basic_os=$field3-$field4 ;; - -windowsnt*) - os=`echo $os | sed -e 's/windowsnt/winnt/'` + *-*-*) + # Ambiguous whether COMPANY is present, or skipped and KERNEL-OS is two + # parts + maybe_os=$field2-$field3 + case $maybe_os in + nto-qnx* | linux-* | uclinux-uclibc* \ + | uclinux-gnu* | kfreebsd*-gnu* | knetbsd*-gnu* | netbsd*-gnu* \ + | netbsd*-eabi* | kopensolaris*-gnu* | cloudabi*-eabi* \ + | storm-chaos* | os2-emx* | rtmk-nova* | managarm-*) + basic_machine=$field1 + basic_os=$maybe_os + ;; + android-linux) + basic_machine=$field1-unknown + basic_os=linux-android + ;; + *) + basic_machine=$field1-$field2 + basic_os=$field3 + ;; + esac ;; - -psos*) - os=-psos + *-*) + # A lone config we happen to match not fitting any pattern + case $field1-$field2 in + decstation-3100) + basic_machine=mips-dec + basic_os= + ;; + *-*) + # Second component is usually, but not always the OS + case $field2 in + # Prevent following clause from handling this valid os + sun*os*) + basic_machine=$field1 + basic_os=$field2 + ;; + zephyr*) + basic_machine=$field1-unknown + basic_os=$field2 + ;; + # Manufacturers + dec* | mips* | sequent* | encore* | pc533* | sgi* | sony* \ + | att* | 7300* | 3300* | delta* | motorola* | sun[234]* \ + | unicom* | ibm* | next | hp | isi* | apollo | altos* \ + | convergent* | ncr* | news | 32* | 3600* | 3100* \ + | hitachi* | c[123]* | convex* | sun | crds | omron* | dg \ + | ultra | tti* | harris | dolphin | highlevel | gould \ + | cbm | ns | masscomp | apple | axis | knuth | cray \ + | microblaze* | sim | cisco \ + | oki | wec | wrs | winbond) + basic_machine=$field1-$field2 + basic_os= + ;; + *) + basic_machine=$field1 + basic_os=$field2 + ;; + esac + ;; + esac ;; - -mint | -mint[0-9]*) - basic_machine=m68k-atari - os=-mint + *) + # Convert single-component short-hands not valid as part of + # multi-component configurations. + case $field1 in + 386bsd) + basic_machine=i386-pc + basic_os=bsd + ;; + a29khif) + basic_machine=a29k-amd + basic_os=udi + ;; + adobe68k) + basic_machine=m68010-adobe + basic_os=scout + ;; + alliant) + basic_machine=fx80-alliant + basic_os= + ;; + altos | altos3068) + basic_machine=m68k-altos + basic_os= + ;; + am29k) + basic_machine=a29k-none + basic_os=bsd + ;; + amdahl) + basic_machine=580-amdahl + basic_os=sysv + ;; + amiga) + basic_machine=m68k-unknown + basic_os= + ;; + amigaos | amigados) + basic_machine=m68k-unknown + basic_os=amigaos + ;; + amigaunix | amix) + basic_machine=m68k-unknown + basic_os=sysv4 + ;; + apollo68) + basic_machine=m68k-apollo + basic_os=sysv + ;; + apollo68bsd) + basic_machine=m68k-apollo + basic_os=bsd + ;; + aros) + basic_machine=i386-pc + basic_os=aros + ;; + aux) + basic_machine=m68k-apple + basic_os=aux + ;; + balance) + basic_machine=ns32k-sequent + basic_os=dynix + ;; + blackfin) + basic_machine=bfin-unknown + basic_os=linux + ;; + cegcc) + basic_machine=arm-unknown + basic_os=cegcc + ;; + convex-c1) + basic_machine=c1-convex + basic_os=bsd + ;; + convex-c2) + basic_machine=c2-convex + basic_os=bsd + ;; + convex-c32) + basic_machine=c32-convex + basic_os=bsd + ;; + convex-c34) + basic_machine=c34-convex + basic_os=bsd + ;; + convex-c38) + basic_machine=c38-convex + basic_os=bsd + ;; + cray) + basic_machine=j90-cray + basic_os=unicos + ;; + crds | unos) + basic_machine=m68k-crds + basic_os= + ;; + da30) + basic_machine=m68k-da30 + basic_os= + ;; + decstation | pmax | pmin | dec3100 | decstatn) + basic_machine=mips-dec + basic_os= + ;; + delta88) + basic_machine=m88k-motorola + basic_os=sysv3 + ;; + dicos) + basic_machine=i686-pc + basic_os=dicos + ;; + djgpp) + basic_machine=i586-pc + basic_os=msdosdjgpp + ;; + ebmon29k) + basic_machine=a29k-amd + basic_os=ebmon + ;; + es1800 | OSE68k | ose68k | ose | OSE) + basic_machine=m68k-ericsson + basic_os=ose + ;; + gmicro) + basic_machine=tron-gmicro + basic_os=sysv + ;; + go32) + basic_machine=i386-pc + basic_os=go32 + ;; + h8300hms) + basic_machine=h8300-hitachi + basic_os=hms + ;; + h8300xray) + basic_machine=h8300-hitachi + basic_os=xray + ;; + h8500hms) + basic_machine=h8500-hitachi + basic_os=hms + ;; + harris) + basic_machine=m88k-harris + basic_os=sysv3 + ;; + hp300 | hp300hpux) + basic_machine=m68k-hp + basic_os=hpux + ;; + hp300bsd) + basic_machine=m68k-hp + basic_os=bsd + ;; + hppaosf) + basic_machine=hppa1.1-hp + basic_os=osf + ;; + hppro) + basic_machine=hppa1.1-hp + basic_os=proelf + ;; + i386mach) + basic_machine=i386-mach + basic_os=mach + ;; + isi68 | isi) + basic_machine=m68k-isi + basic_os=sysv + ;; + m68knommu) + basic_machine=m68k-unknown + basic_os=linux + ;; + magnum | m3230) + basic_machine=mips-mips + basic_os=sysv + ;; + merlin) + basic_machine=ns32k-utek + basic_os=sysv + ;; + mingw64) + basic_machine=x86_64-pc + basic_os=mingw64 + ;; + mingw32) + basic_machine=i686-pc + basic_os=mingw32 + ;; + mingw32ce) + basic_machine=arm-unknown + basic_os=mingw32ce + ;; + monitor) + basic_machine=m68k-rom68k + basic_os=coff + ;; + morphos) + basic_machine=powerpc-unknown + basic_os=morphos + ;; + moxiebox) + basic_machine=moxie-unknown + basic_os=moxiebox + ;; + msdos) + basic_machine=i386-pc + basic_os=msdos + ;; + msys) + basic_machine=i686-pc + basic_os=msys + ;; + mvs) + basic_machine=i370-ibm + basic_os=mvs + ;; + nacl) + basic_machine=le32-unknown + basic_os=nacl + ;; + ncr3000) + basic_machine=i486-ncr + basic_os=sysv4 + ;; + netbsd386) + basic_machine=i386-pc + basic_os=netbsd + ;; + netwinder) + basic_machine=armv4l-rebel + basic_os=linux + ;; + news | news700 | news800 | news900) + basic_machine=m68k-sony + basic_os=newsos + ;; + news1000) + basic_machine=m68030-sony + basic_os=newsos + ;; + necv70) + basic_machine=v70-nec + basic_os=sysv + ;; + nh3000) + basic_machine=m68k-harris + basic_os=cxux + ;; + nh[45]000) + basic_machine=m88k-harris + basic_os=cxux + ;; + nindy960) + basic_machine=i960-intel + basic_os=nindy + ;; + mon960) + basic_machine=i960-intel + basic_os=mon960 + ;; + nonstopux) + basic_machine=mips-compaq + basic_os=nonstopux + ;; + os400) + basic_machine=powerpc-ibm + basic_os=os400 + ;; + OSE68000 | ose68000) + basic_machine=m68000-ericsson + basic_os=ose + ;; + os68k) + basic_machine=m68k-none + basic_os=os68k + ;; + paragon) + basic_machine=i860-intel + basic_os=osf + ;; + parisc) + basic_machine=hppa-unknown + basic_os=linux + ;; + psp) + basic_machine=mipsallegrexel-sony + basic_os=psp + ;; + pw32) + basic_machine=i586-unknown + basic_os=pw32 + ;; + rdos | rdos64) + basic_machine=x86_64-pc + basic_os=rdos + ;; + rdos32) + basic_machine=i386-pc + basic_os=rdos + ;; + rom68k) + basic_machine=m68k-rom68k + basic_os=coff + ;; + sa29200) + basic_machine=a29k-amd + basic_os=udi + ;; + sei) + basic_machine=mips-sei + basic_os=seiux + ;; + sequent) + basic_machine=i386-sequent + basic_os= + ;; + sps7) + basic_machine=m68k-bull + basic_os=sysv2 + ;; + st2000) + basic_machine=m68k-tandem + basic_os= + ;; + stratus) + basic_machine=i860-stratus + basic_os=sysv4 + ;; + sun2) + basic_machine=m68000-sun + basic_os= + ;; + sun2os3) + basic_machine=m68000-sun + basic_os=sunos3 + ;; + sun2os4) + basic_machine=m68000-sun + basic_os=sunos4 + ;; + sun3) + basic_machine=m68k-sun + basic_os= + ;; + sun3os3) + basic_machine=m68k-sun + basic_os=sunos3 + ;; + sun3os4) + basic_machine=m68k-sun + basic_os=sunos4 + ;; + sun4) + basic_machine=sparc-sun + basic_os= + ;; + sun4os3) + basic_machine=sparc-sun + basic_os=sunos3 + ;; + sun4os4) + basic_machine=sparc-sun + basic_os=sunos4 + ;; + sun4sol2) + basic_machine=sparc-sun + basic_os=solaris2 + ;; + sun386 | sun386i | roadrunner) + basic_machine=i386-sun + basic_os= + ;; + sv1) + basic_machine=sv1-cray + basic_os=unicos + ;; + symmetry) + basic_machine=i386-sequent + basic_os=dynix + ;; + t3e) + basic_machine=alphaev5-cray + basic_os=unicos + ;; + t90) + basic_machine=t90-cray + basic_os=unicos + ;; + toad1) + basic_machine=pdp10-xkl + basic_os=tops20 + ;; + tpf) + basic_machine=s390x-ibm + basic_os=tpf + ;; + udi29k) + basic_machine=a29k-amd + basic_os=udi + ;; + ultra3) + basic_machine=a29k-nyu + basic_os=sym1 + ;; + v810 | necv810) + basic_machine=v810-nec + basic_os=none + ;; + vaxv) + basic_machine=vax-dec + basic_os=sysv + ;; + vms) + basic_machine=vax-dec + basic_os=vms + ;; + vsta) + basic_machine=i386-pc + basic_os=vsta + ;; + vxworks960) + basic_machine=i960-wrs + basic_os=vxworks + ;; + vxworks68) + basic_machine=m68k-wrs + basic_os=vxworks + ;; + vxworks29k) + basic_machine=a29k-wrs + basic_os=vxworks + ;; + xbox) + basic_machine=i686-pc + basic_os=mingw32 + ;; + ymp) + basic_machine=ymp-cray + basic_os=unicos + ;; + *) + basic_machine=$1 + basic_os= + ;; + esac ;; esac -# Decode aliases for certain CPU-COMPANY combinations. +# Decode 1-component or ad-hoc basic machines case $basic_machine in - # Recognize the basic CPU types without company name. - # Some are omitted here because they have special meanings below. - 1750a | 580 \ - | a29k \ - | aarch64 | aarch64_be \ - | alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \ - | alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \ - | am33_2.0 \ - | arc | arceb \ - | arm | arm[bl]e | arme[lb] | armv[2-8] | armv[3-8][lb] | armv7[arm] \ - | avr | avr32 \ - | ba \ - | be32 | be64 \ - | bfin \ - | c4x | c8051 | clipper \ - | d10v | d30v | dlx | dsp16xx \ - | e2k | epiphany \ - | fido | fr30 | frv | ft32 \ - | h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \ - | hexagon \ - | i370 | i860 | i960 | ia64 \ - | ip2k | iq2000 \ - | k1om \ - | le32 | le64 \ - | lm32 \ - | m32c | m32r | m32rle | m68000 | m68k | m88k \ - | maxq | mb | microblaze | microblazeel | mcore | mep | metag \ - | mips | mipsbe | mipseb | mipsel | mipsle \ - | mips16 \ - | mips64 | mips64el \ - | mips64octeon | mips64octeonel \ - | mips64orion | mips64orionel \ - | mips64r5900 | mips64r5900el \ - | mips64vr | mips64vrel \ - | mips64vr4100 | mips64vr4100el \ - | mips64vr4300 | mips64vr4300el \ - | mips64vr5000 | mips64vr5000el \ - | mips64vr5900 | mips64vr5900el \ - | mipsisa32 | mipsisa32el \ - | mipsisa32r2 | mipsisa32r2el \ - | mipsisa32r6 | mipsisa32r6el \ - | mipsisa64 | mipsisa64el \ - | mipsisa64r2 | mipsisa64r2el \ - | mipsisa64r6 | mipsisa64r6el \ - | mipsisa64sb1 | mipsisa64sb1el \ - | mipsisa64sr71k | mipsisa64sr71kel \ - | mipsr5900 | mipsr5900el \ - | mipstx39 | mipstx39el \ - | mn10200 | mn10300 \ - | moxie \ - | mt \ - | msp430 \ - | nds32 | nds32le | nds32be \ - | nios | nios2 | nios2eb | nios2el \ - | ns16k | ns32k \ - | open8 | or1k | or1knd | or32 \ - | pdp10 | pdp11 | pj | pjl \ - | powerpc | powerpc64 | powerpc64le | powerpcle \ - | pyramid \ - | riscv32 | riscv64 \ - | rl78 | rx \ - | score \ - | sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[234]eb | sheb | shbe | shle | sh[1234]le | sh3ele \ - | sh64 | sh64le \ - | sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \ - | sparcv8 | sparcv9 | sparcv9b | sparcv9v \ - | spu \ - | tahoe | tic4x | tic54x | tic55x | tic6x | tic80 | tron \ - | ubicom32 \ - | v850 | v850e | v850e1 | v850e2 | v850es | v850e2v3 \ - | visium \ - | we32k \ - | x86 | xc16x | xstormy16 | xtensa \ - | z8k | z80) - basic_machine=$basic_machine-unknown - ;; - c54x) - basic_machine=tic54x-unknown - ;; - c55x) - basic_machine=tic55x-unknown - ;; - c6x) - basic_machine=tic6x-unknown - ;; - leon|leon[3-9]) - basic_machine=sparc-$basic_machine - ;; - m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | nvptx | picochip) - basic_machine=$basic_machine-unknown - os=-none + # Here we handle the default manufacturer of certain CPU types. It is in + # some cases the only manufacturer, in others, it is the most popular. + w89k) + cpu=hppa1.1 + vendor=winbond ;; - m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65 | z8k) + op50n) + cpu=hppa1.1 + vendor=oki ;; - ms1) - basic_machine=mt-unknown + op60c) + cpu=hppa1.1 + vendor=oki ;; - - strongarm | thumb | xscale) - basic_machine=arm-unknown + ibm*) + cpu=i370 + vendor=ibm ;; - xgate) - basic_machine=$basic_machine-unknown - os=-none + orion105) + cpu=clipper + vendor=highlevel ;; - xscaleeb) - basic_machine=armeb-unknown + mac | mpw | mac-mpw) + cpu=m68k + vendor=apple ;; - - xscaleel) - basic_machine=armel-unknown + pmac | pmac-mpw) + cpu=powerpc + vendor=apple ;; - # We use `pc' rather than `unknown' - # because (1) that's what they normally are, and - # (2) the word "unknown" tends to confuse beginning users. - i*86 | x86_64) - basic_machine=$basic_machine-pc - ;; - # Object if more than one company name word. - *-*-*) - echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2 - exit 1 - ;; - # Recognize the basic CPU types with company name. - 580-* \ - | a29k-* \ - | aarch64-* | aarch64_be-* \ - | alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \ - | alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \ - | alphapca5[67]-* | alpha64pca5[67]-* | arc-* | arceb-* \ - | arm-* | armbe-* | armle-* | armeb-* | armv*-* \ - | avr-* | avr32-* \ - | ba-* \ - | be32-* | be64-* \ - | bfin-* | bs2000-* \ - | c[123]* | c30-* | [cjt]90-* | c4x-* \ - | c8051-* | clipper-* | craynv-* | cydra-* \ - | d10v-* | d30v-* | dlx-* \ - | e2k-* | elxsi-* \ - | f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \ - | h8300-* | h8500-* \ - | hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \ - | hexagon-* \ - | i*86-* | i860-* | i960-* | ia64-* \ - | ip2k-* | iq2000-* \ - | k1om-* \ - | le32-* | le64-* \ - | lm32-* \ - | m32c-* | m32r-* | m32rle-* \ - | m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \ - | m88110-* | m88k-* | maxq-* | mcore-* | metag-* \ - | microblaze-* | microblazeel-* \ - | mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \ - | mips16-* \ - | mips64-* | mips64el-* \ - | mips64octeon-* | mips64octeonel-* \ - | mips64orion-* | mips64orionel-* \ - | mips64r5900-* | mips64r5900el-* \ - | mips64vr-* | mips64vrel-* \ - | mips64vr4100-* | mips64vr4100el-* \ - | mips64vr4300-* | mips64vr4300el-* \ - | mips64vr5000-* | mips64vr5000el-* \ - | mips64vr5900-* | mips64vr5900el-* \ - | mipsisa32-* | mipsisa32el-* \ - | mipsisa32r2-* | mipsisa32r2el-* \ - | mipsisa32r6-* | mipsisa32r6el-* \ - | mipsisa64-* | mipsisa64el-* \ - | mipsisa64r2-* | mipsisa64r2el-* \ - | mipsisa64r6-* | mipsisa64r6el-* \ - | mipsisa64sb1-* | mipsisa64sb1el-* \ - | mipsisa64sr71k-* | mipsisa64sr71kel-* \ - | mipsr5900-* | mipsr5900el-* \ - | mipstx39-* | mipstx39el-* \ - | mmix-* \ - | mt-* \ - | msp430-* \ - | nds32-* | nds32le-* | nds32be-* \ - | nios-* | nios2-* | nios2eb-* | nios2el-* \ - | none-* | np1-* | ns16k-* | ns32k-* \ - | open8-* \ - | or1k*-* \ - | orion-* \ - | pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \ - | powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \ - | pyramid-* \ - | riscv32-* | riscv64-* \ - | rl78-* | romp-* | rs6000-* | rx-* \ - | sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \ - | shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \ - | sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \ - | sparclite-* \ - | sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx*-* \ - | tahoe-* \ - | tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \ - | tile*-* \ - | tron-* \ - | ubicom32-* \ - | v850-* | v850e-* | v850e1-* | v850es-* | v850e2-* | v850e2v3-* \ - | vax-* \ - | visium-* \ - | we32k-* \ - | x86-* | x86_64-* | xc16x-* | xps100-* \ - | xstormy16-* | xtensa*-* \ - | ymp-* \ - | z8k-* | z80-*) - ;; - # Recognize the basic CPU types without company name, with glob match. - xtensa*) - basic_machine=$basic_machine-unknown - ;; # Recognize the various machine names and aliases which stand # for a CPU type and a company and sometimes even an OS. - 386bsd) - basic_machine=i386-unknown - os=-bsd - ;; 3b1 | 7300 | 7300-att | att-7300 | pc7300 | safari | unixpc) - basic_machine=m68000-att + cpu=m68000 + vendor=att ;; 3b*) - basic_machine=we32k-att - ;; - a29khif) - basic_machine=a29k-amd - os=-udi - ;; - abacus) - basic_machine=abacus-unknown - ;; - adobe68k) - basic_machine=m68010-adobe - os=-scout - ;; - alliant | fx80) - basic_machine=fx80-alliant - ;; - altos | altos3068) - basic_machine=m68k-altos - ;; - am29k) - basic_machine=a29k-none - os=-bsd - ;; - amd64) - basic_machine=x86_64-pc - ;; - amd64-*) - basic_machine=x86_64-`echo $basic_machine | sed 's/^[^-]*-//'` - ;; - amdahl) - basic_machine=580-amdahl - os=-sysv - ;; - amiga | amiga-*) - basic_machine=m68k-unknown - ;; - amigaos | amigados) - basic_machine=m68k-unknown - os=-amigaos - ;; - amigaunix | amix) - basic_machine=m68k-unknown - os=-sysv4 - ;; - apollo68) - basic_machine=m68k-apollo - os=-sysv - ;; - apollo68bsd) - basic_machine=m68k-apollo - os=-bsd - ;; - aros) - basic_machine=i386-pc - os=-aros - ;; - asmjs) - basic_machine=asmjs-unknown - ;; - aux) - basic_machine=m68k-apple - os=-aux - ;; - balance) - basic_machine=ns32k-sequent - os=-dynix - ;; - blackfin) - basic_machine=bfin-unknown - os=-linux - ;; - blackfin-*) - basic_machine=bfin-`echo $basic_machine | sed 's/^[^-]*-//'` - os=-linux + cpu=we32k + vendor=att ;; bluegene*) - basic_machine=powerpc-ibm - os=-cnk - ;; - c54x-*) - basic_machine=tic54x-`echo $basic_machine | sed 's/^[^-]*-//'` - ;; - c55x-*) - basic_machine=tic55x-`echo $basic_machine | sed 's/^[^-]*-//'` - ;; - c6x-*) - basic_machine=tic6x-`echo $basic_machine | sed 's/^[^-]*-//'` - ;; - c90) - basic_machine=c90-cray - os=-unicos - ;; - cegcc) - basic_machine=arm-unknown - os=-cegcc - ;; - convex-c1) - basic_machine=c1-convex - os=-bsd - ;; - convex-c2) - basic_machine=c2-convex - os=-bsd - ;; - convex-c32) - basic_machine=c32-convex - os=-bsd - ;; - convex-c34) - basic_machine=c34-convex - os=-bsd - ;; - convex-c38) - basic_machine=c38-convex - os=-bsd - ;; - cray | j90) - basic_machine=j90-cray - os=-unicos - ;; - craynv) - basic_machine=craynv-cray - os=-unicosmp - ;; - cr16 | cr16-*) - basic_machine=cr16-unknown - os=-elf - ;; - crds | unos) - basic_machine=m68k-crds - ;; - crisv32 | crisv32-* | etraxfs*) - basic_machine=crisv32-axis - ;; - cris | cris-* | etrax*) - basic_machine=cris-axis - ;; - crx) - basic_machine=crx-unknown - os=-elf - ;; - da30 | da30-*) - basic_machine=m68k-da30 - ;; - decstation | decstation-3100 | pmax | pmax-* | pmin | dec3100 | decstatn) - basic_machine=mips-dec + cpu=powerpc + vendor=ibm + basic_os=cnk ;; decsystem10* | dec10*) - basic_machine=pdp10-dec - os=-tops10 + cpu=pdp10 + vendor=dec + basic_os=tops10 ;; decsystem20* | dec20*) - basic_machine=pdp10-dec - os=-tops20 + cpu=pdp10 + vendor=dec + basic_os=tops20 ;; delta | 3300 | motorola-3300 | motorola-delta \ | 3300-motorola | delta-motorola) - basic_machine=m68k-motorola - ;; - delta88) - basic_machine=m88k-motorola - os=-sysv3 - ;; - dicos) - basic_machine=i686-pc - os=-dicos - ;; - djgpp) - basic_machine=i586-pc - os=-msdosdjgpp + cpu=m68k + vendor=motorola ;; - dpx20 | dpx20-*) - basic_machine=rs6000-bull - os=-bosx - ;; - dpx2* | dpx2*-bull) - basic_machine=m68k-bull - os=-sysv3 - ;; - ebmon29k) - basic_machine=a29k-amd - os=-ebmon - ;; - elxsi) - basic_machine=elxsi-elxsi - os=-bsd + dpx2*) + cpu=m68k + vendor=bull + basic_os=sysv3 ;; encore | umax | mmax) - basic_machine=ns32k-encore + cpu=ns32k + vendor=encore ;; - es1800 | OSE68k | ose68k | ose | OSE) - basic_machine=m68k-ericsson - os=-ose + elxsi) + cpu=elxsi + vendor=elxsi + basic_os=${basic_os:-bsd} ;; fx2800) - basic_machine=i860-alliant + cpu=i860 + vendor=alliant ;; genix) - basic_machine=ns32k-ns - ;; - gmicro) - basic_machine=tron-gmicro - os=-sysv - ;; - go32) - basic_machine=i386-pc - os=-go32 + cpu=ns32k + vendor=ns ;; h3050r* | hiux*) - basic_machine=hppa1.1-hitachi - os=-hiuxwe2 - ;; - h8300hms) - basic_machine=h8300-hitachi - os=-hms - ;; - h8300xray) - basic_machine=h8300-hitachi - os=-xray - ;; - h8500hms) - basic_machine=h8500-hitachi - os=-hms - ;; - harris) - basic_machine=m88k-harris - os=-sysv3 - ;; - hp300-*) - basic_machine=m68k-hp - ;; - hp300bsd) - basic_machine=m68k-hp - os=-bsd - ;; - hp300hpux) - basic_machine=m68k-hp - os=-hpux + cpu=hppa1.1 + vendor=hitachi + basic_os=hiuxwe2 ;; hp3k9[0-9][0-9] | hp9[0-9][0-9]) - basic_machine=hppa1.0-hp + cpu=hppa1.0 + vendor=hp ;; hp9k2[0-9][0-9] | hp9k31[0-9]) - basic_machine=m68000-hp + cpu=m68000 + vendor=hp ;; hp9k3[2-9][0-9]) - basic_machine=m68k-hp + cpu=m68k + vendor=hp ;; hp9k6[0-9][0-9] | hp6[0-9][0-9]) - basic_machine=hppa1.0-hp + cpu=hppa1.0 + vendor=hp ;; hp9k7[0-79][0-9] | hp7[0-79][0-9]) - basic_machine=hppa1.1-hp + cpu=hppa1.1 + vendor=hp ;; hp9k78[0-9] | hp78[0-9]) # FIXME: really hppa2.0-hp - basic_machine=hppa1.1-hp + cpu=hppa1.1 + vendor=hp ;; hp9k8[67]1 | hp8[67]1 | hp9k80[24] | hp80[24] | hp9k8[78]9 | hp8[78]9 | hp9k893 | hp893) # FIXME: really hppa2.0-hp - basic_machine=hppa1.1-hp + cpu=hppa1.1 + vendor=hp ;; hp9k8[0-9][13679] | hp8[0-9][13679]) - basic_machine=hppa1.1-hp + cpu=hppa1.1 + vendor=hp ;; hp9k8[0-9][0-9] | hp8[0-9][0-9]) - basic_machine=hppa1.0-hp - ;; - hppa-next) - os=-nextstep3 - ;; - hppaosf) - basic_machine=hppa1.1-hp - os=-osf - ;; - hppro) - basic_machine=hppa1.1-hp - os=-proelf - ;; - i370-ibm* | ibm*) - basic_machine=i370-ibm + cpu=hppa1.0 + vendor=hp ;; i*86v32) - basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` - os=-sysv32 + cpu=`echo "$1" | sed -e 's/86.*/86/'` + vendor=pc + basic_os=sysv32 ;; i*86v4*) - basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` - os=-sysv4 + cpu=`echo "$1" | sed -e 's/86.*/86/'` + vendor=pc + basic_os=sysv4 ;; i*86v) - basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` - os=-sysv + cpu=`echo "$1" | sed -e 's/86.*/86/'` + vendor=pc + basic_os=sysv ;; i*86sol2) - basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` - os=-solaris2 - ;; - i386mach) - basic_machine=i386-mach - os=-mach + cpu=`echo "$1" | sed -e 's/86.*/86/'` + vendor=pc + basic_os=solaris2 ;; - i386-vsta | vsta) - basic_machine=i386-unknown - os=-vsta + j90 | j90-cray) + cpu=j90 + vendor=cray + basic_os=${basic_os:-unicos} ;; iris | iris4d) - basic_machine=mips-sgi - case $os in - -irix*) + cpu=mips + vendor=sgi + case $basic_os in + irix*) ;; *) - os=-irix4 + basic_os=irix4 ;; esac ;; - isi68 | isi) - basic_machine=m68k-isi - os=-sysv - ;; - leon-*|leon[3-9]-*) - basic_machine=sparc-`echo $basic_machine | sed 's/-.*//'` - ;; - m68knommu) - basic_machine=m68k-unknown - os=-linux - ;; - m68knommu-*) - basic_machine=m68k-`echo $basic_machine | sed 's/^[^-]*-//'` - os=-linux - ;; - m88k-omron*) - basic_machine=m88k-omron - ;; - magnum | m3230) - basic_machine=mips-mips - os=-sysv - ;; - merlin) - basic_machine=ns32k-utek - os=-sysv - ;; - microblaze*) - basic_machine=microblaze-xilinx - ;; - mingw64) - basic_machine=x86_64-pc - os=-mingw64 - ;; - mingw32) - basic_machine=i686-pc - os=-mingw32 - ;; - mingw32ce) - basic_machine=arm-unknown - os=-mingw32ce - ;; miniframe) - basic_machine=m68000-convergent - ;; - *mint | -mint[0-9]* | *MiNT | *MiNT[0-9]*) - basic_machine=m68k-atari - os=-mint - ;; - mips3*-*) - basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'` + cpu=m68000 + vendor=convergent ;; - mips3*) - basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown - ;; - monitor) - basic_machine=m68k-rom68k - os=-coff - ;; - morphos) - basic_machine=powerpc-unknown - os=-morphos - ;; - moxiebox) - basic_machine=moxie-unknown - os=-moxiebox - ;; - msdos) - basic_machine=i386-pc - os=-msdos - ;; - ms1-*) - basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'` - ;; - msys) - basic_machine=i686-pc - os=-msys - ;; - mvs) - basic_machine=i370-ibm - os=-mvs - ;; - nacl) - basic_machine=le32-unknown - os=-nacl - ;; - ncr3000) - basic_machine=i486-ncr - os=-sysv4 - ;; - netbsd386) - basic_machine=i386-unknown - os=-netbsd - ;; - netwinder) - basic_machine=armv4l-rebel - os=-linux - ;; - news | news700 | news800 | news900) - basic_machine=m68k-sony - os=-newsos - ;; - news1000) - basic_machine=m68030-sony - os=-newsos + *mint | mint[0-9]* | *MiNT | *MiNT[0-9]*) + cpu=m68k + vendor=atari + basic_os=mint ;; news-3600 | risc-news) - basic_machine=mips-sony - os=-newsos - ;; - necv70) - basic_machine=v70-nec - os=-sysv - ;; - next | m*-next ) - basic_machine=m68k-next - case $os in - -nextstep* ) + cpu=mips + vendor=sony + basic_os=newsos + ;; + next | m*-next) + cpu=m68k + vendor=next + case $basic_os in + openstep*) + ;; + nextstep*) ;; - -ns2*) - os=-nextstep2 + ns2*) + basic_os=nextstep2 ;; *) - os=-nextstep3 + basic_os=nextstep3 ;; esac ;; - nh3000) - basic_machine=m68k-harris - os=-cxux - ;; - nh[45]000) - basic_machine=m88k-harris - os=-cxux - ;; - nindy960) - basic_machine=i960-intel - os=-nindy - ;; - mon960) - basic_machine=i960-intel - os=-mon960 - ;; - nonstopux) - basic_machine=mips-compaq - os=-nonstopux - ;; np1) - basic_machine=np1-gould - ;; - neo-tandem) - basic_machine=neo-tandem - ;; - nse-tandem) - basic_machine=nse-tandem - ;; - nsr-tandem) - basic_machine=nsr-tandem + cpu=np1 + vendor=gould ;; op50n-* | op60c-*) - basic_machine=hppa1.1-oki - os=-proelf - ;; - openrisc | openrisc-*) - basic_machine=or32-unknown - ;; - os400) - basic_machine=powerpc-ibm - os=-os400 - ;; - OSE68000 | ose68000) - basic_machine=m68000-ericsson - os=-ose - ;; - os68k) - basic_machine=m68k-none - os=-os68k + cpu=hppa1.1 + vendor=oki + basic_os=proelf ;; pa-hitachi) - basic_machine=hppa1.1-hitachi - os=-hiuxwe2 - ;; - paragon) - basic_machine=i860-intel - os=-osf - ;; - parisc) - basic_machine=hppa-unknown - os=-linux - ;; - parisc-*) - basic_machine=hppa-`echo $basic_machine | sed 's/^[^-]*-//'` - os=-linux + cpu=hppa1.1 + vendor=hitachi + basic_os=hiuxwe2 ;; pbd) - basic_machine=sparc-tti + cpu=sparc + vendor=tti ;; pbb) - basic_machine=m68k-tti - ;; - pc532 | pc532-*) - basic_machine=ns32k-pc532 - ;; - pc98) - basic_machine=i386-pc - ;; - pc98-*) - basic_machine=i386-`echo $basic_machine | sed 's/^[^-]*-//'` - ;; - pentium | p5 | k5 | k6 | nexgen | viac3) - basic_machine=i586-pc - ;; - pentiumpro | p6 | 6x86 | athlon | athlon_*) - basic_machine=i686-pc - ;; - pentiumii | pentium2 | pentiumiii | pentium3) - basic_machine=i686-pc + cpu=m68k + vendor=tti ;; - pentium4) - basic_machine=i786-pc - ;; - pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*) - basic_machine=i586-`echo $basic_machine | sed 's/^[^-]*-//'` - ;; - pentiumpro-* | p6-* | 6x86-* | athlon-*) - basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'` - ;; - pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*) - basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'` - ;; - pentium4-*) - basic_machine=i786-`echo $basic_machine | sed 's/^[^-]*-//'` + pc532) + cpu=ns32k + vendor=pc532 ;; pn) - basic_machine=pn-gould - ;; - power) basic_machine=power-ibm - ;; - ppc | ppcbe) basic_machine=powerpc-unknown - ;; - ppc-* | ppcbe-*) - basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'` - ;; - ppcle | powerpclittle | ppc-le | powerpc-little) - basic_machine=powerpcle-unknown - ;; - ppcle-* | powerpclittle-*) - basic_machine=powerpcle-`echo $basic_machine | sed 's/^[^-]*-//'` + cpu=pn + vendor=gould ;; - ppc64) basic_machine=powerpc64-unknown - ;; - ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'` - ;; - ppc64le | powerpc64little | ppc64-le | powerpc64-little) - basic_machine=powerpc64le-unknown - ;; - ppc64le-* | powerpc64little-*) - basic_machine=powerpc64le-`echo $basic_machine | sed 's/^[^-]*-//'` + power) + cpu=power + vendor=ibm ;; ps2) - basic_machine=i386-ibm - ;; - pw32) - basic_machine=i586-unknown - os=-pw32 - ;; - rdos | rdos64) - basic_machine=x86_64-pc - os=-rdos - ;; - rdos32) - basic_machine=i386-pc - os=-rdos - ;; - rom68k) - basic_machine=m68k-rom68k - os=-coff + cpu=i386 + vendor=ibm ;; rm[46]00) - basic_machine=mips-siemens + cpu=mips + vendor=siemens ;; rtpc | rtpc-*) - basic_machine=romp-ibm - ;; - s390 | s390-*) - basic_machine=s390-ibm + cpu=romp + vendor=ibm ;; - s390x | s390x-*) - basic_machine=s390x-ibm - ;; - sa29200) - basic_machine=a29k-amd - os=-udi + sde) + cpu=mipsisa32 + vendor=sde + basic_os=${basic_os:-elf} ;; - sb1) - basic_machine=mipsisa64sb1-unknown + simso-wrs) + cpu=sparclite + vendor=wrs + basic_os=vxworks ;; - sb1el) - basic_machine=mipsisa64sb1el-unknown + tower | tower-32) + cpu=m68k + vendor=ncr ;; - sde) - basic_machine=mipsisa32-sde - os=-elf + vpp*|vx|vx-*) + cpu=f301 + vendor=fujitsu ;; - sei) - basic_machine=mips-sei - os=-seiux + w65) + cpu=w65 + vendor=wdc ;; - sequent) - basic_machine=i386-sequent + w89k-*) + cpu=hppa1.1 + vendor=winbond + basic_os=proelf ;; - sh) - basic_machine=sh-hitachi - os=-hms + none) + cpu=none + vendor=none ;; - sh5el) - basic_machine=sh5le-unknown + leon|leon[3-9]) + cpu=sparc + vendor=$basic_machine ;; - sh64) - basic_machine=sh64-unknown + leon-*|leon[3-9]-*) + cpu=sparc + vendor=`echo "$basic_machine" | sed 's/-.*//'` ;; - sparclite-wrs | simso-wrs) - basic_machine=sparclite-wrs - os=-vxworks + + *-*) + # shellcheck disable=SC2162 + saved_IFS=$IFS + IFS="-" read cpu vendor <&2 - exit 1 + # Recognize the canonical CPU types that are allowed with any + # company name. + case $cpu in + 1750a | 580 \ + | a29k \ + | aarch64 | aarch64_be \ + | abacus \ + | alpha | alphaev[4-8] | alphaev56 | alphaev6[78] \ + | alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] \ + | alphapca5[67] | alpha64pca5[67] \ + | am33_2.0 \ + | amdgcn \ + | arc | arceb | arc32 | arc64 \ + | arm | arm[lb]e | arme[lb] | armv* \ + | avr | avr32 \ + | asmjs \ + | ba \ + | be32 | be64 \ + | bfin | bpf | bs2000 \ + | c[123]* | c30 | [cjt]90 | c4x \ + | c8051 | clipper | craynv | csky | cydra \ + | d10v | d30v | dlx | dsp16xx \ + | e2k | elxsi | epiphany \ + | f30[01] | f700 | fido | fr30 | frv | ft32 | fx80 \ + | h8300 | h8500 \ + | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \ + | hexagon \ + | i370 | i*86 | i860 | i960 | ia16 | ia64 \ + | ip2k | iq2000 \ + | k1om \ + | le32 | le64 \ + | lm32 \ + | loongarch32 | loongarch64 \ + | m32c | m32r | m32rle \ + | m5200 | m68000 | m680[012346]0 | m68360 | m683?2 | m68k \ + | m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x \ + | m88110 | m88k | maxq | mb | mcore | mep | metag \ + | microblaze | microblazeel \ + | mips | mipsbe | mipseb | mipsel | mipsle \ + | mips16 \ + | mips64 | mips64eb | mips64el \ + | mips64octeon | mips64octeonel \ + | mips64orion | mips64orionel \ + | mips64r5900 | mips64r5900el \ + | mips64vr | mips64vrel \ + | mips64vr4100 | mips64vr4100el \ + | mips64vr4300 | mips64vr4300el \ + | mips64vr5000 | mips64vr5000el \ + | mips64vr5900 | mips64vr5900el \ + | mipsisa32 | mipsisa32el \ + | mipsisa32r2 | mipsisa32r2el \ + | mipsisa32r3 | mipsisa32r3el \ + | mipsisa32r5 | mipsisa32r5el \ + | mipsisa32r6 | mipsisa32r6el \ + | mipsisa64 | mipsisa64el \ + | mipsisa64r2 | mipsisa64r2el \ + | mipsisa64r3 | mipsisa64r3el \ + | mipsisa64r5 | mipsisa64r5el \ + | mipsisa64r6 | mipsisa64r6el \ + | mipsisa64sb1 | mipsisa64sb1el \ + | mipsisa64sr71k | mipsisa64sr71kel \ + | mipsr5900 | mipsr5900el \ + | mipstx39 | mipstx39el \ + | mmix \ + | mn10200 | mn10300 \ + | moxie \ + | mt \ + | msp430 \ + | nds32 | nds32le | nds32be \ + | nfp \ + | nios | nios2 | nios2eb | nios2el \ + | none | np1 | ns16k | ns32k | nvptx \ + | open8 \ + | or1k* \ + | or32 \ + | orion \ + | picochip \ + | pdp10 | pdp11 | pj | pjl | pn | power \ + | powerpc | powerpc64 | powerpc64le | powerpcle | powerpcspe \ + | pru \ + | pyramid \ + | riscv | riscv32 | riscv32be | riscv64 | riscv64be \ + | rl78 | romp | rs6000 | rx \ + | s390 | s390x \ + | score \ + | sh | shl \ + | sh[1234] | sh[24]a | sh[24]ae[lb] | sh[23]e | she[lb] | sh[lb]e \ + | sh[1234]e[lb] | sh[12345][lb]e | sh[23]ele | sh64 | sh64le \ + | sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet \ + | sparclite \ + | sparcv8 | sparcv9 | sparcv9b | sparcv9v | sv1 | sx* \ + | spu \ + | tahoe \ + | thumbv7* \ + | tic30 | tic4x | tic54x | tic55x | tic6x | tic80 \ + | tron \ + | ubicom32 \ + | v70 | v850 | v850e | v850e1 | v850es | v850e2 | v850e2v3 \ + | vax \ + | visium \ + | w65 \ + | wasm32 | wasm64 \ + | we32k \ + | x86 | x86_64 | xc16x | xgate | xps100 \ + | xstormy16 | xtensa* \ + | ymp \ + | z8k | z80) + ;; + + *) + echo Invalid configuration \`"$1"\': machine \`"$cpu-$vendor"\' not recognized 1>&2 + exit 1 + ;; + esac ;; esac # Here we canonicalize certain aliases for manufacturers. -case $basic_machine in - *-digital*) - basic_machine=`echo $basic_machine | sed 's/digital.*/dec/'` +case $vendor in + digital*) + vendor=dec ;; - *-commodore*) - basic_machine=`echo $basic_machine | sed 's/commodore.*/cbm/'` + commodore*) + vendor=cbm ;; *) ;; @@ -1345,201 +1306,219 @@ esac # Decode manufacturer-specific aliases for certain operating systems. -if [ x"$os" != x"" ] +if test x$basic_os != x then + +# First recognize some ad-hoc cases, or perhaps split kernel-os, or else just +# set os. +case $basic_os in + gnu/linux*) + kernel=linux + os=`echo "$basic_os" | sed -e 's|gnu/linux|gnu|'` + ;; + os2-emx) + kernel=os2 + os=`echo "$basic_os" | sed -e 's|os2-emx|emx|'` + ;; + nto-qnx*) + kernel=nto + os=`echo "$basic_os" | sed -e 's|nto-qnx|qnx|'` + ;; + *-*) + # shellcheck disable=SC2162 + saved_IFS=$IFS + IFS="-" read kernel os <&2 - exit 1 + # No normalization, but not necessarily accepted, that comes below. ;; esac + else # Here we handle the default operating systems that come with various machines. @@ -1552,261 +1531,376 @@ else # will signal an error saying that MANUFACTURER isn't an operating # system, and we'll never get to this point. -case $basic_machine in +kernel= +case $cpu-$vendor in score-*) - os=-elf + os=elf ;; spu-*) - os=-elf + os=elf ;; *-acorn) - os=-riscix1.2 + os=riscix1.2 ;; arm*-rebel) - os=-linux + kernel=linux + os=gnu ;; arm*-semi) - os=-aout + os=aout ;; c4x-* | tic4x-*) - os=-coff + os=coff ;; c8051-*) - os=-elf + os=elf + ;; + clipper-intergraph) + os=clix ;; hexagon-*) - os=-elf + os=elf ;; tic54x-*) - os=-coff + os=coff ;; tic55x-*) - os=-coff + os=coff ;; tic6x-*) - os=-coff + os=coff ;; # This must come before the *-dec entry. pdp10-*) - os=-tops20 + os=tops20 ;; pdp11-*) - os=-none + os=none ;; *-dec | vax-*) - os=-ultrix4.2 + os=ultrix4.2 ;; m68*-apollo) - os=-domain + os=domain ;; i386-sun) - os=-sunos4.0.2 + os=sunos4.0.2 ;; m68000-sun) - os=-sunos3 + os=sunos3 ;; m68*-cisco) - os=-aout + os=aout ;; mep-*) - os=-elf + os=elf ;; mips*-cisco) - os=-elf + os=elf ;; mips*-*) - os=-elf + os=elf ;; or32-*) - os=-coff + os=coff ;; *-tti) # must be before sparc entry or we get the wrong os. - os=-sysv3 + os=sysv3 ;; sparc-* | *-sun) - os=-sunos4.1.1 + os=sunos4.1.1 ;; - *-be) - os=-beos + pru-*) + os=elf ;; - *-haiku) - os=-haiku + *-be) + os=beos ;; *-ibm) - os=-aix + os=aix ;; *-knuth) - os=-mmixware + os=mmixware ;; *-wec) - os=-proelf + os=proelf ;; *-winbond) - os=-proelf + os=proelf ;; *-oki) - os=-proelf + os=proelf ;; *-hp) - os=-hpux + os=hpux ;; *-hitachi) - os=-hiux + os=hiux ;; i860-* | *-att | *-ncr | *-altos | *-motorola | *-convergent) - os=-sysv + os=sysv ;; *-cbm) - os=-amigaos + os=amigaos ;; *-dg) - os=-dgux + os=dgux ;; *-dolphin) - os=-sysv3 + os=sysv3 ;; m68k-ccur) - os=-rtu + os=rtu ;; m88k-omron*) - os=-luna + os=luna ;; - *-next ) - os=-nextstep + *-next) + os=nextstep ;; *-sequent) - os=-ptx + os=ptx ;; *-crds) - os=-unos + os=unos ;; *-ns) - os=-genix + os=genix ;; i370-*) - os=-mvs - ;; - *-next) - os=-nextstep3 + os=mvs ;; *-gould) - os=-sysv + os=sysv ;; *-highlevel) - os=-bsd + os=bsd ;; *-encore) - os=-bsd + os=bsd ;; *-sgi) - os=-irix + os=irix ;; *-siemens) - os=-sysv4 + os=sysv4 ;; *-masscomp) - os=-rtu + os=rtu ;; f30[01]-fujitsu | f700-fujitsu) - os=-uxpv + os=uxpv ;; *-rom68k) - os=-coff + os=coff ;; *-*bug) - os=-coff + os=coff ;; *-apple) - os=-macos + os=macos ;; *-atari*) - os=-mint + os=mint + ;; + *-wrs) + os=vxworks ;; *) - os=-none + os=none ;; esac + fi +# Now, validate our (potentially fixed-up) OS. +case $os in + # Sometimes we do "kernel-libc", so those need to count as OSes. + musl* | newlib* | relibc* | uclibc*) + ;; + # Likewise for "kernel-abi" + eabi* | gnueabi*) + ;; + # VxWorks passes extra cpu info in the 4th filed. + simlinux | simwindows | spe) + ;; + # Now accept the basic system types. + # The portable systems comes first. + # Each alternative MUST end in a * to match a version number. + gnu* | android* | bsd* | mach* | minix* | genix* | ultrix* | irix* \ + | *vms* | esix* | aix* | cnk* | sunos | sunos[34]* \ + | hpux* | unos* | osf* | luna* | dgux* | auroraux* | solaris* \ + | sym* | plan9* | psp* | sim* | xray* | os68k* | v88r* \ + | hiux* | abug | nacl* | netware* | windows* \ + | os9* | macos* | osx* | ios* \ + | mpw* | magic* | mmixware* | mon960* | lnews* \ + | amigaos* | amigados* | msdos* | newsos* | unicos* | aof* \ + | aos* | aros* | cloudabi* | sortix* | twizzler* \ + | nindy* | vxsim* | vxworks* | ebmon* | hms* | mvs* \ + | clix* | riscos* | uniplus* | iris* | isc* | rtu* | xenix* \ + | mirbsd* | netbsd* | dicos* | openedition* | ose* \ + | bitrig* | openbsd* | secbsd* | solidbsd* | libertybsd* | os108* \ + | ekkobsd* | freebsd* | riscix* | lynxos* | os400* \ + | bosx* | nextstep* | cxux* | aout* | elf* | oabi* \ + | ptx* | coff* | ecoff* | winnt* | domain* | vsta* \ + | udi* | lites* | ieee* | go32* | aux* | hcos* \ + | chorusrdb* | cegcc* | glidix* | serenity* \ + | cygwin* | msys* | pe* | moss* | proelf* | rtems* \ + | midipix* | mingw32* | mingw64* | mint* \ + | uxpv* | beos* | mpeix* | udk* | moxiebox* \ + | interix* | uwin* | mks* | rhapsody* | darwin* \ + | openstep* | oskit* | conix* | pw32* | nonstopux* \ + | storm-chaos* | tops10* | tenex* | tops20* | its* \ + | os2* | vos* | palmos* | uclinux* | nucleus* | morphos* \ + | scout* | superux* | sysv* | rtmk* | tpf* | windiss* \ + | powermax* | dnix* | nx6 | nx7 | sei* | dragonfly* \ + | skyos* | haiku* | rdos* | toppers* | drops* | es* \ + | onefs* | tirtos* | phoenix* | fuchsia* | redox* | bme* \ + | midnightbsd* | amdhsa* | unleashed* | emscripten* | wasi* \ + | nsk* | powerunix* | genode* | zvmoe* | qnx* | emx* | zephyr* \ + | fiwix* | mlibc* ) + ;; + # This one is extra strict with allowed versions + sco3.2v2 | sco3.2v[4-9]* | sco5v6*) + # Don't forget version if it is 3.2v4 or newer. + ;; + none) + ;; + kernel* ) + # Restricted further below + ;; + *) + echo Invalid configuration \`"$1"\': OS \`"$os"\' not recognized 1>&2 + exit 1 + ;; +esac + +# As a final step for OS-related things, validate the OS-kernel combination +# (given a valid OS), if there is a kernel. +case $kernel-$os in + linux-gnu* | linux-dietlibc* | linux-android* | linux-newlib* \ + | linux-musl* | linux-relibc* | linux-uclibc* | linux-mlibc* ) + ;; + uclinux-uclibc* ) + ;; + managarm-mlibc* | managarm-kernel* ) + ;; + -dietlibc* | -newlib* | -musl* | -relibc* | -uclibc* | -mlibc* ) + # These are just libc implementations, not actual OSes, and thus + # require a kernel. + echo "Invalid configuration \`$1': libc \`$os' needs explicit kernel." 1>&2 + exit 1 + ;; + -kernel* ) + echo "Invalid configuration \`$1': \`$os' needs explicit kernel." 1>&2 + exit 1 + ;; + *-kernel* ) + echo "Invalid configuration \`$1': \`$kernel' does not support \`$os'." 1>&2 + exit 1 + ;; + kfreebsd*-gnu* | kopensolaris*-gnu*) + ;; + vxworks-simlinux | vxworks-simwindows | vxworks-spe) + ;; + nto-qnx*) + ;; + os2-emx) + ;; + *-eabi* | *-gnueabi*) + ;; + -*) + # Blank kernel with real OS is always fine. + ;; + *-*) + echo "Invalid configuration \`$1': Kernel \`$kernel' not known to work with OS \`$os'." 1>&2 + exit 1 + ;; +esac + # Here we handle the case where we know the os, and the CPU type, but not the # manufacturer. We pick the logical manufacturer. -vendor=unknown -case $basic_machine in - *-unknown) - case $os in - -riscix*) +case $vendor in + unknown) + case $cpu-$os in + *-riscix*) vendor=acorn ;; - -sunos*) + *-sunos*) vendor=sun ;; - -cnk*|-aix*) + *-cnk* | *-aix*) vendor=ibm ;; - -beos*) + *-beos*) vendor=be ;; - -hpux*) + *-hpux*) vendor=hp ;; - -mpeix*) + *-mpeix*) vendor=hp ;; - -hiux*) + *-hiux*) vendor=hitachi ;; - -unos*) + *-unos*) vendor=crds ;; - -dgux*) + *-dgux*) vendor=dg ;; - -luna*) + *-luna*) vendor=omron ;; - -genix*) + *-genix*) vendor=ns ;; - -mvs* | -opened*) + *-clix*) + vendor=intergraph + ;; + *-mvs* | *-opened*) + vendor=ibm + ;; + *-os400*) vendor=ibm ;; - -os400*) + s390-* | s390x-*) vendor=ibm ;; - -ptx*) + *-ptx*) vendor=sequent ;; - -tpf*) + *-tpf*) vendor=ibm ;; - -vxsim* | -vxworks* | -windiss*) + *-vxsim* | *-vxworks* | *-windiss*) vendor=wrs ;; - -aux*) + *-aux*) vendor=apple ;; - -hms*) + *-hms*) vendor=hitachi ;; - -mpw* | -macos*) + *-mpw* | *-macos*) vendor=apple ;; - -*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*) + *-*mint | *-mint[0-9]* | *-*MiNT | *-MiNT[0-9]*) vendor=atari ;; - -vos*) + *-vos*) vendor=stratus ;; esac - basic_machine=`echo $basic_machine | sed "s/unknown/$vendor/"` ;; esac -echo $basic_machine$os +echo "$cpu-$vendor-${kernel:+$kernel-}$os" exit # Local variables: -# eval: (add-hook 'write-file-hooks 'time-stamp) +# eval: (add-hook 'before-save-hook 'time-stamp) # time-stamp-start: "timestamp='" # time-stamp-format: "%:y-%02m-%02d" # time-stamp-end: "'" From b21936e58f9dbdd149ad38918cacfeec5885576b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 8 Nov 2022 10:38:28 +0100 Subject: [PATCH 0109/1283] Regen tlsexttest.c patch --- patches/tlsexttest.c.patch | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/patches/tlsexttest.c.patch b/patches/tlsexttest.c.patch index bc81da5198..c1591d7aea 100644 --- a/patches/tlsexttest.c.patch +++ b/patches/tlsexttest.c.patch @@ -1,9 +1,9 @@ ---- tests/tlsexttest.c.orig Mon Sep 5 22:30:36 2022 -+++ tests/tlsexttest.c Mon Sep 5 22:32:52 2022 -@@ -1773,7 +1773,9 @@ static unsigned char tlsext_sni_client[] = { +--- tests/tlsexttest.c.orig Tue Nov 8 10:32:18 2022 ++++ tests/tlsexttest.c Tue Nov 8 10:35:52 2022 +@@ -1773,7 +1773,9 @@ static const unsigned char tlsext_sni_client[] = { }; - static unsigned char tlsext_sni_server[] = { + static const unsigned char tlsext_sni_server[] = { + 0x00 }; +const size_t sizeof_tlsext_sni_server = 0; @@ -39,7 +39,7 @@ if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) { FAIL("failed to parse server SNI\n"); goto err; -@@ -3196,7 +3198,10 @@ unsigned char tlsext_clienthello_default[] = { +@@ -3194,7 +3196,10 @@ unsigned char tlsext_clienthello_default[] = { 0x04, 0x03, 0x02, 0x01, 0x02, 0x03, }; @@ -51,7 +51,7 @@ static int test_tlsext_clienthello_build(void) -@@ -3282,18 +3287,18 @@ test_tlsext_clienthello_build(void) +@@ -3280,18 +3285,18 @@ test_tlsext_clienthello_build(void) goto err; } From 72510bc2d6fcc1e449743cd87b9a3a86c71ec333 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 8 Nov 2022 10:56:10 +0100 Subject: [PATCH 0110/1283] Add tls12_internal.h --- ssl/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/ssl/Makefile.am b/ssl/Makefile.am index d5c04665a6..f1bd897bcc 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -99,6 +99,7 @@ noinst_HEADERS += ssl_sigalgs.h noinst_HEADERS += ssl_tlsext.h noinst_HEADERS += tls_content.h noinst_HEADERS += tls_internal.h +noinst_HEADERS += tls12_internal.h noinst_HEADERS += tls13_internal.h noinst_HEADERS += tls13_handshake.h noinst_HEADERS += tls13_record.h From cbf8eefa023761dc5593eb7588caa1335489bf4d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 8 Nov 2022 11:17:48 +0100 Subject: [PATCH 0111/1283] Rename bftest to bf_test --- tests/CMakeLists.txt | 6 +++--- tests/Makefile.am | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 9b10b338c6..3df9256b83 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -93,9 +93,9 @@ target_link_libraries(base64test ${OPENSSL_TEST_LIBS}) add_test(base64test base64test) # bftest -add_executable(bftest bftest.c) -target_link_libraries(bftest ${OPENSSL_TEST_LIBS}) -add_test(bftest bftest) +add_executable(bf_test bf_test.c) +target_link_libraries(bf_test ${OPENSSL_TEST_LIBS}) +add_test(bf_test bf_test) # biotest # the BIO tests rely on resolver results that are OS and environment-specific diff --git a/tests/Makefile.am b/tests/Makefile.am index 24e6f2ee8f..80457d184f 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -110,9 +110,9 @@ check_PROGRAMS += base64test base64test_SOURCES = base64test.c # bftest -TESTS += bftest -check_PROGRAMS += bftest -bftest_SOURCES = bftest.c +TESTS += bf_test +check_PROGRAMS += bf_test +bftest_SOURCES = bf_test.c # biotest # the BIO tests rely on resolver results that are OS and environment-specific From 0107fed58c7ee935574dad918380722d8f1c9c7e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 8 Nov 2022 12:01:34 +0100 Subject: [PATCH 0112/1283] Disable dltstest for now It is not ideal since it reduces test coverage significantly, but we cannot spend time on restarting some of the CI pipelines all the time. --- tests/CMakeLists.txt | 15 ++++++++------- tests/Makefile.am | 15 ++++++++------- 2 files changed, 16 insertions(+), 14 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 3df9256b83..8b4c11ed47 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -217,13 +217,14 @@ add_executable(dsatest dsatest.c) target_link_libraries(dsatest ${OPENSSL_TEST_LIBS}) add_test(dsatest dsatest) -# dtlstest -if(NOT WIN32) - add_executable(dtlstest dtlstest.c) - target_link_libraries(dtlstest ${OPENSSL_TEST_LIBS}) - add_test(NAME dtlstest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/dtlstest.sh) - set_tests_properties(dtlstest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") -endif() +# XXX This test is too flaky for CI. Disable it until it is fixed. +# # dtlstest +# if(NOT WIN32) +# add_executable(dtlstest dtlstest.c) +# target_link_libraries(dtlstest ${OPENSSL_TEST_LIBS}) +# add_test(NAME dtlstest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/dtlstest.sh) +# set_tests_properties(dtlstest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") +# endif() # ec_asn1_test add_executable(ec_asn1_test ec_asn1_test.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index 80457d184f..09d4cad33c 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -234,13 +234,14 @@ TESTS += dsatest check_PROGRAMS += dsatest dsatest_SOURCES = dsatest.c -# dtlstest -if !HOST_WIN -TESTS += dtlstest.sh -check_PROGRAMS += dtlstest -dtlstest_SOURCES = dtlstest.c -endif -EXTRA_DIST += dtlstest.sh +# XXX this test is too flaky for CI. Disable it until it is fixed. +## dtlstest +#if !HOST_WIN +#TESTS += dtlstest.sh +#check_PROGRAMS += dtlstest +#dtlstest_SOURCES = dtlstest.c +#endif +#EXTRA_DIST += dtlstest.sh # ec_asn1_test TESTS += ec_asn1_test From 03fe6d2904a948614e3c25a00e52595268ef1ab7 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Tue, 8 Nov 2022 18:00:23 +1100 Subject: [PATCH 0113/1283] Update checkout action to current version. checkout v2 uses node.js v12 which is has been recently deprecated by github so switch to using the one on the main branch. --- .github/workflows/android_test.yml | 4 ++-- .github/workflows/coverity.yml | 2 +- .github/workflows/cross_test.yml | 2 +- .github/workflows/linux_test.yml | 2 +- .github/workflows/linux_test_asan.yml | 2 +- .github/workflows/macos_test.yml | 2 +- .github/workflows/regress.yml | 2 +- 7 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/android_test.yml b/.github/workflows/android_test.yml index 6ce002ba98..4ecbfacc13 100644 --- a/.github/workflows/android_test.yml +++ b/.github/workflows/android_test.yml @@ -12,7 +12,7 @@ jobs: MAX_NAL: 28 name: Android 8.x 9 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@main - name: Run CI script run: ./scripts/test @@ -25,6 +25,6 @@ jobs: MAX_NAL: 30 name: Android 10 11 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@main - name: Run CI script run: ./scripts/test diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 40e7a07673..444cc0bb32 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -15,7 +15,7 @@ jobs: COVERITY_SCAN_BUILD_COMMAND_PREPEND: "./autogen.sh && ./configure && make dist && tar zxf libressl-*.tar.gz && rm libressl-*.tar.gz && cd libressl-* && mkdir build-static && mkdir build-shared && cmake -GNinja -DBUILD_SHARED_LIBS=ON .." COVERITY_SCAN_BUILD_COMMAND: "ninja" steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@main - name: Install apt dependencies run: | sudo apt-get update diff --git a/.github/workflows/cross_test.yml b/.github/workflows/cross_test.yml index c5b6b25ebf..af093096b4 100644 --- a/.github/workflows/cross_test.yml +++ b/.github/workflows/cross_test.yml @@ -15,6 +15,6 @@ jobs: ARCH: ${{ matrix.arch }} name: ${{ matrix.arch }} - ${{ matrix.os }} steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@main - name: Run CI script run: ./scripts/test diff --git a/.github/workflows/linux_test.yml b/.github/workflows/linux_test.yml index 028c1a4041..105f891d4f 100644 --- a/.github/workflows/linux_test.yml +++ b/.github/workflows/linux_test.yml @@ -15,6 +15,6 @@ jobs: ARCH: native name: ${{ matrix.compiler }} - ${{ matrix.os }} steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@main - name: Run CI script run: ./scripts/test diff --git a/.github/workflows/linux_test_asan.yml b/.github/workflows/linux_test_asan.yml index d6fc1e88d1..12e0889081 100644 --- a/.github/workflows/linux_test_asan.yml +++ b/.github/workflows/linux_test_asan.yml @@ -18,6 +18,6 @@ jobs: CTEST_OUTPUT_ON_FAILURE: 1 name: ${{ matrix.compiler }} - ${{ matrix.os }} steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@main - name: Run CI script run: ./scripts/test diff --git a/.github/workflows/macos_test.yml b/.github/workflows/macos_test.yml index 6e7adac6de..83a1b3599d 100644 --- a/.github/workflows/macos_test.yml +++ b/.github/workflows/macos_test.yml @@ -17,6 +17,6 @@ jobs: steps: - name: Install packages for macos run: brew install automake - - uses: actions/checkout@v2 + - uses: actions/checkout@main - name: Run CI script run: ./scripts/test diff --git a/.github/workflows/regress.yml b/.github/workflows/regress.yml index 88ce310e0c..7cc35dc8dc 100644 --- a/.github/workflows/regress.yml +++ b/.github/workflows/regress.yml @@ -8,7 +8,7 @@ jobs: rust-openssl: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@main - name: Install apt dependencies run: | sudo apt-get update From faa32aeada89e926b7bc10a28121f3eac1635d39 Mon Sep 17 00:00:00 2001 From: David Korczynski Date: Sat, 19 Nov 2022 04:31:40 -0800 Subject: [PATCH 0114/1283] CI: add CIFuzz action Signed-off-by: David Korczynski --- .github/workflows/cifuzz.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .github/workflows/cifuzz.yml diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml new file mode 100644 index 0000000000..8c25624cd2 --- /dev/null +++ b/.github/workflows/cifuzz.yml @@ -0,0 +1,26 @@ +name: CIFuzz +on: [pull_request] +jobs: + Fuzzing: + runs-on: ubuntu-latest + steps: + - name: Build Fuzzers + id: build + uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master + with: + oss-fuzz-project-name: 'libressl' + dry-run: false + language: c++ + - name: Run Fuzzers + uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master + with: + oss-fuzz-project-name: 'libressl' + fuzz-seconds: 300 + dry-run: false + language: c++ + - name: Upload Crash + uses: actions/upload-artifact@v3 + if: failure() && steps.build.outcome == 'success' + with: + name: artifacts + path: ./out/artifacts From 3d6cab79dd032746bb90a1307dae4c99a8697240 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 22 Nov 2022 17:39:44 +0100 Subject: [PATCH 0115/1283] Rename bftest_SOURCES to bf_test_SOURCES --- tests/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/Makefile.am b/tests/Makefile.am index 09d4cad33c..a595c93e3f 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -112,7 +112,7 @@ base64test_SOURCES = base64test.c # bftest TESTS += bf_test check_PROGRAMS += bf_test -bftest_SOURCES = bf_test.c +bf_test_SOURCES = bf_test.c # biotest # the BIO tests rely on resolver results that are OS and environment-specific From 7b66b2d9e652617855908ee5f82f292ae37dbd91 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 22 Nov 2022 18:34:39 +0100 Subject: [PATCH 0116/1283] update speed.c.patch --- patches/speed.c.patch | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/patches/speed.c.patch b/patches/speed.c.patch index 11f9f03a36..4e80f316a9 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -1,6 +1,6 @@ ---- apps/openssl/speed.c.orig Sun Feb 6 20:37:16 2022 -+++ apps/openssl/speed.c Sun Feb 6 21:07:42 2022 -@@ -159,7 +159,16 @@ +--- apps/openssl/speed.c.orig Tue Nov 22 17:32:11 2022 ++++ apps/openssl/speed.c Tue Nov 22 18:33:13 2022 +@@ -159,7 +159,16 @@ static void pkey_print_message(const char *str, const char *str2, long num, int bits, int sec); static void print_result(int alg, int run_no, int count, double time_used); @@ -17,7 +17,7 @@ #define ALGOR_NUM 32 #define SIZE_NUM 5 -@@ -466,8 +475,10 @@ +@@ -466,8 +475,10 @@ speed_main(int argc, char **argv) const EVP_CIPHER *evp_cipher = NULL; const EVP_MD *evp_md = NULL; int decrypt = 0; @@ -26,9 +26,9 @@ const char *errstr = NULL; +#endif - if (single_execution) { - if (pledge("stdio proc", NULL) == -1) { -@@ -544,6 +555,7 @@ + if (pledge("stdio proc", NULL) == -1) { + perror("pledge"); +@@ -542,6 +553,7 @@ speed_main(int argc, char **argv) j--; /* Otherwise, -decrypt gets confused with an * algorithm. */ } @@ -36,7 +36,7 @@ else if ((argc > 0) && (strcmp(*argv, "-multi") == 0)) { argc--; argv++; -@@ -559,6 +571,7 @@ +@@ -557,6 +569,7 @@ speed_main(int argc, char **argv) j--; /* Otherwise, -multi gets confused with an * algorithm. */ } @@ -44,7 +44,7 @@ else if (argc > 0 && !strcmp(*argv, "-mr")) { mr = 1; j--; /* Otherwise, -mr gets confused with an -@@ -921,7 +934,9 @@ +@@ -919,7 +932,9 @@ speed_main(int argc, char **argv) BIO_printf(bio_err, "-evp e use EVP e.\n"); BIO_printf(bio_err, "-decrypt time decryption instead of encryption (only EVP).\n"); BIO_printf(bio_err, "-mr produce machine readable output.\n"); @@ -54,7 +54,7 @@ goto end; } argc--; -@@ -929,8 +944,10 @@ +@@ -927,8 +942,10 @@ speed_main(int argc, char **argv) j++; } @@ -65,7 +65,7 @@ if (j == 0) { for (i = 0; i < ALGOR_NUM; i++) { -@@ -1807,7 +1824,9 @@ +@@ -1805,7 +1822,9 @@ speed_main(int argc, char **argv) ecdh_doit[j] = 0; } } @@ -75,7 +75,7 @@ if (!mr) { fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION)); fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON)); -@@ -1980,11 +1999,15 @@ +@@ -1978,11 +1997,15 @@ pkey_print_message(const char *str, const char *str2, static void print_result(int alg, int run_no, int count, double time_used) { @@ -91,7 +91,7 @@ static char * sstrsep(char **string, const char *delim) { -@@ -2191,4 +2214,5 @@ +@@ -2189,4 +2212,5 @@ do_multi(int multi) free(fds); return 1; } From 8ae1cce7ef3941125344dcb2f459c989f87de182 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 22 Nov 2022 18:41:54 +0100 Subject: [PATCH 0117/1283] Update autoconf framework to build again --- Makefile.am.common | 3 ++- crypto/Makefile.am | 18 +++++++++++++++--- ssl/Makefile.am | 3 +++ update.sh | 4 +++- 4 files changed, 23 insertions(+), 5 deletions(-) diff --git a/Makefile.am.common b/Makefile.am.common index 87aa807031..2c641c54d6 100644 --- a/Makefile.am.common +++ b/Makefile.am.common @@ -1,3 +1,4 @@ AM_CFLAGS = -AM_CPPFLAGS = -I$(top_srcdir)/include -I$(top_srcdir)/include/compat -DLIBRESSL_INTERNAL +AM_CPPFLAGS = -I$(top_srcdir)/crypto/hidden -I$(top_srcdir)/ssl/hidden +AM_CPPFLAGS += -I$(top_srcdir)/include -I$(top_srcdir)/include/compat -DLIBRESSL_INTERNAL AM_CPPFLAGS += -D__BEGIN_HIDDEN_DECLS= -D__END_HIDDEN_DECLS= diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 01833d2edf..48067a2548 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -6,6 +6,7 @@ AM_CPPFLAGS += -I$(top_srcdir)/crypto/asn1 AM_CPPFLAGS += -I$(top_srcdir)/crypto/bio AM_CPPFLAGS += -I$(top_srcdir)/crypto/bn AM_CPPFLAGS += -I$(top_srcdir)/crypto/bytestring +AM_CPPFLAGS += -I$(top_srcdir)/crypto/curve25519 AM_CPPFLAGS += -I$(top_srcdir)/crypto/dh AM_CPPFLAGS += -I$(top_srcdir)/crypto/dsa AM_CPPFLAGS += -I$(top_srcdir)/crypto/ec @@ -285,12 +286,10 @@ libcrypto_la_SOURCES += mem_dbg.c libcrypto_la_SOURCES += o_fips.c libcrypto_la_SOURCES += o_init.c libcrypto_la_SOURCES += o_str.c -libcrypto_la_SOURCES += o_time.c noinst_HEADERS += arm_arch.h noinst_HEADERS += constant_time_locl.h noinst_HEADERS += cryptlib.h noinst_HEADERS += md32_common.h -noinst_HEADERS += o_time.h noinst_HEADERS += x86_arch.h # aes @@ -317,6 +316,7 @@ libcrypto_la_SOURCES += asn1/a_strex.c libcrypto_la_SOURCES += asn1/a_string.c libcrypto_la_SOURCES += asn1/a_strnid.c libcrypto_la_SOURCES += asn1/a_time.c +libcrypto_la_SOURCES += asn1/a_time_posix.c libcrypto_la_SOURCES += asn1/a_time_tm.c libcrypto_la_SOURCES += asn1/a_type.c libcrypto_la_SOURCES += asn1/a_utf8.c @@ -376,7 +376,6 @@ libcrypto_la_SOURCES += bf/bf_enc.c libcrypto_la_SOURCES += bf/bf_ofb64.c libcrypto_la_SOURCES += bf/bf_skey.c noinst_HEADERS += bf/bf_locl.h -noinst_HEADERS += bf/bf_pi.h # bio libcrypto_la_SOURCES += bio/b_dump.c @@ -436,6 +435,7 @@ libcrypto_la_SOURCES += bn/bn_print.c libcrypto_la_SOURCES += bn/bn_rand.c libcrypto_la_SOURCES += bn/bn_recp.c libcrypto_la_SOURCES += bn/bn_shift.c +libcrypto_la_SOURCES += bn/bn_small_primes.c libcrypto_la_SOURCES += bn/bn_sqr.c libcrypto_la_SOURCES += bn/bn_sqrt.c libcrypto_la_SOURCES += bn/bn_word.c @@ -619,6 +619,7 @@ libcrypto_la_SOURCES += ec/ecp_mont.c libcrypto_la_SOURCES += ec/ecp_nist.c libcrypto_la_SOURCES += ec/ecp_oct.c libcrypto_la_SOURCES += ec/ecp_smpl.c +libcrypto_la_SOURCES += ec/ecx_methods.c noinst_HEADERS += ec/ec_lcl.h # ecdh @@ -746,6 +747,17 @@ libcrypto_la_SOURCES += gost/streebog.c noinst_HEADERS += gost/gost_asn1.h noinst_HEADERS += gost/gost_locl.h +# hidden +noinst_HEADERS += hidden/crypto_namespace.h +noinst_HEADERS += hidden/openssl/hmac.h +noinst_HEADERS += hidden/openssl/pkcs12.h +noinst_HEADERS += hidden/openssl/pkcs7.h +noinst_HEADERS += hidden/openssl/stack.h +noinst_HEADERS += hidden/openssl/ui.h +noinst_HEADERS += hidden/openssl/x509.h +noinst_HEADERS += hidden/openssl/x509_vfy.h +noinst_HEADERS += hidden/openssl/x509v3.h + # hkdf libcrypto_la_SOURCES += hkdf/hkdf.c diff --git a/ssl/Makefile.am b/ssl/Makefile.am index f1bd897bcc..8750f77586 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -39,6 +39,9 @@ libbs_la_SOURCES += bs_cbb.c libbs_la_SOURCES += bs_cbs.c noinst_HEADERS = bytestring.h +noinst_HEADERS += hidden/ssl_namespace.h +noinst_HEADERS += hidden/openssl/ssl.h + libssl_la_SOURCES = bio_ssl.c libssl_la_SOURCES += d1_both.c libssl_la_SOURCES += d1_lib.c diff --git a/update.sh b/update.sh index 3aea129407..e7d9e6b204 100755 --- a/update.sh +++ b/update.sh @@ -277,7 +277,9 @@ done echo "copying libssl source" rm -f ssl/*.c ssl/*.h for i in `awk '/SOURCES|HEADERS/ { print $3 }' ssl/Makefile.am` ; do - $CP $libssl_src/$i ssl + dir=`dirname $i` + mkdir -p ssl/$dir + $CP $libssl_src/$i ssl/$i done # add the libssl symbol export list $GREP '^[A-Za-z0-9_]' < $libssl_src/Symbols.list > ssl/ssl.sym From 33adc424c1a150c7ebaf51e37cfa6b6fb97483fd Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 22 Nov 2022 19:02:29 +0100 Subject: [PATCH 0118/1283] Add new tests to autoconf framework --- tests/Makefile.am | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/tests/Makefile.am b/tests/Makefile.am index a595c93e3f..d9ca0d750c 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -5,6 +5,7 @@ AM_CPPFLAGS += -DLIBRESSL_CRYPTO_INTERNAL AM_CPPFLAGS += -I $(top_srcdir)/crypto/asn1 AM_CPPFLAGS += -I $(top_srcdir)/crypto/bio AM_CPPFLAGS += -I $(top_srcdir)/crypto/bn +AM_CPPFLAGS += -I $(top_srcdir)/crypto/curve25519 AM_CPPFLAGS += -I $(top_srcdir)/crypto/evp AM_CPPFLAGS += -I $(top_srcdir)/crypto/modes AM_CPPFLAGS += -I $(top_srcdir)/crypto/x509 @@ -40,6 +41,11 @@ EXTRA_DIST += aes_256_gcm_tests.txt EXTRA_DIST += chacha20_poly1305_tests.txt EXTRA_DIST += xchacha20_poly1305_tests.txt +# aes +TESTS += aes_test +check_PROGRAMS += aes_test +aes_test_SOURCES = aes_test.c + # aes_wrap TESTS += aes_wrap check_PROGRAMS += aes_wrap @@ -163,6 +169,11 @@ TESTS += bn_to_string check_PROGRAMS += bn_to_string bn_to_string_SOURCES = bn_to_string.c +# bn_unit +TESTS += bn_unit +check_PROGRAMS += bn_unit +bn_unit_SOURCES = bn_unit.c + # buffertest TESTS += buffertest check_PROGRAMS += buffertest @@ -268,11 +279,21 @@ TESTS += ectest check_PROGRAMS += ectest ectest_SOURCES = ectest.c +# ed25519test +TESTS += ed25519test +check_PROGRAMS += ed25519test +ed25519test_SOURCES = ed25519test.c + # enginetest TESTS += enginetest check_PROGRAMS += enginetest enginetest_SOURCES = enginetest.c +# evp_ecx_test +TESTS += evp_ecx_test +check_PROGRAMS += evp_ecx_test +evp_ecx_test_SOURCES = evp_ecx_test.c + # evp_pkey_check TESTS += evp_pkey_check check_PROGRAMS += evp_pkey_check From 35265d0e446cc48af768ba476378dd67ec46f826 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 22 Nov 2022 19:20:28 +0100 Subject: [PATCH 0119/1283] Fix cmake builds --- crypto/CMakeLists.txt | 6 +++++- ssl/CMakeLists.txt | 4 +++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 2c0268c7cb..1ed5405451 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -236,7 +236,6 @@ set( o_fips.c o_init.c o_str.c - o_time.c aes/aes_cfb.c aes/aes_ctr.c aes/aes_ecb.c @@ -257,6 +256,7 @@ set( asn1/a_string.c asn1/a_strnid.c asn1/a_time.c + asn1/a_time_posix.c asn1/a_time_tm.c asn1/a_type.c asn1/a_utf8.c @@ -356,6 +356,7 @@ set( bn/bn_rand.c bn/bn_recp.c bn/bn_shift.c + bn/bn_small_primes.c bn/bn_sqr.c bn/bn_sqrt.c bn/bn_word.c @@ -488,6 +489,7 @@ set( ec/ecp_nist.c ec/ecp_oct.c ec/ecp_smpl.c + ec/ecx_methods.c ecdh/ecdh_kdf.c ecdh/ech_err.c ecdh/ech_key.c @@ -992,10 +994,12 @@ target_include_directories(crypto_obj bytestring dh dsa + curve25519 ec ecdh ecdsa evp + hidden hmac modes ocsp diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 8e974a84cc..13072b1d58 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -64,8 +64,10 @@ set( add_library(ssl_obj OBJECT ${SSL_SRC}) target_include_directories(ssl_obj PRIVATE - . + ../crypto/hidden ../crypto/bio + ./hidden + . ../include/compat PUBLIC ../include) From 9b95f2e9c639a45c3a0dfb4f65eb6e4342a8e5fe Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 22 Nov 2022 19:26:38 +0100 Subject: [PATCH 0120/1283] Add new tests to cmake framework --- tests/CMakeLists.txt | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 8b4c11ed47..9df5d9380c 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -5,6 +5,7 @@ include_directories( ../crypto/asn1 ../crypto/bio ../crypto/bn + ../crypto/curve25519 ../crypto/evp ../crypto/modes ../crypto/x509 @@ -29,6 +30,11 @@ else() add_test(aeadtest aeadtest aead ${CMAKE_CURRENT_SOURCE_DIR}/aeadtests.txt) endif() +# aes_test +add_executable(aes_test aes_test.c) +target_link_libraries(aes_test ${OPENSSL_TEST_LIBS}) +add_test(aes_test aes_test) + # aes_wrap add_executable(aes_wrap aes_wrap.c) target_link_libraries(aes_wrap ${OPENSSL_TEST_LIBS}) @@ -147,6 +153,11 @@ add_executable(bn_to_string bn_to_string.c) target_link_libraries(bn_to_string ${OPENSSL_TEST_LIBS}) add_test(bn_to_string bn_to_string) +# bn_unit +add_executable(bn_unit bn_unit.c) +target_link_libraries(bn_unit ${OPENSSL_TEST_LIBS}) +add_test(bn_unit bn_unit) + # buffertest add_executable(buffertest buffertest.c) target_link_libraries(buffertest ${OPENSSL_TEST_LIBS}) @@ -251,11 +262,21 @@ add_executable(ectest ectest.c) target_link_libraries(ectest ${OPENSSL_TEST_LIBS}) add_test(ectest ectest) +# ed25519test +add_executable(ed25519test ed25519test.c) +target_link_libraries(ed25519test ${OPENSSL_TEST_LIBS}) +add_test(ed25519test ed25519test) + # enginetest add_executable(enginetest enginetest.c) target_link_libraries(enginetest ${OPENSSL_TEST_LIBS}) add_test(enginetest enginetest) +# evp_ecx_test +add_executable(evp_ecx_test evp_ecx_test.c) +target_link_libraries(evp_ecx_test ${OPENSSL_TEST_LIBS}) +add_test(evp_ecx_test evp_ecx_test) + # evp_pkey_check add_executable(evp_pkey_check evp_pkey_check.c) target_link_libraries(evp_pkey_check ${OPENSSL_TEST_LIBS}) From 4625f45d064aca9b105a3622db5534158f63f829 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 22 Nov 2022 19:38:27 +0100 Subject: [PATCH 0121/1283] Add asn1_string_to_utf8 test to cmake framework --- tests/CMakeLists.txt | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 9df5d9380c..537ed8fc1d 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -93,6 +93,11 @@ add_executable(asn1x509 asn1x509.c) target_link_libraries(asn1x509 ${OPENSSL_TEST_LIBS}) add_test(asn1x509 asn1x509) +# asn1_string_to_utf8 +add_executable(asn1_string_to_utf8 asn1_string_to_utf8.c) +target_link_libraries(asn1_string_to_utf8 ${OPENSSL_TEST_LIBS}) +add_test(asn1_string_to_utf8 asn1_string_to_utf8) + # base64test add_executable(base64test base64test.c) target_link_libraries(base64test ${OPENSSL_TEST_LIBS}) From f015aed7a0942003e14f52a902a15551712a3ac9 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 22 Nov 2022 21:10:11 +0100 Subject: [PATCH 0122/1283] regen bio.h patch --- patches/bio.h.patch | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/patches/bio.h.patch b/patches/bio.h.patch index 072bc3b052..f7318798c4 100644 --- a/patches/bio.h.patch +++ b/patches/bio.h.patch @@ -1,6 +1,6 @@ ---- include/openssl/bio.h.orig Mon Sep 5 22:30:32 2022 -+++ include/openssl/bio.h Tue Sep 6 01:38:22 2022 -@@ -666,8 +666,24 @@ void BIO_copy_next_retry(BIO *b); +--- include/openssl/bio.h.orig Tue Nov 22 21:08:27 2022 ++++ include/openssl/bio.h Tue Nov 22 21:08:48 2022 +@@ -667,8 +667,24 @@ void BIO_copy_next_retry(BIO *b); /*long BIO_ghbn_ctrl(int cmd,int iarg,char *parg);*/ @@ -25,7 +25,7 @@ __attribute__((__format__(__printf__, 2, 3), __nonnull__(2))); int BIO_vprintf(BIO *bio, const char *format, va_list args) -@@ -680,6 +696,7 @@ int +@@ -681,6 +697,7 @@ int BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args) __attribute__((__deprecated__, __format__(__printf__, 3, 0), __nonnull__(3))); From 67ab6a11877f6d1671da4afa6fbd142bf61a1ed2 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 23 Nov 2022 12:46:44 +0100 Subject: [PATCH 0123/1283] Neuter namespace differently to fix Appveyor CI --- Makefile.am.common | 3 +-- crypto/CMakeLists.txt | 1 - patches/opensslconf.h.patch | 24 ++++++++++++++++++++++++ patches/windows_headers.patch | 13 ------------- ssl/CMakeLists.txt | 2 -- 5 files changed, 25 insertions(+), 18 deletions(-) create mode 100644 patches/opensslconf.h.patch diff --git a/Makefile.am.common b/Makefile.am.common index 2c641c54d6..87aa807031 100644 --- a/Makefile.am.common +++ b/Makefile.am.common @@ -1,4 +1,3 @@ AM_CFLAGS = -AM_CPPFLAGS = -I$(top_srcdir)/crypto/hidden -I$(top_srcdir)/ssl/hidden -AM_CPPFLAGS += -I$(top_srcdir)/include -I$(top_srcdir)/include/compat -DLIBRESSL_INTERNAL +AM_CPPFLAGS = -I$(top_srcdir)/include -I$(top_srcdir)/include/compat -DLIBRESSL_INTERNAL AM_CPPFLAGS += -D__BEGIN_HIDDEN_DECLS= -D__END_HIDDEN_DECLS= diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 1ed5405451..895688426c 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -999,7 +999,6 @@ target_include_directories(crypto_obj ecdh ecdsa evp - hidden hmac modes ocsp diff --git a/patches/opensslconf.h.patch b/patches/opensslconf.h.patch new file mode 100644 index 0000000000..e060a204ee --- /dev/null +++ b/patches/opensslconf.h.patch @@ -0,0 +1,24 @@ +--- include/openssl/opensslconf.h.orig Tue Nov 22 21:08:27 2022 ++++ include/openssl/opensslconf.h Wed Nov 23 12:38:07 2022 +@@ -1,6 +1,21 @@ + #include + /* crypto/opensslconf.h.in */ + ++#if defined(_MSC_VER) && !defined(__clang__) && !defined(__attribute__) ++#define __attribute__(a) ++#endif ++ ++#ifndef LIBRESSL_NAMESPACE ++# define LCRYPTO_UNUSED(x) ++# define LCRYPTO_USED(x) ++# define LCRYPTO_ALIAS1(pre, x) ++# define LCRYPTO_ALIAS(x) ++ ++# define LSSL_UNUSED(x) ++# define LSSL_USED(x) ++# define LSSL_ALIAS(x) ++#endif /* !LIBRESSL_NAMESPACE */ ++ + #if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR) + #define OPENSSLDIR "/etc/ssl" + #endif diff --git a/patches/windows_headers.patch b/patches/windows_headers.patch index 0e9428c152..17c447d00a 100644 --- a/patches/windows_headers.patch +++ b/patches/windows_headers.patch @@ -13,19 +13,6 @@ diff -u include/openssl.orig/dtls1.h include/openssl/dtls1.h #include #include ---- include/openssl/opensslconf.h.orig Sat Nov 5 08:36:25 2016 -+++ include/openssl/opensslconf.h Mon Jul 17 06:06:58 2017 -@@ -1,6 +1,10 @@ - #include - /* crypto/opensslconf.h.in */ - -+#if defined(_MSC_VER) && !defined(__clang__) && !defined(__attribute__) -+#define __attribute__(a) -+#endif -+ - #if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR) - #define OPENSSLDIR "/etc/ssl" - #endif --- include/openssl/ossl_typ.h.orig Fri Feb 18 16:30:39 2022 +++ include/openssl/ossl_typ.h Mon Feb 21 05:39:35 2022 @@ -82,6 +82,22 @@ diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 13072b1d58..4c7357aab1 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -64,9 +64,7 @@ set( add_library(ssl_obj OBJECT ${SSL_SRC}) target_include_directories(ssl_obj PRIVATE - ../crypto/hidden ../crypto/bio - ./hidden . ../include/compat PUBLIC From 38089b559635a425fffb7c421191ec09169f26e8 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 23 Nov 2022 18:36:19 +0100 Subject: [PATCH 0124/1283] Don't leak namespace macros out of the library --- patches/opensslconf.h.patch | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/patches/opensslconf.h.patch b/patches/opensslconf.h.patch index e060a204ee..ee5d645bd7 100644 --- a/patches/opensslconf.h.patch +++ b/patches/opensslconf.h.patch @@ -8,7 +8,7 @@ +#define __attribute__(a) +#endif + -+#ifndef LIBRESSL_NAMESPACE ++#if defined(LIBRESSL_INTERNAL) && !defined(LIBRESSL_NAMESPACE) +# define LCRYPTO_UNUSED(x) +# define LCRYPTO_USED(x) +# define LCRYPTO_ALIAS1(pre, x) @@ -17,7 +17,7 @@ +# define LSSL_UNUSED(x) +# define LSSL_USED(x) +# define LSSL_ALIAS(x) -+#endif /* !LIBRESSL_NAMESPACE */ ++#endif /* LIBRESSL_INTERNAL && !LIBRESSL_NAMESPACE */ + #if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR) #define OPENSSLDIR "/etc/ssl" From 4bc644eab1d63f48801bc6ce473cbccafe4ce323 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 24 Nov 2022 08:18:07 -0600 Subject: [PATCH 0125/1283] update manpage links --- man/links | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/man/links b/man/links index 16e159db4a..360bfed7a0 100644 --- a/man/links +++ b/man/links @@ -92,10 +92,15 @@ ASN1_TIME_set.3,ASN1_GENERALIZEDTIME_set.3 ASN1_TIME_set.3,ASN1_GENERALIZEDTIME_set_string.3 ASN1_TIME_set.3,ASN1_TIME_adj.3 ASN1_TIME_set.3,ASN1_TIME_check.3 +ASN1_TIME_set.3,ASN1_TIME_cmp_time_t.3 +ASN1_TIME_set.3,ASN1_TIME_compare.3 ASN1_TIME_set.3,ASN1_TIME_diff.3 +ASN1_TIME_set.3,ASN1_TIME_normalize.3 ASN1_TIME_set.3,ASN1_TIME_print.3 ASN1_TIME_set.3,ASN1_TIME_set_string.3 +ASN1_TIME_set.3,ASN1_TIME_set_string_X509.3 ASN1_TIME_set.3,ASN1_TIME_to_generalizedtime.3 +ASN1_TIME_set.3,ASN1_TIME_to_tm.3 ASN1_TIME_set.3,ASN1_UTCTIME_adj.3 ASN1_TIME_set.3,ASN1_UTCTIME_check.3 ASN1_TIME_set.3,ASN1_UTCTIME_cmp_time_t.3 @@ -328,6 +333,26 @@ BN_CTX_new.3,BN_CTX_free.3 BN_CTX_new.3,BN_CTX_init.3 BN_CTX_start.3,BN_CTX_end.3 BN_CTX_start.3,BN_CTX_get.3 +BN_GF2m_add.3,BN_GF2m_arr2poly.3 +BN_GF2m_add.3,BN_GF2m_cmp.3 +BN_GF2m_add.3,BN_GF2m_mod.3 +BN_GF2m_add.3,BN_GF2m_mod_arr.3 +BN_GF2m_add.3,BN_GF2m_mod_div.3 +BN_GF2m_add.3,BN_GF2m_mod_div_arr.3 +BN_GF2m_add.3,BN_GF2m_mod_exp.3 +BN_GF2m_add.3,BN_GF2m_mod_exp_arr.3 +BN_GF2m_add.3,BN_GF2m_mod_inv.3 +BN_GF2m_add.3,BN_GF2m_mod_inv_arr.3 +BN_GF2m_add.3,BN_GF2m_mod_mul.3 +BN_GF2m_add.3,BN_GF2m_mod_mul_arr.3 +BN_GF2m_add.3,BN_GF2m_mod_solve_quad.3 +BN_GF2m_add.3,BN_GF2m_mod_solve_quad_arr.3 +BN_GF2m_add.3,BN_GF2m_mod_sqr.3 +BN_GF2m_add.3,BN_GF2m_mod_sqr_arr.3 +BN_GF2m_add.3,BN_GF2m_mod_sqrt.3 +BN_GF2m_add.3,BN_GF2m_mod_sqrt_arr.3 +BN_GF2m_add.3,BN_GF2m_poly2arr.3 +BN_GF2m_add.3,BN_GF2m_sub.3 BN_add.3,BN_div.3 BN_add.3,BN_exp.3 BN_add.3,BN_gcd.3 @@ -402,10 +427,15 @@ BN_mod_mul_reciprocal.3,BN_RECP_CTX_init.3 BN_mod_mul_reciprocal.3,BN_RECP_CTX_new.3 BN_mod_mul_reciprocal.3,BN_RECP_CTX_set.3 BN_mod_mul_reciprocal.3,BN_div_recp.3 +BN_mod_mul_reciprocal.3,BN_reciprocal.3 BN_new.3,BN_clear.3 BN_new.3,BN_clear_free.3 BN_new.3,BN_free.3 BN_new.3,BN_init.3 +BN_nist_mod_521.3,BN_nist_mod_192.3 +BN_nist_mod_521.3,BN_nist_mod_224.3 +BN_nist_mod_521.3,BN_nist_mod_256.3 +BN_nist_mod_521.3,BN_nist_mod_384.3 BN_num_bytes.3,BN_num_bits.3 BN_num_bytes.3,BN_num_bits_word.3 BN_rand.3,BN_pseudo_rand.3 @@ -2222,7 +2252,12 @@ X509_STORE_CTX_set_flags.3,X509_STORE_CTX_set_purpose.3 X509_STORE_CTX_set_flags.3,X509_STORE_CTX_set_time.3 X509_STORE_CTX_set_flags.3,X509_STORE_CTX_set_trust.3 X509_STORE_CTX_set_verify.3,X509_STORE_CTX_get_verify.3 +X509_STORE_CTX_set_verify.3,X509_STORE_CTX_verify_fn.3 +X509_STORE_CTX_set_verify.3,X509_STORE_get_verify.3 +X509_STORE_CTX_set_verify.3,X509_STORE_set_verify.3 +X509_STORE_CTX_set_verify.3,X509_STORE_set_verify_func.3 X509_STORE_CTX_set_verify_cb.3,X509_STORE_CTX_get_verify_cb.3 +X509_STORE_CTX_set_verify_cb.3,X509_STORE_CTX_verify_cb.3 X509_STORE_get_by_subject.3,X509_STORE_CTX_get1_issuer.3 X509_STORE_get_by_subject.3,X509_STORE_CTX_get_by_subject.3 X509_STORE_get_by_subject.3,X509_STORE_CTX_get_obj_by_subject.3 @@ -2244,6 +2279,7 @@ X509_STORE_set1_param.3,X509_STORE_set_ex_data.3 X509_STORE_set1_param.3,X509_STORE_set_flags.3 X509_STORE_set1_param.3,X509_STORE_set_purpose.3 X509_STORE_set1_param.3,X509_STORE_set_trust.3 +X509_STORE_set_verify_cb_func.3,X509_STORE_get_verify_cb.3 X509_STORE_set_verify_cb_func.3,X509_STORE_set_verify_cb.3 X509_TRUST_set.3,X509_TRUST_add.3 X509_TRUST_set.3,X509_TRUST_cleanup.3 From fb342b434bbbffa9a0ac36260b45e515baa9374f Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 24 Nov 2022 08:21:06 -0600 Subject: [PATCH 0126/1283] exclude bogus "ln_" manpage links --- man/links | 8 -------- man/update_links.sh | 1 + 2 files changed, 1 insertion(+), 8 deletions(-) diff --git a/man/links b/man/links index 360bfed7a0..09807f3bb7 100644 --- a/man/links +++ b/man/links @@ -2834,14 +2834,6 @@ lh_new.3,LHASH_COMP_FN_TYPE.3 lh_new.3,LHASH_DOALL_ARG_FN_TYPE.3 lh_new.3,LHASH_DOALL_FN_TYPE.3 lh_new.3,LHASH_HASH_FN_TYPE.3 -lh_new.3,lh__delete.3 -lh_new.3,lh__doall.3 -lh_new.3,lh__doall_arg.3 -lh_new.3,lh__error.3 -lh_new.3,lh__free.3 -lh_new.3,lh__insert.3 -lh_new.3,lh__new.3 -lh_new.3,lh__retrieve.3 lh_new.3,lh_delete.3 lh_new.3,lh_doall.3 lh_new.3,lh_doall_arg.3 diff --git a/man/update_links.sh b/man/update_links.sh index e72f03d8a1..088eb2b807 100755 --- a/man/update_links.sh +++ b/man/update_links.sh @@ -21,4 +21,5 @@ echo "# This is an auto-generated file by $0" > links /usr/src/regress/usr.bin/mandoc/db/mlinks/obj/mlinks mandoc.db | \ grep -v OCSP_crlID_new | \ grep -v bn_print | \ + grep -v "" | \ sort >> links From f39a1b4b64910394382c55b387efc11a28bc9338 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 27 Nov 2022 10:11:51 +0100 Subject: [PATCH 0127/1283] Update */Makefile.am for internal header renaming --- crypto/Makefile.am | 56 +++++++++++++++++++++++----------------------- ssl/Makefile.am | 4 ++-- 2 files changed, 30 insertions(+), 30 deletions(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 48067a2548..bc3d4c2daf 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -287,7 +287,7 @@ libcrypto_la_SOURCES += o_fips.c libcrypto_la_SOURCES += o_init.c libcrypto_la_SOURCES += o_str.c noinst_HEADERS += arm_arch.h -noinst_HEADERS += constant_time_locl.h +noinst_HEADERS += constant_time.h noinst_HEADERS += cryptlib.h noinst_HEADERS += md32_common.h noinst_HEADERS += x86_arch.h @@ -300,7 +300,7 @@ libcrypto_la_SOURCES += aes/aes_ige.c libcrypto_la_SOURCES += aes/aes_misc.c libcrypto_la_SOURCES += aes/aes_ofb.c libcrypto_la_SOURCES += aes/aes_wrap.c -noinst_HEADERS += aes/aes_locl.h +noinst_HEADERS += aes/aes_local.h # asn1 libcrypto_la_SOURCES += asn1/a_bitstr.c @@ -366,7 +366,7 @@ libcrypto_la_SOURCES += asn1/x_spki.c libcrypto_la_SOURCES += asn1/x_val.c libcrypto_la_SOURCES += asn1/x_x509.c libcrypto_la_SOURCES += asn1/x_x509a.c -noinst_HEADERS += asn1/asn1_locl.h +noinst_HEADERS += asn1/asn1_local.h noinst_HEADERS += asn1/charmap.h # bf @@ -375,7 +375,7 @@ libcrypto_la_SOURCES += bf/bf_ecb.c libcrypto_la_SOURCES += bf/bf_enc.c libcrypto_la_SOURCES += bf/bf_ofb64.c libcrypto_la_SOURCES += bf/bf_skey.c -noinst_HEADERS += bf/bf_locl.h +noinst_HEADERS += bf/bf_local.h # bio libcrypto_la_SOURCES += bio/b_dump.c @@ -440,7 +440,7 @@ libcrypto_la_SOURCES += bn/bn_sqr.c libcrypto_la_SOURCES += bn/bn_sqrt.c libcrypto_la_SOURCES += bn/bn_word.c libcrypto_la_SOURCES += bn/bn_x931p.c -noinst_HEADERS += bn/bn_lcl.h +noinst_HEADERS += bn/bn_local.h noinst_HEADERS += bn/bn_prime.h # buffer @@ -461,7 +461,7 @@ libcrypto_la_SOURCES += camellia/cmll_ecb.c libcrypto_la_SOURCES += camellia/cmll_misc.c libcrypto_la_SOURCES += camellia/cmll_ofb.c noinst_HEADERS += camellia/camellia.h -noinst_HEADERS += camellia/cmll_locl.h +noinst_HEADERS += camellia/cmll_local.h # cast libcrypto_la_SOURCES += cast/c_cfb64.c @@ -469,7 +469,7 @@ libcrypto_la_SOURCES += cast/c_ecb.c libcrypto_la_SOURCES += cast/c_enc.c libcrypto_la_SOURCES += cast/c_ofb64.c libcrypto_la_SOURCES += cast/c_skey.c -noinst_HEADERS += cast/cast_lcl.h +noinst_HEADERS += cast/cast_local.h noinst_HEADERS += cast/cast_s.h # chacha @@ -496,7 +496,7 @@ libcrypto_la_SOURCES += cms/cms_lib.c libcrypto_la_SOURCES += cms/cms_pwri.c libcrypto_la_SOURCES += cms/cms_sd.c libcrypto_la_SOURCES += cms/cms_smime.c -noinst_HEADERS += cms/cms_lcl.h +noinst_HEADERS += cms/cms_local.h # comp libcrypto_la_SOURCES += comp/c_rle.c @@ -558,7 +558,7 @@ libcrypto_la_SOURCES += des/rand_key.c libcrypto_la_SOURCES += des/set_key.c libcrypto_la_SOURCES += des/str2key.c libcrypto_la_SOURCES += des/xcbc_enc.c -noinst_HEADERS += des/des_locl.h +noinst_HEADERS += des/des_local.h noinst_HEADERS += des/spr.h # dh @@ -588,7 +588,7 @@ libcrypto_la_SOURCES += dsa/dsa_pmeth.c libcrypto_la_SOURCES += dsa/dsa_prn.c libcrypto_la_SOURCES += dsa/dsa_sign.c libcrypto_la_SOURCES += dsa/dsa_vrf.c -noinst_HEADERS += dsa/dsa_locl.h +noinst_HEADERS += dsa/dsa_local.h # dso libcrypto_la_SOURCES += dso/dso_dlfcn.c @@ -620,14 +620,14 @@ libcrypto_la_SOURCES += ec/ecp_nist.c libcrypto_la_SOURCES += ec/ecp_oct.c libcrypto_la_SOURCES += ec/ecp_smpl.c libcrypto_la_SOURCES += ec/ecx_methods.c -noinst_HEADERS += ec/ec_lcl.h +noinst_HEADERS += ec/ec_local.h # ecdh libcrypto_la_SOURCES += ecdh/ecdh_kdf.c libcrypto_la_SOURCES += ecdh/ech_err.c libcrypto_la_SOURCES += ecdh/ech_key.c libcrypto_la_SOURCES += ecdh/ech_lib.c -noinst_HEADERS += ecdh/ech_locl.h +noinst_HEADERS += ecdh/ech_local.h # ecdsa libcrypto_la_SOURCES += ecdsa/ecs_asn1.c @@ -636,7 +636,7 @@ libcrypto_la_SOURCES += ecdsa/ecs_lib.c libcrypto_la_SOURCES += ecdsa/ecs_ossl.c libcrypto_la_SOURCES += ecdsa/ecs_sign.c libcrypto_la_SOURCES += ecdsa/ecs_vrf.c -noinst_HEADERS += ecdsa/ecs_locl.h +noinst_HEADERS += ecdsa/ecs_local.h # engine libcrypto_la_SOURCES += engine/eng_all.c @@ -727,7 +727,7 @@ libcrypto_la_SOURCES += evp/p_verify.c libcrypto_la_SOURCES += evp/pmeth_fn.c libcrypto_la_SOURCES += evp/pmeth_gn.c libcrypto_la_SOURCES += evp/pmeth_lib.c -noinst_HEADERS += evp/evp_locl.h +noinst_HEADERS += evp/evp_local.h # gost libcrypto_la_SOURCES += gost/gost2814789.c @@ -745,7 +745,7 @@ libcrypto_la_SOURCES += gost/gostr341001_pmeth.c libcrypto_la_SOURCES += gost/gostr341194.c libcrypto_la_SOURCES += gost/streebog.c noinst_HEADERS += gost/gost_asn1.h -noinst_HEADERS += gost/gost_locl.h +noinst_HEADERS += gost/gost_local.h # hidden noinst_HEADERS += hidden/crypto_namespace.h @@ -773,7 +773,7 @@ libcrypto_la_SOURCES += idea/i_cfb64.c libcrypto_la_SOURCES += idea/i_ecb.c libcrypto_la_SOURCES += idea/i_ofb64.c libcrypto_la_SOURCES += idea/i_skey.c -noinst_HEADERS += idea/idea_lcl.h +noinst_HEADERS += idea/idea_local.h # kdf libcrypto_la_SOURCES += kdf/hkdf_evp.c @@ -786,12 +786,12 @@ libcrypto_la_SOURCES += lhash/lhash.c # md4 libcrypto_la_SOURCES += md4/md4_dgst.c libcrypto_la_SOURCES += md4/md4_one.c -noinst_HEADERS += md4/md4_locl.h +noinst_HEADERS += md4/md4_local.h # md5 libcrypto_la_SOURCES += md5/md5_dgst.c libcrypto_la_SOURCES += md5/md5_one.c -noinst_HEADERS += md5/md5_locl.h +noinst_HEADERS += md5/md5_local.h # modes libcrypto_la_SOURCES += modes/cbc128.c @@ -802,7 +802,7 @@ libcrypto_la_SOURCES += modes/cts128.c libcrypto_la_SOURCES += modes/gcm128.c libcrypto_la_SOURCES += modes/ofb128.c libcrypto_la_SOURCES += modes/xts128.c -noinst_HEADERS += modes/modes_lcl.h +noinst_HEADERS += modes/modes_local.h # objects libcrypto_la_SOURCES += objects/o_names.c @@ -882,15 +882,15 @@ libcrypto_la_SOURCES += rc2/rc2_ecb.c libcrypto_la_SOURCES += rc2/rc2_skey.c libcrypto_la_SOURCES += rc2/rc2cfb64.c libcrypto_la_SOURCES += rc2/rc2ofb64.c -noinst_HEADERS += rc2/rc2_locl.h +noinst_HEADERS += rc2/rc2_local.h # rc4 -noinst_HEADERS += rc4/rc4_locl.h +noinst_HEADERS += rc4/rc4_local.h # ripemd libcrypto_la_SOURCES += ripemd/rmd_dgst.c libcrypto_la_SOURCES += ripemd/rmd_one.c -noinst_HEADERS += ripemd/rmd_locl.h +noinst_HEADERS += ripemd/rmd_local.h noinst_HEADERS += ripemd/rmdconst.h # rsa @@ -913,18 +913,18 @@ libcrypto_la_SOURCES += rsa/rsa_pss.c libcrypto_la_SOURCES += rsa/rsa_saos.c libcrypto_la_SOURCES += rsa/rsa_sign.c libcrypto_la_SOURCES += rsa/rsa_x931.c -noinst_HEADERS += rsa/rsa_locl.h +noinst_HEADERS += rsa/rsa_local.h # sha libcrypto_la_SOURCES += sha/sha1_one.c libcrypto_la_SOURCES += sha/sha1dgst.c libcrypto_la_SOURCES += sha/sha256.c libcrypto_la_SOURCES += sha/sha512.c -noinst_HEADERS += sha/sha_locl.h +noinst_HEADERS += sha/sha_local.h # sm3 libcrypto_la_SOURCES += sm3/sm3.c -noinst_HEADERS += sm3/sm3_locl.h +noinst_HEADERS += sm3/sm3_local.h # sm4 libcrypto_la_SOURCES += sm4/sm4.c @@ -959,11 +959,11 @@ if HOST_WIN libcrypto_la_SOURCES += ui/ui_openssl_win.c endif libcrypto_la_SOURCES += ui/ui_util.c -noinst_HEADERS += ui/ui_locl.h +noinst_HEADERS += ui/ui_local.h # whrlpool libcrypto_la_SOURCES += whrlpool/wp_dgst.c -noinst_HEADERS += whrlpool/wp_locl.h +noinst_HEADERS += whrlpool/wp_local.h # x509 libcrypto_la_SOURCES += x509/by_dir.c @@ -1034,4 +1034,4 @@ noinst_HEADERS += x509/pcy_int.h noinst_HEADERS += x509/vpm_int.h noinst_HEADERS += x509/x509_internal.h noinst_HEADERS += x509/x509_issuer_cache.h -noinst_HEADERS += x509/x509_lcl.h +noinst_HEADERS += x509/x509_local.h diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 8750f77586..6591ffafbc 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -96,8 +96,8 @@ libssl_la_SOURCES += tls13_record_layer.c libssl_la_SOURCES += tls13_server.c noinst_HEADERS += srtp.h -noinst_HEADERS += dtls_locl.h -noinst_HEADERS += ssl_locl.h +noinst_HEADERS += dtls_local.h +noinst_HEADERS += ssl_local.h noinst_HEADERS += ssl_sigalgs.h noinst_HEADERS += ssl_tlsext.h noinst_HEADERS += tls_content.h From bcf7afb23f9ae3a8dbdbb4ffe78c1e6f8bdc4444 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 27 Nov 2022 10:35:13 +0100 Subject: [PATCH 0128/1283] Adjust patches for lcl.h -> local.h rename --- patches/{bn_lcl.h.patch => bn_local.h.patch} | 4 ++-- patches/{modes_lcl.h.patch => modes_local.h.patch} | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) rename patches/{bn_lcl.h.patch => bn_local.h.patch} (73%) rename patches/{modes_lcl.h.patch => modes_local.h.patch} (82%) diff --git a/patches/bn_lcl.h.patch b/patches/bn_local.h.patch similarity index 73% rename from patches/bn_lcl.h.patch rename to patches/bn_local.h.patch index 84835ed789..2378ec7c27 100644 --- a/patches/bn_lcl.h.patch +++ b/patches/bn_local.h.patch @@ -1,5 +1,5 @@ ---- ./crypto/bn/bn_lcl.h.orig Fri Feb 18 16:30:39 2022 -+++ ./crypto/bn/bn_lcl.h Mon Feb 21 05:39:35 2022 +--- ./crypto/bn/bn_local.h.orig Fri Feb 18 16:30:39 2022 ++++ ./crypto/bn/bn_local.h Mon Feb 21 05:39:35 2022 @@ -283,7 +283,7 @@ : "r"(a), "r"(b)); \ ret; }) diff --git a/patches/modes_lcl.h.patch b/patches/modes_local.h.patch similarity index 82% rename from patches/modes_lcl.h.patch rename to patches/modes_local.h.patch index 330d4d0448..8f55eedf38 100644 --- a/patches/modes_lcl.h.patch +++ b/patches/modes_local.h.patch @@ -1,5 +1,5 @@ ---- crypto/modes/modes_lcl.h.orig Tue Nov 14 10:25:15 2017 -+++ crypto/modes/modes_lcl.h Sat Jan 19 22:19:23 2019 +--- crypto/modes/modes_local.h.orig Tue Nov 14 10:25:15 2017 ++++ crypto/modes/modes_local.h Sat Jan 19 22:19:23 2019 @@ -45,14 +45,16 @@ asm ("bswapl %0" \ : "+r"(ret)); ret; }) From a911052d609731a9f9169ed5d825db621c52ae6d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 27 Nov 2022 10:45:50 +0100 Subject: [PATCH 0129/1283] Adjust for ui_locl.h -> ui_local.h rename --- crypto/compat/ui_openssl_win.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/compat/ui_openssl_win.c b/crypto/compat/ui_openssl_win.c index ad9e91569d..c245111d66 100644 --- a/crypto/compat/ui_openssl_win.c +++ b/crypto/compat/ui_openssl_win.c @@ -124,7 +124,7 @@ #include #include -#include "ui_locl.h" +#include "ui_local.h" #ifndef NX509_SIG #define NX509_SIG 32 From 7775de6c76ebf09598e2a48664a4d666ee459e45 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 27 Nov 2022 10:50:30 +0100 Subject: [PATCH 0130/1283] regen patches --- patches/bn_isqrt.c.patch | 8 ++++---- patches/openssl.c.patch | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/patches/bn_isqrt.c.patch b/patches/bn_isqrt.c.patch index bf205a3163..9c88a0ae3f 100644 --- a/patches/bn_isqrt.c.patch +++ b/patches/bn_isqrt.c.patch @@ -1,6 +1,6 @@ ---- tests/bn_isqrt.c.orig Mon Aug 15 10:40:29 2022 -+++ tests/bn_isqrt.c Mon Aug 15 10:41:46 2022 -@@ -304,6 +304,7 @@ main(int argc, char *argv[]) +--- tests/bn_isqrt.c.orig Sun Nov 27 10:48:32 2022 ++++ tests/bn_isqrt.c Sun Nov 27 10:48:49 2022 +@@ -303,6 +303,7 @@ main(int argc, char *argv[]) int ch; int failed = 0, print = 0; @@ -8,7 +8,7 @@ while ((ch = getopt(argc, argv, "C")) != -1) { switch (ch) { case 'C': -@@ -314,6 +315,7 @@ main(int argc, char *argv[]) +@@ -313,6 +314,7 @@ main(int argc, char *argv[]) break; } } diff --git a/patches/openssl.c.patch b/patches/openssl.c.patch index 2c2a3dac6e..46702f260b 100644 --- a/patches/openssl.c.patch +++ b/patches/openssl.c.patch @@ -1,6 +1,6 @@ ---- apps/openssl/openssl.c.orig Thu Nov 7 18:19:01 2019 -+++ apps/openssl/openssl.c Fri Sep 4 04:04:26 2020 -@@ -360,7 +360,9 @@ +--- apps/openssl/openssl.c.orig Sun Nov 27 10:48:36 2022 ++++ apps/openssl/openssl.c Sun Nov 27 10:48:49 2022 +@@ -359,7 +359,9 @@ BIO *bio_err = NULL; static void openssl_startup(void) { From be970651de9f3608b04b0041ea55891c1999b4f6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 2 Dec 2022 00:15:29 +0100 Subject: [PATCH 0131/1283] Teach automake about renamed and new tests --- tests/Makefile.am | 45 +++++++++++++++++++++++++-------------------- 1 file changed, 25 insertions(+), 20 deletions(-) diff --git a/tests/Makefile.am b/tests/Makefile.am index d9ca0d750c..3f655d32c6 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -128,16 +128,27 @@ check_PROGRAMS += biotest biotest_SOURCES = biotest.c endif -# bnaddsub -TESTS += bnaddsub -check_PROGRAMS += bnaddsub -bnaddsub_SOURCES = bnaddsub.c +# bn_add_sub +TESTS += bn_add_sub +check_PROGRAMS += bn_add_sub +bn_add_sub_SOURCES = bn_add_sub.c + +# bn_cmp +TESTS += bn_cmp +check_PROGRAMS += bn_cmp +bn_cmp_SOURCES = bn_cmp.c # bn_isqrt TESTS += bn_isqrt check_PROGRAMS += bn_isqrt bn_isqrt_SOURCES = bn_isqrt.c +# bn_mod_exp +TESTS += bn_mod_exp +check_PROGRAMS += bn_mod_exp +bn_mod_exp_CPPFLAGS = $(AM_CPPFLAGS) -ULIBRESSL_INTERNAL +bn_mod_exp_SOURCES = bn_mod_exp.c + # bn_mod_exp2_mont TESTS += bn_mod_exp2_mont check_PROGRAMS += bn_mod_exp2_mont @@ -148,6 +159,11 @@ TESTS += bn_mod_sqrt check_PROGRAMS += bn_mod_sqrt bn_mod_sqrt_SOURCES = bn_mod_sqrt.c +# bn_mont +TESTS += bn_mont +check_PROGRAMS += bn_mont +bn_mont_SOURCES = bn_mont.c + # bn_primes TESTS += bn_primes check_PROGRAMS += bn_primes @@ -158,11 +174,11 @@ TESTS += bn_rand_interval check_PROGRAMS += bn_rand_interval bn_rand_interval_SOURCES = bn_rand_interval.c -# bntest -TESTS += bntest -bntest_CPPFLAGS = $(AM_CPPFLAGS) -ULIBRESSL_INTERNAL -check_PROGRAMS += bntest -bntest_SOURCES = bntest.c +# bn_test +TESTS += bn_test +bn_test_CPPFLAGS = $(AM_CPPFLAGS) -ULIBRESSL_INTERNAL +check_PROGRAMS += bn_test +bn_test_SOURCES = bn_test.c # bn_to_string TESTS += bn_to_string @@ -324,12 +340,6 @@ endif endif endif -# exptest -TESTS += exptest -check_PROGRAMS += exptest -exptest_CPPFLAGS = $(AM_CPPFLAGS) -ULIBRESSL_INTERNAL -exptest_SOURCES = exptest.c - # freenull TESTS += freenull check_PROGRAMS += freenull @@ -387,11 +397,6 @@ TESTS += md_test check_PROGRAMS += md_test md_test_SOURCES = md_test.c -# mont -TESTS += mont -check_PROGRAMS += mont -mont_SOURCES = mont.c - # objectstest TESTS += objectstest check_PROGRAMS += objectstest From e29d66d700740cda915aae650638fc8de916dd26 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 2 Dec 2022 00:22:01 +0100 Subject: [PATCH 0132/1283] Teach cmake framework about new and renamed tests --- tests/CMakeLists.txt | 47 ++++++++++++++++++++++++-------------------- 1 file changed, 26 insertions(+), 21 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 537ed8fc1d..d590708f4b 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -116,16 +116,28 @@ if(ENABLE_EXTRATESTS) add_test(biotest biotest) endif() -# bnaddsub -add_executable(bnaddsub bnaddsub.c) -target_link_libraries(bnaddsub ${OPENSSL_TEST_LIBS}) -add_test(bnaddsub bnaddsub) +# bn_add_sub +add_executable(bn_add_sub bn_add_sub.c) +target_link_libraries(bn_add_sub ${OPENSSL_TEST_LIBS}) +add_test(bn_add_sub bn_add_sub) + +# bn_cmp +add_executable(bn_cmp bn_cmp.c) +target_link_libraries(bn_cmp ${OPENSSL_TEST_LIBS}) +add_test(bn_cmp bn_cmp) # bn_isqrt add_executable(bn_isqrt bn_isqrt.c) target_link_libraries(bn_isqrt ${OPENSSL_TEST_LIBS}) add_test(bn_isqrt bn_isqrt) +# bn_mod_exp +add_executable(bn_mod_exp bn_mod_exp.c) +set_source_files_properties(bn_mod_exp.c PROPERTIES COMPILE_FLAGS + -ULIBRESSL_INTERNAL) +target_link_libraries(bn_mod_exp ${OPENSSL_TEST_LIBS}) +add_test(bn_mod_exp bn_mod_exp) + # bn_mod_exp2_mont add_executable(bn_mod_exp2_mont bn_mod_exp2_mont.c) target_link_libraries(bn_mod_exp2_mont ${OPENSSL_TEST_LIBS}) @@ -136,6 +148,11 @@ add_executable(bn_mod_sqrt bn_mod_sqrt.c) target_link_libraries(bn_mod_sqrt ${OPENSSL_TEST_LIBS}) add_test(bn_mod_sqrt bn_mod_sqrt) +# bn_mont +add_executable(bn_mont bn_mont.c) +target_link_libraries(bn_mont ${OPENSSL_TEST_LIBS}) +add_test(bn_mont bn_mont) + # bn_primes add_executable(bn_primes bn_primes.c) target_link_libraries(bn_primes ${OPENSSL_TEST_LIBS}) @@ -146,12 +163,12 @@ add_executable(bn_rand_interval bn_rand_interval.c) target_link_libraries(bn_rand_interval ${OPENSSL_TEST_LIBS}) add_test(bn_rand_interval bn_rand_interval) -# bntest -add_executable(bntest bntest.c) -set_source_files_properties(bntest.c PROPERTIES COMPILE_FLAGS +# bn_test +add_executable(bn_test bn_test.c) +set_source_files_properties(bn_test.c PROPERTIES COMPILE_FLAGS -ULIBRESSL_INTERNAL) -target_link_libraries(bntest ${OPENSSL_TEST_LIBS}) -add_test(bntest bntest) +target_link_libraries(bn_test ${OPENSSL_TEST_LIBS}) +add_test(bn_test bn_test) # bn_to_string add_executable(bn_to_string bn_to_string.c) @@ -309,13 +326,6 @@ if(NOT WIN32) add_test(explicit_bzero explicit_bzero) endif() -# exptest -add_executable(exptest exptest.c) -set_source_files_properties(exptest.c PROPERTIES COMPILE_FLAGS - -ULIBRESSL_INTERNAL) -target_link_libraries(exptest ${OPENSSL_TEST_LIBS}) -add_test(exptest exptest) - # freenull add_executable(freenull freenull.c) target_link_libraries(freenull ${OPENSSL_TEST_LIBS}) @@ -374,11 +384,6 @@ add_executable(md_test md_test.c) target_link_libraries(md_test ${OPENSSL_TEST_LIBS}) add_test(md_test md_test) -# mont -add_executable(mont mont.c) -target_link_libraries(mont ${OPENSSL_TEST_LIBS}) -add_test(mont mont) - # objectstest add_executable(objectstest objectstest.c) target_link_libraries(objectstest ${OPENSSL_TEST_LIBS}) From 302cda57d86cc2c302cdcd05471a30d872c8aeba Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 3 Dec 2022 11:33:59 +0100 Subject: [PATCH 0133/1283] Add bn_mod_exp_zero test --- tests/CMakeLists.txt | 7 +++++++ tests/Makefile.am | 6 ++++++ 2 files changed, 13 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index d590708f4b..4685c5b9c5 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -138,6 +138,13 @@ set_source_files_properties(bn_mod_exp.c PROPERTIES COMPILE_FLAGS target_link_libraries(bn_mod_exp ${OPENSSL_TEST_LIBS}) add_test(bn_mod_exp bn_mod_exp) +# bn_mod_exp_zero +add_executable(bn_mod_exp_zero bn_mod_exp_zero.c) +set_source_files_properties(bn_mod_exp_zero.c PROPERTIES COMPILE_FLAGS + -ULIBRESSL_INTERNAL) +target_link_libraries(bn_mod_exp_zero ${OPENSSL_TEST_LIBS}) +add_test(bn_mod_exp_zero bn_mod_exp_zero) + # bn_mod_exp2_mont add_executable(bn_mod_exp2_mont bn_mod_exp2_mont.c) target_link_libraries(bn_mod_exp2_mont ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 3f655d32c6..6202bb33ee 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -149,6 +149,12 @@ check_PROGRAMS += bn_mod_exp bn_mod_exp_CPPFLAGS = $(AM_CPPFLAGS) -ULIBRESSL_INTERNAL bn_mod_exp_SOURCES = bn_mod_exp.c +# bn_mod_exp_zero +TESTS += bn_mod_exp_zero +check_PROGRAMS += bn_mod_exp_zero +bn_mod_exp_zero_CPPFLAGS = $(AM_CPPFLAGS) -ULIBRESSL_INTERNAL +bn_mod_exp_zero_SOURCES = bn_mod_exp_zero.c + # bn_mod_exp2_mont TESTS += bn_mod_exp2_mont check_PROGRAMS += bn_mod_exp2_mont From 6755900317e3f855316c52e2d8281b33414b107c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 9 Dec 2022 11:11:40 +0100 Subject: [PATCH 0134/1283] fix comment --- tests/CMakeLists.txt | 2 +- tests/Makefile.am | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 4685c5b9c5..6dbf68c3c2 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -103,7 +103,7 @@ add_executable(base64test base64test.c) target_link_libraries(base64test ${OPENSSL_TEST_LIBS}) add_test(base64test base64test) -# bftest +# bf_test add_executable(bf_test bf_test.c) target_link_libraries(bf_test ${OPENSSL_TEST_LIBS}) add_test(bf_test bf_test) diff --git a/tests/Makefile.am b/tests/Makefile.am index 6202bb33ee..22e3483229 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -115,7 +115,7 @@ TESTS += base64test check_PROGRAMS += base64test base64test_SOURCES = base64test.c -# bftest +# bf_test TESTS += bf_test check_PROGRAMS += bf_test bf_test_SOURCES = bf_test.c From cf4c794c90b7ebff51ce2b3c3837a4289e7072e6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 9 Dec 2022 11:11:53 +0100 Subject: [PATCH 0135/1283] update for biotest split --- tests/CMakeLists.txt | 20 +++++++++++++++----- tests/Makefile.am | 20 +++++++++++++++----- 2 files changed, 30 insertions(+), 10 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 6dbf68c3c2..a7f92cdf9d 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -108,14 +108,24 @@ add_executable(bf_test bf_test.c) target_link_libraries(bf_test ${OPENSSL_TEST_LIBS}) add_test(bf_test bf_test) -# biotest -# the BIO tests rely on resolver results that are OS and environment-specific +# bio_chain +add_executable(bio_chain bio_chain.c) +target_link_libraries(bio_chain ${OPENSSL_TEST_LIBS}) +add_test(bio_chain bio_chain) + +# bio_host +# this test relies on resolver results that are OS and environment-specific if(ENABLE_EXTRATESTS) - add_executable(biotest biotest.c) - target_link_libraries(biotest ${OPENSSL_TEST_LIBS}) - add_test(biotest biotest) + add_executable(bio_host bio_host.c) + target_link_libraries(bio_host ${OPENSSL_TEST_LIBS}) + add_test(bio_host bio_host) endif() +# bio_mem +add_executable(bio_mem bio_mem.c) +target_link_libraries(bio_mem ${OPENSSL_TEST_LIBS}) +add_test(bio_mem bio_mem) + # bn_add_sub add_executable(bn_add_sub bn_add_sub.c) target_link_libraries(bn_add_sub ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 22e3483229..6fea2ebc90 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -120,14 +120,24 @@ TESTS += bf_test check_PROGRAMS += bf_test bf_test_SOURCES = bf_test.c -# biotest -# the BIO tests rely on resolver results that are OS and environment-specific +# bio_chain +TESTS += bio_chain +check_PROGRAMS += bio_chain +bio_chain_SOURCES = bio_chain.c + +# bio_host +# this test relies on resolver results that are OS and environment-specific if ENABLE_EXTRATESTS -TESTS += biotest -check_PROGRAMS += biotest -biotest_SOURCES = biotest.c +TESTS += bio_host +check_PROGRAMS += bio_host +bio_host_SOURCES = bio_host.c endif +# bio_mem +TESTS += bio_mem +check_PROGRAMS += bio_mem +bio_mem_SOURCES = bio_mem.c + # bn_add_sub TESTS += bn_add_sub check_PROGRAMS += bn_add_sub From bd3456405bb337558f3fa87b3d4fd1a93e1d1d5b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 9 Dec 2022 11:14:33 +0100 Subject: [PATCH 0136/1283] regen bn_isqrt.c patch --- patches/bn_isqrt.c.patch | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/patches/bn_isqrt.c.patch b/patches/bn_isqrt.c.patch index 9c88a0ae3f..5f2a568d87 100644 --- a/patches/bn_isqrt.c.patch +++ b/patches/bn_isqrt.c.patch @@ -1,6 +1,6 @@ ---- tests/bn_isqrt.c.orig Sun Nov 27 10:48:32 2022 -+++ tests/bn_isqrt.c Sun Nov 27 10:48:49 2022 -@@ -303,6 +303,7 @@ main(int argc, char *argv[]) +--- tests/bn_isqrt.c.orig Fri Dec 9 11:05:26 2022 ++++ tests/bn_isqrt.c Fri Dec 9 11:12:37 2022 +@@ -306,6 +306,7 @@ main(int argc, char *argv[]) int ch; int failed = 0, print = 0; @@ -8,7 +8,7 @@ while ((ch = getopt(argc, argv, "C")) != -1) { switch (ch) { case 'C': -@@ -313,6 +314,7 @@ main(int argc, char *argv[]) +@@ -316,6 +317,7 @@ main(int argc, char *argv[]) break; } } From 75e2fa0a9e7343d9977b476cd26b38032c72baee Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 20 Oct 2022 13:52:58 +0200 Subject: [PATCH 0137/1283] Initial ChangeLog for 3.6.1 (cherry picked from commit 6419191d820c295055a11fccfe2f1387d6e682f8) --- ChangeLog | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/ChangeLog b/ChangeLog index d5c4617e29..78ebb32b51 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,6 +28,15 @@ history is also available from Git. LibreSSL Portable Release Notes: +3.6.1 - Stable release + + * Bug fixes + - Custom verification callbacks could cause the X.509 verifier to + fail to store errors resulting from leaf certificate verification. + Reported by Ilya Shipitsin. + - Unbreak ASN.1 indefinite length encoding. + Reported by Niklas Hallqvist. + 3.6.0 - Development release * Internal improvements From e36a976a2b7d3fc264e511791993cb419ce0be44 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 9 Dec 2022 13:01:57 +0100 Subject: [PATCH 0138/1283] ChangeLog for 3.7.0 --- ChangeLog | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/ChangeLog b/ChangeLog index 78ebb32b51..036822e012 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,6 +28,48 @@ history is also available from Git. LibreSSL Portable Release Notes: +3.7.0 - Development release + + * Internal improvements + - Replace Julian date calculations with a rewrite from BoringSSL. + - Clean old and unused BN code dealing with primes. + - Start rewriting name constraints code using CBS. + - Remove support for the HMAC PRIVATE KEY. + - Rework DSA signing and verifying internals. + - First few passes on cleaning up the BN code. + - Internal headers coming from OpenSSL are all called *_local.h now. + - Rewrite TLSv1.2 key exporter. + - Cleaned up and refactored various aspects of the legacy TLS stack. + * Compatibility changes + - BIO_read() and BIO_write() now behave more closely to OpenSSL 3 in + various corner cases. More work is needed here. + * Bug fixes + - Add EVP_chacha20_poly1305() to the list of all ciphers. + - Fix potential leaks of EVP_PKEY in various printing functions + - Fix potential leak in OBJ_NAME_add(). + - Avoid signed overflow in i2c_ASN1_BIT_STRING(). + - Clean up EVP_PKEY_ASN1_METHOD related tables and code. + - Fix long standing bugs BN_GF2m_poly2arr() and BN_GF2m_mod(). + - Fix segfaults in BN_{dec,hex}2bn(). + - Fix NULL dereference in x509_constraints_uri_host() reachable only + in the process of generating certificates. + - Fixed a variety of memory corruption issues in BIO chains coming + from poor old and new API: BIO_push(), BIO_pop(), BIO_set_next(). + * Documentation improvements + - Numerous improvements and additions for ASN.1, BIO, BN, and X.509. + - The BN documentation is now considered to be complete. + * Testing and Proactive Security + - As always, new test coverage is added as bugs are fixed and + subsystems are cleaned up. + - Many old tests rewritten, cleaned up and extended. + * New features + - Added Ed25519 support both as a primitive and via OpenSSL's EVP + interfaces. + - X25519 is now also supported via EVP. + - The OpenSSL 1.1 raw public and private key API is available with + support for EVP_PKEY_ED25519, EVP_PKEY_HMAC and EVP_PKEY_X25519. + Poly1305 is not currently supported via this interface. + 3.6.1 - Stable release * Bug fixes From b2718380b06168eb93466dc66f5c4fb0e5667859 Mon Sep 17 00:00:00 2001 From: Bob Beck Date: Fri, 9 Dec 2022 09:12:08 -0700 Subject: [PATCH 0139/1283] Add the reason for the julian time change (get rid of timegm/gmtime) --- ChangeLog | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 036822e012..a3447c158f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -31,8 +31,11 @@ LibreSSL Portable Release Notes: 3.7.0 - Development release * Internal improvements - - Replace Julian date calculations with a rewrite from BoringSSL. - - Clean old and unused BN code dealing with primes. + + - Remove dependency on system timegm() and gmtime() by replacing + traditional Julian date conversion with POSIX epoch-seconds date + conversion from BoringSSL + - Clean oxsld and unused BN code dealing with primes. - Start rewriting name constraints code using CBS. - Remove support for the HMAC PRIVATE KEY. - Rework DSA signing and verifying internals. From f90967d04b0ffd75857cc19b40dcf7a6543a4dd5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 9 Dec 2022 18:20:29 +0100 Subject: [PATCH 0140/1283] Undo inconsistencies introduced in previous --- ChangeLog | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index a3447c158f..015b4c0348 100644 --- a/ChangeLog +++ b/ChangeLog @@ -31,11 +31,10 @@ LibreSSL Portable Release Notes: 3.7.0 - Development release * Internal improvements - - - Remove dependency on system timegm() and gmtime() by replacing - traditional Julian date conversion with POSIX epoch-seconds date - conversion from BoringSSL - - Clean oxsld and unused BN code dealing with primes. + - Remove dependency on system timegm() and gmtime() by replacing + traditional Julian date conversion with POSIX epoch-seconds date + conversion from BoringSSL. + - Clean old and unused BN code dealing with primes. - Start rewriting name constraints code using CBS. - Remove support for the HMAC PRIVATE KEY. - Rework DSA signing and verifying internals. From 202d12ca6ded61a6f70ba413b5c1df369d34131e Mon Sep 17 00:00:00 2001 From: Bob Beck Date: Fri, 9 Dec 2022 10:42:36 -0700 Subject: [PATCH 0141/1283] Add a few more things --- ChangeLog | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 015b4c0348..ef8bc5f774 100644 --- a/ChangeLog +++ b/ChangeLog @@ -33,7 +33,7 @@ LibreSSL Portable Release Notes: * Internal improvements - Remove dependency on system timegm() and gmtime() by replacing traditional Julian date conversion with POSIX epoch-seconds date - conversion from BoringSSL. + conversion from BoringSSL - Clean old and unused BN code dealing with primes. - Start rewriting name constraints code using CBS. - Remove support for the HMAC PRIVATE KEY. @@ -46,6 +46,7 @@ LibreSSL Portable Release Notes: - BIO_read() and BIO_write() now behave more closely to OpenSSL 3 in various corner cases. More work is needed here. * Bug fixes + - Make BIO_push(3) fail if a call would result in a cycle - Add EVP_chacha20_poly1305() to the list of all ciphers. - Fix potential leaks of EVP_PKEY in various printing functions - Fix potential leak in OBJ_NAME_add(). @@ -57,6 +58,7 @@ LibreSSL Portable Release Notes: in the process of generating certificates. - Fixed a variety of memory corruption issues in BIO chains coming from poor old and new API: BIO_push(), BIO_pop(), BIO_set_next(). + - Avoid potential divide by zero in BIO_dump_indent_cb() * Documentation improvements - Numerous improvements and additions for ASN.1, BIO, BN, and X.509. - The BN documentation is now considered to be complete. From 8c6a4618b6b9ea487a6994ec7e61c8a96fdda2af Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 9 Dec 2022 18:47:59 +0100 Subject: [PATCH 0142/1283] Drop a deliberate ommission again --- ChangeLog | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index ef8bc5f774..f38260106b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -33,7 +33,7 @@ LibreSSL Portable Release Notes: * Internal improvements - Remove dependency on system timegm() and gmtime() by replacing traditional Julian date conversion with POSIX epoch-seconds date - conversion from BoringSSL + conversion from BoringSSL. - Clean old and unused BN code dealing with primes. - Start rewriting name constraints code using CBS. - Remove support for the HMAC PRIVATE KEY. @@ -46,7 +46,6 @@ LibreSSL Portable Release Notes: - BIO_read() and BIO_write() now behave more closely to OpenSSL 3 in various corner cases. More work is needed here. * Bug fixes - - Make BIO_push(3) fail if a call would result in a cycle - Add EVP_chacha20_poly1305() to the list of all ciphers. - Fix potential leaks of EVP_PKEY in various printing functions - Fix potential leak in OBJ_NAME_add(). From 4f0f6ebd1aa1038923e08af6730a32cde3202f62 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 13 Dec 2022 04:34:25 -0600 Subject: [PATCH 0143/1283] Build a static test library with all symbols Build and link a special test library rather than assuming that the build has static libraries available. --- tests/Makefile.am | 20 +++++++++++++------- tls/Makefile.am | 9 +++++++++ update.sh | 1 + 3 files changed, 23 insertions(+), 7 deletions(-) diff --git a/tests/Makefile.am b/tests/Makefile.am index 6fea2ebc90..26f6b7d73a 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -1,5 +1,9 @@ include $(top_srcdir)/Makefile.am.common +-include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk +-include $(abs_top_builddir)/ssl/libssl_la_objects.mk +-include $(abs_top_builddir)/tls/libtls_la_objects.mk + AM_CPPFLAGS += -DLIBRESSL_CRYPTO_INTERNAL AM_CPPFLAGS += -I $(top_srcdir)/crypto/asn1 @@ -14,13 +18,15 @@ AM_CPPFLAGS += -I $(top_srcdir)/apps/openssl AM_CPPFLAGS += -I $(top_srcdir)/apps/openssl/compat AM_CPPFLAGS += -D_PATH_SSL_CA_FILE=\"$(top_srcdir)/cert.pem\" -LDADD = $(abs_top_builddir)/tls/.libs/libtls.a -LDADD += $(abs_top_builddir)/ssl/.libs/libssl.a -LDADD += $(abs_top_builddir)/crypto/.libs/libcrypto.a -LDADD += $(PLATFORM_LDADD) $(PROG_LDADD) -if HOST_ASM_MACOSX_X86_64 -LDADD += $(abs_top_builddir)/crypto/.libs/libcrypto_la-cpuid-macosx-x86_64.o -endif +noinst_LTLIBRARIES = libtest.la +libtest_la_LIBADD = $(libcrypto_la_objects) +libtest_la_LIBADD += $(libcompat_la_objects) +libtest_la_LIBADD += $(libcompatnoopt_la_objects) +libtest_la_LIBADD += $(libssl_la_objects) +libtest_la_LIBADD += $(libtls_la_objects) +libtest_la_SOURCES = empty.c + +LDADD = libtest.la $(PLATFORM_LDADD) $(PROG_LDADD) TEST_LOG_DRIVER = env AM_TAP_AWK='$(AWK)' $(SHELL) $(top_srcdir)/tap-driver.sh diff --git a/tls/Makefile.am b/tls/Makefile.am index 4d31c9282f..160359c3f7 100644 --- a/tls/Makefile.am +++ b/tls/Makefile.am @@ -9,6 +9,15 @@ EXTRA_DIST = VERSION EXTRA_DIST += CMakeLists.txt EXTRA_DIST += tls.sym +CLEANFILES = libtls_la_objects.mk + +EXTRA_libtls_la_DEPENDENCIES = libtls_la_objects.mk + +libtls_la_objects.mk: Makefile + @echo "libtls_la_objects= $(libtls_la_OBJECTS)" \ + | sed 's/ */ $$\(abs_top_builddir\)\/tls\//g' \ + > libtls_la_objects.mk + libtls_la_LDFLAGS = -version-info @LIBTLS_VERSION@ -no-undefined -export-symbols $(top_srcdir)/tls/tls.sym libtls_la_LIBADD = $(libcrypto_la_objects) libtls_la_LIBADD += $(libcompat_la_objects) diff --git a/update.sh b/update.sh index e7d9e6b204..c7ff9fb845 100755 --- a/update.sh +++ b/update.sh @@ -286,6 +286,7 @@ $GREP '^[A-Za-z0-9_]' < $libssl_src/Symbols.list > ssl/ssl.sym # copy libcrypto tests echo "copying tests" +touch tests/empty.c for i in `find $libcrypto_regress -name '*.c'`; do $CP "$i" tests done From 80eb1454604f71fdcbb17c7fb73bade22031ef81 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 13 Dec 2022 05:44:07 -0600 Subject: [PATCH 0144/1283] add direct source dependency to each library Fix library generation with some CMake generators by including a direct source file dependency for each library. --- crypto/CMakeLists.txt | 2 +- crypto/Makefile.am | 1 + ssl/CMakeLists.txt | 2 +- ssl/Makefile.am | 1 + tls/CMakeLists.txt | 2 +- tls/Makefile.am | 1 + update.sh | 3 +++ 7 files changed, 9 insertions(+), 3 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 895688426c..bb4343260e 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -1009,7 +1009,7 @@ target_include_directories(crypto_obj PUBLIC ../include) -add_library(crypto $) +add_library(crypto $ empty.c) export_symbol(crypto ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym) target_link_libraries(crypto ${PLATFORM_LIBS}) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index bc3d4c2daf..e380fdf706 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -32,6 +32,7 @@ endif EXTRA_DIST = VERSION EXTRA_DIST += CMakeLists.txt EXTRA_DIST += crypto.sym +EXTRA_DIST += empty.c # needed for a CMake target EXTRA_DIST += compat/strcasecmp.c diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 4c7357aab1..173c3b5845 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -79,7 +79,7 @@ target_include_directories(bs_obj if(BUILD_SHARED_LIBS) add_library(ssl $ $) else() - add_library(ssl $) + add_library(ssl $ empty.c) endif() export_symbol(ssl ${CMAKE_CURRENT_SOURCE_DIR}/ssl.sym) diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 6591ffafbc..a2155fb1e2 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -15,6 +15,7 @@ noinst_DATA = remove_bs_objects EXTRA_DIST = VERSION EXTRA_DIST += CMakeLists.txt EXTRA_DIST += ssl.sym +EXTRA_DIST += empty.c CLEANFILES = libssl_la_objects.mk diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 7827a5ebae..62dde6308d 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -48,7 +48,7 @@ target_include_directories(tls_obj ../include) add_library(tls $ $ - $) + $ empty.c) export_symbol(tls ${CMAKE_CURRENT_BINARY_DIR}/tls.sym) target_link_libraries(tls ${PLATFORM_LIBS}) diff --git a/tls/Makefile.am b/tls/Makefile.am index 160359c3f7..9b62b2231e 100644 --- a/tls/Makefile.am +++ b/tls/Makefile.am @@ -8,6 +8,7 @@ lib_LTLIBRARIES = libtls.la EXTRA_DIST = VERSION EXTRA_DIST += CMakeLists.txt EXTRA_DIST += tls.sym +EXTRA_DIST += empty.c CLEANFILES = libtls_la_objects.mk diff --git a/update.sh b/update.sh index c7ff9fb845..1feca33d47 100755 --- a/update.sh +++ b/update.sh @@ -141,6 +141,7 @@ echo "LibreSSL version `cat VERSION`" # copy libcrypto source echo copying libcrypto source rm -f crypto/*.c crypto/*.h +touch crypto/empty.c for i in `awk '/SOURCES|HEADERS/ { print $3 }' crypto/Makefile.am` ; do dir=`dirname $i` mkdir -p crypto/$dir @@ -231,6 +232,7 @@ done # copy libtls source echo copying libtls source rm -f tls/*.c tls/*.h libtls/src/*.c libtls/src/*.h +touch tls/empty.c for i in `awk '/SOURCES|HEADERS/ { print $3 }' tls/Makefile.am` ; do if [ -e $libtls_src/$i ]; then $CP $libtls_src/$i tls @@ -276,6 +278,7 @@ done # copy libssl source echo "copying libssl source" rm -f ssl/*.c ssl/*.h +touch ssl/empty.c for i in `awk '/SOURCES|HEADERS/ { print $3 }' ssl/Makefile.am` ; do dir=`dirname $i` mkdir -p ssl/$dir From 5a414e584a344b7a7afb3701b95cbbf949812d99 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 18 Dec 2022 00:19:26 +0100 Subject: [PATCH 0145/1283] Link new ui_null.c to build --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index bb4343260e..a595022ac1 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -722,6 +722,7 @@ set( txt_db/txt_db.c ui/ui_err.c ui/ui_lib.c + ui/ui_null.c ui/ui_util.c whrlpool/wp_dgst.c x509/by_dir.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index e380fdf706..7105ae4270 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -953,6 +953,7 @@ libcrypto_la_SOURCES += txt_db/txt_db.c # ui libcrypto_la_SOURCES += ui/ui_err.c libcrypto_la_SOURCES += ui/ui_lib.c +libcrypto_la_SOURCES += ui/ui_null.c if !HOST_WIN libcrypto_la_SOURCES += ui/ui_openssl.c endif From ceca77ab3ef30c62308469e9248d746943d156a7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 18 Dec 2022 00:20:42 +0100 Subject: [PATCH 0146/1283] Add BN shift test --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index a7f92cdf9d..6f3be85194 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -180,6 +180,11 @@ add_executable(bn_rand_interval bn_rand_interval.c) target_link_libraries(bn_rand_interval ${OPENSSL_TEST_LIBS}) add_test(bn_rand_interval bn_rand_interval) +# bn_shift +add_executable(bn_shift bn_shift.c) +target_link_libraries(bn_shift ${OPENSSL_TEST_LIBS}) +add_test(bn_shift bn_shift) + # bn_test add_executable(bn_test bn_test.c) set_source_files_properties(bn_test.c PROPERTIES COMPILE_FLAGS diff --git a/tests/Makefile.am b/tests/Makefile.am index 26f6b7d73a..26ed681a13 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -196,6 +196,11 @@ TESTS += bn_rand_interval check_PROGRAMS += bn_rand_interval bn_rand_interval_SOURCES = bn_rand_interval.c +# bn_shift +TESTS += bn_shift +check_PROGRAMS += bn_shift +bn_shift_SOURCES = bn_shift.c + # bn_test TESTS += bn_test bn_test_CPPFLAGS = $(AM_CPPFLAGS) -ULIBRESSL_INTERNAL From 8c4425cd5305bde35f340df47af5b26a457623d3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 18 Dec 2022 00:47:33 +0100 Subject: [PATCH 0147/1283] Patch in use of BN_zero() until next sync --- patches/bn_mod_exp2_mont.patch | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 patches/bn_mod_exp2_mont.patch diff --git a/patches/bn_mod_exp2_mont.patch b/patches/bn_mod_exp2_mont.patch new file mode 100644 index 0000000000..6d5471054e --- /dev/null +++ b/patches/bn_mod_exp2_mont.patch @@ -0,0 +1,11 @@ +--- tests/bn_mod_exp2_mont.c.orig Sun Dec 18 00:42:18 2022 ++++ tests/bn_mod_exp2_mont.c Sun Dec 18 00:42:25 2022 +@@ -32,7 +32,7 @@ main(void) + if ((m = BN_new()) == NULL) + errx(1, "BN_new"); + +- BN_zero_ex(m); ++ BN_zero(m); + + if (BN_mod_exp2_mont(NULL, NULL, NULL, NULL, NULL, m, NULL, NULL)) + errx(1, "BN_mod_exp2_mont succeeded"); From da826ecc77a941f88a13287ad1e1034a3086f389 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 18 Dec 2022 01:16:15 +0100 Subject: [PATCH 0148/1283] Disable bn_shift benchmarks on Windows Windows doesn't know about SIGALRM --- patches/bn_shift.patch | 45 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 patches/bn_shift.patch diff --git a/patches/bn_shift.patch b/patches/bn_shift.patch new file mode 100644 index 0000000000..f0298a2782 --- /dev/null +++ b/patches/bn_shift.patch @@ -0,0 +1,45 @@ +--- tests/bn_shift.c.orig Sun Dec 18 01:05:29 2022 ++++ tests/bn_shift.c Sun Dec 18 01:15:00 2022 +@@ -26,6 +26,10 @@ + + #include + ++#ifndef _MSC_VER ++#define INCLUDE_BENCHMARKS ++#endif ++ + static const char *bn_shift_want_hex = \ + "02AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \ + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8"; +@@ -314,6 +318,8 @@ test_bn_rshift_to_zero(void) + return failed; + } + ++#ifdef INCLUDE_BENCHMARKS ++ + static void + benchmark_bn_lshift1(BIGNUM *bn) + { +@@ -507,9 +513,12 @@ benchmark_run(const struct benchmark *bm, int seconds) + BN_free(bn); + } + ++#endif ++ + static void + benchmark_bn_shift(void) + { ++#ifdef INCLUDE_BENCHMARKS + const struct benchmark *bm; + size_t i; + +@@ -517,6 +526,9 @@ benchmark_bn_shift(void) + bm = &benchmarks[i]; + benchmark_run(bm, 5); + } ++#else ++ return; ++#endif + } + + int From 320501da40a6b43965775a68b5019d86a146e21a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 18 Dec 2022 01:30:19 +0100 Subject: [PATCH 0149/1283] Use bigger hammer to disable benchmarks --- patches/bn_shift.patch | 23 ++++++----------------- 1 file changed, 6 insertions(+), 17 deletions(-) diff --git a/patches/bn_shift.patch b/patches/bn_shift.patch index f0298a2782..446609b8af 100644 --- a/patches/bn_shift.patch +++ b/patches/bn_shift.patch @@ -1,26 +1,15 @@ --- tests/bn_shift.c.orig Sun Dec 18 01:05:29 2022 -+++ tests/bn_shift.c Sun Dec 18 01:15:00 2022 -@@ -26,6 +26,10 @@ - - #include - -+#ifndef _MSC_VER -+#define INCLUDE_BENCHMARKS -+#endif -+ - static const char *bn_shift_want_hex = \ - "02AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \ - "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8"; -@@ -314,6 +318,8 @@ test_bn_rshift_to_zero(void) ++++ tests/bn_shift.c Sun Dec 18 01:29:36 2022 +@@ -314,6 +314,8 @@ test_bn_rshift_to_zero(void) return failed; } -+#ifdef INCLUDE_BENCHMARKS ++#if 0 + static void benchmark_bn_lshift1(BIGNUM *bn) { -@@ -507,9 +513,12 @@ benchmark_run(const struct benchmark *bm, int seconds) +@@ -507,9 +509,12 @@ benchmark_run(const struct benchmark *bm, int seconds) BN_free(bn); } @@ -29,11 +18,11 @@ static void benchmark_bn_shift(void) { -+#ifdef INCLUDE_BENCHMARKS ++#if 0 const struct benchmark *bm; size_t i; -@@ -517,6 +526,9 @@ benchmark_bn_shift(void) +@@ -517,6 +522,9 @@ benchmark_bn_shift(void) bm = &benchmarks[i]; benchmark_run(bm, 5); } From 95ca0d14f7e80702b52c7eb1751d09db2fc869d0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 20 Dec 2022 01:03:40 +0100 Subject: [PATCH 0150/1283] Update rust-openssl patch --- .github/rust-openssl.patch | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/.github/rust-openssl.patch b/.github/rust-openssl.patch index 56a39418b0..9ff4ea0558 100644 --- a/.github/rust-openssl.patch +++ b/.github/rust-openssl.patch @@ -1,14 +1,13 @@ diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs -index 71b36c23..644a318d 100644 +index cdea3eb4..b16ebecf 100644 --- a/openssl-sys/build/main.rs +++ b/openssl-sys/build/main.rs -@@ -281,8 +281,7 @@ See rust-openssl documentation for more information: - (3, 4, _) => ('3', '4', 'x'), +@@ -282,7 +282,7 @@ See rust-openssl documentation for more information: (3, 5, _) => ('3', '5', 'x'), (3, 6, 0) => ('3', '6', '0'), -- (3, 6, _) => ('3', '6', 'x'), -- _ => version_error(), -+ _ => ('3', '6', 'x'), + (3, 6, _) => ('3', '6', 'x'), +- (3, 7, 0) => ('3', '7', '0'), ++ (3, 7, _) => ('3', '7', 'x'), + _ => version_error(), }; - println!("cargo:libressl=true"); From 1124d1fa717605801a68594f8e7ece8267751855 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 4 Jan 2023 06:08:54 -0600 Subject: [PATCH 0151/1283] remove unneeded patch --- patches/bn_mod_exp2_mont.patch | 11 ----------- 1 file changed, 11 deletions(-) delete mode 100644 patches/bn_mod_exp2_mont.patch diff --git a/patches/bn_mod_exp2_mont.patch b/patches/bn_mod_exp2_mont.patch deleted file mode 100644 index 6d5471054e..0000000000 --- a/patches/bn_mod_exp2_mont.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- tests/bn_mod_exp2_mont.c.orig Sun Dec 18 00:42:18 2022 -+++ tests/bn_mod_exp2_mont.c Sun Dec 18 00:42:25 2022 -@@ -32,7 +32,7 @@ main(void) - if ((m = BN_new()) == NULL) - errx(1, "BN_new"); - -- BN_zero_ex(m); -+ BN_zero(m); - - if (BN_mod_exp2_mont(NULL, NULL, NULL, NULL, NULL, m, NULL, NULL)) - errx(1, "BN_mod_exp2_mont succeeded"); From 184955e129e60015e10e46bb6518d41dc9ba1a38 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 4 Jan 2023 06:23:43 -0600 Subject: [PATCH 0152/1283] manpage links --- man/links | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/man/links b/man/links index 09807f3bb7..a88abaa7d4 100644 --- a/man/links +++ b/man/links @@ -150,6 +150,14 @@ BF_set_key.3,BF_ecb_encrypt.3 BF_set_key.3,BF_encrypt.3 BF_set_key.3,BF_ofb64_encrypt.3 BF_set_key.3,BF_options.3 +BIO_accept.3,BIO_get_accept_socket.3 +BIO_accept.3,BIO_get_host_ip.3 +BIO_accept.3,BIO_get_port.3 +BIO_accept.3,BIO_set_tcp_ndelay.3 +BIO_accept.3,BIO_sock_error.3 +BIO_accept.3,BIO_sock_non_fatal_error.3 +BIO_accept.3,BIO_sock_should_retry.3 +BIO_accept.3,BIO_socket_nbio.3 BIO_ctrl.3,BIO_callback_ctrl.3 BIO_ctrl.3,BIO_ctrl_pending.3 BIO_ctrl.3,BIO_ctrl_wpending.3 @@ -170,6 +178,7 @@ BIO_ctrl.3,BIO_wpending.3 BIO_dump.3,BIO_dump_fp.3 BIO_dump.3,BIO_dump_indent.3 BIO_dump.3,BIO_dump_indent_fp.3 +BIO_dup_chain.3,BIO_dup_state.3 BIO_f_asn1.3,BIO_asn1_get_prefix.3 BIO_f_asn1.3,BIO_asn1_get_suffix.3 BIO_f_asn1.3,BIO_asn1_set_prefix.3 @@ -201,11 +210,24 @@ BIO_f_ssl.3,BIO_ssl_shutdown.3 BIO_find_type.3,BIO_method_name.3 BIO_find_type.3,BIO_method_type.3 BIO_find_type.3,BIO_next.3 +BIO_get_data.3,BIO_clear_flags.3 +BIO_get_data.3,BIO_clear_retry_flags.3 +BIO_get_data.3,BIO_copy_next_retry.3 +BIO_get_data.3,BIO_get_flags.3 +BIO_get_data.3,BIO_get_init.3 +BIO_get_data.3,BIO_get_retry_flags.3 BIO_get_data.3,BIO_get_shutdown.3 BIO_get_data.3,BIO_set_data.3 +BIO_get_data.3,BIO_set_flags.3 BIO_get_data.3,BIO_set_init.3 +BIO_get_data.3,BIO_set_retry_read.3 +BIO_get_data.3,BIO_set_retry_special.3 +BIO_get_data.3,BIO_set_retry_write.3 BIO_get_data.3,BIO_set_shutdown.3 +BIO_get_data.3,BIO_test_flags.3 +BIO_get_ex_new_index.3,BIO_get_app_data.3 BIO_get_ex_new_index.3,BIO_get_ex_data.3 +BIO_get_ex_new_index.3,BIO_set_app_data.3 BIO_get_ex_new_index.3,BIO_set_ex_data.3 BIO_get_ex_new_index.3,ECDH_get_ex_data.3 BIO_get_ex_new_index.3,ECDH_get_ex_new_index.3 @@ -219,8 +241,10 @@ BIO_get_ex_new_index.3,EC_KEY_set_ex_data.3 BIO_get_ex_new_index.3,ENGINE_get_ex_data.3 BIO_get_ex_new_index.3,ENGINE_get_ex_new_index.3 BIO_get_ex_new_index.3,ENGINE_set_ex_data.3 +BIO_get_ex_new_index.3,TYPE_get_app_data.3 BIO_get_ex_new_index.3,TYPE_get_ex_data.3 BIO_get_ex_new_index.3,TYPE_get_ex_new_index.3 +BIO_get_ex_new_index.3,TYPE_set_app_data.3 BIO_get_ex_new_index.3,TYPE_set_ex_data.3 BIO_get_ex_new_index.3,UI_get_ex_data.3 BIO_get_ex_new_index.3,UI_get_ex_new_index.3 @@ -255,8 +279,11 @@ BIO_printf.3,BIO_snprintf.3 BIO_printf.3,BIO_vprintf.3 BIO_printf.3,BIO_vsnprintf.3 BIO_push.3,BIO_pop.3 +BIO_push.3,BIO_set_next.3 BIO_read.3,BIO_gets.3 BIO_read.3,BIO_indent.3 +BIO_read.3,BIO_number_read.3 +BIO_read.3,BIO_number_written.3 BIO_read.3,BIO_puts.3 BIO_read.3,BIO_write.3 BIO_s_accept.3,BIO_do_accept.3 @@ -289,6 +316,16 @@ BIO_s_connect.3,BIO_set_conn_int_port.3 BIO_s_connect.3,BIO_set_conn_ip.3 BIO_s_connect.3,BIO_set_conn_port.3 BIO_s_connect.3,BIO_set_nbio.3 +BIO_s_datagram.3,BIO_ctrl_dgram_connect.3 +BIO_s_datagram.3,BIO_ctrl_set_connected.3 +BIO_s_datagram.3,BIO_dgram_get_peer.3 +BIO_s_datagram.3,BIO_dgram_non_fatal_error.3 +BIO_s_datagram.3,BIO_dgram_recv_timedout.3 +BIO_s_datagram.3,BIO_dgram_send_timedout.3 +BIO_s_datagram.3,BIO_dgram_set_peer.3 +BIO_s_datagram.3,BIO_new_dgram.3 +BIO_s_fd.3,BIO_fd_non_fatal_error.3 +BIO_s_fd.3,BIO_fd_should_retry.3 BIO_s_fd.3,BIO_get_fd.3 BIO_s_fd.3,BIO_new_fd.3 BIO_s_fd.3,BIO_set_fd.3 @@ -307,13 +344,17 @@ BIO_s_mem.3,BIO_set_mem_buf.3 BIO_s_mem.3,BIO_set_mem_eof_return.3 BIO_s_socket.3,BIO_new_socket.3 BIO_set_callback.3,BIO_callback_fn.3 +BIO_set_callback.3,BIO_callback_fn_ex.3 BIO_set_callback.3,BIO_debug_callback.3 BIO_set_callback.3,BIO_get_callback.3 BIO_set_callback.3,BIO_get_callback_arg.3 +BIO_set_callback.3,BIO_get_callback_ex.3 BIO_set_callback.3,BIO_set_callback_arg.3 +BIO_set_callback.3,BIO_set_callback_ex.3 BIO_should_retry.3,BIO_get_retry_BIO.3 BIO_should_retry.3,BIO_get_retry_reason.3 BIO_should_retry.3,BIO_retry_type.3 +BIO_should_retry.3,BIO_set_retry_reason.3 BIO_should_retry.3,BIO_should_io_special.3 BIO_should_retry.3,BIO_should_read.3 BIO_should_retry.3,BIO_should_write.3 @@ -1123,8 +1164,12 @@ EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_verify.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_verify_recover.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_verifyctx.3 EVP_PKEY_new.3,EVP_PKEY_free.3 +EVP_PKEY_new.3,EVP_PKEY_get_raw_private_key.3 +EVP_PKEY_new.3,EVP_PKEY_get_raw_public_key.3 EVP_PKEY_new.3,EVP_PKEY_new_CMAC_key.3 EVP_PKEY_new.3,EVP_PKEY_new_mac_key.3 +EVP_PKEY_new.3,EVP_PKEY_new_raw_private_key.3 +EVP_PKEY_new.3,EVP_PKEY_new_raw_public_key.3 EVP_PKEY_new.3,EVP_PKEY_up_ref.3 EVP_PKEY_print_private.3,EVP_PKEY_print_params.3 EVP_PKEY_print_private.3,EVP_PKEY_print_public.3 @@ -2043,9 +2088,13 @@ UI_new.3,UI_get0_user_data.3 UI_new.3,UI_get_default_method.3 UI_new.3,UI_get_method.3 UI_new.3,UI_new_method.3 +UI_new.3,UI_null.3 UI_new.3,UI_process.3 UI_new.3,UI_set_default_method.3 UI_new.3,UI_set_method.3 +X25519.3,ED25519_keypair.3 +X25519.3,ED25519_sign.3 +X25519.3,ED25519_verify.3 X25519.3,X25519_keypair.3 X509V3_get_d2i.3,X509V3_EXT_d2i.3 X509V3_get_d2i.3,X509V3_EXT_i2d.3 From 7f8267d89124e995a3d09cdd863b27268714c42e Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Wed, 11 Jan 2023 11:00:04 +1100 Subject: [PATCH 0153/1283] Github Actions: add Ubuntu-22.04 to linux matrix (#810) --- .github/workflows/linux_test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/linux_test.yml b/.github/workflows/linux_test.yml index 105f891d4f..3afda0498d 100644 --- a/.github/workflows/linux_test.yml +++ b/.github/workflows/linux_test.yml @@ -6,7 +6,7 @@ jobs: build-native: strategy: matrix: - os: [ubuntu-18.04, ubuntu-20.04] + os: [ubuntu-18.04, ubuntu-20.04, ubuntu-22.04] compiler: [clang, gcc] runs-on: ${{ matrix.os }} continue-on-error: false From 49a179f0d9996894aee38cb307c10bbb668273ff Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Wed, 11 Jan 2023 20:05:54 +1100 Subject: [PATCH 0154/1283] Fixes for GitHub organisation rename --- .github/workflows/coverity.yml | 4 ++-- ChangeLog | 6 +++--- README.md | 16 ++++++++-------- README.windows | 2 +- update.sh | 2 +- 5 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 444cc0bb32..f805c33481 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -7,9 +7,9 @@ on: jobs: scan: runs-on: ubuntu-latest - if: ${{ github.repository_owner == 'libressl-portable' }} + if: ${{ github.repository_owner == 'libressl' }} env: - COVERITY_SCAN_PROJECT_NAME: 'libressl-portable/portable' + COVERITY_SCAN_PROJECT_NAME: 'libressl/portable' COVERITY_SCAN_BRANCH_PATTERN: '*' COVERITY_SCAN_NOTIFICATION_EMAIL: 'libressl-security@openbsd.org' COVERITY_SCAN_BUILD_COMMAND_PREPEND: "./autogen.sh && ./configure && make dist && tar zxf libressl-*.tar.gz && rm libressl-*.tar.gz && cd libressl-* && mkdir build-static && mkdir build-shared && cmake -GNinja -DBUILD_SHARED_LIBS=ON .." diff --git a/ChangeLog b/ChangeLog index f38260106b..1a8bb80b01 100644 --- a/ChangeLog +++ b/ChangeLog @@ -19,12 +19,12 @@ with relevant portions of the C library, to a Git repository. This makes it easier to follow all of the relevant changes to the upstream project in a single place: - https://github.com/libressl-portable/openbsd + https://github.com/libressl/openbsd The portable bits of the project are largely maintained out-of-tree, and their history is also available from Git. - https://github.com/libressl-portable/portable + https://github.com/libressl/portable LibreSSL Portable Release Notes: @@ -2602,7 +2602,7 @@ LibreSSL Portable Release Notes: * Address POODLE attack by disabling SSLv3 by default * Fix Eliptical Curve cipher selection bug - (https://github.com/libressl-portable/portable/issues/35) + (https://github.com/libressl/portable/issues/35) 2.1.0 - First release from the OpenBSD 5.7 tree * Added support for automatic ephemeral EC keys diff --git a/README.md b/README.md index 464da18156..f4015a1dc1 100644 --- a/README.md +++ b/README.md @@ -1,12 +1,12 @@ ![LibreSSL image](https://www.libressl.org/images/libressl.jpg) ## Official portable version of [LibreSSL](https://www.libressl.org) ## -[![Linux Build Status](https://github.com/libressl-portable/portable/actions/workflows/linux_test.yml/badge.svg)](https://github.com/libressl-portable/portable/actions/workflows/linux_test.yml) -[![macOS Build Status](https://github.com/libressl-portable/portable/actions/workflows/macos_test.yml/badge.svg)](https://github.com/libressl-portable/portable/actions/workflows/macos_test.yml) -[![Android_Build Status](https://github.com/libressl-portable/portable/actions/workflows/android_test.yml/badge.svg)](https://github.com/libressl-portable/portable/actions/workflows/android_test.yml) -[![Cross_Build Status](https://github.com/libressl-portable/portable/actions/workflows/cross_test.yml/badge.svg)](https://github.com/libressl-portable/portable/actions/workflows/cross_test.yml) +[![Linux Build Status](https://github.com/libressl/portable/actions/workflows/linux_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/linux_test.yml) +[![macOS Build Status](https://github.com/libressl/portable/actions/workflows/macos_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/macos_test.yml) +[![Android_Build Status](https://github.com/libressl/portable/actions/workflows/android_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/android_test.yml) +[![Cross_Build Status](https://github.com/libressl/portable/actions/workflows/cross_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/cross_test.yml) [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/libressl.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:libressl) -[![ASan Status](https://github.com/libressl-portable/portable/actions/workflows/linux_test_asan.yml/badge.svg)](https://github.com/libressl-portable/portable/actions/workflows/linux_test_asan.yml) +[![ASan Status](https://github.com/libressl/portable/actions/workflows/linux_test_asan.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/linux_test_asan.yml) LibreSSL is a fork of [OpenSSL](https://www.openssl.org) 1.0.1g developed by the [OpenBSD](https://www.openbsd.org) project. Our goal is to modernize the codebase, @@ -52,11 +52,11 @@ OpenBSD mirror in directory although we suggest that you use a [mirror](https://www.openbsd.org/ftp.html). The LibreSSL portable build framework is also -[mirrored](https://github.com/libressl-portable/portable) in Github. +[mirrored](https://github.com/libressl/portable) on GitHub. Please report bugs either to the public libressl@openbsd.org mailing list, -or to the github -[issue tracker](https://github.com/libressl-portable/portable/issues) +or to the GitHub +[issue tracker](https://github.com/libressl/portable/issues) Severe vulnerabilities or bugs requiring coordination with OpenSSL can be sent to the core team at libressl-security@openbsd.org. diff --git a/README.windows b/README.windows index a88ddc9cf2..1a9b7b5530 100644 --- a/README.windows +++ b/README.windows @@ -46,7 +46,7 @@ problem. A script for generating ready-to-use .DLL and static .LIB files is included in the source repository at -https://github.com/libressl-portable/portable/blob/master/dist-win.sh +https://github.com/libressl/portable/blob/master/dist-win.sh This script uses mingw-w64 to build LibreSSL and then uses Visual Studio tools to generate compatible library import files ready-to-use with Visual diff --git a/update.sh b/update.sh index 1feca33d47..e73455e634 100755 --- a/update.sh +++ b/update.sh @@ -7,7 +7,7 @@ openbsd_branch=`cat OPENBSD_BRANCH` echo "pulling upstream openbsd source" if [ ! -d openbsd ]; then if [ -z "$LIBRESSL_GIT" ]; then - git clone https://github.com/libressl-portable/openbsd.git + git clone https://github.com/libressl/openbsd.git else git clone $LIBRESSL_GIT/openbsd fi From d8fa0ebd0b42bf8ce940446c51e2ef339176eb63 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Thu, 12 Jan 2023 18:26:56 +1100 Subject: [PATCH 0155/1283] Revert COVERITY_SCAN_PROJECT_NAME change in Coverity workflow --- .github/workflows/coverity.yml | 2 +- .gitignore | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index f805c33481..1bbb1fd672 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest if: ${{ github.repository_owner == 'libressl' }} env: - COVERITY_SCAN_PROJECT_NAME: 'libressl/portable' + COVERITY_SCAN_PROJECT_NAME: 'libressl-portable/portable' COVERITY_SCAN_BRANCH_PATTERN: '*' COVERITY_SCAN_NOTIFICATION_EMAIL: 'libressl-security@openbsd.org' COVERITY_SCAN_BUILD_COMMAND_PREPEND: "./autogen.sh && ./configure && make dist && tar zxf libressl-*.tar.gz && rm libressl-*.tar.gz && cd libressl-* && mkdir build-static && mkdir build-shared && cmake -GNinja -DBUILD_SHARED_LIBS=ON .." diff --git a/.gitignore b/.gitignore index e00baab6dd..dc82e69d9d 100644 --- a/.gitignore +++ b/.gitignore @@ -212,3 +212,7 @@ openbsd/ *.tar.gz man/Makefile.am man/mandoc.db + +# JetBrains IDEs +.idea/ +*.iml \ No newline at end of file From 5fe2c171a5b194664b5521e486b9c310a34ac711 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Thu, 12 Jan 2023 18:37:41 +1100 Subject: [PATCH 0156/1283] Add 'workflow_dispatch' event trigger to Coverity workflow --- .github/workflows/coverity.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 1bbb1fd672..bc0ee0d4cb 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -1,6 +1,7 @@ name: Coverity on: + workflow_dispatch: schedule: - cron: "0 0 * * *" From 01b26d3019c6dc0528194e915bc28e1cda12f884 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Thu, 12 Jan 2023 19:16:39 +1100 Subject: [PATCH 0157/1283] Add a newline to the end of .gitignore --- .gitignore | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index dc82e69d9d..3a0b97f4e4 100644 --- a/.gitignore +++ b/.gitignore @@ -215,4 +215,4 @@ man/mandoc.db # JetBrains IDEs .idea/ -*.iml \ No newline at end of file +*.iml From a7ca886cb03e52718b51f9dd35ea15f28db71a2b Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sat, 11 Feb 2023 06:44:08 -0600 Subject: [PATCH 0158/1283] pin master build to upstream commit --- OPENBSD_BRANCH | 2 +- update.sh | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/OPENBSD_BRANCH b/OPENBSD_BRANCH index 1f7391f92b..d9fd42dcba 100644 --- a/OPENBSD_BRANCH +++ b/OPENBSD_BRANCH @@ -1 +1 @@ -master +5f0541740b8c555fa2c751e63fae55680a69afe6 diff --git a/update.sh b/update.sh index e73455e634..550d03b464 100755 --- a/update.sh +++ b/update.sh @@ -14,8 +14,7 @@ if [ ! -d openbsd ]; then fi (cd openbsd git fetch - git checkout $openbsd_branch - git pull --rebase) + git checkout $openbsd_branch) # setup source paths CWD=`pwd` From 81e6fb0fe9999a51b6d21393247a32cc4e18f738 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 9 Feb 2023 18:42:33 +0100 Subject: [PATCH 0159/1283] Remove obsolete bn_div patch --- patches/bn_div.c.patch | 11 ----------- 1 file changed, 11 deletions(-) delete mode 100644 patches/bn_div.c.patch diff --git a/patches/bn_div.c.patch b/patches/bn_div.c.patch deleted file mode 100644 index 9989e8d0cc..0000000000 --- a/patches/bn_div.c.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- openbsd/src/lib/libcrypto/bn/bn_div.c 2018-08-03 22:40:06.596555542 -0500 -+++ crypto/bn/bn_div.c 2019-01-20 19:26:37.891450640 -0600 -@@ -89,7 +89,7 @@ - q; \ - }) - # define REMAINDER_IS_ALREADY_CALCULATED --# elif defined(__x86_64) -+# elif defined(__x86_64) && defined(_LP64) - /* - * Same story here, but it's 128-bit by 64-bit division. Wow! - * From 7dc7ef81d16f98327321028257e8ecaebe95bfc2 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 9 Feb 2023 18:44:56 +0100 Subject: [PATCH 0160/1283] refresh patches --- patches/bn_shift.patch | 10 +++++----- patches/netcat.c.patch | 28 ++++++++++++++-------------- 2 files changed, 19 insertions(+), 19 deletions(-) diff --git a/patches/bn_shift.patch b/patches/bn_shift.patch index 446609b8af..74a7d9a873 100644 --- a/patches/bn_shift.patch +++ b/patches/bn_shift.patch @@ -1,6 +1,6 @@ ---- tests/bn_shift.c.orig Sun Dec 18 01:05:29 2022 -+++ tests/bn_shift.c Sun Dec 18 01:29:36 2022 -@@ -314,6 +314,8 @@ test_bn_rshift_to_zero(void) +--- tests/bn_shift.c.orig Thu Feb 9 18:42:51 2023 ++++ tests/bn_shift.c Thu Feb 9 18:43:08 2023 +@@ -351,6 +351,8 @@ test_bn_rshift_to_zero(void) return failed; } @@ -9,7 +9,7 @@ static void benchmark_bn_lshift1(BIGNUM *bn) { -@@ -507,9 +509,12 @@ benchmark_run(const struct benchmark *bm, int seconds) +@@ -616,9 +618,12 @@ benchmark_run(const struct benchmark *bm, int seconds) BN_free(bn); } @@ -22,7 +22,7 @@ const struct benchmark *bm; size_t i; -@@ -517,6 +522,9 @@ benchmark_bn_shift(void) +@@ -626,6 +631,9 @@ benchmark_bn_shift(void) bm = &benchmarks[i]; benchmark_run(bm, 5); } diff --git a/patches/netcat.c.patch b/patches/netcat.c.patch index d21466a6b0..f9d4be05c0 100644 --- a/patches/netcat.c.patch +++ b/patches/netcat.c.patch @@ -1,6 +1,6 @@ ---- apps/nc/netcat.c.orig Wed Jun 22 11:15:52 2022 -+++ apps/nc/netcat.c Wed Jun 22 11:15:52 2022 -@@ -93,9 +93,13 @@ +--- apps/nc/netcat.c.orig Thu Feb 9 18:42:55 2023 ++++ apps/nc/netcat.c Thu Feb 9 18:43:08 2023 +@@ -93,9 +93,13 @@ int zflag; /* Port Scan Flag */ int Dflag; /* sodebug */ int Iflag; /* TCP receive buffer size */ int Oflag; /* TCP send buffer size */ @@ -14,7 +14,7 @@ int usetls; /* use TLS */ const char *Cflag; /* Public cert file */ -@@ -269,12 +273,14 @@ +@@ -268,12 +272,14 @@ main(int argc, char *argv[]) case 'u': uflag = 1; break; @@ -29,7 +29,7 @@ case 'v': vflag = 1; break; -@@ -321,9 +327,11 @@ +@@ -320,9 +326,11 @@ main(int argc, char *argv[]) case 'o': oflag = optarg; break; @@ -41,7 +41,7 @@ case 'T': errstr = NULL; errno = 0; -@@ -347,9 +355,11 @@ +@@ -346,9 +354,11 @@ main(int argc, char *argv[]) argc -= optind; argv += optind; @@ -53,7 +53,7 @@ /* Cruft to make sure options are clean, and used properly. */ if (argc == 1 && family == AF_UNIX) { -@@ -945,7 +955,10 @@ +@@ -927,7 +937,10 @@ remote_connect(const char *host, const char *port, str char *ipaddr) { struct addrinfo *res, *res0; @@ -65,7 +65,7 @@ if ((error = getaddrinfo(host, port, &hints, &res0))) errx(1, "getaddrinfo for host \"%s\" port %s: %s", host, -@@ -960,8 +973,10 @@ +@@ -942,8 +955,10 @@ remote_connect(const char *host, const char *port, str if (sflag || pflag) { struct addrinfo ahints, *ares; @@ -76,7 +76,7 @@ memset(&ahints, 0, sizeof(struct addrinfo)); ahints.ai_family = res->ai_family; ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM; -@@ -1053,7 +1068,10 @@ +@@ -1035,7 +1050,10 @@ int local_listen(const char *host, const char *port, struct addrinfo hints) { struct addrinfo *res, *res0; @@ -88,7 +88,7 @@ int error; /* Allow nodename to be null. */ -@@ -1074,9 +1092,11 @@ +@@ -1056,9 +1074,11 @@ local_listen(const char *host, const char *port, struc res->ai_protocol)) == -1) continue; @@ -100,7 +100,7 @@ set_common_sockopts(s, res->ai_family); -@@ -1545,11 +1565,13 @@ +@@ -1557,11 +1577,13 @@ set_common_sockopts(int s, int af) { int x = 1; @@ -114,7 +114,7 @@ if (Dflag) { if (setsockopt(s, SOL_SOCKET, SO_DEBUG, &x, sizeof(x)) == -1) -@@ -1560,9 +1582,16 @@ +@@ -1572,9 +1594,16 @@ set_common_sockopts(int s, int af) IP_TOS, &Tflag, sizeof(Tflag)) == -1) err(1, "set IP ToS"); @@ -131,7 +131,7 @@ } if (Iflag) { if (setsockopt(s, SOL_SOCKET, SO_RCVBUF, -@@ -1586,13 +1615,17 @@ +@@ -1598,13 +1627,17 @@ set_common_sockopts(int s, int af) } if (minttl != -1) { @@ -150,7 +150,7 @@ } } -@@ -1817,15 +1850,19 @@ +@@ -1829,15 +1862,19 @@ help(void) \t-P proxyuser\tUsername for proxy authentication\n\ \t-p port\t Specify local port for remote connects\n\ \t-R CAfile CA bundle\n\ From b0905e6eeeff6fba69b32e943ed2c9fa4c8c5103 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 9 Feb 2023 18:45:33 +0100 Subject: [PATCH 0161/1283] autoconf: x509_verify.h is no longer public --- crypto/Makefile.am | 1 + update.sh | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 7105ae4270..c7e651de2e 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -1037,3 +1037,4 @@ noinst_HEADERS += x509/vpm_int.h noinst_HEADERS += x509/x509_internal.h noinst_HEADERS += x509/x509_issuer_cache.h noinst_HEADERS += x509/x509_local.h +noinst_HEADERS += x509/x509_verify.h diff --git a/update.sh b/update.sh index 550d03b464..9597d95ab1 100755 --- a/update.sh +++ b/update.sh @@ -115,7 +115,7 @@ copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h objects/objects.h asn1/asn1.h bn/bn.h ec/ec.h ecdsa/ecdsa.h ecdh/ecdh.h rsa/rsa.h sha/sha.h x509/x509_vfy.h pkcs7/pkcs7.h pem/pem.h pem/pem2.h hkdf/hkdf.h hmac/hmac.h rand/rand.h md5/md5.h - x509/x509v3.h x509/x509_verify.h conf/conf.h ocsp/ocsp.h + x509/x509v3.h conf/conf.h ocsp/ocsp.h aes/aes.h modes/modes.h asn1/asn1t.h dso/dso.h bf/blowfish.h bio/bio.h cast/cast.h cmac/cmac.h cms/cms.h conf/conf_api.h des/des.h dh/dh.h dsa/dsa.h engine/engine.h ui/ui.h pkcs12/pkcs12.h ts/ts.h From 97124d674264c5bc2b0a7754452aabed399b85cf Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 9 Feb 2023 18:45:55 +0100 Subject: [PATCH 0162/1283] autoconf: update for bn on amd64-elf --- crypto/Makefile.am | 33 +++++++++++++++++++++++++++++++-- crypto/Makefile.am.elf-x86_64 | 15 +++++++++++++++ 2 files changed, 46 insertions(+), 2 deletions(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index c7e651de2e..960b50f2bb 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -411,12 +411,10 @@ noinst_HEADERS += bio/bio_local.h # bn libcrypto_la_SOURCES += bn/bn_add.c -libcrypto_la_SOURCES += bn/bn_asm.c libcrypto_la_SOURCES += bn/bn_blind.c libcrypto_la_SOURCES += bn/bn_bpsw.c libcrypto_la_SOURCES += bn/bn_const.c libcrypto_la_SOURCES += bn/bn_ctx.c -libcrypto_la_SOURCES += bn/bn_depr.c libcrypto_la_SOURCES += bn/bn_div.c libcrypto_la_SOURCES += bn/bn_err.c libcrypto_la_SOURCES += bn/bn_exp.c @@ -441,8 +439,39 @@ libcrypto_la_SOURCES += bn/bn_sqr.c libcrypto_la_SOURCES += bn/bn_sqrt.c libcrypto_la_SOURCES += bn/bn_word.c libcrypto_la_SOURCES += bn/bn_x931p.c +noinst_HEADERS += bn/bn_internal.h noinst_HEADERS += bn/bn_local.h noinst_HEADERS += bn/bn_prime.h +noinst_HEADERS += bn/s2n_bignum.h +noinst_HEADERS += bn/s2n_bignum_internal.h + +# bn/arch +noinst_HEADERS += bn/arch/aarch64/bn_arch.h +noinst_HEADERS += bn/arch/alpha/bn_arch.h +noinst_HEADERS += bn/arch/amd64/bn_arch.h +noinst_HEADERS += bn/arch/arm/bn_arch.h +noinst_HEADERS += bn/arch/hppa/bn_arch.h +noinst_HEADERS += bn/arch/i386/bn_arch.h +noinst_HEADERS += bn/arch/m88k/bn_arch.h +noinst_HEADERS += bn/arch/mips64/bn_arch.h +noinst_HEADERS += bn/arch/powerpc/bn_arch.h +noinst_HEADERS += bn/arch/powerpc64/bn_arch.h +noinst_HEADERS += bn/arch/riscv64/bn_arch.h +noinst_HEADERS += bn/arch/sh/bn_arch.h +noinst_HEADERS += bn/arch/sparc64/bn_arch.h + +# bn/arch/amd64 +EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_add.S +EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_cmadd.S +EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_cmul.S +EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_mul.S +EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_mul_4_8_alt.S +EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_mul_8_16_alt.S +EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_sqr.S +EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_sqr_4_8_alt.S +EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_sqr_8_16_alt.S +EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_sub.S +EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bn_arch.c # buffer libcrypto_la_SOURCES += buffer/buf_err.c diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index 4cd34e2530..f03d424bbe 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -19,6 +19,18 @@ ASM_X86_64_ELF += sha/sha512-elf-x86_64.S ASM_X86_64_ELF += whrlpool/wp-elf-x86_64.S ASM_X86_64_ELF += cpuid-elf-x86_64.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_add.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_cmadd.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_cmul.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_mul.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_mul_4_8_alt.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_mul_8_16_alt.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_4_8_alt.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_8_16_alt.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_sub.S +ASM_X86_64_ELF += bn/arch/amd64/bn_arch.c + EXTRA_DIST += $(ASM_X86_64_ELF) if HOST_ASM_ELF_X86_64 @@ -38,4 +50,7 @@ libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ libcrypto_la_SOURCES += $(ASM_X86_64_ELF) + +# XXX - not the right place for this. It should be done depending on CPU. +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/amd64/ endif From 5427234a789706dcd469d932fb633e4a7f0226ca Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sat, 11 Feb 2023 06:32:04 -0600 Subject: [PATCH 0163/1283] disable asm by default --- configure.ac | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index 8119508672..6080109c35 100644 --- a/configure.ac +++ b/configure.ac @@ -94,8 +94,9 @@ int main() {return 0;} ]) AC_ARG_ENABLE([asm], - AS_HELP_STRING([--disable-asm], [Disable assembly])) -AM_CONDITIONAL([OPENSSL_NO_ASM], [test "x$enable_asm" = "xno"]) + AS_HELP_STRING([--enable-asm], [Enable assembly])) +# Disable below while updating to support upstream assembly changes +AM_CONDITIONAL([OPENSSL_NO_ASM], [test "x$enable_asm" = xyes]) # Conditionally enable assembly by default AM_CONDITIONAL([HOST_ASM_ELF_ARM], From e4c35bbde4335c3d1d5f7a841b35c669e955ddc8 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 13 Feb 2023 16:59:34 -0600 Subject: [PATCH 0164/1283] Revert "pin master build to upstream commit" This reverts commit a7ca886cb03e52718b51f9dd35ea15f28db71a2b. --- OPENBSD_BRANCH | 2 +- update.sh | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/OPENBSD_BRANCH b/OPENBSD_BRANCH index d9fd42dcba..1f7391f92b 100644 --- a/OPENBSD_BRANCH +++ b/OPENBSD_BRANCH @@ -1 +1 @@ -5f0541740b8c555fa2c751e63fae55680a69afe6 +master diff --git a/update.sh b/update.sh index 9597d95ab1..2a0abd310a 100755 --- a/update.sh +++ b/update.sh @@ -14,7 +14,8 @@ if [ ! -d openbsd ]; then fi (cd openbsd git fetch - git checkout $openbsd_branch) + git checkout $openbsd_branch + git pull --rebase) # setup source paths CWD=`pwd` From 59492d5c9fa784cdd5bdb25585ec919854ad01c4 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 13 Feb 2023 20:10:15 -0600 Subject: [PATCH 0165/1283] update bn_shift patch --- patches/bn_shift.patch | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/patches/bn_shift.patch b/patches/bn_shift.patch index 74a7d9a873..dd1fb9b35a 100644 --- a/patches/bn_shift.patch +++ b/patches/bn_shift.patch @@ -1,6 +1,6 @@ ---- tests/bn_shift.c.orig Thu Feb 9 18:42:51 2023 -+++ tests/bn_shift.c Thu Feb 9 18:43:08 2023 -@@ -351,6 +351,8 @@ test_bn_rshift_to_zero(void) +--- tests/bn_shift.c.orig 2023-02-13 20:06:27.295678033 -0600 ++++ tests/bn_shift.c 2023-02-13 20:08:08.335677654 -0600 +@@ -355,6 +355,8 @@ return failed; } @@ -9,7 +9,7 @@ static void benchmark_bn_lshift1(BIGNUM *bn) { -@@ -616,9 +618,12 @@ benchmark_run(const struct benchmark *bm, int seconds) +@@ -620,9 +622,12 @@ BN_free(bn); } @@ -22,7 +22,7 @@ const struct benchmark *bm; size_t i; -@@ -626,6 +631,9 @@ benchmark_bn_shift(void) +@@ -630,6 +635,9 @@ bm = &benchmarks[i]; benchmark_run(bm, 5); } From e5e36ec6ec6f665c8bbb0e42c55033df98277fe2 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 13 Feb 2023 20:13:52 -0600 Subject: [PATCH 0166/1283] remove obsolete and duplicated file references --- crypto/Makefile.am | 16 ---------------- 1 file changed, 16 deletions(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 960b50f2bb..09a22e6502 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -418,7 +418,6 @@ libcrypto_la_SOURCES += bn/bn_ctx.c libcrypto_la_SOURCES += bn/bn_div.c libcrypto_la_SOURCES += bn/bn_err.c libcrypto_la_SOURCES += bn/bn_exp.c -libcrypto_la_SOURCES += bn/bn_exp2.c libcrypto_la_SOURCES += bn/bn_gcd.c libcrypto_la_SOURCES += bn/bn_gf2m.c libcrypto_la_SOURCES += bn/bn_isqrt.c @@ -460,19 +459,6 @@ noinst_HEADERS += bn/arch/riscv64/bn_arch.h noinst_HEADERS += bn/arch/sh/bn_arch.h noinst_HEADERS += bn/arch/sparc64/bn_arch.h -# bn/arch/amd64 -EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_add.S -EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_cmadd.S -EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_cmul.S -EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_mul.S -EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_mul_4_8_alt.S -EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_mul_8_16_alt.S -EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_sqr.S -EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_sqr_4_8_alt.S -EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_sqr_8_16_alt.S -EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bignum_sub.S -EXTRA_libcrypto_la_SOURCES += ./bn/arch/amd64/bn_arch.c - # buffer libcrypto_la_SOURCES += buffer/buf_err.c libcrypto_la_SOURCES += buffer/buf_str.c @@ -616,8 +602,6 @@ libcrypto_la_SOURCES += dsa/dsa_meth.c libcrypto_la_SOURCES += dsa/dsa_ossl.c libcrypto_la_SOURCES += dsa/dsa_pmeth.c libcrypto_la_SOURCES += dsa/dsa_prn.c -libcrypto_la_SOURCES += dsa/dsa_sign.c -libcrypto_la_SOURCES += dsa/dsa_vrf.c noinst_HEADERS += dsa/dsa_local.h # dso From d36629044db1f6f074a26dc502c9cff7a09fd374 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 13 Feb 2023 21:10:32 -0600 Subject: [PATCH 0167/1283] directly grab bn asm source --- update.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/update.sh b/update.sh index 2a0abd310a..3d0a608e6c 100755 --- a/update.sh +++ b/update.sh @@ -151,6 +151,13 @@ for i in `awk '/SOURCES|HEADERS/ { print $3 }' crypto/Makefile.am` ; do fi fi done + +for i in $libcrypto_src/bn/arch/*; do + arch=`basename $i` + mkdir -p crypto/bn/arch/$arch + $CP $libcrypto_src/bn/arch/$arch/* crypto/bn/arch/$arch/ +done + $CP crypto/compat/b_win.c crypto/bio $CP crypto/compat/ui_openssl_win.c crypto/ui # add the libcrypto symbol export list From 20fb2bdb1197008f46c080b8539084c69b7a8c92 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 14 Feb 2023 02:52:10 -0600 Subject: [PATCH 0168/1283] add CPU checks, include initial bn_arch.h headers --- configure.ac | 17 ++++++++++++++- crypto/Makefile.am | 41 ++++++++++++++++++++++++++++++----- crypto/Makefile.am.elf-x86_64 | 3 --- 3 files changed, 52 insertions(+), 9 deletions(-) diff --git a/configure.ac b/configure.ac index 6080109c35..87c6d5bf91 100644 --- a/configure.ac +++ b/configure.ac @@ -76,11 +76,26 @@ AM_CONDITIONAL([ENABLE_TESTS], [test "x$enable_tests" = xyes]) AS_CASE([$host_cpu], [*arm*], [host_cpu=arm], [*amd64*], [host_cpu=x86_64 HOSTARCH=intel], - [i?86], [HOSTARCH=intel], + [i?86], [host_cpu=i386 HOSTARCH=intel], + [mipsel*], [host_cpu=mips], + [mips64el*], [host_cpu=mips64], + [powerpc*], [host_cpu=powerpc], + [ppc64*], [host_cpu=powerpc64], [x86_64], [HOSTARCH=intel] ) AM_CONDITIONAL([HOST_CPU_IS_INTEL], [test "x$HOSTARCH" = "xintel"]) +AM_CONDITIONAL([HOST_AARCH64], [test "$host_cpu" = "aarch64"]) +AM_CONDITIONAL([HOST_ARM], [test "$host_cpu" = "arm"]) +AM_CONDITIONAL([HOST_I386], [test "$host_cpu" = "i386"]) +AM_CONDITIONAL([HOST_MIPS], [test "$host_cpu" = "mips"]) +AM_CONDITIONAL([HOST_MIPS64], [test "$host_cpu" = "mips64"]) +AM_CONDITIONAL([HOST_POWERPC], [test "$host_cpu" = "powerpc"]) +AM_CONDITIONAL([HOST_POWERPC64], [test "$host_cpu" = "ppc64"]) +AM_CONDITIONAL([HOST_RISCV64], [test "$host_cpu" = "riscv64"]) +AM_CONDITIONAL([HOST_SPARC64], [test "$host_cpu" = "sparc64"]) +AM_CONDITIONAL([HOST_X86_64], [test "$host_cpu" = "x86_64"]) + AC_MSG_CHECKING([if .gnu.warning accepts long strings]) AC_LINK_IFELSE([AC_LANG_SOURCE([[ extern void SSLv3_method(); diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 09a22e6502..733dcbdf36 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -445,20 +445,51 @@ noinst_HEADERS += bn/s2n_bignum.h noinst_HEADERS += bn/s2n_bignum_internal.h # bn/arch +if HOST_AARCH64 +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/aarch64/ +endif noinst_HEADERS += bn/arch/aarch64/bn_arch.h -noinst_HEADERS += bn/arch/alpha/bn_arch.h -noinst_HEADERS += bn/arch/amd64/bn_arch.h + +if HOST_ARM +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/arm/ +endif noinst_HEADERS += bn/arch/arm/bn_arch.h -noinst_HEADERS += bn/arch/hppa/bn_arch.h + +if HOST_I386 +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/i386/ +endif noinst_HEADERS += bn/arch/i386/bn_arch.h -noinst_HEADERS += bn/arch/m88k/bn_arch.h + +if HOST_MIPS64 +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/mips64/ +endif noinst_HEADERS += bn/arch/mips64/bn_arch.h + +if HOST_POWERPC +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/powerpc/ +endif noinst_HEADERS += bn/arch/powerpc/bn_arch.h + +if HOST_POWERPC64 +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/powerpc64/ +endif noinst_HEADERS += bn/arch/powerpc64/bn_arch.h + +if HOST_RISCV64 +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/riscv64/ +endif noinst_HEADERS += bn/arch/riscv64/bn_arch.h -noinst_HEADERS += bn/arch/sh/bn_arch.h + +if HOST_SPARC64 +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/sparc64/ +endif noinst_HEADERS += bn/arch/sparc64/bn_arch.h +if HOST_X86_64 +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/amd64/ +endif +noinst_HEADERS += bn/arch/amd64/bn_arch.h + # buffer libcrypto_la_SOURCES += buffer/buf_err.c libcrypto_la_SOURCES += buffer/buf_str.c diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index f03d424bbe..cc6ea99c9d 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -50,7 +50,4 @@ libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ libcrypto_la_SOURCES += $(ASM_X86_64_ELF) - -# XXX - not the right place for this. It should be done depending on CPU. -libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/amd64/ endif From 3c7747fd8bcaaf2eb2f901c34d573bae52fea0c5 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 15 Feb 2023 07:56:44 -0600 Subject: [PATCH 0169/1283] generate opensslconf.h based on host cpu architecture --- .gitignore | 2 ++ Makefile.am | 2 +- Makefile.am.common | 4 +++- include/Makefile.am | 14 ++++++++++++++ include/openssl/opensslconf.h.in | 15 +++++++++++++++ patches/opensslconf.h.patch | 24 ------------------------ update.sh | 7 ++++++- 7 files changed, 41 insertions(+), 27 deletions(-) create mode 100644 include/openssl/opensslconf.h.in delete mode 100644 patches/opensslconf.h.patch diff --git a/.gitignore b/.gitignore index 3a0b97f4e4..a47dd50289 100644 --- a/.gitignore +++ b/.gitignore @@ -145,6 +145,7 @@ stamp-h1 stamp-h2 include/openssl/Makefile.am +include/arch VERSION crypto/VERSION @@ -152,6 +153,7 @@ ssl/VERSION tls/VERSION libtls-standalone/VERSION +ssl/hidden ssl/*.c ssl/*.h tls/*.c diff --git a/Makefile.am b/Makefile.am index ed59df0bf5..d28692a23d 100644 --- a/Makefile.am +++ b/Makefile.am @@ -1,4 +1,4 @@ -SUBDIRS = crypto ssl tls include apps man +SUBDIRS = include crypto ssl tls apps man if ENABLE_TESTS SUBDIRS += tests endif diff --git a/Makefile.am.common b/Makefile.am.common index 87aa807031..5405704b23 100644 --- a/Makefile.am.common +++ b/Makefile.am.common @@ -1,3 +1,5 @@ AM_CFLAGS = -AM_CPPFLAGS = -I$(top_srcdir)/include -I$(top_srcdir)/include/compat -DLIBRESSL_INTERNAL +AM_CPPFLAGS = -I$(top_srcdir)/include +AM_CPPFLAGS += -I$(abs_top_builddir)/include +AM_CPPFLAGS += -I$(top_srcdir)/include/compat -DLIBRESSL_INTERNAL AM_CPPFLAGS += -D__BEGIN_HIDDEN_DECLS= -D__END_HIDDEN_DECLS= diff --git a/include/Makefile.am b/include/Makefile.am index aed67211e9..26e82fe39d 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -44,4 +44,18 @@ noinst_HEADERS += compat/sys/time.h noinst_HEADERS += compat/sys/types.h noinst_HEADERS += compat/sys/uio.h +noinst_HEADERS += arch/aarch64/opensslconf.h +noinst_HEADERS += arch/alpha/opensslconf.h +noinst_HEADERS += arch/amd64/opensslconf.h +noinst_HEADERS += arch/arm/opensslconf.h +noinst_HEADERS += arch/hppa/opensslconf.h +noinst_HEADERS += arch/i386/opensslconf.h +noinst_HEADERS += arch/m88k/opensslconf.h +noinst_HEADERS += arch/mips64/opensslconf.h +noinst_HEADERS += arch/powerpc/opensslconf.h +noinst_HEADERS += arch/powerpc64/opensslconf.h +noinst_HEADERS += arch/riscv64/opensslconf.h +noinst_HEADERS += arch/sh/opensslconf.h +noinst_HEADERS += arch/sparc64/opensslconf.h + include_HEADERS = tls.h diff --git a/include/openssl/opensslconf.h.in b/include/openssl/opensslconf.h.in new file mode 100644 index 0000000000..8842f00d39 --- /dev/null +++ b/include/openssl/opensslconf.h.in @@ -0,0 +1,15 @@ +#if defined(_MSC_VER) && !defined(__clang__) && !defined(__attribute__) +#define __attribute__(a) +#endif + +#if defined(LIBRESSL_INTERNAL) && !defined(LIBRESSL_NAMESPACE) +# define LCRYPTO_UNUSED(x) +# define LCRYPTO_USED(x) +# define LCRYPTO_ALIAS1(pre, x) +# define LCRYPTO_ALIAS(x) + +# define LSSL_UNUSED(x) +# define LSSL_USED(x) +# define LSSL_ALIAS(x) +#endif /* LIBRESSL_INTERNAL && !LIBRESSL_NAMESPACE */ + diff --git a/patches/opensslconf.h.patch b/patches/opensslconf.h.patch deleted file mode 100644 index ee5d645bd7..0000000000 --- a/patches/opensslconf.h.patch +++ /dev/null @@ -1,24 +0,0 @@ ---- include/openssl/opensslconf.h.orig Tue Nov 22 21:08:27 2022 -+++ include/openssl/opensslconf.h Wed Nov 23 12:38:07 2022 -@@ -1,6 +1,21 @@ - #include - /* crypto/opensslconf.h.in */ - -+#if defined(_MSC_VER) && !defined(__clang__) && !defined(__attribute__) -+#define __attribute__(a) -+#endif -+ -+#if defined(LIBRESSL_INTERNAL) && !defined(LIBRESSL_NAMESPACE) -+# define LCRYPTO_UNUSED(x) -+# define LCRYPTO_USED(x) -+# define LCRYPTO_ALIAS1(pre, x) -+# define LCRYPTO_ALIAS(x) -+ -+# define LSSL_UNUSED(x) -+# define LSSL_USED(x) -+# define LSSL_ALIAS(x) -+#endif /* LIBRESSL_INTERNAL && !LIBRESSL_NAMESPACE */ -+ - #if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR) - #define OPENSSLDIR "/etc/ssl" - #endif diff --git a/update.sh b/update.sh index 3d0a608e6c..29600a4703 100755 --- a/update.sh +++ b/update.sh @@ -70,7 +70,6 @@ fi $CP $libssl_src/LICENSE COPYING -$CP $libcrypto_src/arch/amd64/opensslconf.h include/openssl $CP $libcrypto_src/opensslfeatures.h include/openssl $CP $libssl_src/pqueue.h include @@ -152,6 +151,12 @@ for i in `awk '/SOURCES|HEADERS/ { print $3 }' crypto/Makefile.am` ; do fi done +for i in $libcrypto_src/arch/*; do + arch=`basename $i` + mkdir -p include/arch/$arch + $CP $libcrypto_src/arch/$arch/opensslconf.h include/arch/$arch/ +done + for i in $libcrypto_src/bn/arch/*; do arch=`basename $i` mkdir -p crypto/bn/arch/$arch From c3e1e50cb19621ec5bcea424868f8e70fde60cdf Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 15 Feb 2023 19:32:16 -0600 Subject: [PATCH 0170/1283] update Makefile.am.tpl to build and install correct opensslconf.h --- include/openssl/Makefile.am.tpl | 38 ++++++++++++++++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) diff --git a/include/openssl/Makefile.am.tpl b/include/openssl/Makefile.am.tpl index 1bea34d050..167183a394 100644 --- a/include/openssl/Makefile.am.tpl +++ b/include/openssl/Makefile.am.tpl @@ -3,4 +3,40 @@ include $(top_srcdir)/Makefile.am.common if !ENABLE_LIBTLS_ONLY opensslincludedir=$(includedir)/openssl -opensslinclude_HEADERS = +noinst_HEADERS = opensslconf.h.in +BUILT_SOURCES = opensslconf.h +CLEANFILES = opensslconf.h + +opensslconf.h: opensslconf.h.in Makefile + -echo "generating opensslconf.h ..." + -cp $(top_srcdir)/include/openssl/opensslconf.h.in opensslconf.h + -chmod u+w opensslconf.h +if HOST_AARCH64 + -cat $(top_srcdir)/include/arch/aarch64/opensslconf.h >> opensslconf.h +endif +if HOST_ARM + -cat $(top_srcdir)/include/arch/arm/opensslconf.h >> opensslconf.h +endif +if HOST_I386 + -cat $(top_srcdir)/include/arch/i386/opensslconf.h >> opensslconf.h +endif +if HOST_MIPS64 + -cat $(top_srcdir)/include/arch/mips64/opensslconf.h >> opensslconf.h +endif +if HOST_POWERPC + -cat $(top_srcdir)/include/arch/powerpc/opensslconf.h >> opensslconf.h +endif +if HOST_POWERPC64 + -cat $(top_srcdir)/include/arch/powerpc64/opensslconf.h >> opensslconf.h +endif +if HOST_RISCV64 + -cat $(top_srcdir)/include/arch/riscv64/opensslconf.h >> opensslconf.h +endif +if HOST_SPARC64 + -cat $(top_srcdir)/include/arch/sparc64/opensslconf.h >> opensslconf.h +endif +if HOST_X86_64 + -cat $(top_srcdir)/include/arch/amd64/opensslconf.h >> opensslconf.h +endif + +opensslinclude_HEADERS = opensslconf.h From 8fc30eca61f019a784d06797bfb1805d26073814 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 21 Feb 2023 00:25:04 -0600 Subject: [PATCH 0171/1283] generate and include arch-specific headers for CMake builds --- CMakeLists.txt | 28 +++++++++++++++++++++++++++- crypto/CMakeLists.txt | 37 ++++++++++++++++++++++++++++++++----- include/CMakeLists.txt | 23 +++++++++++++++++++++++ 3 files changed, 82 insertions(+), 6 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 68a7c2dfe2..5fddd7f227 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -306,6 +306,32 @@ if(HAVE_NETINET_IP_H) add_definitions(-DHAVE_NETINET_IP_H) endif() +if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(aarch64|arm64)") + set(HOST_AARCH64 true) +elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm") + set(HOST_ARM true) +elseif("${CMAKE_SYSTEM_NAME}" STREQUAL "SunOS" AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "i386") + set(HOST_X86_64 true) +elseif("${CMAKE_SYSTEM_NAME}" STREQUAL "i386") + set(HOST_I386 true) +elseif("${CMAKE_SYSTEM_NAME}" STREQUAL "mips64") + set(HOST_MIPS64 true) +elseif("${CMAKE_SYSTEM_NAME}" MATCHES "mips") + set(HOST_MIPS true) +elseif("${CMAKE_SYSTEM_NAME}" MATCHES "powerpc") + set(HOST_POWERPC true) +elseif("${CMAKE_SYSTEM_NAME}" MATCHES "ppc64") + set(HOST_PPC64 true) +elseif("${CMAKE_SYSTEM_NAME}" MATCHES "riscv64") + set(HOST_RISCV64 true) +elseif("${CMAKE_SYSTEM_NAME}" MATCHES "sparc64") + set(HOST_SPARC64 true) +elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64)") + set(HOST_X86_64 true) +else() + set(ENABLE_ASM false) +endif() + if(ENABLE_ASM) if("${CMAKE_C_COMPILER_ABI}" STREQUAL "ELF") if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64)") @@ -361,13 +387,13 @@ else() set(LIBTLS_TEST_LIBS tls ${PLATFORM_LIBS}) endif() +add_subdirectory(include) add_subdirectory(crypto) add_subdirectory(ssl) if(LIBRESSL_APPS) add_subdirectory(apps) endif() add_subdirectory(tls) -add_subdirectory(include) if(NOT MSVC) add_subdirectory(man) endif() diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index a595022ac1..65bdf49320 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -47,6 +47,18 @@ if(HOST_ASM_ELF_X86_64) sha/sha512-elf-x86_64.S whrlpool/wp-elf-x86_64.S cpuid-elf-x86_64.S + + bn/arch/amd64/bignum_add.S + bn/arch/amd64/bignum_cmadd.S + bn/arch/amd64/bignum_cmul.S + bn/arch/amd64/bignum_mul.S + bn/arch/amd64/bignum_mul_4_8_alt.S + bn/arch/amd64/bignum_mul_8_16_alt.S + bn/arch/amd64/bignum_sqr.S + bn/arch/amd64/bignum_sqr_4_8_alt.S + bn/arch/amd64/bignum_sqr_8_16_alt.S + bn/arch/amd64/bignum_sub.S + bn/arch/amd64/bn_arch.c ) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) @@ -331,16 +343,13 @@ set( bio/bss_null.c bio/bss_sock.c bn/bn_add.c - bn/bn_asm.c bn/bn_blind.c bn/bn_bpsw.c bn/bn_const.c bn/bn_ctx.c - bn/bn_depr.c bn/bn_div.c bn/bn_err.c bn/bn_exp.c - bn/bn_exp2.c bn/bn_gcd.c bn/bn_gf2m.c bn/bn_isqrt.c @@ -461,8 +470,6 @@ set( dsa/dsa_ossl.c dsa/dsa_pmeth.c dsa/dsa_prn.c - dsa/dsa_sign.c - dsa/dsa_vrf.c dso/dso_dlfcn.c dso/dso_err.c dso/dso_lib.c @@ -1010,6 +1017,26 @@ target_include_directories(crypto_obj PUBLIC ../include) +if(HOST_AARCH64) + target_include_directories(crypto_obj PRIVATE bn/arch/aarch64/) +elseif(HOST_ARM) + target_include_directories(crypto_obj PRIVATE bn/arch/arm/) +elseif(HOST_I386) + target_include_directories(crypto_obj PRIVATE bn/arch/i386/) +elseif(HOST_MIPS64) + target_include_directories(crypto_obj PRIVATE bn/arch/mips64) +elseif(HOST_POWERPC) + target_include_directories(crypto_obj PRIVATE bn/arch/powerpc) +elseif(HOST_POWERPC64) + target_include_directories(crypto_obj PRIVATE bn/arch/powerpc64) +elseif(HOST_RISCV64) + target_include_directories(crypto_obj PRIVATE bn/arch/riscv64) +elseif(HOST_SPARC64) + target_include_directories(crypto_obj PRIVATE bn/arch/sparc64) +elseif(HOST_X86_64) + target_include_directories(crypto_obj PRIVATE bn/arch/amd64) +endif() + add_library(crypto $ empty.c) export_symbol(crypto ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym) diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt index 1d1a15932e..dafdee74af 100644 --- a/include/CMakeLists.txt +++ b/include/CMakeLists.txt @@ -6,3 +6,26 @@ if(ENABLE_LIBRESSL_INSTALL) PATTERN "pqueue.h" EXCLUDE PATTERN "Makefile*" EXCLUDE) endif(ENABLE_LIBRESSL_INSTALL) + +file(READ openssl/opensslconf.h.in OPENSSLCONF) +file(WRITE openssl/opensslconf.h "${OPENSSLCONF}") +if(HOST_AARCH64) + file(READ arch/aarch64/opensslconf.h OPENSSLCONF) +elseif(HOST_ARM) + file(READ arch/arm/opensslconf.h OPENSSLCONF) +elseif(HOST_I386) + file(READ arch/i386/opensslconf.h OPENSSLCONF) +elseif(HOST_MIPS64) + file(READ arch/mips64/opensslconf.h OPENSSLCONF) +elseif(HOST_POWERPC) + file(READ arch/powerpc/opensslconf.h OPENSSLCONF) +elseif(HOST_POWERPC64) + file(READ arch/powerpc64/opensslconf.h OPENSSLCONF) +elseif(HOST_RISCV64) + file(READ arch/riscv64/opensslconf.h OPENSSLCONF) +elseif(HOST_SPARC64) + file(READ arch/sparc64/opensslconf.h OPENSSLCONF) +elseif(HOST_X86_64) + file(READ arch/amd64/opensslconf.h OPENSSLCONF) +endif() +file(APPEND openssl/opensslconf.h "${OPENSSLCONF}") From 5a695723ab8f123ce8eeab9deef7aa8ced076c09 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 21 Feb 2023 01:13:08 -0600 Subject: [PATCH 0172/1283] disable BN ASM for aarch64 for now (fails tests) --- CMakeLists.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index 5fddd7f227..17554fca5b 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -308,6 +308,7 @@ endif() if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(aarch64|arm64)") set(HOST_AARCH64 true) + set(ENABLE_ASM false) elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm") set(HOST_ARM true) elseif("${CMAKE_SYSTEM_NAME}" STREQUAL "SunOS" AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "i386") From 4bcb537aa88dd59877cf0137210f7eabe42ea632 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 21 Feb 2023 01:13:29 -0600 Subject: [PATCH 0173/1283] generally disable asm for now --- CMakeLists.txt | 5 ++++- configure.ac | 6 ++++-- crypto/CMakeLists.txt | 12 ++++++++++++ crypto/Makefile.am.macosx-x86_64 | 12 ++++++++++++ 4 files changed, 32 insertions(+), 3 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 17554fca5b..66d04ba2c0 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -308,6 +308,7 @@ endif() if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(aarch64|arm64)") set(HOST_AARCH64 true) + # disable for now (fails tests) set(ENABLE_ASM false) elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm") set(HOST_ARM true) @@ -344,7 +345,9 @@ if(ENABLE_ASM) endif() add_definitions(-DHAVE_GNU_STACK) elseif(APPLE AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "x86_64") - set(HOST_ASM_MACOSX_X86_64 true) + # disable for now (.section .rodata invalid) + # set(HOST_ASM_MACOSX_X86_64 true) + set(ENABLE_ASM false) elseif(MSVC AND ("${CMAKE_GENERATOR}" MATCHES "Win64" OR "${CMAKE_GENERATOR_PLATFORM}" STREQUAL "x64")) set(HOST_ASM_MASM_X86_64 true) ENABLE_LANGUAGE(ASM_MASM) diff --git a/configure.ac b/configure.ac index 87c6d5bf91..e2f3cd2c06 100644 --- a/configure.ac +++ b/configure.ac @@ -109,15 +109,17 @@ int main() {return 0;} ]) AC_ARG_ENABLE([asm], - AS_HELP_STRING([--enable-asm], [Enable assembly])) + AS_HELP_STRING([--disable-asm], [Disable assembly])) # Disable below while updating to support upstream assembly changes -AM_CONDITIONAL([OPENSSL_NO_ASM], [test "x$enable_asm" = xyes]) +AM_CONDITIONAL([OPENSSL_NO_ASM], [true]) +# AM_CONDITIONAL([OPENSSL_NO_ASM], [test "x$enable_asm" = "xno"]) # Conditionally enable assembly by default AM_CONDITIONAL([HOST_ASM_ELF_ARM], [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "arm" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_ELF_X86_64], [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "x86_64" -a "x$enable_asm" != "xno"]) + AM_CONDITIONAL([HOST_ASM_MACOSX_X86_64], [test "x$HOST_ABI" = "xmacosx" -a "$host_cpu" = "x86_64" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_MASM_X86_64], diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 65bdf49320..5611881ec6 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -101,6 +101,18 @@ if(HOST_ASM_MACOSX_X86_64) sha/sha512-macosx-x86_64.S whrlpool/wp-macosx-x86_64.S cpuid-macosx-x86_64.S + + bn/arch/amd64/bignum_add.S + bn/arch/amd64/bignum_cmadd.S + bn/arch/amd64/bignum_cmul.S + bn/arch/amd64/bignum_mul.S + bn/arch/amd64/bignum_mul_4_8_alt.S + bn/arch/amd64/bignum_mul_8_16_alt.S + bn/arch/amd64/bignum_sqr.S + bn/arch/amd64/bignum_sqr_4_8_alt.S + bn/arch/amd64/bignum_sqr_8_16_alt.S + bn/arch/amd64/bignum_sub.S + bn/arch/amd64/bn_arch.c ) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index 211815643a..e11dd3c8fb 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -19,6 +19,18 @@ ASM_X86_64_MACOSX += sha/sha512-macosx-x86_64.S ASM_X86_64_MACOSX += whrlpool/wp-macosx-x86_64.S ASM_X86_64_MACOSX += cpuid-macosx-x86_64.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_add.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_cmadd.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_cmul.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul_4_8_alt.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul_8_16_alt.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_4_8_alt.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_8_16_alt.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sub.S +ASM_X86_64_MACOSX += bn/arch/amd64/bn_arch.c + EXTRA_DIST += $(ASM_X86_64_MACOSX) if HOST_ASM_MACOSX_X86_64 From 70b0f418d30da7e1fe34c4cbebc90fdb95d6a649 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 21 Feb 2023 05:57:41 -0600 Subject: [PATCH 0174/1283] remove unused patch --- patches/bn_local.h.patch | 11 ----------- 1 file changed, 11 deletions(-) delete mode 100644 patches/bn_local.h.patch diff --git a/patches/bn_local.h.patch b/patches/bn_local.h.patch deleted file mode 100644 index 2378ec7c27..0000000000 --- a/patches/bn_local.h.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- ./crypto/bn/bn_local.h.orig Fri Feb 18 16:30:39 2022 -+++ ./crypto/bn/bn_local.h Mon Feb 21 05:39:35 2022 -@@ -283,7 +283,7 @@ - : "r"(a), "r"(b)); \ - ret; }) - # endif /* compiler */ --# elif defined(__x86_64) || defined(__x86_64__) -+# elif (defined(__x86_64) || defined(__x86_64__)) && defined(_LP64) - # if defined(__GNUC__) && __GNUC__>=2 - # define BN_UMULT_HIGH(a,b) ({ \ - BN_ULONG ret,discard; \ From 8c2c718bb7767d9fea1be1e0bc52b64775de6f21 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 21 Feb 2023 06:01:38 -0600 Subject: [PATCH 0175/1283] Ubuntu 18.04 is getting removed, update Linux base images --- .github/workflows/android_test.yml | 4 ++-- .github/workflows/cross_test.yml | 2 +- .github/workflows/linux_test.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/android_test.yml b/.github/workflows/android_test.yml index 4ecbfacc13..ebce7948d2 100644 --- a/.github/workflows/android_test.yml +++ b/.github/workflows/android_test.yml @@ -4,7 +4,7 @@ on: [push, pull_request] jobs: build-android-8-9: - runs-on: ubuntu-18.04 + runs-on: ubuntu-22.04 continue-on-error: false env: ARCH: android @@ -17,7 +17,7 @@ jobs: run: ./scripts/test build-android-10-11: - runs-on: ubuntu-18.04 + runs-on: ubuntu-22.04 continue-on-error: false env: ARCH: android diff --git a/.github/workflows/cross_test.yml b/.github/workflows/cross_test.yml index af093096b4..649cd2f698 100644 --- a/.github/workflows/cross_test.yml +++ b/.github/workflows/cross_test.yml @@ -6,7 +6,7 @@ jobs: build-other: strategy: matrix: - os: [ubuntu-18.04, ubuntu-20.04] + os: [ubuntu-20.04, ubuntu-22.04] arch: [mingw32, mingw64, arm32, arm64] runs-on: ${{ matrix.os }} continue-on-error: false diff --git a/.github/workflows/linux_test.yml b/.github/workflows/linux_test.yml index 3afda0498d..94bef31544 100644 --- a/.github/workflows/linux_test.yml +++ b/.github/workflows/linux_test.yml @@ -6,7 +6,7 @@ jobs: build-native: strategy: matrix: - os: [ubuntu-18.04, ubuntu-20.04, ubuntu-22.04] + os: [ubuntu-20.04, ubuntu-22.04] compiler: [clang, gcc] runs-on: ${{ matrix.os }} continue-on-error: false From a64adc58115b9e54b3494c4ba7b56392dd58286e Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 21 Feb 2023 09:37:47 -0600 Subject: [PATCH 0176/1283] disable asm for autoconf tests as well --- configure.ac | 1 + 1 file changed, 1 insertion(+) diff --git a/configure.ac b/configure.ac index e2f3cd2c06..d8bf28eadf 100644 --- a/configure.ac +++ b/configure.ac @@ -112,6 +112,7 @@ AC_ARG_ENABLE([asm], AS_HELP_STRING([--disable-asm], [Disable assembly])) # Disable below while updating to support upstream assembly changes AM_CONDITIONAL([OPENSSL_NO_ASM], [true]) +enable_asm = "no" # AM_CONDITIONAL([OPENSSL_NO_ASM], [test "x$enable_asm" = "xno"]) # Conditionally enable assembly by default From a498c6a7c9077b257a2f2a860a12748029d82bcf Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 23 Feb 2023 08:31:31 -0600 Subject: [PATCH 0177/1283] only disable asm on aarch64 for now, enable for other archs --- CMakeLists.txt | 4 +--- configure.ac | 7 ++----- 2 files changed, 3 insertions(+), 8 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 66d04ba2c0..599515f841 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -345,9 +345,7 @@ if(ENABLE_ASM) endif() add_definitions(-DHAVE_GNU_STACK) elseif(APPLE AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "x86_64") - # disable for now (.section .rodata invalid) - # set(HOST_ASM_MACOSX_X86_64 true) - set(ENABLE_ASM false) + set(HOST_ASM_MACOSX_X86_64 true) elseif(MSVC AND ("${CMAKE_GENERATOR}" MATCHES "Win64" OR "${CMAKE_GENERATOR_PLATFORM}" STREQUAL "x64")) set(HOST_ASM_MASM_X86_64 true) ENABLE_LANGUAGE(ASM_MASM) diff --git a/configure.ac b/configure.ac index d8bf28eadf..c89fe9538e 100644 --- a/configure.ac +++ b/configure.ac @@ -74,6 +74,7 @@ AC_ARG_ENABLE([tests], AM_CONDITIONAL([ENABLE_TESTS], [test "x$enable_tests" = xyes]) AS_CASE([$host_cpu], + [arm64], [host_cpu=aarch64], [*arm*], [host_cpu=arm], [*amd64*], [host_cpu=x86_64 HOSTARCH=intel], [i?86], [host_cpu=i386 HOSTARCH=intel], @@ -110,17 +111,13 @@ int main() {return 0;} AC_ARG_ENABLE([asm], AS_HELP_STRING([--disable-asm], [Disable assembly])) -# Disable below while updating to support upstream assembly changes -AM_CONDITIONAL([OPENSSL_NO_ASM], [true]) -enable_asm = "no" -# AM_CONDITIONAL([OPENSSL_NO_ASM], [test "x$enable_asm" = "xno"]) +AM_CONDITIONAL([OPENSSL_NO_ASM], [test "x$enable_asm" = "xno" -o "$host_cpu" = "aarch64"]) # Conditionally enable assembly by default AM_CONDITIONAL([HOST_ASM_ELF_ARM], [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "arm" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_ELF_X86_64], [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "x86_64" -a "x$enable_asm" != "xno"]) - AM_CONDITIONAL([HOST_ASM_MACOSX_X86_64], [test "x$HOST_ABI" = "xmacosx" -a "$host_cpu" = "x86_64" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_MASM_X86_64], From 532d0ef755136981eee8fe479f1b2fb58bdbf50a Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 23 Feb 2023 08:52:59 -0600 Subject: [PATCH 0178/1283] include more asm files --- crypto/CMakeLists.txt | 2 ++ crypto/Makefile.am.elf-x86_64 | 1 + crypto/Makefile.am.macosx-x86_64 | 1 + crypto/Makefile.am.mingw64-x86_64 | 13 +++++++++++++ 4 files changed, 17 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 5611881ec6..dc30a17750 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -58,6 +58,7 @@ if(HOST_ASM_ELF_X86_64) bn/arch/amd64/bignum_sqr_4_8_alt.S bn/arch/amd64/bignum_sqr_8_16_alt.S bn/arch/amd64/bignum_sub.S + bn/arch/amd64/word_clz.S bn/arch/amd64/bn_arch.c ) add_definitions(-DAES_ASM) @@ -112,6 +113,7 @@ if(HOST_ASM_MACOSX_X86_64) bn/arch/amd64/bignum_sqr_4_8_alt.S bn/arch/amd64/bignum_sqr_8_16_alt.S bn/arch/amd64/bignum_sub.S + bn/arch/amd64/word_clz.S bn/arch/amd64/bn_arch.c ) add_definitions(-DAES_ASM) diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index cc6ea99c9d..20cc0ccac7 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -29,6 +29,7 @@ ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr.S ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_4_8_alt.S ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_8_16_alt.S ASM_X86_64_ELF += bn/arch/amd64/bignum_sub.S +ASM_X86_64_ELF += bn/arch/amd64/word_clz.S ASM_X86_64_ELF += bn/arch/amd64/bn_arch.c EXTRA_DIST += $(ASM_X86_64_ELF) diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index e11dd3c8fb..f3990a5fe3 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -29,6 +29,7 @@ ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_4_8_alt.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_8_16_alt.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sub.S +ASM_X86_64_MACOSX += bn/arch/amd64/word_clz.S ASM_X86_64_MACOSX += bn/arch/amd64/bn_arch.c EXTRA_DIST += $(ASM_X86_64_MACOSX) diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index bce854b27e..f808c12175 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -19,6 +19,19 @@ ASM_X86_64_MINGW64 += sha/sha512-mingw64-x86_64.S ASM_X86_64_MINGW64 += whrlpool/wp-mingw64-x86_64.S ASM_X86_64_MINGW64 += cpuid-mingw64-x86_64.S +ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_add.S +ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_cmadd.S +ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_cmul.S +ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_mul.S +ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_mul_4_8_alt.S +ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_mul_8_16_alt.S +ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_sqr.S +ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_sqr_4_8_alt.S +ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_sqr_8_16_alt.S +ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_sub.S +ASM_X86_64_MINGW64 += bn/arch/amd64/word_clz.S +ASM_X86_64_MINGW64 += bn/arch/amd64/bn_arch.c + EXTRA_DIST += $(ASM_X86_64_MINGW64) if HOST_ASM_MINGW64_X86_64 From a0a6e7bd0777e9d174a07a135daf9b66c6ca1e6f Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sat, 25 Feb 2023 10:34:43 -0600 Subject: [PATCH 0179/1283] reenable aarch64 asm for macos --- CMakeLists.txt | 2 -- 1 file changed, 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 599515f841..5fddd7f227 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -308,8 +308,6 @@ endif() if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(aarch64|arm64)") set(HOST_AARCH64 true) - # disable for now (fails tests) - set(ENABLE_ASM false) elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm") set(HOST_ARM true) elseif("${CMAKE_SYSTEM_NAME}" STREQUAL "SunOS" AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "i386") From 6b59828d6d5ddb275255c0b8a5bc90d6ceb1390a Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sat, 25 Feb 2023 18:20:29 -0600 Subject: [PATCH 0180/1283] update cross arch tests for arm/aarch64 --- scripts/test | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/scripts/test b/scripts/test index f2f0cb8474..6f9009ee56 100755 --- a/scripts/test +++ b/scripts/test @@ -81,19 +81,16 @@ elif [ "x$ARCH" = "xarm32" -o "x$ARCH" = "xarm64" ]; then if [ "x$ARCH" = "xarm32" ]; then sudo apt-get install -y g++-arm-linux-gnueabihf - sudo ln -s /usr/arm-linux-gnueabihf/lib/ld-*.*.so /lib/ld-linux-armhf.so.3 - export LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib - export CC=arm-linux-gnueabihf-gcc - ./configure --host=arm-linux + sudo ln -s /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.3 /lib/ + ./configure --host=arm-linux-gnueabihf + LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib make -j 4 check else sudo apt-get install -y g++-aarch64-linux-gnu - sudo ln -s /usr/aarch64-linux-gnu/lib/ld-*.*.so /lib/ld-linux-aarch64.so.1 - export LD_LIBRARY_PATH=/usr/aarch64-linux-gnu/lib - export CC=aarch64-linux-gnu-gcc - ./configure --host=aarch64-linux + sudo ln -s /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.1 /lib/ + ./configure --host=aarch64-linux-gnu + LD_LIBRARY_PATH=/usr/aarch64-linux-gnu/lib make -j 4 check fi - make -j 4 check file apps/openssl/.libs/openssl elif [ "x$ARCH" = "xandroid" ]; then From 531f997093226d62d2b8ea2b72849bb231bc9b94 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sat, 25 Feb 2023 20:56:44 -0600 Subject: [PATCH 0181/1283] enable ASM on aarch64, disable on i386 --- configure.ac | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index c89fe9538e..f3d7c770e4 100644 --- a/configure.ac +++ b/configure.ac @@ -111,7 +111,7 @@ int main() {return 0;} AC_ARG_ENABLE([asm], AS_HELP_STRING([--disable-asm], [Disable assembly])) -AM_CONDITIONAL([OPENSSL_NO_ASM], [test "x$enable_asm" = "xno" -o "$host_cpu" = "aarch64"]) +AM_CONDITIONAL([OPENSSL_NO_ASM], [test "x$enable_asm" = "xno" -o "$host_cpu" = "i386"]) # Conditionally enable assembly by default AM_CONDITIONAL([HOST_ASM_ELF_ARM], From 1fbc858e1df6f4681087c0c5ee57f6e7aa7fc8a5 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 27 Feb 2023 04:19:34 -0600 Subject: [PATCH 0182/1283] remove inherited CC env variable, consolidate common setup --- scripts/test | 30 ++++++++++-------------------- 1 file changed, 10 insertions(+), 20 deletions(-) diff --git a/scripts/test b/scripts/test index 6f9009ee56..65b8255fe9 100755 --- a/scripts/test +++ b/scripts/test @@ -3,6 +3,10 @@ set -e ./autogen.sh +unset CC +sudo apt update +sudo apt install -y cmake ninja-build + if [ "x$ARCH" = "xnative" ]; then # test autotools ./configure @@ -28,8 +32,6 @@ if [ "x$ARCH" = "xnative" ]; then make -j 4 make test else - sudo apt-get update - sudo apt-get install -y cmake ninja-build cmake -GNinja .. ninja -j 4 @@ -42,20 +44,12 @@ if [ "x$ARCH" = "xnative" ]; then fi elif [ "x$ARCH" = "xmingw32" -o "x$ARCH" = "xmingw64" ]; then - sudo apt-get update - sudo apt-get install -y cmake ninja-build - CPU=i686 if [ "x$ARCH" = "xmingw64" ]; then CPU=x86_64 fi - export CC=$CPU-w64-mingw32-gcc - if [ -z $(which $CC) ]; then - sudo apt-get update - sudo apt-get install -y mingw-w64 make - export PATH=$PATH:/opt/$ARCH/bin - fi + sudo apt install -y mingw-w64 ./configure --host=$CPU-w64-mingw32 make -j 4 @@ -76,17 +70,16 @@ elif [ "x$ARCH" = "xmingw32" -o "x$ARCH" = "xmingw64" ]; then ) elif [ "x$ARCH" = "xarm32" -o "x$ARCH" = "xarm64" ]; then - sudo apt-get update - sudo apt-get install -y qemu-user-static binfmt-support + sudo apt install -y qemu-user-static binfmt-support if [ "x$ARCH" = "xarm32" ]; then - sudo apt-get install -y g++-arm-linux-gnueabihf - sudo ln -s /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.3 /lib/ + sudo apt install -y g++-arm-linux-gnueabihf + sudo ln -sf /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.3 /lib/ ./configure --host=arm-linux-gnueabihf LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib make -j 4 check else - sudo apt-get install -y g++-aarch64-linux-gnu - sudo ln -s /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.1 /lib/ + sudo apt install -y g++-aarch64-linux-gnu + sudo ln -sf /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.1 /lib/ ./configure --host=aarch64-linux-gnu LD_LIBRARY_PATH=/usr/aarch64-linux-gnu/lib make -j 4 check fi @@ -94,9 +87,6 @@ elif [ "x$ARCH" = "xarm32" -o "x$ARCH" = "xarm64" ]; then file apps/openssl/.libs/openssl elif [ "x$ARCH" = "xandroid" ]; then - sudo apt-get update - sudo apt-get install -y cmake ninja-build - export TC_FILE=$ANDROID_NDK_HOME/build/cmake/android.toolchain.cmake # set target API level and architecture From c305c7ac43b0fa3a47724cbff2ac3303eb163387 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 27 Feb 2023 04:46:43 -0600 Subject: [PATCH 0183/1283] disable BN asm for amd64 win32 build --- crypto/Makefile.am.mingw64-x86_64 | 13 ------------- patches/win32_amd64_bn_arch.h.patch | 21 +++++++++++++++++++++ 2 files changed, 21 insertions(+), 13 deletions(-) create mode 100644 patches/win32_amd64_bn_arch.h.patch diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index f808c12175..bce854b27e 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -19,19 +19,6 @@ ASM_X86_64_MINGW64 += sha/sha512-mingw64-x86_64.S ASM_X86_64_MINGW64 += whrlpool/wp-mingw64-x86_64.S ASM_X86_64_MINGW64 += cpuid-mingw64-x86_64.S -ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_add.S -ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_cmadd.S -ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_cmul.S -ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_mul.S -ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_mul_4_8_alt.S -ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_mul_8_16_alt.S -ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_sqr.S -ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_sqr_4_8_alt.S -ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_sqr_8_16_alt.S -ASM_X86_64_MINGW64 += bn/arch/amd64/bignum_sub.S -ASM_X86_64_MINGW64 += bn/arch/amd64/word_clz.S -ASM_X86_64_MINGW64 += bn/arch/amd64/bn_arch.c - EXTRA_DIST += $(ASM_X86_64_MINGW64) if HOST_ASM_MINGW64_X86_64 diff --git a/patches/win32_amd64_bn_arch.h.patch b/patches/win32_amd64_bn_arch.h.patch new file mode 100644 index 0000000000..20205dcc22 --- /dev/null +++ b/patches/win32_amd64_bn_arch.h.patch @@ -0,0 +1,21 @@ +--- crypto/bn/arch/amd64/bn_arch.h.orig 2023-02-27 04:43:12.257874699 -0600 ++++ crypto/bn/arch/amd64/bn_arch.h 2023-02-27 04:44:05.541873870 -0600 +@@ -20,6 +20,10 @@ + #ifndef HEADER_BN_ARCH_H + #define HEADER_BN_ARCH_H + ++#ifdef _WIN32 ++#define OPENSSL_NO_ASM ++#else ++ + #ifndef OPENSSL_NO_ASM + + #define HAVE_BN_ADD +@@ -85,6 +89,7 @@ + *out_r0 = r0; + } + #endif /* __GNUC__ */ ++#endif /* _WIN32 */ + + #endif + #endif From 703f430428609c8c6d5b42f82522080e1c60f0ff Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 27 Feb 2023 04:57:29 -0600 Subject: [PATCH 0184/1283] add conditional around common apt commands --- scripts/test | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/scripts/test b/scripts/test index 65b8255fe9..3f35ecae5b 100755 --- a/scripts/test +++ b/scripts/test @@ -1,11 +1,15 @@ #!/bin/sh set -e -./autogen.sh - unset CC -sudo apt update -sudo apt install -y cmake ninja-build + +if type apt-get >/dev/null +then + sudo apt-get update + sudo apt-get install -y cmake ninja-build +fi + +./autogen.sh if [ "x$ARCH" = "xnative" ]; then # test autotools @@ -32,7 +36,6 @@ if [ "x$ARCH" = "xnative" ]; then make -j 4 make test else - cmake -GNinja .. ninja -j 4 ninja test @@ -49,7 +52,7 @@ elif [ "x$ARCH" = "xmingw32" -o "x$ARCH" = "xmingw64" ]; then CPU=x86_64 fi - sudo apt install -y mingw-w64 + sudo apt-get install -y mingw-w64 ./configure --host=$CPU-w64-mingw32 make -j 4 @@ -70,15 +73,15 @@ elif [ "x$ARCH" = "xmingw32" -o "x$ARCH" = "xmingw64" ]; then ) elif [ "x$ARCH" = "xarm32" -o "x$ARCH" = "xarm64" ]; then - sudo apt install -y qemu-user-static binfmt-support + sudo apt-get install -y qemu-user-static binfmt-support if [ "x$ARCH" = "xarm32" ]; then - sudo apt install -y g++-arm-linux-gnueabihf + sudo apt-get install -y g++-arm-linux-gnueabihf sudo ln -sf /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.3 /lib/ ./configure --host=arm-linux-gnueabihf LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib make -j 4 check else - sudo apt install -y g++-aarch64-linux-gnu + sudo apt-get install -y g++-aarch64-linux-gnu sudo ln -sf /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.1 /lib/ ./configure --host=aarch64-linux-gnu LD_LIBRARY_PATH=/usr/aarch64-linux-gnu/lib make -j 4 check From b0310cb34e912d15340d02a179a81311325b4199 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 27 Feb 2023 05:48:23 -0600 Subject: [PATCH 0185/1283] set CMAKE_SYSTEM_PROCESSOR when cross compiling handle x86 as option for 32-bit x86 on Windows --- CMakeLists.txt | 8 ++++---- scripts/i686-w64-mingw32.cmake | 1 + scripts/x86_64-w64-mingw32.cmake | 1 + 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 5fddd7f227..7e8c0ded8b 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -312,9 +312,11 @@ elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm") set(HOST_ARM true) elseif("${CMAKE_SYSTEM_NAME}" STREQUAL "SunOS" AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "i386") set(HOST_X86_64 true) -elseif("${CMAKE_SYSTEM_NAME}" STREQUAL "i386") +elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64)") + set(HOST_X86_64 true) +elseif("${CMAKE_SYSTEM_NAME}" MATCHES "[i386|x86]") set(HOST_I386 true) -elseif("${CMAKE_SYSTEM_NAME}" STREQUAL "mips64") +elseif("${CMAKE_SYSTEM_NAME}" MATCHES "mips64") set(HOST_MIPS64 true) elseif("${CMAKE_SYSTEM_NAME}" MATCHES "mips") set(HOST_MIPS true) @@ -326,8 +328,6 @@ elseif("${CMAKE_SYSTEM_NAME}" MATCHES "riscv64") set(HOST_RISCV64 true) elseif("${CMAKE_SYSTEM_NAME}" MATCHES "sparc64") set(HOST_SPARC64 true) -elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64)") - set(HOST_X86_64 true) else() set(ENABLE_ASM false) endif() diff --git a/scripts/i686-w64-mingw32.cmake b/scripts/i686-w64-mingw32.cmake index 58efd58cf0..bad60db7ab 100644 --- a/scripts/i686-w64-mingw32.cmake +++ b/scripts/i686-w64-mingw32.cmake @@ -1,4 +1,5 @@ SET(CMAKE_SYSTEM_NAME Windows) +SET(CMAKE_SYSTEM_PROCESSOR i386) SET(CMAKE_C_COMPILER i686-w64-mingw32-gcc) SET(CMAKE_CXX_COMPILER i686-w64-mingw32-g++) SET(CMAKE_RC_COMPILER i686-w64-mingw32-windres) diff --git a/scripts/x86_64-w64-mingw32.cmake b/scripts/x86_64-w64-mingw32.cmake index c52b606514..df65165f8d 100644 --- a/scripts/x86_64-w64-mingw32.cmake +++ b/scripts/x86_64-w64-mingw32.cmake @@ -1,4 +1,5 @@ SET(CMAKE_SYSTEM_NAME Windows) +SET(CMAKE_SYSTEM_PROCESSOR amd64) SET(CMAKE_C_COMPILER x86_64-w64-mingw32-gcc) SET(CMAKE_CXX_COMPILER x86_64-w64-mingw32-g++) SET(CMAKE_RC_COMPILER x86_64-w64-mingw32-windres) From 305d0532ab2613f96bb67b2f1b7dee98c029178e Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 27 Feb 2023 06:27:01 -0600 Subject: [PATCH 0186/1283] delete opensslconf.h for each build --- scripts/test | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/test b/scripts/test index 3f35ecae5b..48d7a554ad 100755 --- a/scripts/test +++ b/scripts/test @@ -116,7 +116,7 @@ elif [ "x$ARCH" = "xandroid" ]; then ( build_dir=build_$NAL_$ABI - rm -fr $build_dir + rm -fr $build_dir include/openssl/opensslconf.h mkdir $build_dir cd $build_dir cmake -GNinja -DCMAKE_MAKE_PROGRAM=ninja \ From ab214b56962ff7759ed4d9bc9f326e9d094c632a Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 27 Feb 2023 07:26:07 -0600 Subject: [PATCH 0187/1283] handle i?86 for 32-bit CMake builds --- CMakeLists.txt | 3 ++- scripts/test | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 7e8c0ded8b..7847830a1e 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -314,7 +314,8 @@ elseif("${CMAKE_SYSTEM_NAME}" STREQUAL "SunOS" AND "${CMAKE_SYSTEM_PROCESSOR}" S set(HOST_X86_64 true) elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64)") set(HOST_X86_64 true) -elseif("${CMAKE_SYSTEM_NAME}" MATCHES "[i386|x86]") +elseif("${CMAKE_SYSTEM_NAME}" MATCHES "[i?86|x86]") + set(ENABLE_ASM false) set(HOST_I386 true) elseif("${CMAKE_SYSTEM_NAME}" MATCHES "mips64") set(HOST_MIPS64 true) diff --git a/scripts/test b/scripts/test index 48d7a554ad..0eb2c06661 100755 --- a/scripts/test +++ b/scripts/test @@ -115,10 +115,11 @@ elif [ "x$ARCH" = "xandroid" ]; then echo "##### Date: `date`, Native API level: $NAL, ABI: $ABI" ( - build_dir=build_$NAL_$ABI + build_dir=build-$NAL_$ABI rm -fr $build_dir include/openssl/opensslconf.h mkdir $build_dir cd $build_dir + echo "##### cmake -GNinja -DCMAKE_MAKE_PROGRAM=ninja -DANDROID_NDK=$ANDROID_NDK_HOME -DCMAKE_TOOLCHAIN_FILE=$TC_FILE -DANDROID_ABI=$ABI -DANDROID_NATIVE_API_LEVEL=$NAL .." cmake -GNinja -DCMAKE_MAKE_PROGRAM=ninja \ -DANDROID_NDK=$ANDROID_NDK_HOME \ -DCMAKE_TOOLCHAIN_FILE=$TC_FILE \ From 65af3925dcb7fc84000cedc373d5f84db3fc3265 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 28 Feb 2023 01:51:07 -0600 Subject: [PATCH 0188/1283] update .gitignore for integrated tests, build files --- .gitignore | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.gitignore b/.gitignore index a47dd50289..826d157960 100644 --- a/.gitignore +++ b/.gitignore @@ -55,6 +55,7 @@ x509v3.cnf test-driver *.log *.trs +tests/*.crl tests/aes_wrap* tests/arc4random_fork* tests/asn1api* @@ -66,13 +67,23 @@ tests/asn1string_copy* tests/asn1_string_to_utf8* tests/asn1time* tests/asn1x509* +tests/bio_chain* +tests/bio_mem* tests/bnaddsub* +tests/bn_add_sub* +tests/bn_cmp* tests/bn_isqrt* +tests/bn_mod_exp* +tests/bn_mod_exp_zero* tests/bn_mod_exp2_mont* tests/bn_mod_sqrt* +tests/bn_mont* tests/bn_primes* tests/bn_rand_interval* +tests/bn_shift* tests/bn_to_string* +tests/bn_unit* +tests/callback* tests/cipher* tests/constraints* tests/ec_point_conversion* @@ -156,8 +167,10 @@ libtls-standalone/VERSION ssl/hidden ssl/*.c ssl/*.h +ssl/*.mk tls/*.c tls/*.h +tls/*.mk include/pqueue.h include/tls.h include/openssl/*.h From b98c56fd5e86fa76eb55a98a2266a923f64f705c Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 28 Feb 2023 01:51:41 -0600 Subject: [PATCH 0189/1283] stop exposing hidden defines in public opensslconf.h pull in hidden headers instead, patching drectly for Windows support --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 3 +-- include/CMakeLists.txt | 4 +--- include/openssl/Makefile.am.tpl | 23 ++++++++++------------- include/openssl/opensslconf.h.in | 15 --------------- patches/crypto_namespace.h.patch | 13 +++++++++++++ patches/ssl_namespace.h.patch | 13 +++++++++++++ ssl/CMakeLists.txt | 3 ++- ssl/Makefile.am | 1 + 9 files changed, 42 insertions(+), 34 deletions(-) delete mode 100644 include/openssl/opensslconf.h.in create mode 100644 patches/crypto_namespace.h.patch create mode 100644 patches/ssl_namespace.h.patch diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index dc30a17750..45d9786b17 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -1021,6 +1021,7 @@ target_include_directories(crypto_obj ecdh ecdsa evp + hidden hmac modes ocsp diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 733dcbdf36..c09d266b2e 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -1,7 +1,6 @@ include $(top_srcdir)/Makefile.am.common AM_CPPFLAGS += -DLIBRESSL_CRYPTO_INTERNAL - AM_CPPFLAGS += -I$(top_srcdir)/crypto/asn1 AM_CPPFLAGS += -I$(top_srcdir)/crypto/bio AM_CPPFLAGS += -I$(top_srcdir)/crypto/bn @@ -134,7 +133,7 @@ libcrypto_la_LIBADD = libcompat.la if !HAVE_EXPLICIT_BZERO libcrypto_la_LIBADD += libcompatnoopt.la endif -libcrypto_la_CPPFLAGS = $(AM_CPPFLAGS) +libcrypto_la_CPPFLAGS = -I$(top_srcdir)/crypto/hidden ${AM_CPPFLAGS} libcrypto_la_CPPFLAGS += -DLIBRESSL_INTERNAL libcrypto_la_CPPFLAGS += -DOPENSSL_NO_HW_PADLOCK if OPENSSL_NO_ASM diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt index dafdee74af..a08a78171e 100644 --- a/include/CMakeLists.txt +++ b/include/CMakeLists.txt @@ -7,8 +7,6 @@ if(ENABLE_LIBRESSL_INSTALL) PATTERN "Makefile*" EXCLUDE) endif(ENABLE_LIBRESSL_INSTALL) -file(READ openssl/opensslconf.h.in OPENSSLCONF) -file(WRITE openssl/opensslconf.h "${OPENSSLCONF}") if(HOST_AARCH64) file(READ arch/aarch64/opensslconf.h OPENSSLCONF) elseif(HOST_ARM) @@ -28,4 +26,4 @@ elseif(HOST_SPARC64) elseif(HOST_X86_64) file(READ arch/amd64/opensslconf.h OPENSSLCONF) endif() -file(APPEND openssl/opensslconf.h "${OPENSSLCONF}") +file(WRITE openssl/opensslconf.h "${OPENSSLCONF}") diff --git a/include/openssl/Makefile.am.tpl b/include/openssl/Makefile.am.tpl index 167183a394..2f67d100c4 100644 --- a/include/openssl/Makefile.am.tpl +++ b/include/openssl/Makefile.am.tpl @@ -3,40 +3,37 @@ include $(top_srcdir)/Makefile.am.common if !ENABLE_LIBTLS_ONLY opensslincludedir=$(includedir)/openssl -noinst_HEADERS = opensslconf.h.in BUILT_SOURCES = opensslconf.h CLEANFILES = opensslconf.h -opensslconf.h: opensslconf.h.in Makefile +opensslconf.h: Makefile -echo "generating opensslconf.h ..." - -cp $(top_srcdir)/include/openssl/opensslconf.h.in opensslconf.h - -chmod u+w opensslconf.h if HOST_AARCH64 - -cat $(top_srcdir)/include/arch/aarch64/opensslconf.h >> opensslconf.h + -cp $(top_srcdir)/include/arch/aarch64/opensslconf.h opensslconf.h endif if HOST_ARM - -cat $(top_srcdir)/include/arch/arm/opensslconf.h >> opensslconf.h + -cp $(top_srcdir)/include/arch/arm/opensslconf.h opensslconf.h endif if HOST_I386 - -cat $(top_srcdir)/include/arch/i386/opensslconf.h >> opensslconf.h + -cp $(top_srcdir)/include/arch/i386/opensslconf.h opensslconf.h endif if HOST_MIPS64 - -cat $(top_srcdir)/include/arch/mips64/opensslconf.h >> opensslconf.h + -cp $(top_srcdir)/include/arch/mips64/opensslconf.h opensslconf.h endif if HOST_POWERPC - -cat $(top_srcdir)/include/arch/powerpc/opensslconf.h >> opensslconf.h + -cp $(top_srcdir)/include/arch/powerpc/opensslconf.h opensslconf.h endif if HOST_POWERPC64 - -cat $(top_srcdir)/include/arch/powerpc64/opensslconf.h >> opensslconf.h + -cp $(top_srcdir)/include/arch/powerpc64/opensslconf.h opensslconf.h endif if HOST_RISCV64 - -cat $(top_srcdir)/include/arch/riscv64/opensslconf.h >> opensslconf.h + -cp $(top_srcdir)/include/arch/riscv64/opensslconf.h opensslconf.h endif if HOST_SPARC64 - -cat $(top_srcdir)/include/arch/sparc64/opensslconf.h >> opensslconf.h + -cp $(top_srcdir)/include/arch/sparc64/opensslconf.h opensslconf.h endif if HOST_X86_64 - -cat $(top_srcdir)/include/arch/amd64/opensslconf.h >> opensslconf.h + -cp $(top_srcdir)/include/arch/amd64/opensslconf.h opensslconf.h endif opensslinclude_HEADERS = opensslconf.h diff --git a/include/openssl/opensslconf.h.in b/include/openssl/opensslconf.h.in deleted file mode 100644 index 8842f00d39..0000000000 --- a/include/openssl/opensslconf.h.in +++ /dev/null @@ -1,15 +0,0 @@ -#if defined(_MSC_VER) && !defined(__clang__) && !defined(__attribute__) -#define __attribute__(a) -#endif - -#if defined(LIBRESSL_INTERNAL) && !defined(LIBRESSL_NAMESPACE) -# define LCRYPTO_UNUSED(x) -# define LCRYPTO_USED(x) -# define LCRYPTO_ALIAS1(pre, x) -# define LCRYPTO_ALIAS(x) - -# define LSSL_UNUSED(x) -# define LSSL_USED(x) -# define LSSL_ALIAS(x) -#endif /* LIBRESSL_INTERNAL && !LIBRESSL_NAMESPACE */ - diff --git a/patches/crypto_namespace.h.patch b/patches/crypto_namespace.h.patch new file mode 100644 index 0000000000..27515244e0 --- /dev/null +++ b/patches/crypto_namespace.h.patch @@ -0,0 +1,13 @@ +--- crypto/hidden/crypto_namespace.h.orig 2023-02-28 00:41:43.212756628 -0600 ++++ crypto/hidden/crypto_namespace.h 2023-02-28 00:42:01.152756349 -0600 +@@ -18,6 +18,10 @@ + #ifndef _LIBCRYPTO_CRYPTO_NAMESPACE_H_ + #define _LIBCRYPTO_CRYPTO_NAMESPACE_H_ + ++#if defined(_MSC_VER) && !defined(__clang__) && !defined(__attribute__) ++#define __attribute__(a) ++#endif ++ + /* + * If marked as 'used', then internal calls use the name with prefix "_lcry_" + * and we alias that to the normal name *and* the name with prefix "_libre_"; diff --git a/patches/ssl_namespace.h.patch b/patches/ssl_namespace.h.patch new file mode 100644 index 0000000000..649e862a7e --- /dev/null +++ b/patches/ssl_namespace.h.patch @@ -0,0 +1,13 @@ +--- ssl/hidden/ssl_namespace.h.orig 2023-02-28 00:42:20.928756042 -0600 ++++ ssl/hidden/ssl_namespace.h 2023-02-28 00:43:16.372755180 -0600 +@@ -18,6 +18,10 @@ + #ifndef _LIBSSL_SSL_NAMESPACE_H_ + #define _LIBSSL_SSL_NAMESPACE_H_ + ++#if defined(_MSC_VER) && !defined(__clang__) && !defined(__attribute__) ++#define __attribute__(a) ++#endif ++ + /* + * If marked as 'used', then internal calls use the name with prefix "_lssl_" + * and we alias that to the normal name. diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 173c3b5845..f5d52f7732 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -64,8 +64,9 @@ set( add_library(ssl_obj OBJECT ${SSL_SRC}) target_include_directories(ssl_obj PRIVATE - ../crypto/bio . + hidden + ../crypto/bio ../include/compat PUBLIC ../include) diff --git a/ssl/Makefile.am b/ssl/Makefile.am index a2155fb1e2..d27e2af835 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -31,6 +31,7 @@ remove_bs_objects: libssl.la -$(AR) dv $(abs_top_builddir)/ssl/.libs/libssl.a \ bs_ber.o bs_cbb.o bs_cbs.o +libssl_la_CPPFLAGS = -I$(top_srcdir)/ssl/hidden ${AM_CPPFLAGS} libssl_la_LDFLAGS = -version-info @LIBSSL_VERSION@ -no-undefined -export-symbols $(top_srcdir)/ssl/ssl.sym libssl_la_LIBADD = $(abs_top_builddir)/crypto/libcrypto.la $(PLATFORM_LDADD) libssl_la_LIBADD += libbs.la From 94289fd2efb496a9e80b183b316dd28c2f05a9b6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 28 Feb 2023 09:29:06 +0100 Subject: [PATCH 0190/1283] Adjust patch to recent speed.c change --- patches/speed.c.patch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/patches/speed.c.patch b/patches/speed.c.patch index 4e80f316a9..87a06bc43a 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -83,7 +83,7 @@ + speed_alarm_free(run); +#endif BIO_printf(bio_err, mr ? "+R:%d:%s:%f\n" - : "%d %s's in %.2fs\n", count, names[alg], time_used); + : "%d %s in %.2fs\n", count, names[alg], time_used); results[alg][run_no] = ((double) count) / time_used * lengths[run_no]; } From b38f5a8904b83d433e967f683821ca992354551b Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 18 Dec 2022 21:39:58 -0600 Subject: [PATCH 0191/1283] fix dangling whitespace when building object list breaks latest macOS linker to have a directory in the object list --- tls/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tls/Makefile.am b/tls/Makefile.am index 9b62b2231e..d5725c362a 100644 --- a/tls/Makefile.am +++ b/tls/Makefile.am @@ -16,7 +16,7 @@ EXTRA_libtls_la_DEPENDENCIES = libtls_la_objects.mk libtls_la_objects.mk: Makefile @echo "libtls_la_objects= $(libtls_la_OBJECTS)" \ - | sed 's/ */ $$\(abs_top_builddir\)\/tls\//g' \ + | sed -e 's/ *$$//' -e 's/ */ $$\(abs_top_builddir\)\/tls\//g' \ > libtls_la_objects.mk libtls_la_LDFLAGS = -version-info @LIBTLS_VERSION@ -no-undefined -export-symbols $(top_srcdir)/tls/tls.sym From cfbdf67f5960198363f56b06f6a4f88aa8654d10 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 18 Dec 2022 22:10:11 -0600 Subject: [PATCH 0192/1283] link internal apps statically --- apps/nc/Makefile.am | 11 +++++++---- apps/ocspcheck/Makefile.am | 12 +++++++++--- apps/openssl/Makefile.am | 9 +++++++-- 3 files changed, 23 insertions(+), 9 deletions(-) diff --git a/apps/nc/Makefile.am b/apps/nc/Makefile.am index e9db6e592b..aba306ed3b 100644 --- a/apps/nc/Makefile.am +++ b/apps/nc/Makefile.am @@ -1,6 +1,8 @@ include $(top_srcdir)/Makefile.am.common -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk +-include $(abs_top_builddir)/ssl/libssl_la_objects.mk +-include $(abs_top_builddir)/tls/libtls_la_objects.mk if BUILD_NC @@ -14,12 +16,13 @@ endif EXTRA_DIST = nc.1 EXTRA_DIST += CMakeLists.txt -nc_LDADD = $(abs_top_builddir)/tls/libtls.la -nc_LDADD += $(PLATFORM_LDADD) $(PROG_LDADD) - -nc_LDADD += $(libcrypto_la_objects) +nc_LDADD = $(libcrypto_la_objects) nc_LDADD += $(libcompat_la_objects) nc_LDADD += $(libcompatnoopt_la_objects) +nc_LDADD += $(libssl_la_objects) +nc_LDADD += $(libtls_la_objects) + +nc_LDADD += $(PLATFORM_LDADD) $(PROG_LDADD) AM_CPPFLAGS += -I$(top_srcdir)/apps/nc/compat diff --git a/apps/ocspcheck/Makefile.am b/apps/ocspcheck/Makefile.am index 7c7b454313..e6f3c5436b 100644 --- a/apps/ocspcheck/Makefile.am +++ b/apps/ocspcheck/Makefile.am @@ -1,5 +1,9 @@ include $(top_srcdir)/Makefile.am.common +-include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk +-include $(abs_top_builddir)/ssl/libssl_la_objects.mk +-include $(abs_top_builddir)/tls/libtls_la_objects.mk + if !ENABLE_LIBTLS_ONLY bin_PROGRAMS = ocspcheck dist_man_MANS = ocspcheck.8 @@ -10,9 +14,11 @@ endif EXTRA_DIST = ocspcheck.8 EXTRA_DIST += CMakeLists.txt -ocspcheck_LDADD = $(abs_top_builddir)/crypto/libcrypto.la -ocspcheck_LDADD += $(abs_top_builddir)/ssl/libssl.la -ocspcheck_LDADD += $(abs_top_builddir)/tls/libtls.la +ocspcheck_LDADD = $(libcrypto_la_objects) +ocspcheck_LDADD += $(libcompat_la_objects) +ocspcheck_LDADD += $(libcompatnoopt_la_objects) +ocspcheck_LDADD += $(libssl_la_objects) +ocspcheck_LDADD += $(libtls_la_objects) ocspcheck_LDADD += $(PLATFORM_LDADD) $(PROG_LDADD) ocspcheck_SOURCES = http.c diff --git a/apps/openssl/Makefile.am b/apps/openssl/Makefile.am index 7cbac48ae6..9574e06339 100644 --- a/apps/openssl/Makefile.am +++ b/apps/openssl/Makefile.am @@ -1,5 +1,8 @@ include $(top_srcdir)/Makefile.am.common +-include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk +-include $(abs_top_builddir)/ssl/libssl_la_objects.mk + if !ENABLE_LIBTLS_ONLY bin_PROGRAMS = openssl dist_man_MANS = openssl.1 @@ -7,8 +10,10 @@ else noinst_PROGRAMS = openssl endif -openssl_LDADD = $(abs_top_builddir)/ssl/libssl.la -openssl_LDADD += $(abs_top_builddir)/crypto/libcrypto.la +openssl_LDADD = $(libcrypto_la_objects) +openssl_LDADD += $(libcompat_la_objects) +openssl_LDADD += $(libcompatnoopt_la_objects) +openssl_LDADD += $(libssl_la_objects) openssl_LDADD += $(PLATFORM_LDADD) $(PROG_LDADD) openssl_SOURCES = apps.c From 47aeda0fb235043acf0b010315d175e67fa4ed00 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 28 Feb 2023 08:34:08 -0600 Subject: [PATCH 0193/1283] make it simpler to test on a non-Linux system --- scripts/test | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/scripts/test b/scripts/test index 0eb2c06661..c7200dcaab 100755 --- a/scripts/test +++ b/scripts/test @@ -1,10 +1,10 @@ #!/bin/sh set -e +set -x unset CC -if type apt-get >/dev/null -then +if type apt-get >/dev/null 2>&1; then sudo apt-get update sudo apt-get install -y cmake ninja-build fi @@ -52,7 +52,9 @@ elif [ "x$ARCH" = "xmingw32" -o "x$ARCH" = "xmingw64" ]; then CPU=x86_64 fi - sudo apt-get install -y mingw-w64 + if ! type i686-w64-mingw32-gcc > /dev/null; then + sudo apt-get install -y mingw-w64 + fi ./configure --host=$CPU-w64-mingw32 make -j 4 From f261e8c46e5ce6a15638275b95d9d5c145d35d9c Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 28 Feb 2023 08:34:39 -0600 Subject: [PATCH 0194/1283] unexport internal compat symbols from libcrypto --- crypto/Makefile.am | 66 ---------------------------------------------- ssl/Makefile.am | 4 +++ 2 files changed, 4 insertions(+), 66 deletions(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index c09d266b2e..0b5ba3f99f 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -44,73 +44,7 @@ crypto_portable.sym: crypto.sym Makefile -echo "generating crypto_portable.sym ..." -cp $(top_srcdir)/crypto/crypto.sym crypto_portable.sym -chmod u+w crypto_portable.sym -if !HAVE_ARC4RANDOM_BUF - -echo arc4random >> crypto_portable.sym - -echo arc4random_buf >> crypto_portable.sym - -echo arc4random_uniform >> crypto_portable.sym -if !HAVE_GETENTROPY - -echo getentropy >> crypto_portable.sym -endif -endif -if !HAVE_ASPRINTF - -echo asprintf >> crypto_portable.sym - -echo vasprintf >> crypto_portable.sym -endif -if !HAVE_EXPLICIT_BZERO - -echo explicit_bzero >> crypto_portable.sym -endif -if !HAVE_FREEZERO - -echo freezero >> crypto_portable.sym -endif -if !HAVE_REALLOCARRAY - -echo reallocarray >> crypto_portable.sym -endif -if !HAVE_RECALLOCARRAY - -echo recallocarray >> crypto_portable.sym -endif -if !HAVE_STRLCAT - -echo strlcat >> crypto_portable.sym -endif -if !HAVE_STRLCPY - -echo strlcpy >> crypto_portable.sym -endif -if !HAVE_STRNDUP - -echo strndup >> crypto_portable.sym -endif -if !HAVE_STRNLEN - -echo strnlen >> crypto_portable.sym -endif -if !HAVE_STRSEP - -echo strsep >> crypto_portable.sym -endif -if !HAVE_STRTONUM - -echo strtonum >> crypto_portable.sym -endif -if !HAVE_TIMEGM - -echo timegm >> crypto_portable.sym -endif -if !HAVE_TIMINGSAFE_BCMP - -echo timingsafe_bcmp >> crypto_portable.sym -endif -if !HAVE_TIMINGSAFE_MEMCMP - -echo timingsafe_memcmp >> crypto_portable.sym -endif -if HOST_CPU_IS_INTEL - -echo OPENSSL_ia32cap_P >> crypto_portable.sym -endif if HOST_WIN - -echo posix_perror >> crypto_portable.sym - -echo posix_fopen >> crypto_portable.sym - -echo posix_fgets >> crypto_portable.sym - -echo posix_open >> crypto_portable.sym - -echo posix_rename >> crypto_portable.sym - -echo posix_connect >> crypto_portable.sym - -echo posix_close >> crypto_portable.sym - -echo posix_read >> crypto_portable.sym - -echo posix_write >> crypto_portable.sym - -echo posix_getsockopt >> crypto_portable.sym - -echo posix_setsockopt >> crypto_portable.sym - -echo getuid >> crypto_portable.sym -grep -v BIO_s_log crypto_portable.sym > crypto_portable.sym.tmp -mv crypto_portable.sym.tmp crypto_portable.sym endif diff --git a/ssl/Makefile.am b/ssl/Makefile.am index d27e2af835..002a26674a 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -1,5 +1,7 @@ include $(top_srcdir)/Makefile.am.common +-include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk + AM_CPPFLAGS += -I$(top_srcdir)/crypto/bio noinst_LTLIBRARIES = libbs.la @@ -34,6 +36,8 @@ remove_bs_objects: libssl.la libssl_la_CPPFLAGS = -I$(top_srcdir)/ssl/hidden ${AM_CPPFLAGS} libssl_la_LDFLAGS = -version-info @LIBSSL_VERSION@ -no-undefined -export-symbols $(top_srcdir)/ssl/ssl.sym libssl_la_LIBADD = $(abs_top_builddir)/crypto/libcrypto.la $(PLATFORM_LDADD) +libssl_la_LIBADD += $(libcompat_la_objects) +libssl_la_LIBADD += $(libcompatnoopt_la_objects) libssl_la_LIBADD += libbs.la libbs_la_SOURCES = bs_ber.c From db3074802925a1490056f6276b9379132fc775ab Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 11 Mar 2023 07:23:54 -0700 Subject: [PATCH 0195/1283] Link cipher_method_lib.c to -portable build --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 45d9786b17..a364e868af 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -552,6 +552,7 @@ set( evp/bio_enc.c evp/bio_md.c evp/c_all.c + evp/cipher_method_lib.c evp/digest.c evp/e_aes.c evp/e_aes_cbc_hmac_sha1.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index c09d266b2e..e456198fb6 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -719,6 +719,7 @@ libcrypto_la_SOURCES += evp/bio_b64.c libcrypto_la_SOURCES += evp/bio_enc.c libcrypto_la_SOURCES += evp/bio_md.c libcrypto_la_SOURCES += evp/c_all.c +libcrypto_la_SOURCES += evp/cipher_method_lib.c libcrypto_la_SOURCES += evp/digest.c libcrypto_la_SOURCES += evp/e_aes.c libcrypto_la_SOURCES += evp/e_aes_cbc_hmac_sha1.c From 1f997d143bdfe3aa0e22f913044c51b0c07a43d6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 11 Mar 2023 07:54:08 -0700 Subject: [PATCH 0196/1283] Do not build freenull.c with LIBRESSL_INTERANL The point of this check is to test external API... --- tests/CMakeLists.txt | 2 ++ tests/Makefile.am | 1 + 2 files changed, 3 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 6f3be85194..ef1b206afe 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -350,6 +350,8 @@ endif() # freenull add_executable(freenull freenull.c) +set_source_files_properties(freenull.c PROPERTIES COMPILE_FLAGS + -ULIBRESSL_INTERNAL) target_link_libraries(freenull ${OPENSSL_TEST_LIBS}) add_test(freenull freenull) diff --git a/tests/Makefile.am b/tests/Makefile.am index 26ed681a13..dc965bdfab 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -369,6 +369,7 @@ endif # freenull TESTS += freenull +freenull_CPPFLAGS = $(AM_CPPFLAGS) -ULIBRESSL_INTERNAL check_PROGRAMS += freenull freenull_SOURCES = freenull.c From 6016c0651c05a14992f092de977ef7329d7196fb Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 11 Mar 2023 16:09:56 -0700 Subject: [PATCH 0197/1283] Hook in bn_word test --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index ef1b206afe..991076f369 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -202,6 +202,11 @@ add_executable(bn_unit bn_unit.c) target_link_libraries(bn_unit ${OPENSSL_TEST_LIBS}) add_test(bn_unit bn_unit) +# bn_word +add_executable(bn_word bn_word.c) +target_link_libraries(bn_word ${OPENSSL_TEST_LIBS}) +add_test(bn_word bn_word) + # buffertest add_executable(buffertest buffertest.c) target_link_libraries(buffertest ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index dc965bdfab..2a18b84e8d 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -217,6 +217,11 @@ TESTS += bn_unit check_PROGRAMS += bn_unit bn_unit_SOURCES = bn_unit.c +# bn_word +TESTS += bn_word +check_PROGRAMS += bn_word +bn_word_SOURCES = bn_word.c + # buffertest TESTS += buffertest check_PROGRAMS += buffertest From 42a3218362cc9494d017edd49923c4add876c8c3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 11 Mar 2023 16:11:29 -0700 Subject: [PATCH 0198/1283] Add bn_word to gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index 826d157960..99be2c42d5 100644 --- a/.gitignore +++ b/.gitignore @@ -83,6 +83,7 @@ tests/bn_rand_interval* tests/bn_shift* tests/bn_to_string* tests/bn_unit* +tests/bn_word* tests/callback* tests/cipher* tests/constraints* From 047fddbee9f34c16a82e66ecbe1058bb8810e82f Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 15 Mar 2023 02:03:00 -0600 Subject: [PATCH 0199/1283] Minimal 3.7.1 ChangeLog --- ChangeLog | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/ChangeLog b/ChangeLog index 1a8bb80b01..4fe0e0258a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,6 +28,33 @@ history is also available from Git. LibreSSL Portable Release Notes: +3.7.1 - Development release + + * Internal improvements + - Initial overhaul of the BIGNUM code: + - Added a new framework that allows architecture-dependent + replacement implementations for bignum primitives + - Imported s2n-bignum's constant time assembly primitives. + Use them for amd64 and arm64. + - Lots of cleanup, simplification and bug fixes + - Assorted initial cleanup in the EC code + - Fixed Perl assembly generators to move constants into .rodata. + This allows code to run with execute-only permissions + * Bug fixes + - Fixed a memory leak, a double free and various other issues in + BIO_new_NDEF() + - Avoid infinite loops in DSA and ECDSA signing + - Check DSA parameter sanity + - Fixed various crashes in the openssl(1) testing utility + - Do not check policies by default in the new X.509 verifier + * Public API: + - added EVP_CIPHER_meth_* support (only setters) + - UI_null(), X509_CRL_get0_tbs_sigalg(), X509_STORE_*check_issued(), + X509_get0_uids() + * Security fix + - A malicious certificate revocation list or timestamp response token + would allow an attacker to read arbitrary memory. + 3.7.0 - Development release * Internal improvements From 3fab19adc4e5b5754566c3ee2b936cb37b906e5f Mon Sep 17 00:00:00 2001 From: Bob Beck Date: Wed, 15 Mar 2023 18:45:21 -0600 Subject: [PATCH 0200/1283] 3.7.1. ChangeLog --- ChangeLog | 62 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) diff --git a/ChangeLog b/ChangeLog index 4fe0e0258a..fbfdacb5f6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,6 +28,7 @@ history is also available from Git. LibreSSL Portable Release Notes: +<<<<<<< HEAD 3.7.1 - Development release * Internal improvements @@ -56,7 +57,68 @@ LibreSSL Portable Release Notes: would allow an attacker to read arbitrary memory. 3.7.0 - Development release +======= +3.7.1 - Stable release + * Internal improvements + - Extensive reworking of bignum and montgomery multiplication support (BN_). + - Transition to using s2n-bignum assembly implementation for bignum on amd64 + - ASN1 parsing rework and improvements, including infinite loop avoidance. + - Make UI_destroy_method() NULL safe. + - Various improvements to nc + - Call CRYPTO_cleanup_all_ex_data() from OPENSSL_cleanup(). + - Various internal EC improvements. + - Various openssl(1) improvements. + - Cap the number of iterations in ECDSA signing + - Cap the number of iterations in DSA signing, and other DSA sanity checks. + - Always clear EC groups and points on free. + - Various other internal cleanups + * Compatibility changes + - correct the prototypes of BIO_get_conn_ip(3) and BIO_get_conn_int_port(3) + * Bug fixes + - Avoid -0 in BN_div_word(). + - Fix an off-by-one in dsa_check_key() + - openssl(1) asn1parse: avoid crash with ASN.1 BOOLEANS + - Add missing error checking in PKCS7 + * Documentation improvements + - Mark BIO_s_log(3) BIO_nread0(3), BIO_nread(3), BIO_nwrite0(3), BIO_nwrite(3), + BIO_dump_cb(3) and BIO_dump_indent_cb(3) as intentionally undocumented. + - Document BIO_number_read(3) and BIO_number_written(3) + - Merge documentation of UI_null() from OpenSSL 1.1 + - Document BIO_set_retry_read(3), BIO_set_retry_write(3), BIO_set_retry_special(3), + BIO_clear_retry_flags(3), BIO_get_retry_flags(3), and the BIO_FLAGS_* constants + - Document BIO_dup_chain(3). + - Document BIO_set_flags(3), BIO_clear_flags(3), BIO_test_flags(3), and BIO_get_flags(3). + - Document BIO_callback_fn_ex(3), BIO_set_callback_ex(3), BIO_get_callback_ex(3), + and BIO_callback_fn(3). + - Document ED25519_keypair(3), ED25519_sign(3), and ED25519_verify(3). + - Document EVP_PKEY_new_raw_private_key(3), EVP_PKEY_new_raw_public_key(3), + EVP_PKEY_get_raw_private_key(3), and EVP_PKEY_get_raw_public_key(3). + - Document ASN1_buf_print(3). + - Document ED25519_keypair(3), ED25519_sign(3), and ED25519_verify(3). + - Document ECDSA_SIG_get0_{r,s}(). + - Document DH_get0_* for individual DH members. + - Document DSA_get0_* for individual DSA members + - Document RSA_get0_* for individual RSA members. + - Various spelling and other documentation improvements. + * Testing and Proactive Security + - As always, new test coverage is added as bugs are fixed and + subsystems are cleaned up + - New Wycheproof tests added. + - OpenSSL 3.0 Interop tests added. + - Many old tests rewritten, cleaned up and extended. + * New features + - Modifications to perlasm and assembly code to move constants out of + executable memory to rodata memory, thus supportinf execute only + memory + - import a copy of OpenSSL 1.1's cmeth_lib.c + - Provide UI_null() + - Expose various X509_STORE_*check_issued() + - Expose X509_CRL_get0_sigalg() and X509_get0_uids + - Expose the EVP_CIPHER_meth_* API (setter only) in evp.h + - Introduce X509_get0_uids() accessor function +>>>>>>> 788c39a (3.7.1. ChangeLog) +3.7.0 - Development release * Internal improvements - Remove dependency on system timegm() and gmtime() by replacing traditional Julian date conversion with POSIX epoch-seconds date From 977be09d69a9f9b7eaf85dbd83465c0ec8361598 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 15 Mar 2023 17:33:08 -0600 Subject: [PATCH 0201/1283] Fix build for MSVC --- patches/crypto_namespace.h.patch | 33 +++++---- patches/libcrypto.hidden.patch | 120 +++++++++++++++++++++++++++++++ patches/libssl.hidden.patch | 15 ++++ patches/opensslfeatures.h.patch | 16 +++++ patches/ssl_namespace.h.patch | 32 +++++---- 5 files changed, 192 insertions(+), 24 deletions(-) create mode 100644 patches/libcrypto.hidden.patch create mode 100644 patches/libssl.hidden.patch create mode 100644 patches/opensslfeatures.h.patch diff --git a/patches/crypto_namespace.h.patch b/patches/crypto_namespace.h.patch index 27515244e0..171e7f54cd 100644 --- a/patches/crypto_namespace.h.patch +++ b/patches/crypto_namespace.h.patch @@ -1,13 +1,22 @@ ---- crypto/hidden/crypto_namespace.h.orig 2023-02-28 00:41:43.212756628 -0600 -+++ crypto/hidden/crypto_namespace.h 2023-02-28 00:42:01.152756349 -0600 -@@ -18,6 +18,10 @@ - #ifndef _LIBCRYPTO_CRYPTO_NAMESPACE_H_ - #define _LIBCRYPTO_CRYPTO_NAMESPACE_H_ +--- openbsd/src/lib/libcrypto/hidden/crypto_namespace.h 2023-03-15 11:41:37.614024500 -0600 ++++ crypto/hidden/crypto_namespace.h 2023-03-15 17:12:55.297157400 -0600 +@@ -24,6 +24,12 @@ + * external calls use the latter name. + */ -+#if defined(_MSC_VER) && !defined(__clang__) && !defined(__attribute__) -+#define __attribute__(a) -+#endif -+ - /* - * If marked as 'used', then internal calls use the name with prefix "_lcry_" - * and we alias that to the normal name *and* the name with prefix "_libre_"; ++#ifdef _MSC_VER ++# define LCRYPTO_UNUSED(x) ++# define LCRYPTO_USED(x) ++# define LCRYPTO_ALIAS1(pre, x) ++# define LCRYPTO_ALIAS(x) ++#else + #ifdef LIBRESSL_NAMESPACE + # define LCRYPTO_UNUSED(x) typeof(x) x __attribute__((deprecated)) + #ifdef LIBRESSL_CRYPTO_NAMESPACE +@@ -40,5 +46,6 @@ + # define LCRYPTO_ALIAS1(pre,x) + # define LCRYPTO_ALIAS(x) asm("") + #endif ++#endif /* _MSC_VER */ + + #endif /* _LIBCRYPTO_CRYPTO_NAMESPACE_H_ */ diff --git a/patches/libcrypto.hidden.patch b/patches/libcrypto.hidden.patch new file mode 100644 index 0000000000..a00a3dd231 --- /dev/null +++ b/patches/libcrypto.hidden.patch @@ -0,0 +1,120 @@ +diff -u openbsd/src/lib/libcrypto/hidden/openssl/hmac.h crypto/hidden/openssl/hmac.h +--- openbsd/src/lib/libcrypto/hidden/openssl/hmac.h 2023-03-15 11:41:37.632580800 -0600 ++++ crypto/hidden/openssl/hmac.h 2023-03-15 16:49:29.144080400 -0600 +@@ -18,7 +18,11 @@ + #ifndef _LIBCRYPTO_HMAC_H_ + #define _LIBCRYPTO_HMAC_H_ + ++#ifdef _MSC_VER ++#include <../include/openssl/hmac.h> ++#else + #include_next ++#endif + #include "crypto_namespace.h" + + LCRYPTO_USED(HMAC_CTX_new); +diff -u openbsd/src/lib/libcrypto/hidden/openssl/pkcs12.h crypto/hidden/openssl/pkcs12.h +--- openbsd/src/lib/libcrypto/hidden/openssl/pkcs12.h 2023-03-15 11:41:37.648024900 -0600 ++++ crypto/hidden/openssl/pkcs12.h 2023-03-15 17:15:36.015981800 -0600 +@@ -18,7 +18,11 @@ + #ifndef _LIBCRYPTO_PKCS12_H + #define _LIBCRYPTO_PKCS12_H + ++#ifdef _MSC_VER ++#include <../include/openssl/pkcs12.h> ++#else + #include_next ++#endif + #include "crypto_namespace.h" + + LCRYPTO_USED(PKCS12_SAFEBAG_get0_attr); +diff -u openbsd/src/lib/libcrypto/hidden/openssl/pkcs7.h crypto/hidden/openssl/pkcs7.h +--- openbsd/src/lib/libcrypto/hidden/openssl/pkcs7.h 2023-03-15 11:41:37.663599200 -0600 ++++ crypto/hidden/openssl/pkcs7.h 2023-03-15 16:53:43.232866600 -0600 +@@ -18,7 +18,11 @@ + #ifndef _LIBCRYPTO_PKCS7_H + #define _LIBCRYPTO_PKCS7_H + ++#ifdef _MSC_VER ++#include <../include/openssl/pkcs7.h> ++#else + #include_next ++#endif + #include "crypto_namespace.h" + + LCRYPTO_USED(PKCS7_ISSUER_AND_SERIAL_new); +diff -u openbsd/src/lib/libcrypto/hidden/openssl/stack.h crypto/hidden/openssl/stack.h +--- openbsd/src/lib/libcrypto/hidden/openssl/stack.h 2023-03-15 11:41:37.680453800 -0600 ++++ crypto/hidden/openssl/stack.h 2023-03-15 16:49:29.200142600 -0600 +@@ -18,7 +18,11 @@ + #ifndef _LIBCRYPTO_STACK_H + #define _LIBCRYPTO_STACK_H + ++#ifdef _MSC_VER ++#include <../include/openssl/stack.h> ++#else + #include_next ++#endif + #include "crypto_namespace.h" + + LCRYPTO_USED(sk_num); +diff -u openbsd/src/lib/libcrypto/hidden/openssl/ui.h crypto/hidden/openssl/ui.h +--- openbsd/src/lib/libcrypto/hidden/openssl/ui.h 2023-03-15 11:41:37.696291800 -0600 ++++ crypto/hidden/openssl/ui.h 2023-03-15 16:49:29.222310800 -0600 +@@ -18,7 +18,11 @@ + #ifndef _LIBCRYPTO_UI_H + #define _LIBCRYPTO_UI_H + ++#ifdef _MSC_VER ++#include <../include/openssl/ui.h> ++#else + #include_next ++#endif + #include "crypto_namespace.h" + + LCRYPTO_USED(UI_new); +diff -u openbsd/src/lib/libcrypto/hidden/openssl/x509.h crypto/hidden/openssl/x509.h +--- openbsd/src/lib/libcrypto/hidden/openssl/x509.h 2023-03-15 11:41:37.713302600 -0600 ++++ crypto/hidden/openssl/x509.h 2023-03-15 16:49:29.238904200 -0600 +@@ -18,7 +18,11 @@ + #ifndef _LIBCRYPTO_X509_H + #define _LIBCRYPTO_X509_H + ++#ifdef _MSC_VER ++#include <../include/openssl/x509.h> ++#else + #include_next ++#endif + #include "crypto_namespace.h" + + LCRYPTO_USED(X509_CRL_up_ref); +diff -u openbsd/src/lib/libcrypto/hidden/openssl/x509v3.h crypto/hidden/openssl/x509v3.h +--- openbsd/src/lib/libcrypto/hidden/openssl/x509v3.h 2023-03-15 11:41:37.756379100 -0600 ++++ crypto/hidden/openssl/x509v3.h 2023-03-15 16:49:29.264482800 -0600 +@@ -18,7 +18,11 @@ + #ifndef _LIBCRYPTO_X509V3_H + #define _LIBCRYPTO_X509V3_H + ++#ifdef _MSC_VER ++#include <../include/openssl/x509v3.h> ++#else + #include_next ++#endif + #include "crypto_namespace.h" + + LCRYPTO_USED(PROXY_POLICY_new); +diff -u openbsd/src/lib/libcrypto/hidden/openssl/x509_vfy.h crypto/hidden/openssl/x509_vfy.h +--- openbsd/src/lib/libcrypto/hidden/openssl/x509_vfy.h 2023-03-15 11:41:37.735995100 -0600 ++++ crypto/hidden/openssl/x509_vfy.h 2023-03-15 16:49:29.300450300 -0600 +@@ -18,7 +18,11 @@ + #ifndef _LIBCRYPTO_X509_VFY_H + #define _LIBCRYPTO_X509_VFY_H + ++#ifdef _MSC_VER ++#include <../include/openssl/x509_vfy.h> ++#else + #include_next ++#endif + #include "crypto_namespace.h" + + LCRYPTO_USED(X509_STORE_set_depth); diff --git a/patches/libssl.hidden.patch b/patches/libssl.hidden.patch new file mode 100644 index 0000000000..5a8c2c8181 --- /dev/null +++ b/patches/libssl.hidden.patch @@ -0,0 +1,15 @@ +diff -u openbsd/src/lib/libssl/hidden/openssl/ssl.h ssl/hidden/openssl/ssl.h +--- openbsd/src/lib/libssl/hidden/openssl/ssl.h 2023-03-15 11:41:52.466146400 -0600 ++++ ssl/hidden/openssl/ssl.h 2023-03-15 16:49:29.358377300 -0600 +@@ -18,7 +18,11 @@ + #ifndef _LIBSSL_SSL_H_ + #define _LIBSSL_SSL_H_ + ++#ifdef _MSC_VER ++#include <../include/openssl/ssl.h> ++#else + #include_next ++#endif + #include "ssl_namespace.h" + + LSSL_USED(BIO_f_ssl); diff --git a/patches/opensslfeatures.h.patch b/patches/opensslfeatures.h.patch new file mode 100644 index 0000000000..8ee311d446 --- /dev/null +++ b/patches/opensslfeatures.h.patch @@ -0,0 +1,16 @@ +--- openbsd/src/lib/libcrypto/opensslfeatures.h 2023-03-15 11:41:47.301015100 -0600 ++++ include/openssl/opensslfeatures.h 2023-03-15 18:27:57.740024800 -0600 +@@ -7,6 +7,13 @@ + #define LIBRESSL_HAS_TLS1_3 + #define LIBRESSL_HAS_DTLS1_2 + ++/* ++ * Used for compatibility with compilers lacking __attribute__ ++ */ ++#if defined(_MSC_VER) && !defined(__clang__) && !defined(__attribute__) ++#define __attribute__(a) ++#endif ++ + #define OPENSSL_THREADS + + #define OPENSSL_NO_BUF_FREELISTS diff --git a/patches/ssl_namespace.h.patch b/patches/ssl_namespace.h.patch index 649e862a7e..758f8dcd2a 100644 --- a/patches/ssl_namespace.h.patch +++ b/patches/ssl_namespace.h.patch @@ -1,13 +1,21 @@ ---- ssl/hidden/ssl_namespace.h.orig 2023-02-28 00:42:20.928756042 -0600 -+++ ssl/hidden/ssl_namespace.h 2023-02-28 00:43:16.372755180 -0600 -@@ -18,6 +18,10 @@ - #ifndef _LIBSSL_SSL_NAMESPACE_H_ - #define _LIBSSL_SSL_NAMESPACE_H_ - -+#if defined(_MSC_VER) && !defined(__clang__) && !defined(__attribute__) -+#define __attribute__(a) -+#endif -+ - /* - * If marked as 'used', then internal calls use the name with prefix "_lssl_" +--- openbsd/src/lib/libssl/hidden/ssl_namespace.h 2023-03-15 11:41:52.481641800 -0600 ++++ ssl/hidden/ssl_namespace.h 2023-03-15 17:28:04.685309300 -0600 +@@ -23,6 +23,11 @@ * and we alias that to the normal name. + */ + ++#ifdef _MSC_VER ++#define LSSL_UNUSED(x) ++#define LSSL_USED(x) ++#define LSSL_ALIAS(x) ++#else + #ifdef LIBRESSL_NAMESPACE + #define LSSL_UNUSED(x) typeof(x) x __attribute__((deprecated)) + #define LSSL_USED(x) __attribute__((visibility("hidden"))) \ +@@ -33,5 +38,6 @@ + #define LSSL_USED(x) + #define LSSL_ALIAS(x) asm("") + #endif ++#endif /* _MSC_VER */ + + #endif /* _LIBSSL_SSL_NAMESPACE_H_ */ From ce4536684c9b3d82c99318da257525c0e651983b Mon Sep 17 00:00:00 2001 From: Bob Beck Date: Wed, 15 Mar 2023 20:34:00 -0600 Subject: [PATCH 0202/1283] Fix up 3.7.1 changelog --- ChangeLog | 52 +++++++++++++++++----------------------------------- 1 file changed, 17 insertions(+), 35 deletions(-) diff --git a/ChangeLog b/ChangeLog index fbfdacb5f6..58eebcbed6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -41,28 +41,7 @@ LibreSSL Portable Release Notes: - Assorted initial cleanup in the EC code - Fixed Perl assembly generators to move constants into .rodata. This allows code to run with execute-only permissions - * Bug fixes - - Fixed a memory leak, a double free and various other issues in - BIO_new_NDEF() - - Avoid infinite loops in DSA and ECDSA signing - - Check DSA parameter sanity - - Fixed various crashes in the openssl(1) testing utility - - Do not check policies by default in the new X.509 verifier - * Public API: - - added EVP_CIPHER_meth_* support (only setters) - - UI_null(), X509_CRL_get0_tbs_sigalg(), X509_STORE_*check_issued(), - X509_get0_uids() - * Security fix - - A malicious certificate revocation list or timestamp response token - would allow an attacker to read arbitrary memory. - -3.7.0 - Development release -======= -3.7.1 - Stable release - * Internal improvements - - Extensive reworking of bignum and montgomery multiplication support (BN_). - - Transition to using s2n-bignum assembly implementation for bignum on amd64 - - ASN1 parsing rework and improvements, including infinite loop avoidance. + - ASN1 parsing rework and improvements - Make UI_destroy_method() NULL safe. - Various improvements to nc - Call CRYPTO_cleanup_all_ex_data() from OPENSSL_cleanup(). @@ -72,13 +51,24 @@ LibreSSL Portable Release Notes: - Cap the number of iterations in DSA signing, and other DSA sanity checks. - Always clear EC groups and points on free. - Various other internal cleanups - * Compatibility changes - - correct the prototypes of BIO_get_conn_ip(3) and BIO_get_conn_int_port(3) * Bug fixes + - Fixed a memory leak, a double free and various other issues in + BIO_new_NDEF() + - Avoid infinite loops in DSA and ECDSA signing + - Check DSA parameter sanity + - Fixed various crashes in the openssl(1) testing utility + - Do not check policies by default in the new X.509 verifier - Avoid -0 in BN_div_word(). - Fix an off-by-one in dsa_check_key() - openssl(1) asn1parse: avoid crash with ASN.1 BOOLEANS - Add missing error checking in PKCS7 + * Compatibility changes + - correct the prototypes of BIO_get_conn_ip(3) and BIO_get_conn_int_port(3) + - Provide UI_null() + - Expose various X509_STORE_*check_issued() + - Expose X509_CRL_get0_sigalg() and X509_get0_uids + - Expose the EVP_CIPHER_meth_* API (setter only) in evp.h + - Introduce X509_get0_uids() accessor function * Documentation improvements - Mark BIO_s_log(3) BIO_nread0(3), BIO_nread(3), BIO_nwrite0(3), BIO_nwrite(3), BIO_dump_cb(3) and BIO_dump_indent_cb(3) as intentionally undocumented. @@ -106,17 +96,9 @@ LibreSSL Portable Release Notes: - New Wycheproof tests added. - OpenSSL 3.0 Interop tests added. - Many old tests rewritten, cleaned up and extended. - * New features - - Modifications to perlasm and assembly code to move constants out of - executable memory to rodata memory, thus supportinf execute only - memory - - import a copy of OpenSSL 1.1's cmeth_lib.c - - Provide UI_null() - - Expose various X509_STORE_*check_issued() - - Expose X509_CRL_get0_sigalg() and X509_get0_uids - - Expose the EVP_CIPHER_meth_* API (setter only) in evp.h - - Introduce X509_get0_uids() accessor function ->>>>>>> 788c39a (3.7.1. ChangeLog) + * Security fix + - A malicious certificate revocation list or timestamp response token + would allow an attacker to read arbitrary memory. 3.7.0 - Development release * Internal improvements From ab7e90a209b734622f6f968ad7be258636a9b9e8 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 15 Mar 2023 22:01:22 -0500 Subject: [PATCH 0203/1283] fix more formatting and remove redundancy --- ChangeLog | 63 +++++++++++++++++++++++++++---------------------------- 1 file changed, 31 insertions(+), 32 deletions(-) diff --git a/ChangeLog b/ChangeLog index 58eebcbed6..edbf17799f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,7 +28,6 @@ history is also available from Git. LibreSSL Portable Release Notes: -<<<<<<< HEAD 3.7.1 - Development release * Internal improvements @@ -38,69 +37,69 @@ LibreSSL Portable Release Notes: - Imported s2n-bignum's constant time assembly primitives. Use them for amd64 and arm64. - Lots of cleanup, simplification and bug fixes - - Assorted initial cleanup in the EC code - Fixed Perl assembly generators to move constants into .rodata. - This allows code to run with execute-only permissions + This allows code to run with execute-only permissions. - ASN1 parsing rework and improvements - - Make UI_destroy_method() NULL safe. + - Make UI_destroy_method() NULL safe. - Various improvements to nc - - Call CRYPTO_cleanup_all_ex_data() from OPENSSL_cleanup(). - - Various internal EC improvements. - - Various openssl(1) improvements. - - Cap the number of iterations in ECDSA signing - - Cap the number of iterations in DSA signing, and other DSA sanity checks. + - Call CRYPTO_cleanup_all_ex_data() from OPENSSL_cleanup(). + - Cap the number of iterations in ECDSA signing,DSA signing, and other + DSA sanity checks. - Always clear EC groups and points on free. - - Various other internal cleanups + - Cleanup and improvements in EC code + - Various openssl(1) improvements. * Bug fixes - Fixed a memory leak, a double free and various other issues in BIO_new_NDEF() - - Avoid infinite loops in DSA and ECDSA signing + - Avoid infinite loops in DSA and ECDSA signing. - Check DSA parameter sanity - - Fixed various crashes in the openssl(1) testing utility - - Do not check policies by default in the new X.509 verifier + - Fixed various crashes in the openssl(1) testing utility. + - Do not check policies by default in the new X.509 verifier. - Avoid -0 in BN_div_word(). - - Fix an off-by-one in dsa_check_key() - - openssl(1) asn1parse: avoid crash with ASN.1 BOOLEANS - - Add missing error checking in PKCS7 + - Fix an off-by-one in dsa_check_key(). + - Avoid crash with ASN.1 BOOLEANS in openssl(1) asn1parse. + - Add missing error checking in PKCS7. * Compatibility changes - - correct the prototypes of BIO_get_conn_ip(3) and BIO_get_conn_int_port(3) + - Correct the prototypes of BIO_get_conn_ip(3) and + BIO_get_conn_int_port(3). - Provide UI_null() - Expose various X509_STORE_*check_issued() - Expose X509_CRL_get0_sigalg() and X509_get0_uids - Expose the EVP_CIPHER_meth_* API (setter only) in evp.h - Introduce X509_get0_uids() accessor function * Documentation improvements - - Mark BIO_s_log(3) BIO_nread0(3), BIO_nread(3), BIO_nwrite0(3), BIO_nwrite(3), - BIO_dump_cb(3) and BIO_dump_indent_cb(3) as intentionally undocumented. - - Document BIO_number_read(3) and BIO_number_written(3) + - Mark BIO_s_log(3) BIO_nread0(3), BIO_nread(3), BIO_nwrite0(3), BIO_nwrite(3), + BIO_dump_cb(3) and BIO_dump_indent_cb(3) as intentionally undocumented. - Merge documentation of UI_null() from OpenSSL 1.1 - - Document BIO_set_retry_read(3), BIO_set_retry_write(3), BIO_set_retry_special(3), - BIO_clear_retry_flags(3), BIO_get_retry_flags(3), and the BIO_FLAGS_* constants - - Document BIO_dup_chain(3). - - Document BIO_set_flags(3), BIO_clear_flags(3), BIO_test_flags(3), and BIO_get_flags(3). - - Document BIO_callback_fn_ex(3), BIO_set_callback_ex(3), BIO_get_callback_ex(3), - and BIO_callback_fn(3). + - Document BIO_number_read(3), BIO_number_written(3), + BIO_set_retry_read(3), BIO_set_retry_write(3), + BIO_set_retry_special(3), BIO_clear_retry_flags(3), + BIO_get_retry_flags(3), BIO_dup_chain(3), BIO_set_flags(3), + BIO_clear_flags(3), BIO_test_flags(3), BIO_get_flags(3). + BIO_callback_fn_ex(3), BIO_set_callback_ex(3), BIO_get_callback_ex(3), + BIO_callback_fn(3), and the BIO_FLAGS_* constants - Document ED25519_keypair(3), ED25519_sign(3), and ED25519_verify(3). - - Document EVP_PKEY_new_raw_private_key(3), EVP_PKEY_new_raw_public_key(3), - EVP_PKEY_get_raw_private_key(3), and EVP_PKEY_get_raw_public_key(3). + - Document EVP_PKEY_new_raw_private_key(3), + EVP_PKEY_new_raw_public_key(3), EVP_PKEY_get_raw_private_key(3), and + EVP_PKEY_get_raw_public_key(3). - Document ASN1_buf_print(3). - - Document ED25519_keypair(3), ED25519_sign(3), and ED25519_verify(3). - Document ECDSA_SIG_get0_{r,s}(). - Document DH_get0_* for individual DH members. - Document DSA_get0_* for individual DSA members - Document RSA_get0_* for individual RSA members. - Various spelling and other documentation improvements. * Testing and Proactive Security - - As always, new test coverage is added as bugs are fixed and - subsystems are cleaned up + - As always, new test coverage is added as bugs are fixed and subsystems + are cleaned up - New Wycheproof tests added. - - OpenSSL 3.0 Interop tests added. + - OpenSSL 3.0 Interop tests added. - Many old tests rewritten, cleaned up and extended. * Security fix - A malicious certificate revocation list or timestamp response token would allow an attacker to read arbitrary memory. 3.7.0 - Development release + * Internal improvements - Remove dependency on system timegm() and gmtime() by replacing traditional Julian date conversion with POSIX epoch-seconds date From fedc581dcb6cf26d9114ef33ac75f416f3505cd7 Mon Sep 17 00:00:00 2001 From: Joel Sing Date: Thu, 16 Mar 2023 15:54:02 +1100 Subject: [PATCH 0204/1283] Further tweaks and improvements to the ChangeLog --- ChangeLog | 52 ++++++++++++++++++++++++---------------------------- 1 file changed, 24 insertions(+), 28 deletions(-) diff --git a/ChangeLog b/ChangeLog index edbf17799f..71fd38eb84 100644 --- a/ChangeLog +++ b/ChangeLog @@ -33,44 +33,40 @@ LibreSSL Portable Release Notes: * Internal improvements - Initial overhaul of the BIGNUM code: - Added a new framework that allows architecture-dependent - replacement implementations for bignum primitives - - Imported s2n-bignum's constant time assembly primitives. - Use them for amd64 and arm64. - - Lots of cleanup, simplification and bug fixes - - Fixed Perl assembly generators to move constants into .rodata. - This allows code to run with execute-only permissions. - - ASN1 parsing rework and improvements - - Make UI_destroy_method() NULL safe. - - Various improvements to nc - - Call CRYPTO_cleanup_all_ex_data() from OPENSSL_cleanup(). - - Cap the number of iterations in ECDSA signing,DSA signing, and other - DSA sanity checks. + replacement implementations for bignum primitives. + - Imported various s2n-bignum's constant time assembly primitives + and switched amd64 to them. + - Lots of cleanup, simplification and bug fixes. + - Changed Perl assembly generators to move constants into .rodata, + allowing code to run with execute-only permissions. + - Capped the number of iterations in DSA and ECDSA signing (avoiding + infinite loops), added additional sanity checks to DSA. + - ASN.1 parsing improvements. + - Made UI_destroy_method() NULL safe. + - Various improvements to nc(1). - Always clear EC groups and points on free. - - Cleanup and improvements in EC code + - Cleanup and improvements in EC code. - Various openssl(1) improvements. * Bug fixes - Fixed a memory leak, a double free and various other issues in - BIO_new_NDEF() - - Avoid infinite loops in DSA and ECDSA signing. - - Check DSA parameter sanity + BIO_new_NDEF(). - Fixed various crashes in the openssl(1) testing utility. - Do not check policies by default in the new X.509 verifier. - - Avoid -0 in BN_div_word(). - - Fix an off-by-one in dsa_check_key(). - Avoid crash with ASN.1 BOOLEANS in openssl(1) asn1parse. - - Add missing error checking in PKCS7. + - Added missing error checking in PKCS7. + - Call CRYPTO_cleanup_all_ex_data() from OPENSSL_cleanup(). * Compatibility changes - Correct the prototypes of BIO_get_conn_ip(3) and BIO_get_conn_int_port(3). - - Provide UI_null() - - Expose various X509_STORE_*check_issued() - - Expose X509_CRL_get0_sigalg() and X509_get0_uids - - Expose the EVP_CIPHER_meth_* API (setter only) in evp.h - - Introduce X509_get0_uids() accessor function + * New features + - Added UI_null() + - Added X509_STORE_*check_issued() + - Added X509_CRL_get0_sigalg() and X509_get0_uids() accessors. + - Added EVP_CIPHER_meth_*() setter API. * Documentation improvements - - Mark BIO_s_log(3) BIO_nread0(3), BIO_nread(3), BIO_nwrite0(3), BIO_nwrite(3), + - Marked BIO_s_log(3) BIO_nread0(3), BIO_nread(3), BIO_nwrite0(3), BIO_nwrite(3), BIO_dump_cb(3) and BIO_dump_indent_cb(3) as intentionally undocumented. - - Merge documentation of UI_null() from OpenSSL 1.1 + - Merged documentation of UI_null() from OpenSSL 1.1 - Document BIO_number_read(3), BIO_number_written(3), BIO_set_retry_read(3), BIO_set_retry_write(3), BIO_set_retry_special(3), BIO_clear_retry_flags(3), @@ -90,11 +86,11 @@ LibreSSL Portable Release Notes: - Various spelling and other documentation improvements. * Testing and Proactive Security - As always, new test coverage is added as bugs are fixed and subsystems - are cleaned up + are cleaned up. - New Wycheproof tests added. - OpenSSL 3.0 Interop tests added. - Many old tests rewritten, cleaned up and extended. - * Security fix + * Security fixes - A malicious certificate revocation list or timestamp response token would allow an attacker to read arbitrary memory. From 0b304ec0ca3d7a1b26ef9e5939b15b1b49eaf9d3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 16 Mar 2023 08:48:35 +0100 Subject: [PATCH 0205/1283] Compactify, don't list doc fix as compat change --- ChangeLog | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/ChangeLog b/ChangeLog index 71fd38eb84..6a5e3e2b19 100644 --- a/ChangeLog +++ b/ChangeLog @@ -52,12 +52,8 @@ LibreSSL Portable Release Notes: BIO_new_NDEF(). - Fixed various crashes in the openssl(1) testing utility. - Do not check policies by default in the new X.509 verifier. - - Avoid crash with ASN.1 BOOLEANS in openssl(1) asn1parse. - Added missing error checking in PKCS7. - Call CRYPTO_cleanup_all_ex_data() from OPENSSL_cleanup(). - * Compatibility changes - - Correct the prototypes of BIO_get_conn_ip(3) and - BIO_get_conn_int_port(3). * New features - Added UI_null() - Added X509_STORE_*check_issued() @@ -66,7 +62,6 @@ LibreSSL Portable Release Notes: * Documentation improvements - Marked BIO_s_log(3) BIO_nread0(3), BIO_nread(3), BIO_nwrite0(3), BIO_nwrite(3), BIO_dump_cb(3) and BIO_dump_indent_cb(3) as intentionally undocumented. - - Merged documentation of UI_null() from OpenSSL 1.1 - Document BIO_number_read(3), BIO_number_written(3), BIO_set_retry_read(3), BIO_set_retry_write(3), BIO_set_retry_special(3), BIO_clear_retry_flags(3), @@ -74,15 +69,14 @@ LibreSSL Portable Release Notes: BIO_clear_flags(3), BIO_test_flags(3), BIO_get_flags(3). BIO_callback_fn_ex(3), BIO_set_callback_ex(3), BIO_get_callback_ex(3), BIO_callback_fn(3), and the BIO_FLAGS_* constants + - Correct the prototypes of BIO_get_conn_ip(3) and BIO_get_conn_int_port(3). - Document ED25519_keypair(3), ED25519_sign(3), and ED25519_verify(3). - Document EVP_PKEY_new_raw_private_key(3), EVP_PKEY_new_raw_public_key(3), EVP_PKEY_get_raw_private_key(3), and EVP_PKEY_get_raw_public_key(3). - Document ASN1_buf_print(3). - - Document ECDSA_SIG_get0_{r,s}(). - - Document DH_get0_* for individual DH members. - - Document DSA_get0_* for individual DSA members - - Document RSA_get0_* for individual RSA members. + - Document DH_get0_*, DSA_get0_*, ECDSA_SIG_get0_{r,s}() and RSA_get0_*. + - Merged documentation of UI_null() from OpenSSL 1.1 - Various spelling and other documentation improvements. * Testing and Proactive Security - As always, new test coverage is added as bugs are fixed and subsystems From d82cc196310fceed5da847f41219e51767a20051 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 16 Mar 2023 05:19:24 -0600 Subject: [PATCH 0206/1283] fix typo --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 6a5e3e2b19..662c3feb47 100644 --- a/ChangeLog +++ b/ChangeLog @@ -57,7 +57,7 @@ LibreSSL Portable Release Notes: * New features - Added UI_null() - Added X509_STORE_*check_issued() - - Added X509_CRL_get0_sigalg() and X509_get0_uids() accessors. + - Added X509_CRL_get0_tbs_sigalg() and X509_get0_uids() accessors. - Added EVP_CIPHER_meth_*() setter API. * Documentation improvements - Marked BIO_s_log(3) BIO_nread0(3), BIO_nread(3), BIO_nwrite0(3), BIO_nwrite(3), From 6b3c90efa9debdcf16ebbda2cfe6b34ff5c34cf4 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 18 Mar 2023 03:01:43 -0600 Subject: [PATCH 0207/1283] Unhook the bn_mod_exp_zero test --- tests/CMakeLists.txt | 7 ------- tests/Makefile.am | 6 ------ 2 files changed, 13 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 991076f369..27a96007cd 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -148,13 +148,6 @@ set_source_files_properties(bn_mod_exp.c PROPERTIES COMPILE_FLAGS target_link_libraries(bn_mod_exp ${OPENSSL_TEST_LIBS}) add_test(bn_mod_exp bn_mod_exp) -# bn_mod_exp_zero -add_executable(bn_mod_exp_zero bn_mod_exp_zero.c) -set_source_files_properties(bn_mod_exp_zero.c PROPERTIES COMPILE_FLAGS - -ULIBRESSL_INTERNAL) -target_link_libraries(bn_mod_exp_zero ${OPENSSL_TEST_LIBS}) -add_test(bn_mod_exp_zero bn_mod_exp_zero) - # bn_mod_exp2_mont add_executable(bn_mod_exp2_mont bn_mod_exp2_mont.c) target_link_libraries(bn_mod_exp2_mont ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 2a18b84e8d..b4d50e38c9 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -165,12 +165,6 @@ check_PROGRAMS += bn_mod_exp bn_mod_exp_CPPFLAGS = $(AM_CPPFLAGS) -ULIBRESSL_INTERNAL bn_mod_exp_SOURCES = bn_mod_exp.c -# bn_mod_exp_zero -TESTS += bn_mod_exp_zero -check_PROGRAMS += bn_mod_exp_zero -bn_mod_exp_zero_CPPFLAGS = $(AM_CPPFLAGS) -ULIBRESSL_INTERNAL -bn_mod_exp_zero_SOURCES = bn_mod_exp_zero.c - # bn_mod_exp2_mont TESTS += bn_mod_exp2_mont check_PROGRAMS += bn_mod_exp2_mont From 59261d04c5618711d63d457863a83e55f770efc1 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 19 Mar 2023 23:19:00 -0600 Subject: [PATCH 0208/1283] Adjust rust-openssl version check --- .github/rust-openssl.patch | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/.github/rust-openssl.patch b/.github/rust-openssl.patch index 9ff4ea0558..fac4ae6dff 100644 --- a/.github/rust-openssl.patch +++ b/.github/rust-openssl.patch @@ -1,12 +1,11 @@ diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs -index cdea3eb4..b16ebecf 100644 +index 3357518f..f55b5def 100644 --- a/openssl-sys/build/main.rs +++ b/openssl-sys/build/main.rs -@@ -282,7 +282,7 @@ See rust-openssl documentation for more information: - (3, 5, _) => ('3', '5', 'x'), - (3, 6, 0) => ('3', '6', '0'), +@@ -295,6 +295,7 @@ See rust-openssl documentation for more information: (3, 6, _) => ('3', '6', 'x'), -- (3, 7, 0) => ('3', '7', '0'), + (3, 7, 0) => ('3', '7', '0'), + (3, 7, 1) => ('3', '7', '1'), + (3, 7, _) => ('3', '7', 'x'), _ => version_error(), }; From 73d924f643be938205d434dc7ba7aa642150ba84 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 23 Mar 2023 06:07:31 -0500 Subject: [PATCH 0209/1283] fix mips/mips64 builds --- configure.ac | 15 ++-- crypto/Makefile.am | 16 +++- crypto/Makefile.am.elf-mips | 24 +++++ crypto/Makefile.am.elf-mips64 | 24 +++++ crypto/bn/arch/mips/bn_arch.h | 24 +++++ include/arch/mips/opensslconf.h | 154 ++++++++++++++++++++++++++++++++ scripts/test | 17 ++++ update.sh | 97 +++++++++++++------- 8 files changed, 327 insertions(+), 44 deletions(-) create mode 100644 crypto/Makefile.am.elf-mips create mode 100644 crypto/Makefile.am.elf-mips64 create mode 100644 crypto/bn/arch/mips/bn_arch.h create mode 100644 include/arch/mips/opensslconf.h diff --git a/configure.ac b/configure.ac index f3d7c770e4..51e096bd90 100644 --- a/configure.ac +++ b/configure.ac @@ -77,9 +77,9 @@ AS_CASE([$host_cpu], [arm64], [host_cpu=aarch64], [*arm*], [host_cpu=arm], [*amd64*], [host_cpu=x86_64 HOSTARCH=intel], - [i?86], [host_cpu=i386 HOSTARCH=intel], - [mipsel*], [host_cpu=mips], - [mips64el*], [host_cpu=mips64], + [i?86], [host_cpu=i386 HOSTARCH=intel enable_asm=no], + [mips64*], [host_cpu=mips64 enable_asm=no], + [mips*], [host_cpu=mips enable_asm=no], [powerpc*], [host_cpu=powerpc], [ppc64*], [host_cpu=powerpc64], [x86_64], [HOSTARCH=intel] @@ -109,13 +109,16 @@ int main() {return 0;} AC_MSG_RESULT(no) ]) -AC_ARG_ENABLE([asm], - AS_HELP_STRING([--disable-asm], [Disable assembly])) -AM_CONDITIONAL([OPENSSL_NO_ASM], [test "x$enable_asm" = "xno" -o "$host_cpu" = "i386"]) +AC_ARG_ENABLE([asm], AS_HELP_STRING([--disable-asm], [Disable assembly])) +AM_CONDITIONAL([OPENSSL_NO_ASM], [test "x$enable_asm" = "xno"]) # Conditionally enable assembly by default AM_CONDITIONAL([HOST_ASM_ELF_ARM], [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "arm" -a "x$enable_asm" != "xno"]) +AM_CONDITIONAL([HOST_ASM_ELF_MIPS], + [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "mips" -a "x$enable_asm" != "xno"]) +AM_CONDITIONAL([HOST_ASM_ELF_MIPS64], + [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "mips64" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_ELF_X86_64], [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "x86_64" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_MACOSX_X86_64], diff --git a/crypto/Makefile.am b/crypto/Makefile.am index e456198fb6..3939802922 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -136,10 +136,6 @@ endif libcrypto_la_CPPFLAGS = -I$(top_srcdir)/crypto/hidden ${AM_CPPFLAGS} libcrypto_la_CPPFLAGS += -DLIBRESSL_INTERNAL libcrypto_la_CPPFLAGS += -DOPENSSL_NO_HW_PADLOCK -if OPENSSL_NO_ASM -libcrypto_la_CPPFLAGS += -DOPENSSL_NO_ASM -else -endif if OPENSSLDIR_DEFINED libcrypto_la_CPPFLAGS += -DOPENSSLDIR=\"@OPENSSLDIR@\" @@ -247,16 +243,21 @@ libcrypto_la_SOURCES = EXTRA_libcrypto_la_SOURCES = include Makefile.am.elf-arm +include Makefile.am.elf-mips +include Makefile.am.elf-mips64 include Makefile.am.elf-x86_64 include Makefile.am.macosx-x86_64 include Makefile.am.masm-x86_64 include Makefile.am.mingw64-x86_64 if !HOST_ASM_ELF_ARM +if !HOST_ASM_ELF_MIPS +if !HOST_ASM_ELF_MIPS64 if !HOST_ASM_ELF_X86_64 if !HOST_ASM_MACOSX_X86_64 if !HOST_ASM_MASM_X86_64 if !HOST_ASM_MINGW64_X86_64 +libcrypto_la_CPPFLAGS += -DOPENSSL_NO_ASM libcrypto_la_SOURCES += aes/aes_cbc.c libcrypto_la_SOURCES += aes/aes_core.c libcrypto_la_SOURCES += camellia/camellia.c @@ -269,6 +270,8 @@ endif endif endif endif +endif +endif libcrypto_la_SOURCES += cpt_err.c libcrypto_la_SOURCES += cryptlib.c @@ -459,6 +462,11 @@ libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/i386/ endif noinst_HEADERS += bn/arch/i386/bn_arch.h +if HOST_MIPS +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/mips/ +endif +noinst_HEADERS += bn/arch/mips/bn_arch.h + if HOST_MIPS64 libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/mips64/ endif diff --git a/crypto/Makefile.am.elf-mips b/crypto/Makefile.am.elf-mips new file mode 100644 index 0000000000..9c4a70f151 --- /dev/null +++ b/crypto/Makefile.am.elf-mips @@ -0,0 +1,24 @@ +ASM_MIPS_ELF = aes/aes-mips.S +ASM_MIPS_ELF += bn/bn-mips.S +ASM_MIPS_ELF += bn/mont-mips.S +ASM_MIPS_ELF += sha/sha1-mips.S +ASM_MIPS_ELF += sha/sha512-mips.S +ASM_MIPS_ELF += sha/sha256-mips.S + +ASM_MIPS_ELF += aes/aes_cbc.c +ASM_MIPS_ELF += camellia/camellia.c +ASM_MIPS_ELF += camellia/cmll_cbc.c +ASM_MIPS_ELF += rc4/rc4_enc.c +ASM_MIPS_ELF += rc4/rc4_skey.c +ASM_MIPS_ELF += whrlpool/wp_block.c + +EXTRA_DIST += $(ASM_MIPS_ELF) + +if HOST_ASM_ELF_MIPS +libcrypto_la_CPPFLAGS += -DAES_ASM +libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT +libcrypto_la_CPPFLAGS += -DSHA1_ASM +libcrypto_la_CPPFLAGS += -DSHA256_ASM +libcrypto_la_CPPFLAGS += -DSHA512_ASM +libcrypto_la_SOURCES += $(ASM_MIPS_ELF) +endif diff --git a/crypto/Makefile.am.elf-mips64 b/crypto/Makefile.am.elf-mips64 new file mode 100644 index 0000000000..c599fa8396 --- /dev/null +++ b/crypto/Makefile.am.elf-mips64 @@ -0,0 +1,24 @@ +ASM_MIPS64_ELF = aes/aes-mips.S +ASM_MIPS64_ELF += bn/bn-mips.S +ASM_MIPS64_ELF += bn/mont-mips.S +ASM_MIPS64_ELF += sha/sha1-mips.S +ASM_MIPS64_ELF += sha/sha512-mips.S +ASM_MIPS64_ELF += sha/sha256-mips.S + +ASM_MIPS64_ELF += aes/aes_cbc.c +ASM_MIPS64_ELF += camellia/camellia.c +ASM_MIPS64_ELF += camellia/cmll_cbc.c +ASM_MIPS64_ELF += rc4/rc4_enc.c +ASM_MIPS64_ELF += rc4/rc4_skey.c +ASM_MIPS64_ELF += whrlpool/wp_block.c + +EXTRA_DIST += $(ASM_MIPS64_ELF) + +if HOST_ASM_ELF_MIPS64 +libcrypto_la_CPPFLAGS += -DAES_ASM +libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT +libcrypto_la_CPPFLAGS += -DSHA1_ASM +libcrypto_la_CPPFLAGS += -DSHA256_ASM +libcrypto_la_CPPFLAGS += -DSHA512_ASM +libcrypto_la_SOURCES += $(ASM_MIPS64_ELF) +endif diff --git a/crypto/bn/arch/mips/bn_arch.h b/crypto/bn/arch/mips/bn_arch.h new file mode 100644 index 0000000000..4d6571f9cb --- /dev/null +++ b/crypto/bn/arch/mips/bn_arch.h @@ -0,0 +1,24 @@ +/* $OpenBSD: bn_arch.h,v 1.1 2023/01/20 10:04:34 jsing Exp $ */ +/* + * Copyright (c) 2023 Joel Sing + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef HEADER_BN_ARCH_H +#define HEADER_BN_ARCH_H + +#ifndef OPENSSL_NO_ASM + +#endif +#endif diff --git a/include/arch/mips/opensslconf.h b/include/arch/mips/opensslconf.h new file mode 100644 index 0000000000..f17d3d2803 --- /dev/null +++ b/include/arch/mips/opensslconf.h @@ -0,0 +1,154 @@ +#include +/* crypto/opensslconf.h.in */ + +#if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR) +#define OPENSSLDIR "/etc/ssl" +#endif + +#undef OPENSSL_UNISTD +#define OPENSSL_UNISTD + +#undef OPENSSL_EXPORT_VAR_AS_FUNCTION + +#if defined(HEADER_IDEA_H) && !defined(IDEA_INT) +#define IDEA_INT unsigned int +#endif + +#if defined(HEADER_MD2_H) && !defined(MD2_INT) +#define MD2_INT unsigned int +#endif + +#if defined(HEADER_RC2_H) && !defined(RC2_INT) +/* I need to put in a mod for the alpha - eay */ +#define RC2_INT unsigned int +#endif + +#if defined(HEADER_RC4_H) +#if !defined(RC4_INT) +/* using int types make the structure larger but make the code faster + * on most boxes I have tested - up to %20 faster. */ +/* + * I don't know what does "most" mean, but declaring "int" is a must on: + * - Intel P6 because partial register stalls are very expensive; + * - elder Alpha because it lacks byte load/store instructions; + */ +#define RC4_INT unsigned int +#endif +#if !defined(RC4_CHUNK) +/* + * This enables code handling data aligned at natural CPU word + * boundary. See crypto/rc4/rc4_enc.c for further details. + */ +#undef RC4_CHUNK +#endif +#endif + +#if (defined(HEADER_NEW_DES_H) || defined(HEADER_DES_H)) && !defined(DES_LONG) +/* If this is set to 'unsigned int' on a DEC Alpha, this gives about a + * %20 speed up (longs are 8 bytes, int's are 4). */ +#ifndef DES_LONG +#define DES_LONG unsigned int +#endif +#endif + +#if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H) +#define CONFIG_HEADER_BN_H +#define BN_LLONG + +/* Should we define BN_DIV2W here? */ + +/* Only one for the following should be defined */ +/* The prime number generation stuff may not work when + * EIGHT_BIT but I don't care since I've only used this mode + * for debugging the bignum libraries */ +#undef SIXTY_FOUR_BIT_LONG +#undef SIXTY_FOUR_BIT +#define THIRTY_TWO_BIT +#undef SIXTEEN_BIT +#undef EIGHT_BIT +#endif + +#if defined(HEADER_RC4_LOCL_H) && !defined(CONFIG_HEADER_RC4_LOCL_H) +#define CONFIG_HEADER_RC4_LOCL_H +/* if this is defined data[i] is used instead of *data, this is a %20 + * speedup on x86 */ +#define RC4_INDEX +#endif + +#if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H) +#define CONFIG_HEADER_BF_LOCL_H +#undef BF_PTR +#endif /* HEADER_BF_LOCL_H */ + +#if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H) +#define CONFIG_HEADER_DES_LOCL_H +#ifndef DES_DEFAULT_OPTIONS +/* the following is tweaked from a config script, that is why it is a + * protected undef/define */ +#ifndef DES_PTR +#undef DES_PTR +#endif + +/* This helps C compiler generate the correct code for multiple functional + * units. It reduces register dependencies at the expense of 2 more + * registers */ +#ifndef DES_RISC1 +#undef DES_RISC1 +#endif + +#ifndef DES_RISC2 +#undef DES_RISC2 +#endif + +#if defined(DES_RISC1) && defined(DES_RISC2) +YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!! +#endif + +/* Unroll the inner loop, this sometimes helps, sometimes hinders. + * Very much CPU dependent */ +#ifndef DES_UNROLL +#define DES_UNROLL +#endif + +/* These default values were supplied by + * Peter Gutman + * They are only used if nothing else has been defined */ +#if !defined(DES_PTR) && !defined(DES_RISC1) && !defined(DES_RISC2) && !defined(DES_UNROLL) +/* Special defines which change the way the code is built depending on the + CPU and OS. For SGI machines you can use _MIPS_SZLONG (32 or 64) to find + even newer MIPS CPU's, but at the moment one size fits all for + optimization options. Older Sparc's work better with only UNROLL, but + there's no way to tell at compile time what it is you're running on */ + +#if defined( sun ) /* Newer Sparc's */ +# define DES_PTR +# define DES_RISC1 +# define DES_UNROLL +#elif defined( __ultrix ) /* Older MIPS */ +# define DES_PTR +# define DES_RISC2 +# define DES_UNROLL +#elif defined( __osf1__ ) /* Alpha */ +# define DES_PTR +# define DES_RISC2 +#elif defined ( _AIX ) /* RS6000 */ + /* Unknown */ +#elif defined( __hpux ) /* HP-PA */ + /* Unknown */ +#elif defined( __aux ) /* 68K */ + /* Unknown */ +#elif defined( __dgux ) /* 88K (but P6 in latest boxes) */ +# define DES_UNROLL +#elif defined( __sgi ) /* Newer MIPS */ +# define DES_PTR +# define DES_RISC2 +# define DES_UNROLL +#elif defined(i386) || defined(__i386__) /* x86 boxes, should be gcc */ +# define DES_PTR +# define DES_RISC1 +# define DES_UNROLL +#endif /* Systems-specific speed defines */ +#endif + +#endif /* DES_DEFAULT_OPTIONS */ +#endif /* HEADER_DES_LOCL_H */ diff --git a/scripts/test b/scripts/test index 0eb2c06661..34437026df 100755 --- a/scripts/test +++ b/scripts/test @@ -89,6 +89,23 @@ elif [ "x$ARCH" = "xarm32" -o "x$ARCH" = "xarm64" ]; then file apps/openssl/.libs/openssl +elif [ "x$ARCH" = "xmipsel" -o "x$ARCH" = "xmips64el" ]; then + sudo apt-get install -y qemu-user-static binfmt-support + + if [ "x$ARCH" = "xmipsel" ]; then + sudo apt-get install -y g++-mips-linux-gnu + sudo ln -sf /usr/mipsel-linux-gnu/lib/ld.so.1 /lib/ + ./configure --host=mipsel-linux-gnu + LD_LIBRARY_PATH=/usr/mipsel-linux-gnu/lib make -j 4 check + else + sudo apt-get install -y g++-mips64el-linux-gnuabi64 + sudo ln -sf /usr/mips64el-linux-gnuabi64/lib64/ld.so.1 /lib64 + ./configure --host=mips64el-linux-gnuabi64 + LD_LIBRARY_PATH=/usr/mips64el-linux-gnuabi64/lib make -j 4 check + fi + + file apps/openssl/.libs/openssl + elif [ "x$ARCH" = "xandroid" ]; then export TC_FILE=$ANDROID_NDK_HOME/build/cmake/android.toolchain.cmake diff --git a/update.sh b/update.sh index 29600a4703..cac95cad69 100755 --- a/update.sh +++ b/update.sh @@ -180,65 +180,94 @@ fixup_masm() { # generate assembly crypto algorithms asm_src=$libcrypto_src gen_asm_stdout() { - CC=true perl $asm_src/$2 $1 > $3.tmp - [ $1 = "elf" ] && cat <<-EOF >> $3.tmp + CC=true perl $asm_src/$2 $1 > crypto/$3.tmp + [ $1 = "elf" ] && cat <<-EOF >> crypto/$3.tmp #if defined(HAVE_GNU_STACK) .section .note.GNU-stack,"",%progbits #endif EOF if [ $1 = "masm" ]; then - fixup_masm $3.tmp $3 + fixup_masm crypto/$3.tmp crypto/$3 else - $MV $3.tmp $3 + $MV crypto/$3.tmp crypto/$3 fi } +gen_asm_mips() { + abi=$1 + dir=$2 + src=$3 + dst=$4 + CC=true perl $asm_src/$dir/asm/$src.pl $abi $dst.S + cat <<-EOF >> $dst.S + #if defined(HAVE_GNU_STACK) + .section .note.GNU-stack,"",%progbits + #endif + EOF + mv $dst.S crypto/$dir/$dst.S +} gen_asm() { - CC=true perl $asm_src/$2 $1 $3.tmp - [ $1 = "elf" ] && cat <<-EOF >> $3.tmp + CC=true perl $asm_src/$2 $1 crypto/$3.tmp + [ $1 = "elf" ] && cat <<-EOF >> crypto/$3.tmp #if defined(HAVE_GNU_STACK) .section .note.GNU-stack,"",%progbits #endif EOF if [ $1 = "masm" ]; then - fixup_masm $3.tmp $3 + fixup_masm crypto/$3.tmp crypto/$3 else - $MV $3.tmp $3 + $MV crypto/$3.tmp crypto/$3 fi } +#echo generating mips ASM source for elf +gen_asm_mips o32 aes aes-mips aes-mips +gen_asm_mips o32 bn mips bn-mips +gen_asm_mips o32 bn mips-mont mont-mips +gen_asm_mips o32 sha sha1-mips sha1-mips +gen_asm_mips o32 sha sha512-mips sha256-mips +gen_asm_mips o32 sha sha512-mips sha512-mips + +echo generating mips64 ASM source for elf +gen_asm_mips 64 aes aes-mips aes-mips64 +gen_asm_mips 64 bn mips bn-mips64 +gen_asm_mips 64 bn mips-mont mont-mips64 +gen_asm_mips 64 sha sha1-mips sha1-mips64 +gen_asm_mips 64 sha sha512-mips sha256-mips64 +gen_asm_mips 64 sha sha512-mips sha512-mips64 + echo generating arm ASM source for elf -gen_asm_stdout elf aes/asm/aes-armv4.pl crypto/aes/aes-elf-armv4.S -gen_asm_stdout elf bn/asm/armv4-gf2m.pl crypto/bn/gf2m-elf-armv4.S -gen_asm_stdout elf bn/asm/armv4-mont.pl crypto/bn/mont-elf-armv4.S -gen_asm_stdout elf sha/asm/sha1-armv4-large.pl crypto/sha/sha1-elf-armv4.S -gen_asm_stdout elf sha/asm/sha256-armv4.pl crypto/sha/sha256-elf-armv4.S -gen_asm_stdout elf sha/asm/sha512-armv4.pl crypto/sha/sha512-elf-armv4.S -gen_asm_stdout elf modes/asm/ghash-armv4.pl crypto/modes/ghash-elf-armv4.S +gen_asm_stdout elf aes/asm/aes-armv4.pl aes/aes-elf-armv4.S +gen_asm_stdout elf bn/asm/armv4-gf2m.pl bn/gf2m-elf-armv4.S +gen_asm_stdout elf bn/asm/armv4-mont.pl bn/mont-elf-armv4.S +gen_asm_stdout elf sha/asm/sha1-armv4-large.pl sha/sha1-elf-armv4.S +gen_asm_stdout elf sha/asm/sha256-armv4.pl sha/sha256-elf-armv4.S +gen_asm_stdout elf sha/asm/sha512-armv4.pl sha/sha512-elf-armv4.S +gen_asm_stdout elf modes/asm/ghash-armv4.pl modes/ghash-elf-armv4.S $CP $libcrypto_src/arch/arm/armv4cpuid.S crypto $CP $libcrypto_src/arch/arm/armcap.c crypto $CP $libcrypto_src/arch/arm/arm_arch.h crypto for abi in elf macosx masm mingw64; do echo generating x86_64 ASM source for $abi - gen_asm_stdout $abi aes/asm/aes-x86_64.pl crypto/aes/aes-$abi-x86_64.S - gen_asm_stdout $abi aes/asm/vpaes-x86_64.pl crypto/aes/vpaes-$abi-x86_64.S - gen_asm_stdout $abi aes/asm/bsaes-x86_64.pl crypto/aes/bsaes-$abi-x86_64.S - gen_asm_stdout $abi aes/asm/aesni-x86_64.pl crypto/aes/aesni-$abi-x86_64.S - gen_asm_stdout $abi aes/asm/aesni-sha1-x86_64.pl crypto/aes/aesni-sha1-$abi-x86_64.S - gen_asm_stdout $abi bn/asm/modexp512-x86_64.pl crypto/bn/modexp512-$abi-x86_64.S - gen_asm_stdout $abi bn/asm/x86_64-mont.pl crypto/bn/mont-$abi-x86_64.S - gen_asm_stdout $abi bn/asm/x86_64-mont5.pl crypto/bn/mont5-$abi-x86_64.S - gen_asm_stdout $abi bn/asm/x86_64-gf2m.pl crypto/bn/gf2m-$abi-x86_64.S - gen_asm_stdout $abi camellia/asm/cmll-x86_64.pl crypto/camellia/cmll-$abi-x86_64.S - gen_asm_stdout $abi md5/asm/md5-x86_64.pl crypto/md5/md5-$abi-x86_64.S - gen_asm_stdout $abi modes/asm/ghash-x86_64.pl crypto/modes/ghash-$abi-x86_64.S - gen_asm_stdout $abi rc4/asm/rc4-x86_64.pl crypto/rc4/rc4-$abi-x86_64.S - gen_asm_stdout $abi rc4/asm/rc4-md5-x86_64.pl crypto/rc4/rc4-md5-$abi-x86_64.S - gen_asm_stdout $abi sha/asm/sha1-x86_64.pl crypto/sha/sha1-$abi-x86_64.S - gen_asm $abi sha/asm/sha512-x86_64.pl crypto/sha/sha256-$abi-x86_64.S - gen_asm $abi sha/asm/sha512-x86_64.pl crypto/sha/sha512-$abi-x86_64.S - gen_asm_stdout $abi whrlpool/asm/wp-x86_64.pl crypto/whrlpool/wp-$abi-x86_64.S - gen_asm $abi x86_64cpuid.pl crypto/cpuid-$abi-x86_64.S + gen_asm_stdout $abi aes/asm/aes-x86_64.pl aes/aes-$abi-x86_64.S + gen_asm_stdout $abi aes/asm/vpaes-x86_64.pl aes/vpaes-$abi-x86_64.S + gen_asm_stdout $abi aes/asm/bsaes-x86_64.pl aes/bsaes-$abi-x86_64.S + gen_asm_stdout $abi aes/asm/aesni-x86_64.pl aes/aesni-$abi-x86_64.S + gen_asm_stdout $abi aes/asm/aesni-sha1-x86_64.pl aes/aesni-sha1-$abi-x86_64.S + gen_asm_stdout $abi bn/asm/modexp512-x86_64.pl bn/modexp512-$abi-x86_64.S + gen_asm_stdout $abi bn/asm/x86_64-mont.pl bn/mont-$abi-x86_64.S + gen_asm_stdout $abi bn/asm/x86_64-mont5.pl bn/mont5-$abi-x86_64.S + gen_asm_stdout $abi bn/asm/x86_64-gf2m.pl bn/gf2m-$abi-x86_64.S + gen_asm_stdout $abi camellia/asm/cmll-x86_64.pl camellia/cmll-$abi-x86_64.S + gen_asm_stdout $abi md5/asm/md5-x86_64.pl md5/md5-$abi-x86_64.S + gen_asm_stdout $abi modes/asm/ghash-x86_64.pl modes/ghash-$abi-x86_64.S + gen_asm_stdout $abi rc4/asm/rc4-x86_64.pl rc4/rc4-$abi-x86_64.S + gen_asm_stdout $abi rc4/asm/rc4-md5-x86_64.pl rc4/rc4-md5-$abi-x86_64.S + gen_asm_stdout $abi sha/asm/sha1-x86_64.pl sha/sha1-$abi-x86_64.S + gen_asm $abi sha/asm/sha512-x86_64.pl sha/sha256-$abi-x86_64.S + gen_asm $abi sha/asm/sha512-x86_64.pl sha/sha512-$abi-x86_64.S + gen_asm_stdout $abi whrlpool/asm/wp-x86_64.pl whrlpool/wp-$abi-x86_64.S + gen_asm $abi x86_64cpuid.pl cpuid-$abi-x86_64.S done # copy libtls source From fa35b982c474f8a2f8b8f4cd13b60ff7b4428be7 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 23 Mar 2023 06:09:38 -0500 Subject: [PATCH 0210/1283] enable CI for mips32/mips64 --- .github/workflows/cross_test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cross_test.yml b/.github/workflows/cross_test.yml index 649cd2f698..fc742e7d81 100644 --- a/.github/workflows/cross_test.yml +++ b/.github/workflows/cross_test.yml @@ -7,7 +7,7 @@ jobs: strategy: matrix: os: [ubuntu-20.04, ubuntu-22.04] - arch: [mingw32, mingw64, arm32, arm64] + arch: [mingw32, mingw64, arm32, arm64, mips32, mips64] runs-on: ${{ matrix.os }} continue-on-error: false env: From dc7d38d52f829f77d60ddeb31546d20783d73498 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 23 Mar 2023 06:21:32 -0500 Subject: [PATCH 0211/1283] match CI names in test script --- scripts/test | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/test b/scripts/test index 34437026df..144930f090 100755 --- a/scripts/test +++ b/scripts/test @@ -89,10 +89,10 @@ elif [ "x$ARCH" = "xarm32" -o "x$ARCH" = "xarm64" ]; then file apps/openssl/.libs/openssl -elif [ "x$ARCH" = "xmipsel" -o "x$ARCH" = "xmips64el" ]; then +elif [ "x$ARCH" = "xmips32" -o "x$ARCH" = "xmips64" ]; then sudo apt-get install -y qemu-user-static binfmt-support - if [ "x$ARCH" = "xmipsel" ]; then + if [ "x$ARCH" = "xmips32" ]; then sudo apt-get install -y g++-mips-linux-gnu sudo ln -sf /usr/mipsel-linux-gnu/lib/ld.so.1 /lib/ ./configure --host=mipsel-linux-gnu From 6501696dd7669b3d20d69beffc508c46f0a807da Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 23 Mar 2023 06:35:41 -0500 Subject: [PATCH 0212/1283] generate opensslconf.h for mips --- include/CMakeLists.txt | 2 ++ include/Makefile.am | 1 + include/openssl/Makefile.am.tpl | 3 +++ update.sh | 2 +- 4 files changed, 7 insertions(+), 1 deletion(-) diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt index a08a78171e..44ab86b410 100644 --- a/include/CMakeLists.txt +++ b/include/CMakeLists.txt @@ -13,6 +13,8 @@ elseif(HOST_ARM) file(READ arch/arm/opensslconf.h OPENSSLCONF) elseif(HOST_I386) file(READ arch/i386/opensslconf.h OPENSSLCONF) +elseif(HOST_MIPS) + file(READ arch/mips/opensslconf.h OPENSSLCONF) elseif(HOST_MIPS64) file(READ arch/mips64/opensslconf.h OPENSSLCONF) elseif(HOST_POWERPC) diff --git a/include/Makefile.am b/include/Makefile.am index 26e82fe39d..077637df6b 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -51,6 +51,7 @@ noinst_HEADERS += arch/arm/opensslconf.h noinst_HEADERS += arch/hppa/opensslconf.h noinst_HEADERS += arch/i386/opensslconf.h noinst_HEADERS += arch/m88k/opensslconf.h +noinst_HEADERS += arch/mips/opensslconf.h noinst_HEADERS += arch/mips64/opensslconf.h noinst_HEADERS += arch/powerpc/opensslconf.h noinst_HEADERS += arch/powerpc64/opensslconf.h diff --git a/include/openssl/Makefile.am.tpl b/include/openssl/Makefile.am.tpl index 2f67d100c4..303d0b9eb8 100644 --- a/include/openssl/Makefile.am.tpl +++ b/include/openssl/Makefile.am.tpl @@ -17,6 +17,9 @@ endif if HOST_I386 -cp $(top_srcdir)/include/arch/i386/opensslconf.h opensslconf.h endif +if HOST_MIPS + -cp $(top_srcdir)/include/arch/mips/opensslconf.h opensslconf.h +endif if HOST_MIPS64 -cp $(top_srcdir)/include/arch/mips64/opensslconf.h opensslconf.h endif diff --git a/update.sh b/update.sh index cac95cad69..15d5006c8a 100755 --- a/update.sh +++ b/update.sh @@ -219,7 +219,7 @@ gen_asm() { fi } -#echo generating mips ASM source for elf +echo generating mips ASM source for elf gen_asm_mips o32 aes aes-mips aes-mips gen_asm_mips o32 bn mips bn-mips gen_asm_mips o32 bn mips-mont mont-mips From 4abde54b93e758e3f0d419edd997856ee8c59ac8 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 26 Mar 2023 13:28:00 -0600 Subject: [PATCH 0213/1283] Link bio_asn1 to regress --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 27a96007cd..f3336fcf6f 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -108,6 +108,11 @@ add_executable(bf_test bf_test.c) target_link_libraries(bf_test ${OPENSSL_TEST_LIBS}) add_test(bf_test bf_test) +# bio_asn1 +add_executable(bio_asn1 bio_asn1.c) +target_link_libraries(bio_asn1 ${OPENSSL_TEST_LIBS}) +add_test(bio_asn1 bio_asn1) + # bio_chain add_executable(bio_chain bio_chain.c) target_link_libraries(bio_chain ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index b4d50e38c9..87b196ab14 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -126,6 +126,11 @@ TESTS += bf_test check_PROGRAMS += bf_test bf_test_SOURCES = bf_test.c +# bio_asn1 +TESTS += bio_asn1 +check_PROGRAMS += bio_asn1 +bio_asn1_SOURCES = bio_asn1.c + # bio_chain TESTS += bio_chain check_PROGRAMS += bio_chain From ec0749ebc13d389e8ac2095e180712aeb300968a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 26 Mar 2023 16:27:02 -0600 Subject: [PATCH 0214/1283] Unhook the bn_mod_exp2_mont test --- tests/CMakeLists.txt | 5 ----- tests/Makefile.am | 5 ----- 2 files changed, 10 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index f3336fcf6f..900f2ea244 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -153,11 +153,6 @@ set_source_files_properties(bn_mod_exp.c PROPERTIES COMPILE_FLAGS target_link_libraries(bn_mod_exp ${OPENSSL_TEST_LIBS}) add_test(bn_mod_exp bn_mod_exp) -# bn_mod_exp2_mont -add_executable(bn_mod_exp2_mont bn_mod_exp2_mont.c) -target_link_libraries(bn_mod_exp2_mont ${OPENSSL_TEST_LIBS}) -add_test(bn_mod_exp2_mont bn_mod_exp2_mont) - # bn_mod_sqrt add_executable(bn_mod_sqrt bn_mod_sqrt.c) target_link_libraries(bn_mod_sqrt ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 87b196ab14..9f69157208 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -170,11 +170,6 @@ check_PROGRAMS += bn_mod_exp bn_mod_exp_CPPFLAGS = $(AM_CPPFLAGS) -ULIBRESSL_INTERNAL bn_mod_exp_SOURCES = bn_mod_exp.c -# bn_mod_exp2_mont -TESTS += bn_mod_exp2_mont -check_PROGRAMS += bn_mod_exp2_mont -bn_mod_exp2_mont_SOURCES = bn_mod_exp2_mont.c - # bn_mod_sqrt TESTS += bn_mod_sqrt check_PROGRAMS += bn_mod_sqrt From 9ee3389582333e5b3bc9f3388a6c4a182a8d0a8a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 26 Mar 2023 16:35:47 -0600 Subject: [PATCH 0215/1283] Start the 3.8.0 ChangeLog --- ChangeLog | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ChangeLog b/ChangeLog index 662c3feb47..376d44bcd9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,6 +28,14 @@ history is also available from Git. LibreSSL Portable Release Notes: +3.8.0 - Development release + * Internal improvements + - Cleaned up SHA internals + - Improved sieve of Eratosthenes script used for generating a table + of small primes + * Bug fixes + - Correctly reduce negative input to BN_mod_exp2_mont + 3.7.1 - Development release * Internal improvements From 2692b2f1ddca8bb7bddf2f94640ea589600d008f Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 26 Mar 2023 21:05:08 -0500 Subject: [PATCH 0216/1283] Checkout openbsd tag or closest commit when on a release tag This is a compromise needed to support building from non-stable tags. This incorporates the same logic used to generate openbsd tags in the first place, which are unstable because the CVS to git conversion does not have stable commit hashes. --- update.sh | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/update.sh b/update.sh index 15d5006c8a..e4fac1db0e 100755 --- a/update.sh +++ b/update.sh @@ -12,10 +12,27 @@ if [ ! -d openbsd ]; then git clone $LIBRESSL_GIT/openbsd fi fi -(cd openbsd - git fetch - git checkout $openbsd_branch - git pull --rebase) + +# pull either the latest or if on a tag, the matching tag +set +e +tag=`git describe --exact-match --tags HEAD 2>/dev/null` +is_tag=$? +# adjust for 9 hour time delta between trees +release_ts=$((`git show -s --format=%ct $tag|tail -n1` + 32400)) +commit=`git -C openbsd rev-list -n 1 --before=$release_ts $openbsd_branch` +git -C openbsd fetch +if [ $is_tag -eq 0 ]; then + echo "This is tag $tag, trying OpenBSD tag libressl-$tag" + if ! git -C openbsd checkout "libressl-$tag"; then + echo "No matching OpenBSD tag found trying nearest commit $commit" + git -C openbsd checkout -q $commit + fi +else + echo "Not on a tag, grabbing latest (NOTE: this may be broken from time to time)" + git -C openbsd checkout $openbsd_branch + git -C openbsd pull +fi +set -e # setup source paths CWD=`pwd` From 4faab7c1566c2efa231a83a481177c76b9cf9493 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 27 Mar 2023 02:44:53 -0600 Subject: [PATCH 0217/1283] ChangeLog tweaks/additions --- ChangeLog | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 376d44bcd9..7414259e2f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -29,12 +29,18 @@ history is also available from Git. LibreSSL Portable Release Notes: 3.8.0 - Development release + * Internal improvements - - Cleaned up SHA internals - Improved sieve of Eratosthenes script used for generating a table - of small primes + of small primes. + - Cleaned up SHA internals. + - Replace internal use of BN_copy() with bn_copy() for consistency. * Bug fixes - - Correctly reduce negative input to BN_mod_exp2_mont + - Correctly reduce negative input to BN_mod_exp2_mont(). + - Ensure ERR_load_ERR_strings() does not set errno unexpectedly. + * Testing and Proactive Security + - As always, new test coverage is added as bugs are fixed and subsystems + are cleaned up. 3.7.1 - Development release From e1e2c066bb9921cc078919ea69e94e0a9a35e7b7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 31 Mar 2023 00:13:02 -0600 Subject: [PATCH 0218/1283] Update ChangeLog --- ChangeLog | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 7414259e2f..92658a1ca4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,13 +28,14 @@ history is also available from Git. LibreSSL Portable Release Notes: -3.8.0 - Development release +3.8.0 - In development * Internal improvements - Improved sieve of Eratosthenes script used for generating a table of small primes. - Cleaned up SHA internals. - Replace internal use of BN_copy() with bn_copy() for consistency. + - Rewrote BN_exp(). * Bug fixes - Correctly reduce negative input to BN_mod_exp2_mont(). - Ensure ERR_load_ERR_strings() does not set errno unexpectedly. From 7b4991bf9713753f3931e98f60a4883ef8af668d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 31 Mar 2023 00:30:03 -0600 Subject: [PATCH 0219/1283] Mention error checking in i2d_ECDSA_SIG --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 92658a1ca4..3b4ef0023e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,6 +39,7 @@ LibreSSL Portable Release Notes: * Bug fixes - Correctly reduce negative input to BN_mod_exp2_mont(). - Ensure ERR_load_ERR_strings() does not set errno unexpectedly. + - Fix error checking of i2d_ECDSA_SIG() in ossl_ecdsa_sign(). * Testing and Proactive Security - As always, new test coverage is added as bugs are fixed and subsystems are cleaned up. From f450fde1117d10e6d8783497363641e612baba39 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 2 Apr 2023 07:01:44 -0500 Subject: [PATCH 0220/1283] add portable changes --- ChangeLog | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/ChangeLog b/ChangeLog index 3b4ef0023e..efa1864524 100644 --- a/ChangeLog +++ b/ChangeLog @@ -44,6 +44,15 @@ LibreSSL Portable Release Notes: - As always, new test coverage is added as bugs are fixed and subsystems are cleaned up. +3.7.2 - Stable release + + * Portable changes + - Moved official Github project to http://github.com/libressl/ + - Build support for Apple Silicon + - Installed opensslconf.h is now architecture-specific + - Removed internal defines from opensslconf.h + - Support reproducible builds on tagged commits in main branch + 3.7.1 - Development release * Internal improvements From 634b5a5b896cc29455a301d74b4cb0681d7a81d7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 2 Apr 2023 09:16:29 -0600 Subject: [PATCH 0221/1283] Fix indent, use https, end sentences with '.' --- ChangeLog | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index efa1864524..f9150cae05 100644 --- a/ChangeLog +++ b/ChangeLog @@ -47,11 +47,11 @@ LibreSSL Portable Release Notes: 3.7.2 - Stable release * Portable changes - - Moved official Github project to http://github.com/libressl/ - - Build support for Apple Silicon - - Installed opensslconf.h is now architecture-specific - - Removed internal defines from opensslconf.h - - Support reproducible builds on tagged commits in main branch + - Moved official Github project to https://github.com/libressl/. + - Build support for Apple Silicon. + - Installed opensslconf.h is now architecture-specific. + - Removed internal defines from opensslconf.h. + - Support reproducible builds on tagged commits in main branch. 3.7.1 - Development release From 14481349f99c9970577c1086ce1886ea09c832a3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 5 Apr 2023 23:50:56 -0600 Subject: [PATCH 0222/1283] Link bn_gcd test to build --- .gitignore | 1 + tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 3 files changed, 11 insertions(+) diff --git a/.gitignore b/.gitignore index 99be2c42d5..cca3fae60d 100644 --- a/.gitignore +++ b/.gitignore @@ -72,6 +72,7 @@ tests/bio_mem* tests/bnaddsub* tests/bn_add_sub* tests/bn_cmp* +tests/bn_gcd* tests/bn_isqrt* tests/bn_mod_exp* tests/bn_mod_exp_zero* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 900f2ea244..b61dc490e1 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -136,6 +136,11 @@ add_executable(bn_add_sub bn_add_sub.c) target_link_libraries(bn_add_sub ${OPENSSL_TEST_LIBS}) add_test(bn_add_sub bn_add_sub) +# bn_gcd +add_executable(bn_gcd bn_cmp.c) +target_link_libraries(bn_gcd ${OPENSSL_TEST_LIBS}) +add_test(bn_gcd bn_gcd) + # bn_cmp add_executable(bn_cmp bn_cmp.c) target_link_libraries(bn_cmp ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 9f69157208..aebfed13a3 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -159,6 +159,11 @@ TESTS += bn_cmp check_PROGRAMS += bn_cmp bn_cmp_SOURCES = bn_cmp.c +# bn_gcd +TESTS += bn_gcd +check_PROGRAMS += bn_gcd +bn_gcd_SOURCES = bn_gcd.c + # bn_isqrt TESTS += bn_isqrt check_PROGRAMS += bn_isqrt From 7fa835f0be9c814e378be6b016d8decf8e08cb4c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 6 Apr 2023 00:02:15 -0600 Subject: [PATCH 0223/1283] Update ChangeLog --- ChangeLog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index f9150cae05..c4f39f4f26 100644 --- a/ChangeLog +++ b/ChangeLog @@ -36,11 +36,15 @@ LibreSSL Portable Release Notes: - Cleaned up SHA internals. - Replace internal use of BN_copy() with bn_copy() for consistency. - Rewrote BN_exp(). + - Add branch target information (BTI) support to arm64 assembly. * Bug fixes - Correctly reduce negative input to BN_mod_exp2_mont(). - Ensure ERR_load_ERR_strings() does not set errno unexpectedly. - Fix error checking of i2d_ECDSA_SIG() in ossl_ecdsa_sign(). + - Fixed detection of extended operations (XOP) on AMD hardware. + - Ensure Montgomery exponentiation is used for the initial RSA blinding. * Testing and Proactive Security + - Significantly improved test coverage of BN_mod_sqrt() and GCD. - As always, new test coverage is added as bugs are fixed and subsystems are cleaned up. From f79a103b256764a3f8e2900cd3bc1ff7dbe54e8b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 9 Apr 2023 10:47:17 -0600 Subject: [PATCH 0224/1283] Update rust-openssl patch --- .github/rust-openssl.patch | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/rust-openssl.patch b/.github/rust-openssl.patch index fac4ae6dff..ab955bec86 100644 --- a/.github/rust-openssl.patch +++ b/.github/rust-openssl.patch @@ -1,12 +1,13 @@ diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs -index 3357518f..f55b5def 100644 +index ba149c17..5274dc44 100644 --- a/openssl-sys/build/main.rs +++ b/openssl-sys/build/main.rs -@@ -295,6 +295,7 @@ See rust-openssl documentation for more information: - (3, 6, _) => ('3', '6', 'x'), +@@ -285,7 +285,7 @@ See rust-openssl documentation for more information: (3, 7, 0) => ('3', '7', '0'), (3, 7, 1) => ('3', '7', '1'), -+ (3, 7, _) => ('3', '7', 'x'), - _ => version_error(), + (3, 7, _) => ('3', '7', 'x'), +- _ => version_error(), ++ _ => ('3', '7', 'x'), }; + println!("cargo:libressl=true"); From 418d7adf8a782b12517c26eaaa6fcdf044c15ff2 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 11 Apr 2023 06:11:08 -0600 Subject: [PATCH 0225/1283] Update for mod_sqrt and sha1 changes --- crypto/CMakeLists.txt | 5 ++--- crypto/Makefile.am | 5 ++--- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index a364e868af..c2a6ee0990 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -370,6 +370,7 @@ set( bn/bn_kron.c bn/bn_lib.c bn/bn_mod.c + bn/bn_mod_sqrt.c bn/bn_mont.c bn/bn_mpi.c bn/bn_mul.c @@ -381,7 +382,6 @@ set( bn/bn_shift.c bn/bn_small_primes.c bn/bn_sqr.c - bn/bn_sqrt.c bn/bn_word.c bn/bn_x931p.c buffer/buf_err.c @@ -723,8 +723,7 @@ set( rsa/rsa_saos.c rsa/rsa_sign.c rsa/rsa_x931.c - sha/sha1_one.c - sha/sha1dgst.c + sha/sha1.c sha/sha256.c sha/sha512.c sm3/sm3.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 3939802922..da3742767e 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -426,6 +426,7 @@ libcrypto_la_SOURCES += bn/bn_isqrt.c libcrypto_la_SOURCES += bn/bn_kron.c libcrypto_la_SOURCES += bn/bn_lib.c libcrypto_la_SOURCES += bn/bn_mod.c +libcrypto_la_SOURCES += bn/bn_mod_sqrt.c libcrypto_la_SOURCES += bn/bn_mont.c libcrypto_la_SOURCES += bn/bn_mpi.c libcrypto_la_SOURCES += bn/bn_mul.c @@ -437,7 +438,6 @@ libcrypto_la_SOURCES += bn/bn_recp.c libcrypto_la_SOURCES += bn/bn_shift.c libcrypto_la_SOURCES += bn/bn_small_primes.c libcrypto_la_SOURCES += bn/bn_sqr.c -libcrypto_la_SOURCES += bn/bn_sqrt.c libcrypto_la_SOURCES += bn/bn_word.c libcrypto_la_SOURCES += bn/bn_x931p.c noinst_HEADERS += bn/bn_internal.h @@ -969,8 +969,7 @@ libcrypto_la_SOURCES += rsa/rsa_x931.c noinst_HEADERS += rsa/rsa_local.h # sha -libcrypto_la_SOURCES += sha/sha1_one.c -libcrypto_la_SOURCES += sha/sha1dgst.c +libcrypto_la_SOURCES += sha/sha1.c libcrypto_la_SOURCES += sha/sha256.c libcrypto_la_SOURCES += sha/sha512.c noinst_HEADERS += sha/sha_local.h From f9fbe121cf314afe947d15cba4d976452fea50c5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 11 Apr 2023 06:12:40 -0600 Subject: [PATCH 0226/1283] Update ChangeLog --- ChangeLog | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index c4f39f4f26..37fefa13a6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -33,10 +33,11 @@ LibreSSL Portable Release Notes: * Internal improvements - Improved sieve of Eratosthenes script used for generating a table of small primes. - - Cleaned up SHA internals. + - Cleaned up and rewrote SHA internals. - Replace internal use of BN_copy() with bn_copy() for consistency. - Rewrote BN_exp(). - Add branch target information (BTI) support to arm64 assembly. + - Added a new implementation of BN_mod_sqrt(). * Bug fixes - Correctly reduce negative input to BN_mod_exp2_mont(). - Ensure ERR_load_ERR_strings() does not set errno unexpectedly. From 2f16a857425435c64e01b6f3c8db7c57905deeb0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 11 Apr 2023 06:26:58 -0600 Subject: [PATCH 0227/1283] Update .gitignore --- .gitignore | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/.gitignore b/.gitignore index cca3fae60d..cafdd03b19 100644 --- a/.gitignore +++ b/.gitignore @@ -27,12 +27,19 @@ *.gcov *.gcda +# mandoc stuff +links +mandoc.db + # Autotools stuff .deps .dirstamp Makefile Makefile.in +# CMake stuff +build + # Libtool stuff .libs *.lo @@ -67,7 +74,9 @@ tests/asn1string_copy* tests/asn1_string_to_utf8* tests/asn1time* tests/asn1x509* +tests/bio_asn1* tests/bio_chain* +tests/bio_host* tests/bio_mem* tests/bnaddsub* tests/bn_add_sub* @@ -128,6 +137,15 @@ tests/util.c tests/valid_handshakes_terminate* tests/handshake_table* +# benchmarks, tests with external dependencies +tests/bn_general* +tests/bn_mul_div* +tests/expirecallback* +tests/wycheproof-primes* + +# update.sh creates this for some reason +tests/empty.c + # ctags stuff TAGS From 462369e82a888bd3c2647d7d136511f4a0e955f4 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 11 Apr 2023 06:43:26 -0600 Subject: [PATCH 0228/1283] Move bn_gcd after bn_cmp --- tests/CMakeLists.txt | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index b61dc490e1..9a6242c178 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -136,16 +136,16 @@ add_executable(bn_add_sub bn_add_sub.c) target_link_libraries(bn_add_sub ${OPENSSL_TEST_LIBS}) add_test(bn_add_sub bn_add_sub) -# bn_gcd -add_executable(bn_gcd bn_cmp.c) -target_link_libraries(bn_gcd ${OPENSSL_TEST_LIBS}) -add_test(bn_gcd bn_gcd) - # bn_cmp add_executable(bn_cmp bn_cmp.c) target_link_libraries(bn_cmp ${OPENSSL_TEST_LIBS}) add_test(bn_cmp bn_cmp) +# bn_gcd +add_executable(bn_gcd bn_cmp.c) +target_link_libraries(bn_gcd ${OPENSSL_TEST_LIBS}) +add_test(bn_gcd bn_gcd) + # bn_isqrt add_executable(bn_isqrt bn_isqrt.c) target_link_libraries(bn_isqrt ${OPENSSL_TEST_LIBS}) From 6bbcefa48bbb9fbb6ef11ebce750bbb6a2135a31 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 11 Apr 2023 16:06:24 +0200 Subject: [PATCH 0229/1283] Import endianness compat from iked (via tobhe) --- include/compat/endian.h | 61 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) diff --git a/include/compat/endian.h b/include/compat/endian.h index cd85f5c48b..6dfe0b00df 100644 --- a/include/compat/endian.h +++ b/include/compat/endian.h @@ -48,4 +48,65 @@ #endif #endif +#if defined(__APPLE__) && !defined(HAVE_ENDIAN_H) +#include +#define betoh16(x) OSSwapBigToHostInt16((x)) +#define htobe16(x) OSSwapHostToBigInt16((x)) +#define betoh32(x) OSSwapBigToHostInt32((x)) +#define htobe32(x) OSSwapHostToBigInt32(x) +#define htole64(x) OSSwapHostToLittleInt64(x) +#define htobe64(x) OSSwapHostToBigInt64(x) +#define letoh64(x) OSSwapLittleToHostInt64(x) +#define betoh64(x) OSSwapBigToHostInt64(x) +#endif /* __APPLE__ && !HAVE_ENDIAN_H */ + +#if defined(_WIN32) && !defined(HAVE_ENDIAN_H) +#include +#define betoh16(x) ntohs((x)) +#define htobe16(x) htons((x)) +#define betoh32(x) ntohl((x)) +#define htobe32(x) ntohl((x)) +#define betoh64(x) ntohll((x)) +#define htobe64(x) ntohll((x)) +#endif /* _WIN32 && !HAVE_ENDIAN_H */ + +#ifdef __linux__ +#if !defined(betoh16) +#define betoh16 be16toh +#endif +#if !defined(betoh32) +#define betoh32 be32toh +#endif +#if !defined(betoh64) +#define betoh64 be64toh +#endif +#endif /* __linux__ */ + +#if defined(__FreeBSD__) +#if !defined(HAVE_ENDIAN_H) +#include +#endif +#if !defined(betoh16) +#define betoh16 be16toh +#endif +#if !defined(betoh32) +#define betoh32 be32toh +#endif +#if !defined(betoh64) +#define betoh64 be64toh +#endif +#endif + +#if defined(__NetBSD__) +#if !defined(betoh16) +#define betoh16 be16toh +#endif +#if !defined(betoh32) +#define betoh32 be32toh +#endif +#if !defined(betoh64) +#define betoh64 be64toh +#endif +#endif + #endif From e61927441352a7ac4c51b9b8fc2164d1d236e2f3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 11 Apr 2023 16:18:17 +0200 Subject: [PATCH 0230/1283] Temporarily add sha512.c r1.27 as a patch --- patches/sha512.c.patch | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 patches/sha512.c.patch diff --git a/patches/sha512.c.patch b/patches/sha512.c.patch new file mode 100644 index 0000000000..92cfdf4942 --- /dev/null +++ b/patches/sha512.c.patch @@ -0,0 +1,35 @@ +diff -u -p -r1.29 -r1.28 +--- crypto/sha/sha512.c 11 Apr 2023 13:03:03 -0000 1.29 ++++ crypto/sha/sha512.c 11 Apr 2023 10:35:21 -0000 1.28 +@@ -546,28 +546,9 @@ SHA512_Final(unsigned char *md, SHA512_C + sha512_block_data_order(c, p, 1); + } + +- memset (p + n, 0, sizeof(c->u) - 16 - n); +-#if BYTE_ORDER == BIG_ENDIAN +- c->u.d[SHA_LBLOCK - 2] = c->Nh; +- c->u.d[SHA_LBLOCK - 1] = c->Nl; +-#else +- p[sizeof(c->u) - 1] = (unsigned char)(c->Nl); +- p[sizeof(c->u) - 2] = (unsigned char)(c->Nl >> 8); +- p[sizeof(c->u) - 3] = (unsigned char)(c->Nl >> 16); +- p[sizeof(c->u) - 4] = (unsigned char)(c->Nl >> 24); +- p[sizeof(c->u) - 5] = (unsigned char)(c->Nl >> 32); +- p[sizeof(c->u) - 6] = (unsigned char)(c->Nl >> 40); +- p[sizeof(c->u) - 7] = (unsigned char)(c->Nl >> 48); +- p[sizeof(c->u) - 8] = (unsigned char)(c->Nl >> 56); +- p[sizeof(c->u) - 9] = (unsigned char)(c->Nh); +- p[sizeof(c->u) - 10] = (unsigned char)(c->Nh >> 8); +- p[sizeof(c->u) - 11] = (unsigned char)(c->Nh >> 16); +- p[sizeof(c->u) - 12] = (unsigned char)(c->Nh >> 24); +- p[sizeof(c->u) - 13] = (unsigned char)(c->Nh >> 32); +- p[sizeof(c->u) - 14] = (unsigned char)(c->Nh >> 40); +- p[sizeof(c->u) - 15] = (unsigned char)(c->Nh >> 48); +- p[sizeof(c->u) - 16] = (unsigned char)(c->Nh >> 56); +-#endif ++ memset(p + n, 0, sizeof(c->u) - 16 - n); ++ c->u.d[SHA_LBLOCK - 2] = htobe64(c->Nh); ++ c->u.d[SHA_LBLOCK - 1] = htobe64(c->Nl); + + sha512_block_data_order(c, p, 1); + From 7f319186539ed6e6cf0e475cf84aef296b30b1a4 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 11 Apr 2023 16:37:04 +0200 Subject: [PATCH 0231/1283] attempt to appease mingw32 --- include/compat/endian.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/include/compat/endian.h b/include/compat/endian.h index 6dfe0b00df..ca3465dbe0 100644 --- a/include/compat/endian.h +++ b/include/compat/endian.h @@ -62,11 +62,20 @@ #if defined(_WIN32) && !defined(HAVE_ENDIAN_H) #include + #define betoh16(x) ntohs((x)) #define htobe16(x) htons((x)) #define betoh32(x) ntohl((x)) #define htobe32(x) ntohl((x)) #define betoh64(x) ntohll((x)) + +#if !defined(ntohll) +#define ntohll(x) ((1==htonl(1)) ? (x) : ((uint64_t)ntohl((x) & 0xFFFFFFFF) << 32) | ntohl((x) >> 32)) +#endif +#if !defined(htonll) +#define htonll(x) ((1==ntohl(1)) ? (x) : ((uint64_t)htonl((x) & 0xFFFFFFFF) << 32) | htonl((x) >> 32)) +#endif + #define htobe64(x) ntohll((x)) #endif /* _WIN32 && !HAVE_ENDIAN_H */ From be58e25d2c6220ec7d299560facb1cf057dfb76d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 11 Apr 2023 17:33:24 +0200 Subject: [PATCH 0232/1283] Revert "Temporarily add sha512.c r1.27 as a patch" This reverts commit e61927441352a7ac4c51b9b8fc2164d1d236e2f3. --- patches/sha512.c.patch | 35 ----------------------------------- 1 file changed, 35 deletions(-) delete mode 100644 patches/sha512.c.patch diff --git a/patches/sha512.c.patch b/patches/sha512.c.patch deleted file mode 100644 index 92cfdf4942..0000000000 --- a/patches/sha512.c.patch +++ /dev/null @@ -1,35 +0,0 @@ -diff -u -p -r1.29 -r1.28 ---- crypto/sha/sha512.c 11 Apr 2023 13:03:03 -0000 1.29 -+++ crypto/sha/sha512.c 11 Apr 2023 10:35:21 -0000 1.28 -@@ -546,28 +546,9 @@ SHA512_Final(unsigned char *md, SHA512_C - sha512_block_data_order(c, p, 1); - } - -- memset (p + n, 0, sizeof(c->u) - 16 - n); --#if BYTE_ORDER == BIG_ENDIAN -- c->u.d[SHA_LBLOCK - 2] = c->Nh; -- c->u.d[SHA_LBLOCK - 1] = c->Nl; --#else -- p[sizeof(c->u) - 1] = (unsigned char)(c->Nl); -- p[sizeof(c->u) - 2] = (unsigned char)(c->Nl >> 8); -- p[sizeof(c->u) - 3] = (unsigned char)(c->Nl >> 16); -- p[sizeof(c->u) - 4] = (unsigned char)(c->Nl >> 24); -- p[sizeof(c->u) - 5] = (unsigned char)(c->Nl >> 32); -- p[sizeof(c->u) - 6] = (unsigned char)(c->Nl >> 40); -- p[sizeof(c->u) - 7] = (unsigned char)(c->Nl >> 48); -- p[sizeof(c->u) - 8] = (unsigned char)(c->Nl >> 56); -- p[sizeof(c->u) - 9] = (unsigned char)(c->Nh); -- p[sizeof(c->u) - 10] = (unsigned char)(c->Nh >> 8); -- p[sizeof(c->u) - 11] = (unsigned char)(c->Nh >> 16); -- p[sizeof(c->u) - 12] = (unsigned char)(c->Nh >> 24); -- p[sizeof(c->u) - 13] = (unsigned char)(c->Nh >> 32); -- p[sizeof(c->u) - 14] = (unsigned char)(c->Nh >> 40); -- p[sizeof(c->u) - 15] = (unsigned char)(c->Nh >> 48); -- p[sizeof(c->u) - 16] = (unsigned char)(c->Nh >> 56); --#endif -+ memset(p + n, 0, sizeof(c->u) - 16 - n); -+ c->u.d[SHA_LBLOCK - 2] = htobe64(c->Nh); -+ c->u.d[SHA_LBLOCK - 1] = htobe64(c->Nl); - - sha512_block_data_order(c, p, 1); - From b18f6a89e7df79532e610de64e83505bc6ecc0db Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 11 Apr 2023 09:46:30 -0600 Subject: [PATCH 0233/1283] update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 37fefa13a6..c3ca16e4fd 100644 --- a/ChangeLog +++ b/ChangeLog @@ -30,6 +30,8 @@ LibreSSL Portable Release Notes: 3.8.0 - In development + * Portable changes + - Extended the endian.h compat header with htobe* and betoh* macros. * Internal improvements - Improved sieve of Eratosthenes script used for generating a table of small primes. From 7f0258e683963790ea8a5c2c0a16ccc023474aa0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 12 Apr 2023 15:16:36 -0600 Subject: [PATCH 0234/1283] Drop sha_local.h add crypto_internal.h --- crypto/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index da3742767e..485790ad37 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -292,6 +292,7 @@ libcrypto_la_SOURCES += o_str.c noinst_HEADERS += arm_arch.h noinst_HEADERS += constant_time.h noinst_HEADERS += cryptlib.h +noinst_HEADERS += crypto_internal.h noinst_HEADERS += md32_common.h noinst_HEADERS += x86_arch.h @@ -972,7 +973,6 @@ noinst_HEADERS += rsa/rsa_local.h libcrypto_la_SOURCES += sha/sha1.c libcrypto_la_SOURCES += sha/sha256.c libcrypto_la_SOURCES += sha/sha512.c -noinst_HEADERS += sha/sha_local.h # sm3 libcrypto_la_SOURCES += sm3/sm3.c From b43f3fc25cc6e7297d7bde91305df8fdbfecbee1 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 12 Apr 2023 16:45:39 -0600 Subject: [PATCH 0235/1283] Update ChangeLog --- ChangeLog | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ChangeLog b/ChangeLog index c3ca16e4fd..9453fcdba1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -46,6 +46,11 @@ LibreSSL Portable Release Notes: - Fix error checking of i2d_ECDSA_SIG() in ossl_ecdsa_sign(). - Fixed detection of extended operations (XOP) on AMD hardware. - Ensure Montgomery exponentiation is used for the initial RSA blinding. + * Documentation improvements + - Improved documentation of BIO_ctrl(3), BIO_set_info_callback(3), + BIO_get_info_callback(3), BIO_method_type(3), and BIO_method_name(3). + - Marked BIO_CB_return(), BIO_cb_pre(), and BIO_cb_Post() as intentionally + undocumented. * Testing and Proactive Security - Significantly improved test coverage of BN_mod_sqrt() and GCD. - As always, new test coverage is added as bugs are fixed and subsystems From 4c75669d35ca742854ee1076d6d389e61d7a7941 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 13 Apr 2023 09:30:39 -0600 Subject: [PATCH 0236/1283] Remove no longer existing *_depr.c and ecs_*.c --- crypto/CMakeLists.txt | 5 ----- crypto/Makefile.am | 5 ----- 2 files changed, 10 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index c2a6ee0990..a4db6e5811 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -466,7 +466,6 @@ set( dh/dh_ameth.c dh/dh_asn1.c dh/dh_check.c - dh/dh_depr.c dh/dh_err.c dh/dh_gen.c dh/dh_key.c @@ -475,7 +474,6 @@ set( dh/dh_prn.c dsa/dsa_ameth.c dsa/dsa_asn1.c - dsa/dsa_depr.c dsa/dsa_err.c dsa/dsa_gen.c dsa/dsa_key.c @@ -519,8 +517,6 @@ set( ecdsa/ecs_err.c ecdsa/ecs_lib.c ecdsa/ecs_ossl.c - ecdsa/ecs_sign.c - ecdsa/ecs_vrf.c engine/eng_all.c engine/eng_cnf.c engine/eng_ctrl.c @@ -708,7 +704,6 @@ set( rsa/rsa_asn1.c rsa/rsa_chk.c rsa/rsa_crpt.c - rsa/rsa_depr.c rsa/rsa_eay.c rsa/rsa_err.c rsa/rsa_gen.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 485790ad37..cfb93ef51c 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -620,7 +620,6 @@ noinst_HEADERS += des/spr.h libcrypto_la_SOURCES += dh/dh_ameth.c libcrypto_la_SOURCES += dh/dh_asn1.c libcrypto_la_SOURCES += dh/dh_check.c -libcrypto_la_SOURCES += dh/dh_depr.c libcrypto_la_SOURCES += dh/dh_err.c libcrypto_la_SOURCES += dh/dh_gen.c libcrypto_la_SOURCES += dh/dh_key.c @@ -632,7 +631,6 @@ noinst_HEADERS += dh/dh_local.h # dsa libcrypto_la_SOURCES += dsa/dsa_ameth.c libcrypto_la_SOURCES += dsa/dsa_asn1.c -libcrypto_la_SOURCES += dsa/dsa_depr.c libcrypto_la_SOURCES += dsa/dsa_err.c libcrypto_la_SOURCES += dsa/dsa_gen.c libcrypto_la_SOURCES += dsa/dsa_key.c @@ -687,8 +685,6 @@ libcrypto_la_SOURCES += ecdsa/ecs_asn1.c libcrypto_la_SOURCES += ecdsa/ecs_err.c libcrypto_la_SOURCES += ecdsa/ecs_lib.c libcrypto_la_SOURCES += ecdsa/ecs_ossl.c -libcrypto_la_SOURCES += ecdsa/ecs_sign.c -libcrypto_la_SOURCES += ecdsa/ecs_vrf.c noinst_HEADERS += ecdsa/ecs_local.h # engine @@ -952,7 +948,6 @@ libcrypto_la_SOURCES += rsa/rsa_ameth.c libcrypto_la_SOURCES += rsa/rsa_asn1.c libcrypto_la_SOURCES += rsa/rsa_chk.c libcrypto_la_SOURCES += rsa/rsa_crpt.c -libcrypto_la_SOURCES += rsa/rsa_depr.c libcrypto_la_SOURCES += rsa/rsa_eay.c libcrypto_la_SOURCES += rsa/rsa_err.c libcrypto_la_SOURCES += rsa/rsa_gen.c From 76b135953a6c9885fa1fde0038262debff36639a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 14 Apr 2023 06:24:22 -0600 Subject: [PATCH 0237/1283] Hook a few more tests to the build --- tests/CMakeLists.txt | 50 +++++++++++++++++++++++++++++++++++++++++++- tests/Makefile.am | 46 ++++++++++++++++++++++++++++++++++++++++ update.sh | 2 ++ 3 files changed, 97 insertions(+), 1 deletion(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 9a6242c178..f53495f4a3 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -40,6 +40,13 @@ add_executable(aes_wrap aes_wrap.c) target_link_libraries(aes_wrap ${OPENSSL_TEST_LIBS}) add_test(aes_wrap aes_wrap) +# apitest +add_executable(apitest apitest.c) +target_link_libraries(apitest ${OPENSSL_TEST_LIBS}) +set_source_files_properties(apitest.c PROPERTIES COMPILE_FLAGS + -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") +add_test(apitest apitest) + # arc4randomforktest # Windows/mingw does not have fork, but Cygwin does. if(NOT (WIN32 OR (CMAKE_SYSTEM_NAME MATCHES "MINGW"))) @@ -146,6 +153,8 @@ add_executable(bn_gcd bn_cmp.c) target_link_libraries(bn_gcd ${OPENSSL_TEST_LIBS}) add_test(bn_gcd bn_gcd) +# bn_general is a benchmark + # bn_isqrt add_executable(bn_isqrt bn_isqrt.c) target_link_libraries(bn_isqrt ${OPENSSL_TEST_LIBS}) @@ -215,6 +224,9 @@ add_executable(bytestringtest bytestringtest.c) target_link_libraries(bytestringtest ${OPENSSL_TEST_LIBS}) add_test(bytestringtest bytestringtest) +# callback +# callbackfailures + # casttest add_executable(casttest casttest.c) target_link_libraries(casttest ${OPENSSL_TEST_LIBS}) @@ -260,6 +272,13 @@ add_executable(cts128test cts128test.c) target_link_libraries(cts128test ${OPENSSL_TEST_LIBS}) add_test(cts128test cts128test) +# cttest +add_executable(cttest cttest.c) +target_link_libraries(cttest ${OPENSSL_TEST_LIBS}) +set_source_files_properties(cttest.c PROPERTIES COMPILE_FLAGS + -DCTPATH=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") +add_test(cttest cttest) + # destest add_executable(destest destest.c) target_link_libraries(destest ${OPENSSL_TEST_LIBS}) @@ -339,6 +358,13 @@ add_executable(evptest evptest.c) target_link_libraries(evptest ${OPENSSL_TEST_LIBS}) add_test(evptest evptest ${CMAKE_CURRENT_SOURCE_DIR}/evptests.txt) +# evp_test +add_executable(evp_test evp_test.c) +target_link_libraries(evp_test ${OPENSSL_TEST_LIBS}) +add_test(evp_test evp_test) + +# expirecallback.c + # explicit_bzero # explicit_bzero relies on SA_ONSTACK, which is unavailable on Windows if(NOT WIN32) @@ -351,6 +377,11 @@ if(NOT WIN32) add_test(explicit_bzero explicit_bzero) endif() +# exportertest +add_executable(exportertest exportertest.c) +target_link_libraries(exportertest ${OPENSSL_TEST_LIBS}) +add_test(exportertest exportertest) + # freenull add_executable(freenull freenull.c) set_source_files_properties(freenull.c PROPERTIES COMPILE_FLAGS @@ -393,11 +424,14 @@ add_executable(igetest igetest.c) target_link_libraries(igetest ${OPENSSL_TEST_LIBS}) add_test(igetest igetest) -# keypairtest +# init_pledge + +# key_schedule add_executable(key_schedule key_schedule.c) target_link_libraries(key_schedule ${OPENSSL_TEST_LIBS}) add_test(key_schedule key_schedule) +# keypair add_executable(keypairtest keypairtest.c) target_link_libraries(keypairtest ${LIBTLS_TEST_LIBS}) target_include_directories(keypairtest BEFORE PUBLIC ../tls) @@ -528,6 +562,8 @@ add_executable(rsa_test rsa_test.c) target_link_libraries(rsa_test ${OPENSSL_TEST_LIBS}) add_test(rsa_test rsa_test) +# server.c + # servertest add_executable(servertest servertest.c) target_link_libraries(servertest ${OPENSSL_TEST_LIBS}) @@ -543,6 +579,18 @@ add_executable(sha_test sha_test.c) target_link_libraries(sha_test ${OPENSSL_TEST_LIBS}) add_test(sha_test sha_test) +# signertest +add_executable(signertest signertest.c) +target_link_libraries(signertest ${LIBTLS_TEST_LIBS}) +target_include_directories(signertest BEFORE PUBLIC ../tls) +set_source_files_properties(signertest.c PROPERTIES COMPILE_FLAGS + -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") +add_test(signertest signertest) + +# sm2crypttest +# sm2evptest +# sm2sigtest + # sm3test add_executable(sm3test sm3test.c) target_link_libraries(sm3test ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index aebfed13a3..b0e1128b6f 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -57,6 +57,12 @@ TESTS += aes_wrap check_PROGRAMS += aes_wrap aes_wrap_SOURCES = aes_wrap.c +# apitest +TESTS += apitest +check_PROGRAMS += apitest +apitest_SOURCES = apitest.c +apitest_CPPFLAGS = $(AM_CPPFLAGS) -DCERTSDIR=\"$(srcdir)\" + # arc4randomforktest # Windows/mingw does not have fork, but Cygwin does. if !HOST_WIN @@ -164,6 +170,8 @@ TESTS += bn_gcd check_PROGRAMS += bn_gcd bn_gcd_SOURCES = bn_gcd.c +# bn_general is a benchmark. + # bn_isqrt TESTS += bn_isqrt check_PROGRAMS += bn_isqrt @@ -231,6 +239,9 @@ TESTS += bytestringtest check_PROGRAMS += bytestringtest bytestringtest_SOURCES = bytestringtest.c +# callback +# callbackfailures + # casttest TESTS += casttest check_PROGRAMS += casttest @@ -277,6 +288,15 @@ TESTS += cts128test check_PROGRAMS += cts128test cts128test_SOURCES = cts128test.c +# cttest +TESTS += cttest +check_PROGRAMS += cttest +cttest_SOURCES = cttest.c +cttest_CPPFLAGS = $(AM_CPPFLAGS) -DCTPATH=\"$(srcdir)\" +EXTRA_DIST += ctlog.conf +EXTRA_DIST += letsencrypt-r3.crt +EXTRA_DIST += libressl.org.crt + # destest TESTS += destest check_PROGRAMS += destest @@ -358,6 +378,13 @@ evptest_SOURCES = evptest.c EXTRA_DIST += evptest.sh EXTRA_DIST += evptests.txt +# evp_test +TESTS += evp_test +check_PROGRAMS += evp_test +evp_test_SOURCES = evp_test.c + +# expirecallback.c + # explicit_bzero # explicit_bzero relies on SA_ONSTACK, which is unavailable on Windows if !HOST_WIN @@ -371,6 +398,11 @@ endif endif endif +# exportertest +TESTS += exportertest +check_PROGRAMS += exportertest +exportertest_SOURCES = exportertest.c + # freenull TESTS += freenull freenull_CPPFLAGS = $(AM_CPPFLAGS) -ULIBRESSL_INTERNAL @@ -412,6 +444,8 @@ TESTS += igetest check_PROGRAMS += igetest igetest_SOURCES = igetest.c +# init_pledge.c + # key_schedule TESTS += key_schedule check_PROGRAMS += key_schedule @@ -536,6 +570,8 @@ TESTS += rsa_test check_PROGRAMS += rsa_test rsa_test_SOURCES = rsa_test.c +# server.c + # servertest TESTS += servertest.sh check_PROGRAMS += servertest @@ -547,6 +583,16 @@ TESTS += sha_test check_PROGRAMS += sha_test sha_test_SOURCES = sha_test.c +# signertest +TESTS += signertest +check_PROGRAMS += signertest +signertest_CPPFLAGS = -I $(top_srcdir)/tls $(AM_CPPFLAGS) -DCERTSDIR=\"$(srcdir)\" +signertest_SOURCES = signertest.c + +# sm2crypttest +# sm2evptest +# sm2sigtest + # sm3test TESTS += sm3test check_PROGRAMS += sm3test diff --git a/update.sh b/update.sh index e4fac1db0e..46aa483817 100755 --- a/update.sh +++ b/update.sh @@ -353,6 +353,8 @@ for i in `find $libcrypto_regress -name '*.c'`; do done $CP $libcrypto_regress/evp/evptests.txt tests $CP $libcrypto_regress/aead/*.txt tests +$CP $libcrypto_regress/ct/ctlog.conf tests +$CP $libcrypto_regress/ct/*.crt tests # generate libcrypto freenull.c awk -f $libcrypto_regress/free/freenull.awk \ From f5bd09f83c940467ec4a99d8570e2a0da167f4ab Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 14 Apr 2023 07:15:25 -0600 Subject: [PATCH 0238/1283] Update file lists --- crypto/CMakeLists.txt | 2 +- crypto/Makefile.am | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index a4db6e5811..525c5fdaa5 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -360,6 +360,7 @@ set( bn/bn_blind.c bn/bn_bpsw.c bn/bn_const.c + bn/bn_convert.c bn/bn_ctx.c bn/bn_div.c bn/bn_err.c @@ -376,7 +377,6 @@ set( bn/bn_mul.c bn/bn_nist.c bn/bn_prime.c - bn/bn_print.c bn/bn_rand.c bn/bn_recp.c bn/bn_shift.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index cfb93ef51c..5032f89170 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -417,6 +417,7 @@ libcrypto_la_SOURCES += bn/bn_add.c libcrypto_la_SOURCES += bn/bn_blind.c libcrypto_la_SOURCES += bn/bn_bpsw.c libcrypto_la_SOURCES += bn/bn_const.c +libcrypto_la_SOURCES += bn/bn_convert.c libcrypto_la_SOURCES += bn/bn_ctx.c libcrypto_la_SOURCES += bn/bn_div.c libcrypto_la_SOURCES += bn/bn_err.c @@ -433,7 +434,6 @@ libcrypto_la_SOURCES += bn/bn_mpi.c libcrypto_la_SOURCES += bn/bn_mul.c libcrypto_la_SOURCES += bn/bn_nist.c libcrypto_la_SOURCES += bn/bn_prime.c -libcrypto_la_SOURCES += bn/bn_print.c libcrypto_la_SOURCES += bn/bn_rand.c libcrypto_la_SOURCES += bn/bn_recp.c libcrypto_la_SOURCES += bn/bn_shift.c @@ -968,6 +968,7 @@ noinst_HEADERS += rsa/rsa_local.h libcrypto_la_SOURCES += sha/sha1.c libcrypto_la_SOURCES += sha/sha256.c libcrypto_la_SOURCES += sha/sha512.c +noinst_HEADERS += sha/sha_internal.h # sm3 libcrypto_la_SOURCES += sm3/sm3.c From 3b7ac8e1310102ea8c3de0b9963b137738d9f703 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 14 Apr 2023 08:55:03 -0600 Subject: [PATCH 0239/1283] Disable signertest. Needs proper socketpair compat --- tests/CMakeLists.txt | 13 +++++++------ tests/Makefile.am | 9 +++++---- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index f53495f4a3..3567b7c2b8 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -579,13 +579,14 @@ add_executable(sha_test sha_test.c) target_link_libraries(sha_test ${OPENSSL_TEST_LIBS}) add_test(sha_test sha_test) +# XXX HAVE_SOCKETPAIR # signertest -add_executable(signertest signertest.c) -target_link_libraries(signertest ${LIBTLS_TEST_LIBS}) -target_include_directories(signertest BEFORE PUBLIC ../tls) -set_source_files_properties(signertest.c PROPERTIES COMPILE_FLAGS - -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") -add_test(signertest signertest) +# add_executable(signertest signertest.c) +# target_link_libraries(signertest ${LIBTLS_TEST_LIBS}) +# target_include_directories(signertest BEFORE PUBLIC ../tls) +# set_source_files_properties(signertest.c PROPERTIES COMPILE_FLAGS +# -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") +# add_test(signertest signertest) # sm2crypttest # sm2evptest diff --git a/tests/Makefile.am b/tests/Makefile.am index b0e1128b6f..a3bf6f96dd 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -583,11 +583,12 @@ TESTS += sha_test check_PROGRAMS += sha_test sha_test_SOURCES = sha_test.c +# XXX HAVE_SOCKETPAIR # signertest -TESTS += signertest -check_PROGRAMS += signertest -signertest_CPPFLAGS = -I $(top_srcdir)/tls $(AM_CPPFLAGS) -DCERTSDIR=\"$(srcdir)\" -signertest_SOURCES = signertest.c +# TESTS += signertest +# check_PROGRAMS += signertest +# signertest_CPPFLAGS = -I $(top_srcdir)/tls $(AM_CPPFLAGS) -DCERTSDIR=\"$(srcdir)\" +# signertest_SOURCES = signertest.c # sm2crypttest # sm2evptest From af28ef737db64df660b375d639398fd68cf08734 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 14 Apr 2023 09:02:39 -0600 Subject: [PATCH 0240/1283] Update ChangeLog --- ChangeLog | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 9453fcdba1..bd324b42aa 100644 --- a/ChangeLog +++ b/ChangeLog @@ -36,8 +36,9 @@ LibreSSL Portable Release Notes: - Improved sieve of Eratosthenes script used for generating a table of small primes. - Cleaned up and rewrote SHA internals. + - Added initial support for truncated SHA-2. - Replace internal use of BN_copy() with bn_copy() for consistency. - - Rewrote BN_exp(). + - Rewrote and improved BN_exp() and BN_copy(). - Add branch target information (BTI) support to arm64 assembly. - Added a new implementation of BN_mod_sqrt(). * Bug fixes @@ -53,6 +54,7 @@ LibreSSL Portable Release Notes: undocumented. * Testing and Proactive Security - Significantly improved test coverage of BN_mod_sqrt() and GCD. + - Made more tests available in portable. - As always, new test coverage is added as bugs are fixed and subsystems are cleaned up. From 1a6640329d4d72343cd85fd156e4800c9d2e93ba Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 15 Apr 2023 13:38:01 -0600 Subject: [PATCH 0241/1283] Drop GF2m assembly --- crypto/CMakeLists.txt | 10 ---------- crypto/Makefile.am.elf-arm | 2 -- crypto/Makefile.am.elf-x86_64 | 2 -- crypto/Makefile.am.macosx-x86_64 | 2 -- crypto/Makefile.am.masm-x86_64 | 2 -- crypto/Makefile.am.mingw64-x86_64 | 2 -- update.sh | 2 -- 7 files changed, 22 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 525c5fdaa5..7afbc98f3e 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -4,7 +4,6 @@ if(HOST_ASM_ELF_ARMV4) set( ASM_ARMV4_ELF_SRC aes/aes-elf-armv4.S - bn/gf2m-elf-armv4.S bn/mont-elf-armv4.S sha/sha1-elf-armv4.S sha/sha512-elf-armv4.S @@ -15,7 +14,6 @@ if(HOST_ASM_ELF_ARMV4) ) add_definitions(-DAES_ASM) add_definitions(-DOPENSSL_BN_ASM_MONT) - add_definitions(-DOPENSSL_BN_ASM_GF2m) add_definitions(-DGHASH_ASM) add_definitions(-DSHA1_ASM) add_definitions(-DSHA256_ASM) @@ -36,7 +34,6 @@ if(HOST_ASM_ELF_X86_64) bn/modexp512-elf-x86_64.S bn/mont-elf-x86_64.S bn/mont5-elf-x86_64.S - bn/gf2m-elf-x86_64.S camellia/cmll-elf-x86_64.S md5/md5-elf-x86_64.S modes/ghash-elf-x86_64.S @@ -67,7 +64,6 @@ if(HOST_ASM_ELF_X86_64) add_definitions(-DOPENSSL_IA32_SSE2) add_definitions(-DOPENSSL_BN_ASM_MONT) add_definitions(-DOPENSSL_BN_ASM_MONT5) - add_definitions(-DOPENSSL_BN_ASM_GF2m) add_definitions(-DMD5_ASM) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) @@ -91,7 +87,6 @@ if(HOST_ASM_MACOSX_X86_64) bn/modexp512-macosx-x86_64.S bn/mont-macosx-x86_64.S bn/mont5-macosx-x86_64.S - bn/gf2m-macosx-x86_64.S camellia/cmll-macosx-x86_64.S md5/md5-macosx-x86_64.S modes/ghash-macosx-x86_64.S @@ -122,7 +117,6 @@ if(HOST_ASM_MACOSX_X86_64) add_definitions(-DOPENSSL_IA32_SSE2) add_definitions(-DOPENSSL_BN_ASM_MONT) add_definitions(-DOPENSSL_BN_ASM_MONT5) - add_definitions(-DOPENSSL_BN_ASM_GF2m) add_definitions(-DMD5_ASM) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) @@ -147,7 +141,6 @@ if(HOST_ASM_MASM_X86_64) #bn/modexp512-masm-x86_64.S #bn/mont-masm-x86_64.S #bn/mont5-masm-x86_64.S - #bn/gf2m-masm-x86_64.S camellia/cmll-masm-x86_64.S md5/md5-masm-x86_64.S modes/ghash-masm-x86_64.S @@ -165,7 +158,6 @@ if(HOST_ASM_MASM_X86_64) add_definitions(-DOPENSSL_IA32_SSE2) #add_definitions(-DOPENSSL_BN_ASM_MONT) #add_definitions(-DOPENSSL_BN_ASM_MONT5) - #add_definitions(-DOPENSSL_BN_ASM_GF2m) add_definitions(-DMD5_ASM) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) @@ -189,7 +181,6 @@ if(HOST_ASM_MINGW64_X86_64) #bn/modexp512-mingw64-x86_64.S #bn/mont-mingw64-x86_64.S #bn/mont5-mingw64-x86_64.S - #bn/gf2m-mingw64-x86_64.S camellia/cmll-mingw64-x86_64.S md5/md5-mingw64-x86_64.S modes/ghash-mingw64-x86_64.S @@ -207,7 +198,6 @@ if(HOST_ASM_MINGW64_X86_64) add_definitions(-DOPENSSL_IA32_SSE2) #add_definitions(-DOPENSSL_BN_ASM_MONT) #add_definitions(-DOPENSSL_BN_ASM_MONT5) - #add_definitions(-DOPENSSL_BN_ASM_GF2m) add_definitions(-DMD5_ASM) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) diff --git a/crypto/Makefile.am.elf-arm b/crypto/Makefile.am.elf-arm index a77c4d3b24..041c27c7a1 100644 --- a/crypto/Makefile.am.elf-arm +++ b/crypto/Makefile.am.elf-arm @@ -1,5 +1,4 @@ ASM_ARM_ELF = aes/aes-elf-armv4.S -ASM_ARM_ELF += bn/gf2m-elf-armv4.S ASM_ARM_ELF += bn/mont-elf-armv4.S ASM_ARM_ELF += sha/sha1-elf-armv4.S ASM_ARM_ELF += sha/sha512-elf-armv4.S @@ -20,7 +19,6 @@ EXTRA_DIST += $(ASM_ARM_ELF) if HOST_ASM_ELF_ARM libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT -libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_GF2m libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DSHA1_ASM libcrypto_la_CPPFLAGS += -DSHA256_ASM diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index 20cc0ccac7..88be1d5023 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -7,7 +7,6 @@ ASM_X86_64_ELF += aes/aesni-sha1-elf-x86_64.S ASM_X86_64_ELF += bn/modexp512-elf-x86_64.S ASM_X86_64_ELF += bn/mont-elf-x86_64.S ASM_X86_64_ELF += bn/mont5-elf-x86_64.S -ASM_X86_64_ELF += bn/gf2m-elf-x86_64.S ASM_X86_64_ELF += camellia/cmll-elf-x86_64.S ASM_X86_64_ELF += md5/md5-elf-x86_64.S ASM_X86_64_ELF += modes/ghash-elf-x86_64.S @@ -41,7 +40,6 @@ libcrypto_la_CPPFLAGS += -DVPAES_ASM libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 -libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_GF2m libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index f3990a5fe3..b9b89cf04b 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -7,7 +7,6 @@ ASM_X86_64_MACOSX += aes/aesni-sha1-macosx-x86_64.S ASM_X86_64_MACOSX += bn/modexp512-macosx-x86_64.S ASM_X86_64_MACOSX += bn/mont-macosx-x86_64.S ASM_X86_64_MACOSX += bn/mont5-macosx-x86_64.S -ASM_X86_64_MACOSX += bn/gf2m-macosx-x86_64.S ASM_X86_64_MACOSX += camellia/cmll-macosx-x86_64.S ASM_X86_64_MACOSX += md5/md5-macosx-x86_64.S ASM_X86_64_MACOSX += modes/ghash-macosx-x86_64.S @@ -41,7 +40,6 @@ libcrypto_la_CPPFLAGS += -DVPAES_ASM libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 -libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_GF2m libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index 27094c0ba9..b914cb6c2b 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -7,7 +7,6 @@ ASM_X86_64_MASM += aes/aesni-sha1-masm-x86_64.S ASM_X86_64_MASM += bn/modexp512-masm-x86_64.S ASM_X86_64_MASM += bn/mont-masm-x86_64.S ASM_X86_64_MASM += bn/mont5-masm-x86_64.S -ASM_X86_64_MASM += bn/gf2m-masm-x86_64.S ASM_X86_64_MASM += camellia/cmll-masm-x86_64.S ASM_X86_64_MASM += md5/md5-masm-x86_64.S ASM_X86_64_MASM += modes/ghash-masm-x86_64.S @@ -28,7 +27,6 @@ libcrypto_la_CPPFLAGS += -DVPAES_ASM libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 -libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_GF2m libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index bce854b27e..5a277c5900 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -7,7 +7,6 @@ ASM_X86_64_MINGW64 += aes/aesni-sha1-mingw64-x86_64.S #ASM_X86_64_MINGW64 += bn/modexp512-mingw64-x86_64.S #ASM_X86_64_MINGW64 += bn/mont-mingw64-x86_64.S #ASM_X86_64_MINGW64 += bn/mont5-mingw64-x86_64.S -#ASM_X86_64_MINGW64 += bn/gf2m-mingw64-x86_64.S ASM_X86_64_MINGW64 += camellia/cmll-mingw64-x86_64.S ASM_X86_64_MINGW64 += md5/md5-mingw64-x86_64.S ASM_X86_64_MINGW64 += modes/ghash-mingw64-x86_64.S @@ -28,7 +27,6 @@ libcrypto_la_CPPFLAGS += -DVPAES_ASM libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 #libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT #libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 -#libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_GF2m libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM diff --git a/update.sh b/update.sh index 46aa483817..e5d17994d7 100755 --- a/update.sh +++ b/update.sh @@ -254,7 +254,6 @@ gen_asm_mips 64 sha sha512-mips sha512-mips64 echo generating arm ASM source for elf gen_asm_stdout elf aes/asm/aes-armv4.pl aes/aes-elf-armv4.S -gen_asm_stdout elf bn/asm/armv4-gf2m.pl bn/gf2m-elf-armv4.S gen_asm_stdout elf bn/asm/armv4-mont.pl bn/mont-elf-armv4.S gen_asm_stdout elf sha/asm/sha1-armv4-large.pl sha/sha1-elf-armv4.S gen_asm_stdout elf sha/asm/sha256-armv4.pl sha/sha256-elf-armv4.S @@ -274,7 +273,6 @@ for abi in elf macosx masm mingw64; do gen_asm_stdout $abi bn/asm/modexp512-x86_64.pl bn/modexp512-$abi-x86_64.S gen_asm_stdout $abi bn/asm/x86_64-mont.pl bn/mont-$abi-x86_64.S gen_asm_stdout $abi bn/asm/x86_64-mont5.pl bn/mont5-$abi-x86_64.S - gen_asm_stdout $abi bn/asm/x86_64-gf2m.pl bn/gf2m-$abi-x86_64.S gen_asm_stdout $abi camellia/asm/cmll-x86_64.pl camellia/cmll-$abi-x86_64.S gen_asm_stdout $abi md5/asm/md5-x86_64.pl md5/md5-$abi-x86_64.S gen_asm_stdout $abi modes/asm/ghash-x86_64.pl modes/ghash-$abi-x86_64.S From c22fc910550b3c5ef25bdc516dc6e9d7bf91c1e0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 15 Apr 2023 13:41:09 -0600 Subject: [PATCH 0242/1283] Update ChangeLog --- ChangeLog | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index bd324b42aa..a0446fbd87 100644 --- a/ChangeLog +++ b/ChangeLog @@ -32,15 +32,20 @@ LibreSSL Portable Release Notes: * Portable changes - Extended the endian.h compat header with htobe* and betoh* macros. + - Adapted more tests to the portable framework. * Internal improvements - Improved sieve of Eratosthenes script used for generating a table of small primes. - Cleaned up and rewrote SHA internals. - - Added initial support for truncated SHA-2. - Replace internal use of BN_copy() with bn_copy() for consistency. - Rewrote and improved BN_exp() and BN_copy(). - Add branch target information (BTI) support to arm64 assembly. - Added a new implementation of BN_mod_sqrt(). + * New features + - Added support for truncated SHA-2 and for SHA-3. + * Compatibility changes + - Removed X9.31 support + - Dropped proxy certificate (RFC 3820) support * Bug fixes - Correctly reduce negative input to BN_mod_exp2_mont(). - Ensure ERR_load_ERR_strings() does not set errno unexpectedly. @@ -54,7 +59,6 @@ LibreSSL Portable Release Notes: undocumented. * Testing and Proactive Security - Significantly improved test coverage of BN_mod_sqrt() and GCD. - - Made more tests available in portable. - As always, new test coverage is added as bugs are fixed and subsystems are cleaned up. From ff47798e6fbe0aae133994e4806170d314d9dd37 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 16 Apr 2023 12:51:28 -0600 Subject: [PATCH 0243/1283] ext_dat.h and vpm_int.h are gone --- crypto/Makefile.am | 2 -- 1 file changed, 2 deletions(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 5032f89170..80f1892502 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -1078,9 +1078,7 @@ libcrypto_la_SOURCES += x509/x509rset.c libcrypto_la_SOURCES += x509/x509spki.c libcrypto_la_SOURCES += x509/x509type.c libcrypto_la_SOURCES += x509/x_all.c -noinst_HEADERS += x509/ext_dat.h noinst_HEADERS += x509/pcy_int.h -noinst_HEADERS += x509/vpm_int.h noinst_HEADERS += x509/x509_internal.h noinst_HEADERS += x509/x509_issuer_cache.h noinst_HEADERS += x509/x509_local.h From 3eea95d266ede03c1faf398bf91c57f36cdd525b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 16 Apr 2023 13:44:59 -0600 Subject: [PATCH 0244/1283] ChangeLog: add missing periods to two lines --- ChangeLog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index a0446fbd87..599222d4f0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -44,8 +44,8 @@ LibreSSL Portable Release Notes: * New features - Added support for truncated SHA-2 and for SHA-3. * Compatibility changes - - Removed X9.31 support - - Dropped proxy certificate (RFC 3820) support + - Removed X9.31 support. + - Dropped proxy certificate (RFC 3820) support. * Bug fixes - Correctly reduce negative input to BN_mod_exp2_mont(). - Ensure ERR_load_ERR_strings() does not set errno unexpectedly. From 8fa0fb8aae15ea203df80956e9ddf05669b3e0ea Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 16 Apr 2023 13:55:21 -0600 Subject: [PATCH 0245/1283] add ct test fixtures --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index cafdd03b19..58ebb7c17f 100644 --- a/.gitignore +++ b/.gitignore @@ -97,6 +97,8 @@ tests/bn_word* tests/callback* tests/cipher* tests/constraints* +tests/ctlog.conf +tests/*.crt tests/ec_point_conversion* tests/evp_pkey_check* tests/evp_pkey_cleanup* From a42f70f8d14a705e36132c8ed247a74749b30aae Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 16 Apr 2023 13:59:37 -0600 Subject: [PATCH 0246/1283] sha_internal.h is in crypto/sha --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 7afbc98f3e..a816402f99 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -1012,6 +1012,7 @@ target_include_directories(crypto_obj ocsp pkcs12 rsa + sha x509 ../include/compat PUBLIC diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 80f1892502..a90a1aaa6d 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -17,6 +17,7 @@ AM_CPPFLAGS += -I$(top_srcdir)/crypto/modes AM_CPPFLAGS += -I$(top_srcdir)/crypto/ocsp AM_CPPFLAGS += -I$(top_srcdir)/crypto/pkcs12 AM_CPPFLAGS += -I$(top_srcdir)/crypto/rsa +AM_CPPFLAGS += -I$(top_srcdir)/crypto/sha AM_CPPFLAGS += -I$(top_srcdir)/crypto/x509 AM_CPPFLAGS += -I$(top_srcdir)/crypto From 4b388c7a45650e5f0bb3951ea28755a8901db867 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 17 Apr 2023 00:04:00 -0600 Subject: [PATCH 0247/1283] Drop dh_prn.c --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index a816402f99..ccaaf5d4b5 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -461,7 +461,6 @@ set( dh/dh_key.c dh/dh_lib.c dh/dh_pmeth.c - dh/dh_prn.c dsa/dsa_ameth.c dsa/dsa_asn1.c dsa/dsa_err.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index a90a1aaa6d..93d137e022 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -626,7 +626,6 @@ libcrypto_la_SOURCES += dh/dh_gen.c libcrypto_la_SOURCES += dh/dh_key.c libcrypto_la_SOURCES += dh/dh_lib.c libcrypto_la_SOURCES += dh/dh_pmeth.c -libcrypto_la_SOURCES += dh/dh_prn.c noinst_HEADERS += dh/dh_local.h # dsa From a71c37909f37812a592c6a7d343feb812b7253b5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 17 Apr 2023 01:07:45 -0600 Subject: [PATCH 0248/1283] Link sha3 to build. --- crypto/CMakeLists.txt | 2 ++ crypto/Makefile.am | 3 +++ 2 files changed, 5 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index ccaaf5d4b5..6c70ea253c 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -573,6 +573,7 @@ set( evp/m_null.c evp/m_ripemd.c evp/m_sha1.c + evp/m_sha3.c evp/m_sigver.c evp/m_streebog.c evp/m_sm3.c @@ -709,6 +710,7 @@ set( rsa/rsa_x931.c sha/sha1.c sha/sha256.c + sha/sha3.c sha/sha512.c sm3/sm3.c sm4/sm4.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 93d137e022..0f0204e3c1 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -760,6 +760,7 @@ libcrypto_la_SOURCES += evp/m_md5_sha1.c libcrypto_la_SOURCES += evp/m_null.c libcrypto_la_SOURCES += evp/m_ripemd.c libcrypto_la_SOURCES += evp/m_sha1.c +libcrypto_la_SOURCES += evp/m_sha3.c libcrypto_la_SOURCES += evp/m_sigver.c libcrypto_la_SOURCES += evp/m_streebog.c libcrypto_la_SOURCES += evp/m_sm3.c @@ -967,8 +968,10 @@ noinst_HEADERS += rsa/rsa_local.h # sha libcrypto_la_SOURCES += sha/sha1.c libcrypto_la_SOURCES += sha/sha256.c +libcrypto_la_SOURCES += sha/sha3.c libcrypto_la_SOURCES += sha/sha512.c noinst_HEADERS += sha/sha_internal.h +noinst_HEADERS += sha/sha3_internal.h # sm3 libcrypto_la_SOURCES += sm3/sm3.c From e45df9efa6b148ef2d7a96255b6dd3981d40f5c2 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 17 Apr 2023 08:50:16 -0600 Subject: [PATCH 0249/1283] bn_mpi.c is no more --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 6c70ea253c..f77d165937 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -363,7 +363,6 @@ set( bn/bn_mod.c bn/bn_mod_sqrt.c bn/bn_mont.c - bn/bn_mpi.c bn/bn_mul.c bn/bn_nist.c bn/bn_prime.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 0f0204e3c1..4308de3863 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -431,7 +431,6 @@ libcrypto_la_SOURCES += bn/bn_lib.c libcrypto_la_SOURCES += bn/bn_mod.c libcrypto_la_SOURCES += bn/bn_mod_sqrt.c libcrypto_la_SOURCES += bn/bn_mont.c -libcrypto_la_SOURCES += bn/bn_mpi.c libcrypto_la_SOURCES += bn/bn_mul.c libcrypto_la_SOURCES += bn/bn_nist.c libcrypto_la_SOURCES += bn/bn_prime.c From 63ba2e308960b3f557beffdac3ab199d692aa564 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 18 Apr 2023 03:33:46 -0600 Subject: [PATCH 0250/1283] Regen x509.h patch --- patches/windows_headers.patch | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/patches/windows_headers.patch b/patches/windows_headers.patch index 17c447d00a..e6bf5846b5 100644 --- a/patches/windows_headers.patch +++ b/patches/windows_headers.patch @@ -61,12 +61,12 @@ diff -u include/openssl.orig/pkcs7.h include/openssl/pkcs7.h Encryption_ID DES-CBC Digest_ID MD5 diff -u include/openssl.orig/x509.h include/openssl/x509.h ---- include/openssl.orig/x509.h Mon Dec 7 07:58:32 2015 -+++ include/openssl/x509.h Mon Dec 7 07:56:14 2015 -@@ -112,6 +112,19 @@ +--- include/openssl.orig/x509.h Tue Apr 18 03:26:56 2023 ++++ include/openssl/x509.h Tue Apr 18 03:27:14 2023 +@@ -106,6 +106,19 @@ extern "C" { #endif - + +#if defined(_WIN32) && defined(__WINCRYPT_H__) +#ifndef LIBRESSL_INTERNAL +#ifdef _MSC_VER From 998eab961d1bfea4d3f088fed54ed05aeb1450f3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 18 Apr 2023 15:13:23 -0600 Subject: [PATCH 0251/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 599222d4f0..8f3f5a1993 100644 --- a/ChangeLog +++ b/ChangeLog @@ -46,6 +46,7 @@ LibreSSL Portable Release Notes: * Compatibility changes - Removed X9.31 support. - Dropped proxy certificate (RFC 3820) support. + - Started removing binary extension field and curve support. * Bug fixes - Correctly reduce negative input to BN_mod_exp2_mont(). - Ensure ERR_load_ERR_strings() does not set errno unexpectedly. From c9747bf1da921c87b8eda4fe7655bc2550798eb4 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 20 Apr 2023 13:04:45 -0600 Subject: [PATCH 0252/1283] update man links --- man/links | 46 +++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 43 insertions(+), 3 deletions(-) diff --git a/man/links b/man/links index a88abaa7d4..ebacbc6b4f 100644 --- a/man/links +++ b/man/links @@ -175,6 +175,7 @@ BIO_ctrl.3,BIO_set_close.3 BIO_ctrl.3,BIO_set_info_callback.3 BIO_ctrl.3,BIO_tell.3 BIO_ctrl.3,BIO_wpending.3 +BIO_ctrl.3,bio_info_cb.3 BIO_dump.3,BIO_dump_fp.3 BIO_dump.3,BIO_dump_indent.3 BIO_dump.3,BIO_dump_indent_fp.3 @@ -611,7 +612,12 @@ DH_generate_parameters.3,DH_check_pub_key.3 DH_generate_parameters.3,DH_generate_parameters_ex.3 DH_get0_pqg.3,DH_clear_flags.3 DH_get0_pqg.3,DH_get0_engine.3 +DH_get0_pqg.3,DH_get0_g.3 DH_get0_pqg.3,DH_get0_key.3 +DH_get0_pqg.3,DH_get0_p.3 +DH_get0_pqg.3,DH_get0_priv_key.3 +DH_get0_pqg.3,DH_get0_pub_key.3 +DH_get0_pqg.3,DH_get0_q.3 DH_get0_pqg.3,DH_set0_key.3 DH_get0_pqg.3,DH_set0_pqg.3 DH_get0_pqg.3,DH_set_flags.3 @@ -640,7 +646,12 @@ DSA_do_sign.3,DSA_do_verify.3 DSA_generate_parameters.3,DSA_generate_parameters_ex.3 DSA_get0_pqg.3,DSA_clear_flags.3 DSA_get0_pqg.3,DSA_get0_engine.3 +DSA_get0_pqg.3,DSA_get0_g.3 DSA_get0_pqg.3,DSA_get0_key.3 +DSA_get0_pqg.3,DSA_get0_p.3 +DSA_get0_pqg.3,DSA_get0_priv_key.3 +DSA_get0_pqg.3,DSA_get0_pub_key.3 +DSA_get0_pqg.3,DSA_get0_q.3 DSA_get0_pqg.3,DSA_set0_key.3 DSA_get0_pqg.3,DSA_set0_pqg.3 DSA_get0_pqg.3,DSA_set_flags.3 @@ -666,6 +677,8 @@ ECDH_compute_key.3,ECDH_size.3 ECDSA_SIG_new.3,ECDSA_OpenSSL.3 ECDSA_SIG_new.3,ECDSA_SIG_free.3 ECDSA_SIG_new.3,ECDSA_SIG_get0.3 +ECDSA_SIG_new.3,ECDSA_SIG_get0_r.3 +ECDSA_SIG_new.3,ECDSA_SIG_get0_s.3 ECDSA_SIG_new.3,ECDSA_SIG_set0.3 ECDSA_SIG_new.3,ECDSA_do_sign.3 ECDSA_SIG_new.3,ECDSA_do_sign_ex.3 @@ -941,6 +954,17 @@ EVP_AEAD_CTX_init.3,EVP_aead_aes_128_gcm.3 EVP_AEAD_CTX_init.3,EVP_aead_aes_256_gcm.3 EVP_AEAD_CTX_init.3,EVP_aead_chacha20_poly1305.3 EVP_AEAD_CTX_init.3,EVP_aead_xchacha20_poly1305.3 +EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_dup.3 +EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_free.3 +EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_cleanup.3 +EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_ctrl.3 +EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_do_cipher.3 +EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_flags.3 +EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_get_asn1_params.3 +EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_impl_ctx_size.3 +EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_init.3 +EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_iv_length.3 +EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_set_asn1_params.3 EVP_DigestInit.3,EVP_Digest.3 EVP_DigestInit.3,EVP_DigestFinal.3 EVP_DigestInit.3,EVP_DigestFinal_ex.3 @@ -1629,7 +1653,15 @@ RSA_blinding_on.3,RSA_blinding_off.3 RSA_generate_key.3,RSA_generate_key_ex.3 RSA_get0_key.3,RSA_clear_flags.3 RSA_get0_key.3,RSA_get0_crt_params.3 +RSA_get0_key.3,RSA_get0_d.3 +RSA_get0_key.3,RSA_get0_dmp1.3 +RSA_get0_key.3,RSA_get0_dmq1.3 +RSA_get0_key.3,RSA_get0_e.3 RSA_get0_key.3,RSA_get0_factors.3 +RSA_get0_key.3,RSA_get0_iqmp.3 +RSA_get0_key.3,RSA_get0_n.3 +RSA_get0_key.3,RSA_get0_p.3 +RSA_get0_key.3,RSA_get0_q.3 RSA_get0_key.3,RSA_set0_crt_params.3 RSA_get0_key.3,RSA_set0_factors.3 RSA_get0_key.3,RSA_set0_key.3 @@ -2107,6 +2139,7 @@ X509V3_get_d2i.3,X509_REVOKED_get0_extensions.3 X509V3_get_d2i.3,X509_REVOKED_get_ext_d2i.3 X509V3_get_d2i.3,X509_add1_ext_i2d.3 X509V3_get_d2i.3,X509_get0_extensions.3 +X509V3_get_d2i.3,X509_get0_uids.3 X509V3_get_d2i.3,X509_get_ext_d2i.3 X509_ALGOR_dup.3,X509_ALGOR_cmp.3 X509_ALGOR_dup.3,X509_ALGOR_free.3 @@ -2300,9 +2333,13 @@ X509_STORE_CTX_set_flags.3,X509_STORE_CTX_set_depth.3 X509_STORE_CTX_set_flags.3,X509_STORE_CTX_set_purpose.3 X509_STORE_CTX_set_flags.3,X509_STORE_CTX_set_time.3 X509_STORE_CTX_set_flags.3,X509_STORE_CTX_set_trust.3 +X509_STORE_CTX_set_verify.3,X509_STORE_CTX_check_issued_fn.3 +X509_STORE_CTX_set_verify.3,X509_STORE_CTX_get_check_issued.3 X509_STORE_CTX_set_verify.3,X509_STORE_CTX_get_verify.3 X509_STORE_CTX_set_verify.3,X509_STORE_CTX_verify_fn.3 +X509_STORE_CTX_set_verify.3,X509_STORE_get_check_issued.3 X509_STORE_CTX_set_verify.3,X509_STORE_get_verify.3 +X509_STORE_CTX_set_verify.3,X509_STORE_set_check_issued.3 X509_STORE_CTX_set_verify.3,X509_STORE_set_verify.3 X509_STORE_CTX_set_verify.3,X509_STORE_set_verify_func.3 X509_STORE_CTX_set_verify_cb.3,X509_STORE_CTX_get_verify_cb.3 @@ -2408,6 +2445,7 @@ X509_get0_notBefore.3,X509_set1_notBefore.3 X509_get0_notBefore.3,X509_set_notAfter.3 X509_get0_notBefore.3,X509_set_notBefore.3 X509_get0_signature.3,X509_CRL_get0_signature.3 +X509_get0_signature.3,X509_CRL_get0_tbs_sigalg.3 X509_get0_signature.3,X509_CRL_get_signature_nid.3 X509_get0_signature.3,X509_REQ_get0_signature.3 X509_get0_signature.3,X509_REQ_get_signature_nid.3 @@ -2517,9 +2555,6 @@ bn_dump.3,bn_fix_top.3 bn_dump.3,bn_mul_add_words.3 bn_dump.3,bn_mul_comba4.3 bn_dump.3,bn_mul_comba8.3 -bn_dump.3,bn_mul_high.3 -bn_dump.3,bn_mul_low_normal.3 -bn_dump.3,bn_mul_low_recursive.3 bn_dump.3,bn_mul_normal.3 bn_dump.3,bn_mul_part_recursive.3 bn_dump.3,bn_mul_recursive.3 @@ -2896,6 +2931,11 @@ lh_stats.3,lh_node_stats_bio.3 lh_stats.3,lh_node_usage_stats.3 lh_stats.3,lh_node_usage_stats_bio.3 lh_stats.3,lh_stats_bio.3 +s2i_ASN1_INTEGER.3,i2s_ASN1_ENUMERATED.3 +s2i_ASN1_INTEGER.3,i2s_ASN1_ENUMERATED_TABLE.3 +s2i_ASN1_INTEGER.3,i2s_ASN1_INTEGER.3 +s2i_ASN1_INTEGER.3,i2s_ASN1_OCTET_STRING.3 +s2i_ASN1_INTEGER.3,s2i_ASN1_OCTET_STRING.3 tls_accept_socket.3,tls_accept_cbs.3 tls_accept_socket.3,tls_accept_fds.3 tls_client.3,tls_configure.3 From 43edddb8884ea91ee22c4606d2b43e62043acf35 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 20 Apr 2023 15:53:35 -0600 Subject: [PATCH 0253/1283] RFC 3779 test no longer uses __unused --- tests/CMakeLists.txt | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 3567b7c2b8..41fed3b73d 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -539,7 +539,6 @@ add_test(record_layer_test record_layer_test) # rfc3779 add_executable(rfc3779 rfc3779.c) -set_source_files_properties(rfc3779.c PROPERTIES COMPILE_FLAGS -D__unused=) target_link_libraries(rfc3779 ${OPENSSL_TEST_LIBS}) add_test(rfc3779 rfc3779) From f67df7c062648711cebf6404b9f4fa8ef2fa8734 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 20 Apr 2023 15:53:49 -0600 Subject: [PATCH 0254/1283] Update ChangeLog --- ChangeLog | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 8f3f5a1993..8c345898e8 100644 --- a/ChangeLog +++ b/ChangeLog @@ -41,12 +41,21 @@ LibreSSL Portable Release Notes: - Rewrote and improved BN_exp() and BN_copy(). - Add branch target information (BTI) support to arm64 assembly. - Added a new implementation of BN_mod_sqrt(). + - Removed incomplete and dangerous BN_RECURSION code. * New features - Added support for truncated SHA-2 and for SHA-3. * Compatibility changes + - Support for GF2m was removed: BIGNUM no longer supports binary extension + field arithmetic and all binary elliptic builtin curves were removed. + - Removed dangerous, "fast" NIST prime and elliptic curve implementations. + In particular, EC_GFp_nist_method() is no longer available. + - Removed most public symbols that were deprecated in OpenSSL 0.9.8. - Removed X9.31 support. + - Removed Cipher Text Stealing mode. - Dropped proxy certificate (RFC 3820) support. - - Started removing binary extension field and curve support. + - The POLICY_TREE and its related structures and API are no longer public. + - The explicitText user notice uses UTF8String instead of VisibleString + to reduce the risk of emitting certificates with invalid DER-encoding. * Bug fixes - Correctly reduce negative input to BN_mod_exp2_mont(). - Ensure ERR_load_ERR_strings() does not set errno unexpectedly. From 61daaabc61a04c3d45a4c7d3cbfcec213fd39ba3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 21 Apr 2023 00:16:20 -0600 Subject: [PATCH 0255/1283] x509_enum.c is gone --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index f77d165937..aacf9d0dd7 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -755,7 +755,6 @@ set( x509/x509_crld.c x509/x509_d2.c x509/x509_def.c - x509/x509_enum.c x509/x509_err.c x509/x509_ext.c x509/x509_extku.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 4308de3863..b94067eb9e 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -1041,7 +1041,6 @@ libcrypto_la_SOURCES += x509/x509_cpols.c libcrypto_la_SOURCES += x509/x509_crld.c libcrypto_la_SOURCES += x509/x509_d2.c libcrypto_la_SOURCES += x509/x509_def.c -libcrypto_la_SOURCES += x509/x509_enum.c libcrypto_la_SOURCES += x509/x509_err.c libcrypto_la_SOURCES += x509/x509_ext.c libcrypto_la_SOURCES += x509/x509_extku.c From 250713b30dfe57aeb97864e2ef843efe4310932a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 25 Apr 2023 02:44:17 -0600 Subject: [PATCH 0256/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 8c345898e8..3b3e7cf0ac 100644 --- a/ChangeLog +++ b/ChangeLog @@ -42,6 +42,7 @@ LibreSSL Portable Release Notes: - Add branch target information (BTI) support to arm64 assembly. - Added a new implementation of BN_mod_sqrt(). - Removed incomplete and dangerous BN_RECURSION code. + - Added endbr64 instructions to amd64 assembly. * New features - Added support for truncated SHA-2 and for SHA-3. * Compatibility changes From 1852585726c3e80e64b1aca821cfcc246e246287 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 25 Apr 2023 12:03:07 +0200 Subject: [PATCH 0257/1283] Pin -portable to a commit before the endb64 addition --- OPENBSD_BRANCH | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/OPENBSD_BRANCH b/OPENBSD_BRANCH index 1f7391f92b..89eff1e317 100644 --- a/OPENBSD_BRANCH +++ b/OPENBSD_BRANCH @@ -1 +1 @@ -master +a48d45b9c9c083528cb0f6d510a54b9f63d47f7e From 94763de52b947fbf7a6360f9dfc1e7b3363a9492 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 25 Apr 2023 11:47:02 +0200 Subject: [PATCH 0258/1283] Disable assembly on macos for now --- CMakeLists.txt | 2 +- configure.ac | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 7847830a1e..e05221c316 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -344,7 +344,7 @@ if(ENABLE_ASM) endif() add_definitions(-DHAVE_GNU_STACK) elseif(APPLE AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "x86_64") - set(HOST_ASM_MACOSX_X86_64 true) + set(ENABLE_ASM false) elseif(MSVC AND ("${CMAKE_GENERATOR}" MATCHES "Win64" OR "${CMAKE_GENERATOR_PLATFORM}" STREQUAL "x64")) set(HOST_ASM_MASM_X86_64 true) ENABLE_LANGUAGE(ASM_MASM) diff --git a/configure.ac b/configure.ac index 51e096bd90..6fe2ff426a 100644 --- a/configure.ac +++ b/configure.ac @@ -122,7 +122,7 @@ AM_CONDITIONAL([HOST_ASM_ELF_MIPS64], AM_CONDITIONAL([HOST_ASM_ELF_X86_64], [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "x86_64" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_MACOSX_X86_64], - [test "x$HOST_ABI" = "xmacosx" -a "$host_cpu" = "x86_64" -a "x$enable_asm" != "xno"]) + [test "x$HOST_ABI" = "xmacosx" -a "$host_cpu" = "x86_64" -a "x$enable_asm" == "xenabled"]) AM_CONDITIONAL([HOST_ASM_MASM_X86_64], [test "x$HOST_ABI" = "xmasm" -a "$host_cpu" = "x86_64" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_MINGW64_X86_64], From 8ef59bff3419a06811da41adebefe6cba5ea3647 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 25 Apr 2023 14:09:45 -0600 Subject: [PATCH 0259/1283] Revert "Pin -portable to a commit before the endb64 addition" This reverts commit 1852585726c3e80e64b1aca821cfcc246e246287. --- OPENBSD_BRANCH | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/OPENBSD_BRANCH b/OPENBSD_BRANCH index 89eff1e317..1f7391f92b 100644 --- a/OPENBSD_BRANCH +++ b/OPENBSD_BRANCH @@ -1 +1 @@ -a48d45b9c9c083528cb0f6d510a54b9f63d47f7e +master From a99c1feee6b28a60c7705929eaae5e76e5fe05f0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 25 Apr 2023 14:13:20 -0600 Subject: [PATCH 0260/1283] Remove the cts128 test --- tests/CMakeLists.txt | 5 ----- tests/Makefile.am | 5 ----- 2 files changed, 10 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 41fed3b73d..27065fb2f8 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -267,11 +267,6 @@ add_executable(constraints constraints.c) target_link_libraries(constraints ${OPENSSL_TEST_LIBS}) add_test(constraints constraints) -# cts128test -add_executable(cts128test cts128test.c) -target_link_libraries(cts128test ${OPENSSL_TEST_LIBS}) -add_test(cts128test cts128test) - # cttest add_executable(cttest cttest.c) target_link_libraries(cttest ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index a3bf6f96dd..d984ed99bf 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -283,11 +283,6 @@ TESTS += constraints check_PROGRAMS += constraints constraints_SOURCES = constraints.c -# cts128test -TESTS += cts128test -check_PROGRAMS += cts128test -cts128test_SOURCES = cts128test.c - # cttest TESTS += cttest check_PROGRAMS += cttest From b3c137558806f75ad9a81560b85e62f7e3638432 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 25 Apr 2023 14:17:25 -0600 Subject: [PATCH 0261/1283] A handful of files were removed --- apps/openssl/CMakeLists.txt | 1 - apps/openssl/Makefile.am | 1 - crypto/CMakeLists.txt | 14 -------------- crypto/Makefile.am | 14 -------------- 4 files changed, 30 deletions(-) diff --git a/apps/openssl/CMakeLists.txt b/apps/openssl/CMakeLists.txt index 2a84178f22..437c0db007 100644 --- a/apps/openssl/CMakeLists.txt +++ b/apps/openssl/CMakeLists.txt @@ -20,7 +20,6 @@ set( gendsa.c genpkey.c genrsa.c - nseq.c ocsp.c openssl.c passwd.c diff --git a/apps/openssl/Makefile.am b/apps/openssl/Makefile.am index 7cbac48ae6..064975bb85 100644 --- a/apps/openssl/Makefile.am +++ b/apps/openssl/Makefile.am @@ -31,7 +31,6 @@ openssl_SOURCES += gendh.c openssl_SOURCES += gendsa.c openssl_SOURCES += genpkey.c openssl_SOURCES += genrsa.c -openssl_SOURCES += nseq.c openssl_SOURCES += ocsp.c openssl_SOURCES += openssl.c openssl_SOURCES += passwd.c diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index aacf9d0dd7..bcf8a29dc4 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -289,7 +289,6 @@ set( asn1/asn_moid.c asn1/bio_asn1.c asn1/bio_ndef.c - asn1/nsseq.c asn1/p5_pbe.c asn1/p5_pbev2.c asn1/p8_pkey.c @@ -356,7 +355,6 @@ set( bn/bn_err.c bn/bn_exp.c bn/bn_gcd.c - bn/bn_gf2m.c bn/bn_isqrt.c bn/bn_kron.c bn/bn_lib.c @@ -364,7 +362,6 @@ set( bn/bn_mod_sqrt.c bn/bn_mont.c bn/bn_mul.c - bn/bn_nist.c bn/bn_prime.c bn/bn_rand.c bn/bn_recp.c @@ -372,7 +369,6 @@ set( bn/bn_small_primes.c bn/bn_sqr.c bn/bn_word.c - bn/bn_x931p.c buffer/buf_err.c buffer/buf_str.c buffer/buffer.c @@ -475,9 +471,6 @@ set( dso/dso_lib.c dso/dso_null.c dso/dso_openssl.c - ec/ec2_mult.c - ec/ec2_oct.c - ec/ec2_smpl.c ec/ec_ameth.c ec/ec_asn1.c ec/ec_check.c @@ -493,7 +486,6 @@ set( ec/ec_print.c ec/eck_prn.c ec/ecp_mont.c - ec/ecp_nist.c ec/ecp_oct.c ec/ecp_smpl.c ec/ecx_methods.c @@ -550,7 +542,6 @@ set( evp/e_gost2814789.c evp/e_idea.c evp/e_null.c - evp/e_old.c evp/e_rc2.c evp/e_rc4.c evp/e_rc4_hmac_md5.c @@ -625,7 +616,6 @@ set( modes/ccm128.c modes/cfb128.c modes/ctr128.c - modes/cts128.c modes/gcm128.c modes/ofb128.c modes/xts128.c @@ -706,7 +696,6 @@ set( rsa/rsa_pss.c rsa/rsa_saos.c rsa/rsa_sign.c - rsa/rsa_x931.c sha/sha1.c sha/sha256.c sha/sha3.c @@ -768,8 +757,6 @@ set( x509/x509_ncons.c x509/x509_obj.c x509/x509_ocsp.c - x509/x509_pci.c - x509/x509_pcia.c x509/x509_pcons.c x509/x509_pku.c x509/x509_pmaps.c @@ -779,7 +766,6 @@ set( x509/x509_req.c x509/x509_set.c x509/x509_skey.c - x509/x509_sxnet.c x509/x509_trs.c x509/x509_txt.c x509/x509_utl.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index b94067eb9e..37e91a13d7 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -338,7 +338,6 @@ libcrypto_la_SOURCES += asn1/asn_mime.c libcrypto_la_SOURCES += asn1/asn_moid.c libcrypto_la_SOURCES += asn1/bio_asn1.c libcrypto_la_SOURCES += asn1/bio_ndef.c -libcrypto_la_SOURCES += asn1/nsseq.c libcrypto_la_SOURCES += asn1/p5_pbe.c libcrypto_la_SOURCES += asn1/p5_pbev2.c libcrypto_la_SOURCES += asn1/p8_pkey.c @@ -424,7 +423,6 @@ libcrypto_la_SOURCES += bn/bn_div.c libcrypto_la_SOURCES += bn/bn_err.c libcrypto_la_SOURCES += bn/bn_exp.c libcrypto_la_SOURCES += bn/bn_gcd.c -libcrypto_la_SOURCES += bn/bn_gf2m.c libcrypto_la_SOURCES += bn/bn_isqrt.c libcrypto_la_SOURCES += bn/bn_kron.c libcrypto_la_SOURCES += bn/bn_lib.c @@ -432,7 +430,6 @@ libcrypto_la_SOURCES += bn/bn_mod.c libcrypto_la_SOURCES += bn/bn_mod_sqrt.c libcrypto_la_SOURCES += bn/bn_mont.c libcrypto_la_SOURCES += bn/bn_mul.c -libcrypto_la_SOURCES += bn/bn_nist.c libcrypto_la_SOURCES += bn/bn_prime.c libcrypto_la_SOURCES += bn/bn_rand.c libcrypto_la_SOURCES += bn/bn_recp.c @@ -440,7 +437,6 @@ libcrypto_la_SOURCES += bn/bn_shift.c libcrypto_la_SOURCES += bn/bn_small_primes.c libcrypto_la_SOURCES += bn/bn_sqr.c libcrypto_la_SOURCES += bn/bn_word.c -libcrypto_la_SOURCES += bn/bn_x931p.c noinst_HEADERS += bn/bn_internal.h noinst_HEADERS += bn/bn_local.h noinst_HEADERS += bn/bn_prime.h @@ -648,9 +644,6 @@ libcrypto_la_SOURCES += dso/dso_null.c libcrypto_la_SOURCES += dso/dso_openssl.c # ec -libcrypto_la_SOURCES += ec/ec2_mult.c -libcrypto_la_SOURCES += ec/ec2_oct.c -libcrypto_la_SOURCES += ec/ec2_smpl.c libcrypto_la_SOURCES += ec/ec_ameth.c libcrypto_la_SOURCES += ec/ec_asn1.c libcrypto_la_SOURCES += ec/ec_check.c @@ -666,7 +659,6 @@ libcrypto_la_SOURCES += ec/ec_pmeth.c libcrypto_la_SOURCES += ec/ec_print.c libcrypto_la_SOURCES += ec/eck_prn.c libcrypto_la_SOURCES += ec/ecp_mont.c -libcrypto_la_SOURCES += ec/ecp_nist.c libcrypto_la_SOURCES += ec/ecp_oct.c libcrypto_la_SOURCES += ec/ecp_smpl.c libcrypto_la_SOURCES += ec/ecx_methods.c @@ -737,7 +729,6 @@ libcrypto_la_SOURCES += evp/e_des3.c libcrypto_la_SOURCES += evp/e_gost2814789.c libcrypto_la_SOURCES += evp/e_idea.c libcrypto_la_SOURCES += evp/e_null.c -libcrypto_la_SOURCES += evp/e_old.c libcrypto_la_SOURCES += evp/e_rc2.c libcrypto_la_SOURCES += evp/e_rc4.c libcrypto_la_SOURCES += evp/e_rc4_hmac_md5.c @@ -848,7 +839,6 @@ libcrypto_la_SOURCES += modes/cbc128.c libcrypto_la_SOURCES += modes/ccm128.c libcrypto_la_SOURCES += modes/cfb128.c libcrypto_la_SOURCES += modes/ctr128.c -libcrypto_la_SOURCES += modes/cts128.c libcrypto_la_SOURCES += modes/gcm128.c libcrypto_la_SOURCES += modes/ofb128.c libcrypto_la_SOURCES += modes/xts128.c @@ -961,7 +951,6 @@ libcrypto_la_SOURCES += rsa/rsa_prn.c libcrypto_la_SOURCES += rsa/rsa_pss.c libcrypto_la_SOURCES += rsa/rsa_saos.c libcrypto_la_SOURCES += rsa/rsa_sign.c -libcrypto_la_SOURCES += rsa/rsa_x931.c noinst_HEADERS += rsa/rsa_local.h # sha @@ -1054,8 +1043,6 @@ libcrypto_la_SOURCES += x509/x509_lu.c libcrypto_la_SOURCES += x509/x509_ncons.c libcrypto_la_SOURCES += x509/x509_obj.c libcrypto_la_SOURCES += x509/x509_ocsp.c -libcrypto_la_SOURCES += x509/x509_pci.c -libcrypto_la_SOURCES += x509/x509_pcia.c libcrypto_la_SOURCES += x509/x509_pcons.c libcrypto_la_SOURCES += x509/x509_pku.c libcrypto_la_SOURCES += x509/x509_pmaps.c @@ -1065,7 +1052,6 @@ libcrypto_la_SOURCES += x509/x509_r2x.c libcrypto_la_SOURCES += x509/x509_req.c libcrypto_la_SOURCES += x509/x509_set.c libcrypto_la_SOURCES += x509/x509_skey.c -libcrypto_la_SOURCES += x509/x509_sxnet.c libcrypto_la_SOURCES += x509/x509_trs.c libcrypto_la_SOURCES += x509/x509_txt.c libcrypto_la_SOURCES += x509/x509_utl.c From 9b5f33843b427daa0ddc2258e380535b1b3ca432 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 25 Apr 2023 16:48:18 -0600 Subject: [PATCH 0262/1283] regen tlsexttest.c patch --- patches/tlsexttest.c.patch | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/patches/tlsexttest.c.patch b/patches/tlsexttest.c.patch index c1591d7aea..17d026a765 100644 --- a/patches/tlsexttest.c.patch +++ b/patches/tlsexttest.c.patch @@ -1,6 +1,6 @@ ---- tests/tlsexttest.c.orig Tue Nov 8 10:32:18 2022 -+++ tests/tlsexttest.c Tue Nov 8 10:35:52 2022 -@@ -1773,7 +1773,9 @@ static const unsigned char tlsext_sni_client[] = { +--- tests/tlsexttest.c.orig Tue Apr 25 16:44:59 2023 ++++ tests/tlsexttest.c Tue Apr 25 16:45:18 2023 +@@ -1774,7 +1774,9 @@ }; static const unsigned char tlsext_sni_server[] = { @@ -10,7 +10,7 @@ static int test_tlsext_sni_client(void) -@@ -1971,9 +1973,9 @@ test_tlsext_sni_server(void) +@@ -1972,9 +1974,9 @@ if (!CBB_finish(&cbb, &data, &dlen)) errx(1, "failed to finish CBB"); @@ -22,7 +22,7 @@ goto err; } -@@ -1982,14 +1984,14 @@ test_tlsext_sni_server(void) +@@ -1983,14 +1985,14 @@ fprintf(stderr, "received:\n"); hexdump(data, dlen); fprintf(stderr, "test data:\n"); @@ -39,7 +39,7 @@ if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) { FAIL("failed to parse server SNI\n"); goto err; -@@ -3194,7 +3196,10 @@ unsigned char tlsext_clienthello_default[] = { +@@ -3195,7 +3197,10 @@ 0x04, 0x03, 0x02, 0x01, 0x02, 0x03, }; @@ -51,7 +51,7 @@ static int test_tlsext_clienthello_build(void) -@@ -3280,18 +3285,18 @@ test_tlsext_clienthello_build(void) +@@ -3286,18 +3291,18 @@ goto err; } From fe6650450486fad6396954fc86b0452cf2474f0f Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 25 Apr 2023 16:52:30 -0600 Subject: [PATCH 0263/1283] regen openssl patch --- patches/openssl.c.patch | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/patches/openssl.c.patch b/patches/openssl.c.patch index 46702f260b..7816dd07df 100644 --- a/patches/openssl.c.patch +++ b/patches/openssl.c.patch @@ -1,6 +1,6 @@ ---- apps/openssl/openssl.c.orig Sun Nov 27 10:48:36 2022 -+++ apps/openssl/openssl.c Sun Nov 27 10:48:49 2022 -@@ -359,7 +359,9 @@ BIO *bio_err = NULL; +--- apps/openssl/openssl.c.orig Tue Apr 25 16:50:41 2023 ++++ apps/openssl/openssl.c Tue Apr 25 16:51:01 2023 +@@ -358,7 +358,9 @@ static void openssl_startup(void) { From 3f4235529b03804b7a3eeabc63086066ed24e221 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 25 Apr 2023 17:19:01 -0600 Subject: [PATCH 0264/1283] add back e_old.c --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index bcf8a29dc4..2267a3be48 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -542,6 +542,7 @@ set( evp/e_gost2814789.c evp/e_idea.c evp/e_null.c + evp/e_old.c evp/e_rc2.c evp/e_rc4.c evp/e_rc4_hmac_md5.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 37e91a13d7..fd518fe304 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -729,6 +729,7 @@ libcrypto_la_SOURCES += evp/e_des3.c libcrypto_la_SOURCES += evp/e_gost2814789.c libcrypto_la_SOURCES += evp/e_idea.c libcrypto_la_SOURCES += evp/e_null.c +libcrypto_la_SOURCES += evp/e_old.c libcrypto_la_SOURCES += evp/e_rc2.c libcrypto_la_SOURCES += evp/e_rc4.c libcrypto_la_SOURCES += evp/e_rc4_hmac_md5.c From 9f3b1b5a1af6d3b4688a370aa7bedf7aec6d2164 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 25 Apr 2023 17:51:11 -0600 Subject: [PATCH 0265/1283] Remove OPENSSL_NO_DEPRECATED from e_old.c --- patches/e_old.c.patch | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 patches/e_old.c.patch diff --git a/patches/e_old.c.patch b/patches/e_old.c.patch new file mode 100644 index 0000000000..031b955537 --- /dev/null +++ b/patches/e_old.c.patch @@ -0,0 +1,18 @@ +--- crypto/evp/e_old.c.orig Tue Apr 25 17:46:52 2023 ++++ crypto/evp/e_old.c Tue Apr 25 17:47:08 2023 +@@ -58,8 +58,6 @@ + + #include + +-#ifndef OPENSSL_NO_DEPRECATED +- + #include + + /* Define some deprecated functions, so older programs +@@ -154,6 +152,4 @@ + { + return EVP_aes_256_cfb128(); + } +-#endif +- + #endif From 6007185dc0865600abed916fa477cdb658bb287d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 26 Apr 2023 02:42:48 -0600 Subject: [PATCH 0266/1283] e_old.c went away again --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 2267a3be48..bcf8a29dc4 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -542,7 +542,6 @@ set( evp/e_gost2814789.c evp/e_idea.c evp/e_null.c - evp/e_old.c evp/e_rc2.c evp/e_rc4.c evp/e_rc4_hmac_md5.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index fd518fe304..37e91a13d7 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -729,7 +729,6 @@ libcrypto_la_SOURCES += evp/e_des3.c libcrypto_la_SOURCES += evp/e_gost2814789.c libcrypto_la_SOURCES += evp/e_idea.c libcrypto_la_SOURCES += evp/e_null.c -libcrypto_la_SOURCES += evp/e_old.c libcrypto_la_SOURCES += evp/e_rc2.c libcrypto_la_SOURCES += evp/e_rc4.c libcrypto_la_SOURCES += evp/e_rc4_hmac_md5.c From aa7c104b1ad5ba612fa71defb6b97395dc0dc55b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 26 Apr 2023 03:02:14 -0600 Subject: [PATCH 0267/1283] patching a non-existent file doesn't work so well... --- patches/e_old.c.patch | 18 ------------------ 1 file changed, 18 deletions(-) delete mode 100644 patches/e_old.c.patch diff --git a/patches/e_old.c.patch b/patches/e_old.c.patch deleted file mode 100644 index 031b955537..0000000000 --- a/patches/e_old.c.patch +++ /dev/null @@ -1,18 +0,0 @@ ---- crypto/evp/e_old.c.orig Tue Apr 25 17:46:52 2023 -+++ crypto/evp/e_old.c Tue Apr 25 17:47:08 2023 -@@ -58,8 +58,6 @@ - - #include - --#ifndef OPENSSL_NO_DEPRECATED -- - #include - - /* Define some deprecated functions, so older programs -@@ -154,6 +152,4 @@ - { - return EVP_aes_256_cfb128(); - } --#endif -- - #endif From b3ab35886f4b2355c97ebf17a602e85cf0c8e710 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 26 Apr 2023 08:29:58 -0600 Subject: [PATCH 0268/1283] bio_pk7.c was removed --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index bcf8a29dc4..a110f4c244 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -660,7 +660,6 @@ set( pkcs12/p12_sbag.c pkcs12/p12_utl.c pkcs12/pk12err.c - pkcs7/bio_pk7.c pkcs7/pk7_asn1.c pkcs7/pk7_attr.c pkcs7/pk7_doit.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 37e91a13d7..6b0f5644c2 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -898,7 +898,6 @@ libcrypto_la_SOURCES += pkcs12/pk12err.c noinst_HEADERS += pkcs12/pkcs12_local.h # pkcs7 -libcrypto_la_SOURCES += pkcs7/bio_pk7.c libcrypto_la_SOURCES += pkcs7/pk7_asn1.c libcrypto_la_SOURCES += pkcs7/pk7_attr.c libcrypto_la_SOURCES += pkcs7/pk7_doit.c From bafe5fa59dc11067aa6f872a36ddf9730d093261 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 26 Apr 2023 13:16:08 -0600 Subject: [PATCH 0269/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 3b3e7cf0ac..c82010481e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -43,6 +43,7 @@ LibreSSL Portable Release Notes: - Added a new implementation of BN_mod_sqrt(). - Removed incomplete and dangerous BN_RECURSION code. - Added endbr64 instructions to amd64 assembly. + - Imported RFC 5280 policy checking code from BoringSSL. * New features - Added support for truncated SHA-2 and for SHA-3. * Compatibility changes @@ -53,6 +54,8 @@ LibreSSL Portable Release Notes: - Removed most public symbols that were deprecated in OpenSSL 0.9.8. - Removed X9.31 support. - Removed Cipher Text Stealing mode. + - Removed SXNET and NETSCAPE_CERT_SEQUENCE support including the + openssl(1) nseq command. - Dropped proxy certificate (RFC 3820) support. - The POLICY_TREE and its related structures and API are no longer public. - The explicitText user notice uses UTF8String instead of VisibleString From 4c2ab9981ec049bd9aa618321c747f1d48fe9a74 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 26 Apr 2023 13:18:17 -0600 Subject: [PATCH 0270/1283] Link x509_policy.c to the build --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index a110f4c244..dae152a55e 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -759,6 +759,7 @@ set( x509/x509_pcons.c x509/x509_pku.c x509/x509_pmaps.c + x509/x509_policy.c x509/x509_prn.c x509/x509_purp.c x509/x509_r2x.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 6b0f5644c2..f7d6b87a81 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -1044,6 +1044,7 @@ libcrypto_la_SOURCES += x509/x509_obj.c libcrypto_la_SOURCES += x509/x509_ocsp.c libcrypto_la_SOURCES += x509/x509_pcons.c libcrypto_la_SOURCES += x509/x509_pku.c +libcrypto_la_SOURCES += x509/x509_policy.c libcrypto_la_SOURCES += x509/x509_pmaps.c libcrypto_la_SOURCES += x509/x509_prn.c libcrypto_la_SOURCES += x509/x509_purp.c From 4fdce0c68441bcbff65ed5303fe5472c2915520a Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Sat, 29 Apr 2023 01:15:13 +1000 Subject: [PATCH 0271/1283] Add CI workflow to run tests with ASM disabled --- .github/workflows/linux_test_asan_noasm.yml | 24 +++++++++++++++++++++ scripts/test | 16 ++++++++------ 2 files changed, 33 insertions(+), 7 deletions(-) create mode 100644 .github/workflows/linux_test_asan_noasm.yml diff --git a/.github/workflows/linux_test_asan_noasm.yml b/.github/workflows/linux_test_asan_noasm.yml new file mode 100644 index 0000000000..92ab2fccaf --- /dev/null +++ b/.github/workflows/linux_test_asan_noasm.yml @@ -0,0 +1,24 @@ +name: linux_ci_asan_noasm + +on: [push, pull_request] + +jobs: + build-native: + name: "${{ matrix.compiler }} - ${{ matrix.os }}" + runs-on: "${{ matrix.os }}" + strategy: + matrix: + os: ["ubuntu-latest"] + compiler: ["clang"] + env: + CC: "${{ matrix.compiler }}" + ARCH: native + CFLAGS: "-ggdb -fsanitize=address" + LDFLAGS: "-fsanitize=address" + CTEST_OUTPUT_ON_FAILURE: 1 + ENABLE_ASM: OFF + steps: + - name: "Checkout repository" + uses: actions/checkout@main + - name: "Run tests" + run: ./scripts/test diff --git a/scripts/test b/scripts/test index 144930f090..66c4f54ffb 100755 --- a/scripts/test +++ b/scripts/test @@ -2,6 +2,7 @@ set -e unset CC +ENABLE_ASM="${ENABLE_ASM:=ON}" if type apt-get >/dev/null then @@ -27,21 +28,21 @@ if [ "x$ARCH" = "xnative" ]; then # test cmake and ninja if [ `uname` = "Darwin" ]; then - cmake .. + cmake -DENABLE_ASM=${ENABLE_ASM} .. make -j 4 make test cd ../build-shared - cmake -DBUILD_SHARED_LIBS=ON .. + cmake -DBUILD_SHARED_LIBS=ON -DENABLE_ASM=${ENABLE_ASM} .. make -j 4 make test else - cmake -GNinja .. + cmake -GNinja -DENABLE_ASM=${ENABLE_ASM} .. ninja -j 4 ninja test cd ../build-shared - cmake -GNinja -DBUILD_SHARED_LIBS=ON .. + cmake -GNinja -DBUILD_SHARED_LIBS=ON -DENABLE_ASM=${ENABLE_ASM} .. ninja -j 4 ninja test fi @@ -61,14 +62,14 @@ elif [ "x$ARCH" = "xmingw32" -o "x$ARCH" = "xmingw64" ]; then rm -fr build-static mkdir build-static cd build-static - cmake -GNinja -DCMAKE_TOOLCHAIN_FILE=../scripts/$CPU-w64-mingw32.cmake .. + cmake -GNinja -DCMAKE_TOOLCHAIN_FILE=../scripts/$CPU-w64-mingw32.cmake -DENABLE_ASM=${ENABLE_ASM} .. ninja -j 4 ) ( rm -fr build-shared mkdir build-shared cd build-shared - cmake -GNinja -DCMAKE_TOOLCHAIN_FILE=../scripts/$CPU-w64-mingw32.cmake -DBUILD_SHARED_LIBS=ON .. + cmake -GNinja -DCMAKE_TOOLCHAIN_FILE=../scripts/$CPU-w64-mingw32.cmake -DBUILD_SHARED_LIBS=ON -DENABLE_ASM=${ENABLE_ASM} .. ninja -j 4 ) @@ -140,7 +141,8 @@ elif [ "x$ARCH" = "xandroid" ]; then cmake -GNinja -DCMAKE_MAKE_PROGRAM=ninja \ -DANDROID_NDK=$ANDROID_NDK_HOME \ -DCMAKE_TOOLCHAIN_FILE=$TC_FILE \ - -DANDROID_ABI=$ABI -DANDROID_NATIVE_API_LEVEL=$NAL .. + -DANDROID_ABI=$ABI -DANDROID_NATIVE_API_LEVEL=$NAL \ + -DENABLE_ASM=${ENABLE_ASM} .. ninja -j 4 From 9b4a05cbe6d004c5fedeb0ec06f07406245705c5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 28 Apr 2023 10:52:41 -0600 Subject: [PATCH 0272/1283] Update ChangeLog --- ChangeLog | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index c82010481e..4c2743dcdd 100644 --- a/ChangeLog +++ b/ChangeLog @@ -43,7 +43,8 @@ LibreSSL Portable Release Notes: - Added a new implementation of BN_mod_sqrt(). - Removed incomplete and dangerous BN_RECURSION code. - Added endbr64 instructions to amd64 assembly. - - Imported RFC 5280 policy checking code from BoringSSL. + - Imported RFC 5280 policy checking code from BoringSSL and used it + to replace the old exponential time code. * New features - Added support for truncated SHA-2 and for SHA-3. * Compatibility changes @@ -57,7 +58,7 @@ LibreSSL Portable Release Notes: - Removed SXNET and NETSCAPE_CERT_SEQUENCE support including the openssl(1) nseq command. - Dropped proxy certificate (RFC 3820) support. - - The POLICY_TREE and its related structures and API are no longer public. + - The POLICY_TREE and its related structures and API were removed. - The explicitText user notice uses UTF8String instead of VisibleString to reduce the risk of emitting certificates with invalid DER-encoding. * Bug fixes From f08bf799695d22feabe6c7ac73a7b151db2412a4 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 28 Apr 2023 11:03:01 -0600 Subject: [PATCH 0273/1283] Unhook policy code --- crypto/CMakeLists.txt | 6 ------ crypto/Makefile.am | 7 ------- 2 files changed, 13 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index dae152a55e..3b8468334d 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -722,12 +722,6 @@ set( x509/by_dir.c x509/by_file.c x509/by_mem.c - x509/pcy_cache.c - x509/pcy_data.c - x509/pcy_lib.c - x509/pcy_map.c - x509/pcy_node.c - x509/pcy_tree.c x509/x509_addr.c x509/x509_akey.c x509/x509_akeya.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index f7d6b87a81..e9dca252d1 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -1008,12 +1008,6 @@ noinst_HEADERS += whrlpool/wp_local.h libcrypto_la_SOURCES += x509/by_dir.c libcrypto_la_SOURCES += x509/by_file.c libcrypto_la_SOURCES += x509/by_mem.c -libcrypto_la_SOURCES += x509/pcy_cache.c -libcrypto_la_SOURCES += x509/pcy_data.c -libcrypto_la_SOURCES += x509/pcy_lib.c -libcrypto_la_SOURCES += x509/pcy_map.c -libcrypto_la_SOURCES += x509/pcy_node.c -libcrypto_la_SOURCES += x509/pcy_tree.c libcrypto_la_SOURCES += x509/x509_addr.c libcrypto_la_SOURCES += x509/x509_akey.c libcrypto_la_SOURCES += x509/x509_akeya.c @@ -1065,7 +1059,6 @@ libcrypto_la_SOURCES += x509/x509rset.c libcrypto_la_SOURCES += x509/x509spki.c libcrypto_la_SOURCES += x509/x509type.c libcrypto_la_SOURCES += x509/x_all.c -noinst_HEADERS += x509/pcy_int.h noinst_HEADERS += x509/x509_internal.h noinst_HEADERS += x509/x509_issuer_cache.h noinst_HEADERS += x509/x509_local.h From 79f5058d42e07d0ddec549c9e39ac8ee9c7c835a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 28 Apr 2023 11:03:51 -0600 Subject: [PATCH 0274/1283] enable x509_asn1 test --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 27065fb2f8..e29cee0724 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -727,6 +727,11 @@ add_executable(x509attribute x509attribute.c) target_link_libraries(x509attribute ${OPENSSL_TEST_LIBS}) add_test(x509attribute x509attribute) +# x509_asn1 +add_executable(x509_asn1 x509_asn1.c) +target_link_libraries(x509_asn1 ${OPENSSL_TEST_LIBS}) +add_test(x509_asn1 x509_asn1) + # x509_info add_executable(x509_info x509_info.c) target_link_libraries(x509_info ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index d984ed99bf..3ee6a69d84 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -716,6 +716,11 @@ TESTS += x509attribute check_PROGRAMS += x509attribute x509attribute_SOURCES = x509attribute.c +# x509_asn1 +TESTS += x509_asn1 +check_PROGRAMS += x509_asn1 +x509_asn1_SOURCES = x509_asn1.c + # x509_info TESTS += x509_info check_PROGRAMS += x509_info From 5e68ae38e43a93aad5150c70bf1e467f8dcefee4 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 28 Apr 2023 11:34:43 -0600 Subject: [PATCH 0275/1283] rfc3779 no longer uses __unused --- tests/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/Makefile.am b/tests/Makefile.am index 3ee6a69d84..7b064c6c54 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -541,7 +541,7 @@ record_layer_test_SOURCES = record_layer_test.c # rfc3779 TESTS += rfc3779 -rfc3779_CPPFLAGS = $(AM_CPPFLAGS) -D__unused= +rfc3779_CPPFLAGS = $(AM_CPPFLAGS) check_PROGRAMS += rfc3779 rfc3779_SOURCES = rfc3779.c From 0d3f252c94057ef5d32e659e941d7877de37d514 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 28 Apr 2023 11:42:10 -0600 Subject: [PATCH 0276/1283] add and enable policy tests --- tests/CMakeLists.txt | 7 +++++++ tests/Makefile.am | 33 +++++++++++++++++++++++++++++++++ update.sh | 1 + 3 files changed, 41 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index e29cee0724..4c38a7ded0 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -485,6 +485,13 @@ add_executable(poly1305test poly1305test.c) target_link_libraries(poly1305test ${OPENSSL_TEST_LIBS}) add_test(poly1305test poly1305test) +# policy +add_executable(policy policy.c) +set_source_files_properties(policy.c PROPERTIES COMPILE_FLAGS + -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") +target_link_libraries(policy ${OPENSSL_TEST_LIBS}) +add_test(policy policy) + # pq_test add_executable(pq_test pq_test.c) target_link_libraries(pq_test ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 7b064c6c54..a608d31171 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -501,6 +501,39 @@ TESTS += poly1305test check_PROGRAMS += poly1305test poly1305test_SOURCES = poly1305test.c +# policy +TESTS += policy +check_program += policy +policy_CPPFLAGS = $(AM_CPPFLAGS) -DCERTSDIR=\"$(srcdir)\" +policy_SOURCES = policy.c +EXTRA_DIST += policy_intermediate.pem +EXTRA_DIST += policy_intermediate_any.pem +EXTRA_DIST += policy_intermediate_duplicate.pem +EXTRA_DIST += policy_intermediate_invalid.pem +EXTRA_DIST += policy_intermediate_mapped.pem +EXTRA_DIST += policy_intermediate_mapped_any.pem +EXTRA_DIST += policy_intermediate_mapped_oid3.pem +EXTRA_DIST += policy_intermediate_require.pem +EXTRA_DIST += policy_intermediate_require1.pem +EXTRA_DIST += policy_intermediate_require2.pem +EXTRA_DIST += policy_intermediate_require_duplicate.pem +EXTRA_DIST += policy_intermediate_require_no_policies.pem +EXTRA_DIST += policy_leaf.pem +EXTRA_DIST += policy_leaf_any.pem +EXTRA_DIST += policy_leaf_duplicate.pem +EXTRA_DIST += policy_leaf_invalid.pem +EXTRA_DIST += policy_leaf_none.pem +EXTRA_DIST += policy_leaf_oid1.pem +EXTRA_DIST += policy_leaf_oid2.pem +EXTRA_DIST += policy_leaf_oid3.pem +EXTRA_DIST += policy_leaf_oid4.pem +EXTRA_DIST += policy_leaf_oid5.pem +EXTRA_DIST += policy_leaf_require.pem +EXTRA_DIST += policy_leaf_require1.pem +EXTRA_DIST += policy_root.pem +EXTRA_DIST += policy_root2.pem +EXTRA_DIST += policy_root_cross_inhibit_mapping.pem + # pq_test TESTS += pq_test.sh check_PROGRAMS += pq_test diff --git a/update.sh b/update.sh index e5d17994d7..d42cd5867c 100755 --- a/update.sh +++ b/update.sh @@ -353,6 +353,7 @@ $CP $libcrypto_regress/evp/evptests.txt tests $CP $libcrypto_regress/aead/*.txt tests $CP $libcrypto_regress/ct/ctlog.conf tests $CP $libcrypto_regress/ct/*.crt tests +$CP $libcrypto_regress/x509/policy/*.pem tests # generate libcrypto freenull.c awk -f $libcrypto_regress/free/freenull.awk \ From da8d75b6609c23aa89df1d05fdec611659ecfc1b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 28 Apr 2023 11:47:16 -0600 Subject: [PATCH 0277/1283] update gitignore --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index 58ebb7c17f..d6b9276e2f 100644 --- a/.gitignore +++ b/.gitignore @@ -107,6 +107,7 @@ tests/freenull* tests/gost2814789t* tests/key_schedule* tests/mont* +tests/policy* tests/rfc3779* tests/rfc5280time* tests/ssl_get_shared_ciphers* @@ -126,6 +127,7 @@ tests/testssl tests/*.txt tests/compat/*.c tests/verify* +tests/x509_asn1* tests/x509_info* tests/x509attribute* tests/x509name* From bcb576938d6ad75ed877e0506457a8629a82f6f8 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 28 Apr 2023 11:56:17 -0600 Subject: [PATCH 0278/1283] regen tlsexttest.patch --- patches/tlsexttest.c.patch | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/patches/tlsexttest.c.patch b/patches/tlsexttest.c.patch index 17d026a765..023d3231a8 100644 --- a/patches/tlsexttest.c.patch +++ b/patches/tlsexttest.c.patch @@ -1,6 +1,6 @@ ---- tests/tlsexttest.c.orig Tue Apr 25 16:44:59 2023 -+++ tests/tlsexttest.c Tue Apr 25 16:45:18 2023 -@@ -1774,7 +1774,9 @@ +--- tests/tlsexttest.c.orig Fri Apr 28 11:42:38 2023 ++++ tests/tlsexttest.c Fri Apr 28 11:55:27 2023 +@@ -1775,7 +1775,9 @@ }; static const unsigned char tlsext_sni_server[] = { @@ -10,7 +10,7 @@ static int test_tlsext_sni_client(void) -@@ -1972,9 +1974,9 @@ +@@ -1973,9 +1975,9 @@ if (!CBB_finish(&cbb, &data, &dlen)) errx(1, "failed to finish CBB"); @@ -22,7 +22,7 @@ goto err; } -@@ -1983,14 +1985,14 @@ +@@ -1984,14 +1986,14 @@ fprintf(stderr, "received:\n"); hexdump(data, dlen); fprintf(stderr, "test data:\n"); @@ -39,7 +39,7 @@ if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) { FAIL("failed to parse server SNI\n"); goto err; -@@ -3195,7 +3197,10 @@ +@@ -3196,7 +3198,10 @@ 0x04, 0x03, 0x02, 0x01, 0x02, 0x03, }; @@ -51,7 +51,7 @@ static int test_tlsext_clienthello_build(void) -@@ -3286,18 +3291,18 @@ +@@ -3287,18 +3292,18 @@ goto err; } From fc15f4839354a7c312376c51286c29ef94e6eeff Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 28 Apr 2023 11:58:27 -0600 Subject: [PATCH 0279/1283] Fixed botched autoconf --- tests/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/Makefile.am b/tests/Makefile.am index a608d31171..b17f1ef48c 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -503,7 +503,7 @@ poly1305test_SOURCES = poly1305test.c # policy TESTS += policy -check_program += policy +check_PROGRAMS += policy policy_CPPFLAGS = $(AM_CPPFLAGS) -DCERTSDIR=\"$(srcdir)\" policy_SOURCES = policy.c EXTRA_DIST += policy_intermediate.pem From b5609cd9492e5c73f9081a80f1239774c48fa492 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 1 May 2023 04:22:51 -0600 Subject: [PATCH 0280/1283] tweak ChangeLog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 4c2743dcdd..57b34e3560 100644 --- a/ChangeLog +++ b/ChangeLog @@ -70,7 +70,7 @@ LibreSSL Portable Release Notes: * Documentation improvements - Improved documentation of BIO_ctrl(3), BIO_set_info_callback(3), BIO_get_info_callback(3), BIO_method_type(3), and BIO_method_name(3). - - Marked BIO_CB_return(), BIO_cb_pre(), and BIO_cb_Post() as intentionally + - Marked BIO_CB_return(), BIO_cb_pre(), and BIO_cb_post() as intentionally undocumented. * Testing and Proactive Security - Significantly improved test coverage of BN_mod_sqrt() and GCD. From d0b6ef4002e091479c9c9d9f0f3bb5394808c6a2 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 1 May 2023 05:02:27 -0600 Subject: [PATCH 0281/1283] Update man links --- man/links | 87 ++----------------------------------------------------- 1 file changed, 3 insertions(+), 84 deletions(-) diff --git a/man/links b/man/links index ebacbc6b4f..964a7fb06f 100644 --- a/man/links +++ b/man/links @@ -123,7 +123,6 @@ ASN1_item_d2i.3,ASN1_item_dup.3 ASN1_item_d2i.3,ASN1_item_i2d.3 ASN1_item_d2i.3,ASN1_item_i2d_bio.3 ASN1_item_d2i.3,ASN1_item_i2d_fp.3 -ASN1_item_d2i.3,ASN1_item_ndef_i2d.3 ASN1_item_d2i.3,ASN1_item_print.3 ASN1_item_d2i.3,d2i_ASN1_TYPE.3 ASN1_item_d2i.3,i2d_ASN1_TYPE.3 @@ -196,6 +195,7 @@ BIO_f_cipher.3,BIO_set_cipher.3 BIO_f_md.3,BIO_get_md.3 BIO_f_md.3,BIO_get_md_ctx.3 BIO_f_md.3,BIO_set_md.3 +BIO_f_md.3,BIO_set_md_ctx.3 BIO_f_ssl.3,BIO_do_handshake.3 BIO_f_ssl.3,BIO_get_num_renegotiates.3 BIO_f_ssl.3,BIO_get_ssl.3 @@ -364,37 +364,14 @@ BN_BLINDING_new.3,BN_BLINDING_convert_ex.3 BN_BLINDING_new.3,BN_BLINDING_create_param.3 BN_BLINDING_new.3,BN_BLINDING_free.3 BN_BLINDING_new.3,BN_BLINDING_get_flags.3 -BN_BLINDING_new.3,BN_BLINDING_get_thread_id.3 BN_BLINDING_new.3,BN_BLINDING_invert.3 BN_BLINDING_new.3,BN_BLINDING_invert_ex.3 BN_BLINDING_new.3,BN_BLINDING_set_flags.3 -BN_BLINDING_new.3,BN_BLINDING_set_thread_id.3 BN_BLINDING_new.3,BN_BLINDING_thread_id.3 BN_BLINDING_new.3,BN_BLINDING_update.3 BN_CTX_new.3,BN_CTX_free.3 -BN_CTX_new.3,BN_CTX_init.3 BN_CTX_start.3,BN_CTX_end.3 BN_CTX_start.3,BN_CTX_get.3 -BN_GF2m_add.3,BN_GF2m_arr2poly.3 -BN_GF2m_add.3,BN_GF2m_cmp.3 -BN_GF2m_add.3,BN_GF2m_mod.3 -BN_GF2m_add.3,BN_GF2m_mod_arr.3 -BN_GF2m_add.3,BN_GF2m_mod_div.3 -BN_GF2m_add.3,BN_GF2m_mod_div_arr.3 -BN_GF2m_add.3,BN_GF2m_mod_exp.3 -BN_GF2m_add.3,BN_GF2m_mod_exp_arr.3 -BN_GF2m_add.3,BN_GF2m_mod_inv.3 -BN_GF2m_add.3,BN_GF2m_mod_inv_arr.3 -BN_GF2m_add.3,BN_GF2m_mod_mul.3 -BN_GF2m_add.3,BN_GF2m_mod_mul_arr.3 -BN_GF2m_add.3,BN_GF2m_mod_solve_quad.3 -BN_GF2m_add.3,BN_GF2m_mod_solve_quad_arr.3 -BN_GF2m_add.3,BN_GF2m_mod_sqr.3 -BN_GF2m_add.3,BN_GF2m_mod_sqr_arr.3 -BN_GF2m_add.3,BN_GF2m_mod_sqrt.3 -BN_GF2m_add.3,BN_GF2m_mod_sqrt_arr.3 -BN_GF2m_add.3,BN_GF2m_poly2arr.3 -BN_GF2m_add.3,BN_GF2m_sub.3 BN_add.3,BN_div.3 BN_add.3,BN_exp.3 BN_add.3,BN_gcd.3 @@ -448,36 +425,18 @@ BN_generate_prime.3,BN_GENCB_new.3 BN_generate_prime.3,BN_GENCB_set.3 BN_generate_prime.3,BN_GENCB_set_old.3 BN_generate_prime.3,BN_generate_prime_ex.3 -BN_generate_prime.3,BN_is_prime.3 BN_generate_prime.3,BN_is_prime_ex.3 -BN_generate_prime.3,BN_is_prime_fasttest.3 BN_generate_prime.3,BN_is_prime_fasttest_ex.3 -BN_get0_nist_prime_521.3,BN_get0_nist_prime_192.3 -BN_get0_nist_prime_521.3,BN_get0_nist_prime_224.3 -BN_get0_nist_prime_521.3,BN_get0_nist_prime_256.3 -BN_get0_nist_prime_521.3,BN_get0_nist_prime_384.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_copy.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_free.3 -BN_mod_mul_montgomery.3,BN_MONT_CTX_init.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_new.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_set.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_set_locked.3 BN_mod_mul_montgomery.3,BN_from_montgomery.3 BN_mod_mul_montgomery.3,BN_to_montgomery.3 -BN_mod_mul_reciprocal.3,BN_RECP_CTX_free.3 -BN_mod_mul_reciprocal.3,BN_RECP_CTX_init.3 -BN_mod_mul_reciprocal.3,BN_RECP_CTX_new.3 -BN_mod_mul_reciprocal.3,BN_RECP_CTX_set.3 -BN_mod_mul_reciprocal.3,BN_div_recp.3 -BN_mod_mul_reciprocal.3,BN_reciprocal.3 BN_new.3,BN_clear.3 BN_new.3,BN_clear_free.3 BN_new.3,BN_free.3 -BN_new.3,BN_init.3 -BN_nist_mod_521.3,BN_nist_mod_192.3 -BN_nist_mod_521.3,BN_nist_mod_224.3 -BN_nist_mod_521.3,BN_nist_mod_256.3 -BN_nist_mod_521.3,BN_nist_mod_384.3 BN_num_bytes.3,BN_num_bits.3 BN_num_bytes.3,BN_num_bits_word.3 BN_rand.3,BN_pseudo_rand.3 @@ -497,7 +456,6 @@ BN_zero.3,BN_get_word.3 BN_zero.3,BN_one.3 BN_zero.3,BN_set_word.3 BN_zero.3,BN_value_one.3 -BN_zero.3,BN_zero_ex.3 BUF_MEM_new.3,BUF_MEM_free.3 BUF_MEM_new.3,BUF_MEM_grow.3 BUF_MEM_new.3,BUF_MEM_grow_clean.3 @@ -693,12 +651,7 @@ ECDSA_SIG_new.3,ECDSA_size.3 ECDSA_SIG_new.3,ECDSA_verify.3 ECDSA_SIG_new.3,d2i_ECDSA_SIG.3 ECDSA_SIG_new.3,i2d_ECDSA_SIG.3 -EC_GFp_simple_method.3,EC_GF2m_simple_method.3 EC_GFp_simple_method.3,EC_GFp_mont_method.3 -EC_GFp_simple_method.3,EC_GFp_nist_method.3 -EC_GFp_simple_method.3,EC_GFp_nistp224_method.3 -EC_GFp_simple_method.3,EC_GFp_nistp256_method.3 -EC_GFp_simple_method.3,EC_GFp_nistp521_method.3 EC_GFp_simple_method.3,EC_METHOD_get_field_type.3 EC_GROUP_copy.3,EC_GROUP_check.3 EC_GROUP_copy.3,EC_GROUP_check_discriminant.3 @@ -726,13 +679,10 @@ EC_GROUP_copy.3,EC_GROUP_set_seed.3 EC_GROUP_new.3,EC_GROUP_clear_free.3 EC_GROUP_new.3,EC_GROUP_free.3 EC_GROUP_new.3,EC_GROUP_get_curve.3 -EC_GROUP_new.3,EC_GROUP_get_curve_GF2m.3 EC_GROUP_new.3,EC_GROUP_get_curve_GFp.3 EC_GROUP_new.3,EC_GROUP_new_by_curve_name.3 -EC_GROUP_new.3,EC_GROUP_new_curve_GF2m.3 EC_GROUP_new.3,EC_GROUP_new_curve_GFp.3 EC_GROUP_new.3,EC_GROUP_set_curve.3 -EC_GROUP_new.3,EC_GROUP_set_curve_GF2m.3 EC_GROUP_new.3,EC_GROUP_set_curve_GFp.3 EC_GROUP_new.3,EC_get_builtin_curves.3 EC_KEY_METHOD_new.3,EC_KEY_METHOD_free.3 @@ -764,8 +714,6 @@ EC_KEY_new.3,EC_KEY_get0_public_key.3 EC_KEY_new.3,EC_KEY_get_conv_form.3 EC_KEY_new.3,EC_KEY_get_enc_flags.3 EC_KEY_new.3,EC_KEY_get_flags.3 -EC_KEY_new.3,EC_KEY_get_key_method_data.3 -EC_KEY_new.3,EC_KEY_insert_key_method_data.3 EC_KEY_new.3,EC_KEY_new_by_curve_name.3 EC_KEY_new.3,EC_KEY_precompute_mult.3 EC_KEY_new.3,EC_KEY_print.3 @@ -797,7 +745,6 @@ EC_POINT_new.3,EC_POINT_dup.3 EC_POINT_new.3,EC_POINT_free.3 EC_POINT_new.3,EC_POINT_get_Jprojective_coordinates_GFp.3 EC_POINT_new.3,EC_POINT_get_affine_coordinates.3 -EC_POINT_new.3,EC_POINT_get_affine_coordinates_GF2m.3 EC_POINT_new.3,EC_POINT_get_affine_coordinates_GFp.3 EC_POINT_new.3,EC_POINT_hex2point.3 EC_POINT_new.3,EC_POINT_method_of.3 @@ -807,10 +754,8 @@ EC_POINT_new.3,EC_POINT_point2hex.3 EC_POINT_new.3,EC_POINT_point2oct.3 EC_POINT_new.3,EC_POINT_set_Jprojective_coordinates_GFp.3 EC_POINT_new.3,EC_POINT_set_affine_coordinates.3 -EC_POINT_new.3,EC_POINT_set_affine_coordinates_GF2m.3 EC_POINT_new.3,EC_POINT_set_affine_coordinates_GFp.3 EC_POINT_new.3,EC_POINT_set_compressed_coordinates.3 -EC_POINT_new.3,EC_POINT_set_compressed_coordinates_GF2m.3 EC_POINT_new.3,EC_POINT_set_compressed_coordinates_GFp.3 EC_POINT_new.3,EC_POINT_set_to_infinity.3 ENGINE_add.3,ENGINE_by_id.3 @@ -1001,6 +946,8 @@ EVP_DigestInit.3,EVP_sha224.3 EVP_DigestInit.3,EVP_sha256.3 EVP_DigestInit.3,EVP_sha384.3 EVP_DigestInit.3,EVP_sha512.3 +EVP_DigestInit.3,EVP_sha512_224.3 +EVP_DigestInit.3,EVP_sha512_256.3 EVP_DigestSignInit.3,EVP_DigestSign.3 EVP_DigestSignInit.3,EVP_DigestSignFinal.3 EVP_DigestSignInit.3,EVP_DigestSignUpdate.3 @@ -1495,7 +1442,6 @@ PEM_read_bio_PrivateKey.3,PEM_read_DSAparams.3 PEM_read_bio_PrivateKey.3,PEM_read_ECPKParameters.3 PEM_read_bio_PrivateKey.3,PEM_read_ECPrivateKey.3 PEM_read_bio_PrivateKey.3,PEM_read_EC_PUBKEY.3 -PEM_read_bio_PrivateKey.3,PEM_read_NETSCAPE_CERT_SEQUENCE.3 PEM_read_bio_PrivateKey.3,PEM_read_PKCS7.3 PEM_read_bio_PrivateKey.3,PEM_read_PKCS8.3 PEM_read_bio_PrivateKey.3,PEM_read_PKCS8_PRIV_KEY_INFO.3 @@ -1516,7 +1462,6 @@ PEM_read_bio_PrivateKey.3,PEM_read_bio_DSAparams.3 PEM_read_bio_PrivateKey.3,PEM_read_bio_ECPKParameters.3 PEM_read_bio_PrivateKey.3,PEM_read_bio_ECPrivateKey.3 PEM_read_bio_PrivateKey.3,PEM_read_bio_EC_PUBKEY.3 -PEM_read_bio_PrivateKey.3,PEM_read_bio_NETSCAPE_CERT_SEQUENCE.3 PEM_read_bio_PrivateKey.3,PEM_read_bio_PKCS7.3 PEM_read_bio_PrivateKey.3,PEM_read_bio_PKCS8.3 PEM_read_bio_PrivateKey.3,PEM_read_bio_PKCS8_PRIV_KEY_INFO.3 @@ -1536,7 +1481,6 @@ PEM_read_bio_PrivateKey.3,PEM_write_DSAparams.3 PEM_read_bio_PrivateKey.3,PEM_write_ECPKParameters.3 PEM_read_bio_PrivateKey.3,PEM_write_ECPrivateKey.3 PEM_read_bio_PrivateKey.3,PEM_write_EC_PUBKEY.3 -PEM_read_bio_PrivateKey.3,PEM_write_NETSCAPE_CERT_SEQUENCE.3 PEM_read_bio_PrivateKey.3,PEM_write_PKCS7.3 PEM_read_bio_PrivateKey.3,PEM_write_PKCS8.3 PEM_read_bio_PrivateKey.3,PEM_write_PKCS8PrivateKey.3 @@ -1560,7 +1504,6 @@ PEM_read_bio_PrivateKey.3,PEM_write_bio_DSAparams.3 PEM_read_bio_PrivateKey.3,PEM_write_bio_ECPKParameters.3 PEM_read_bio_PrivateKey.3,PEM_write_bio_ECPrivateKey.3 PEM_read_bio_PrivateKey.3,PEM_write_bio_EC_PUBKEY.3 -PEM_read_bio_PrivateKey.3,PEM_write_bio_NETSCAPE_CERT_SEQUENCE.3 PEM_read_bio_PrivateKey.3,PEM_write_bio_PKCS7.3 PEM_read_bio_PrivateKey.3,PEM_write_bio_PKCS8.3 PEM_read_bio_PrivateKey.3,PEM_write_bio_PKCS8PrivateKey.3 @@ -1632,9 +1575,6 @@ POLICYINFO_new.3,POLICY_MAPPING_free.3 POLICYINFO_new.3,POLICY_MAPPING_new.3 POLICYINFO_new.3,USERNOTICE_free.3 POLICYINFO_new.3,USERNOTICE_new.3 -PROXY_POLICY_new.3,PROXY_CERT_INFO_EXTENSION_free.3 -PROXY_POLICY_new.3,PROXY_CERT_INFO_EXTENSION_new.3 -PROXY_POLICY_new.3,PROXY_POLICY_free.3 RAND_add.3,RAND_cleanup.3 RAND_add.3,RAND_poll.3 RAND_add.3,RAND_seed.3 @@ -2060,13 +2000,6 @@ SSL_want.3,SSL_want_read.3 SSL_want.3,SSL_want_write.3 SSL_want.3,SSL_want_x509_lookup.3 SSL_write.3,SSL_write_ex.3 -SXNET_new.3,SXNETID_free.3 -SXNET_new.3,SXNETID_new.3 -SXNET_new.3,SXNET_free.3 -SXNET_new.3,d2i_SXNET.3 -SXNET_new.3,d2i_SXNETID.3 -SXNET_new.3,i2d_SXNET.3 -SXNET_new.3,i2d_SXNETID.3 TS_REQ_new.3,TS_ACCURACY_free.3 TS_REQ_new.3,TS_ACCURACY_new.3 TS_REQ_new.3,TS_MSG_IMPRINT_free.3 @@ -2297,12 +2230,10 @@ X509_STORE_CTX_get_error.3,X509_STORE_CTX_get0_chain.3 X509_STORE_CTX_get_error.3,X509_STORE_CTX_get0_current_crl.3 X509_STORE_CTX_get_error.3,X509_STORE_CTX_get0_current_issuer.3 X509_STORE_CTX_get_error.3,X509_STORE_CTX_get0_parent_ctx.3 -X509_STORE_CTX_get_error.3,X509_STORE_CTX_get0_policy_tree.3 X509_STORE_CTX_get_error.3,X509_STORE_CTX_get1_chain.3 X509_STORE_CTX_get_error.3,X509_STORE_CTX_get_chain.3 X509_STORE_CTX_get_error.3,X509_STORE_CTX_get_current_cert.3 X509_STORE_CTX_get_error.3,X509_STORE_CTX_get_error_depth.3 -X509_STORE_CTX_get_error.3,X509_STORE_CTX_get_explicit_policy.3 X509_STORE_CTX_get_error.3,X509_STORE_CTX_get_num_untrusted.3 X509_STORE_CTX_get_error.3,X509_STORE_CTX_set0_verified_chain.3 X509_STORE_CTX_get_error.3,X509_STORE_CTX_set_current_cert.3 @@ -2489,14 +2420,6 @@ X509_new.3,X509_chain_up_ref.3 X509_new.3,X509_dup.3 X509_new.3,X509_free.3 X509_new.3,X509_up_ref.3 -X509_policy_check.3,X509_policy_tree_free.3 -X509_policy_tree_get0_policies.3,X509_policy_tree_get0_user_policies.3 -X509_policy_tree_level_count.3,X509_policy_level_get0_node.3 -X509_policy_tree_level_count.3,X509_policy_level_node_count.3 -X509_policy_tree_level_count.3,X509_policy_node_get0_parent.3 -X509_policy_tree_level_count.3,X509_policy_node_get0_policy.3 -X509_policy_tree_level_count.3,X509_policy_node_get0_qualifiers.3 -X509_policy_tree_level_count.3,X509_policy_tree_get0_level.3 X509_print_ex.3,X509_CERT_AUX_print.3 X509_print_ex.3,X509_print.3 X509_print_ex.3,X509_print_ex_fp.3 @@ -2750,7 +2673,6 @@ d2i_PKCS7.3,i2d_PKCS7_ENCRYPT.3 d2i_PKCS7.3,i2d_PKCS7_ENC_CONTENT.3 d2i_PKCS7.3,i2d_PKCS7_ENVELOPE.3 d2i_PKCS7.3,i2d_PKCS7_ISSUER_AND_SERIAL.3 -d2i_PKCS7.3,i2d_PKCS7_NDEF.3 d2i_PKCS7.3,i2d_PKCS7_RECIP_INFO.3 d2i_PKCS7.3,i2d_PKCS7_SIGNED.3 d2i_PKCS7.3,i2d_PKCS7_SIGNER_INFO.3 @@ -2777,9 +2699,6 @@ d2i_POLICYINFO.3,i2d_NOTICEREF.3 d2i_POLICYINFO.3,i2d_POLICYINFO.3 d2i_POLICYINFO.3,i2d_POLICYQUALINFO.3 d2i_POLICYINFO.3,i2d_USERNOTICE.3 -d2i_PROXY_POLICY.3,d2i_PROXY_CERT_INFO_EXTENSION.3 -d2i_PROXY_POLICY.3,i2d_PROXY_CERT_INFO_EXTENSION.3 -d2i_PROXY_POLICY.3,i2d_PROXY_POLICY.3 d2i_PrivateKey.3,d2i_AutoPrivateKey.3 d2i_PrivateKey.3,d2i_PrivateKey_bio.3 d2i_PrivateKey.3,d2i_PrivateKey_fp.3 From 0b710d6672ef0cd5e87192baf4438a827d9aabff Mon Sep 17 00:00:00 2001 From: Bob Beck Date: Tue, 2 May 2023 08:19:29 -0600 Subject: [PATCH 0282/1283] Add to changelog --- ChangeLog | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 57b34e3560..9fbc33a170 100644 --- a/ChangeLog +++ b/ChangeLog @@ -45,6 +45,8 @@ LibreSSL Portable Release Notes: - Added endbr64 instructions to amd64 assembly. - Imported RFC 5280 policy checking code from BoringSSL and used it to replace the old exponential time code. + - Modified X509_NAME_get_text_by_[NID|OBJ] to safely return a C string + instead of potentially arbitrary bytes * New features - Added support for truncated SHA-2 and for SHA-3. * Compatibility changes @@ -67,8 +69,10 @@ LibreSSL Portable Release Notes: - Fix error checking of i2d_ECDSA_SIG() in ossl_ecdsa_sign(). - Fixed detection of extended operations (XOP) on AMD hardware. - Ensure Montgomery exponentiation is used for the initial RSA blinding. + - Policy is always checked in X509 validation, Critical policy extensions + are no longer silently ignored. * Documentation improvements - - Improved documentation of BIO_ctrl(3), BIO_set_info_callback(3), + - Improved documentation of BIO_ctrl(3), BIO_set_info_callback(3), BIO_get_info_callback(3), BIO_method_type(3), and BIO_method_name(3). - Marked BIO_CB_return(), BIO_cb_pre(), and BIO_cb_post() as intentionally undocumented. From cfd985364666309abf772b27764c114e68818f57 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 3 May 2023 23:13:18 -0600 Subject: [PATCH 0283/1283] Update ChangeLog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 9fbc33a170..93e7ddbe44 100644 --- a/ChangeLog +++ b/ChangeLog @@ -55,7 +55,7 @@ LibreSSL Portable Release Notes: - Removed dangerous, "fast" NIST prime and elliptic curve implementations. In particular, EC_GFp_nist_method() is no longer available. - Removed most public symbols that were deprecated in OpenSSL 0.9.8. - - Removed X9.31 support. + - The public X9.31 API was removed. RSA_X931_PADDING is still available. - Removed Cipher Text Stealing mode. - Removed SXNET and NETSCAPE_CERT_SEQUENCE support including the openssl(1) nseq command. From 686f7ff31e9848a282020f9ed82e6d3ca86fc109 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 5 May 2023 06:42:50 -0600 Subject: [PATCH 0284/1283] Add back rsa_x931.c for salt --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 3b8468334d..49dfdf8dd8 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -695,6 +695,7 @@ set( rsa/rsa_pss.c rsa/rsa_saos.c rsa/rsa_sign.c + rsa/rsa_x931.c sha/sha1.c sha/sha256.c sha/sha3.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index e9dca252d1..8fcd4f73be 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -950,6 +950,7 @@ libcrypto_la_SOURCES += rsa/rsa_prn.c libcrypto_la_SOURCES += rsa/rsa_pss.c libcrypto_la_SOURCES += rsa/rsa_saos.c libcrypto_la_SOURCES += rsa/rsa_sign.c +libcrypto_la_SOURCES += rsa/rsa_x931.c noinst_HEADERS += rsa/rsa_local.h # sha From bfc51905a91739c3955fe458b8eacb8bf8300543 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 5 May 2023 09:23:26 -0600 Subject: [PATCH 0285/1283] Update ChangeLog --- ChangeLog | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 93e7ddbe44..5916166e45 100644 --- a/ChangeLog +++ b/ChangeLog @@ -45,8 +45,6 @@ LibreSSL Portable Release Notes: - Added endbr64 instructions to amd64 assembly. - Imported RFC 5280 policy checking code from BoringSSL and used it to replace the old exponential time code. - - Modified X509_NAME_get_text_by_[NID|OBJ] to safely return a C string - instead of potentially arbitrary bytes * New features - Added support for truncated SHA-2 and for SHA-3. * Compatibility changes @@ -69,7 +67,7 @@ LibreSSL Portable Release Notes: - Fix error checking of i2d_ECDSA_SIG() in ossl_ecdsa_sign(). - Fixed detection of extended operations (XOP) on AMD hardware. - Ensure Montgomery exponentiation is used for the initial RSA blinding. - - Policy is always checked in X509 validation, Critical policy extensions + - Policy is always checked in X509 validation. Critical policy extensions are no longer silently ignored. * Documentation improvements - Improved documentation of BIO_ctrl(3), BIO_set_info_callback(3), From b24deefa4271f6fa31e0ea842774e7c6ce859916 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 10 May 2023 02:20:55 -0600 Subject: [PATCH 0286/1283] Update ChangeLog --- ChangeLog | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 5916166e45..ec6e072975 100644 --- a/ChangeLog +++ b/ChangeLog @@ -45,6 +45,7 @@ LibreSSL Portable Release Notes: - Added endbr64 instructions to amd64 assembly. - Imported RFC 5280 policy checking code from BoringSSL and used it to replace the old exponential time code. + - Converted more of libcrypto to use CBB/CBS. * New features - Added support for truncated SHA-2 and for SHA-3. * Compatibility changes @@ -62,13 +63,14 @@ LibreSSL Portable Release Notes: - The explicitText user notice uses UTF8String instead of VisibleString to reduce the risk of emitting certificates with invalid DER-encoding. * Bug fixes - - Correctly reduce negative input to BN_mod_exp2_mont(). + - Correctly handle negative input to various BIGNUM functions. - Ensure ERR_load_ERR_strings() does not set errno unexpectedly. - Fix error checking of i2d_ECDSA_SIG() in ossl_ecdsa_sign(). - Fixed detection of extended operations (XOP) on AMD hardware. - Ensure Montgomery exponentiation is used for the initial RSA blinding. - Policy is always checked in X509 validation. Critical policy extensions are no longer silently ignored. + - Fixed error handling in tls_check_common_name(). * Documentation improvements - Improved documentation of BIO_ctrl(3), BIO_set_info_callback(3), BIO_get_info_callback(3), BIO_method_type(3), and BIO_method_name(3). From 07f8b2f6c9a14b4644660abbf9b559fff285420a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 10 May 2023 03:16:19 -0600 Subject: [PATCH 0287/1283] switch cvsweb links to https --- ChangeLog | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index ec6e072975..b77c7ce3ad 100644 --- a/ChangeLog +++ b/ChangeLog @@ -3,16 +3,16 @@ Git, it can be confusing following all of the changes. Most of the libssl and libcrypto source code is is here in OpenBSD CVS: - http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/ + https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/ Some of the libcrypto and OS-compatibility files for entropy and random number generation are here: - http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libcrypto/ + https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libcrypto/ A simplified TLS wrapper library is here: - http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libtls/ + https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libtls/ The LibreSSL Portable project copies these portions of the OpenBSD tree, along with relevant portions of the C library, to a Git repository. This makes it From c450eaff50ad806322de5c91c246ede3eace02a3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 10 May 2023 07:05:47 -0600 Subject: [PATCH 0288/1283] Modernize the compat with OpenSSL paragraph a bit This is a bit vague and may leave a lot of room for improvement, but it's at least not factually incorrect. ok joshua jsing --- README.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index f4015a1dc1..0209b24099 100644 --- a/README.md +++ b/README.md @@ -14,9 +14,12 @@ improve security, and apply best practice development processes from OpenBSD. ## Compatibility with OpenSSL: ## -LibreSSL is API compatible with OpenSSL 1.0.1, but does not yet include all -new APIs from OpenSSL 1.0.2 and later. LibreSSL also includes APIs not yet -present in OpenSSL. The current common API subset is OpenSSL 1.0.1. +LibreSSL provides much of the OpenSSL 1.1 API. The OpenSSL 3 API is not currently +supported. Incompatibilities between the projects exist and are unavoidable since +both evolve with different goals and priorities. Important incompatibilities will +be addressed if possible and as long as they are not too detrimental to LibreSSL's +goals of simplicity, security and sanity. We do not add new features, ciphers and +API without a solid reason and require that new code be clean and of high quality. LibreSSL is not ABI compatible with any release of OpenSSL, or necessarily earlier releases of LibreSSL. You will need to relink your programs to From 72ef4d3c779a825b80d3eae63833f5e13df639cd Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 10 May 2023 11:23:06 -0600 Subject: [PATCH 0289/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index b77c7ce3ad..8c18e99a19 100644 --- a/ChangeLog +++ b/ChangeLog @@ -48,6 +48,8 @@ LibreSSL Portable Release Notes: - Converted more of libcrypto to use CBB/CBS. * New features - Added support for truncated SHA-2 and for SHA-3. + - The BPSW primality test performs additional Miller-Rabin rounds + with random bases to reduce the likelihood of composites passing. * Compatibility changes - Support for GF2m was removed: BIGNUM no longer supports binary extension field arithmetic and all binary elliptic builtin curves were removed. From 89fee1252f2284039d6a089f172b6acc72747229 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 12 May 2023 02:34:22 -0600 Subject: [PATCH 0290/1283] Link asn1oct test to the build --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 4c38a7ded0..991fb01cb8 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -80,6 +80,11 @@ add_executable(asn1object asn1object.c) target_link_libraries(asn1object ${OPENSSL_TEST_LIBS}) add_test(asn1object asn1object) +# asn1oct +add_executable(asn1oct asn1oct.c) +target_link_libraries(asn1oct ${OPENSSL_TEST_LIBS}) +add_test(asn1oct asn1oct) + # asn1string_copy add_executable(asn1string_copy asn1string_copy.c) target_link_libraries(asn1string_copy ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index b17f1ef48c..71037d8e20 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -102,6 +102,11 @@ TESTS += asn1object check_PROGRAMS += asn1object asn1object_SOURCES = asn1object.c +# asn1oct +TESTS += asn1oct +check_PROGRAMS += asn1oct +asn1oct_SOURCES = asn1oct.c + # asn1string_copy TESTS += asn1string_copy check_PROGRAMS += asn1string_copy From 0cb69d68ee84987861f99a7ad7d0bb018ebc0002 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 17 May 2023 06:41:47 -0600 Subject: [PATCH 0291/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 8c18e99a19..f1d6d36114 100644 --- a/ChangeLog +++ b/ChangeLog @@ -73,6 +73,8 @@ LibreSSL Portable Release Notes: - Policy is always checked in X509 validation. Critical policy extensions are no longer silently ignored. - Fixed error handling in tls_check_common_name(). + - Add missing pointer invalidation in SSL_free(). + - Fixed X509error() and X509V3error(). * Documentation improvements - Improved documentation of BIO_ctrl(3), BIO_set_info_callback(3), BIO_get_info_callback(3), BIO_method_type(3), and BIO_method_name(3). From 765a8fac94fece34cead0bd03f89bdb1b8c43da6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 17 May 2023 16:49:25 +0200 Subject: [PATCH 0292/1283] endian.h: Use POSIX names instead old BSD names --- include/compat/endian.h | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/include/compat/endian.h b/include/compat/endian.h index ca3465dbe0..d9f7eb2af7 100644 --- a/include/compat/endian.h +++ b/include/compat/endian.h @@ -50,24 +50,24 @@ #if defined(__APPLE__) && !defined(HAVE_ENDIAN_H) #include -#define betoh16(x) OSSwapBigToHostInt16((x)) +#define be16toh(x) OSSwapBigToHostInt16((x)) #define htobe16(x) OSSwapHostToBigInt16((x)) -#define betoh32(x) OSSwapBigToHostInt32((x)) +#define be32toh(x) OSSwapBigToHostInt32((x)) #define htobe32(x) OSSwapHostToBigInt32(x) #define htole64(x) OSSwapHostToLittleInt64(x) #define htobe64(x) OSSwapHostToBigInt64(x) -#define letoh64(x) OSSwapLittleToHostInt64(x) -#define betoh64(x) OSSwapBigToHostInt64(x) +#define le64toh(x) OSSwapLittleToHostInt64(x) +#define be64toh(x) OSSwapBigToHostInt64(x) #endif /* __APPLE__ && !HAVE_ENDIAN_H */ #if defined(_WIN32) && !defined(HAVE_ENDIAN_H) #include -#define betoh16(x) ntohs((x)) +#define be16toh(x) ntohs((x)) #define htobe16(x) htons((x)) -#define betoh32(x) ntohl((x)) +#define be32toh(x) ntohl((x)) #define htobe32(x) ntohl((x)) -#define betoh64(x) ntohll((x)) +#define be64toh(x) ntohll((x)) #if !defined(ntohll) #define ntohll(x) ((1==htonl(1)) ? (x) : ((uint64_t)ntohl((x) & 0xFFFFFFFF) << 32) | ntohl((x) >> 32)) From 28f30570ea733f36e9f7fb6ec40fca1837e90f7c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 17 May 2023 17:05:16 +0200 Subject: [PATCH 0293/1283] Add asn1oct test to .gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index d6b9276e2f..2f30f7433e 100644 --- a/.gitignore +++ b/.gitignore @@ -70,6 +70,7 @@ tests/asn1basic* tests/asn1complex* tests/asn1evp* tests/asn1object* +tests/asn1oct* tests/asn1string_copy* tests/asn1_string_to_utf8* tests/asn1time* From 35368ffce8493c82155fac2eff9fe2eaab6473e8 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 21 May 2023 11:50:57 -0600 Subject: [PATCH 0294/1283] Update ChangeLog --- ChangeLog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index f1d6d36114..d62bb2557d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -50,6 +50,8 @@ LibreSSL Portable Release Notes: - Added support for truncated SHA-2 and for SHA-3. - The BPSW primality test performs additional Miller-Rabin rounds with random bases to reduce the likelihood of composites passing. + - Allow testing of ciphers and digests using badly aligned buffers + in openssl speed. * Compatibility changes - Support for GF2m was removed: BIGNUM no longer supports binary extension field arithmetic and all binary elliptic builtin curves were removed. @@ -64,6 +66,8 @@ LibreSSL Portable Release Notes: - The POLICY_TREE and its related structures and API were removed. - The explicitText user notice uses UTF8String instead of VisibleString to reduce the risk of emitting certificates with invalid DER-encoding. + - Initial fixes for RSA-PSS suport to make the TLSv1.3 stack more compliant + with RFC 8446. * Bug fixes - Correctly handle negative input to various BIGNUM functions. - Ensure ERR_load_ERR_strings() does not set errno unexpectedly. From 4adafb2616ef31b184869266f013d74fe663c673 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 21 May 2023 20:08:13 +0200 Subject: [PATCH 0295/1283] ChangeLog: fix typo and line wrapping --- ChangeLog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index d62bb2557d..359a17eb95 100644 --- a/ChangeLog +++ b/ChangeLog @@ -66,8 +66,8 @@ LibreSSL Portable Release Notes: - The POLICY_TREE and its related structures and API were removed. - The explicitText user notice uses UTF8String instead of VisibleString to reduce the risk of emitting certificates with invalid DER-encoding. - - Initial fixes for RSA-PSS suport to make the TLSv1.3 stack more compliant - with RFC 8446. + - Initial fixes for RSA-PSS support to make the TLSv1.3 stack more + compliant with RFC 8446. * Bug fixes - Correctly handle negative input to various BIGNUM functions. - Ensure ERR_load_ERR_strings() does not set errno unexpectedly. From d5556b47c745903bab69ef7a7c411b346851ac78 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 21 May 2023 12:18:07 -0600 Subject: [PATCH 0296/1283] Regen speed.c diff --- patches/speed.c.patch | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/patches/speed.c.patch b/patches/speed.c.patch index 87a06bc43a..fadb3df78d 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -1,6 +1,6 @@ ---- apps/openssl/speed.c.orig Tue Nov 22 17:32:11 2022 -+++ apps/openssl/speed.c Tue Nov 22 18:33:13 2022 -@@ -159,7 +159,16 @@ static void +--- apps/openssl/speed.c.orig Sun May 21 12:13:46 2023 ++++ apps/openssl/speed.c Sun May 21 12:15:49 2023 +@@ -161,7 +161,16 @@ static void pkey_print_message(const char *str, const char *str2, long num, int bits, int sec); static void print_result(int alg, int run_no, int count, double time_used); @@ -17,7 +17,7 @@ #define ALGOR_NUM 32 #define SIZE_NUM 5 -@@ -466,8 +475,10 @@ speed_main(int argc, char **argv) +@@ -431,8 +440,10 @@ speed_main(int argc, char **argv) const EVP_CIPHER *evp_cipher = NULL; const EVP_MD *evp_md = NULL; int decrypt = 0; @@ -28,33 +28,33 @@ if (pledge("stdio proc", NULL) == -1) { perror("pledge"); -@@ -542,6 +553,7 @@ speed_main(int argc, char **argv) +@@ -506,6 +517,7 @@ speed_main(int argc, char **argv) + decrypt = 1; j--; /* Otherwise, -decrypt gets confused with an * algorithm. */ - } +#ifndef _WIN32 - else if ((argc > 0) && (strcmp(*argv, "-multi") == 0)) { + } else if (argc > 0 && strcmp(*argv, "-multi") == 0) { argc--; argv++; -@@ -557,6 +569,7 @@ speed_main(int argc, char **argv) +@@ -520,6 +532,7 @@ speed_main(int argc, char **argv) + } j--; /* Otherwise, -multi gets confused with an * algorithm. */ - } +#endif - else if (argc > 0 && !strcmp(*argv, "-mr")) { - mr = 1; - j--; /* Otherwise, -mr gets confused with an -@@ -919,7 +932,9 @@ speed_main(int argc, char **argv) + } else if (argc > 0 && strcmp(*argv, "-unaligned") == 0) { + argc--; + argv++; +@@ -855,7 +868,9 @@ speed_main(int argc, char **argv) BIO_printf(bio_err, "-evp e use EVP e.\n"); BIO_printf(bio_err, "-decrypt time decryption instead of encryption (only EVP).\n"); BIO_printf(bio_err, "-mr produce machine readable output.\n"); +#ifndef _WIN32 BIO_printf(bio_err, "-multi n run n benchmarks in parallel.\n"); +#endif + BIO_printf(bio_err, "-unaligned n use buffers with offset n from proper alignment.\n"); goto end; } - argc--; -@@ -927,8 +942,10 @@ speed_main(int argc, char **argv) +@@ -864,8 +879,10 @@ speed_main(int argc, char **argv) j++; } @@ -65,7 +65,7 @@ if (j == 0) { for (i = 0; i < ALGOR_NUM; i++) { -@@ -1805,7 +1822,9 @@ speed_main(int argc, char **argv) +@@ -1742,7 +1759,9 @@ speed_main(int argc, char **argv) ecdh_doit[j] = 0; } } @@ -75,7 +75,7 @@ if (!mr) { fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION)); fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON)); -@@ -1978,11 +1997,15 @@ pkey_print_message(const char *str, const char *str2, +@@ -1915,11 +1934,15 @@ pkey_print_message(const char *str, const char *str2, static void print_result(int alg, int run_no, int count, double time_used) { @@ -91,7 +91,7 @@ static char * sstrsep(char **string, const char *delim) { -@@ -2189,4 +2212,5 @@ do_multi(int multi) +@@ -2126,4 +2149,5 @@ do_multi(int multi) free(fds); return 1; } From 564ef7e293825830e632ad6f00b9ab2f554a904c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 21 May 2023 12:32:28 -0600 Subject: [PATCH 0297/1283] speed.c: move errstr out of #ifndef --- patches/speed.c.patch | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/patches/speed.c.patch b/patches/speed.c.patch index fadb3df78d..3baf9f2146 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -1,5 +1,5 @@ --- apps/openssl/speed.c.orig Sun May 21 12:13:46 2023 -+++ apps/openssl/speed.c Sun May 21 12:15:49 2023 ++++ apps/openssl/speed.c Sun May 21 12:31:50 2023 @@ -161,7 +161,16 @@ static void pkey_print_message(const char *str, const char *str2, long num, int bits, int sec); @@ -17,17 +17,16 @@ #define ALGOR_NUM 32 #define SIZE_NUM 5 -@@ -431,8 +440,10 @@ speed_main(int argc, char **argv) +@@ -431,7 +440,9 @@ speed_main(int argc, char **argv) const EVP_CIPHER *evp_cipher = NULL; const EVP_MD *evp_md = NULL; int decrypt = 0; +#ifndef _WIN32 int multi = 0; - const char *errstr = NULL; +#endif + const char *errstr = NULL; if (pledge("stdio proc", NULL) == -1) { - perror("pledge"); @@ -506,6 +517,7 @@ speed_main(int argc, char **argv) decrypt = 1; j--; /* Otherwise, -decrypt gets confused with an From 0f48dbcb93c7ac0af3375d9eb7e16d915a07a61a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 23 May 2023 14:08:27 -0600 Subject: [PATCH 0298/1283] Update ChangeLog --- ChangeLog | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 359a17eb95..c6eaaa8232 100644 --- a/ChangeLog +++ b/ChangeLog @@ -78,7 +78,8 @@ LibreSSL Portable Release Notes: are no longer silently ignored. - Fixed error handling in tls_check_common_name(). - Add missing pointer invalidation in SSL_free(). - - Fixed X509error() and X509V3error(). + - Fixed X509err() and X509V3err() and their internal versions. + - Ensure that OBJ_obj2txt() always returns a C string again. * Documentation improvements - Improved documentation of BIO_ctrl(3), BIO_set_info_callback(3), BIO_get_info_callback(3), BIO_method_type(3), and BIO_method_name(3). From b4b1e6762003b30b8f3387c8c0fe509e736ceeca Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 24 May 2023 03:38:27 -0600 Subject: [PATCH 0299/1283] Link ssl_verify_param test to build --- .gitignore | 1 + tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 3 files changed, 11 insertions(+) diff --git a/.gitignore b/.gitignore index 2f30f7433e..1e01631ea3 100644 --- a/.gitignore +++ b/.gitignore @@ -114,6 +114,7 @@ tests/rfc5280time* tests/ssl_get_shared_ciphers* tests/ssl_methods* tests/ssl_set_alpn_protos* +tests/ssl_verify_param* tests/ssl_versions* tests/string_table* tests/timingsafe* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 991fb01cb8..7e730e3521 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -625,6 +625,11 @@ add_executable(ssl_set_alpn_protos ssl_set_alpn_protos.c) target_link_libraries(ssl_set_alpn_protos ${OPENSSL_TEST_LIBS}) add_test(ssl_set_alpn_protos ssl_set_alpn_protos) +# ssl_verify_param +add_executable(ssl_verify_param ssl_verify_param.c) +target_link_libraries(ssl_verify_param ${OPENSSL_TEST_LIBS}) +add_test(ssl_verify_param ssl_verify_param) + # ssl_versions add_executable(ssl_versions ssl_versions.c) target_link_libraries(ssl_versions ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 71037d8e20..6c257c0421 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -653,6 +653,11 @@ TESTS += ssl_set_alpn_protos check_PROGRAMS += ssl_set_alpn_protos ssl_set_alpn_protos_SOURCES = ssl_set_alpn_protos.c +# ssl_verify_param +TESTS += ssl_verify_param +check_PROGRAMS += ssl_verify_param +ssl_verify_param_SOURCES = ssl_verify_param.c + # ssl_versions TESTS += ssl_versions check_PROGRAMS += ssl_versions From 8801e1d04026ba478328050cc193ed219214add8 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 24 May 2023 03:39:37 -0600 Subject: [PATCH 0300/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index c6eaaa8232..8715b78a38 100644 --- a/ChangeLog +++ b/ChangeLog @@ -80,6 +80,8 @@ LibreSSL Portable Release Notes: - Add missing pointer invalidation in SSL_free(). - Fixed X509err() and X509V3err() and their internal versions. - Ensure that OBJ_obj2txt() always returns a C string again. + - In X509_VERIFY_PARAM_inherit() copy hostflags independently of the + host list. * Documentation improvements - Improved documentation of BIO_ctrl(3), BIO_set_info_callback(3), BIO_get_info_callback(3), BIO_method_type(3), and BIO_method_name(3). From 76d053c3a82410df38ad39965094768fae883928 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 25 May 2023 01:59:08 -0600 Subject: [PATCH 0301/1283] Update ChangeLog --- ChangeLog | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 8715b78a38..6f35e48151 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,7 +28,7 @@ history is also available from Git. LibreSSL Portable Release Notes: -3.8.0 - In development +3.8.0 - Development release * Portable changes - Extended the endian.h compat header with htobe* and betoh* macros. @@ -46,12 +46,15 @@ LibreSSL Portable Release Notes: - Imported RFC 5280 policy checking code from BoringSSL and used it to replace the old exponential time code. - Converted more of libcrypto to use CBB/CBS. + - Cleaned up and simplified the code dealing with builtin curves. * New features - Added support for truncated SHA-2 and for SHA-3. - The BPSW primality test performs additional Miller-Rabin rounds with random bases to reduce the likelihood of composites passing. - Allow testing of ciphers and digests using badly aligned buffers in openssl speed. + - Added a workaround for a poorly thought-out change in OpenSSL 3 that + broke privilege separation support in libtls. * Compatibility changes - Support for GF2m was removed: BIGNUM no longer supports binary extension field arithmetic and all binary elliptic builtin curves were removed. From 05e287fefcb6dca05117ed471ac08701d621fd6b Mon Sep 17 00:00:00 2001 From: Joel Sing Date: Fri, 26 May 2023 16:44:59 +1000 Subject: [PATCH 0302/1283] Minor tweaks to ChangeLog --- ChangeLog | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index 6f35e48151..fc453d0e99 100644 --- a/ChangeLog +++ b/ChangeLog @@ -31,16 +31,16 @@ LibreSSL Portable Release Notes: 3.8.0 - Development release * Portable changes - - Extended the endian.h compat header with htobe* and betoh* macros. + - Extended the endian.h compat header with hto* and *toh macros. - Adapted more tests to the portable framework. * Internal improvements - Improved sieve of Eratosthenes script used for generating a table of small primes. - - Cleaned up and rewrote SHA internals. + - Started cleaning up and rewriting SHA internals. - Replace internal use of BN_copy() with bn_copy() for consistency. - Rewrote and improved BN_exp() and BN_copy(). - Add branch target information (BTI) support to arm64 assembly. - - Added a new implementation of BN_mod_sqrt(). + - Replaced BN_mod_sqrt() with a new implementation. - Removed incomplete and dangerous BN_RECURSION code. - Added endbr64 instructions to amd64 assembly. - Imported RFC 5280 policy checking code from BoringSSL and used it @@ -61,7 +61,7 @@ LibreSSL Portable Release Notes: - Removed dangerous, "fast" NIST prime and elliptic curve implementations. In particular, EC_GFp_nist_method() is no longer available. - Removed most public symbols that were deprecated in OpenSSL 0.9.8. - - The public X9.31 API was removed. RSA_X931_PADDING is still available. + - Removed the public X9.31 API (RSA_X931_PADDING is still available). - Removed Cipher Text Stealing mode. - Removed SXNET and NETSCAPE_CERT_SEQUENCE support including the openssl(1) nseq command. From 419fbd6fba15beaea3f3e6d22ef9e161f032f460 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 26 May 2023 21:51:56 -0500 Subject: [PATCH 0303/1283] fix asm on x86_64 macos --- CMakeLists.txt | 2 +- configure.ac | 2 +- update.sh | 9 +++++++++ 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index e05221c316..7847830a1e 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -344,7 +344,7 @@ if(ENABLE_ASM) endif() add_definitions(-DHAVE_GNU_STACK) elseif(APPLE AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "x86_64") - set(ENABLE_ASM false) + set(HOST_ASM_MACOSX_X86_64 true) elseif(MSVC AND ("${CMAKE_GENERATOR}" MATCHES "Win64" OR "${CMAKE_GENERATOR_PLATFORM}" STREQUAL "x64")) set(HOST_ASM_MASM_X86_64 true) ENABLE_LANGUAGE(ASM_MASM) diff --git a/configure.ac b/configure.ac index 6fe2ff426a..51e096bd90 100644 --- a/configure.ac +++ b/configure.ac @@ -122,7 +122,7 @@ AM_CONDITIONAL([HOST_ASM_ELF_MIPS64], AM_CONDITIONAL([HOST_ASM_ELF_X86_64], [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "x86_64" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_MACOSX_X86_64], - [test "x$HOST_ABI" = "xmacosx" -a "$host_cpu" = "x86_64" -a "x$enable_asm" == "xenabled"]) + [test "x$HOST_ABI" = "xmacosx" -a "$host_cpu" = "x86_64" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_MASM_X86_64], [test "x$HOST_ABI" = "xmasm" -a "$host_cpu" = "x86_64" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_MINGW64_X86_64], diff --git a/update.sh b/update.sh index d42cd5867c..abf2097be1 100755 --- a/update.sh +++ b/update.sh @@ -194,6 +194,11 @@ fixup_masm() { > $2 } +fixup_macosx() { + echo Fixing up $2 + sed -e 's/endbr64//' $1 > $2 +} + # generate assembly crypto algorithms asm_src=$libcrypto_src gen_asm_stdout() { @@ -205,6 +210,8 @@ gen_asm_stdout() { EOF if [ $1 = "masm" ]; then fixup_masm crypto/$3.tmp crypto/$3 + elif [ $1 = "macosx" ]; then + fixup_macosx crypto/$3.tmp crypto/$3 else $MV crypto/$3.tmp crypto/$3 fi @@ -231,6 +238,8 @@ gen_asm() { EOF if [ $1 = "masm" ]; then fixup_masm crypto/$3.tmp crypto/$3 + elif [ $1 = "macosx" ]; then + fixup_macosx crypto/$3.tmp crypto/$3 else $MV crypto/$3.tmp crypto/$3 fi From f8ced390cd47811bc7d3447aead5d4a11816403f Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 18 Dec 2022 21:39:58 -0600 Subject: [PATCH 0304/1283] fix dangling whitespace when building object list breaks latest macOS linker to have a directory in the object list --- tls/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tls/Makefile.am b/tls/Makefile.am index 9b62b2231e..d5725c362a 100644 --- a/tls/Makefile.am +++ b/tls/Makefile.am @@ -16,7 +16,7 @@ EXTRA_libtls_la_DEPENDENCIES = libtls_la_objects.mk libtls_la_objects.mk: Makefile @echo "libtls_la_objects= $(libtls_la_OBJECTS)" \ - | sed 's/ */ $$\(abs_top_builddir\)\/tls\//g' \ + | sed -e 's/ *$$//' -e 's/ */ $$\(abs_top_builddir\)\/tls\//g' \ > libtls_la_objects.mk libtls_la_LDFLAGS = -version-info @LIBTLS_VERSION@ -no-undefined -export-symbols $(top_srcdir)/tls/tls.sym From a316f8ab8cf79895062c1d1fcc5d47c3d2cc6f6a Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 18 Dec 2022 22:10:11 -0600 Subject: [PATCH 0305/1283] link internal apps statically --- apps/nc/Makefile.am | 11 +++++++---- apps/ocspcheck/Makefile.am | 12 +++++++++--- apps/openssl/Makefile.am | 9 +++++++-- 3 files changed, 23 insertions(+), 9 deletions(-) diff --git a/apps/nc/Makefile.am b/apps/nc/Makefile.am index e9db6e592b..aba306ed3b 100644 --- a/apps/nc/Makefile.am +++ b/apps/nc/Makefile.am @@ -1,6 +1,8 @@ include $(top_srcdir)/Makefile.am.common -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk +-include $(abs_top_builddir)/ssl/libssl_la_objects.mk +-include $(abs_top_builddir)/tls/libtls_la_objects.mk if BUILD_NC @@ -14,12 +16,13 @@ endif EXTRA_DIST = nc.1 EXTRA_DIST += CMakeLists.txt -nc_LDADD = $(abs_top_builddir)/tls/libtls.la -nc_LDADD += $(PLATFORM_LDADD) $(PROG_LDADD) - -nc_LDADD += $(libcrypto_la_objects) +nc_LDADD = $(libcrypto_la_objects) nc_LDADD += $(libcompat_la_objects) nc_LDADD += $(libcompatnoopt_la_objects) +nc_LDADD += $(libssl_la_objects) +nc_LDADD += $(libtls_la_objects) + +nc_LDADD += $(PLATFORM_LDADD) $(PROG_LDADD) AM_CPPFLAGS += -I$(top_srcdir)/apps/nc/compat diff --git a/apps/ocspcheck/Makefile.am b/apps/ocspcheck/Makefile.am index 7c7b454313..e6f3c5436b 100644 --- a/apps/ocspcheck/Makefile.am +++ b/apps/ocspcheck/Makefile.am @@ -1,5 +1,9 @@ include $(top_srcdir)/Makefile.am.common +-include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk +-include $(abs_top_builddir)/ssl/libssl_la_objects.mk +-include $(abs_top_builddir)/tls/libtls_la_objects.mk + if !ENABLE_LIBTLS_ONLY bin_PROGRAMS = ocspcheck dist_man_MANS = ocspcheck.8 @@ -10,9 +14,11 @@ endif EXTRA_DIST = ocspcheck.8 EXTRA_DIST += CMakeLists.txt -ocspcheck_LDADD = $(abs_top_builddir)/crypto/libcrypto.la -ocspcheck_LDADD += $(abs_top_builddir)/ssl/libssl.la -ocspcheck_LDADD += $(abs_top_builddir)/tls/libtls.la +ocspcheck_LDADD = $(libcrypto_la_objects) +ocspcheck_LDADD += $(libcompat_la_objects) +ocspcheck_LDADD += $(libcompatnoopt_la_objects) +ocspcheck_LDADD += $(libssl_la_objects) +ocspcheck_LDADD += $(libtls_la_objects) ocspcheck_LDADD += $(PLATFORM_LDADD) $(PROG_LDADD) ocspcheck_SOURCES = http.c diff --git a/apps/openssl/Makefile.am b/apps/openssl/Makefile.am index 064975bb85..2567ef0407 100644 --- a/apps/openssl/Makefile.am +++ b/apps/openssl/Makefile.am @@ -1,5 +1,8 @@ include $(top_srcdir)/Makefile.am.common +-include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk +-include $(abs_top_builddir)/ssl/libssl_la_objects.mk + if !ENABLE_LIBTLS_ONLY bin_PROGRAMS = openssl dist_man_MANS = openssl.1 @@ -7,8 +10,10 @@ else noinst_PROGRAMS = openssl endif -openssl_LDADD = $(abs_top_builddir)/ssl/libssl.la -openssl_LDADD += $(abs_top_builddir)/crypto/libcrypto.la +openssl_LDADD = $(libcrypto_la_objects) +openssl_LDADD += $(libcompat_la_objects) +openssl_LDADD += $(libcompatnoopt_la_objects) +openssl_LDADD += $(libssl_la_objects) openssl_LDADD += $(PLATFORM_LDADD) $(PROG_LDADD) openssl_SOURCES = apps.c From 605328314f266e01c4b670addcb2e5a2991d2f49 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 28 Feb 2023 08:34:08 -0600 Subject: [PATCH 0306/1283] make it simpler to test on a non-Linux system --- scripts/test | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/scripts/test b/scripts/test index 66c4f54ffb..f1fdd83d39 100755 --- a/scripts/test +++ b/scripts/test @@ -1,11 +1,11 @@ #!/bin/sh set -e +set -x unset CC ENABLE_ASM="${ENABLE_ASM:=ON}" -if type apt-get >/dev/null -then +if type apt-get >/dev/null 2>&1; then sudo apt-get update sudo apt-get install -y cmake ninja-build fi @@ -53,7 +53,9 @@ elif [ "x$ARCH" = "xmingw32" -o "x$ARCH" = "xmingw64" ]; then CPU=x86_64 fi - sudo apt-get install -y mingw-w64 + if ! type i686-w64-mingw32-gcc > /dev/null; then + sudo apt-get install -y mingw-w64 + fi ./configure --host=$CPU-w64-mingw32 make -j 4 From 54b31ce5ec82248bba32f1a7c49e66e088cb1807 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 28 Feb 2023 08:34:39 -0600 Subject: [PATCH 0307/1283] unexport internal compat symbols from libcrypto --- crypto/Makefile.am | 66 ---------------------------------------------- ssl/Makefile.am | 4 +++ 2 files changed, 4 insertions(+), 66 deletions(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 8fcd4f73be..b113850fba 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -45,73 +45,7 @@ crypto_portable.sym: crypto.sym Makefile -echo "generating crypto_portable.sym ..." -cp $(top_srcdir)/crypto/crypto.sym crypto_portable.sym -chmod u+w crypto_portable.sym -if !HAVE_ARC4RANDOM_BUF - -echo arc4random >> crypto_portable.sym - -echo arc4random_buf >> crypto_portable.sym - -echo arc4random_uniform >> crypto_portable.sym -if !HAVE_GETENTROPY - -echo getentropy >> crypto_portable.sym -endif -endif -if !HAVE_ASPRINTF - -echo asprintf >> crypto_portable.sym - -echo vasprintf >> crypto_portable.sym -endif -if !HAVE_EXPLICIT_BZERO - -echo explicit_bzero >> crypto_portable.sym -endif -if !HAVE_FREEZERO - -echo freezero >> crypto_portable.sym -endif -if !HAVE_REALLOCARRAY - -echo reallocarray >> crypto_portable.sym -endif -if !HAVE_RECALLOCARRAY - -echo recallocarray >> crypto_portable.sym -endif -if !HAVE_STRLCAT - -echo strlcat >> crypto_portable.sym -endif -if !HAVE_STRLCPY - -echo strlcpy >> crypto_portable.sym -endif -if !HAVE_STRNDUP - -echo strndup >> crypto_portable.sym -endif -if !HAVE_STRNLEN - -echo strnlen >> crypto_portable.sym -endif -if !HAVE_STRSEP - -echo strsep >> crypto_portable.sym -endif -if !HAVE_STRTONUM - -echo strtonum >> crypto_portable.sym -endif -if !HAVE_TIMEGM - -echo timegm >> crypto_portable.sym -endif -if !HAVE_TIMINGSAFE_BCMP - -echo timingsafe_bcmp >> crypto_portable.sym -endif -if !HAVE_TIMINGSAFE_MEMCMP - -echo timingsafe_memcmp >> crypto_portable.sym -endif -if HOST_CPU_IS_INTEL - -echo OPENSSL_ia32cap_P >> crypto_portable.sym -endif if HOST_WIN - -echo posix_perror >> crypto_portable.sym - -echo posix_fopen >> crypto_portable.sym - -echo posix_fgets >> crypto_portable.sym - -echo posix_open >> crypto_portable.sym - -echo posix_rename >> crypto_portable.sym - -echo posix_connect >> crypto_portable.sym - -echo posix_close >> crypto_portable.sym - -echo posix_read >> crypto_portable.sym - -echo posix_write >> crypto_portable.sym - -echo posix_getsockopt >> crypto_portable.sym - -echo posix_setsockopt >> crypto_portable.sym - -echo getuid >> crypto_portable.sym -grep -v BIO_s_log crypto_portable.sym > crypto_portable.sym.tmp -mv crypto_portable.sym.tmp crypto_portable.sym endif diff --git a/ssl/Makefile.am b/ssl/Makefile.am index d27e2af835..002a26674a 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -1,5 +1,7 @@ include $(top_srcdir)/Makefile.am.common +-include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk + AM_CPPFLAGS += -I$(top_srcdir)/crypto/bio noinst_LTLIBRARIES = libbs.la @@ -34,6 +36,8 @@ remove_bs_objects: libssl.la libssl_la_CPPFLAGS = -I$(top_srcdir)/ssl/hidden ${AM_CPPFLAGS} libssl_la_LDFLAGS = -version-info @LIBSSL_VERSION@ -no-undefined -export-symbols $(top_srcdir)/ssl/ssl.sym libssl_la_LIBADD = $(abs_top_builddir)/crypto/libcrypto.la $(PLATFORM_LDADD) +libssl_la_LIBADD += $(libcompat_la_objects) +libssl_la_LIBADD += $(libcompatnoopt_la_objects) libssl_la_LIBADD += libbs.la libbs_la_SOURCES = bs_ber.c From e6dbcc47dcf8090a80ea0cd6ad9e867da2450102 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 26 May 2023 22:07:14 -0500 Subject: [PATCH 0308/1283] update man links --- man/links | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/man/links b/man/links index 964a7fb06f..57335121da 100644 --- a/man/links +++ b/man/links @@ -372,6 +372,26 @@ BN_BLINDING_new.3,BN_BLINDING_update.3 BN_CTX_new.3,BN_CTX_free.3 BN_CTX_start.3,BN_CTX_end.3 BN_CTX_start.3,BN_CTX_get.3 +BN_GF2m_add.3,BN_GF2m_arr2poly.3 +BN_GF2m_add.3,BN_GF2m_cmp.3 +BN_GF2m_add.3,BN_GF2m_mod.3 +BN_GF2m_add.3,BN_GF2m_mod_arr.3 +BN_GF2m_add.3,BN_GF2m_mod_div.3 +BN_GF2m_add.3,BN_GF2m_mod_div_arr.3 +BN_GF2m_add.3,BN_GF2m_mod_exp.3 +BN_GF2m_add.3,BN_GF2m_mod_exp_arr.3 +BN_GF2m_add.3,BN_GF2m_mod_inv.3 +BN_GF2m_add.3,BN_GF2m_mod_inv_arr.3 +BN_GF2m_add.3,BN_GF2m_mod_mul.3 +BN_GF2m_add.3,BN_GF2m_mod_mul_arr.3 +BN_GF2m_add.3,BN_GF2m_mod_solve_quad.3 +BN_GF2m_add.3,BN_GF2m_mod_solve_quad_arr.3 +BN_GF2m_add.3,BN_GF2m_mod_sqr.3 +BN_GF2m_add.3,BN_GF2m_mod_sqr_arr.3 +BN_GF2m_add.3,BN_GF2m_mod_sqrt.3 +BN_GF2m_add.3,BN_GF2m_mod_sqrt_arr.3 +BN_GF2m_add.3,BN_GF2m_poly2arr.3 +BN_GF2m_add.3,BN_GF2m_sub.3 BN_add.3,BN_div.3 BN_add.3,BN_exp.3 BN_add.3,BN_gcd.3 @@ -427,6 +447,10 @@ BN_generate_prime.3,BN_GENCB_set_old.3 BN_generate_prime.3,BN_generate_prime_ex.3 BN_generate_prime.3,BN_is_prime_ex.3 BN_generate_prime.3,BN_is_prime_fasttest_ex.3 +BN_get0_nist_prime_521.3,BN_get0_nist_prime_192.3 +BN_get0_nist_prime_521.3,BN_get0_nist_prime_224.3 +BN_get0_nist_prime_521.3,BN_get0_nist_prime_256.3 +BN_get0_nist_prime_521.3,BN_get0_nist_prime_384.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_copy.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_free.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_new.3 @@ -434,9 +458,19 @@ BN_mod_mul_montgomery.3,BN_MONT_CTX_set.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_set_locked.3 BN_mod_mul_montgomery.3,BN_from_montgomery.3 BN_mod_mul_montgomery.3,BN_to_montgomery.3 +BN_mod_mul_reciprocal.3,BN_RECP_CTX_free.3 +BN_mod_mul_reciprocal.3,BN_RECP_CTX_init.3 +BN_mod_mul_reciprocal.3,BN_RECP_CTX_new.3 +BN_mod_mul_reciprocal.3,BN_RECP_CTX_set.3 +BN_mod_mul_reciprocal.3,BN_div_recp.3 +BN_mod_mul_reciprocal.3,BN_reciprocal.3 BN_new.3,BN_clear.3 BN_new.3,BN_clear_free.3 BN_new.3,BN_free.3 +BN_nist_mod_521.3,BN_nist_mod_192.3 +BN_nist_mod_521.3,BN_nist_mod_224.3 +BN_nist_mod_521.3,BN_nist_mod_256.3 +BN_nist_mod_521.3,BN_nist_mod_384.3 BN_num_bytes.3,BN_num_bits.3 BN_num_bytes.3,BN_num_bits_word.3 BN_rand.3,BN_pseudo_rand.3 @@ -1575,6 +1609,9 @@ POLICYINFO_new.3,POLICY_MAPPING_free.3 POLICYINFO_new.3,POLICY_MAPPING_new.3 POLICYINFO_new.3,USERNOTICE_free.3 POLICYINFO_new.3,USERNOTICE_new.3 +PROXY_POLICY_new.3,PROXY_CERT_INFO_EXTENSION_free.3 +PROXY_POLICY_new.3,PROXY_CERT_INFO_EXTENSION_new.3 +PROXY_POLICY_new.3,PROXY_POLICY_free.3 RAND_add.3,RAND_cleanup.3 RAND_add.3,RAND_poll.3 RAND_add.3,RAND_seed.3 @@ -2000,6 +2037,13 @@ SSL_want.3,SSL_want_read.3 SSL_want.3,SSL_want_write.3 SSL_want.3,SSL_want_x509_lookup.3 SSL_write.3,SSL_write_ex.3 +SXNET_new.3,SXNETID_free.3 +SXNET_new.3,SXNETID_new.3 +SXNET_new.3,SXNET_free.3 +SXNET_new.3,d2i_SXNET.3 +SXNET_new.3,d2i_SXNETID.3 +SXNET_new.3,i2d_SXNET.3 +SXNET_new.3,i2d_SXNETID.3 TS_REQ_new.3,TS_ACCURACY_free.3 TS_REQ_new.3,TS_ACCURACY_new.3 TS_REQ_new.3,TS_MSG_IMPRINT_free.3 @@ -2420,6 +2464,14 @@ X509_new.3,X509_chain_up_ref.3 X509_new.3,X509_dup.3 X509_new.3,X509_free.3 X509_new.3,X509_up_ref.3 +X509_policy_check.3,X509_policy_tree_free.3 +X509_policy_tree_get0_policies.3,X509_policy_tree_get0_user_policies.3 +X509_policy_tree_level_count.3,X509_policy_level_get0_node.3 +X509_policy_tree_level_count.3,X509_policy_level_node_count.3 +X509_policy_tree_level_count.3,X509_policy_node_get0_parent.3 +X509_policy_tree_level_count.3,X509_policy_node_get0_policy.3 +X509_policy_tree_level_count.3,X509_policy_node_get0_qualifiers.3 +X509_policy_tree_level_count.3,X509_policy_tree_get0_level.3 X509_print_ex.3,X509_CERT_AUX_print.3 X509_print_ex.3,X509_print.3 X509_print_ex.3,X509_print_ex_fp.3 @@ -2699,6 +2751,9 @@ d2i_POLICYINFO.3,i2d_NOTICEREF.3 d2i_POLICYINFO.3,i2d_POLICYINFO.3 d2i_POLICYINFO.3,i2d_POLICYQUALINFO.3 d2i_POLICYINFO.3,i2d_USERNOTICE.3 +d2i_PROXY_POLICY.3,d2i_PROXY_CERT_INFO_EXTENSION.3 +d2i_PROXY_POLICY.3,i2d_PROXY_CERT_INFO_EXTENSION.3 +d2i_PROXY_POLICY.3,i2d_PROXY_POLICY.3 d2i_PrivateKey.3,d2i_AutoPrivateKey.3 d2i_PrivateKey.3,d2i_PrivateKey_bio.3 d2i_PrivateKey.3,d2i_PrivateKey_fp.3 From 7e69c3a6af5d7f407781a080fb526ed766394697 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 27 May 2023 07:51:18 -0600 Subject: [PATCH 0309/1283] Update ChangeLog --- ChangeLog | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/ChangeLog b/ChangeLog index fc453d0e99..f05fd3a978 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,11 +28,24 @@ history is also available from Git. LibreSSL Portable Release Notes: +3.8.1 - In development + + * Portable changes + * Internal improvements + - Fixed alignment handling in SHA512. + - Moved the verified_chain to the correct internal struct. + * New features + * Compatibility changes + * Bug fixes + * Documentation improvements + * Testing and Proactive Security + 3.8.0 - Development release * Portable changes - Extended the endian.h compat header with hto* and *toh macros. - Adapted more tests to the portable framework. + - Internal tools are now statically linked. * Internal improvements - Improved sieve of Eratosthenes script used for generating a table of small primes. @@ -95,6 +108,14 @@ LibreSSL Portable Release Notes: - As always, new test coverage is added as bugs are fixed and subsystems are cleaned up. +3.7.3 - Bug and reliability fixes + + * Bug fix + - Hostflags in the verify parameters would not propagate from an + SSL_CTX to newly created SSL. + * Reliability fix + - A double free or use after free could occur after SSL_clear(3). + 3.7.2 - Stable release * Portable changes @@ -209,6 +230,20 @@ LibreSSL Portable Release Notes: support for EVP_PKEY_ED25519, EVP_PKEY_HMAC and EVP_PKEY_X25519. Poly1305 is not currently supported via this interface. +3.6.3 - Bug and reliability fixes + + * Bug fix + - Hostflags in the verify parameters would not propagate from an + SSL_CTX to newly created SSL. + * Reliability fix + - A double free or use after free could occur after SSL_clear(3). + +3.6.2 - Security release + + * Security fix + - A malicious certificate revocation list or timestamp response token + would allow an attacker to read arbitrary memory. + 3.6.1 - Stable release * Bug fixes From 3e78c18646eb995e300694f9aac685213337da42 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 27 May 2023 08:03:15 -0600 Subject: [PATCH 0310/1283] Update man links --- man/links | 55 ------------------------------------------------------- 1 file changed, 55 deletions(-) diff --git a/man/links b/man/links index 57335121da..964a7fb06f 100644 --- a/man/links +++ b/man/links @@ -372,26 +372,6 @@ BN_BLINDING_new.3,BN_BLINDING_update.3 BN_CTX_new.3,BN_CTX_free.3 BN_CTX_start.3,BN_CTX_end.3 BN_CTX_start.3,BN_CTX_get.3 -BN_GF2m_add.3,BN_GF2m_arr2poly.3 -BN_GF2m_add.3,BN_GF2m_cmp.3 -BN_GF2m_add.3,BN_GF2m_mod.3 -BN_GF2m_add.3,BN_GF2m_mod_arr.3 -BN_GF2m_add.3,BN_GF2m_mod_div.3 -BN_GF2m_add.3,BN_GF2m_mod_div_arr.3 -BN_GF2m_add.3,BN_GF2m_mod_exp.3 -BN_GF2m_add.3,BN_GF2m_mod_exp_arr.3 -BN_GF2m_add.3,BN_GF2m_mod_inv.3 -BN_GF2m_add.3,BN_GF2m_mod_inv_arr.3 -BN_GF2m_add.3,BN_GF2m_mod_mul.3 -BN_GF2m_add.3,BN_GF2m_mod_mul_arr.3 -BN_GF2m_add.3,BN_GF2m_mod_solve_quad.3 -BN_GF2m_add.3,BN_GF2m_mod_solve_quad_arr.3 -BN_GF2m_add.3,BN_GF2m_mod_sqr.3 -BN_GF2m_add.3,BN_GF2m_mod_sqr_arr.3 -BN_GF2m_add.3,BN_GF2m_mod_sqrt.3 -BN_GF2m_add.3,BN_GF2m_mod_sqrt_arr.3 -BN_GF2m_add.3,BN_GF2m_poly2arr.3 -BN_GF2m_add.3,BN_GF2m_sub.3 BN_add.3,BN_div.3 BN_add.3,BN_exp.3 BN_add.3,BN_gcd.3 @@ -447,10 +427,6 @@ BN_generate_prime.3,BN_GENCB_set_old.3 BN_generate_prime.3,BN_generate_prime_ex.3 BN_generate_prime.3,BN_is_prime_ex.3 BN_generate_prime.3,BN_is_prime_fasttest_ex.3 -BN_get0_nist_prime_521.3,BN_get0_nist_prime_192.3 -BN_get0_nist_prime_521.3,BN_get0_nist_prime_224.3 -BN_get0_nist_prime_521.3,BN_get0_nist_prime_256.3 -BN_get0_nist_prime_521.3,BN_get0_nist_prime_384.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_copy.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_free.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_new.3 @@ -458,19 +434,9 @@ BN_mod_mul_montgomery.3,BN_MONT_CTX_set.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_set_locked.3 BN_mod_mul_montgomery.3,BN_from_montgomery.3 BN_mod_mul_montgomery.3,BN_to_montgomery.3 -BN_mod_mul_reciprocal.3,BN_RECP_CTX_free.3 -BN_mod_mul_reciprocal.3,BN_RECP_CTX_init.3 -BN_mod_mul_reciprocal.3,BN_RECP_CTX_new.3 -BN_mod_mul_reciprocal.3,BN_RECP_CTX_set.3 -BN_mod_mul_reciprocal.3,BN_div_recp.3 -BN_mod_mul_reciprocal.3,BN_reciprocal.3 BN_new.3,BN_clear.3 BN_new.3,BN_clear_free.3 BN_new.3,BN_free.3 -BN_nist_mod_521.3,BN_nist_mod_192.3 -BN_nist_mod_521.3,BN_nist_mod_224.3 -BN_nist_mod_521.3,BN_nist_mod_256.3 -BN_nist_mod_521.3,BN_nist_mod_384.3 BN_num_bytes.3,BN_num_bits.3 BN_num_bytes.3,BN_num_bits_word.3 BN_rand.3,BN_pseudo_rand.3 @@ -1609,9 +1575,6 @@ POLICYINFO_new.3,POLICY_MAPPING_free.3 POLICYINFO_new.3,POLICY_MAPPING_new.3 POLICYINFO_new.3,USERNOTICE_free.3 POLICYINFO_new.3,USERNOTICE_new.3 -PROXY_POLICY_new.3,PROXY_CERT_INFO_EXTENSION_free.3 -PROXY_POLICY_new.3,PROXY_CERT_INFO_EXTENSION_new.3 -PROXY_POLICY_new.3,PROXY_POLICY_free.3 RAND_add.3,RAND_cleanup.3 RAND_add.3,RAND_poll.3 RAND_add.3,RAND_seed.3 @@ -2037,13 +2000,6 @@ SSL_want.3,SSL_want_read.3 SSL_want.3,SSL_want_write.3 SSL_want.3,SSL_want_x509_lookup.3 SSL_write.3,SSL_write_ex.3 -SXNET_new.3,SXNETID_free.3 -SXNET_new.3,SXNETID_new.3 -SXNET_new.3,SXNET_free.3 -SXNET_new.3,d2i_SXNET.3 -SXNET_new.3,d2i_SXNETID.3 -SXNET_new.3,i2d_SXNET.3 -SXNET_new.3,i2d_SXNETID.3 TS_REQ_new.3,TS_ACCURACY_free.3 TS_REQ_new.3,TS_ACCURACY_new.3 TS_REQ_new.3,TS_MSG_IMPRINT_free.3 @@ -2464,14 +2420,6 @@ X509_new.3,X509_chain_up_ref.3 X509_new.3,X509_dup.3 X509_new.3,X509_free.3 X509_new.3,X509_up_ref.3 -X509_policy_check.3,X509_policy_tree_free.3 -X509_policy_tree_get0_policies.3,X509_policy_tree_get0_user_policies.3 -X509_policy_tree_level_count.3,X509_policy_level_get0_node.3 -X509_policy_tree_level_count.3,X509_policy_level_node_count.3 -X509_policy_tree_level_count.3,X509_policy_node_get0_parent.3 -X509_policy_tree_level_count.3,X509_policy_node_get0_policy.3 -X509_policy_tree_level_count.3,X509_policy_node_get0_qualifiers.3 -X509_policy_tree_level_count.3,X509_policy_tree_get0_level.3 X509_print_ex.3,X509_CERT_AUX_print.3 X509_print_ex.3,X509_print.3 X509_print_ex.3,X509_print_ex_fp.3 @@ -2751,9 +2699,6 @@ d2i_POLICYINFO.3,i2d_NOTICEREF.3 d2i_POLICYINFO.3,i2d_POLICYINFO.3 d2i_POLICYINFO.3,i2d_POLICYQUALINFO.3 d2i_POLICYINFO.3,i2d_USERNOTICE.3 -d2i_PROXY_POLICY.3,d2i_PROXY_CERT_INFO_EXTENSION.3 -d2i_PROXY_POLICY.3,i2d_PROXY_CERT_INFO_EXTENSION.3 -d2i_PROXY_POLICY.3,i2d_PROXY_POLICY.3 d2i_PrivateKey.3,d2i_AutoPrivateKey.3 d2i_PrivateKey.3,d2i_PrivateKey_bio.3 d2i_PrivateKey.3,d2i_PrivateKey_fp.3 From 4f93524b64cac07802334918fe9a29bf535b5f04 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 27 May 2023 23:49:56 -0600 Subject: [PATCH 0311/1283] Update patch for rust-openssl version check --- .github/rust-openssl.patch | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/rust-openssl.patch b/.github/rust-openssl.patch index ab955bec86..f62372020b 100644 --- a/.github/rust-openssl.patch +++ b/.github/rust-openssl.patch @@ -1,13 +1,13 @@ diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs -index ba149c17..5274dc44 100644 +index 1762068d..9e7295b0 100644 --- a/openssl-sys/build/main.rs +++ b/openssl-sys/build/main.rs @@ -285,7 +285,7 @@ See rust-openssl documentation for more information: (3, 7, 0) => ('3', '7', '0'), (3, 7, 1) => ('3', '7', '1'), (3, 7, _) => ('3', '7', 'x'), -- _ => version_error(), -+ _ => ('3', '7', 'x'), +- (3, 8, 0) => ('3', '8', '0'), ++ (3, 8, _) => ('3', '8', '0'), + _ => version_error(), }; - println!("cargo:libressl=true"); From 341e0bf1c305028bf6b9169c4fa10e8136b61af0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 1 Jun 2023 09:43:42 -0600 Subject: [PATCH 0312/1283] Update ChangeLog --- ChangeLog | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index f05fd3a978..7fbadc01e6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -32,12 +32,20 @@ LibreSSL Portable Release Notes: * Portable changes * Internal improvements - - Fixed alignment handling in SHA512. + - Fixed alignment handling in SHA-512. - Moved the verified_chain to the correct internal struct. + - Improved checks for commonName in libtls. + - Fixed error check for X509_get_ext_d2i() failure in libtls. + - Improved BIGNUM internals and performance on aarch64. + - Initial cleanups for SHA-256 internals. + - Converted more libcrypto internals API using CBB and CBS. * New features * Compatibility changes + - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain + valid UTF-8 without embedded NUL. * Bug fixes * Documentation improvements + - Made it very explicit that the verify_cb() should not be used. * Testing and Proactive Security 3.8.0 - Development release From 6b935ac1c027689743845df5e20322d85acb09f9 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 3 Jun 2023 15:49:08 -0600 Subject: [PATCH 0313/1283] Update ChangeLog --- ChangeLog | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 7fbadc01e6..dd64c2b6f1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,8 +34,8 @@ LibreSSL Portable Release Notes: * Internal improvements - Fixed alignment handling in SHA-512. - Moved the verified_chain to the correct internal struct. - - Improved checks for commonName in libtls. - - Fixed error check for X509_get_ext_d2i() failure in libtls. + - Improved checks for commonName in libtls. + - Fixed error check for X509_get_ext_d2i() failure in libtls. - Improved BIGNUM internals and performance on aarch64. - Initial cleanups for SHA-256 internals. - Converted more libcrypto internals API using CBB and CBS. @@ -44,6 +44,7 @@ LibreSSL Portable Release Notes: - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain valid UTF-8 without embedded NUL. * Bug fixes + - Fixed aliasing issue in BN_mod_inverse(). * Documentation improvements - Made it very explicit that the verify_cb() should not be used. * Testing and Proactive Security From d5547e52ccc8efbf89f64acb09fcace6cf00b7bd Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 3 Jun 2023 15:53:31 -0600 Subject: [PATCH 0314/1283] Link BN_mod_inverse test to build --- .gitignore | 1 + tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 3 files changed, 11 insertions(+) diff --git a/.gitignore b/.gitignore index 1e01631ea3..2289897ef6 100644 --- a/.gitignore +++ b/.gitignore @@ -87,6 +87,7 @@ tests/bn_isqrt* tests/bn_mod_exp* tests/bn_mod_exp_zero* tests/bn_mod_exp2_mont* +tests/bn_mod_inverse* tests/bn_mod_sqrt* tests/bn_mont* tests/bn_primes* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 7e730e3521..c4038e5942 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -172,6 +172,11 @@ set_source_files_properties(bn_mod_exp.c PROPERTIES COMPILE_FLAGS target_link_libraries(bn_mod_exp ${OPENSSL_TEST_LIBS}) add_test(bn_mod_exp bn_mod_exp) +# bn_mod_inverse +add_executable(bn_mod_inverse bn_mod_inverse.c) +target_link_libraries(bn_mod_inverse ${OPENSSL_TEST_LIBS}) +add_test(bn_mod_inverse bn_mod_inverse) + # bn_mod_sqrt add_executable(bn_mod_sqrt bn_mod_sqrt.c) target_link_libraries(bn_mod_sqrt ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 6c257c0421..a1e312d8dc 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -188,6 +188,11 @@ check_PROGRAMS += bn_mod_exp bn_mod_exp_CPPFLAGS = $(AM_CPPFLAGS) -ULIBRESSL_INTERNAL bn_mod_exp_SOURCES = bn_mod_exp.c +# bn_mod_inverse +TESTS += bn_mod_inverse +check_PROGRAMS += bn_mod_inverse +bn_mod_inverse_SOURCES = bn_mod_inverse.c + # bn_mod_sqrt TESTS += bn_mod_sqrt check_PROGRAMS += bn_mod_sqrt From 309455efe7ac27c32d37c807d3d28e11e29f9051 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 6 Jun 2023 11:17:16 -0600 Subject: [PATCH 0315/1283] Update ChangeLog --- ChangeLog | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index dd64c2b6f1..7188edb77c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -46,7 +46,8 @@ LibreSSL Portable Release Notes: * Bug fixes - Fixed aliasing issue in BN_mod_inverse(). * Documentation improvements - - Made it very explicit that the verify_cb() should not be used. + - Made it very explicit that the verify callback should not be used. + - Called out that the CRL lastUpdate is standardized as thisUpdate. * Testing and Proactive Security 3.8.0 - Development release From 0d7ffa52606a151046806c550c9185b85870cf8c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 9 Jun 2023 07:23:10 -0600 Subject: [PATCH 0316/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 7188edb77c..d32eb71189 100644 --- a/ChangeLog +++ b/ChangeLog @@ -49,6 +49,8 @@ LibreSSL Portable Release Notes: - Made it very explicit that the verify callback should not be used. - Called out that the CRL lastUpdate is standardized as thisUpdate. * Testing and Proactive Security + - As always, new test coverage is added as bugs are fixed and subsystems + are cleaned up. 3.8.0 - Development release From afeeb17fb9dc5ee545b43c8ae408f57814ab2497 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 11 Jun 2023 00:09:55 -0600 Subject: [PATCH 0317/1283] Remove cms_cd.c --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 49dfdf8dd8..d94997e94b 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -391,7 +391,6 @@ set( cmac/cmac.c cms/cms_asn1.c cms/cms_att.c - cms/cms_cd.c cms/cms_dd.c cms/cms_enc.c cms/cms_env.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index b113850fba..0c4586339b 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -469,7 +469,6 @@ libcrypto_la_SOURCES += cmac/cmac.c # cms libcrypto_la_SOURCES += cms/cms_asn1.c libcrypto_la_SOURCES += cms/cms_att.c -libcrypto_la_SOURCES += cms/cms_cd.c libcrypto_la_SOURCES += cms/cms_dd.c libcrypto_la_SOURCES += cms/cms_enc.c libcrypto_la_SOURCES += cms/cms_env.c From ba4fc35fb9bf2849025c6aea874e19f7c4e7ddce Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 11 Jun 2023 00:12:12 -0600 Subject: [PATCH 0318/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index d32eb71189..cc0e3299ad 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,6 +39,7 @@ LibreSSL Portable Release Notes: - Improved BIGNUM internals and performance on aarch64. - Initial cleanups for SHA-256 internals. - Converted more libcrypto internals API using CBB and CBS. + - Removed code guarded by ZLIB. * New features * Compatibility changes - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain From 0aa471fe68fc0f1c771c4509be69ea476b06b837 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 11 Jun 2023 13:16:01 -0600 Subject: [PATCH 0319/1283] ChangeLog: small wording tweak --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index cc0e3299ad..e059be56ab 100644 --- a/ChangeLog +++ b/ChangeLog @@ -37,7 +37,7 @@ LibreSSL Portable Release Notes: - Improved checks for commonName in libtls. - Fixed error check for X509_get_ext_d2i() failure in libtls. - Improved BIGNUM internals and performance on aarch64. - - Initial cleanups for SHA-256 internals. + - Initial cleanup passes for SHA-256 internals. - Converted more libcrypto internals API using CBB and CBS. - Removed code guarded by ZLIB. * New features From d7096cc3e19230c63f4ea99b46e4b2df4307ca88 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 12 Jun 2023 13:37:35 -0600 Subject: [PATCH 0320/1283] Tweak ChangeLog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index e059be56ab..d079e6fffa 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,7 +39,7 @@ LibreSSL Portable Release Notes: - Improved BIGNUM internals and performance on aarch64. - Initial cleanup passes for SHA-256 internals. - Converted more libcrypto internals API using CBB and CBS. - - Removed code guarded by ZLIB. + - Removed code guarded by #ifdef ZLIB. * New features * Compatibility changes - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain From 4e2abbea666fd47d5d01ece0b099443e9ce01152 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 15 Jun 2023 13:30:23 -0600 Subject: [PATCH 0321/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index d079e6fffa..39035c0cc6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -40,6 +40,8 @@ LibreSSL Portable Release Notes: - Initial cleanup passes for SHA-256 internals. - Converted more libcrypto internals API using CBB and CBS. - Removed code guarded by #ifdef ZLIB. + - Changed ASN1_item_sign_ctx() and ASN1_item_verify() to work with + Ed25519 and fixed a few bugs in there. * New features * Compatibility changes - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain From 8c792f98f1313fe462afd90df1780779c19d6b9d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 17 Jun 2023 13:09:58 -0600 Subject: [PATCH 0322/1283] Update ChangeLog --- ChangeLog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index 39035c0cc6..aeed49c165 100644 --- a/ChangeLog +++ b/ChangeLog @@ -37,6 +37,7 @@ LibreSSL Portable Release Notes: - Improved checks for commonName in libtls. - Fixed error check for X509_get_ext_d2i() failure in libtls. - Improved BIGNUM internals and performance on aarch64. + - Significantly improved Montgomery multiplication performance. - Initial cleanup passes for SHA-256 internals. - Converted more libcrypto internals API using CBB and CBS. - Removed code guarded by #ifdef ZLIB. @@ -48,6 +49,9 @@ LibreSSL Portable Release Notes: valid UTF-8 without embedded NUL. * Bug fixes - Fixed aliasing issue in BN_mod_inverse(). + - Made CRYPTO_get_ex_new_index() not return 0 to allow applications + to use *_{get,set}_app_data() and *_{get,set}_ex_data() alongside + each other. * Documentation improvements - Made it very explicit that the verify callback should not be used. - Called out that the CRL lastUpdate is standardized as thisUpdate. From d5204e5fe68aff449aa9464ef144c11ad9783b0b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 18 Jun 2023 08:10:53 -0600 Subject: [PATCH 0323/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index aeed49c165..3b2f1c9e65 100644 --- a/ChangeLog +++ b/ChangeLog @@ -43,6 +43,7 @@ LibreSSL Portable Release Notes: - Removed code guarded by #ifdef ZLIB. - Changed ASN1_item_sign_ctx() and ASN1_item_verify() to work with Ed25519 and fixed a few bugs in there. + - Moved libtls from ECDSA_METHOD to EC_KEY_METHOD. * New features * Compatibility changes - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain From ee0a1048b88dde6ba44b7b004c501e887daab395 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 21 Jun 2023 02:31:32 -0600 Subject: [PATCH 0324/1283] Link bn_primitives.c to the build --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index d94997e94b..03798999d1 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -363,6 +363,7 @@ set( bn/bn_mont.c bn/bn_mul.c bn/bn_prime.c + bn/bn_primitives.c bn/bn_rand.c bn/bn_recp.c bn/bn_shift.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 0c4586339b..dc244ef84d 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -365,6 +365,7 @@ libcrypto_la_SOURCES += bn/bn_mod_sqrt.c libcrypto_la_SOURCES += bn/bn_mont.c libcrypto_la_SOURCES += bn/bn_mul.c libcrypto_la_SOURCES += bn/bn_prime.c +libcrypto_la_SOURCES += bn/bn_primitives.c libcrypto_la_SOURCES += bn/bn_rand.c libcrypto_la_SOURCES += bn/bn_recp.c libcrypto_la_SOURCES += bn/bn_shift.c From bc2f9954b5bfea08de763d5a1e12e77ee97907fe Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 21 Jun 2023 02:39:32 -0600 Subject: [PATCH 0325/1283] Update ChangeLog --- ChangeLog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index 3b2f1c9e65..bec07ad7fa 100644 --- a/ChangeLog +++ b/ChangeLog @@ -44,6 +44,10 @@ LibreSSL Portable Release Notes: - Changed ASN1_item_sign_ctx() and ASN1_item_verify() to work with Ed25519 and fixed a few bugs in there. - Moved libtls from ECDSA_METHOD to EC_KEY_METHOD. + - Fixed various issues with EVP_PKEY_CTX_{new,dup}(). + - Improved X.509 certificate version checks. + - Cleaned up handling of elliptic curve cofactors. + - Made BN_num_bits() independent of bn->top. * New features * Compatibility changes - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain From 3e7f4d0aba5c08e4e938b6e9b77aeea2b83364d3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 24 Jun 2023 04:47:27 -0600 Subject: [PATCH 0326/1283] Regen patches --- patches/libcrypto.hidden.patch | 2 +- patches/openssl.c.patch | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/patches/libcrypto.hidden.patch b/patches/libcrypto.hidden.patch index a00a3dd231..f29ce831c3 100644 --- a/patches/libcrypto.hidden.patch +++ b/patches/libcrypto.hidden.patch @@ -102,7 +102,7 @@ diff -u openbsd/src/lib/libcrypto/hidden/openssl/x509v3.h crypto/hidden/openssl/ +#endif #include "crypto_namespace.h" - LCRYPTO_USED(PROXY_POLICY_new); + LCRYPTO_USED(BASIC_CONSTRAINTS_new); diff -u openbsd/src/lib/libcrypto/hidden/openssl/x509_vfy.h crypto/hidden/openssl/x509_vfy.h --- openbsd/src/lib/libcrypto/hidden/openssl/x509_vfy.h 2023-03-15 11:41:37.735995100 -0600 +++ crypto/hidden/openssl/x509_vfy.h 2023-03-15 16:49:29.300450300 -0600 diff --git a/patches/openssl.c.patch b/patches/openssl.c.patch index 7816dd07df..9b9d7f0d7e 100644 --- a/patches/openssl.c.patch +++ b/patches/openssl.c.patch @@ -1,6 +1,6 @@ ---- apps/openssl/openssl.c.orig Tue Apr 25 16:50:41 2023 -+++ apps/openssl/openssl.c Tue Apr 25 16:51:01 2023 -@@ -358,7 +358,9 @@ +--- apps/openssl/openssl.c.orig Sat Jun 17 13:06:00 2023 ++++ apps/openssl/openssl.c Sat Jun 24 04:44:55 2023 +@@ -354,7 +354,9 @@ static void openssl_startup(void) { From 2a9096debe7b1592ad51b67ca5bf71413a927dfc Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 24 Jun 2023 04:51:01 -0600 Subject: [PATCH 0327/1283] Add bn_convert test to build --- .gitignore | 1 + tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 3 files changed, 11 insertions(+) diff --git a/.gitignore b/.gitignore index 2289897ef6..a0a34d7bde 100644 --- a/.gitignore +++ b/.gitignore @@ -82,6 +82,7 @@ tests/bio_mem* tests/bnaddsub* tests/bn_add_sub* tests/bn_cmp* +tests/bn_convert* tests/bn_gcd* tests/bn_isqrt* tests/bn_mod_exp* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index c4038e5942..96981ba2c3 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -153,6 +153,11 @@ add_executable(bn_cmp bn_cmp.c) target_link_libraries(bn_cmp ${OPENSSL_TEST_LIBS}) add_test(bn_cmp bn_cmp) +# bn_convert +add_executable(bn_convert bn_convert.c) +target_link_libraries(bn_convert ${OPENSSL_TEST_LIBS}) +add_test(bn_convert bn_convert) + # bn_gcd add_executable(bn_gcd bn_cmp.c) target_link_libraries(bn_gcd ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index a1e312d8dc..3e605cf74b 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -170,6 +170,11 @@ TESTS += bn_cmp check_PROGRAMS += bn_cmp bn_cmp_SOURCES = bn_cmp.c +# bn_convert +TESTS += bn_convert +check_PROGRAMS += bn_convert +bn_convert_SOURCES = bn_convert.c + # bn_gcd TESTS += bn_gcd check_PROGRAMS += bn_gcd From c6fcebf9e3cc2c39bdbb482855b497c9d5ff762b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 24 Jun 2023 14:31:19 -0600 Subject: [PATCH 0328/1283] Update ChangeLog --- ChangeLog | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index bec07ad7fa..a24c37bb94 100644 --- a/ChangeLog +++ b/ChangeLog @@ -36,7 +36,7 @@ LibreSSL Portable Release Notes: - Moved the verified_chain to the correct internal struct. - Improved checks for commonName in libtls. - Fixed error check for X509_get_ext_d2i() failure in libtls. - - Improved BIGNUM internals and performance on aarch64. + - Improved BIGNUM internals and performance. - Significantly improved Montgomery multiplication performance. - Initial cleanup passes for SHA-256 internals. - Converted more libcrypto internals API using CBB and CBS. @@ -48,6 +48,8 @@ LibreSSL Portable Release Notes: - Improved X.509 certificate version checks. - Cleaned up handling of elliptic curve cofactors. - Made BN_num_bits() independent of bn->top. + - Rewrote and simplified bn_sqr(). + - Removed EC_GROUP precomp machinery. * New features * Compatibility changes - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain From 12769568340e4e9d423db670891575e069403334 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 25 Jun 2023 07:57:17 -0600 Subject: [PATCH 0329/1283] Update ChangeLog --- ChangeLog | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index a24c37bb94..9d1cf86add 100644 --- a/ChangeLog +++ b/ChangeLog @@ -43,17 +43,18 @@ LibreSSL Portable Release Notes: - Removed code guarded by #ifdef ZLIB. - Changed ASN1_item_sign_ctx() and ASN1_item_verify() to work with Ed25519 and fixed a few bugs in there. - - Moved libtls from ECDSA_METHOD to EC_KEY_METHOD. - Fixed various issues with EVP_PKEY_CTX_{new,dup}(). - Improved X.509 certificate version checks. - Cleaned up handling of elliptic curve cofactors. - Made BN_num_bits() independent of bn->top. - Rewrote and simplified bn_sqr(). - Removed EC_GROUP precomp machinery. + - Ensure no X.509v3 extensions appear more than once in certificates. * New features * Compatibility changes - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain valid UTF-8 without embedded NUL. + - Moved libtls from ECDSA_METHOD to EC_KEY_METHOD. * Bug fixes - Fixed aliasing issue in BN_mod_inverse(). - Made CRYPTO_get_ex_new_index() not return 0 to allow applications From 7204769b60a8602ee5389800c7a5869b5e0de6e5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 25 Jun 2023 14:06:59 -0600 Subject: [PATCH 0330/1283] ech_local.h was removed --- crypto/Makefile.am | 1 - 1 file changed, 1 deletion(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index dc244ef84d..667352f9bb 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -603,7 +603,6 @@ libcrypto_la_SOURCES += ecdh/ecdh_kdf.c libcrypto_la_SOURCES += ecdh/ech_err.c libcrypto_la_SOURCES += ecdh/ech_key.c libcrypto_la_SOURCES += ecdh/ech_lib.c -noinst_HEADERS += ecdh/ech_local.h # ecdsa libcrypto_la_SOURCES += ecdsa/ecs_asn1.c From 3bfd835ae32e840f9d0a59cfaad99ffc60abf00b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 26 Jun 2023 03:31:01 -0600 Subject: [PATCH 0331/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 9d1cf86add..882b8312ac 100644 --- a/ChangeLog +++ b/ChangeLog @@ -60,6 +60,7 @@ LibreSSL Portable Release Notes: - Made CRYPTO_get_ex_new_index() not return 0 to allow applications to use *_{get,set}_app_data() and *_{get,set}_ex_data() alongside each other. + - Made EVP_PKEY_set1_hkdf_key() fail on a NULL key. * Documentation improvements - Made it very explicit that the verify callback should not be used. - Called out that the CRL lastUpdate is standardized as thisUpdate. From 559f40996a938c8563821e0920974d3779f29c6a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 28 Jun 2023 14:25:11 -0600 Subject: [PATCH 0332/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 882b8312ac..5b03040fe0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -55,6 +55,7 @@ LibreSSL Portable Release Notes: - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain valid UTF-8 without embedded NUL. - Moved libtls from ECDSA_METHOD to EC_KEY_METHOD. + - Removed support for ECDH_METHOD and ECDSA_METHOD. * Bug fixes - Fixed aliasing issue in BN_mod_inverse(). - Made CRYPTO_get_ex_new_index() not return 0 to allow applications From 2493c4737b4bfde179ce8dc34941d832aa992167 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 2 Jul 2023 11:21:27 -0600 Subject: [PATCH 0333/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 5b03040fe0..122ee7b3f4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -50,6 +50,7 @@ LibreSSL Portable Release Notes: - Rewrote and simplified bn_sqr(). - Removed EC_GROUP precomp machinery. - Ensure no X.509v3 extensions appear more than once in certificates. + - Cleaned up various ECDH, ECDSA and EC internals. * New features * Compatibility changes - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain From 4ccf125f8899c9ec45c91560ba835d8b9ee8e4c9 Mon Sep 17 00:00:00 2001 From: Bob Beck Date: Sun, 2 Jul 2023 11:24:57 -0600 Subject: [PATCH 0334/1283] legacy disabling --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 122ee7b3f4..9a797ba175 100644 --- a/ChangeLog +++ b/ChangeLog @@ -69,6 +69,9 @@ LibreSSL Portable Release Notes: * Testing and Proactive Security - As always, new test coverage is added as bugs are fixed and subsystems are cleaned up. + * Security fixes + - Disabled TLSv1.0 and TLSv1.1 in libssl so that they may no longer + be selected for use. 3.8.0 - Development release From 11dfc90f83c260e99aed721cf0880ec427a9bb6f Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 3 Jul 2023 16:34:38 +0300 Subject: [PATCH 0335/1283] move endbr64 removal to preprocessor --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am.macosx-x86_64 | 1 + update.sh | 9 --------- 3 files changed, 2 insertions(+), 9 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 03798999d1..c978c04184 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -111,6 +111,7 @@ if(HOST_ASM_MACOSX_X86_64) bn/arch/amd64/word_clz.S bn/arch/amd64/bn_arch.c ) + add_definitions(-Dendbr64) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) add_definitions(-DVPAES_ASM) diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index b9b89cf04b..789da0aa7c 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -34,6 +34,7 @@ ASM_X86_64_MACOSX += bn/arch/amd64/bn_arch.c EXTRA_DIST += $(ASM_X86_64_MACOSX) if HOST_ASM_MACOSX_X86_64 +libcrypto_la_CPPFLAGS += -Dendbr64 libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM libcrypto_la_CPPFLAGS += -DVPAES_ASM diff --git a/update.sh b/update.sh index abf2097be1..d42cd5867c 100755 --- a/update.sh +++ b/update.sh @@ -194,11 +194,6 @@ fixup_masm() { > $2 } -fixup_macosx() { - echo Fixing up $2 - sed -e 's/endbr64//' $1 > $2 -} - # generate assembly crypto algorithms asm_src=$libcrypto_src gen_asm_stdout() { @@ -210,8 +205,6 @@ gen_asm_stdout() { EOF if [ $1 = "masm" ]; then fixup_masm crypto/$3.tmp crypto/$3 - elif [ $1 = "macosx" ]; then - fixup_macosx crypto/$3.tmp crypto/$3 else $MV crypto/$3.tmp crypto/$3 fi @@ -238,8 +231,6 @@ gen_asm() { EOF if [ $1 = "masm" ]; then fixup_masm crypto/$3.tmp crypto/$3 - elif [ $1 = "macosx" ]; then - fixup_macosx crypto/$3.tmp crypto/$3 else $MV crypto/$3.tmp crypto/$3 fi From 33b2c49c9bde6aff3f8c460e46007fd9301e1dbf Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 17 Apr 2023 10:55:52 +0200 Subject: [PATCH 0336/1283] link signertest to build --- tests/CMakeLists.txt | 20 +++++++++++++------- tests/Makefile.am | 12 +++++++----- 2 files changed, 20 insertions(+), 12 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 96981ba2c3..1828f0f626 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -595,14 +595,20 @@ add_executable(sha_test sha_test.c) target_link_libraries(sha_test ${OPENSSL_TEST_LIBS}) add_test(sha_test sha_test) -# XXX HAVE_SOCKETPAIR # signertest -# add_executable(signertest signertest.c) -# target_link_libraries(signertest ${LIBTLS_TEST_LIBS}) -# target_include_directories(signertest BEFORE PUBLIC ../tls) -# set_source_files_properties(signertest.c PROPERTIES COMPILE_FLAGS -# -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") -# add_test(signertest signertest) +if(NOT CMAKE_SYSTEM_NAME MATCHES "WindowsStore") + set(SIGNERTEST_SRC signertest.c) + check_function_exists(pipe2 HAVE_PIPE2) + if(!HAVE_PIPE2) + set(SIGNERTEST_SRC ${SIGNERTEST_SRC} compat/pipe2.c) + endif() + set_source_files_properties(signertest.c PROPERTIES COMPILE_FLAGS + -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") + add_executable(signertest ${SIGNERTEST_SRC}) + target_link_libraries(signertest ${LIBTLS_TEST_LIBS}) + target_include_directories(signertest BEFORE PUBLIC ../tls) + add_test(signertest signertest) +endif() # sm2crypttest # sm2evptest diff --git a/tests/Makefile.am b/tests/Makefile.am index 3e605cf74b..2353396dbe 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -626,12 +626,14 @@ TESTS += sha_test check_PROGRAMS += sha_test sha_test_SOURCES = sha_test.c -# XXX HAVE_SOCKETPAIR # signertest -# TESTS += signertest -# check_PROGRAMS += signertest -# signertest_CPPFLAGS = -I $(top_srcdir)/tls $(AM_CPPFLAGS) -DCERTSDIR=\"$(srcdir)\" -# signertest_SOURCES = signertest.c +TESTS += signertest +check_PROGRAMS += signertest +signertest_CPPFLAGS = -I $(top_srcdir)/tls $(AM_CPPFLAGS) -DCERTSDIR=\"$(srcdir)\" +signertest_SOURCES = signertest.c +if !HAVE_PIPE2 +signertest_SOURCES += compat/pipe2.c +endif # sm2crypttest # sm2evptest From cdb7ad475308d135ad8f3734a31c10d70c5a2299 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 3 Jul 2023 16:50:10 +0300 Subject: [PATCH 0337/1283] define endbr64 as nop --- crypto/CMakeLists.txt | 2 +- crypto/Makefile.am.macosx-x86_64 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index c978c04184..5d80541b89 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -111,7 +111,7 @@ if(HOST_ASM_MACOSX_X86_64) bn/arch/amd64/word_clz.S bn/arch/amd64/bn_arch.c ) - add_definitions(-Dendbr64) + add_definitions(-Dendbr64=nop) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) add_definitions(-DVPAES_ASM) diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index 789da0aa7c..270861872d 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -34,7 +34,7 @@ ASM_X86_64_MACOSX += bn/arch/amd64/bn_arch.c EXTRA_DIST += $(ASM_X86_64_MACOSX) if HOST_ASM_MACOSX_X86_64 -libcrypto_la_CPPFLAGS += -Dendbr64 +libcrypto_la_CPPFLAGS += -Dendbr64=nop libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM libcrypto_la_CPPFLAGS += -DVPAES_ASM From b328be457ae699947f409b7434293d632c36e47d Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 3 Jul 2023 18:40:00 +0300 Subject: [PATCH 0338/1283] third try's a charm --- crypto/CMakeLists.txt | 2 +- crypto/Makefile.am.macosx-x86_64 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 5d80541b89..707424cecd 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -111,7 +111,7 @@ if(HOST_ASM_MACOSX_X86_64) bn/arch/amd64/word_clz.S bn/arch/amd64/bn_arch.c ) - add_definitions(-Dendbr64=nop) + add_definitions(-Dendbr64=) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) add_definitions(-DVPAES_ASM) diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index 270861872d..219a7acb42 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -34,7 +34,7 @@ ASM_X86_64_MACOSX += bn/arch/amd64/bn_arch.c EXTRA_DIST += $(ASM_X86_64_MACOSX) if HOST_ASM_MACOSX_X86_64 -libcrypto_la_CPPFLAGS += -Dendbr64=nop +libcrypto_la_CPPFLAGS += -Dendbr64= libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM libcrypto_la_CPPFLAGS += -DVPAES_ASM From 7179a01c454a997ad884cba3d2cd1804989c6adc Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 3 Jul 2023 19:00:12 +0300 Subject: [PATCH 0339/1283] flip logic around --- tests/CMakeLists.txt | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 1828f0f626..7a7e391a70 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -599,9 +599,12 @@ add_test(sha_test sha_test) if(NOT CMAKE_SYSTEM_NAME MATCHES "WindowsStore") set(SIGNERTEST_SRC signertest.c) check_function_exists(pipe2 HAVE_PIPE2) - if(!HAVE_PIPE2) + if(HAVE_PIPE2) + add_definitions(-DHAVE_PIPE2) + else() set(SIGNERTEST_SRC ${SIGNERTEST_SRC} compat/pipe2.c) endif() + set_source_files_properties(signertest.c PROPERTIES COMPILE_FLAGS -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") add_executable(signertest ${SIGNERTEST_SRC}) From b16ad4dbd4143aa27e89744a635ebd7d48697af4 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 4 Jul 2023 02:17:58 +0300 Subject: [PATCH 0340/1283] disable client / server tests for now These were broken with the removal of TLS 1.0/1.1 support due to static checks in packet structure. --- tests/CMakeLists.txt | 28 +++++++++++++++------------- tests/Makefile.am | 9 +++++---- 2 files changed, 20 insertions(+), 17 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 7a7e391a70..48d2da7145 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -263,9 +263,10 @@ target_link_libraries(cipherstest ${OPENSSL_TEST_LIBS}) add_test(cipherstest cipherstest) # clienttest +# Disabled for now after removal of TLS 1.0/1.1 support add_executable(clienttest clienttest.c) target_link_libraries(clienttest ${OPENSSL_TEST_LIBS}) -add_test(clienttest clienttest) +#add_test(clienttest clienttest) # cmstest add_executable(cmstest cmstest.c) @@ -581,14 +582,15 @@ add_test(rsa_test rsa_test) # server.c # servertest +# Disabled for now after removal of TLS 1.0/1.1 support add_executable(servertest servertest.c) target_link_libraries(servertest ${OPENSSL_TEST_LIBS}) -if(NOT MSVC) - add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.sh) -else() - add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.bat $) -endif() -set_tests_properties(servertest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") +#if(NOT MSVC) +# add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.sh) +#else() +# add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.bat $) +#endif() +#set_tests_properties(servertest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # sha_test add_executable(sha_test sha_test.c) @@ -657,12 +659,12 @@ add_test(ssl_versions ssl_versions) # ssltest add_executable(ssltest ssltest.c) target_link_libraries(ssltest ${OPENSSL_TEST_LIBS}) -if(NOT MSVC) - add_test(NAME ssltest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssltest.sh) -else() - add_test(NAME ssltest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssltest.bat $ $) -endif() -set_tests_properties(ssltest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") +#if(NOT MSVC) +# add_test(NAME ssltest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssltest.sh) +#else() +# add_test(NAME ssltest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssltest.bat $ $) +#endif() +#set_tests_properties(ssltest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # string_table add_executable(string_table string_table.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index 2353396dbe..f2ebbdf635 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -279,7 +279,8 @@ check_PROGRAMS += cipherstest cipherstest_SOURCES = cipherstest.c # clienttest -TESTS += clienttest +# Disabled for now after removal of TLS 1.0/1.1 support +#TESTS += clienttest check_PROGRAMS += clienttest clienttest_SOURCES = clienttest.c @@ -616,7 +617,8 @@ rsa_test_SOURCES = rsa_test.c # server.c # servertest -TESTS += servertest.sh +# Disabled for now after removal of TLS 1.0/1.1 support +#TESTS += servertest.sh check_PROGRAMS += servertest servertest_SOURCES = servertest.c EXTRA_DIST += servertest.sh servertest.bat @@ -676,7 +678,7 @@ check_PROGRAMS += ssl_versions ssl_versions_SOURCES = ssl_versions.c # ssltest -TESTS += ssltest.sh +#TESTS += ssltest.sh check_PROGRAMS += ssltest ssltest_SOURCES = ssltest.c EXTRA_DIST += ssltest.sh ssltest.bat @@ -693,7 +695,6 @@ EXTRA_DIST += server2-ecdsa.pem server2-rsa-chain.pem server2-rsa.pem EXTRA_DIST += server3-ecdsa-chain.pem server3-ecdsa.pem server3-rsa-chain.pem EXTRA_DIST += server3-rsa.pem - # string_table TESTS += string_table check_PROGRAMS += string_table From 23718ad1348c55ff5ba37384256a860b113be1e8 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 4 Jul 2023 01:52:46 -0500 Subject: [PATCH 0341/1283] reenable ssltest failure was unrelated to tls 1.0/1.1 changes --- tests/CMakeLists.txt | 12 ++++++------ tests/Makefile.am | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 48d2da7145..36c68a9321 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -659,12 +659,12 @@ add_test(ssl_versions ssl_versions) # ssltest add_executable(ssltest ssltest.c) target_link_libraries(ssltest ${OPENSSL_TEST_LIBS}) -#if(NOT MSVC) -# add_test(NAME ssltest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssltest.sh) -#else() -# add_test(NAME ssltest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssltest.bat $ $) -#endif() -#set_tests_properties(ssltest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") +if(NOT MSVC) + add_test(NAME ssltest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssltest.sh) +else() + add_test(NAME ssltest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssltest.bat $ $) +endif() +set_tests_properties(ssltest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # string_table add_executable(string_table string_table.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index f2ebbdf635..70371d3d3e 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -678,7 +678,7 @@ check_PROGRAMS += ssl_versions ssl_versions_SOURCES = ssl_versions.c # ssltest -#TESTS += ssltest.sh +TESTS += ssltest.sh check_PROGRAMS += ssltest ssltest_SOURCES = ssltest.c EXTRA_DIST += ssltest.sh ssltest.bat From 71ce0b8c3e07079a40011d2f3515969e3bdf302e Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 4 Jul 2023 10:37:24 +0300 Subject: [PATCH 0342/1283] generate opensslconf.h in build dir for cmake --- apps/nc/CMakeLists.txt | 10 ++++++++-- apps/ocspcheck/CMakeLists.txt | 12 ++++++++---- apps/openssl/CMakeLists.txt | 17 +++++++++++------ crypto/CMakeLists.txt | 3 ++- include/CMakeLists.txt | 7 +++++-- ssl/CMakeLists.txt | 3 ++- tests/CMakeLists.txt | 1 + tls/CMakeLists.txt | 3 ++- 8 files changed, 39 insertions(+), 17 deletions(-) diff --git a/apps/nc/CMakeLists.txt b/apps/nc/CMakeLists.txt index bd59211f3a..ffd68e55db 100644 --- a/apps/nc/CMakeLists.txt +++ b/apps/nc/CMakeLists.txt @@ -36,8 +36,14 @@ else() endif() add_executable(nc ${NC_SRC}) -target_include_directories(nc PUBLIC ../../include) -target_include_directories(nc PRIVATE . ./compat ../../include/compat) +target_include_directories(nc + PRIVATE + . + ./compat + ../../include/compat + PUBLIC + ../../include + ${CMAKE_BINARY_DIR}/include) target_link_libraries(nc ${LIBTLS_LIBS}) if(ENABLE_NC) diff --git a/apps/ocspcheck/CMakeLists.txt b/apps/ocspcheck/CMakeLists.txt index 2dddb6e2e4..43eebdf466 100644 --- a/apps/ocspcheck/CMakeLists.txt +++ b/apps/ocspcheck/CMakeLists.txt @@ -8,9 +8,9 @@ set( check_function_exists(memmem HAVE_MEMMEM) if(HAVE_MEMMEM) - add_definitions(-DHAVE_MEMMEM) + add_definitions(-DHAVE_MEMMEM) else() - set(OCSPCHECK_SRC ${OCSPCHECK_SRC} compat/memmem.c) + set(OCSPCHECK_SRC ${OCSPCHECK_SRC} compat/memmem.c) endif() if(NOT "${OPENSSLDIR}" STREQUAL "") @@ -20,8 +20,12 @@ else() endif() add_executable(ocspcheck ${OCSPCHECK_SRC}) -target_include_directories(ocspcheck PUBLIC ../../include) -target_include_directories(ocspcheck PRIVATE . ./compat ../../include/compat) +target_include_directories(ocspcheck + PRIVATE + ../../include/compat + PUBLIC + ../../include + ${CMAKE_BINARY_DIR}/include) target_link_libraries(ocspcheck tls ${OPENSSL_LIBS}) if(ENABLE_LIBRESSL_INSTALL) diff --git a/apps/openssl/CMakeLists.txt b/apps/openssl/CMakeLists.txt index 437c0db007..efea2175ed 100644 --- a/apps/openssl/CMakeLists.txt +++ b/apps/openssl/CMakeLists.txt @@ -61,15 +61,20 @@ if(WIN32) endif() if(CMAKE_SYSTEM_NAME MATCHES "Darwin") - check_function_exists(clock_gettime HAVE_CLOCK_GETTIME) - if(NOT HAVE_CLOCK_GETTIME) - set(OPENSSL_SRC ${OPENSSL_SRC} compat/clock_gettime_osx.c) - endif() + check_function_exists(clock_gettime HAVE_CLOCK_GETTIME) + if(NOT HAVE_CLOCK_GETTIME) + set(OPENSSL_SRC ${OPENSSL_SRC} compat/clock_gettime_osx.c) + endif() endif() add_executable(openssl ${OPENSSL_SRC}) -target_include_directories(openssl PUBLIC ../../include) -target_include_directories(openssl PRIVATE . ../../include/compat) +target_include_directories(openssl + PRIVATE + . + ../../include/compat + PUBLIC + ../../include + ${CMAKE_BINARY_DIR}/include) target_link_libraries(openssl ${OPENSSL_LIBS}) if(ENABLE_LIBRESSL_INSTALL) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 707424cecd..84eb894fbe 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -997,7 +997,8 @@ target_include_directories(crypto_obj x509 ../include/compat PUBLIC - ../include) + ../include + ${CMAKE_BINARY_DIR}/include) if(HOST_AARCH64) target_include_directories(crypto_obj PRIVATE bn/arch/aarch64/) diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt index 44ab86b410..ca81ee885d 100644 --- a/include/CMakeLists.txt +++ b/include/CMakeLists.txt @@ -4,7 +4,10 @@ if(ENABLE_LIBRESSL_INSTALL) PATTERN "CMakeLists.txt" EXCLUDE PATTERN "compat" EXCLUDE PATTERN "pqueue.h" EXCLUDE - PATTERN "Makefile*" EXCLUDE) + PATTERN "Makefile*" EXCLUDE + PATTERN "arch" EXCLUDE) + install(FILES ${CMAKE_BINARY_DIR}/include/openssl/opensslconf.h + DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/openssl") endif(ENABLE_LIBRESSL_INSTALL) if(HOST_AARCH64) @@ -28,4 +31,4 @@ elseif(HOST_SPARC64) elseif(HOST_X86_64) file(READ arch/amd64/opensslconf.h OPENSSLCONF) endif() -file(WRITE openssl/opensslconf.h "${OPENSSLCONF}") +file(WRITE ${CMAKE_BINARY_DIR}/include/openssl/opensslconf.h "${OPENSSLCONF}") diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index f5d52f7732..88e7bbd2e1 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -69,7 +69,8 @@ target_include_directories(ssl_obj ../crypto/bio ../include/compat PUBLIC - ../include) + ../include + ${CMAKE_BINARY_DIR}/include) add_library(bs_obj OBJECT ${BS_SRC}) target_include_directories(bs_obj diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 48d2da7145..715919e914 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -13,6 +13,7 @@ include_directories( ../apps/openssl ../apps/openssl/compat ../include + ${CMAKE_BINARY_DIR}/include ../include/compat ) diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 62dde6308d..5bc6208d82 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -45,7 +45,8 @@ target_include_directories(tls_obj . ../include/compat PUBLIC - ../include) + ../include + ${CMAKE_BINARY_DIR}/include) add_library(tls $ $ $ empty.c) From 2203c13d25cfc83a45e306df40bb3b5624cace2f Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 4 Jul 2023 12:36:57 +0300 Subject: [PATCH 0343/1283] make cross compilation possible on macOS with CMake Sync CMAKE_SYSTEM_PROCESSOR to CMAKE_OSX_ARCHITECTURES. This doesn't support universal binaries, but does allow cross-compiling for a single architecture by setting -DCMAKE_OSX_ARCHITECTURES=(arm64|x86_64) --- CMakeLists.txt | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index 7847830a1e..b8863c4453 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -306,6 +306,15 @@ if(HAVE_NETINET_IP_H) add_definitions(-DHAVE_NETINET_IP_H) endif() +# This isn't ready for universal binaries yet, since we do conditional +# compilation based on the architecture, but this makes cross compiling for a +# single architecture work on macOS at least. +# +# Don't set CMAKE_OSX_ARCHITECTURES to more than a single value for now. +if(APPLE) + set(CMAKE_SYSTEM_PROCESSOR "${CMAKE_OSX_ARCHITECTURES}") +endif() + if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(aarch64|arm64)") set(HOST_AARCH64 true) elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm") From 15d076b475ab12049b6b5dc5ab9cb360994c7ca4 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 4 Jul 2023 13:09:31 +0300 Subject: [PATCH 0344/1283] add ventura and arm64 test targets, remove big sur This reworks the macOS github actions to target Apple silicon for tests. To simplify the test matrix, removing big sur and adding ventura. Also some cleanups to the test script. We really don't need the 'x' workaround for non-POSIX shells, and it got confusing writing "xx86_64". --- .github/workflows/macos_test.yml | 7 ++- scripts/test | 83 ++++++++++++++++++++++---------- 2 files changed, 60 insertions(+), 30 deletions(-) diff --git a/.github/workflows/macos_test.yml b/.github/workflows/macos_test.yml index 83a1b3599d..d7509d6e0b 100644 --- a/.github/workflows/macos_test.yml +++ b/.github/workflows/macos_test.yml @@ -6,13 +6,12 @@ jobs: build-native: strategy: matrix: - os: [macos-12, macos-11] - compiler: [clang, gcc] + os: [macos-13, macos-12] + arch: [arm64, x86_64] runs-on: ${{ matrix.os }} continue-on-error: false env: - CC: ${{ matrix.compiler }} - ARCH: native + ARCH: ${{ matrix.arch }} name: ${{ matrix.compiler }} - ${{ matrix.os }} steps: - name: Install packages for macos diff --git a/scripts/test b/scripts/test index f1fdd83d39..97e316e0b2 100755 --- a/scripts/test +++ b/scripts/test @@ -10,46 +10,77 @@ if type apt-get >/dev/null 2>&1; then sudo apt-get install -y cmake ninja-build fi +# generate source tree ./autogen.sh -if [ "x$ARCH" = "xnative" ]; then +if [ "$ARCH" = "" ]; then + ARCH=`uname -m` +fi + +# test macOS +if [ `uname` = "Darwin" ]; then # test autotools ./configure - make -j 4 distcheck # make distribution - make dist + make -j 4 distcheck + + # test cmake tar zxvf libressl-*.tar.gz cd libressl-* - mkdir build-static - mkdir build-shared - - cd build-static - # test cmake and ninja - if [ `uname` = "Darwin" ]; then - cmake -DENABLE_ASM=${ENABLE_ASM} .. + ( + mkdir build-static + cd build-static + cmake -DCMAKE_OSX_ARCHITECTURES=$ARCH .. make -j 4 - make test + if [ "$ARCH" = "x86_64" ]; then + make test + fi + ) - cd ../build-shared - cmake -DBUILD_SHARED_LIBS=ON -DENABLE_ASM=${ENABLE_ASM} .. + ( + mkdir build-shared + cd build-shared + cmake -DBUILD_SHARED_LIBS=ON -DCMAKE_OSX_ARCHITECTURES=$ARCH .. make -j 4 - make test - else + if [ "$ARCH" = "x86_64" ]; then + make test + fi + ) + +# assuming Linux below +elif [ "$ARCH" = "native" ]; then + # test autotools + ./configure + + # make distribution + make -j 4 distcheck + + tar zxvf libressl-*.tar.gz + cd libressl-* + + + # test cmake and ninja + ( + mkdir build-static + cd build-static cmake -GNinja -DENABLE_ASM=${ENABLE_ASM} .. - ninja -j 4 + ninja ninja test + ) - cd ../build-shared + ( + mkdir build-shared + cd build-shared cmake -GNinja -DBUILD_SHARED_LIBS=ON -DENABLE_ASM=${ENABLE_ASM} .. - ninja -j 4 + ninja ninja test - fi + ) -elif [ "x$ARCH" = "xmingw32" -o "x$ARCH" = "xmingw64" ]; then +elif [ "$ARCH" = "mingw32" -o "$ARCH" = "mingw64" ]; then CPU=i686 - if [ "x$ARCH" = "xmingw64" ]; then + if [ "$ARCH" = "mingw64" ]; then CPU=x86_64 fi @@ -75,10 +106,10 @@ elif [ "x$ARCH" = "xmingw32" -o "x$ARCH" = "xmingw64" ]; then ninja -j 4 ) -elif [ "x$ARCH" = "xarm32" -o "x$ARCH" = "xarm64" ]; then +elif [ "$ARCH" = "arm32" -o "$ARCH" = "arm64" ]; then sudo apt-get install -y qemu-user-static binfmt-support - if [ "x$ARCH" = "xarm32" ]; then + if [ "$ARCH" = "arm32" ]; then sudo apt-get install -y g++-arm-linux-gnueabihf sudo ln -sf /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.3 /lib/ ./configure --host=arm-linux-gnueabihf @@ -92,10 +123,10 @@ elif [ "x$ARCH" = "xarm32" -o "x$ARCH" = "xarm64" ]; then file apps/openssl/.libs/openssl -elif [ "x$ARCH" = "xmips32" -o "x$ARCH" = "xmips64" ]; then +elif [ "$ARCH" = "mips32" -o "$ARCH" = "mips64" ]; then sudo apt-get install -y qemu-user-static binfmt-support - if [ "x$ARCH" = "xmips32" ]; then + if [ "$ARCH" = "mips32" ]; then sudo apt-get install -y g++-mips-linux-gnu sudo ln -sf /usr/mipsel-linux-gnu/lib/ld.so.1 /lib/ ./configure --host=mipsel-linux-gnu @@ -109,7 +140,7 @@ elif [ "x$ARCH" = "xmips32" -o "x$ARCH" = "xmips64" ]; then file apps/openssl/.libs/openssl -elif [ "x$ARCH" = "xandroid" ]; then +elif [ "$ARCH" = "android" ]; then export TC_FILE=$ANDROID_NDK_HOME/build/cmake/android.toolchain.cmake # set target API level and architecture From d238b6d3a17a81564124edc8bb598734e717407e Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 4 Jul 2023 19:35:50 +0300 Subject: [PATCH 0345/1283] label individual macos build arches --- .github/workflows/macos_test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/macos_test.yml b/.github/workflows/macos_test.yml index d7509d6e0b..9f88d77dcd 100644 --- a/.github/workflows/macos_test.yml +++ b/.github/workflows/macos_test.yml @@ -12,7 +12,7 @@ jobs: continue-on-error: false env: ARCH: ${{ matrix.arch }} - name: ${{ matrix.compiler }} - ${{ matrix.os }} + name: ${{ matrix.os }} - ${{ matrix.arch }} steps: - name: Install packages for macos run: brew install automake From 3601512b6134c3c8ec357f650b9934b3f1b281dc Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 5 Jul 2023 10:13:47 +0300 Subject: [PATCH 0346/1283] update testssl.bat for TLS 1.0 removal --- tests/testssl.bat | 39 +++++++++++++++++++-------------------- 1 file changed, 19 insertions(+), 20 deletions(-) diff --git a/tests/testssl.bat b/tests/testssl.bat index 4c3ca1b649..c4e62861fc 100644 --- a/tests/testssl.bat +++ b/tests/testssl.bat @@ -1,4 +1,4 @@ -@echo off +@echo on setlocal enabledelayedexpansion REM testssl.bat @@ -88,8 +88,7 @@ for /f "usebackq" %%s in (`%openssl% no-dh`) do set nodh=%%s if %nodh%==no-dh ( echo skipping anonymous DH tests ) else ( - echo test tls1 with 1024bit anonymous DH, multiple handshakes - %ssltest% -v -bio_pair -tls1 -cipher ADH -dhe1024dsa -num 10 -f -time %extra% & if !errorlevel! neq 0 exit /b 1 + echo skipping tls1 tests. ) REM #for /f "usebackq" %%s in (`%openssl% no-rsa`) do set norsa=%%s @@ -112,24 +111,24 @@ REM # REM # DTLS tests REM # -echo test dtlsv1 -%ssltest% -dtls1 %extra% & if !errorlevel! neq 0 exit /b 1 +echo test dtlsv1_2 +%ssltest% -dtls1_2 %extra% & if !errorlevel! neq 0 exit /b 1 -echo test dtlsv1 with server authentication -%ssltest% -dtls1 -server_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1 +echo test dtlsv1_2 with server authentication +%ssltest% -dtls1_2 -server_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1 -echo test dtlsv1 with client authentication -%ssltest% -dtls1 -client_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1 +echo test dtlsv1_2 with client authentication +%ssltest% -dtls1_2 -client_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1 -echo test dtlsv1 with both client and server authentication -%ssltest% -dtls1 -server_auth -client_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1 +echo test dtlsv1_2 with both client and server authentication +%ssltest% -dtls1_2 -server_auth -client_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1 echo "Testing DTLS ciphersuites" for %%p in ( SSLv3 ) do ( echo "Testing ciphersuites for %%p" for /f "usebackq" %%c in (`%openssl% ciphers -v "RSA+%%p:-RC4" ^| find "%%p"`) do ( echo "Testing %%c" - %ssltest% -cipher %%c -dtls1 + %ssltest% -cipher %%c -dtls1_2 if !errorlevel! neq 0 ( echo "Failed %%c" exit /b 1 @@ -141,19 +140,19 @@ REM # REM # ALPN tests REM # echo "Testing ALPN..." -%ssltest% -bio_pair -tls1 -alpn_client foo -alpn_server bar & if !errorlevel! neq 0 exit /b 1 -%ssltest% -bio_pair -tls1 -alpn_client foo -alpn_server foo ^ +%ssltest% -bio_pair -alpn_client foo -alpn_server bar & if !errorlevel! neq 0 exit /b 1 +%ssltest% -bio_pair -alpn_client foo -alpn_server foo ^ -alpn_expected foo & if !errorlevel! neq 0 exit /b 1 -%ssltest% -bio_pair -tls1 -alpn_client foo,bar -alpn_server foo ^ +%ssltest% -bio_pair -alpn_client foo,bar -alpn_server foo ^ -alpn_expected foo & if !errorlevel! neq 0 exit /b 1 -%ssltest% -bio_pair -tls1 -alpn_client bar,foo -alpn_server foo ^ +%ssltest% -bio_pair -alpn_client bar,foo -alpn_server foo ^ -alpn_expected foo & if !errorlevel! neq 0 exit /b 1 -%ssltest% -bio_pair -tls1 -alpn_client bar,foo -alpn_server foo,bar ^ +%ssltest% -bio_pair -alpn_client bar,foo -alpn_server foo,bar ^ -alpn_expected foo & if !errorlevel! neq 0 exit /b 1 -%ssltest% -bio_pair -tls1 -alpn_client bar,foo -alpn_server bar,foo ^ +%ssltest% -bio_pair -alpn_client bar,foo -alpn_server bar,foo ^ -alpn_expected bar & if !errorlevel! neq 0 exit /b 1 -%ssltest% -bio_pair -tls1 -alpn_client foo,bar -alpn_server bar,foo ^ +%ssltest% -bio_pair -alpn_client foo,bar -alpn_server bar,foo ^ -alpn_expected bar & if !errorlevel! neq 0 exit /b 1 -%ssltest% -bio_pair -tls1 -alpn_client baz -alpn_server bar,foo & if !errorlevel! neq 0 exit /b 1 +%ssltest% -bio_pair -alpn_client baz -alpn_server bar,foo & if !errorlevel! neq 0 exit /b 1 endlocal From 74be614b0c7e6f0affa4ab0bfb9c2eaab75ea470 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 4 Jul 2023 19:36:38 +0300 Subject: [PATCH 0347/1283] add Windows builder test actions --- .github/workflows/windows_test.yml | 45 ++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 .github/workflows/windows_test.yml diff --git a/.github/workflows/windows_test.yml b/.github/workflows/windows_test.yml new file mode 100644 index 0000000000..ff91f9a6d7 --- /dev/null +++ b/.github/workflows/windows_test.yml @@ -0,0 +1,45 @@ +name: windows_ci + +on: [push, pull_request] + +jobs: + build-native: + strategy: + matrix: + os: [windows-2019, windows-2022] + arch: [Win32, x64, ARM64] + include: + - generator: "Visual Studio 16 2019" + os: windows-2019 + - generator: "Visual Studio 17 2022" + os: windows-2022 + runs-on: ${{ matrix.os }} + continue-on-error: false + name: ${{ matrix.os }} - ${{ matrix.arch }} + steps: + - uses: msys2/setup-msys2@v2 + with: + update: true + install: >- + autoconf + automake + diffutils + libtool + gcc + git + patch + perl + - uses: actions/checkout@main + - shell: msys2 {0} + run: ./autogen.sh + - shell: cmd + run: cmake -Bbuild -G "${{ matrix.generator }}" -A ${{ matrix.arch }} -DCMAKE_INSTALL_PREFIX=../local + - shell: cmd + run: cmake --build build --config Release + - shell: cmd + if: ${{ matrix.arch != 'ARM64' }} + run: ctest --test-dir build -C Release --output-on-failure + - uses: actions/upload-artifact@v3 + with: + name: windows-build-results-${{ matrix.os }}-${{ matrix.arch }} + path: build From 642ead359ba9bbeddac2bf0dc593282d0c562092 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 5 Jul 2023 14:27:23 +0300 Subject: [PATCH 0348/1283] only link libtls statically to libssl/libcrypto when building standalone --- tls/Makefile.am | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/tls/Makefile.am b/tls/Makefile.am index d5725c362a..22f3222a71 100644 --- a/tls/Makefile.am +++ b/tls/Makefile.am @@ -20,10 +20,17 @@ libtls_la_objects.mk: Makefile > libtls_la_objects.mk libtls_la_LDFLAGS = -version-info @LIBTLS_VERSION@ -no-undefined -export-symbols $(top_srcdir)/tls/tls.sym + +if ENABLE_LIBTLS_ONLY libtls_la_LIBADD = $(libcrypto_la_objects) +libtls_la_LIBADD += $(libssl_la_objects) +else +libtls_la_LIBADD = $(abs_top_builddir)/crypto/libcrypto.la +libtls_la_LIBADD += $(abs_top_builddir)/ssl/libssl.la +endif + libtls_la_LIBADD += $(libcompat_la_objects) libtls_la_LIBADD += $(libcompatnoopt_la_objects) -libtls_la_LIBADD += $(libssl_la_objects) libtls_la_LIBADD += $(PLATFORM_LDADD) libtls_la_CPPFLAGS = $(AM_CPPFLAGS) From 3a757272d028834c00924c08156ca0b2dfbc6a5c Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 5 Jul 2023 07:08:32 -0500 Subject: [PATCH 0349/1283] move attribute shims There's not a great place for these, but since they are internal, we can just move them to the most common header. --- include/compat/stdint.h | 12 ++++++++++++ include/compat/sys/types.h | 12 ------------ 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/include/compat/stdint.h b/include/compat/stdint.h index 282915187f..dbe3539c5d 100644 --- a/include/compat/stdint.h +++ b/include/compat/stdint.h @@ -16,4 +16,16 @@ #include #endif +#if !defined(HAVE_ATTRIBUTE__BOUNDED__) && !defined(__bounded__) +# define __bounded__(x, y, z) +#endif + +#if !defined(HAVE_ATTRIBUTE__DEAD) && !defined(__dead) +#ifdef _MSC_VER +#define __dead __declspec(noreturn) +#else +#define __dead __attribute__((__noreturn__)) +#endif +#endif + #endif diff --git a/include/compat/sys/types.h b/include/compat/sys/types.h index 49678439b2..59664bcf9b 100644 --- a/include/compat/sys/types.h +++ b/include/compat/sys/types.h @@ -45,18 +45,6 @@ typedef SSIZE_T ssize_t; #endif -#if !defined(HAVE_ATTRIBUTE__BOUNDED__) && !defined(__bounded__) -# define __bounded__(x, y, z) -#endif - -#if !defined(HAVE_ATTRIBUTE__DEAD) && !defined(__dead) -#ifdef _MSC_VER -#define __dead __declspec(noreturn) -#else -#define __dead __attribute__((__noreturn__)) -#endif -#endif - #ifdef _WIN32 #define __warn_references(sym,msg) #else From 186134f7c5578fe979fb8f18a96c84fe04e4413e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 5 Jul 2023 05:40:45 -0600 Subject: [PATCH 0350/1283] Some ECDH and ECDSA files were (re)moved --- crypto/CMakeLists.txt | 6 ++---- crypto/Makefile.am | 8 +++----- 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 84eb894fbe..302352b8ec 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -490,14 +490,12 @@ set( ec/ecp_oct.c ec/ecp_smpl.c ec/ecx_methods.c - ecdh/ecdh_kdf.c + ecdh/ecdh.c ecdh/ech_err.c - ecdh/ech_key.c ecdh/ech_lib.c - ecdsa/ecs_asn1.c + ecdsa/ecdsa.c ecdsa/ecs_err.c ecdsa/ecs_lib.c - ecdsa/ecs_ossl.c engine/eng_all.c engine/eng_cnf.c engine/eng_ctrl.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 667352f9bb..258da674a4 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -599,17 +599,15 @@ libcrypto_la_SOURCES += ec/ecx_methods.c noinst_HEADERS += ec/ec_local.h # ecdh -libcrypto_la_SOURCES += ecdh/ecdh_kdf.c +libcrypto_la_SOURCES += ecdh/ecdh.c libcrypto_la_SOURCES += ecdh/ech_err.c -libcrypto_la_SOURCES += ecdh/ech_key.c libcrypto_la_SOURCES += ecdh/ech_lib.c # ecdsa -libcrypto_la_SOURCES += ecdsa/ecs_asn1.c +libcrypto_la_SOURCES += ecdsa/ecdsa.c libcrypto_la_SOURCES += ecdsa/ecs_err.c libcrypto_la_SOURCES += ecdsa/ecs_lib.c -libcrypto_la_SOURCES += ecdsa/ecs_ossl.c -noinst_HEADERS += ecdsa/ecs_local.h +noinst_HEADERS += ecdsa/ecdsa_local.h # engine libcrypto_la_SOURCES += engine/eng_all.c From 9a00e9e1ceb21d12f4c280ff29ff688991b994dd Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 5 Jul 2023 11:32:18 -0600 Subject: [PATCH 0351/1283] Remove patch that was merged into upstream --- patches/tlsexttest.c.patch | 76 -------------------------------------- 1 file changed, 76 deletions(-) delete mode 100644 patches/tlsexttest.c.patch diff --git a/patches/tlsexttest.c.patch b/patches/tlsexttest.c.patch deleted file mode 100644 index 023d3231a8..0000000000 --- a/patches/tlsexttest.c.patch +++ /dev/null @@ -1,76 +0,0 @@ ---- tests/tlsexttest.c.orig Fri Apr 28 11:42:38 2023 -+++ tests/tlsexttest.c Fri Apr 28 11:55:27 2023 -@@ -1775,7 +1775,9 @@ - }; - - static const unsigned char tlsext_sni_server[] = { -+ 0x00 - }; -+const size_t sizeof_tlsext_sni_server = 0; - - static int - test_tlsext_sni_client(void) -@@ -1973,9 +1975,9 @@ - if (!CBB_finish(&cbb, &data, &dlen)) - errx(1, "failed to finish CBB"); - -- if (dlen != sizeof(tlsext_sni_server)) { -+ if (dlen != sizeof_tlsext_sni_server) { - FAIL("got server SNI with length %zu, " -- "want length %zu\n", dlen, sizeof(tlsext_sni_server)); -+ "want length %zu\n", dlen, sizeof_tlsext_sni_server); - goto err; - } - -@@ -1984,14 +1986,14 @@ - fprintf(stderr, "received:\n"); - hexdump(data, dlen); - fprintf(stderr, "test data:\n"); -- hexdump(tlsext_sni_server, sizeof(tlsext_sni_server)); -+ hexdump(tlsext_sni_server, sizeof_tlsext_sni_server); - goto err; - } - - free(ssl->session->tlsext_hostname); - ssl->session->tlsext_hostname = NULL; - -- CBS_init(&cbs, tlsext_sni_server, sizeof(tlsext_sni_server)); -+ CBS_init(&cbs, tlsext_sni_server, sizeof_tlsext_sni_server); - if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) { - FAIL("failed to parse server SNI\n"); - goto err; -@@ -3196,7 +3198,10 @@ - 0x04, 0x03, 0x02, 0x01, 0x02, 0x03, - }; - --unsigned char tlsext_clienthello_disabled[] = {}; -+unsigned char tlsext_clienthello_disabled[] = { -+ 0x00 -+}; -+const size_t sizeof_tlsext_clienthello_disabled = 0; - - static int - test_tlsext_clienthello_build(void) -@@ -3287,18 +3292,18 @@ - goto err; - } - -- if (dlen != sizeof(tlsext_clienthello_disabled)) { -+ if (dlen != sizeof_tlsext_clienthello_disabled) { - FAIL("got clienthello extensions with length %zu, " - "want length %zu\n", dlen, -- sizeof(tlsext_clienthello_disabled)); -+ sizeof_tlsext_clienthello_disabled); - compare_data(data, dlen, tlsext_clienthello_disabled, -- sizeof(tlsext_clienthello_disabled)); -+ sizeof_tlsext_clienthello_disabled); - goto err; - } - if (memcmp(data, tlsext_clienthello_disabled, dlen) != 0) { - FAIL("clienthello extensions differs:\n"); - compare_data(data, dlen, tlsext_clienthello_disabled, -- sizeof(tlsext_clienthello_disabled)); -+ sizeof_tlsext_clienthello_disabled); - goto err; - } - From ed4831099aafd3780d094c9d4f157b59ebdbdcab Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 5 Jul 2023 13:25:58 -0600 Subject: [PATCH 0352/1283] Remove patch that was merged upstream --- patches/bio.h.patch | 35 ----------------------------------- 1 file changed, 35 deletions(-) delete mode 100644 patches/bio.h.patch diff --git a/patches/bio.h.patch b/patches/bio.h.patch deleted file mode 100644 index f7318798c4..0000000000 --- a/patches/bio.h.patch +++ /dev/null @@ -1,35 +0,0 @@ ---- include/openssl/bio.h.orig Tue Nov 22 21:08:27 2022 -+++ include/openssl/bio.h Tue Nov 22 21:08:48 2022 -@@ -667,8 +667,24 @@ void BIO_copy_next_retry(BIO *b); - - /*long BIO_ghbn_ctrl(int cmd,int iarg,char *parg);*/ - -+#ifdef __MINGW_PRINTF_FORMAT - int - BIO_printf(BIO *bio, const char *format, ...) -+ __attribute__((__format__(__MINGW_PRINTF_FORMAT, 2, 3), __nonnull__(2))); -+int -+BIO_vprintf(BIO *bio, const char *format, va_list args) -+ __attribute__((__format__(__MINGW_PRINTF_FORMAT, 2, 0), __nonnull__(2))); -+int -+BIO_snprintf(char *buf, size_t n, const char *format, ...) -+ __attribute__((__deprecated__, __format__(__MINGW_PRINTF_FORMAT, 3, 4), -+ __nonnull__(3))); -+int -+BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args) -+ __attribute__((__deprecated__, __format__(__MINGW_PRINTF_FORMAT, 3, 0), -+ __nonnull__(3))); -+#else -+int -+BIO_printf(BIO *bio, const char *format, ...) - __attribute__((__format__(__printf__, 2, 3), __nonnull__(2))); - int - BIO_vprintf(BIO *bio, const char *format, va_list args) -@@ -681,6 +697,7 @@ int - BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args) - __attribute__((__deprecated__, __format__(__printf__, 3, 0), - __nonnull__(3))); -+#endif - - void ERR_load_BIO_strings(void); - From b2b19236004c1c5a3baf0622074a3ddf7dbc7d69 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 5 Jul 2023 13:37:32 -0600 Subject: [PATCH 0353/1283] Add hidden/openssl/chacha.h --- crypto/Makefile.am | 1 + patches/libcrypto.hidden.patch | 14 ++++++++++++++ 2 files changed, 15 insertions(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 258da674a4..811946ad2e 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -721,6 +721,7 @@ noinst_HEADERS += gost/gost_local.h # hidden noinst_HEADERS += hidden/crypto_namespace.h +noinst_HEADERS += hidden/openssl/chacha.h noinst_HEADERS += hidden/openssl/hmac.h noinst_HEADERS += hidden/openssl/pkcs12.h noinst_HEADERS += hidden/openssl/pkcs7.h diff --git a/patches/libcrypto.hidden.patch b/patches/libcrypto.hidden.patch index f29ce831c3..f786576899 100644 --- a/patches/libcrypto.hidden.patch +++ b/patches/libcrypto.hidden.patch @@ -118,3 +118,17 @@ diff -u openbsd/src/lib/libcrypto/hidden/openssl/x509_vfy.h crypto/hidden/openss #include "crypto_namespace.h" LCRYPTO_USED(X509_STORE_set_depth); +--- crypto/hidden/openssl/chacha.h.orig Wed Jul 5 13:42:44 2023 ++++ crypto/hidden/openssl/chacha.h Wed Jul 5 13:44:17 2023 +@@ -18,7 +18,11 @@ + #ifndef _LIBCRYPTO_CHACHA_H + #define _LIBCRYPTO_CHACHA_H + ++#ifdef _MSC_VER ++#include <../include/openssl/chacha.h> ++#else + #include_next ++#endif + #include "crypto_namespace.h" + + LCRYPTO_USED(ChaCha_set_key); From a47e39014e1596ffc94d5b64096f647596a1a581 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 5 Jul 2023 15:38:45 -0600 Subject: [PATCH 0354/1283] Remove patches merged into upstream --- patches/libcrypto.hidden.patch | 134 --------------------------------- patches/libssl.hidden.patch | 15 ---- 2 files changed, 149 deletions(-) delete mode 100644 patches/libcrypto.hidden.patch delete mode 100644 patches/libssl.hidden.patch diff --git a/patches/libcrypto.hidden.patch b/patches/libcrypto.hidden.patch deleted file mode 100644 index f786576899..0000000000 --- a/patches/libcrypto.hidden.patch +++ /dev/null @@ -1,134 +0,0 @@ -diff -u openbsd/src/lib/libcrypto/hidden/openssl/hmac.h crypto/hidden/openssl/hmac.h ---- openbsd/src/lib/libcrypto/hidden/openssl/hmac.h 2023-03-15 11:41:37.632580800 -0600 -+++ crypto/hidden/openssl/hmac.h 2023-03-15 16:49:29.144080400 -0600 -@@ -18,7 +18,11 @@ - #ifndef _LIBCRYPTO_HMAC_H_ - #define _LIBCRYPTO_HMAC_H_ - -+#ifdef _MSC_VER -+#include <../include/openssl/hmac.h> -+#else - #include_next -+#endif - #include "crypto_namespace.h" - - LCRYPTO_USED(HMAC_CTX_new); -diff -u openbsd/src/lib/libcrypto/hidden/openssl/pkcs12.h crypto/hidden/openssl/pkcs12.h ---- openbsd/src/lib/libcrypto/hidden/openssl/pkcs12.h 2023-03-15 11:41:37.648024900 -0600 -+++ crypto/hidden/openssl/pkcs12.h 2023-03-15 17:15:36.015981800 -0600 -@@ -18,7 +18,11 @@ - #ifndef _LIBCRYPTO_PKCS12_H - #define _LIBCRYPTO_PKCS12_H - -+#ifdef _MSC_VER -+#include <../include/openssl/pkcs12.h> -+#else - #include_next -+#endif - #include "crypto_namespace.h" - - LCRYPTO_USED(PKCS12_SAFEBAG_get0_attr); -diff -u openbsd/src/lib/libcrypto/hidden/openssl/pkcs7.h crypto/hidden/openssl/pkcs7.h ---- openbsd/src/lib/libcrypto/hidden/openssl/pkcs7.h 2023-03-15 11:41:37.663599200 -0600 -+++ crypto/hidden/openssl/pkcs7.h 2023-03-15 16:53:43.232866600 -0600 -@@ -18,7 +18,11 @@ - #ifndef _LIBCRYPTO_PKCS7_H - #define _LIBCRYPTO_PKCS7_H - -+#ifdef _MSC_VER -+#include <../include/openssl/pkcs7.h> -+#else - #include_next -+#endif - #include "crypto_namespace.h" - - LCRYPTO_USED(PKCS7_ISSUER_AND_SERIAL_new); -diff -u openbsd/src/lib/libcrypto/hidden/openssl/stack.h crypto/hidden/openssl/stack.h ---- openbsd/src/lib/libcrypto/hidden/openssl/stack.h 2023-03-15 11:41:37.680453800 -0600 -+++ crypto/hidden/openssl/stack.h 2023-03-15 16:49:29.200142600 -0600 -@@ -18,7 +18,11 @@ - #ifndef _LIBCRYPTO_STACK_H - #define _LIBCRYPTO_STACK_H - -+#ifdef _MSC_VER -+#include <../include/openssl/stack.h> -+#else - #include_next -+#endif - #include "crypto_namespace.h" - - LCRYPTO_USED(sk_num); -diff -u openbsd/src/lib/libcrypto/hidden/openssl/ui.h crypto/hidden/openssl/ui.h ---- openbsd/src/lib/libcrypto/hidden/openssl/ui.h 2023-03-15 11:41:37.696291800 -0600 -+++ crypto/hidden/openssl/ui.h 2023-03-15 16:49:29.222310800 -0600 -@@ -18,7 +18,11 @@ - #ifndef _LIBCRYPTO_UI_H - #define _LIBCRYPTO_UI_H - -+#ifdef _MSC_VER -+#include <../include/openssl/ui.h> -+#else - #include_next -+#endif - #include "crypto_namespace.h" - - LCRYPTO_USED(UI_new); -diff -u openbsd/src/lib/libcrypto/hidden/openssl/x509.h crypto/hidden/openssl/x509.h ---- openbsd/src/lib/libcrypto/hidden/openssl/x509.h 2023-03-15 11:41:37.713302600 -0600 -+++ crypto/hidden/openssl/x509.h 2023-03-15 16:49:29.238904200 -0600 -@@ -18,7 +18,11 @@ - #ifndef _LIBCRYPTO_X509_H - #define _LIBCRYPTO_X509_H - -+#ifdef _MSC_VER -+#include <../include/openssl/x509.h> -+#else - #include_next -+#endif - #include "crypto_namespace.h" - - LCRYPTO_USED(X509_CRL_up_ref); -diff -u openbsd/src/lib/libcrypto/hidden/openssl/x509v3.h crypto/hidden/openssl/x509v3.h ---- openbsd/src/lib/libcrypto/hidden/openssl/x509v3.h 2023-03-15 11:41:37.756379100 -0600 -+++ crypto/hidden/openssl/x509v3.h 2023-03-15 16:49:29.264482800 -0600 -@@ -18,7 +18,11 @@ - #ifndef _LIBCRYPTO_X509V3_H - #define _LIBCRYPTO_X509V3_H - -+#ifdef _MSC_VER -+#include <../include/openssl/x509v3.h> -+#else - #include_next -+#endif - #include "crypto_namespace.h" - - LCRYPTO_USED(BASIC_CONSTRAINTS_new); -diff -u openbsd/src/lib/libcrypto/hidden/openssl/x509_vfy.h crypto/hidden/openssl/x509_vfy.h ---- openbsd/src/lib/libcrypto/hidden/openssl/x509_vfy.h 2023-03-15 11:41:37.735995100 -0600 -+++ crypto/hidden/openssl/x509_vfy.h 2023-03-15 16:49:29.300450300 -0600 -@@ -18,7 +18,11 @@ - #ifndef _LIBCRYPTO_X509_VFY_H - #define _LIBCRYPTO_X509_VFY_H - -+#ifdef _MSC_VER -+#include <../include/openssl/x509_vfy.h> -+#else - #include_next -+#endif - #include "crypto_namespace.h" - - LCRYPTO_USED(X509_STORE_set_depth); ---- crypto/hidden/openssl/chacha.h.orig Wed Jul 5 13:42:44 2023 -+++ crypto/hidden/openssl/chacha.h Wed Jul 5 13:44:17 2023 -@@ -18,7 +18,11 @@ - #ifndef _LIBCRYPTO_CHACHA_H - #define _LIBCRYPTO_CHACHA_H - -+#ifdef _MSC_VER -+#include <../include/openssl/chacha.h> -+#else - #include_next -+#endif - #include "crypto_namespace.h" - - LCRYPTO_USED(ChaCha_set_key); diff --git a/patches/libssl.hidden.patch b/patches/libssl.hidden.patch deleted file mode 100644 index 5a8c2c8181..0000000000 --- a/patches/libssl.hidden.patch +++ /dev/null @@ -1,15 +0,0 @@ -diff -u openbsd/src/lib/libssl/hidden/openssl/ssl.h ssl/hidden/openssl/ssl.h ---- openbsd/src/lib/libssl/hidden/openssl/ssl.h 2023-03-15 11:41:52.466146400 -0600 -+++ ssl/hidden/openssl/ssl.h 2023-03-15 16:49:29.358377300 -0600 -@@ -18,7 +18,11 @@ - #ifndef _LIBSSL_SSL_H_ - #define _LIBSSL_SSL_H_ - -+#ifdef _MSC_VER -+#include <../include/openssl/ssl.h> -+#else - #include_next -+#endif - #include "ssl_namespace.h" - - LSSL_USED(BIO_f_ssl); From 546a622bcd190415b9494b6be6c718762386a84b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 5 Jul 2023 15:38:50 -0600 Subject: [PATCH 0355/1283] Add hidden asn1.h, asn1t.h, bio.h to build --- crypto/Makefile.am | 3 +++ 1 file changed, 3 insertions(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 811946ad2e..cf611a20b1 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -721,6 +721,9 @@ noinst_HEADERS += gost/gost_local.h # hidden noinst_HEADERS += hidden/crypto_namespace.h +noinst_HEADERS += hidden/openssl/asn1.h +noinst_HEADERS += hidden/openssl/asn1t.h +noinst_HEADERS += hidden/openssl/bio.h noinst_HEADERS += hidden/openssl/chacha.h noinst_HEADERS += hidden/openssl/hmac.h noinst_HEADERS += hidden/openssl/pkcs12.h From 691814aaac58c8d2cef04f6d83681ff7b43819c0 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 5 Jul 2023 19:54:01 +0300 Subject: [PATCH 0356/1283] see #353, do not support Solaris 10 --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 0209b24099..ecfba179cd 100644 --- a/README.md +++ b/README.md @@ -40,7 +40,7 @@ At the time of this writing, LibreSSL is known to build and work on: * FreeBSD (tested with 9.2 and later) * NetBSD (7.0 or later recommended) * HP-UX (11i) -* Solaris (11 and later preferred) +* Solaris 11 and later * Mac OS X (tested with 10.8 and later) * AIX (5.3 and later) From 09418fe29ed7d5829e0b251aa543b6c1b6f2090f Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 6 Jul 2023 11:05:53 +0300 Subject: [PATCH 0357/1283] make update.sh compatible with Solaris 11 tail behavior --- update.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/update.sh b/update.sh index d42cd5867c..0c1a74940a 100755 --- a/update.sh +++ b/update.sh @@ -18,7 +18,7 @@ set +e tag=`git describe --exact-match --tags HEAD 2>/dev/null` is_tag=$? # adjust for 9 hour time delta between trees -release_ts=$((`git show -s --format=%ct $tag|tail -n1` + 32400)) +release_ts=$((`git show -s --format=%ct $tag|tail -1` + 32400)) commit=`git -C openbsd rev-list -n 1 --before=$release_ts $openbsd_branch` git -C openbsd fetch if [ $is_tag -eq 0 ]; then From 4aa76421303aaddbae7da8cf76549d5c0f1419be Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 6 Jul 2023 11:06:25 +0300 Subject: [PATCH 0358/1283] update endian compatibility shim Prefer function-like macros where possible, some style tweaks, and add Solaris support. --- include/compat/endian.h | 54 +++++++++++++++++++++++++++-------------- 1 file changed, 36 insertions(+), 18 deletions(-) diff --git a/include/compat/endian.h b/include/compat/endian.h index d9f7eb2af7..928affe90c 100644 --- a/include/compat/endian.h +++ b/include/compat/endian.h @@ -8,9 +8,9 @@ #if defined(_WIN32) -#define LITTLE_ENDIAN 1234 +#define LITTLE_ENDIAN 1234 #define BIG_ENDIAN 4321 -#define PDP_ENDIAN 3412 +#define PDP_ENDIAN 3412 /* * Use GCC and Visual Studio compiler defines to determine endian. @@ -28,8 +28,8 @@ #include_next #elif defined(__sun) || defined(_AIX) || defined(__hpux) -#include #include +#include #elif defined(__sgi) #include @@ -39,10 +39,9 @@ #ifndef __STRICT_ALIGNMENT #define __STRICT_ALIGNMENT -#if defined(__i386) || defined(__i386__) || \ - defined(__x86_64) || defined(__x86_64__) || \ - defined(__s390__) || defined(__s390x__) || \ - defined(__aarch64__) || \ +#if defined(__i386) || defined(__i386__) || defined(__x86_64) || \ + defined(__x86_64__) || defined(__s390__) || defined(__s390x__) || \ + defined(__aarch64__) || \ ((defined(__arm__) || defined(__arm)) && __ARM_ARCH >= 6) #undef __STRICT_ALIGNMENT #endif @@ -70,10 +69,16 @@ #define be64toh(x) ntohll((x)) #if !defined(ntohll) -#define ntohll(x) ((1==htonl(1)) ? (x) : ((uint64_t)ntohl((x) & 0xFFFFFFFF) << 32) | ntohl((x) >> 32)) +#define ntohll(x) \ + ((1 == htonl(1)) \ + ? (x) \ + : ((uint64_t)ntohl((x)&0xFFFFFFFF) << 32) | ntohl((x) >> 32)) #endif #if !defined(htonll) -#define htonll(x) ((1==ntohl(1)) ? (x) : ((uint64_t)htonl((x) & 0xFFFFFFFF) << 32) | htonl((x) >> 32)) +#define htonll(x) \ + ((1 == ntohl(1)) \ + ? (x) \ + : ((uint64_t)htonl((x)&0xFFFFFFFF) << 32) | htonl((x) >> 32)) #endif #define htobe64(x) ntohll((x)) @@ -81,13 +86,13 @@ #ifdef __linux__ #if !defined(betoh16) -#define betoh16 be16toh +#define betoh16(x) be16toh(x) #endif #if !defined(betoh32) -#define betoh32 be32toh +#define betoh32(x) be32toh(x) #endif #if !defined(betoh64) -#define betoh64 be64toh +#define betoh64(x) be64toh(x) #endif #endif /* __linux__ */ @@ -96,26 +101,39 @@ #include #endif #if !defined(betoh16) -#define betoh16 be16toh +#define betoh16(x) be16toh(x) #endif #if !defined(betoh32) -#define betoh32 be32toh +#define betoh32(x) be32toh(x) #endif #if !defined(betoh64) -#define betoh64 be64toh +#define betoh64(x) be64toh(x) #endif #endif #if defined(__NetBSD__) #if !defined(betoh16) -#define betoh16 be16toh +#define betoh16(x) be16toh(x) #endif #if !defined(betoh32) -#define betoh32 be32toh +#define betoh32(x) be32toh(x) #endif #if !defined(betoh64) -#define betoh64 be64toh +#define betoh64(x) be64toh(x) #endif #endif +#if defined(__sun) +#include +#define be16toh(x) BE_IN16(x) +#define betoh16(x) BE_IN16(x) +#define htobe16(x) BE_16(x) +#define be32toh(x) BE_IN32(x) +#define betoh32(x) BE_IN32(x) +#define htobe32(x) BE_32(x) +#define be64toh(x) BE_IN64(x) +#define betoh64(x) BE_IN64(x) +#define htobe64(x) BE_64(x) +#endif + #endif From afcd4be8a72abcae003f1760eea407cf3db5e14e Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 6 Jul 2023 20:32:34 +0300 Subject: [PATCH 0359/1283] change socket / file descriptor checks on windows based on discussion in https://github.com/libressl/portable/issues/266 and https://bugs.python.org/issue23524 adjust the compat layer for Windows to use _get_osfhandle in combination with _set_thread_local_invalid_parameter_handler if applicable to more reliably determine if a handle is a socket, file, or closed socket. This prevents assertions when calling tls_close on an already-closed socket. --- CMakeLists.txt | 2 +- crypto/compat/posix_win.c | 125 ++++++++++++++++++++++++++++++-------- 2 files changed, 102 insertions(+), 25 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index b8863c4453..02699d08ec 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -121,7 +121,7 @@ if(WIN32) if(NOT CMAKE_SYSTEM_NAME MATCHES "WindowsStore") add_definitions(-D_WIN32_WINNT=0x0600) endif() - set(PLATFORM_LIBS ${PLATFORM_LIBS} ws2_32 bcrypt) + set(PLATFORM_LIBS ${PLATFORM_LIBS} ws2_32 ntdll bcrypt) endif() if(MSVC) diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index 30c93cd126..cea73e9d28 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -148,6 +148,61 @@ wsa_errno(int err) return -1; } +/* + * Employ a similar trick to cpython (pycore_fileutils.h) where the CRT report + * handler is disabled while checking if a descriptor is a socket or a file + */ +#if defined _MSC_VER && _MSC_VER >= 1900 + +#include +#include + +typedef void (*_invalid_parameter_handler)( + const wchar_t * expression, + const wchar_t * function, + const wchar_t * file, + unsigned int line, + uintptr_t pReserved +); + +extern _invalid_parameter_handler _set_thread_local_invalid_parameter_handler( + _invalid_parameter_handler pNew +); + +static void noop_handler(const wchar_t *expression, const wchar_t *function, + const wchar_t *file, unsigned int line, uintptr_t pReserved) +{ + return; +} + +#define BEGIN_SUPPRESS_IPH \ + _invalid_parameter_handler old_handler = _set_thread_local_invalid_parameter_handler(noop_handler) +#define END_SUPPRESS_IPH \ + _set_thread_local_invalid_parameter_handler(old_handler) + +#else + +#define BEGIN_SUPPRESS_IPH +#define END_SUPPRESS_IPH + +#endif + +static int +is_socket(int fd) +{ + intptr_t hd; + + BEGIN_SUPPRESS_IPH; + hd = _get_osfhandle(fd); + END_SUPPRESS_IPH; + + if (hd == (intptr_t)INVALID_HANDLE_VALUE) { + return 1; /* fd is not file descriptor */ + } + + return 0; +} + int posix_connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen) { @@ -160,24 +215,31 @@ posix_connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen) int posix_close(int fd) { - if (closesocket(fd) == SOCKET_ERROR) { - int err = WSAGetLastError(); - return (err == WSAENOTSOCK || err == WSAEBADF || - err == WSANOTINITIALISED) ? - close(fd) : wsa_errno(err); + int rc; + + if (is_socket(fd)) { + if ((rc = closesocket(fd)) == SOCKET_ERROR) { + int err = WSAGetLastError(); + rc = wsa_errno(err); + } + } else { + rc = close(fd); } - return 0; + return rc; } ssize_t posix_read(int fd, void *buf, size_t count) { - ssize_t rc = recv(fd, buf, count, 0); - if (rc == SOCKET_ERROR) { - int err = WSAGetLastError(); - return (err == WSAENOTSOCK || err == WSAEBADF || - err == WSANOTINITIALISED) ? - read(fd, buf, count) : wsa_errno(err); + ssize_t rc; + + if (is_socket(fd)) { + if ((rc = recv(fd, buf, count, 0)) == SOCKET_ERROR) { + int err = WSAGetLastError(); + rc = wsa_errno(err); + } + } else { + rc = read(fd, buf, count); } return rc; } @@ -185,12 +247,13 @@ posix_read(int fd, void *buf, size_t count) ssize_t posix_write(int fd, const void *buf, size_t count) { - ssize_t rc = send(fd, buf, count, 0); - if (rc == SOCKET_ERROR) { - int err = WSAGetLastError(); - return (err == WSAENOTSOCK || err == WSAEBADF || - err == WSANOTINITIALISED) ? - write(fd, buf, count) : wsa_errno(err); + ssize_t rc; + if (is_socket(fd)) { + if ((rc = send(fd, buf, count, 0)) == SOCKET_ERROR) { + rc = wsa_errno(WSAGetLastError()); + } + } else { + rc = write(fd, buf, count); } return rc; } @@ -199,17 +262,32 @@ int posix_getsockopt(int sockfd, int level, int optname, void *optval, socklen_t *optlen) { - int rc = getsockopt(sockfd, level, optname, (char *)optval, optlen); - return rc == 0 ? 0 : wsa_errno(WSAGetLastError()); - + int rc; + if (is_socket(sockfd)) { + rc = getsockopt(sockfd, level, optname, (char *)optval, optlen); + if (rc == 0) { + rc = wsa_errno(WSAGetLastError()); + } + } else { + rc = -1; + } + return rc; } int posix_setsockopt(int sockfd, int level, int optname, const void *optval, socklen_t optlen) { - int rc = setsockopt(sockfd, level, optname, (char *)optval, optlen); - return rc == 0 ? 0 : wsa_errno(WSAGetLastError()); + int rc; + if (is_socket(sockfd)) { + rc = setsockopt(sockfd, level, optname, (char *)optval, optlen); + if (rc == 0) { + rc = wsa_errno(WSAGetLastError()); + } + } else { + rc = -1; + } + return rc; } uid_t getuid(void) @@ -241,5 +319,4 @@ int gettimeofday(struct timeval * tp, struct timezone * tzp) tp->tv_usec = (long)(system_time.wMilliseconds * 1000); return 0; } - #endif From f75c00226cdae7a42b4ce30ee794ed6f8bc660cd Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 6 Jul 2023 20:53:12 +0300 Subject: [PATCH 0360/1283] remove unneeded extern since we're not trying to hack this into mingw-w64 --- crypto/compat/posix_win.c | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index cea73e9d28..3f8b5f9ed1 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -157,18 +157,6 @@ wsa_errno(int err) #include #include -typedef void (*_invalid_parameter_handler)( - const wchar_t * expression, - const wchar_t * function, - const wchar_t * file, - unsigned int line, - uintptr_t pReserved -); - -extern _invalid_parameter_handler _set_thread_local_invalid_parameter_handler( - _invalid_parameter_handler pNew -); - static void noop_handler(const wchar_t *expression, const wchar_t *function, const wchar_t *file, unsigned int line, uintptr_t pReserved) { From c9b18cb296c0f43d56b9dc9c1e05b57fc780c798 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 6 Jul 2023 22:05:06 +0300 Subject: [PATCH 0361/1283] fix get/setsockopt reversed logic --- crypto/compat/posix_win.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index 3f8b5f9ed1..b3a4687212 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -253,7 +253,7 @@ posix_getsockopt(int sockfd, int level, int optname, int rc; if (is_socket(sockfd)) { rc = getsockopt(sockfd, level, optname, (char *)optval, optlen); - if (rc == 0) { + if (rc != 0) { rc = wsa_errno(WSAGetLastError()); } } else { @@ -269,7 +269,7 @@ posix_setsockopt(int sockfd, int level, int optname, int rc; if (is_socket(sockfd)) { rc = setsockopt(sockfd, level, optname, (char *)optval, optlen); - if (rc == 0) { + if (rc != 0) { rc = wsa_errno(WSAGetLastError()); } } else { From f331e071bb5356297e7473466bbc7b0747912553 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 6 Jul 2023 12:13:39 +0300 Subject: [PATCH 0362/1283] initial solaris test workflow This adds a builder for Solaris 11.4 based on https://github.com/vmactions/solaris-vm --- .github/workflows/solaris_test.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 .github/workflows/solaris_test.yml diff --git a/.github/workflows/solaris_test.yml b/.github/workflows/solaris_test.yml new file mode 100644 index 0000000000..091d8faaeb --- /dev/null +++ b/.github/workflows/solaris_test.yml @@ -0,0 +1,27 @@ +name: solaris_ci + +on: [push] + +jobs: + build-native: + strategy: + matrix: + release: [11.4] + runs-on: macos-12 + continue-on-error: false + name: Solaris ${{ matrix.release }} + steps: + - name: Checkout source + uses: actions/checkout@main + - name: Configure source + run: | + brew install automake autoconf libtool + ./autogen.sh + - name: Build on VM + uses: vmactions/solaris-vm@v0 + with: + prepare: | + pkg install gcc make + run: | + MAKE=gmake ./configure + gmake -j2 check From e1d6f782966399be59a0c15deb051f8f11fa6ebd Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 7 Jul 2023 08:34:16 +0300 Subject: [PATCH 0363/1283] change the trigger for running fuzzer tests Since fuzzers benefit more from being run regularly on the openbsd tree, and they take a long time, does it make more sense that the trigger is a cron like the Coverity job? They sometimes don't work in branches anyway, since the fuzz builds rely on external code being updated to match the master branch. --- .github/workflows/cifuzz.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 8c25624cd2..bdb3b2c0f0 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -1,5 +1,10 @@ name: CIFuzz -on: [pull_request] + +on: + workflow_dispatch: + schedule: + - cron: "0 0 * * *" + jobs: Fuzzing: runs-on: ubuntu-latest From 990fd347ee8b60c4a0fefc4272c7b76befdfd74a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 7 Jul 2023 10:13:19 +0200 Subject: [PATCH 0364/1283] Add hidden ts.h --- crypto/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index cf611a20b1..b4d558bd5f 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -729,6 +729,7 @@ noinst_HEADERS += hidden/openssl/hmac.h noinst_HEADERS += hidden/openssl/pkcs12.h noinst_HEADERS += hidden/openssl/pkcs7.h noinst_HEADERS += hidden/openssl/stack.h +noinst_HEADERS += hidden/openssl/ts.h noinst_HEADERS += hidden/openssl/ui.h noinst_HEADERS += hidden/openssl/x509.h noinst_HEADERS += hidden/openssl/x509_vfy.h From e06ce19f9531240fa4e754197850184dbcd445fc Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 7 Jul 2023 10:14:29 +0200 Subject: [PATCH 0365/1283] hook bn_print to build --- ChangeLog | 1 + crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 5 files changed, 13 insertions(+) diff --git a/ChangeLog b/ChangeLog index 9a797ba175..3c90f4ff24 100644 --- a/ChangeLog +++ b/ChangeLog @@ -51,6 +51,7 @@ LibreSSL Portable Release Notes: - Removed EC_GROUP precomp machinery. - Ensure no X.509v3 extensions appear more than once in certificates. - Cleaned up various ECDH, ECDSA and EC internals. + - Replaced ASN1_bn_print with a cleaner internal implementation. * New features * Compatibility changes - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 302352b8ec..0c86dd4940 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -365,6 +365,7 @@ set( bn/bn_mul.c bn/bn_prime.c bn/bn_primitives.c + bn/bn_print.c bn/bn_rand.c bn/bn_recp.c bn/bn_shift.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index b4d558bd5f..60e9c0074a 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -366,6 +366,7 @@ libcrypto_la_SOURCES += bn/bn_mont.c libcrypto_la_SOURCES += bn/bn_mul.c libcrypto_la_SOURCES += bn/bn_prime.c libcrypto_la_SOURCES += bn/bn_primitives.c +libcrypto_la_SOURCES += bn/bn_print.c libcrypto_la_SOURCES += bn/bn_rand.c libcrypto_la_SOURCES += bn/bn_recp.c libcrypto_la_SOURCES += bn/bn_shift.c diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 9edb613c59..cefba2e860 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -198,6 +198,11 @@ add_executable(bn_primes bn_primes.c) target_link_libraries(bn_primes ${OPENSSL_TEST_LIBS}) add_test(bn_primes bn_primes) +# bn_print +add_executable(bn_print bn_print.c) +target_link_libraries(bn_print ${OPENSSL_TEST_LIBS}) +add_test(bn_print bn_print) + # bn_rand_interval add_executable(bn_rand_interval bn_rand_interval.c) target_link_libraries(bn_rand_interval ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 70371d3d3e..646c927b44 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -213,6 +213,11 @@ TESTS += bn_primes check_PROGRAMS += bn_primes bn_primes_SOURCES = bn_primes.c +# bn_print +TESTS += bn_print +check_PROGRAMS += bn_print +bn_print_SOURCES = bn_print.c + # bn_rand_interval TESTS += bn_rand_interval check_PROGRAMS += bn_rand_interval From 7463f87cf1c3b8494a604976a8f818b07747b55e Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 7 Jul 2023 11:46:21 +0300 Subject: [PATCH 0366/1283] add compat getopt implementation, remove patches This adds a getopt implementation for compatibility where it is not available, removing a couple of regress patches. Note, this is a slightly modified copy from OpenBSD libc that doesn't expose getopt_long, which has dependency conflicts with Windows system headers and isn't needed anyway. --- CMakeLists.txt | 5 + crypto/CMakeLists.txt | 5 + crypto/compat/getopt_long.c | 528 ++++++++++++++++++++++++++++++++ include/compat/getopt.h | 50 +++ include/compat/unistd.h | 4 + m4/check-libc.m4 | 3 +- patches/bn_isqrt.c.patch | 18 -- patches/handshake_table.c.patch | 18 -- 8 files changed, 594 insertions(+), 37 deletions(-) create mode 100644 crypto/compat/getopt_long.c create mode 100644 include/compat/getopt.h delete mode 100644 patches/bn_isqrt.c.patch delete mode 100644 patches/handshake_table.c.patch diff --git a/CMakeLists.txt b/CMakeLists.txt index b8863c4453..6f0d5cc967 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -176,6 +176,11 @@ if(HAVE_ASPRINTF) add_definitions(-DHAVE_ASPRINTF) endif() +check_function_exists(getopt HAVE_GETOPT) +if(HAVE_GETOPT) + add_definitions(-DHAVE_GETOPT) +endif() + check_function_exists(reallocarray HAVE_REALLOCARRAY) if(HAVE_REALLOCARRAY) add_definitions(-DHAVE_REALLOCARRAY) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 0c86dd4940..3fb2285b1e 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -818,6 +818,11 @@ if(NOT HAVE_FREEZERO) set(EXTRA_EXPORT ${EXTRA_EXPORT} freezero) endif() +if(NOT HAVE_GETOPT) + set(CRYPTO_SRC ${CRYPTO_SRC} compat/getopt_long.c) + set(EXTRA_EXPORT ${EXTRA_EXPORT} getopt) +endif() + if(NOT HAVE_GETPAGESIZE) set(CRYPTO_SRC ${CRYPTO_SRC} compat/getpagesize.c) endif() diff --git a/crypto/compat/getopt_long.c b/crypto/compat/getopt_long.c new file mode 100644 index 0000000000..546c541b4c --- /dev/null +++ b/crypto/compat/getopt_long.c @@ -0,0 +1,528 @@ +/* $OpenBSD: getopt_long.c,v 1.32 2020/05/27 22:25:09 schwarze Exp $ */ +/* $NetBSD: getopt_long.c,v 1.15 2002/01/31 22:43:40 tv Exp $ */ + +/* + * Copyright (c) 2002 Todd C. Miller + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + * + * Sponsored in part by the Defense Advanced Research Projects + * Agency (DARPA) and Air Force Research Laboratory, Air Force + * Materiel Command, USAF, under agreement number F39502-99-1-0512. + */ +/*- + * Copyright (c) 2000 The NetBSD Foundation, Inc. + * All rights reserved. + * + * This code is derived from software contributed to The NetBSD Foundation + * by Dieter Baron and Thomas Klausner. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS + * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS + * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +#include +#include +#include +#include +#include + +#define no_argument 0 +#define required_argument 1 +#define optional_argument 2 + +struct option { + /* name of long option */ + const char *name; + /* + * one of no_argument, required_argument, and optional_argument: + * whether option takes an argument + */ + int has_arg; + /* if not NULL, set *flag to val when option found */ + int *flag; + /* if flag not NULL, value to set *flag to; else return value */ + int val; +}; + +int opterr = 1; /* if error message should be printed */ +int optind = 1; /* index into parent argv vector */ +int optopt = '?'; /* character checked for validity */ +int optreset; /* reset getopt */ +char *optarg; /* argument associated with option */ + +#if 0 +/* DEF_* only work on initialized (non-COMMON) variables */ +#endif + +#define PRINT_ERROR ((opterr) && (*options != ':')) + +#define FLAG_PERMUTE 0x01 /* permute non-options to the end of argv */ +#define FLAG_ALLARGS 0x02 /* treat non-options as args to option "-1" */ +#define FLAG_LONGONLY 0x04 /* operate as getopt_long_only */ + +/* return values */ +#define BADCH (int)'?' +#define BADARG ((*options == ':') ? (int)':' : (int)'?') +#define INORDER (int)1 + +#define EMSG "" + +static int getopt_internal(int, char * const *, const char *, + const struct option *, int *, int); +static int parse_long_options(char * const *, const char *, + const struct option *, int *, int, int); +static int gcd(int, int); +static void permute_args(int, int, int, char * const *); + +static char *place = EMSG; /* option letter processing */ + +/* XXX: set optreset to 1 rather than these two */ +static int nonopt_start = -1; /* first non option argument (for permute) */ +static int nonopt_end = -1; /* first option after non options (for permute) */ + +/* Error messages */ +static const char recargchar[] = "option requires an argument -- %c"; +static const char recargstring[] = "option requires an argument -- %s"; +static const char ambig[] = "ambiguous option -- %.*s"; +static const char noarg[] = "option doesn't take an argument -- %.*s"; +static const char illoptchar[] = "unknown option -- %c"; +static const char illoptstring[] = "unknown option -- %s"; + +/* + * Compute the greatest common divisor of a and b. + */ +static int +gcd(int a, int b) +{ + int c; + + c = a % b; + while (c != 0) { + a = b; + b = c; + c = a % b; + } + + return (b); +} + +/* + * Exchange the block from nonopt_start to nonopt_end with the block + * from nonopt_end to opt_end (keeping the same order of arguments + * in each block). + */ +static void +permute_args(int panonopt_start, int panonopt_end, int opt_end, + char * const *nargv) +{ + int cstart, cyclelen, i, j, ncycle, nnonopts, nopts, pos; + char *swap; + + /* + * compute lengths of blocks and number and size of cycles + */ + nnonopts = panonopt_end - panonopt_start; + nopts = opt_end - panonopt_end; + ncycle = gcd(nnonopts, nopts); + cyclelen = (opt_end - panonopt_start) / ncycle; + + for (i = 0; i < ncycle; i++) { + cstart = panonopt_end+i; + pos = cstart; + for (j = 0; j < cyclelen; j++) { + if (pos >= panonopt_end) + pos -= nnonopts; + else + pos += nopts; + swap = nargv[pos]; + ((char **)nargv)[pos] = nargv[cstart]; + ((char **)nargv)[cstart] = swap; + } + } +} + +/* + * parse_long_options -- + * Parse long options in argc/argv argument vector. + * Returns -1 if short_too is set and the option does not match long_options. + */ +static int +parse_long_options(char * const *nargv, const char *options, + const struct option *long_options, int *idx, int short_too, int flags) +{ + char *current_argv, *has_equal; + size_t current_argv_len; + int i, match, exact_match, second_partial_match; + + current_argv = place; + match = -1; + exact_match = 0; + second_partial_match = 0; + + optind++; + + if ((has_equal = strchr(current_argv, '=')) != NULL) { + /* argument found (--option=arg) */ + current_argv_len = has_equal - current_argv; + has_equal++; + } else + current_argv_len = strlen(current_argv); + + for (i = 0; long_options[i].name; i++) { + /* find matching long option */ + if (strncmp(current_argv, long_options[i].name, + current_argv_len)) + continue; + + if (strlen(long_options[i].name) == current_argv_len) { + /* exact match */ + match = i; + exact_match = 1; + break; + } + /* + * If this is a known short option, don't allow + * a partial match of a single character. + */ + if (short_too && current_argv_len == 1) + continue; + + if (match == -1) /* first partial match */ + match = i; + else if ((flags & FLAG_LONGONLY) || + long_options[i].has_arg != long_options[match].has_arg || + long_options[i].flag != long_options[match].flag || + long_options[i].val != long_options[match].val) + second_partial_match = 1; + } + if (!exact_match && second_partial_match) { + /* ambiguous abbreviation */ + if (PRINT_ERROR) + warnx(ambig, (int)current_argv_len, current_argv); + optopt = 0; + return (BADCH); + } + if (match != -1) { /* option found */ + if (long_options[match].has_arg == no_argument + && has_equal) { + if (PRINT_ERROR) + warnx(noarg, (int)current_argv_len, + current_argv); + /* + * XXX: GNU sets optopt to val regardless of flag + */ + if (long_options[match].flag == NULL) + optopt = long_options[match].val; + else + optopt = 0; + return (BADARG); + } + if (long_options[match].has_arg == required_argument || + long_options[match].has_arg == optional_argument) { + if (has_equal) + optarg = has_equal; + else if (long_options[match].has_arg == + required_argument) { + /* + * optional argument doesn't use next nargv + */ + optarg = nargv[optind++]; + } + } + if ((long_options[match].has_arg == required_argument) + && (optarg == NULL)) { + /* + * Missing argument; leading ':' indicates no error + * should be generated. + */ + if (PRINT_ERROR) + warnx(recargstring, + current_argv); + /* + * XXX: GNU sets optopt to val regardless of flag + */ + if (long_options[match].flag == NULL) + optopt = long_options[match].val; + else + optopt = 0; + --optind; + return (BADARG); + } + } else { /* unknown option */ + if (short_too) { + --optind; + return (-1); + } + if (PRINT_ERROR) + warnx(illoptstring, current_argv); + optopt = 0; + return (BADCH); + } + if (idx) + *idx = match; + if (long_options[match].flag) { + *long_options[match].flag = long_options[match].val; + return (0); + } else + return (long_options[match].val); +} + +/* + * getopt_internal -- + * Parse argc/argv argument vector. Called by user level routines. + */ +static int +getopt_internal(int nargc, char * const *nargv, const char *options, + const struct option *long_options, int *idx, int flags) +{ + char *oli; /* option letter list index */ + int optchar, short_too; + static int posixly_correct = -1; + + if (options == NULL) + return (-1); + + /* + * XXX Some GNU programs (like cvs) set optind to 0 instead of + * XXX using optreset. Work around this braindamage. + */ + if (optind == 0) + optind = optreset = 1; + + /* + * Disable GNU extensions if POSIXLY_CORRECT is set or options + * string begins with a '+'. + */ + if (posixly_correct == -1 || optreset) + posixly_correct = (getenv("POSIXLY_CORRECT") != NULL); + if (*options == '-') + flags |= FLAG_ALLARGS; + else if (posixly_correct || *options == '+') + flags &= ~FLAG_PERMUTE; + if (*options == '+' || *options == '-') + options++; + + optarg = NULL; + if (optreset) + nonopt_start = nonopt_end = -1; +start: + if (optreset || !*place) { /* update scanning pointer */ + optreset = 0; + if (optind >= nargc) { /* end of argument vector */ + place = EMSG; + if (nonopt_end != -1) { + /* do permutation, if we have to */ + permute_args(nonopt_start, nonopt_end, + optind, nargv); + optind -= nonopt_end - nonopt_start; + } + else if (nonopt_start != -1) { + /* + * If we skipped non-options, set optind + * to the first of them. + */ + optind = nonopt_start; + } + nonopt_start = nonopt_end = -1; + return (-1); + } + if (*(place = nargv[optind]) != '-' || + (place[1] == '\0' && strchr(options, '-') == NULL)) { + place = EMSG; /* found non-option */ + if (flags & FLAG_ALLARGS) { + /* + * GNU extension: + * return non-option as argument to option 1 + */ + optarg = nargv[optind++]; + return (INORDER); + } + if (!(flags & FLAG_PERMUTE)) { + /* + * If no permutation wanted, stop parsing + * at first non-option. + */ + return (-1); + } + /* do permutation */ + if (nonopt_start == -1) + nonopt_start = optind; + else if (nonopt_end != -1) { + permute_args(nonopt_start, nonopt_end, + optind, nargv); + nonopt_start = optind - + (nonopt_end - nonopt_start); + nonopt_end = -1; + } + optind++; + /* process next argument */ + goto start; + } + if (nonopt_start != -1 && nonopt_end == -1) + nonopt_end = optind; + + /* + * If we have "-" do nothing, if "--" we are done. + */ + if (place[1] != '\0' && *++place == '-' && place[1] == '\0') { + optind++; + place = EMSG; + /* + * We found an option (--), so if we skipped + * non-options, we have to permute. + */ + if (nonopt_end != -1) { + permute_args(nonopt_start, nonopt_end, + optind, nargv); + optind -= nonopt_end - nonopt_start; + } + nonopt_start = nonopt_end = -1; + return (-1); + } + } + + /* + * Check long options if: + * 1) we were passed some + * 2) the arg is not just "-" + * 3) either the arg starts with -- we are getopt_long_only() + */ + if (long_options != NULL && place != nargv[optind] && + (*place == '-' || (flags & FLAG_LONGONLY))) { + short_too = 0; + if (*place == '-') + place++; /* --foo long option */ + else if (*place != ':' && strchr(options, *place) != NULL) + short_too = 1; /* could be short option too */ + + optchar = parse_long_options(nargv, options, long_options, + idx, short_too, flags); + if (optchar != -1) { + place = EMSG; + return (optchar); + } + } + + if ((optchar = (int)*place++) == (int)':' || + (oli = strchr(options, optchar)) == NULL) { + if (!*place) + ++optind; + if (PRINT_ERROR) + warnx(illoptchar, optchar); + optopt = optchar; + return (BADCH); + } + if (long_options != NULL && optchar == 'W' && oli[1] == ';') { + /* -W long-option */ + if (*place) /* no space */ + /* NOTHING */; + else if (++optind >= nargc) { /* no arg */ + place = EMSG; + if (PRINT_ERROR) + warnx(recargchar, optchar); + optopt = optchar; + return (BADARG); + } else /* white space */ + place = nargv[optind]; + optchar = parse_long_options(nargv, options, long_options, + idx, 0, flags); + place = EMSG; + return (optchar); + } + if (*++oli != ':') { /* doesn't take argument */ + if (!*place) + ++optind; + } else { /* takes (optional) argument */ + optarg = NULL; + if (*place) /* no white space */ + optarg = place; + else if (oli[1] != ':') { /* arg not optional */ + if (++optind >= nargc) { /* no arg */ + place = EMSG; + if (PRINT_ERROR) + warnx(recargchar, optchar); + optopt = optchar; + return (BADARG); + } else + optarg = nargv[optind]; + } + place = EMSG; + ++optind; + } + /* dump back option letter */ + return (optchar); +} + +/* + * getopt -- + * Parse argc/argv argument vector. + */ +int +getopt(int nargc, char * const *nargv, const char *options) +{ + + /* + * We don't pass FLAG_PERMUTE to getopt_internal() since + * the BSD getopt(3) (unlike GNU) has never done this. + * + * Furthermore, since many privileged programs call getopt() + * before dropping privileges it makes sense to keep things + * as simple (and bug-free) as possible. + */ + return (getopt_internal(nargc, nargv, options, NULL, NULL, 0)); +} + +/* + * getopt_long -- + * Parse argc/argv argument vector. + */ +int +getopt_long(int nargc, char * const *nargv, const char *options, + const struct option *long_options, int *idx) +{ + + return (getopt_internal(nargc, nargv, options, long_options, idx, + FLAG_PERMUTE)); +} + +/* + * getopt_long_only -- + * Parse argc/argv argument vector. + */ +int +getopt_long_only(int nargc, char * const *nargv, const char *options, + const struct option *long_options, int *idx) +{ + + return (getopt_internal(nargc, nargv, options, long_options, idx, + FLAG_PERMUTE|FLAG_LONGONLY)); +} diff --git a/include/compat/getopt.h b/include/compat/getopt.h new file mode 100644 index 0000000000..8cc3207f38 --- /dev/null +++ b/include/compat/getopt.h @@ -0,0 +1,50 @@ +/* $OpenBSD: getopt.h,v 1.3 2013/11/22 21:32:49 millert Exp $ */ +/* $NetBSD: getopt.h,v 1.4 2000/07/07 10:43:54 ad Exp $ */ + +/*- + * Copyright (c) 2000 The NetBSD Foundation, Inc. + * All rights reserved. + * + * This code is derived from software contributed to The NetBSD Foundation + * by Dieter Baron and Thomas Klausner. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS + * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS + * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +#ifdef HAVE_GETOPT + +#include_next + +#else + +#ifndef _GETOPT_DEFINED_ +#define _GETOPT_DEFINED_ +int getopt(int, char * const *, const char *); + +extern char *optarg; /* getopt(3) external variables */ +extern int opterr; +extern int optind; +extern int optopt; +extern int optreset; +#endif + +#endif /* HAVE_GETOPT */ diff --git a/include/compat/unistd.h b/include/compat/unistd.h index 5e6ab1d8b3..2583a6eae3 100644 --- a/include/compat/unistd.h +++ b/include/compat/unistd.h @@ -64,6 +64,10 @@ int getentropy(void *buf, size_t buflen); #endif #endif +#ifndef HAVE_GETOPT +#include +#endif + #ifndef HAVE_GETPAGESIZE int getpagesize(void); #endif diff --git a/m4/check-libc.m4 b/m4/check-libc.m4 index 68a4f88e4b..dc8d6bd7c8 100644 --- a/m4/check-libc.m4 +++ b/m4/check-libc.m4 @@ -11,7 +11,7 @@ AC_CHECK_FUNCS([asprintf freezero memmem]) AC_CHECK_FUNCS([readpassphrase reallocarray recallocarray]) AC_CHECK_FUNCS([strlcat strlcpy strndup strnlen strsep strtonum]) AC_CHECK_FUNCS([timegm _mkgmtime timespecsub]) -AC_CHECK_FUNCS([getprogname syslog syslog_r]) +AC_CHECK_FUNCS([getopt getprogname syslog syslog_r]) AC_CACHE_CHECK([for getpagesize], ac_cv_func_getpagesize, [ AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include @@ -25,6 +25,7 @@ AC_CACHE_CHECK([for getpagesize], ac_cv_func_getpagesize, [ AM_CONDITIONAL([HAVE_ASPRINTF], [test "x$ac_cv_func_asprintf" = xyes]) AM_CONDITIONAL([HAVE_FREEZERO], [test "x$ac_cv_func_freezero" = xyes]) AM_CONDITIONAL([HAVE_GETPAGESIZE], [test "x$ac_cv_func_getpagesize" = xyes]) +AM_CONDITIONAL([HAVE_GETOPT], [test "x$ac_cv_func_getopt" = xyes]) AM_CONDITIONAL([HAVE_MEMMEM], [test "x$ac_cv_func_memmem" = xyes]) AM_CONDITIONAL([HAVE_READPASSPHRASE], [test "x$ac_cv_func_readpassphrase" = xyes]) AM_CONDITIONAL([HAVE_REALLOCARRAY], [test "x$ac_cv_func_reallocarray" = xyes]) diff --git a/patches/bn_isqrt.c.patch b/patches/bn_isqrt.c.patch deleted file mode 100644 index 5f2a568d87..0000000000 --- a/patches/bn_isqrt.c.patch +++ /dev/null @@ -1,18 +0,0 @@ ---- tests/bn_isqrt.c.orig Fri Dec 9 11:05:26 2022 -+++ tests/bn_isqrt.c Fri Dec 9 11:12:37 2022 -@@ -306,6 +306,7 @@ main(int argc, char *argv[]) - int ch; - int failed = 0, print = 0; - -+#ifndef _MSC_VER - while ((ch = getopt(argc, argv, "C")) != -1) { - switch (ch) { - case 'C': -@@ -316,6 +317,7 @@ main(int argc, char *argv[]) - break; - } - } -+#endif - - if (print) - return check_tables(1); diff --git a/patches/handshake_table.c.patch b/patches/handshake_table.c.patch deleted file mode 100644 index f3a40044ea..0000000000 --- a/patches/handshake_table.c.patch +++ /dev/null @@ -1,18 +0,0 @@ ---- tests/handshake_table.c.orig Tue Mar 15 11:37:03 2022 -+++ tests/handshake_table.c Mon Mar 21 05:26:15 2022 -@@ -518,6 +518,7 @@ - unsigned int depth = 0; - int ch, graphviz = 0, print = 0; - -+#ifndef _MSC_VER - while ((ch = getopt(argc, argv, "Cg")) != -1) { - switch (ch) { - case 'C': -@@ -535,6 +536,7 @@ - - if (argc != 0) - usage(); -+#endif - - if (graphviz && print) - usage(); From 6000f4de8f5bead23cce1a5cc1f701bf69e16181 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 7 Jul 2023 03:13:31 -0500 Subject: [PATCH 0367/1283] remove aeadtest patch upstreamed --- patches/aeadtest.c.patch | 15 --------------- 1 file changed, 15 deletions(-) delete mode 100644 patches/aeadtest.c.patch diff --git a/patches/aeadtest.c.patch b/patches/aeadtest.c.patch deleted file mode 100644 index b3fe052411..0000000000 --- a/patches/aeadtest.c.patch +++ /dev/null @@ -1,15 +0,0 @@ ---- tests/aeadtest.c.orig Mon Sep 5 22:30:33 2022 -+++ tests/aeadtest.c Mon Sep 5 23:51:27 2022 -@@ -48,6 +48,12 @@ - - #define BUF_MAX 1024 - -+#ifdef _MSC_VER -+#ifdef IN -+#undef IN -+#endif -+#endif -+ - /* These are the different types of line that are found in the input file. */ - enum { - AEAD = 0, /* name of the AEAD algorithm. */ From de9c24a0254d554251c1fa43738a6f2e70b3ed83 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 7 Jul 2023 04:34:46 -0500 Subject: [PATCH 0368/1283] rename regress to rust regress --- .github/workflows/{regress.yml => rust_regress.yml} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename .github/workflows/{regress.yml => rust_regress.yml} (96%) diff --git a/.github/workflows/regress.yml b/.github/workflows/rust_regress.yml similarity index 96% rename from .github/workflows/regress.yml rename to .github/workflows/rust_regress.yml index 7cc35dc8dc..ef2d80e139 100644 --- a/.github/workflows/regress.yml +++ b/.github/workflows/rust_regress.yml @@ -1,4 +1,4 @@ -name: regress testing +name: rust regress tests on: schedule: From 081cee6207dc01747dd968b06637ab9ee2cdc496 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 7 Jul 2023 15:02:16 +0300 Subject: [PATCH 0369/1283] fixes #681, allow override of library POSTFIX for nested builds --- crypto/CMakeLists.txt | 2 +- ssl/CMakeLists.txt | 2 +- tls/CMakeLists.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 3fb2285b1e..cc597d984a 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -1029,7 +1029,7 @@ add_library(crypto $ empty.c) export_symbol(crypto ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym) target_link_libraries(crypto ${PLATFORM_LIBS}) if (WIN32) - set(CRYPTO_POSTFIX -${CRYPTO_MAJOR_VERSION}) + set(CRYPTO_POSTFIX -${CRYPTO_MAJOR_VERSION} PARENT_SCOPE) endif() set_target_properties(crypto PROPERTIES OUTPUT_NAME crypto${CRYPTO_POSTFIX} diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 88e7bbd2e1..3d5b5df1c5 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -87,7 +87,7 @@ endif() export_symbol(ssl ${CMAKE_CURRENT_SOURCE_DIR}/ssl.sym) target_link_libraries(ssl crypto ${PLATFORM_LIBS}) if (WIN32) - set(SSL_POSTFIX -${SSL_MAJOR_VERSION}) + set(SSL_POSTFIX -${SSL_MAJOR_VERSION} PARENT_SCOPE) endif() set_target_properties(ssl PROPERTIES OUTPUT_NAME ssl${SSL_POSTFIX} diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 5bc6208d82..2a9019214c 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -54,7 +54,7 @@ add_library(tls $ $ export_symbol(tls ${CMAKE_CURRENT_BINARY_DIR}/tls.sym) target_link_libraries(tls ${PLATFORM_LIBS}) if (WIN32) - set(TLS_POSTFIX -${TLS_MAJOR_VERSION}) + set(TLS_POSTFIX -${TLS_MAJOR_VERSION} PARENT_SCOPE) endif() set_target_properties(tls PROPERTIES OUTPUT_NAME tls${TLS_POSTFIX} From 8de5d47868d040f070c0b187ea7130ccb7b043c5 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 7 Jul 2023 15:25:50 +0300 Subject: [PATCH 0370/1283] tweak Windows README --- README.windows | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/README.windows b/README.windows index 1a9b7b5530..4d74a2eba8 100644 --- a/README.windows +++ b/README.windows @@ -55,11 +55,11 @@ cv2pdb to generate Visual Studio and windbg compatible debug files. cv2pdb is a tool developed for the D language and can be found here: https://github.com/rainers/cv2pdb -Pre-built Windows binaries are available with LibreSSL releases if you do not -have a mingw-w64 build environment. Mingw-w64 code is largely, but not 100%, -compatible with code built from Visual Studio. Notably, FILE * pointers cannot -be shared between code built for Mingw-w64 and Visual Studio. +The mingw-w64 code is largely, but not 100%, compatible with code built from +Visual Studio. Notably, FILE * pointers cannot be shared between code built for +Mingw-w64 and Visual Studio. -As of LibreSSL 2.2.2, Visual Studio Native builds can be produced using CMake. -This produces ABI-compatible libraries for linking with native code generated -by Visual Studio. +As of LibreSSL 2.2.2, Visual Studio Native builds can also be produced using +CMake. This produces ABI-compatible libraries for linking with native code +generated by Visual Studio. Currently tested versions are VS 2019 and 2022, +though earlier versions may work as well. From 45b1b1db941f28efaf4bb01e41a3e960202644d6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 7 Jul 2023 06:02:57 -0600 Subject: [PATCH 0371/1283] Add hidden poly1305.h rand.h sm3.h sm4.h --- crypto/Makefile.am | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 60e9c0074a..6dc85fd7d3 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -729,6 +729,10 @@ noinst_HEADERS += hidden/openssl/chacha.h noinst_HEADERS += hidden/openssl/hmac.h noinst_HEADERS += hidden/openssl/pkcs12.h noinst_HEADERS += hidden/openssl/pkcs7.h +noinst_HEADERS += hidden/openssl/poly1305.h +noinst_HEADERS += hidden/openssl/rand.h +noinst_HEADERS += hidden/openssl/sm3.h +noinst_HEADERS += hidden/openssl/sm4.h noinst_HEADERS += hidden/openssl/stack.h noinst_HEADERS += hidden/openssl/ts.h noinst_HEADERS += hidden/openssl/ui.h From e2714304ede187025a54300a87e25573516e301b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 7 Jul 2023 06:43:37 -0600 Subject: [PATCH 0372/1283] Add hidden rc2.h, pem.h, lhash.h --- crypto/Makefile.am | 3 +++ 1 file changed, 3 insertions(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 6dc85fd7d3..409e581f50 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -727,10 +727,13 @@ noinst_HEADERS += hidden/openssl/asn1t.h noinst_HEADERS += hidden/openssl/bio.h noinst_HEADERS += hidden/openssl/chacha.h noinst_HEADERS += hidden/openssl/hmac.h +noinst_HEADERS += hidden/openssl/lhash.h +noinst_HEADERS += hidden/openssl/pem.h noinst_HEADERS += hidden/openssl/pkcs12.h noinst_HEADERS += hidden/openssl/pkcs7.h noinst_HEADERS += hidden/openssl/poly1305.h noinst_HEADERS += hidden/openssl/rand.h +noinst_HEADERS += hidden/openssl/rc2.h noinst_HEADERS += hidden/openssl/sm3.h noinst_HEADERS += hidden/openssl/sm4.h noinst_HEADERS += hidden/openssl/stack.h From f555467a6f0140c0e82241332f2d98125d0ffd88 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 7 Jul 2023 08:39:25 -0600 Subject: [PATCH 0373/1283] Add hidden ec.h, ecdh.h, err.h, evp.h hkdf.h --- crypto/Makefile.am | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 409e581f50..7189fe6262 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -726,6 +726,11 @@ noinst_HEADERS += hidden/openssl/asn1.h noinst_HEADERS += hidden/openssl/asn1t.h noinst_HEADERS += hidden/openssl/bio.h noinst_HEADERS += hidden/openssl/chacha.h +noinst_HEADERS += hidden/openssl/ec.h +noinst_HEADERS += hidden/openssl/ecdsa.h +noinst_HEADERS += hidden/openssl/err.h +noinst_HEADERS += hidden/openssl/evp.h +noinst_HEADERS += hidden/openssl/hkdf.h noinst_HEADERS += hidden/openssl/hmac.h noinst_HEADERS += hidden/openssl/lhash.h noinst_HEADERS += hidden/openssl/pem.h From 56b283e27f84a2f199333827fd809ed73d292a60 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 7 Jul 2023 17:34:38 +0300 Subject: [PATCH 0374/1283] remove Windows lld workaround --- patches/ssl_txt.c.patch | 21 --------------------- 1 file changed, 21 deletions(-) delete mode 100644 patches/ssl_txt.c.patch diff --git a/patches/ssl_txt.c.patch b/patches/ssl_txt.c.patch deleted file mode 100644 index 7439b0d02a..0000000000 --- a/patches/ssl_txt.c.patch +++ /dev/null @@ -1,21 +0,0 @@ ---- ssl/ssl_txt.c.orig Wed Jun 22 11:37:59 2022 -+++ ssl/ssl_txt.c Wed Jun 22 11:37:59 2022 -@@ -82,6 +82,7 @@ - * OTHERWISE. - */ - -+#include - #include - - #include -@@ -174,8 +174,8 @@ - } - - if (x->time != 0) { -- if (BIO_printf(bp, "\n Start Time: %lld", -- (long long)x->time) <= 0) -+ if (BIO_printf(bp, "\n Start Time: %"PRId64, -+ (int64_t)x->time) <= 0) - goto err; - } - From 00fc21e8a7912632591596f18f8631ab02c64895 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 7 Jul 2023 18:28:06 +0300 Subject: [PATCH 0375/1283] Remove hard-coded optimization level in CMake builds Fixes #683. These are not compiler-agnostic, and can interfere with user overrides as well. The defaults in Cmake are reasonable. --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index adfb540883..c5b880b381 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -79,7 +79,7 @@ if(WIN32 OR (CMAKE_SYSTEM_NAME MATCHES "MINGW")) add_definitions(-D__USE_MINGW_ANSI_STDIO) endif() -set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -O2 -Wall") +set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall") if(CMAKE_SYSTEM_NAME MATCHES "HP-UX") if(CMAKE_C_COMPILER MATCHES "gcc") From 64c55e27084cfdd701b322e53b86912c075011e8 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 7 Jul 2023 14:55:15 -0500 Subject: [PATCH 0376/1283] upstreamed ocsp_test --- patches/ocsp_test.c.patch | 14 -------------- 1 file changed, 14 deletions(-) delete mode 100644 patches/ocsp_test.c.patch diff --git a/patches/ocsp_test.c.patch b/patches/ocsp_test.c.patch deleted file mode 100644 index 39f1326780..0000000000 --- a/patches/ocsp_test.c.patch +++ /dev/null @@ -1,14 +0,0 @@ ---- tests/ocsp_test.c.orig 2018-07-24 21:59:17.000000000 -0500 -+++ tests/ocsp_test.c 2018-11-07 18:44:43.000000000 -0600 -@@ -35,6 +35,11 @@ - hints.ai_family = AF_INET; - hints.ai_socktype = SOCK_STREAM; - -+#ifdef _MSC_VER -+ if (BIO_sock_init() != 1) -+ exit(-1); -+#endif -+ - error = getaddrinfo(host, port, &hints, &res); - if (error != 0) { - perror("getaddrinfo()"); From eae1263233443579c47704eb3d46d5996a107557 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 7 Jul 2023 13:42:50 -0600 Subject: [PATCH 0377/1283] Remove hidden sm3.h and evp.h again --- crypto/Makefile.am | 2 -- 1 file changed, 2 deletions(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 7189fe6262..2ef8af177a 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -729,7 +729,6 @@ noinst_HEADERS += hidden/openssl/chacha.h noinst_HEADERS += hidden/openssl/ec.h noinst_HEADERS += hidden/openssl/ecdsa.h noinst_HEADERS += hidden/openssl/err.h -noinst_HEADERS += hidden/openssl/evp.h noinst_HEADERS += hidden/openssl/hkdf.h noinst_HEADERS += hidden/openssl/hmac.h noinst_HEADERS += hidden/openssl/lhash.h @@ -739,7 +738,6 @@ noinst_HEADERS += hidden/openssl/pkcs7.h noinst_HEADERS += hidden/openssl/poly1305.h noinst_HEADERS += hidden/openssl/rand.h noinst_HEADERS += hidden/openssl/rc2.h -noinst_HEADERS += hidden/openssl/sm3.h noinst_HEADERS += hidden/openssl/sm4.h noinst_HEADERS += hidden/openssl/stack.h noinst_HEADERS += hidden/openssl/ts.h From a471f2e054f37709b72eac77e856dccd08f6c92c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Jul 2023 00:40:41 -0600 Subject: [PATCH 0378/1283] Add hidden ecdh.h, sm3.h --- crypto/Makefile.am | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 2ef8af177a..9f82491fcd 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -727,6 +727,7 @@ noinst_HEADERS += hidden/openssl/asn1t.h noinst_HEADERS += hidden/openssl/bio.h noinst_HEADERS += hidden/openssl/chacha.h noinst_HEADERS += hidden/openssl/ec.h +noinst_HEADERS += hidden/openssl/ecdh.h noinst_HEADERS += hidden/openssl/ecdsa.h noinst_HEADERS += hidden/openssl/err.h noinst_HEADERS += hidden/openssl/hkdf.h @@ -738,6 +739,7 @@ noinst_HEADERS += hidden/openssl/pkcs7.h noinst_HEADERS += hidden/openssl/poly1305.h noinst_HEADERS += hidden/openssl/rand.h noinst_HEADERS += hidden/openssl/rc2.h +noinst_HEADERS += hidden/openssl/sm3.h noinst_HEADERS += hidden/openssl/sm4.h noinst_HEADERS += hidden/openssl/stack.h noinst_HEADERS += hidden/openssl/ts.h From bad876da8cb40c12ab9ae04d1366de173aac4cde Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Jul 2023 00:41:07 -0600 Subject: [PATCH 0379/1283] Remove sm3_local.h --- crypto/Makefile.am | 1 - 1 file changed, 1 deletion(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 9f82491fcd..0cb3852ab1 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -912,7 +912,6 @@ noinst_HEADERS += sha/sha3_internal.h # sm3 libcrypto_la_SOURCES += sm3/sm3.c -noinst_HEADERS += sm3/sm3_local.h # sm4 libcrypto_la_SOURCES += sm4/sm4.c From fb2b33289cfde5f36cc837d730140a381713b940 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Jul 2023 01:33:04 -0600 Subject: [PATCH 0380/1283] Add hidden ct.h and dso.h --- crypto/Makefile.am | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 0cb3852ab1..97a78e0ba1 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -726,6 +726,8 @@ noinst_HEADERS += hidden/openssl/asn1.h noinst_HEADERS += hidden/openssl/asn1t.h noinst_HEADERS += hidden/openssl/bio.h noinst_HEADERS += hidden/openssl/chacha.h +noinst_HEADERS += hidden/openssl/ct.h +noinst_HEADERS += hidden/openssl/dso.h noinst_HEADERS += hidden/openssl/ec.h noinst_HEADERS += hidden/openssl/ecdh.h noinst_HEADERS += hidden/openssl/ecdsa.h @@ -776,12 +778,10 @@ libcrypto_la_SOURCES += lhash/lhash.c # md4 libcrypto_la_SOURCES += md4/md4_dgst.c libcrypto_la_SOURCES += md4/md4_one.c -noinst_HEADERS += md4/md4_local.h # md5 libcrypto_la_SOURCES += md5/md5_dgst.c libcrypto_la_SOURCES += md5/md5_one.c -noinst_HEADERS += md5/md5_local.h # modes libcrypto_la_SOURCES += modes/cbc128.c @@ -878,7 +878,6 @@ noinst_HEADERS += rc4/rc4_local.h # ripemd libcrypto_la_SOURCES += ripemd/rmd_dgst.c libcrypto_la_SOURCES += ripemd/rmd_one.c -noinst_HEADERS += ripemd/rmd_local.h noinst_HEADERS += ripemd/rmdconst.h # rsa From 977bd49c5bb3b247070934501c7ea2bcdac00111 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Jul 2023 01:36:33 -0600 Subject: [PATCH 0381/1283] Add hidden buffer.h, cms.h, comp.h, conf_api.h --- crypto/Makefile.am | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 97a78e0ba1..f7346170fe 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -725,7 +725,11 @@ noinst_HEADERS += hidden/crypto_namespace.h noinst_HEADERS += hidden/openssl/asn1.h noinst_HEADERS += hidden/openssl/asn1t.h noinst_HEADERS += hidden/openssl/bio.h +noinst_HEADERS += hidden/openssl/buffer.h noinst_HEADERS += hidden/openssl/chacha.h +noinst_HEADERS += hidden/openssl/cms.h +noinst_HEADERS += hidden/openssl/comp.h +noinst_HEADERS += hidden/openssl/conf_api.h noinst_HEADERS += hidden/openssl/ct.h noinst_HEADERS += hidden/openssl/dso.h noinst_HEADERS += hidden/openssl/ec.h From bf99e422ce95b22c0ed58b727abc735c7299a174 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Jul 2023 02:03:37 -0600 Subject: [PATCH 0382/1283] Add hidden crypto.h --- crypto/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index f7346170fe..7799a65dfb 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -730,6 +730,7 @@ noinst_HEADERS += hidden/openssl/chacha.h noinst_HEADERS += hidden/openssl/cms.h noinst_HEADERS += hidden/openssl/comp.h noinst_HEADERS += hidden/openssl/conf_api.h +noinst_HEADERS += hidden/openssl/crypto.h noinst_HEADERS += hidden/openssl/ct.h noinst_HEADERS += hidden/openssl/dso.h noinst_HEADERS += hidden/openssl/ec.h From 11cdcdd5958230649cd3091db1407134f841f96e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Jul 2023 04:52:03 -0600 Subject: [PATCH 0383/1283] Add hidden cast.h idea.h md4.h md5.h ocsp.h --- crypto/Makefile.am | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 7799a65dfb..a5a9bbd06d 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -726,6 +726,7 @@ noinst_HEADERS += hidden/openssl/asn1.h noinst_HEADERS += hidden/openssl/asn1t.h noinst_HEADERS += hidden/openssl/bio.h noinst_HEADERS += hidden/openssl/buffer.h +noinst_HEADERS += hidden/openssl/cast.h noinst_HEADERS += hidden/openssl/chacha.h noinst_HEADERS += hidden/openssl/cms.h noinst_HEADERS += hidden/openssl/comp.h @@ -739,7 +740,11 @@ noinst_HEADERS += hidden/openssl/ecdsa.h noinst_HEADERS += hidden/openssl/err.h noinst_HEADERS += hidden/openssl/hkdf.h noinst_HEADERS += hidden/openssl/hmac.h +noinst_HEADERS += hidden/openssl/idea.h noinst_HEADERS += hidden/openssl/lhash.h +noinst_HEADERS += hidden/openssl/md4.h +noinst_HEADERS += hidden/openssl/md5.h +noinst_HEADERS += hidden/openssl/ocsp.h noinst_HEADERS += hidden/openssl/pem.h noinst_HEADERS += hidden/openssl/pkcs12.h noinst_HEADERS += hidden/openssl/pkcs7.h From 4a3af592b2bb7ee5e4c374a2bc9d8d7d6b7230fa Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Jul 2023 05:27:37 -0600 Subject: [PATCH 0384/1283] Add hidden txt_cb.h --- crypto/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index a5a9bbd06d..50eb8f7d64 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -755,6 +755,7 @@ noinst_HEADERS += hidden/openssl/sm3.h noinst_HEADERS += hidden/openssl/sm4.h noinst_HEADERS += hidden/openssl/stack.h noinst_HEADERS += hidden/openssl/ts.h +noinst_HEADERS += hidden/openssl/txt_db.h noinst_HEADERS += hidden/openssl/ui.h noinst_HEADERS += hidden/openssl/x509.h noinst_HEADERS += hidden/openssl/x509_vfy.h From 22e7b97c8ad210e1e29ca6e845defb7a69cd4387 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Jul 2023 05:40:49 -0600 Subject: [PATCH 0385/1283] Add hidden bn.h --- crypto/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 50eb8f7d64..2c392ddae1 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -725,6 +725,7 @@ noinst_HEADERS += hidden/crypto_namespace.h noinst_HEADERS += hidden/openssl/asn1.h noinst_HEADERS += hidden/openssl/asn1t.h noinst_HEADERS += hidden/openssl/bio.h +noinst_HEADERS += hidden/openssl/bn.h noinst_HEADERS += hidden/openssl/buffer.h noinst_HEADERS += hidden/openssl/cast.h noinst_HEADERS += hidden/openssl/chacha.h From a6c28611a793fa48a203c5c87ae24310b85f14bd Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Jul 2023 06:20:34 -0600 Subject: [PATCH 0386/1283] Add hidden objects.h, rsa.h, sha.h --- crypto/Makefile.am | 3 +++ 1 file changed, 3 insertions(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 2c392ddae1..5a1306270d 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -746,12 +746,15 @@ noinst_HEADERS += hidden/openssl/lhash.h noinst_HEADERS += hidden/openssl/md4.h noinst_HEADERS += hidden/openssl/md5.h noinst_HEADERS += hidden/openssl/ocsp.h +noinst_HEADERS += hidden/openssl/objects.h noinst_HEADERS += hidden/openssl/pem.h noinst_HEADERS += hidden/openssl/pkcs12.h noinst_HEADERS += hidden/openssl/pkcs7.h noinst_HEADERS += hidden/openssl/poly1305.h noinst_HEADERS += hidden/openssl/rand.h noinst_HEADERS += hidden/openssl/rc2.h +noinst_HEADERS += hidden/openssl/rsa.h +noinst_HEADERS += hidden/openssl/sha.h noinst_HEADERS += hidden/openssl/sm3.h noinst_HEADERS += hidden/openssl/sm4.h noinst_HEADERS += hidden/openssl/stack.h From bedbbe39ce0a03865d44bc12517b92b5342ea9a2 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Jul 2023 08:23:38 -0600 Subject: [PATCH 0387/1283] sort hidden headers --- crypto/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 5a1306270d..cb98f4ae7c 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -745,8 +745,8 @@ noinst_HEADERS += hidden/openssl/idea.h noinst_HEADERS += hidden/openssl/lhash.h noinst_HEADERS += hidden/openssl/md4.h noinst_HEADERS += hidden/openssl/md5.h -noinst_HEADERS += hidden/openssl/ocsp.h noinst_HEADERS += hidden/openssl/objects.h +noinst_HEADERS += hidden/openssl/ocsp.h noinst_HEADERS += hidden/openssl/pem.h noinst_HEADERS += hidden/openssl/pkcs12.h noinst_HEADERS += hidden/openssl/pkcs7.h From 5696d1ac306147afddaf838e5bca843c12bf01f8 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Jul 2023 08:24:54 -0600 Subject: [PATCH 0388/1283] Add hidden cmac.h, dsa.h, gost.h --- crypto/Makefile.am | 3 +++ 1 file changed, 3 insertions(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index cb98f4ae7c..ec207e80f7 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -729,16 +729,19 @@ noinst_HEADERS += hidden/openssl/bn.h noinst_HEADERS += hidden/openssl/buffer.h noinst_HEADERS += hidden/openssl/cast.h noinst_HEADERS += hidden/openssl/chacha.h +noinst_HEADERS += hidden/openssl/cmac.h noinst_HEADERS += hidden/openssl/cms.h noinst_HEADERS += hidden/openssl/comp.h noinst_HEADERS += hidden/openssl/conf_api.h noinst_HEADERS += hidden/openssl/crypto.h noinst_HEADERS += hidden/openssl/ct.h +noinst_HEADERS += hidden/openssl/dsa.h noinst_HEADERS += hidden/openssl/dso.h noinst_HEADERS += hidden/openssl/ec.h noinst_HEADERS += hidden/openssl/ecdh.h noinst_HEADERS += hidden/openssl/ecdsa.h noinst_HEADERS += hidden/openssl/err.h +noinst_HEADERS += hidden/openssl/gost.h noinst_HEADERS += hidden/openssl/hkdf.h noinst_HEADERS += hidden/openssl/hmac.h noinst_HEADERS += hidden/openssl/idea.h From 0761bd33f248ca73e2d336ce78163e5c1ce6072b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Jul 2023 08:54:23 -0600 Subject: [PATCH 0389/1283] Add hidden modes.h --- crypto/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index ec207e80f7..7e91a64266 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -748,6 +748,7 @@ noinst_HEADERS += hidden/openssl/idea.h noinst_HEADERS += hidden/openssl/lhash.h noinst_HEADERS += hidden/openssl/md4.h noinst_HEADERS += hidden/openssl/md5.h +noinst_HEADERS += hidden/openssl/modes.h noinst_HEADERS += hidden/openssl/objects.h noinst_HEADERS += hidden/openssl/ocsp.h noinst_HEADERS += hidden/openssl/pem.h From 2c8e1eb716a17f7eb40164a056af5518c3c6cff4 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Jul 2023 09:15:02 -0600 Subject: [PATCH 0390/1283] Add hidden curve25519.h --- crypto/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 7e91a64266..bd1a61a1e6 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -735,6 +735,7 @@ noinst_HEADERS += hidden/openssl/comp.h noinst_HEADERS += hidden/openssl/conf_api.h noinst_HEADERS += hidden/openssl/crypto.h noinst_HEADERS += hidden/openssl/ct.h +noinst_HEADERS += hidden/openssl/curve25519.h noinst_HEADERS += hidden/openssl/dsa.h noinst_HEADERS += hidden/openssl/dso.h noinst_HEADERS += hidden/openssl/ec.h From fbe39d015725183ec5abce17f0cc83c27ffc9b74 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Jul 2023 09:28:08 -0600 Subject: [PATCH 0391/1283] Add hidden dh.h --- crypto/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index bd1a61a1e6..c0be2995f5 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -736,6 +736,7 @@ noinst_HEADERS += hidden/openssl/conf_api.h noinst_HEADERS += hidden/openssl/crypto.h noinst_HEADERS += hidden/openssl/ct.h noinst_HEADERS += hidden/openssl/curve25519.h +noinst_HEADERS += hidden/openssl/dh.h noinst_HEADERS += hidden/openssl/dsa.h noinst_HEADERS += hidden/openssl/dso.h noinst_HEADERS += hidden/openssl/ec.h From 4aa2efb54da5d68c6df6fd1c3050f4666636fb4a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Jul 2023 10:41:10 -0600 Subject: [PATCH 0392/1283] Add hidden srtp.h and tls1.h --- ssl/Makefile.am | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 002a26674a..9acacd7bc5 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -46,6 +46,8 @@ libbs_la_SOURCES += bs_cbs.c noinst_HEADERS = bytestring.h noinst_HEADERS += hidden/ssl_namespace.h +noinst_HEADERS += hidden/openssl/srtp.h +noinst_HEADERS += hidden/openssl/tls1.h noinst_HEADERS += hidden/openssl/ssl.h libssl_la_SOURCES = bio_ssl.c From d36f70674fa41bd30cb383222cd91ea5e2267a3b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Jul 2023 14:20:25 -0600 Subject: [PATCH 0393/1283] Rebase modes_local.h patch over KNF rampage --- patches/modes_local.h.patch | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/patches/modes_local.h.patch b/patches/modes_local.h.patch index 8f55eedf38..1ff799b99d 100644 --- a/patches/modes_local.h.patch +++ b/patches/modes_local.h.patch @@ -1,19 +1,16 @@ ---- crypto/modes/modes_local.h.orig Tue Nov 14 10:25:15 2017 -+++ crypto/modes/modes_local.h Sat Jan 19 22:19:23 2019 -@@ -45,14 +45,16 @@ - asm ("bswapl %0" \ +--- crypto/modes/modes_local.h.orig Sat Jul 8 14:03:53 2023 ++++ crypto/modes/modes_local.h Sat Jul 8 14:10:56 2023 +@@ -45,6 +45,7 @@ + asm ("bswapl %0" \ : "+r"(ret)); ret; }) # elif (defined(__arm__) || defined(__arm)) && !defined(__STRICT_ALIGNMENT) --# define BSWAP8(x) ({ u32 lo=(u64)(x)>>32,hi=(x); \ +# if (__ARM_ARCH >= 6) -+# define BSWAP8(x) ({ u32 lo=(u64)(x)>>32,hi=(x); \ - asm ("rev %0,%0; rev %1,%1" \ - : "+r"(hi),"+r"(lo)); \ - (u64)hi<<32|lo; }) --# define BSWAP4(x) ({ u32 ret; \ -+# define BSWAP4(x) ({ u32 ret; \ - asm ("rev %0,%1" \ - : "=r"(ret) : "r"((u32)(x))); \ + # define BSWAP8(x) ({ u32 lo=(u64)(x)>>32,hi=(x); \ + asm ("rev %0,%0; rev %1,%1" \ + : "+r"(hi),"+r"(lo)); \ +@@ -53,6 +54,7 @@ + asm ("rev %0,%1" \ + : "=r"(ret) : "r"((u32)(x))); \ ret; }) +# endif # endif From 8450ca8c073af0ecd12bd938261bcb4aeb86db6b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 11 Jul 2023 13:42:59 -0600 Subject: [PATCH 0394/1283] Reenable clienttest and servertest --- tests/CMakeLists.txt | 16 +++++++--------- tests/Makefile.am | 6 ++---- 2 files changed, 9 insertions(+), 13 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index cefba2e860..b82a2a64fb 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -269,10 +269,9 @@ target_link_libraries(cipherstest ${OPENSSL_TEST_LIBS}) add_test(cipherstest cipherstest) # clienttest -# Disabled for now after removal of TLS 1.0/1.1 support add_executable(clienttest clienttest.c) target_link_libraries(clienttest ${OPENSSL_TEST_LIBS}) -#add_test(clienttest clienttest) +add_test(clienttest clienttest) # cmstest add_executable(cmstest cmstest.c) @@ -588,15 +587,14 @@ add_test(rsa_test rsa_test) # server.c # servertest -# Disabled for now after removal of TLS 1.0/1.1 support add_executable(servertest servertest.c) target_link_libraries(servertest ${OPENSSL_TEST_LIBS}) -#if(NOT MSVC) -# add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.sh) -#else() -# add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.bat $) -#endif() -#set_tests_properties(servertest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") +if(NOT MSVC) + add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.sh) +else() + add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.bat $) +endif() +set_tests_properties(servertest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # sha_test add_executable(sha_test sha_test.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index 646c927b44..28d7d0f781 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -284,8 +284,7 @@ check_PROGRAMS += cipherstest cipherstest_SOURCES = cipherstest.c # clienttest -# Disabled for now after removal of TLS 1.0/1.1 support -#TESTS += clienttest +TESTS += clienttest check_PROGRAMS += clienttest clienttest_SOURCES = clienttest.c @@ -622,8 +621,7 @@ rsa_test_SOURCES = rsa_test.c # server.c # servertest -# Disabled for now after removal of TLS 1.0/1.1 support -#TESTS += servertest.sh +TESTS += servertest.sh check_PROGRAMS += servertest servertest_SOURCES = servertest.c EXTRA_DIST += servertest.sh servertest.bat From 5d6a7305fcdce3bef745a8db7bccbb4420704c14 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 16 Jul 2023 01:56:50 -0600 Subject: [PATCH 0395/1283] link ecc_cdh test --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index b82a2a64fb..b6604785ee 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -319,6 +319,11 @@ add_test(dsatest dsatest) # set_tests_properties(dtlstest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # endif() +# ecc_cdh +add_executable(ecc_cdh ecc_cdh.c) +target_link_libraries(ecc_cdh ${OPENSSL_TEST_LIBS}) +add_test(ecc_cdh ecc_cdh) + # ec_asn1_test add_executable(ec_asn1_test ec_asn1_test.c) target_link_libraries(ec_asn1_test ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 28d7d0f781..a77b145973 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -336,6 +336,11 @@ dsatest_SOURCES = dsatest.c #endif #EXTRA_DIST += dtlstest.sh +# ecc_cdh +TESTS += ecc_cdh +check_PROGRAMS += ecc_cdh +ecc_cdh_SOURCES = ecc_cdh.c + # ec_asn1_test TESTS += ec_asn1_test check_PROGRAMS += ec_asn1_test From d499ec2b77be5131176319911d3eea9565d94191 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 16 Jul 2023 01:58:35 -0600 Subject: [PATCH 0396/1283] update gitignore --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index a0a34d7bde..bdae627a77 100644 --- a/.gitignore +++ b/.gitignore @@ -92,6 +92,7 @@ tests/bn_mod_inverse* tests/bn_mod_sqrt* tests/bn_mont* tests/bn_primes* +tests/bn_print* tests/bn_rand_interval* tests/bn_shift* tests/bn_to_string* @@ -103,6 +104,7 @@ tests/constraints* tests/ctlog.conf tests/*.crt tests/ec_point_conversion* +tests/ecc_cdh* tests/evp_pkey_check* tests/evp_pkey_cleanup* tests/explicit_bzero* From ed94460b6a68e5585f02a0d4c3e5f497a7d93024 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 19 Jul 2023 14:06:33 -0600 Subject: [PATCH 0397/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 3c90f4ff24..8b05429b1d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -52,6 +52,7 @@ LibreSSL Portable Release Notes: - Ensure no X.509v3 extensions appear more than once in certificates. - Cleaned up various ECDH, ECDSA and EC internals. - Replaced ASN1_bn_print with a cleaner internal implementation. + - Simplified ASN1_item_sign_ctx(). * New features * Compatibility changes - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain From 3afb61ff8065b3d30f8e8c809fc353124d7611f3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 21 Jul 2023 03:37:16 -0600 Subject: [PATCH 0398/1283] Link engine_stubs.c to build --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index cc597d984a..ea4a86c2d5 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -497,6 +497,7 @@ set( ecdsa/ecdsa.c ecdsa/ecs_err.c ecdsa/ecs_lib.c + engine/engine_stubs.c engine/eng_all.c engine/eng_cnf.c engine/eng_ctrl.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index c0be2995f5..01090db5e6 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -611,6 +611,7 @@ libcrypto_la_SOURCES += ecdsa/ecs_lib.c noinst_HEADERS += ecdsa/ecdsa_local.h # engine +libcrypto_la_SOURCES += engine/engine_stubs.c libcrypto_la_SOURCES += engine/eng_all.c libcrypto_la_SOURCES += engine/eng_cnf.c libcrypto_la_SOURCES += engine/eng_ctrl.c From 41a9d8fd04c8e38539670c486a7182335dddca6c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 21 Jul 2023 04:04:17 -0600 Subject: [PATCH 0399/1283] Update man links --- man/links | 59 +++++++++++++++++++++---------------------------------- 1 file changed, 22 insertions(+), 37 deletions(-) diff --git a/man/links b/man/links index 964a7fb06f..79c393d456 100644 --- a/man/links +++ b/man/links @@ -230,12 +230,6 @@ BIO_get_ex_new_index.3,BIO_get_app_data.3 BIO_get_ex_new_index.3,BIO_get_ex_data.3 BIO_get_ex_new_index.3,BIO_set_app_data.3 BIO_get_ex_new_index.3,BIO_set_ex_data.3 -BIO_get_ex_new_index.3,ECDH_get_ex_data.3 -BIO_get_ex_new_index.3,ECDH_get_ex_new_index.3 -BIO_get_ex_new_index.3,ECDH_set_ex_data.3 -BIO_get_ex_new_index.3,ECDSA_get_ex_data.3 -BIO_get_ex_new_index.3,ECDSA_get_ex_new_index.3 -BIO_get_ex_new_index.3,ECDSA_set_ex_data.3 BIO_get_ex_new_index.3,EC_KEY_get_ex_data.3 BIO_get_ex_new_index.3,EC_KEY_get_ex_new_index.3 BIO_get_ex_new_index.3,EC_KEY_set_ex_data.3 @@ -427,6 +421,13 @@ BN_generate_prime.3,BN_GENCB_set_old.3 BN_generate_prime.3,BN_generate_prime_ex.3 BN_generate_prime.3,BN_is_prime_ex.3 BN_generate_prime.3,BN_is_prime_fasttest_ex.3 +BN_get_rfc3526_prime_8192.3,BN_get_rfc2409_prime_1024.3 +BN_get_rfc3526_prime_8192.3,BN_get_rfc2409_prime_768.3 +BN_get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_1536.3 +BN_get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_2048.3 +BN_get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_3072.3 +BN_get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_4096.3 +BN_get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_6144.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_copy.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_free.3 BN_mod_mul_montgomery.3,BN_MONT_CTX_new.3 @@ -632,21 +633,14 @@ DSA_sign.3,DSA_sign_setup.3 DSA_sign.3,DSA_verify.3 DSA_size.3,DSA_bits.3 ECDH_compute_key.3,ECDH_size.3 -ECDSA_SIG_new.3,ECDSA_OpenSSL.3 ECDSA_SIG_new.3,ECDSA_SIG_free.3 ECDSA_SIG_new.3,ECDSA_SIG_get0.3 ECDSA_SIG_new.3,ECDSA_SIG_get0_r.3 ECDSA_SIG_new.3,ECDSA_SIG_get0_s.3 ECDSA_SIG_new.3,ECDSA_SIG_set0.3 ECDSA_SIG_new.3,ECDSA_do_sign.3 -ECDSA_SIG_new.3,ECDSA_do_sign_ex.3 ECDSA_SIG_new.3,ECDSA_do_verify.3 -ECDSA_SIG_new.3,ECDSA_get_default_method.3 -ECDSA_SIG_new.3,ECDSA_set_default_method.3 -ECDSA_SIG_new.3,ECDSA_set_method.3 ECDSA_SIG_new.3,ECDSA_sign.3 -ECDSA_SIG_new.3,ECDSA_sign_ex.3 -ECDSA_SIG_new.3,ECDSA_sign_setup.3 ECDSA_SIG_new.3,ECDSA_size.3 ECDSA_SIG_new.3,ECDSA_verify.3 ECDSA_SIG_new.3,d2i_ECDSA_SIG.3 @@ -665,10 +659,8 @@ EC_GROUP_copy.3,EC_GROUP_get_cofactor.3 EC_GROUP_copy.3,EC_GROUP_get_curve_name.3 EC_GROUP_copy.3,EC_GROUP_get_degree.3 EC_GROUP_copy.3,EC_GROUP_get_order.3 -EC_GROUP_copy.3,EC_GROUP_get_pentanomial_basis.3 EC_GROUP_copy.3,EC_GROUP_get_point_conversion_form.3 EC_GROUP_copy.3,EC_GROUP_get_seed_len.3 -EC_GROUP_copy.3,EC_GROUP_get_trinomial_basis.3 EC_GROUP_copy.3,EC_GROUP_method_of.3 EC_GROUP_copy.3,EC_GROUP_order_bits.3 EC_GROUP_copy.3,EC_GROUP_set_asn1_flag.3 @@ -780,8 +772,7 @@ ENGINE_ctrl.3,ENGINE_set_ctrl_function.3 ENGINE_get_default_RSA.3,ENGINE_get_cipher_engine.3 ENGINE_get_default_RSA.3,ENGINE_get_default_DH.3 ENGINE_get_default_RSA.3,ENGINE_get_default_DSA.3 -ENGINE_get_default_RSA.3,ENGINE_get_default_ECDH.3 -ENGINE_get_default_RSA.3,ENGINE_get_default_ECDSA.3 +ENGINE_get_default_RSA.3,ENGINE_get_default_EC.3 ENGINE_get_default_RSA.3,ENGINE_get_default_RAND.3 ENGINE_get_default_RSA.3,ENGINE_get_digest_engine.3 ENGINE_get_default_RSA.3,ENGINE_get_table_flags.3 @@ -821,8 +812,7 @@ ENGINE_set_RSA.3,ENGINE_CIPHERS_PTR.3 ENGINE_set_RSA.3,ENGINE_DIGESTS_PTR.3 ENGINE_set_RSA.3,ENGINE_get_DH.3 ENGINE_set_RSA.3,ENGINE_get_DSA.3 -ENGINE_set_RSA.3,ENGINE_get_ECDH.3 -ENGINE_set_RSA.3,ENGINE_get_ECDSA.3 +ENGINE_set_RSA.3,ENGINE_get_EC.3 ENGINE_set_RSA.3,ENGINE_get_RAND.3 ENGINE_set_RSA.3,ENGINE_get_RSA.3 ENGINE_set_RSA.3,ENGINE_get_STORE.3 @@ -832,8 +822,7 @@ ENGINE_set_RSA.3,ENGINE_get_digest.3 ENGINE_set_RSA.3,ENGINE_get_digests.3 ENGINE_set_RSA.3,ENGINE_set_DH.3 ENGINE_set_RSA.3,ENGINE_set_DSA.3 -ENGINE_set_RSA.3,ENGINE_set_ECDH.3 -ENGINE_set_RSA.3,ENGINE_set_ECDSA.3 +ENGINE_set_RSA.3,ENGINE_set_EC.3 ENGINE_set_RSA.3,ENGINE_set_RAND.3 ENGINE_set_RSA.3,ENGINE_set_STORE.3 ENGINE_set_RSA.3,ENGINE_set_ciphers.3 @@ -1038,6 +1027,18 @@ EVP_EncryptInit.3,EVP_rc2_cfb.3 EVP_EncryptInit.3,EVP_rc2_cfb64.3 EVP_EncryptInit.3,EVP_rc2_ecb.3 EVP_EncryptInit.3,EVP_rc2_ofb.3 +EVP_MD_meth_new.3,EVP_MD_meth_dup.3 +EVP_MD_meth_new.3,EVP_MD_meth_free.3 +EVP_MD_meth_new.3,EVP_MD_meth_set_app_datasize.3 +EVP_MD_meth_new.3,EVP_MD_meth_set_cleanup.3 +EVP_MD_meth_new.3,EVP_MD_meth_set_copy.3 +EVP_MD_meth_new.3,EVP_MD_meth_set_ctrl.3 +EVP_MD_meth_new.3,EVP_MD_meth_set_final.3 +EVP_MD_meth_new.3,EVP_MD_meth_set_flags.3 +EVP_MD_meth_new.3,EVP_MD_meth_set_init.3 +EVP_MD_meth_new.3,EVP_MD_meth_set_input_blocksize.3 +EVP_MD_meth_new.3,EVP_MD_meth_set_result_size.3 +EVP_MD_meth_new.3,EVP_MD_meth_set_update.3 EVP_OpenInit.3,EVP_OpenFinal.3 EVP_OpenInit.3,EVP_OpenUpdate.3 EVP_PKCS82PKEY.3,EVP_PKEY2PKCS8.3 @@ -1302,7 +1303,6 @@ OBJ_NAME_add.3,OBJ_NAME_new_index.3 OBJ_NAME_add.3,OBJ_NAME_remove.3 OBJ_add_sigid.3,OBJ_find_sigid_algs.3 OBJ_add_sigid.3,OBJ_find_sigid_by_algs.3 -OBJ_add_sigid.3,OBJ_sigid_free.3 OBJ_create.3,OBJ_add_object.3 OBJ_create.3,OBJ_cleanup.3 OBJ_create.3,OBJ_create_objects.3 @@ -2812,21 +2812,6 @@ d2i_X509_SIG.3,i2d_X509_SIG.3 des_read_pw.3,EVP_read_pw_string.3 des_read_pw.3,EVP_read_pw_string_min.3 des_read_pw.3,des_read_pw_string.3 -get_rfc3526_prime_8192.3,BN_get_rfc2409_prime_1024.3 -get_rfc3526_prime_8192.3,BN_get_rfc2409_prime_768.3 -get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_1536.3 -get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_2048.3 -get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_3072.3 -get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_4096.3 -get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_6144.3 -get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_8192.3 -get_rfc3526_prime_8192.3,get_rfc2409_prime_1024.3 -get_rfc3526_prime_8192.3,get_rfc2409_prime_768.3 -get_rfc3526_prime_8192.3,get_rfc3526_prime_1536.3 -get_rfc3526_prime_8192.3,get_rfc3526_prime_2048.3 -get_rfc3526_prime_8192.3,get_rfc3526_prime_3072.3 -get_rfc3526_prime_8192.3,get_rfc3526_prime_4096.3 -get_rfc3526_prime_8192.3,get_rfc3526_prime_6144.3 i2a_ASN1_STRING.3,a2i_ASN1_ENUMERATED.3 i2a_ASN1_STRING.3,a2i_ASN1_INTEGER.3 i2a_ASN1_STRING.3,a2i_ASN1_STRING.3 From e51077f12cec727c77e4dbb9a675a49ec4839aa2 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 21 Jul 2023 05:05:03 -0600 Subject: [PATCH 0400/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 8b05429b1d..055e2f4e20 100644 --- a/ChangeLog +++ b/ChangeLog @@ -59,6 +59,8 @@ LibreSSL Portable Release Notes: valid UTF-8 without embedded NUL. - Moved libtls from ECDSA_METHOD to EC_KEY_METHOD. - Removed support for ECDH_METHOD and ECDSA_METHOD. + - BN_is_prime{,_fasttest}_ex() refuse to check numbers larger than + 32 kbits for primality. This mitigates various DoS vectors. * Bug fixes - Fixed aliasing issue in BN_mod_inverse(). - Made CRYPTO_get_ex_new_index() not return 0 to allow applications From 89de230099ba4832f29db6a479778da5a931a030 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 22 Jul 2023 13:14:31 -0600 Subject: [PATCH 0401/1283] obj_xref.h was removed --- crypto/Makefile.am | 1 - 1 file changed, 1 deletion(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 01090db5e6..91ff226aef 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -822,7 +822,6 @@ libcrypto_la_SOURCES += objects/obj_err.c libcrypto_la_SOURCES += objects/obj_lib.c libcrypto_la_SOURCES += objects/obj_xref.c noinst_HEADERS += objects/obj_dat.h -noinst_HEADERS += objects/obj_xref.h # ocsp libcrypto_la_SOURCES += ocsp/ocsp_asn.c From cbde559cc33a52067b5567ec734fc6fb6b8f7c9e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 22 Jul 2023 13:15:30 -0600 Subject: [PATCH 0402/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 055e2f4e20..cf9765ca1e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -53,6 +53,7 @@ LibreSSL Portable Release Notes: - Cleaned up various ECDH, ECDSA and EC internals. - Replaced ASN1_bn_print with a cleaner internal implementation. - Simplified ASN1_item_sign_ctx(). + - Rewrote OBJ_find_sigid_algs() and OBJ_find_sigid_by_algs(). * New features * Compatibility changes - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain From 479e85d1fbc90117fab2d568449a288fe97699c9 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 22 Jul 2023 13:24:37 -0600 Subject: [PATCH 0403/1283] Update man links --- man/links | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/man/links b/man/links index 79c393d456..cc09d2da33 100644 --- a/man/links +++ b/man/links @@ -1301,14 +1301,13 @@ OBJ_NAME_add.3,OBJ_NAME_get.3 OBJ_NAME_add.3,OBJ_NAME_init.3 OBJ_NAME_add.3,OBJ_NAME_new_index.3 OBJ_NAME_add.3,OBJ_NAME_remove.3 -OBJ_add_sigid.3,OBJ_find_sigid_algs.3 -OBJ_add_sigid.3,OBJ_find_sigid_by_algs.3 OBJ_create.3,OBJ_add_object.3 OBJ_create.3,OBJ_cleanup.3 OBJ_create.3,OBJ_create_objects.3 OBJ_create.3,OBJ_new_nid.3 OBJ_create.3,check_defer.3 OBJ_create.3,obj_cleanup_defer.3 +OBJ_find_sigid_algs.3,OBJ_find_sigid_by_algs.3 OBJ_nid2obj.3,OBJ_cmp.3 OBJ_nid2obj.3,OBJ_dup.3 OBJ_nid2obj.3,OBJ_ln2nid.3 From 6472f2881f5d71af6202ffdf8cec877c72d048d9 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 23 Jul 2023 17:06:55 -0500 Subject: [PATCH 0404/1283] switch solaris to a daily test --- .github/workflows/solaris_test.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/solaris_test.yml b/.github/workflows/solaris_test.yml index 091d8faaeb..e5fc8f126e 100644 --- a/.github/workflows/solaris_test.yml +++ b/.github/workflows/solaris_test.yml @@ -1,6 +1,9 @@ name: solaris_ci -on: [push] +on: + workflow_dispatch: + schedule: + - cron: "0 0 * * *" jobs: build-native: From e2a869ae550a6b759f61155f40d3ea3f2884d8b1 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 23 Jul 2023 17:08:18 -0500 Subject: [PATCH 0405/1283] add solaris badge --- README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index ecfba179cd..02ec12b68d 100644 --- a/README.md +++ b/README.md @@ -3,8 +3,9 @@ [![Linux Build Status](https://github.com/libressl/portable/actions/workflows/linux_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/linux_test.yml) [![macOS Build Status](https://github.com/libressl/portable/actions/workflows/macos_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/macos_test.yml) -[![Android_Build Status](https://github.com/libressl/portable/actions/workflows/android_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/android_test.yml) -[![Cross_Build Status](https://github.com/libressl/portable/actions/workflows/cross_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/cross_test.yml) +[![Android Build Status](https://github.com/libressl/portable/actions/workflows/android_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/android_test.yml) +[![Cross Build Status](https://github.com/libressl/portable/actions/workflows/cross_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/cross_test.yml) +[![Solaris Build Status](https://github.com/libressl/portable/actions/workflows/solaris_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/solaris_test.yml) [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/libressl.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:libressl) [![ASan Status](https://github.com/libressl/portable/actions/workflows/linux_test_asan.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/linux_test_asan.yml) From 75f90d9557dc2ab722052d2fccaf61bc65c79375 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 26 Jul 2023 08:58:31 -0600 Subject: [PATCH 0406/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index cf9765ca1e..3030fe1f7b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -54,6 +54,8 @@ LibreSSL Portable Release Notes: - Replaced ASN1_bn_print with a cleaner internal implementation. - Simplified ASN1_item_sign_ctx(). - Rewrote OBJ_find_sigid_algs() and OBJ_find_sigid_by_algs(). + - Various improvements in the 'simple' EC code. + - Fix OPENSSL_cpuid_setup() invocations on arm/aarch64. * New features * Compatibility changes - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain From a7bf3b95a53d4ab2ae5bd06848f4fadccc5ef5e2 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 28 Jul 2023 06:00:54 -0600 Subject: [PATCH 0407/1283] Update ChangeLog --- ChangeLog | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ChangeLog b/ChangeLog index 3030fe1f7b..9618febb0f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -64,6 +64,14 @@ LibreSSL Portable Release Notes: - Removed support for ECDH_METHOD and ECDSA_METHOD. - BN_is_prime{,_fasttest}_ex() refuse to check numbers larger than 32 kbits for primality. This mitigates various DoS vectors. + - Comp was removed. + - Dynamic loading of conf modules is no longer supported. + - DSO was removed and OPENSSL_NO_DSO is defined. + - ENGINE support was removed and OPENSSL_NO_ENGINE is set. In spite + of this, some stub functions are provided to avoid patching some + applications that do not honor OPENSSL_NO_ENGINE. + - It is no longer possible to make the library use your own error + stack or ex_data implementation. * Bug fixes - Fixed aliasing issue in BN_mod_inverse(). - Made CRYPTO_get_ex_new_index() not return 0 to allow applications From 85a0a1ae3fb40b32e1daea61a6e3249c639c53a5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 28 Jul 2023 06:03:57 -0600 Subject: [PATCH 0408/1283] Adjust for file removal and renaming --- crypto/CMakeLists.txt | 49 +++-------------------------------- crypto/Makefile.am | 59 +++---------------------------------------- update.sh | 2 +- 3 files changed, 7 insertions(+), 103 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index ea4a86c2d5..cce0e7015f 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -257,7 +257,6 @@ set( aes/aes_ctr.c aes/aes_ecb.c aes/aes_ige.c - aes/aes_misc.c aes/aes_ofb.c aes/aes_wrap.c asn1/a_bitstr.c @@ -294,7 +293,6 @@ set( asn1/p5_pbev2.c asn1/p8_pkey.c asn1/t_crl.c - asn1/t_pkey.c asn1/t_req.c asn1/t_spki.c asn1/t_x509.c @@ -373,7 +371,6 @@ set( bn/bn_sqr.c bn/bn_word.c buffer/buf_err.c - buffer/buf_str.c buffer/buffer.c bytestring/bs_ber.c bytestring/bs_cbb.c @@ -405,10 +402,6 @@ set( cms/cms_pwri.c cms/cms_sd.c cms/cms_smime.c - comp/c_rle.c - comp/c_zlib.c - comp/comp_err.c - comp/comp_lib.c conf/conf_api.c conf/conf_def.c conf/conf_err.c @@ -468,11 +461,6 @@ set( dsa/dsa_ossl.c dsa/dsa_pmeth.c dsa/dsa_prn.c - dso/dso_dlfcn.c - dso/dso_err.c - dso/dso_lib.c - dso/dso_null.c - dso/dso_openssl.c ec/ec_ameth.c ec/ec_asn1.c ec/ec_check.c @@ -492,36 +480,8 @@ set( ec/ecp_smpl.c ec/ecx_methods.c ecdh/ecdh.c - ecdh/ech_err.c - ecdh/ech_lib.c ecdsa/ecdsa.c - ecdsa/ecs_err.c - ecdsa/ecs_lib.c engine/engine_stubs.c - engine/eng_all.c - engine/eng_cnf.c - engine/eng_ctrl.c - engine/eng_dyn.c - engine/eng_err.c - engine/eng_fat.c - engine/eng_init.c - engine/eng_lib.c - engine/eng_list.c - engine/eng_openssl.c - engine/eng_pkey.c - engine/eng_table.c - engine/tb_asnmth.c - engine/tb_cipher.c - engine/tb_dh.c - engine/tb_digest.c - engine/tb_dsa.c - engine/tb_ecdh.c - engine/tb_ecdsa.c - engine/tb_eckey.c - engine/tb_pkmeth.c - engine/tb_rand.c - engine/tb_rsa.c - engine/tb_store.c err/err.c err/err_all.c err/err_prn.c @@ -609,10 +569,8 @@ set( kdf/kdf_err.c lhash/lh_stats.c lhash/lhash.c - md4/md4_dgst.c - md4/md4_one.c - md5/md5_dgst.c - md5/md5_one.c + md4/md4.c + md5/md5.c modes/cbc128.c modes/ccm128.c modes/cfb128.c @@ -677,8 +635,7 @@ set( rc2/rc2_skey.c rc2/rc2cfb64.c rc2/rc2ofb64.c - ripemd/rmd_dgst.c - ripemd/rmd_one.c + ripemd/ripemd.c rsa/rsa_ameth.c rsa/rsa_asn1.c rsa/rsa_chk.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 91ff226aef..d0486688b9 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -236,7 +236,6 @@ libcrypto_la_SOURCES += aes/aes_cfb.c libcrypto_la_SOURCES += aes/aes_ctr.c libcrypto_la_SOURCES += aes/aes_ecb.c libcrypto_la_SOURCES += aes/aes_ige.c -libcrypto_la_SOURCES += aes/aes_misc.c libcrypto_la_SOURCES += aes/aes_ofb.c libcrypto_la_SOURCES += aes/aes_wrap.c noinst_HEADERS += aes/aes_local.h @@ -276,7 +275,6 @@ libcrypto_la_SOURCES += asn1/p5_pbe.c libcrypto_la_SOURCES += asn1/p5_pbev2.c libcrypto_la_SOURCES += asn1/p8_pkey.c libcrypto_la_SOURCES += asn1/t_crl.c -libcrypto_la_SOURCES += asn1/t_pkey.c libcrypto_la_SOURCES += asn1/t_req.c libcrypto_la_SOURCES += asn1/t_spki.c libcrypto_la_SOURCES += asn1/t_x509.c @@ -432,7 +430,6 @@ noinst_HEADERS += bn/arch/amd64/bn_arch.h # buffer libcrypto_la_SOURCES += buffer/buf_err.c -libcrypto_la_SOURCES += buffer/buf_str.c libcrypto_la_SOURCES += buffer/buffer.c noinst_HEADERS += bytestring/bytestring.h @@ -484,13 +481,6 @@ libcrypto_la_SOURCES += cms/cms_sd.c libcrypto_la_SOURCES += cms/cms_smime.c noinst_HEADERS += cms/cms_local.h -# comp -libcrypto_la_SOURCES += comp/c_rle.c -libcrypto_la_SOURCES += comp/c_zlib.c -libcrypto_la_SOURCES += comp/comp_err.c -libcrypto_la_SOURCES += comp/comp_lib.c -noinst_HEADERS += comp/comp_local.h - # conf libcrypto_la_SOURCES += conf/conf_api.c libcrypto_la_SOURCES += conf/conf_def.c @@ -571,13 +561,6 @@ libcrypto_la_SOURCES += dsa/dsa_pmeth.c libcrypto_la_SOURCES += dsa/dsa_prn.c noinst_HEADERS += dsa/dsa_local.h -# dso -libcrypto_la_SOURCES += dso/dso_dlfcn.c -libcrypto_la_SOURCES += dso/dso_err.c -libcrypto_la_SOURCES += dso/dso_lib.c -libcrypto_la_SOURCES += dso/dso_null.c -libcrypto_la_SOURCES += dso/dso_openssl.c - # ec libcrypto_la_SOURCES += ec/ec_ameth.c libcrypto_la_SOURCES += ec/ec_asn1.c @@ -601,42 +584,13 @@ noinst_HEADERS += ec/ec_local.h # ecdh libcrypto_la_SOURCES += ecdh/ecdh.c -libcrypto_la_SOURCES += ecdh/ech_err.c -libcrypto_la_SOURCES += ecdh/ech_lib.c # ecdsa libcrypto_la_SOURCES += ecdsa/ecdsa.c -libcrypto_la_SOURCES += ecdsa/ecs_err.c -libcrypto_la_SOURCES += ecdsa/ecs_lib.c noinst_HEADERS += ecdsa/ecdsa_local.h # engine libcrypto_la_SOURCES += engine/engine_stubs.c -libcrypto_la_SOURCES += engine/eng_all.c -libcrypto_la_SOURCES += engine/eng_cnf.c -libcrypto_la_SOURCES += engine/eng_ctrl.c -libcrypto_la_SOURCES += engine/eng_dyn.c -libcrypto_la_SOURCES += engine/eng_err.c -libcrypto_la_SOURCES += engine/eng_fat.c -libcrypto_la_SOURCES += engine/eng_init.c -libcrypto_la_SOURCES += engine/eng_lib.c -libcrypto_la_SOURCES += engine/eng_list.c -libcrypto_la_SOURCES += engine/eng_openssl.c -libcrypto_la_SOURCES += engine/eng_pkey.c -libcrypto_la_SOURCES += engine/eng_table.c -libcrypto_la_SOURCES += engine/tb_asnmth.c -libcrypto_la_SOURCES += engine/tb_cipher.c -libcrypto_la_SOURCES += engine/tb_dh.c -libcrypto_la_SOURCES += engine/tb_digest.c -libcrypto_la_SOURCES += engine/tb_dsa.c -libcrypto_la_SOURCES += engine/tb_ecdh.c -libcrypto_la_SOURCES += engine/tb_ecdsa.c -libcrypto_la_SOURCES += engine/tb_eckey.c -libcrypto_la_SOURCES += engine/tb_pkmeth.c -libcrypto_la_SOURCES += engine/tb_rand.c -libcrypto_la_SOURCES += engine/tb_rsa.c -libcrypto_la_SOURCES += engine/tb_store.c -noinst_HEADERS += engine/eng_int.h # err libcrypto_la_SOURCES += err/err.c @@ -732,17 +686,13 @@ noinst_HEADERS += hidden/openssl/cast.h noinst_HEADERS += hidden/openssl/chacha.h noinst_HEADERS += hidden/openssl/cmac.h noinst_HEADERS += hidden/openssl/cms.h -noinst_HEADERS += hidden/openssl/comp.h noinst_HEADERS += hidden/openssl/conf_api.h noinst_HEADERS += hidden/openssl/crypto.h noinst_HEADERS += hidden/openssl/ct.h noinst_HEADERS += hidden/openssl/curve25519.h noinst_HEADERS += hidden/openssl/dh.h noinst_HEADERS += hidden/openssl/dsa.h -noinst_HEADERS += hidden/openssl/dso.h noinst_HEADERS += hidden/openssl/ec.h -noinst_HEADERS += hidden/openssl/ecdh.h -noinst_HEADERS += hidden/openssl/ecdsa.h noinst_HEADERS += hidden/openssl/err.h noinst_HEADERS += hidden/openssl/gost.h noinst_HEADERS += hidden/openssl/hkdf.h @@ -798,12 +748,10 @@ libcrypto_la_SOURCES += lhash/lh_stats.c libcrypto_la_SOURCES += lhash/lhash.c # md4 -libcrypto_la_SOURCES += md4/md4_dgst.c -libcrypto_la_SOURCES += md4/md4_one.c +libcrypto_la_SOURCES += md4/md4.c # md5 -libcrypto_la_SOURCES += md5/md5_dgst.c -libcrypto_la_SOURCES += md5/md5_one.c +libcrypto_la_SOURCES += md5/md5.c # modes libcrypto_la_SOURCES += modes/cbc128.c @@ -897,8 +845,7 @@ noinst_HEADERS += rc2/rc2_local.h noinst_HEADERS += rc4/rc4_local.h # ripemd -libcrypto_la_SOURCES += ripemd/rmd_dgst.c -libcrypto_la_SOURCES += ripemd/rmd_one.c +libcrypto_la_SOURCES += ripemd/ripemd.c noinst_HEADERS += ripemd/rmdconst.h # rsa diff --git a/update.sh b/update.sh index 0c1a74940a..ef40eedf57 100755 --- a/update.sh +++ b/update.sh @@ -133,7 +133,7 @@ copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h ecdh/ecdh.h rsa/rsa.h sha/sha.h x509/x509_vfy.h pkcs7/pkcs7.h pem/pem.h pem/pem2.h hkdf/hkdf.h hmac/hmac.h rand/rand.h md5/md5.h x509/x509v3.h conf/conf.h ocsp/ocsp.h - aes/aes.h modes/modes.h asn1/asn1t.h dso/dso.h bf/blowfish.h + aes/aes.h modes/modes.h asn1/asn1t.h bf/blowfish.h bio/bio.h cast/cast.h cmac/cmac.h cms/cms.h conf/conf_api.h des/des.h dh/dh.h dsa/dsa.h engine/engine.h ui/ui.h pkcs12/pkcs12.h ts/ts.h md4/md4.h ripemd/ripemd.h whrlpool/whrlpool.h idea/idea.h From 5b5f96b0fb54c4e74c59576c952d862a3f943d77 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 28 Jul 2023 06:12:29 -0600 Subject: [PATCH 0409/1283] Regen patches --- patches/opensslfeatures.h.patch | 6 +++--- patches/speed.c.patch | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/patches/opensslfeatures.h.patch b/patches/opensslfeatures.h.patch index 8ee311d446..618de7374c 100644 --- a/patches/opensslfeatures.h.patch +++ b/patches/opensslfeatures.h.patch @@ -1,6 +1,6 @@ ---- openbsd/src/lib/libcrypto/opensslfeatures.h 2023-03-15 11:41:47.301015100 -0600 -+++ include/openssl/opensslfeatures.h 2023-03-15 18:27:57.740024800 -0600 -@@ -7,6 +7,13 @@ +--- include/openssl/opensslfeatures.h.orig Fri Jul 28 06:04:42 2023 ++++ include/openssl/opensslfeatures.h Fri Jul 28 06:09:00 2023 +@@ -8,6 +8,13 @@ #define LIBRESSL_HAS_TLS1_3 #define LIBRESSL_HAS_DTLS1_2 diff --git a/patches/speed.c.patch b/patches/speed.c.patch index 3baf9f2146..4b129f8718 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -1,5 +1,5 @@ ---- apps/openssl/speed.c.orig Sun May 21 12:13:46 2023 -+++ apps/openssl/speed.c Sun May 21 12:31:50 2023 +--- apps/openssl/speed.c.orig Fri Jul 28 06:04:45 2023 ++++ apps/openssl/speed.c Fri Jul 28 06:09:00 2023 @@ -161,7 +161,16 @@ static void pkey_print_message(const char *str, const char *str2, long num, int bits, int sec); @@ -74,7 +74,7 @@ if (!mr) { fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION)); fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON)); -@@ -1915,11 +1934,15 @@ pkey_print_message(const char *str, const char *str2, +@@ -1898,11 +1917,15 @@ pkey_print_message(const char *str, const char *str2, static void print_result(int alg, int run_no, int count, double time_used) { @@ -90,7 +90,7 @@ static char * sstrsep(char **string, const char *delim) { -@@ -2126,4 +2149,5 @@ do_multi(int multi) +@@ -2109,4 +2132,5 @@ do_multi(int multi) free(fds); return 1; } From d7cc3e96950e56f07a90165584fb86a263a9489f Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 28 Jul 2023 06:15:42 -0600 Subject: [PATCH 0410/1283] Update man links --- man/links | 22 ++-------------------- 1 file changed, 2 insertions(+), 20 deletions(-) diff --git a/man/links b/man/links index cc09d2da33..b5f692488e 100644 --- a/man/links +++ b/man/links @@ -6,9 +6,6 @@ AES_encrypt.3,AES_cbc_encrypt.3 AES_encrypt.3,AES_decrypt.3 AES_encrypt.3,AES_set_decrypt_key.3 AES_encrypt.3,AES_set_encrypt_key.3 -ASN1_BIT_STRING_num_asc.3,ASN1_BIT_STRING_name_print.3 -ASN1_BIT_STRING_num_asc.3,ASN1_BIT_STRING_set_asc.3 -ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_check.3 ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_get_bit.3 ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_set_bit.3 ASN1_INTEGER_get.3,ASN1_ENUMERATED_get.3 @@ -179,11 +176,6 @@ BIO_dump.3,BIO_dump_fp.3 BIO_dump.3,BIO_dump_indent.3 BIO_dump.3,BIO_dump_indent_fp.3 BIO_dup_chain.3,BIO_dup_state.3 -BIO_f_asn1.3,BIO_asn1_get_prefix.3 -BIO_f_asn1.3,BIO_asn1_get_suffix.3 -BIO_f_asn1.3,BIO_asn1_set_prefix.3 -BIO_f_asn1.3,BIO_asn1_set_suffix.3 -BIO_f_asn1.3,asn1_ps_func.3 BIO_f_buffer.3,BIO_get_buffer_num_lines.3 BIO_f_buffer.3,BIO_set_buffer_read_data.3 BIO_f_buffer.3,BIO_set_buffer_size.3 @@ -353,16 +345,6 @@ BIO_should_retry.3,BIO_set_retry_reason.3 BIO_should_retry.3,BIO_should_io_special.3 BIO_should_retry.3,BIO_should_read.3 BIO_should_retry.3,BIO_should_write.3 -BN_BLINDING_new.3,BN_BLINDING_convert.3 -BN_BLINDING_new.3,BN_BLINDING_convert_ex.3 -BN_BLINDING_new.3,BN_BLINDING_create_param.3 -BN_BLINDING_new.3,BN_BLINDING_free.3 -BN_BLINDING_new.3,BN_BLINDING_get_flags.3 -BN_BLINDING_new.3,BN_BLINDING_invert.3 -BN_BLINDING_new.3,BN_BLINDING_invert_ex.3 -BN_BLINDING_new.3,BN_BLINDING_set_flags.3 -BN_BLINDING_new.3,BN_BLINDING_thread_id.3 -BN_BLINDING_new.3,BN_BLINDING_update.3 BN_CTX_new.3,BN_CTX_free.3 BN_CTX_start.3,BN_CTX_end.3 BN_CTX_start.3,BN_CTX_get.3 @@ -460,8 +442,6 @@ BN_zero.3,BN_value_one.3 BUF_MEM_new.3,BUF_MEM_free.3 BUF_MEM_new.3,BUF_MEM_grow.3 BUF_MEM_new.3,BUF_MEM_grow_clean.3 -BUF_MEM_new.3,BUF_reverse.3 -BUF_MEM_new.3,BUF_strdup.3 CMAC_Init.3,CMAC_CTX_cleanup.3 CMAC_Init.3,CMAC_CTX_copy.3 CMAC_Init.3,CMAC_CTX_free.3 @@ -495,9 +475,11 @@ CMS_get0_RecipientInfos.3,CMS_RecipientInfo_type.3 CMS_get0_SignerInfos.3,CMS_SignerInfo_cert_cmp.3 CMS_get0_SignerInfos.3,CMS_SignerInfo_get0_signature.3 CMS_get0_SignerInfos.3,CMS_SignerInfo_get0_signer_id.3 +CMS_get0_SignerInfos.3,CMS_SignerInfo_get_version.3 CMS_get0_SignerInfos.3,CMS_SignerInfo_set1_signer_cert.3 CMS_get0_type.3,CMS_get0_content.3 CMS_get0_type.3,CMS_get0_eContentType.3 +CMS_get0_type.3,CMS_get_version.3 CMS_get0_type.3,CMS_set1_eContentType.3 CMS_get1_ReceiptRequest.3,CMS_ReceiptRequest_create0.3 CMS_get1_ReceiptRequest.3,CMS_ReceiptRequest_get0_values.3 From aab9622a3fbfad3236d761e92fffd5bc17f0d698 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 31 Jul 2023 03:05:39 -0600 Subject: [PATCH 0411/1283] Fix typo in README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 02ec12b68d..7906fcf17f 100644 --- a/README.md +++ b/README.md @@ -182,7 +182,7 @@ It will tell CMake to find LibreSSL and if found will let you use the following * LibreSSL::SSL * LibreSSL::TLS -If you for example want to use the LibreSSL TLS library in your test program, include it like so (SSL and Cryto are required by TLS and included automatically too): +If you for example want to use the LibreSSL TLS library in your test program, include it like so (SSL and Crypto are required by TLS and included automatically too): ```cmake target_link_libraries(test LibreSSL::TLS) From dd37b95775c1c3774d4aac3be4b76beb361fbdd3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 3 Aug 2023 13:00:06 -0600 Subject: [PATCH 0412/1283] Retire the bn_rand_interval test --- tests/CMakeLists.txt | 5 ----- tests/Makefile.am | 5 ----- 2 files changed, 10 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index b6604785ee..d09b9da402 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -203,11 +203,6 @@ add_executable(bn_print bn_print.c) target_link_libraries(bn_print ${OPENSSL_TEST_LIBS}) add_test(bn_print bn_print) -# bn_rand_interval -add_executable(bn_rand_interval bn_rand_interval.c) -target_link_libraries(bn_rand_interval ${OPENSSL_TEST_LIBS}) -add_test(bn_rand_interval bn_rand_interval) - # bn_shift add_executable(bn_shift bn_shift.c) target_link_libraries(bn_shift ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index a77b145973..b860acef08 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -218,11 +218,6 @@ TESTS += bn_print check_PROGRAMS += bn_print bn_print_SOURCES = bn_print.c -# bn_rand_interval -TESTS += bn_rand_interval -check_PROGRAMS += bn_rand_interval -bn_rand_interval_SOURCES = bn_rand_interval.c - # bn_shift TESTS += bn_shift check_PROGRAMS += bn_shift From 89aca6d00314339caf560f173341aaf8be4919ee Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 3 Aug 2023 13:38:41 -0600 Subject: [PATCH 0413/1283] Update x509.h patch --- patches/windows_headers.patch | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/patches/windows_headers.patch b/patches/windows_headers.patch index e6bf5846b5..087d5ab33b 100644 --- a/patches/windows_headers.patch +++ b/patches/windows_headers.patch @@ -60,10 +60,9 @@ diff -u include/openssl.orig/pkcs7.h include/openssl/pkcs7.h /* Encryption_ID DES-CBC Digest_ID MD5 -diff -u include/openssl.orig/x509.h include/openssl/x509.h ---- include/openssl.orig/x509.h Tue Apr 18 03:26:56 2023 -+++ include/openssl/x509.h Tue Apr 18 03:27:14 2023 -@@ -106,6 +106,19 @@ +--- include/openssl/x509.h.orig Thu Aug 3 13:35:00 2023 ++++ include/openssl/x509.h Thu Aug 3 13:35:18 2023 +@@ -100,6 +100,19 @@ extern "C" { #endif From f543d27f22aee467093a56f36c3bf26cb3b3305b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 6 Aug 2023 08:32:06 -0600 Subject: [PATCH 0414/1283] Rebase rust-openssl patch --- .github/rust-openssl.patch | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/rust-openssl.patch b/.github/rust-openssl.patch index f62372020b..80fa0b7f86 100644 --- a/.github/rust-openssl.patch +++ b/.github/rust-openssl.patch @@ -1,8 +1,8 @@ diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs -index 1762068d..9e7295b0 100644 +index 21ccf3d0..1cf2d184 100644 --- a/openssl-sys/build/main.rs +++ b/openssl-sys/build/main.rs -@@ -285,7 +285,7 @@ See rust-openssl documentation for more information: +@@ -272,7 +272,7 @@ See rust-openssl documentation for more information: (3, 7, 0) => ('3', '7', '0'), (3, 7, 1) => ('3', '7', '1'), (3, 7, _) => ('3', '7', 'x'), From 500c57ae6d0262499a9a68fa19429ae7c06b0888 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 7 Aug 2023 06:17:07 -0600 Subject: [PATCH 0415/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 9618febb0f..09a2b09fb0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -78,6 +78,7 @@ LibreSSL Portable Release Notes: to use *_{get,set}_app_data() and *_{get,set}_ex_data() alongside each other. - Made EVP_PKEY_set1_hkdf_key() fail on a NULL key. + - Plugged leaks in BIO_chain_dup(). * Documentation improvements - Made it very explicit that the verify callback should not be used. - Called out that the CRL lastUpdate is standardized as thisUpdate. From 30c240160d0054441d42b243f64db86b1606911d Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Tue, 8 Aug 2023 08:11:40 +0200 Subject: [PATCH 0416/1283] CI: get rid of travis-ci coverity wrapper --- .github/workflows/coverity.yml | 38 +++++++++++++++++++++++++--------- 1 file changed, 28 insertions(+), 10 deletions(-) diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index bc0ee0d4cb..85799f15ad 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -9,20 +9,38 @@ jobs: scan: runs-on: ubuntu-latest if: ${{ github.repository_owner == 'libressl' }} - env: - COVERITY_SCAN_PROJECT_NAME: 'libressl-portable/portable' - COVERITY_SCAN_BRANCH_PATTERN: '*' - COVERITY_SCAN_NOTIFICATION_EMAIL: 'libressl-security@openbsd.org' - COVERITY_SCAN_BUILD_COMMAND_PREPEND: "./autogen.sh && ./configure && make dist && tar zxf libressl-*.tar.gz && rm libressl-*.tar.gz && cd libressl-* && mkdir build-static && mkdir build-shared && cmake -GNinja -DBUILD_SHARED_LIBS=ON .." - COVERITY_SCAN_BUILD_COMMAND: "ninja" steps: - uses: actions/checkout@main - name: Install apt dependencies run: | sudo apt-get update sudo apt-get install -y cmake ninja-build - - name: Run Coverity Scan - env: - COVERITY_SCAN_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }} + - name: Download Coverity build tool run: | - curl -fsSL "https://scan.coverity.com/scripts/travisci_build_coverity_scan.sh" | bash || true + wget -c -N https://scan.coverity.com/download/linux64 --post-data "token=${{ secrets.COVERITY_SCAN_TOKEN }}&project=libressl-portable%2Fportable" -O coverity_tool.tar.gz + mkdir coverity_tool + tar xzf coverity_tool.tar.gz --strip 1 -C coverity_tool + - name: Configure + run: | + ./autogen.sh + ./configure + make dist + tar zxf libressl-*.tar.gz + rm libressl-*.tar.gz + cd libressl-* + mkdir build-static + mkdir build-shared + cmake -GNinja -DBUILD_SHARED_LIBS=ON .. + - name: Build with Coverity build tool + run: | + export PATH=`pwd`/coverity_tool/bin:$PATH + cov-build --dir cov-int ninja + - name: Submit build result to Coverity Scan + run: | + tar czvf cov.tar.gz cov-int + curl --form token=${{ secrets.COVERITY_SCAN_TOKEN }} \ + --form email=libressl-security@openbsd.org \ + --form file=@cov.tar.gz \ + --form version="Commit $GITHUB_SHA" \ + --form description="Build submitted via CI" \ + https://scan.coverity.com/builds?project=libressl-portable%2Fportable From 61025c5a5e182f0487f4ce801f979798063b0ffc Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 9 Aug 2023 05:45:10 -0600 Subject: [PATCH 0417/1283] Remove bn_blind.c, rsa_crpt.c; add rsa_blinding.c --- crypto/CMakeLists.txt | 3 +-- crypto/Makefile.am | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index cce0e7015f..b4259596b8 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -345,7 +345,6 @@ set( bio/bss_null.c bio/bss_sock.c bn/bn_add.c - bn/bn_blind.c bn/bn_bpsw.c bn/bn_const.c bn/bn_convert.c @@ -638,8 +637,8 @@ set( ripemd/ripemd.c rsa/rsa_ameth.c rsa/rsa_asn1.c + rsa/rsa_blinding.c rsa/rsa_chk.c - rsa/rsa_crpt.c rsa/rsa_eay.c rsa/rsa_err.c rsa/rsa_gen.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index d0486688b9..e538a0e430 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -346,7 +346,6 @@ noinst_HEADERS += bio/bio_local.h # bn libcrypto_la_SOURCES += bn/bn_add.c -libcrypto_la_SOURCES += bn/bn_blind.c libcrypto_la_SOURCES += bn/bn_bpsw.c libcrypto_la_SOURCES += bn/bn_const.c libcrypto_la_SOURCES += bn/bn_convert.c @@ -851,8 +850,8 @@ noinst_HEADERS += ripemd/rmdconst.h # rsa libcrypto_la_SOURCES += rsa/rsa_ameth.c libcrypto_la_SOURCES += rsa/rsa_asn1.c +libcrypto_la_SOURCES += rsa/rsa_blinding.c libcrypto_la_SOURCES += rsa/rsa_chk.c -libcrypto_la_SOURCES += rsa/rsa_crpt.c libcrypto_la_SOURCES += rsa/rsa_eay.c libcrypto_la_SOURCES += rsa/rsa_err.c libcrypto_la_SOURCES += rsa/rsa_gen.c From 6650dcecc69dba13054c31a7c4eba8402d99ab53 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 10 Aug 2023 05:09:06 -0600 Subject: [PATCH 0418/1283] rmdconst.h was removed --- crypto/Makefile.am | 1 - 1 file changed, 1 deletion(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index e538a0e430..d93b879e16 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -845,7 +845,6 @@ noinst_HEADERS += rc4/rc4_local.h # ripemd libcrypto_la_SOURCES += ripemd/ripemd.c -noinst_HEADERS += ripemd/rmdconst.h # rsa libcrypto_la_SOURCES += rsa/rsa_ameth.c From 5c63ba97612e1430d049be0bb7b179db24936a28 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Sun, 6 Aug 2023 18:13:51 +0000 Subject: [PATCH 0419/1283] cmake: fix to use MINGW variable to detect MinGW --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index c5b880b381..690cd48ab3 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -362,7 +362,7 @@ if(ENABLE_ASM) elseif(MSVC AND ("${CMAKE_GENERATOR}" MATCHES "Win64" OR "${CMAKE_GENERATOR_PLATFORM}" STREQUAL "x64")) set(HOST_ASM_MASM_X86_64 true) ENABLE_LANGUAGE(ASM_MASM) - elseif(CMAKE_SYSTEM_NAME MATCHES "MINGW" AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "x86_64") + elseif(MINGW AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "x86_64") set(HOST_ASM_MINGW64_X86_64 true) endif() endif() From e0fd031f300570437f1aa768ea6997850a36cd0a Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Sun, 6 Aug 2023 18:14:25 +0000 Subject: [PATCH 0420/1283] cmake: fix to not force-disable ASM for MinGW builds --- crypto/CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index b4259596b8..1e73e8854c 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -904,7 +904,7 @@ else() (NOT "${CMAKE_GENERATOR_PLATFORM}" STREQUAL "x64")) add_definitions(-DOPENSSL_NO_ASM) endif() - elseif(WIN32) + elseif(WIN32 AND NOT MINGW) add_definitions(-DOPENSSL_NO_ASM) endif() endif() From 752eb8a4e96d62f7c8fc1468e73f2ef56c469e0c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 11 Aug 2023 17:01:03 -0600 Subject: [PATCH 0421/1283] Update man links --- man/links | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/man/links b/man/links index b5f692488e..44dde5a394 100644 --- a/man/links +++ b/man/links @@ -145,7 +145,6 @@ BF_set_key.3,BF_decrypt.3 BF_set_key.3,BF_ecb_encrypt.3 BF_set_key.3,BF_encrypt.3 BF_set_key.3,BF_ofb64_encrypt.3 -BF_set_key.3,BF_options.3 BIO_accept.3,BIO_get_accept_socket.3 BIO_accept.3,BIO_get_host_ip.3 BIO_accept.3,BIO_get_port.3 @@ -889,6 +888,7 @@ EVP_DigestInit.3,EVP_DigestUpdate.3 EVP_DigestInit.3,EVP_MAX_MD_SIZE.3 EVP_DigestInit.3,EVP_MD_CTX_block_size.3 EVP_DigestInit.3,EVP_MD_CTX_cleanup.3 +EVP_DigestInit.3,EVP_MD_CTX_clear_flags.3 EVP_DigestInit.3,EVP_MD_CTX_copy.3 EVP_DigestInit.3,EVP_MD_CTX_copy_ex.3 EVP_DigestInit.3,EVP_MD_CTX_create.3 @@ -897,11 +897,17 @@ EVP_DigestInit.3,EVP_MD_CTX_destroy.3 EVP_DigestInit.3,EVP_MD_CTX_free.3 EVP_DigestInit.3,EVP_MD_CTX_init.3 EVP_DigestInit.3,EVP_MD_CTX_md.3 +EVP_DigestInit.3,EVP_MD_CTX_md_data.3 EVP_DigestInit.3,EVP_MD_CTX_new.3 +EVP_DigestInit.3,EVP_MD_CTX_pkey_ctx.3 EVP_DigestInit.3,EVP_MD_CTX_reset.3 +EVP_DigestInit.3,EVP_MD_CTX_set_flags.3 +EVP_DigestInit.3,EVP_MD_CTX_set_pkey_ctx.3 EVP_DigestInit.3,EVP_MD_CTX_size.3 +EVP_DigestInit.3,EVP_MD_CTX_test_flags.3 EVP_DigestInit.3,EVP_MD_CTX_type.3 EVP_DigestInit.3,EVP_MD_block_size.3 +EVP_DigestInit.3,EVP_MD_flags.3 EVP_DigestInit.3,EVP_MD_pkey_type.3 EVP_DigestInit.3,EVP_MD_size.3 EVP_DigestInit.3,EVP_MD_type.3 @@ -2256,6 +2262,8 @@ X509_STORE_CTX_set_verify.3,X509_STORE_set_verify.3 X509_STORE_CTX_set_verify.3,X509_STORE_set_verify_func.3 X509_STORE_CTX_set_verify_cb.3,X509_STORE_CTX_get_verify_cb.3 X509_STORE_CTX_set_verify_cb.3,X509_STORE_CTX_verify_cb.3 +X509_STORE_get_by_subject.3,X509_STORE_CTX_get1_certs.3 +X509_STORE_get_by_subject.3,X509_STORE_CTX_get1_crls.3 X509_STORE_get_by_subject.3,X509_STORE_CTX_get1_issuer.3 X509_STORE_get_by_subject.3,X509_STORE_CTX_get_by_subject.3 X509_STORE_get_by_subject.3,X509_STORE_CTX_get_obj_by_subject.3 @@ -2477,6 +2485,8 @@ bn_dump.3,mul.3 bn_dump.3,mul_add.3 bn_dump.3,sqr.3 d2i_ASN1_NULL.3,i2d_ASN1_NULL.3 +d2i_ASN1_OBJECT.3,OBJ_get0_data.3 +d2i_ASN1_OBJECT.3,OBJ_length.3 d2i_ASN1_OBJECT.3,i2d_ASN1_OBJECT.3 d2i_ASN1_OCTET_STRING.3,d2i_ASN1_BIT_STRING.3 d2i_ASN1_OCTET_STRING.3,d2i_ASN1_BMPSTRING.3 From 3b0e389fc36461cbac435b982dbd0f722d281f0b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 11 Aug 2023 17:03:11 -0600 Subject: [PATCH 0422/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 09a2b09fb0..71d8114821 100644 --- a/ChangeLog +++ b/ChangeLog @@ -56,6 +56,8 @@ LibreSSL Portable Release Notes: - Rewrote OBJ_find_sigid_algs() and OBJ_find_sigid_by_algs(). - Various improvements in the 'simple' EC code. - Fix OPENSSL_cpuid_setup() invocations on arm/aarch64. + - Fixed numerous leaks and other minor bugs in RSA, DH, DSA and EC + ASN.1 methods. Unified the coding style. * New features * Compatibility changes - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain From 761c90d45bbcfe5b874d576aaf5ad4c1228c7bed Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 11 Aug 2023 17:18:24 -0600 Subject: [PATCH 0423/1283] Update ChangeLog --- ChangeLog | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 71d8114821..ef62523307 100644 --- a/ChangeLog +++ b/ChangeLog @@ -56,8 +56,10 @@ LibreSSL Portable Release Notes: - Rewrote OBJ_find_sigid_algs() and OBJ_find_sigid_by_algs(). - Various improvements in the 'simple' EC code. - Fix OPENSSL_cpuid_setup() invocations on arm/aarch64. - - Fixed numerous leaks and other minor bugs in RSA, DH, DSA and EC - ASN.1 methods. Unified the coding style. + - Reduced the dependency of hash implementations on many layers of + macros. This results in significant speedups since modern compilers + are now less confused. + - Significantly simplified the BN_BLINDING internals used in RSA. * New features * Compatibility changes - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain @@ -81,6 +83,8 @@ LibreSSL Portable Release Notes: each other. - Made EVP_PKEY_set1_hkdf_key() fail on a NULL key. - Plugged leaks in BIO_chain_dup(). + - Fixed numerous leaks and other minor bugs in RSA, DH, DSA and EC + ASN.1 methods. Unified the coding style. * Documentation improvements - Made it very explicit that the verify callback should not be used. - Called out that the CRL lastUpdate is standardized as thisUpdate. From 93da76767694776b53c8e9dbea46d4ae0ba8cbfd Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Sat, 12 Aug 2023 22:38:27 +0200 Subject: [PATCH 0424/1283] CI: fix coverity task --- .github/workflows/coverity.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 85799f15ad..e1bfcb0c96 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -34,9 +34,11 @@ jobs: - name: Build with Coverity build tool run: | export PATH=`pwd`/coverity_tool/bin:$PATH + cd libressl-* cov-build --dir cov-int ninja - name: Submit build result to Coverity Scan run: | + cd libressl-* tar czvf cov.tar.gz cov-int curl --form token=${{ secrets.COVERITY_SCAN_TOKEN }} \ --form email=libressl-security@openbsd.org \ From 125c54cdd79670c6a0b762d8534488a02383764e Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 27 Jul 2023 06:10:20 -0500 Subject: [PATCH 0425/1283] set default build type to 'Release' --- CMakeLists.txt | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index c5b880b381..272cf6a166 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1,8 +1,6 @@ +cmake_minimum_required (VERSION 3.20.0) if(MSVC) - cmake_minimum_required (VERSION 3.16.4) cmake_policy(SET CMP0091 NEW) -else() - cmake_minimum_required (VERSION 3.0) endif() project (LibreSSL C ASM) @@ -51,6 +49,17 @@ if(NOT LIBRESSL_SKIP_INSTALL) set( ENABLE_LIBRESSL_INSTALL ON ) endif(NOT LIBRESSL_SKIP_INSTALL) +# Set a default build type if none was specified +set(default_build_type "Release") + +if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES) + message(STATUS "Setting build type to '${default_build_type}' as none was specified.") + set(CMAKE_BUILD_TYPE "${default_build_type}" CACHE + STRING "Choose the type of build." FORCE) + # Set the possible values of build type for cmake-gui + set_property(CACHE CMAKE_BUILD_TYPE PROPERTY + STRINGS "Debug" "Release" "MinSizeRel" "RelWithDebInfo") +endif() set(BUILD_NC true) From 7e59829f180ae6542c2582334ab5830c15ba3cea Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 13 Aug 2023 23:02:24 -0500 Subject: [PATCH 0426/1283] version is breaking things --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 272cf6a166..8027474974 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1,4 +1,4 @@ -cmake_minimum_required (VERSION 3.20.0) +cmake_minimum_required (VERSION 3.16.4) if(MSVC) cmake_policy(SET CMP0091 NEW) endif() From 585a4c8c61476dc2df7152a420c60de9f5fa2359 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 14 Aug 2023 02:56:05 -0600 Subject: [PATCH 0427/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index ef62523307..612711793e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -85,6 +85,8 @@ LibreSSL Portable Release Notes: - Plugged leaks in BIO_chain_dup(). - Fixed numerous leaks and other minor bugs in RSA, DH, DSA and EC ASN.1 methods. Unified the coding style. + - On socket errors in the poll loop, netcat could issue system calls + on invalidated file descriptors. * Documentation improvements - Made it very explicit that the verify callback should not be used. - Called out that the CRL lastUpdate is standardized as thisUpdate. From bc03c7c8988f0340416af187211eb4a8b8448061 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 15 Aug 2023 15:19:06 -0600 Subject: [PATCH 0428/1283] Regen netcat patch --- patches/netcat.c.patch | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/patches/netcat.c.patch b/patches/netcat.c.patch index f9d4be05c0..9c3a45080e 100644 --- a/patches/netcat.c.patch +++ b/patches/netcat.c.patch @@ -1,5 +1,5 @@ ---- apps/nc/netcat.c.orig Thu Feb 9 18:42:55 2023 -+++ apps/nc/netcat.c Thu Feb 9 18:43:08 2023 +--- apps/nc/netcat.c.orig Tue Aug 15 15:17:28 2023 ++++ apps/nc/netcat.c Tue Aug 15 15:17:54 2023 @@ -93,9 +93,13 @@ int zflag; /* Port Scan Flag */ int Dflag; /* sodebug */ int Iflag; /* TCP receive buffer size */ @@ -100,7 +100,7 @@ set_common_sockopts(s, res->ai_family); -@@ -1557,11 +1577,13 @@ set_common_sockopts(int s, int af) +@@ -1563,11 +1583,13 @@ set_common_sockopts(int s, int af) { int x = 1; @@ -114,7 +114,7 @@ if (Dflag) { if (setsockopt(s, SOL_SOCKET, SO_DEBUG, &x, sizeof(x)) == -1) -@@ -1572,9 +1594,16 @@ set_common_sockopts(int s, int af) +@@ -1578,9 +1600,16 @@ set_common_sockopts(int s, int af) IP_TOS, &Tflag, sizeof(Tflag)) == -1) err(1, "set IP ToS"); @@ -131,7 +131,7 @@ } if (Iflag) { if (setsockopt(s, SOL_SOCKET, SO_RCVBUF, -@@ -1598,13 +1627,17 @@ set_common_sockopts(int s, int af) +@@ -1604,13 +1633,17 @@ set_common_sockopts(int s, int af) } if (minttl != -1) { @@ -150,7 +150,7 @@ } } -@@ -1829,15 +1862,19 @@ help(void) +@@ -1835,15 +1868,19 @@ help(void) \t-P proxyuser\tUsername for proxy authentication\n\ \t-p port\t Specify local port for remote connects\n\ \t-R CAfile CA bundle\n\ From caa119b41813664fc357d60880b23643ad2ecbaa Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 15 Aug 2023 15:21:11 -0600 Subject: [PATCH 0429/1283] Update man links --- man/links | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/man/links b/man/links index 44dde5a394..58cf948a3d 100644 --- a/man/links +++ b/man/links @@ -998,7 +998,6 @@ EVP_EncryptInit.3,EVP_cast5_cfb.3 EVP_EncryptInit.3,EVP_cast5_cfb64.3 EVP_EncryptInit.3,EVP_cast5_ecb.3 EVP_EncryptInit.3,EVP_cast5_ofb.3 -EVP_EncryptInit.3,EVP_chacha20.3 EVP_EncryptInit.3,EVP_enc_null.3 EVP_EncryptInit.3,EVP_get_cipherbyname.3 EVP_EncryptInit.3,EVP_get_cipherbynid.3 @@ -1225,6 +1224,7 @@ EVP_camellia_128_cbc.3,EVP_camellia_256_cfb128.3 EVP_camellia_128_cbc.3,EVP_camellia_256_cfb8.3 EVP_camellia_128_cbc.3,EVP_camellia_256_ecb.3 EVP_camellia_128_cbc.3,EVP_camellia_256_ofb.3 +EVP_chacha20.3,EVP_chacha20_poly1305.3 EVP_des_cbc.3,EVP_des_cfb.3 EVP_des_cbc.3,EVP_des_cfb1.3 EVP_des_cbc.3,EVP_des_cfb64.3 @@ -1248,6 +1248,9 @@ EVP_des_cbc.3,EVP_des_ofb.3 EVP_des_cbc.3,EVP_desx_cbc.3 EVP_rc4.3,EVP_rc4_40.3 EVP_rc4.3,EVP_rc4_hmac_md5.3 +EVP_sha3_224.3,EVP_sha3_256.3 +EVP_sha3_224.3,EVP_sha3_384.3 +EVP_sha3_224.3,EVP_sha3_512.3 EVP_sm4_cbc.3,EVP_sm4_cfb.3 EVP_sm4_cbc.3,EVP_sm4_cfb128.3 EVP_sm4_cbc.3,EVP_sm4_ctr.3 From 3c49cfb3447f61ced5bb64e8a23cc5abd4e84a2b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 15 Aug 2023 23:52:26 +0200 Subject: [PATCH 0430/1283] Add htole32 and le32toh for macos and windows Windows assumes little endian for now... --- include/compat/endian.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/include/compat/endian.h b/include/compat/endian.h index 928affe90c..0945ecef14 100644 --- a/include/compat/endian.h +++ b/include/compat/endian.h @@ -51,7 +51,9 @@ #include #define be16toh(x) OSSwapBigToHostInt16((x)) #define htobe16(x) OSSwapHostToBigInt16((x)) +#define le32toh(x) OSSwapLittleToHostInt32((x)) #define be32toh(x) OSSwapBigToHostInt32((x)) +#define htole32(x) OSSwapHostToLittleInt32(x) #define htobe32(x) OSSwapHostToBigInt32(x) #define htole64(x) OSSwapHostToLittleInt64(x) #define htobe64(x) OSSwapHostToBigInt64(x) @@ -64,7 +66,9 @@ #define be16toh(x) ntohs((x)) #define htobe16(x) htons((x)) +#define le32toh(x) (x) #define be32toh(x) ntohl((x)) +#define htole32(x) (x) #define htobe32(x) ntohl((x)) #define be64toh(x) ntohll((x)) From 29159e34e39e0ac337526560f954d3b1d39cb32b Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 16 Aug 2023 05:20:48 -0500 Subject: [PATCH 0431/1283] add htole32/le32toh for Solaris --- include/compat/endian.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/compat/endian.h b/include/compat/endian.h index 0945ecef14..3d55994767 100644 --- a/include/compat/endian.h +++ b/include/compat/endian.h @@ -132,8 +132,10 @@ #define be16toh(x) BE_IN16(x) #define betoh16(x) BE_IN16(x) #define htobe16(x) BE_16(x) +#define le32toh(x) LE_IN32(x) #define be32toh(x) BE_IN32(x) #define betoh32(x) BE_IN32(x) +#define htole32(x) LE_32(x) #define htobe32(x) BE_32(x) #define be64toh(x) BE_IN64(x) #define betoh64(x) BE_IN64(x) From ebc38481f0bc50f4f302b978c9348ce2f93981aa Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 17 Aug 2023 20:46:14 +0200 Subject: [PATCH 0432/1283] Simplify and fix solaris endian.h macros Fixes #898 --- include/compat/endian.h | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/include/compat/endian.h b/include/compat/endian.h index 3d55994767..d0dcfe3251 100644 --- a/include/compat/endian.h +++ b/include/compat/endian.h @@ -129,16 +129,13 @@ #if defined(__sun) #include -#define be16toh(x) BE_IN16(x) -#define betoh16(x) BE_IN16(x) +#define be16toh(x) BE_16(x) #define htobe16(x) BE_16(x) -#define le32toh(x) LE_IN32(x) -#define be32toh(x) BE_IN32(x) -#define betoh32(x) BE_IN32(x) +#define le32toh(x) LE_32(x) +#define be32toh(x) BE_32(x) #define htole32(x) LE_32(x) #define htobe32(x) BE_32(x) -#define be64toh(x) BE_IN64(x) -#define betoh64(x) BE_IN64(x) +#define be64toh(x) BE_64(x) #define htobe64(x) BE_64(x) #endif From afcdc1aefe0a044b3bf9a627367d50ab4f2d7704 Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Thu, 17 Aug 2023 22:33:40 +0200 Subject: [PATCH 0433/1283] CI: Solaris: display tests/test-suite.log in case of failure --- .github/workflows/solaris_test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/solaris_test.yml b/.github/workflows/solaris_test.yml index e5fc8f126e..f5e6bf49d7 100644 --- a/.github/workflows/solaris_test.yml +++ b/.github/workflows/solaris_test.yml @@ -27,4 +27,4 @@ jobs: pkg install gcc make run: | MAKE=gmake ./configure - gmake -j2 check + gmake -j2 check || (cat tests/test-suite.log && exit 1) From 30e43e7ab5f9a3cef1b79b6e2c8000837c597f5e Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Thu, 17 Aug 2023 23:11:26 +0200 Subject: [PATCH 0434/1283] CI: add scheduled Fedora Rawhide builds Fedora Rawhide is shipped with the most recent gcc/clang, it is nice to test build on them from time to time --- .github/workflows/fedora-rawhide.yml | 40 ++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 .github/workflows/fedora-rawhide.yml diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml new file mode 100644 index 0000000000..f593815217 --- /dev/null +++ b/.github/workflows/fedora-rawhide.yml @@ -0,0 +1,40 @@ +name: Fedora/Rawhide + +on: + workflow_dispatch: + schedule: + - cron: "0 0 * * *" + +permissions: + contents: read + +jobs: + build_and_test: + strategy: + matrix: + cc: [ gcc, clang ] + name: ${{ matrix.cc }} + runs-on: ubuntu-latest + container: + image: fedora:rawhide + steps: + - uses: actions/checkout@v3 + - name: Install dependencies + run: | + dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch + - name: Configure + run: | + ./autogen.sh + ./configure + - name: Make dist + run: | + make dist + tar zxvf libressl-*.tar.gz + rm libressl-*.tar.gz + - name: Build and test + run: | + cd libressl-* + mkdir build-shared + cmake -GNinja -DBUILD_SHARED_LIBS=ON .. + ninja + ninja test From c62972a3f498d316ec1ca0f174f405bfc7f075b7 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 18 Aug 2023 04:49:19 -0500 Subject: [PATCH 0435/1283] compat changes --- ChangeLog | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/ChangeLog b/ChangeLog index 612711793e..f0c8115395 100644 --- a/ChangeLog +++ b/ChangeLog @@ -31,6 +31,28 @@ LibreSSL Portable Release Notes: 3.8.1 - In development * Portable changes + - Applications bundled as part of the LibreSSL package internally, + nc(1) and openssl(1), now are linked statically if static libraries + are built. + - Internal compatibility function symbols are no longer exported from + libcrypto. Instead, the libcompat library is linked to libcrypto, + libssl, and libtls separately. This increases size a little, but + ensures that the libraries are not exporting symbols to programs + unintentionally. + - Selective removal of CET implementation on platforms where it is + not supported (macOS). + - Integrated four more tests + - Added Windows ARM64 architecture to tested platforms + - Removed Solaris 10 support, fixed Solaris 11 + - libtls no longer links statically to libcrypto / libssl unless + '--enable-libtls-only' is specified at configure time. + - Improved Windows compatibility library, namely handling of files vs + sockets, correcting an exception when operating on a closed socket. + - CMake builds no longer hardcode '-O2' into the compiler flags, instead + using flags from the CMake build type instead. + - Set the CMake default build type to 'Release'. This can be overridden + during configuration. + - Fixed broken ASM support with MinGW builds * Internal improvements - Fixed alignment handling in SHA-512. - Moved the verified_chain to the correct internal struct. From 30188c46f510f11c8b1b553b685367a2155588b7 Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Fri, 18 Aug 2023 19:00:45 +0200 Subject: [PATCH 0436/1283] CI: fedora rawhide follow up --- .github/workflows/fedora-rawhide.yml | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index f593815217..092a437151 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -22,19 +22,13 @@ jobs: - name: Install dependencies run: | dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch - - name: Configure + - name: Pull upstream source run: | - ./autogen.sh - ./configure - - name: Make dist + ./update.sh + - name: Build run: | - make dist - tar zxvf libressl-*.tar.gz - rm libressl-*.tar.gz - - name: Build and test - run: | - cd libressl-* - mkdir build-shared - cmake -GNinja -DBUILD_SHARED_LIBS=ON .. + CC=${{ matrix.cc }} cmake -GNinja -DBUILD_SHARED_LIBS=ON . ninja + - name: Test + run: | ninja test From 5432e22b25026fb50b00ab5dcf894e18daa8bcb6 Mon Sep 17 00:00:00 2001 From: Pierre Wendling Date: Sun, 6 Aug 2023 15:04:02 -0400 Subject: [PATCH 0437/1283] CMake: Copy public headers to the build directory. --- include/CMakeLists.txt | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt index ca81ee885d..9d015cd5ea 100644 --- a/include/CMakeLists.txt +++ b/include/CMakeLists.txt @@ -10,6 +10,14 @@ if(ENABLE_LIBRESSL_INSTALL) DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/openssl") endif(ENABLE_LIBRESSL_INSTALL) +file(COPY . + DESTINATION "${CMAKE_BINARY_DIR}/include" + PATTERN "CMakeLists.txt" EXCLUDE + PATTERN "compat" EXCLUDE + PATTERN "pqueue.h" EXCLUDE + PATTERN "Makefile*" EXCLUDE + PATTERN "arch" EXCLUDE) + if(HOST_AARCH64) file(READ arch/aarch64/opensslconf.h OPENSSLCONF) elseif(HOST_ARM) From a89cd65980153ef60b42cb26d3bef949751f87f1 Mon Sep 17 00:00:00 2001 From: Pierre Wendling Date: Sun, 6 Aug 2023 15:07:31 -0400 Subject: [PATCH 0438/1283] CMake: Export and install library targets. The configs can be consumed by setting LibreSSL_DIR to the build directory, or after installation using CMAKE_PREFIX_PATH/LibreSSL_DIR. For compatibility, the EXPORT_NAME of targets and the LIBRESSL_* variables are set to match the names used in FindLibreSSL. --- CMakeLists.txt | 34 +++++++++++++++++++++++++++++++++- LibreSSLConfig.cmake.in | 33 +++++++++++++++++++++++++++++++++ Makefile.am | 2 +- crypto/CMakeLists.txt | 32 +++++++++++++++++++++++++++++--- ssl/CMakeLists.txt | 32 +++++++++++++++++++++++++++++--- tls/CMakeLists.txt | 32 +++++++++++++++++++++++++++++--- 6 files changed, 154 insertions(+), 11 deletions(-) create mode 100644 LibreSSLConfig.cmake.in diff --git a/CMakeLists.txt b/CMakeLists.txt index 991f60c4e7..8e26e4722d 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -39,6 +39,7 @@ option(ENABLE_ASM "Enable assembly" ON) option(ENABLE_EXTRATESTS "Enable extra tests that may be unreliable on some platforms" OFF) option(ENABLE_NC "Enable installing TLS-enabled nc(1)" OFF) set(OPENSSLDIR ${OPENSSLDIR} CACHE PATH "Set the default openssl directory" FORCE) +set(LIBRESSL_INSTALL_CMAKEDIR "${CMAKE_INSTALL_LIBDIR}/cmake" CACHE STRING "Installation directory for the CMake targets") option(USE_STATIC_MSVC_RUNTIMES "Use /MT instead of /MD in MSVC" OFF) if(USE_STATIC_MSVC_RUNTIMES) @@ -439,6 +440,38 @@ if (BUILD_APPLE_XCFRAMEWORK) endif(ENABLE_LIBRESSL_INSTALL) endif(BUILD_APPLE_XCFRAMEWORK) +file(STRINGS "VERSION" VERSION LIMIT_COUNT 1) +include(CMakePackageConfigHelpers) +write_basic_package_version_file( + "LibreSSLConfigVersion.cmake" + VERSION "${VERSION}" + COMPATIBILITY SameMajorVersion +) + +set(INCLUDE_DIRECTORY "${CMAKE_BINARY_DIR}/include") +configure_package_config_file( + "${CMAKE_CURRENT_LIST_DIR}/LibreSSLConfig.cmake.in" + "${CMAKE_CURRENT_BINARY_DIR}/LibreSSLConfig.cmake" + PATH_VARS INCLUDE_DIRECTORY + INSTALL_DESTINATION "${CMAKE_CURRENT_BINARY_DIR}" + INSTALL_PREFIX "${CMAKE_CURRENT_BINARY_DIR}" +) + +if(ENABLE_LIBRESSL_INSTALL) + set(INCLUDE_DIRECTORY "${CMAKE_INSTALL_INCLUDEDIR}") + configure_package_config_file( + "${CMAKE_CURRENT_LIST_DIR}/LibreSSLConfig.cmake.in" + "${CMAKE_CURRENT_BINARY_DIR}/install-config/LibreSSLConfig.cmake" + PATH_VARS INCLUDE_DIRECTORY + INSTALL_DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}/LibreSSL" + ) + install(FILES + "${CMAKE_BINARY_DIR}/install-config/LibreSSLConfig.cmake" + "${CMAKE_BINARY_DIR}/LibreSSLConfigVersion.cmake" + DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}/LibreSSL" + ) +endif() + if(ENABLE_LIBRESSL_INSTALL) if(NOT MSVC) # Create pkgconfig files. @@ -449,7 +482,6 @@ if(ENABLE_LIBRESSL_INSTALL) if(PLATFORM_LIBS) string(REGEX REPLACE ";" " -l" PLATFORM_LDADD ";${PLATFORM_LIBS}") endif() - file(STRINGS "VERSION" VERSION LIMIT_COUNT 1) file(GLOB OPENSSL_PKGCONFIGS "*.pc.in") foreach(file ${OPENSSL_PKGCONFIGS}) get_filename_component(filename ${file} NAME) diff --git a/LibreSSLConfig.cmake.in b/LibreSSLConfig.cmake.in new file mode 100644 index 0000000000..d6fbe3b211 --- /dev/null +++ b/LibreSSLConfig.cmake.in @@ -0,0 +1,33 @@ +@PACKAGE_INIT@ + +set(LIBRESSL_VERSION @VERSION@) +set_and_check(LIBRESSL_INCLUDE_DIR @PACKAGE_INCLUDE_DIRECTORY@) + +if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-Crypto.cmake") + include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-Crypto.cmake") + set(LIBRESSL_CRYPTO_LIBRARY LibreSSL::Crypto) +endif() + +if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-SSL.cmake") + include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-SSL.cmake") + set(LIBRESSL_SSL_LIBRARY LibreSSL::SSL) +endif() + +if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-TLS.cmake") + include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-TLS.cmake") + set(LIBRESSL_TLS_LIBRARY LibreSSL::TLS) +endif() + +set(LIBRESSL_LIBRARIES + ${LIBRESSL_CRYPTO_LIBRARY} + ${LIBRESSL_SSL_LIBRARY} + ${LIBRESSL_TLS_LIBRARY} +) + +check_required_components( + Crypto + SSL + TLS +) + +set(LIBRESSL_FOUND TRUE) diff --git a/Makefile.am b/Makefile.am index d28692a23d..2edef0db5a 100644 --- a/Makefile.am +++ b/Makefile.am @@ -11,7 +11,7 @@ pkgconfig_DATA += libcrypto.pc libssl.pc openssl.pc endif EXTRA_DIST = README.md README.windows VERSION config scripts -EXTRA_DIST += CMakeLists.txt cmake_export_symbol.cmake cmake_uninstall.cmake.in FindLibreSSL.cmake +EXTRA_DIST += CMakeLists.txt cmake_export_symbol.cmake cmake_uninstall.cmake.in FindLibreSSL.cmake LibreSSLConfig.cmake.in EXTRA_DIST += cert.pem openssl.cnf x509v3.cnf .PHONY: install_sw diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 1e73e8854c..597ffef779 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -990,9 +990,29 @@ if (WIN32) endif() set_target_properties(crypto PROPERTIES OUTPUT_NAME crypto${CRYPTO_POSTFIX} - ARCHIVE_OUTPUT_NAME crypto${CRYPTO_POSTFIX}) -set_target_properties(crypto PROPERTIES VERSION - ${CRYPTO_VERSION} SOVERSION ${CRYPTO_MAJOR_VERSION}) + ARCHIVE_OUTPUT_NAME crypto${CRYPTO_POSTFIX} + EXPORT_NAME Crypto + VERSION ${CRYPTO_VERSION} + SOVERSION ${CRYPTO_MAJOR_VERSION} +) + +target_include_directories( + crypto + PUBLIC + $ + $ +) + +install( + TARGETS crypto + EXPORT Crypto-target +) + +export( + EXPORT Crypto-target + FILE "${LibreSSL_BINARY_DIR}/LibreSSL-Crypto.cmake" + NAMESPACE LibreSSL:: +) if(ENABLE_LIBRESSL_INSTALL) install( @@ -1001,6 +1021,12 @@ if(ENABLE_LIBRESSL_INSTALL) LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR} RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} ) + install( + EXPORT Crypto-target + FILE "LibreSSL-Crypto.cmake" + NAMESPACE LibreSSL:: + DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}/LibreSSL" + ) endif(ENABLE_LIBRESSL_INSTALL) # build static library for regression test diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 3d5b5df1c5..16ef277769 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -91,9 +91,29 @@ if (WIN32) endif() set_target_properties(ssl PROPERTIES OUTPUT_NAME ssl${SSL_POSTFIX} - ARCHIVE_OUTPUT_NAME ssl${SSL_POSTFIX}) -set_target_properties(ssl PROPERTIES VERSION ${SSL_VERSION} - SOVERSION ${SSL_MAJOR_VERSION}) + ARCHIVE_OUTPUT_NAME ssl${SSL_POSTFIX} + EXPORT_NAME SSL + VERSION ${SSL_VERSION} + SOVERSION ${SSL_MAJOR_VERSION} +) + +target_include_directories( + ssl + PUBLIC + $ + $ +) + +install( + TARGETS ssl + EXPORT SSL-target +) + +export( + EXPORT SSL-target + FILE "${LibreSSL_BINARY_DIR}/LibreSSL-SSL.cmake" + NAMESPACE LibreSSL:: +) if(ENABLE_LIBRESSL_INSTALL) install( @@ -102,6 +122,12 @@ if(ENABLE_LIBRESSL_INSTALL) LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR} RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} ) + install( + EXPORT SSL-target + FILE "LibreSSL-SSL.cmake" + NAMESPACE LibreSSL:: + DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}/LibreSSL" + ) endif(ENABLE_LIBRESSL_INSTALL) # build static library for regression test diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 2a9019214c..a8f29af04f 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -58,9 +58,29 @@ if (WIN32) endif() set_target_properties(tls PROPERTIES OUTPUT_NAME tls${TLS_POSTFIX} - ARCHIVE_OUTPUT_NAME tls${TLS_POSTFIX}) -set_target_properties(tls PROPERTIES VERSION ${TLS_VERSION} - SOVERSION ${TLS_MAJOR_VERSION}) + ARCHIVE_OUTPUT_NAME tls${TLS_POSTFIX} + EXPORT_NAME TLS + VERSION ${TLS_VERSION} + SOVERSION ${TLS_MAJOR_VERSION} +) + +target_include_directories( + tls + PUBLIC + $ + $ +) + +install( + TARGETS tls + EXPORT TLS-target +) + +export( + EXPORT TLS-target + FILE "${LibreSSL_BINARY_DIR}/LibreSSL-TLS.cmake" + NAMESPACE LibreSSL:: +) if(ENABLE_LIBRESSL_INSTALL) install( @@ -69,6 +89,12 @@ if(ENABLE_LIBRESSL_INSTALL) LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR} RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} ) + install( + EXPORT TLS-target + FILE "LibreSSL-TLS.cmake" + NAMESPACE LibreSSL:: + DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}/LibreSSL" + ) endif(ENABLE_LIBRESSL_INSTALL) # build static library for regression test From 31391735689077c238623591655753160168ad38 Mon Sep 17 00:00:00 2001 From: Pierre Wendling Date: Sun, 6 Aug 2023 15:08:28 -0400 Subject: [PATCH 0439/1283] CI: Test consuming the exported CMake configs. --- .github/workflows/cmake_config.yml | 85 ++++++++++++++++++++++++++++++ tests/cmake/CMakeLists.txt | 37 +++++++++++++ tests/cmake/crypto.c | 7 +++ tests/cmake/ssl.c | 6 +++ tests/cmake/tls.c | 6 +++ 5 files changed, 141 insertions(+) create mode 100644 .github/workflows/cmake_config.yml create mode 100644 tests/cmake/CMakeLists.txt create mode 100644 tests/cmake/crypto.c create mode 100644 tests/cmake/ssl.c create mode 100644 tests/cmake/tls.c diff --git a/.github/workflows/cmake_config.yml b/.github/workflows/cmake_config.yml new file mode 100644 index 0000000000..ad1ad7500a --- /dev/null +++ b/.github/workflows/cmake_config.yml @@ -0,0 +1,85 @@ +name: cmake_config + +on: [push, pull_request] + +jobs: + cmake-check: + defaults: + run: + shell: bash + strategy: + matrix: + os: [windows-latest, macos-latest, ubuntu-latest] + runs-on: ${{ matrix.os }} + continue-on-error: false + name: ${{ matrix.os }} + steps: + - name: Setup Windows dependencies + if: runner.os == 'Windows' + uses: msys2/setup-msys2@v2 + with: + update: true + install: >- + autoconf + automake + diffutils + libtool + gcc + git + patch + perl + + - name: Setup macOS dependencies + if: runner.os == 'macOS' + run: brew install automake + + - uses: actions/checkout@main + + - name: Prepare source tree for build (Windows) + if: runner.os == 'Windows' + run: ./autogen.sh + shell: msys2 {0} + + - name: Prepare source tree for build (Unix) + if: runner.os != 'Windows' + run: ./autogen.sh + + - name: Configure + run: | + cmake -S . \ + -B build \ + -D CMAKE_BUILD_TYPE=Release \ + -D CMAKE_INSTALL_PREFIX=$GITHUB_WORKSPACE/../local + + - name: Build + run: cmake --build build --config Release --verbose + + - name: Install + run: cmake --install build --config Release + + - name: Consume from the build directory - Configure + run: | + cmake -S tests/cmake \ + -B consumer-build \ + -D CMAKE_BUILD_TYPE=Release \ + -D LibreSSL_DIR=$GITHUB_WORKSPACE/build + - name: Consume from the build directory - Build + run: cmake --build consumer-build --config Release --verbose + + - name: Consume from the install directory (CMAKE_PREFIX_PATH) - Configure + run: | + cmake -S tests/cmake \ + -B consumer-install-prefix \ + -D CMAKE_BUILD_TYPE=Release \ + -D CMAKE_PREFIX_PATH=$GITHUB_WORKSPACE/../local + - name: Consume from the install directory (CMAKE_PREFIX_PATH) - Build + run: cmake --build consumer-install-prefix --config Release --verbose + + - name: Consume from the install directory (LibreSSL_DIR) - Configure + run: | + cmake -S tests/cmake \ + -B consumer-install-dir \ + -D CMAKE_BUILD_TYPE=Release \ + -D LibreSSL_DIR=$GITHUB_WORKSPACE/../local/lib/cmake/LibreSSL + - name: Consume from the install directory (LibreSSL_DIR) - Build + run: cmake --build consumer-install-dir --config Release --verbose diff --git a/tests/cmake/CMakeLists.txt b/tests/cmake/CMakeLists.txt new file mode 100644 index 0000000000..956fbfd12f --- /dev/null +++ b/tests/cmake/CMakeLists.txt @@ -0,0 +1,37 @@ +cmake_minimum_required(VERSION 3.5) + +project(LibreSSL_Consumer LANGUAGES C) + +find_package( + LibreSSL + CONFIG + REQUIRED + COMPONENTS Crypto SSL TLS +) + +set(RESULTS_TO_CHECK + "LIBRESSL_VERSION" + "LIBRESSL_FOUND" + "LIBRESSL_INCLUDE_DIR" + "LIBRESSL_LIBRARIES" + "LIBRESSL_CRYPTO_LIBRARY" + "LIBRESSL_SSL_LIBRARY" + "LIBRESSL_TLS_LIBRARY" +) + +foreach(RESULT_VAR IN LISTS RESULTS_TO_CHECK) + if(${RESULT_VAR}) + message(STATUS "${RESULT_VAR}: ${${RESULT_VAR}}") + else() + message(FATAL_ERROR "${RESULT_VAR} was not set by the package.") + endif() +endforeach() + +add_executable(crypto crypto.c) +target_link_libraries(crypto PRIVATE LibreSSL::Crypto) + +add_executable(ssl ssl.c) +target_link_libraries(ssl PRIVATE LibreSSL::SSL) + +add_executable(tls tls.c) +target_link_libraries(tls PRIVATE LibreSSL::TLS) diff --git a/tests/cmake/crypto.c b/tests/cmake/crypto.c new file mode 100644 index 0000000000..38381807ea --- /dev/null +++ b/tests/cmake/crypto.c @@ -0,0 +1,7 @@ +#include + +int main(void) { + OPENSSL_init_crypto(0, NULL); + OPENSSL_cleanup(); + return 0; +} diff --git a/tests/cmake/ssl.c b/tests/cmake/ssl.c new file mode 100644 index 0000000000..2123d6a399 --- /dev/null +++ b/tests/cmake/ssl.c @@ -0,0 +1,6 @@ +#include + +int main(void) { + SSL_library_init(); + return 0; +} diff --git a/tests/cmake/tls.c b/tests/cmake/tls.c new file mode 100644 index 0000000000..1493ab0a6b --- /dev/null +++ b/tests/cmake/tls.c @@ -0,0 +1,6 @@ +#include + +int main(void) { + tls_init(); + return 0; +} From 86a6826fef085618e506ea8eedb4d688646460bf Mon Sep 17 00:00:00 2001 From: Pierre Wendling Date: Tue, 15 Aug 2023 11:08:06 -0400 Subject: [PATCH 0440/1283] Move `LibreSSL/` to `LIBRESSL_INSTALL_CMAKEDIR`. This allows users to install the CMake configs without forcing a `LibreSSL` directory after `LIBRESSL_INSTALL_CMAKEDIR`. --- CMakeLists.txt | 6 +++--- crypto/CMakeLists.txt | 2 +- ssl/CMakeLists.txt | 2 +- tls/CMakeLists.txt | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 8e26e4722d..4b34765a63 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -39,7 +39,7 @@ option(ENABLE_ASM "Enable assembly" ON) option(ENABLE_EXTRATESTS "Enable extra tests that may be unreliable on some platforms" OFF) option(ENABLE_NC "Enable installing TLS-enabled nc(1)" OFF) set(OPENSSLDIR ${OPENSSLDIR} CACHE PATH "Set the default openssl directory" FORCE) -set(LIBRESSL_INSTALL_CMAKEDIR "${CMAKE_INSTALL_LIBDIR}/cmake" CACHE STRING "Installation directory for the CMake targets") +set(LIBRESSL_INSTALL_CMAKEDIR "${CMAKE_INSTALL_LIBDIR}/cmake/LibreSSL" CACHE STRING "Installation directory for the CMake targets") option(USE_STATIC_MSVC_RUNTIMES "Use /MT instead of /MD in MSVC" OFF) if(USE_STATIC_MSVC_RUNTIMES) @@ -463,12 +463,12 @@ if(ENABLE_LIBRESSL_INSTALL) "${CMAKE_CURRENT_LIST_DIR}/LibreSSLConfig.cmake.in" "${CMAKE_CURRENT_BINARY_DIR}/install-config/LibreSSLConfig.cmake" PATH_VARS INCLUDE_DIRECTORY - INSTALL_DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}/LibreSSL" + INSTALL_DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}" ) install(FILES "${CMAKE_BINARY_DIR}/install-config/LibreSSLConfig.cmake" "${CMAKE_BINARY_DIR}/LibreSSLConfigVersion.cmake" - DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}/LibreSSL" + DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}" ) endif() diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 597ffef779..6ff46c8cbb 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -1025,7 +1025,7 @@ if(ENABLE_LIBRESSL_INSTALL) EXPORT Crypto-target FILE "LibreSSL-Crypto.cmake" NAMESPACE LibreSSL:: - DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}/LibreSSL" + DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}" ) endif(ENABLE_LIBRESSL_INSTALL) diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 16ef277769..9ba2a9e6f1 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -126,7 +126,7 @@ if(ENABLE_LIBRESSL_INSTALL) EXPORT SSL-target FILE "LibreSSL-SSL.cmake" NAMESPACE LibreSSL:: - DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}/LibreSSL" + DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}" ) endif(ENABLE_LIBRESSL_INSTALL) diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index a8f29af04f..59deee3662 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -93,7 +93,7 @@ if(ENABLE_LIBRESSL_INSTALL) EXPORT TLS-target FILE "LibreSSL-TLS.cmake" NAMESPACE LibreSSL:: - DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}/LibreSSL" + DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}" ) endif(ENABLE_LIBRESSL_INSTALL) From d95ec322ae0779d8f87f475131301757cc91adc9 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 25 Aug 2023 02:49:38 -0600 Subject: [PATCH 0441/1283] Update man links --- man/links | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/man/links b/man/links index 58cf948a3d..c33f161ecc 100644 --- a/man/links +++ b/man/links @@ -1168,6 +1168,12 @@ EVP_SignInit.3,EVP_SignUpdate.3 EVP_VerifyInit.3,EVP_VerifyFinal.3 EVP_VerifyInit.3,EVP_VerifyInit_ex.3 EVP_VerifyInit.3,EVP_VerifyUpdate.3 +EVP_add_cipher.3,EVP_add_cipher_alias.3 +EVP_add_cipher.3,EVP_add_digest.3 +EVP_add_cipher.3,EVP_add_digest_alias.3 +EVP_add_cipher.3,EVP_delete_cipher_alias.3 +EVP_add_cipher.3,EVP_remove_cipher_alias.3 +EVP_add_cipher.3,EVP_remove_digest_alias.3 EVP_aes_128_cbc.3,EVP_aes_128_cbc_hmac_sha1.3 EVP_aes_128_cbc.3,EVP_aes_128_ccm.3 EVP_aes_128_cbc.3,EVP_aes_128_cfb.3 From 27478182e643898c9e85bd8b51bc264de7394a5f Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 26 Aug 2023 03:07:16 -0600 Subject: [PATCH 0442/1283] Update man links --- man/links | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/man/links b/man/links index c33f161ecc..3511322ff8 100644 --- a/man/links +++ b/man/links @@ -869,6 +869,7 @@ EVP_AEAD_CTX_init.3,EVP_aead_aes_128_gcm.3 EVP_AEAD_CTX_init.3,EVP_aead_aes_256_gcm.3 EVP_AEAD_CTX_init.3,EVP_aead_chacha20_poly1305.3 EVP_AEAD_CTX_init.3,EVP_aead_xchacha20_poly1305.3 +EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_set_cipher_data.3 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_dup.3 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_free.3 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_cleanup.3 @@ -1172,8 +1173,7 @@ EVP_add_cipher.3,EVP_add_cipher_alias.3 EVP_add_cipher.3,EVP_add_digest.3 EVP_add_cipher.3,EVP_add_digest_alias.3 EVP_add_cipher.3,EVP_delete_cipher_alias.3 -EVP_add_cipher.3,EVP_remove_cipher_alias.3 -EVP_add_cipher.3,EVP_remove_digest_alias.3 +EVP_add_cipher.3,EVP_delete_digest_alias.3 EVP_aes_128_cbc.3,EVP_aes_128_cbc_hmac_sha1.3 EVP_aes_128_cbc.3,EVP_aes_128_ccm.3 EVP_aes_128_cbc.3,EVP_aes_128_cfb.3 From 4c1f595d98dc228c7c4a1575d8a005c2ad8eb682 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 27 Aug 2023 10:12:55 -0600 Subject: [PATCH 0443/1283] Update man links --- man/links | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/man/links b/man/links index 3511322ff8..28c4b665a6 100644 --- a/man/links +++ b/man/links @@ -869,6 +869,7 @@ EVP_AEAD_CTX_init.3,EVP_aead_aes_128_gcm.3 EVP_AEAD_CTX_init.3,EVP_aead_aes_256_gcm.3 EVP_AEAD_CTX_init.3,EVP_aead_chacha20_poly1305.3 EVP_AEAD_CTX_init.3,EVP_aead_xchacha20_poly1305.3 +EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_buf_noconst.3 EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_set_cipher_data.3 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_dup.3 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_free.3 @@ -915,11 +916,8 @@ EVP_DigestInit.3,EVP_MD_type.3 EVP_DigestInit.3,EVP_get_digestbyname.3 EVP_DigestInit.3,EVP_get_digestbynid.3 EVP_DigestInit.3,EVP_get_digestbyobj.3 -EVP_DigestInit.3,EVP_md5.3 -EVP_DigestInit.3,EVP_md5_sha1.3 EVP_DigestInit.3,EVP_md_null.3 EVP_DigestInit.3,EVP_ripemd160.3 -EVP_DigestInit.3,EVP_sha1.3 EVP_DigestInit.3,EVP_sha224.3 EVP_DigestInit.3,EVP_sha256.3 EVP_DigestInit.3,EVP_sha384.3 @@ -945,7 +943,9 @@ EVP_EncryptInit.3,EVP_CIPHER_CTX_block_size.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_cipher.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_cleanup.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_clear_flags.3 +EVP_EncryptInit.3,EVP_CIPHER_CTX_copy.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_ctrl.3 +EVP_EncryptInit.3,EVP_CIPHER_CTX_encrypting.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_flags.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_free.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_get_app_data.3 @@ -1155,6 +1155,7 @@ EVP_PKEY_set1_RSA.3,EVP_PKEY_set1_DH.3 EVP_PKEY_set1_RSA.3,EVP_PKEY_set1_DSA.3 EVP_PKEY_set1_RSA.3,EVP_PKEY_set1_EC_KEY.3 EVP_PKEY_set1_RSA.3,EVP_PKEY_set_type.3 +EVP_PKEY_set1_RSA.3,EVP_PKEY_set_type_str.3 EVP_PKEY_set1_RSA.3,EVP_PKEY_type.3 EVP_PKEY_sign.3,EVP_PKEY_sign_init.3 EVP_PKEY_size.3,EVP_PKEY_bits.3 @@ -1254,6 +1255,9 @@ EVP_des_cbc.3,EVP_des_ofb.3 EVP_des_cbc.3,EVP_desx_cbc.3 EVP_rc4.3,EVP_rc4_40.3 EVP_rc4.3,EVP_rc4_hmac_md5.3 +EVP_sha1.3,EVP_md4.3 +EVP_sha1.3,EVP_md5.3 +EVP_sha1.3,EVP_md5_sha1.3 EVP_sha3_224.3,EVP_sha3_256.3 EVP_sha3_224.3,EVP_sha3_384.3 EVP_sha3_224.3,EVP_sha3_512.3 From e5f1938cc6479055ca3e59edc8d4dceed08bc000 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 27 Aug 2023 05:29:27 -0500 Subject: [PATCH 0444/1283] Fix build flags for tests The default C flags for all build types other than 'Debug' sets -DNDEBUG which disables assert(), and breaks tests. This switches tests to use 'Debug' instead, reenabling asserts. --- tests/CMakeLists.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index d09b9da402..b43f406921 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -17,6 +17,9 @@ include_directories( ../include/compat ) +# force 'Debug' build type for tests to not disable asserts +set(CMAKE_BUILD_TYPE "Debug") + add_definitions(-D_PATH_SSL_CA_FILE=\"${CMAKE_CURRENT_SOURCE_DIR}/../cert.pem\") file(TO_NATIVE_PATH ${CMAKE_CURRENT_SOURCE_DIR} TEST_SOURCE_DIR) From f4059e4775b2a2ffe7828f7941b6541995691067 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 28 Aug 2023 00:40:11 -0500 Subject: [PATCH 0445/1283] enable asserts regardless of build type --- CMakeLists.txt | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index 4b34765a63..ca593f2bb0 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -62,6 +62,13 @@ if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES) STRINGS "Debug" "Release" "MinSizeRel" "RelWithDebInfo") endif() +# Enable asserts regardless of build type +if(MSVC) + add_definitions(/UNDEBUG) +else() + add_definitions(-UNDEBUG) +endif() + set(BUILD_NC true) if(CMAKE_SYSTEM_NAME MATCHES "Darwin") From 0784b3ade720a67b7d01c37670e14ef2827ff702 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 28 Aug 2023 00:41:59 -0500 Subject: [PATCH 0446/1283] remove unneeded release change for tests --- tests/CMakeLists.txt | 3 --- 1 file changed, 3 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index b43f406921..d09b9da402 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -17,9 +17,6 @@ include_directories( ../include/compat ) -# force 'Debug' build type for tests to not disable asserts -set(CMAKE_BUILD_TYPE "Debug") - add_definitions(-D_PATH_SSL_CA_FILE=\"${CMAKE_CURRENT_SOURCE_DIR}/../cert.pem\") file(TO_NATIVE_PATH ${CMAKE_CURRENT_SOURCE_DIR} TEST_SOURCE_DIR) From 8c6d8ec351210f5f11b37bf2e4351bc4e3576aab Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 29 Aug 2023 19:45:58 -0600 Subject: [PATCH 0447/1283] Update man links --- man/links | 3 +++ 1 file changed, 3 insertions(+) diff --git a/man/links b/man/links index 28c4b665a6..2818343e62 100644 --- a/man/links +++ b/man/links @@ -871,6 +871,9 @@ EVP_AEAD_CTX_init.3,EVP_aead_chacha20_poly1305.3 EVP_AEAD_CTX_init.3,EVP_aead_xchacha20_poly1305.3 EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_buf_noconst.3 EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_set_cipher_data.3 +EVP_CIPHER_do_all.3,EVP_CIPHER_do_all_sorted.3 +EVP_CIPHER_do_all.3,EVP_MD_do_all.3 +EVP_CIPHER_do_all.3,EVP_MD_do_all_sorted.3 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_dup.3 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_free.3 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_cleanup.3 From fbb21ed9212be4032f7fd60f58beb8d7e20235d9 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 30 Aug 2023 04:34:15 -0600 Subject: [PATCH 0448/1283] End all ChangeLog entries with a period --- ChangeLog | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index f0c8115395..664ef32658 100644 --- a/ChangeLog +++ b/ChangeLog @@ -41,9 +41,9 @@ LibreSSL Portable Release Notes: unintentionally. - Selective removal of CET implementation on platforms where it is not supported (macOS). - - Integrated four more tests - - Added Windows ARM64 architecture to tested platforms - - Removed Solaris 10 support, fixed Solaris 11 + - Integrated four more tests. + - Added Windows ARM64 architecture to tested platforms. + - Removed Solaris 10 support, fixed Solaris 11. - libtls no longer links statically to libcrypto / libssl unless '--enable-libtls-only' is specified at configure time. - Improved Windows compatibility library, namely handling of files vs @@ -52,7 +52,7 @@ LibreSSL Portable Release Notes: using flags from the CMake build type instead. - Set the CMake default build type to 'Release'. This can be overridden during configuration. - - Fixed broken ASM support with MinGW builds + - Fixed broken ASM support with MinGW builds. * Internal improvements - Fixed alignment handling in SHA-512. - Moved the verified_chain to the correct internal struct. From 8fa9337f65314955fb31e53193980f0c283fa4ae Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 31 Aug 2023 10:12:54 -0600 Subject: [PATCH 0449/1283] Prepare 3.8.2 ChangeLog --- ChangeLog | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 664ef32658..59188fdb53 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,7 +28,15 @@ history is also available from Git. LibreSSL Portable Release Notes: -3.8.1 - In development +3.8.2 - In development + + * Portable changes + * Internal improvements + * Documentation improvements + * Testing and Proactive Security + * Security fixes + +3.8.1 - Development release * Portable changes - Applications bundled as part of the LibreSSL package internally, From a6bd25d3bd098f68cd9ffbf1cbfbf015b91d33a5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 2 Sep 2023 04:02:03 -0600 Subject: [PATCH 0450/1283] Rebase rust-openssl patch --- .github/rust-openssl.patch | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/rust-openssl.patch b/.github/rust-openssl.patch index 80fa0b7f86..e9586dd708 100644 --- a/.github/rust-openssl.patch +++ b/.github/rust-openssl.patch @@ -1,13 +1,13 @@ diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs -index 21ccf3d0..1cf2d184 100644 +index 82013b6c..2974abed 100644 --- a/openssl-sys/build/main.rs +++ b/openssl-sys/build/main.rs -@@ -272,7 +272,7 @@ See rust-openssl documentation for more information: - (3, 7, 0) => ('3', '7', '0'), +@@ -273,7 +273,7 @@ See rust-openssl documentation for more information: (3, 7, 1) => ('3', '7', '1'), (3, 7, _) => ('3', '7', 'x'), -- (3, 8, 0) => ('3', '8', '0'), -+ (3, 8, _) => ('3', '8', '0'), + (3, 8, 0) => ('3', '8', '0'), +- (3, 8, 1) => ('3', '8', '1'), ++ (3, 8, _) => ('3', '8', 'x'), _ => version_error(), }; From 70688874f84607f272ea0028ce8982f5db00cd52 Mon Sep 17 00:00:00 2001 From: Jiajie Chen Date: Mon, 4 Sep 2023 09:05:45 +0800 Subject: [PATCH 0451/1283] Fix processor detection in CMakeLists.txt --- CMakeLists.txt | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index ca593f2bb0..f3c8a05e5c 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -333,32 +333,32 @@ endif() # single architecture work on macOS at least. # # Don't set CMAKE_OSX_ARCHITECTURES to more than a single value for now. -if(APPLE) +if(APPLE AND (NOT CMAKE_OSX_ARCHITECTURES STREQUAL "")) set(CMAKE_SYSTEM_PROCESSOR "${CMAKE_OSX_ARCHITECTURES}") endif() -if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(aarch64|arm64)") +if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(aarch64|arm64|ARM64)") set(HOST_AARCH64 true) elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm") set(HOST_ARM true) elseif("${CMAKE_SYSTEM_NAME}" STREQUAL "SunOS" AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "i386") set(HOST_X86_64 true) -elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64)") +elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64|AMD64)") set(HOST_X86_64 true) -elseif("${CMAKE_SYSTEM_NAME}" MATCHES "[i?86|x86]") +elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(i[3-6]86|[xX]86)") set(ENABLE_ASM false) set(HOST_I386 true) -elseif("${CMAKE_SYSTEM_NAME}" MATCHES "mips64") +elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "mips64") set(HOST_MIPS64 true) -elseif("${CMAKE_SYSTEM_NAME}" MATCHES "mips") +elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "mips") set(HOST_MIPS true) -elseif("${CMAKE_SYSTEM_NAME}" MATCHES "powerpc") +elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "powerpc") set(HOST_POWERPC true) -elseif("${CMAKE_SYSTEM_NAME}" MATCHES "ppc64") +elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "ppc64") set(HOST_PPC64 true) -elseif("${CMAKE_SYSTEM_NAME}" MATCHES "riscv64") +elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "riscv64") set(HOST_RISCV64 true) -elseif("${CMAKE_SYSTEM_NAME}" MATCHES "sparc64") +elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "sparc64") set(HOST_SPARC64 true) else() set(ENABLE_ASM false) From 34f45b6cd79c5ead489dd9e59872c9aadaee3539 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 7 Sep 2023 11:50:41 -0600 Subject: [PATCH 0452/1283] Update man links --- man/links | 82 +++++++++++++++++++++++++++---------------------------- 1 file changed, 40 insertions(+), 42 deletions(-) diff --git a/man/links b/man/links index 2818343e62..fdac972270 100644 --- a/man/links +++ b/man/links @@ -869,8 +869,23 @@ EVP_AEAD_CTX_init.3,EVP_aead_aes_128_gcm.3 EVP_AEAD_CTX_init.3,EVP_aead_aes_256_gcm.3 EVP_AEAD_CTX_init.3,EVP_aead_chacha20_poly1305.3 EVP_AEAD_CTX_init.3,EVP_aead_xchacha20_poly1305.3 +EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_get_iv.3 +EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_iv_length.3 +EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_key_length.3 +EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_set_iv.3 +EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_set_key_length.3 +EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_CTX_set_padding.3 +EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_iv_length.3 +EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_key_length.3 EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_buf_noconst.3 EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_set_cipher_data.3 +EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_clear_flags.3 +EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_get_app_data.3 +EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_rand_key.3 +EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_set_app_data.3 +EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_test_flags.3 +EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_asn1_to_param.3 +EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_param_to_asn1.3 EVP_CIPHER_do_all.3,EVP_CIPHER_do_all_sorted.3 EVP_CIPHER_do_all.3,EVP_MD_do_all.3 EVP_CIPHER_do_all.3,EVP_MD_do_all_sorted.3 @@ -885,37 +900,32 @@ EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_impl_ctx_size.3 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_init.3 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_iv_length.3 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_set_asn1_params.3 +EVP_CIPHER_nid.3,EVP_CIPHER_CTX_block_size.3 +EVP_CIPHER_nid.3,EVP_CIPHER_CTX_flags.3 +EVP_CIPHER_nid.3,EVP_CIPHER_CTX_mode.3 +EVP_CIPHER_nid.3,EVP_CIPHER_CTX_nid.3 +EVP_CIPHER_nid.3,EVP_CIPHER_CTX_type.3 +EVP_CIPHER_nid.3,EVP_CIPHER_block_size.3 +EVP_CIPHER_nid.3,EVP_CIPHER_flags.3 +EVP_CIPHER_nid.3,EVP_CIPHER_mode.3 +EVP_CIPHER_nid.3,EVP_CIPHER_name.3 +EVP_CIPHER_nid.3,EVP_CIPHER_type.3 EVP_DigestInit.3,EVP_Digest.3 EVP_DigestInit.3,EVP_DigestFinal.3 EVP_DigestInit.3,EVP_DigestFinal_ex.3 EVP_DigestInit.3,EVP_DigestInit_ex.3 EVP_DigestInit.3,EVP_DigestUpdate.3 EVP_DigestInit.3,EVP_MAX_MD_SIZE.3 -EVP_DigestInit.3,EVP_MD_CTX_block_size.3 EVP_DigestInit.3,EVP_MD_CTX_cleanup.3 -EVP_DigestInit.3,EVP_MD_CTX_clear_flags.3 EVP_DigestInit.3,EVP_MD_CTX_copy.3 EVP_DigestInit.3,EVP_MD_CTX_copy_ex.3 EVP_DigestInit.3,EVP_MD_CTX_create.3 -EVP_DigestInit.3,EVP_MD_CTX_ctrl.3 EVP_DigestInit.3,EVP_MD_CTX_destroy.3 EVP_DigestInit.3,EVP_MD_CTX_free.3 EVP_DigestInit.3,EVP_MD_CTX_init.3 EVP_DigestInit.3,EVP_MD_CTX_md.3 -EVP_DigestInit.3,EVP_MD_CTX_md_data.3 EVP_DigestInit.3,EVP_MD_CTX_new.3 -EVP_DigestInit.3,EVP_MD_CTX_pkey_ctx.3 EVP_DigestInit.3,EVP_MD_CTX_reset.3 -EVP_DigestInit.3,EVP_MD_CTX_set_flags.3 -EVP_DigestInit.3,EVP_MD_CTX_set_pkey_ctx.3 -EVP_DigestInit.3,EVP_MD_CTX_size.3 -EVP_DigestInit.3,EVP_MD_CTX_test_flags.3 -EVP_DigestInit.3,EVP_MD_CTX_type.3 -EVP_DigestInit.3,EVP_MD_block_size.3 -EVP_DigestInit.3,EVP_MD_flags.3 -EVP_DigestInit.3,EVP_MD_pkey_type.3 -EVP_DigestInit.3,EVP_MD_size.3 -EVP_DigestInit.3,EVP_MD_type.3 EVP_DigestInit.3,EVP_get_digestbyname.3 EVP_DigestInit.3,EVP_get_digestbynid.3 EVP_DigestInit.3,EVP_get_digestbyobj.3 @@ -942,41 +952,14 @@ EVP_EncodeInit.3,EVP_ENCODE_CTX_new.3 EVP_EncodeInit.3,EVP_EncodeBlock.3 EVP_EncodeInit.3,EVP_EncodeFinal.3 EVP_EncodeInit.3,EVP_EncodeUpdate.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_block_size.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_cipher.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_cleanup.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_clear_flags.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_copy.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_ctrl.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_encrypting.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_flags.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_free.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_get_app_data.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_get_iv.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_init.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_iv_length.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_key_length.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_mode.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_new.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_nid.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_rand_key.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_reset.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_set_app_data.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_set_flags.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_set_iv.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_set_key_length.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_set_padding.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_test_flags.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_type.3 -EVP_EncryptInit.3,EVP_CIPHER_asn1_to_param.3 -EVP_EncryptInit.3,EVP_CIPHER_block_size.3 -EVP_EncryptInit.3,EVP_CIPHER_flags.3 -EVP_EncryptInit.3,EVP_CIPHER_iv_length.3 -EVP_EncryptInit.3,EVP_CIPHER_key_length.3 -EVP_EncryptInit.3,EVP_CIPHER_mode.3 -EVP_EncryptInit.3,EVP_CIPHER_nid.3 -EVP_EncryptInit.3,EVP_CIPHER_param_to_asn1.3 -EVP_EncryptInit.3,EVP_CIPHER_type.3 EVP_EncryptInit.3,EVP_Cipher.3 EVP_EncryptInit.3,EVP_CipherFinal.3 EVP_EncryptInit.3,EVP_CipherFinal_ex.3 @@ -1018,6 +1001,12 @@ EVP_EncryptInit.3,EVP_rc2_cfb.3 EVP_EncryptInit.3,EVP_rc2_cfb64.3 EVP_EncryptInit.3,EVP_rc2_ecb.3 EVP_EncryptInit.3,EVP_rc2_ofb.3 +EVP_MD_CTX_ctrl.3,EVP_MD_CTX_clear_flags.3 +EVP_MD_CTX_ctrl.3,EVP_MD_CTX_md_data.3 +EVP_MD_CTX_ctrl.3,EVP_MD_CTX_pkey_ctx.3 +EVP_MD_CTX_ctrl.3,EVP_MD_CTX_set_flags.3 +EVP_MD_CTX_ctrl.3,EVP_MD_CTX_set_pkey_ctx.3 +EVP_MD_CTX_ctrl.3,EVP_MD_CTX_test_flags.3 EVP_MD_meth_new.3,EVP_MD_meth_dup.3 EVP_MD_meth_new.3,EVP_MD_meth_free.3 EVP_MD_meth_new.3,EVP_MD_meth_set_app_datasize.3 @@ -1030,6 +1019,15 @@ EVP_MD_meth_new.3,EVP_MD_meth_set_init.3 EVP_MD_meth_new.3,EVP_MD_meth_set_input_blocksize.3 EVP_MD_meth_new.3,EVP_MD_meth_set_result_size.3 EVP_MD_meth_new.3,EVP_MD_meth_set_update.3 +EVP_MD_nid.3,EVP_MD_CTX_block_size.3 +EVP_MD_nid.3,EVP_MD_CTX_size.3 +EVP_MD_nid.3,EVP_MD_CTX_type.3 +EVP_MD_nid.3,EVP_MD_block_size.3 +EVP_MD_nid.3,EVP_MD_flags.3 +EVP_MD_nid.3,EVP_MD_name.3 +EVP_MD_nid.3,EVP_MD_pkey_type.3 +EVP_MD_nid.3,EVP_MD_size.3 +EVP_MD_nid.3,EVP_MD_type.3 EVP_OpenInit.3,EVP_OpenFinal.3 EVP_OpenInit.3,EVP_OpenUpdate.3 EVP_PKCS82PKEY.3,EVP_PKEY2PKCS8.3 From ccaec87950e1e6bde4925b91b8397a5062fb08f7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 10 Sep 2023 13:29:58 -0600 Subject: [PATCH 0453/1283] update man links --- man/links | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/man/links b/man/links index fdac972270..6210cd0ec9 100644 --- a/man/links +++ b/man/links @@ -915,7 +915,6 @@ EVP_DigestInit.3,EVP_DigestFinal.3 EVP_DigestInit.3,EVP_DigestFinal_ex.3 EVP_DigestInit.3,EVP_DigestInit_ex.3 EVP_DigestInit.3,EVP_DigestUpdate.3 -EVP_DigestInit.3,EVP_MAX_MD_SIZE.3 EVP_DigestInit.3,EVP_MD_CTX_cleanup.3 EVP_DigestInit.3,EVP_MD_CTX_copy.3 EVP_DigestInit.3,EVP_MD_CTX_copy_ex.3 @@ -1052,6 +1051,7 @@ EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_set_ecdh_kdf_md.3 EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_set_ecdh_kdf_outlen.3 EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_set_ecdh_kdf_type.3 EVP_PKEY_CTX_ctrl.3,EVP_PKEY_CTX_set_signature_md.3 +EVP_PKEY_CTX_get_operation.3,EVP_PKEY_CTX_get0_pkey.3 EVP_PKEY_CTX_new.3,EVP_PKEY_CTX_dup.3 EVP_PKEY_CTX_new.3,EVP_PKEY_CTX_free.3 EVP_PKEY_CTX_new.3,EVP_PKEY_CTX_new_id.3 @@ -1091,18 +1091,22 @@ EVP_PKEY_cmp.3,EVP_PKEY_cmp_parameters.3 EVP_PKEY_cmp.3,EVP_PKEY_copy_parameters.3 EVP_PKEY_cmp.3,EVP_PKEY_missing_parameters.3 EVP_PKEY_decrypt.3,EVP_PKEY_decrypt_init.3 +EVP_PKEY_derive.3,EVP_PKEY_CTX_get0_peerkey.3 EVP_PKEY_derive.3,EVP_PKEY_derive_init.3 EVP_PKEY_derive.3,EVP_PKEY_derive_set_peer.3 EVP_PKEY_encrypt.3,EVP_PKEY_encrypt_init.3 EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_app_data.3 EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_cb.3 EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_keygen_info.3 +EVP_PKEY_keygen.3,EVP_PKEY_CTX_set0_keygen_info.3 EVP_PKEY_keygen.3,EVP_PKEY_CTX_set_app_data.3 EVP_PKEY_keygen.3,EVP_PKEY_CTX_set_cb.3 EVP_PKEY_keygen.3,EVP_PKEY_gen_cb.3 EVP_PKEY_keygen.3,EVP_PKEY_keygen_init.3 EVP_PKEY_keygen.3,EVP_PKEY_paramgen.3 EVP_PKEY_keygen.3,EVP_PKEY_paramgen_init.3 +EVP_PKEY_meth_new.3,EVP_PKEY_CTX_get_data.3 +EVP_PKEY_meth_new.3,EVP_PKEY_CTX_set_data.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_add0.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_copy.3 EVP_PKEY_meth_new.3,EVP_PKEY_meth_find.3 @@ -1422,6 +1426,7 @@ OPENSSL_sk_new.3,sk_zero.3 OpenSSL_add_all_algorithms.3,EVP_cleanup.3 OpenSSL_add_all_algorithms.3,OpenSSL_add_all_ciphers.3 OpenSSL_add_all_algorithms.3,OpenSSL_add_all_digests.3 +OpenSSL_add_all_algorithms.3,SSLeay_add_all_algorithms.3 PEM_ASN1_read.3,PEM_ASN1_read_bio.3 PEM_ASN1_read.3,d2i_of_void.3 PEM_X509_INFO_read.3,PEM_X509_INFO_read_bio.3 @@ -1677,6 +1682,8 @@ RSA_print.3,DSAparams_print.3 RSA_print.3,DSAparams_print_fp.3 RSA_print.3,RSA_print_fp.3 RSA_private_encrypt.3,RSA_public_decrypt.3 +RSA_public_encrypt.3,EVP_PKEY_decrypt_old.3 +RSA_public_encrypt.3,EVP_PKEY_encrypt_old.3 RSA_public_encrypt.3,RSA_private_decrypt.3 RSA_security_bits.3,BN_security_bits.3 RSA_security_bits.3,DH_security_bits.3 @@ -2814,9 +2821,10 @@ d2i_X509_SIG.3,d2i_PKCS8_fp.3 d2i_X509_SIG.3,i2d_PKCS8_bio.3 d2i_X509_SIG.3,i2d_PKCS8_fp.3 d2i_X509_SIG.3,i2d_X509_SIG.3 +des_read_pw.3,EVP_get_pw_prompt.3 des_read_pw.3,EVP_read_pw_string.3 des_read_pw.3,EVP_read_pw_string_min.3 -des_read_pw.3,des_read_pw_string.3 +des_read_pw.3,EVP_set_pw_prompt.3 i2a_ASN1_STRING.3,a2i_ASN1_ENUMERATED.3 i2a_ASN1_STRING.3,a2i_ASN1_INTEGER.3 i2a_ASN1_STRING.3,a2i_ASN1_STRING.3 From 46635430822fbe9098327efd494cacb40e3e2987 Mon Sep 17 00:00:00 2001 From: Marc Aldorasi Date: Tue, 12 Sep 2023 15:07:51 -0400 Subject: [PATCH 0454/1283] Consistently use CMAKE_CURRENT_BINARY_DIR --- CMakeLists.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index ca593f2bb0..52aeaba0f1 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -473,8 +473,8 @@ if(ENABLE_LIBRESSL_INSTALL) INSTALL_DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}" ) install(FILES - "${CMAKE_BINARY_DIR}/install-config/LibreSSLConfig.cmake" - "${CMAKE_BINARY_DIR}/LibreSSLConfigVersion.cmake" + "${CMAKE_CURRENT_BINARY_DIR}/install-config/LibreSSLConfig.cmake" + "${CMAKE_CURRENT_BINARY_DIR}/LibreSSLConfigVersion.cmake" DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}" ) endif() From c90e80d21edf18bda93891b80f99765d55d2f627 Mon Sep 17 00:00:00 2001 From: Marc Aldorasi Date: Tue, 12 Sep 2023 15:08:44 -0400 Subject: [PATCH 0455/1283] Properly check components --- LibreSSLConfig.cmake.in | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/LibreSSLConfig.cmake.in b/LibreSSLConfig.cmake.in index d6fbe3b211..6c5cdd8327 100644 --- a/LibreSSLConfig.cmake.in +++ b/LibreSSLConfig.cmake.in @@ -6,16 +6,19 @@ set_and_check(LIBRESSL_INCLUDE_DIR @PACKAGE_INCLUDE_DIRECTORY@) if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-Crypto.cmake") include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-Crypto.cmake") set(LIBRESSL_CRYPTO_LIBRARY LibreSSL::Crypto) + set(LibreSSL_Crypto_FOUND TRUE) endif() if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-SSL.cmake") include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-SSL.cmake") set(LIBRESSL_SSL_LIBRARY LibreSSL::SSL) + set(LibreSSL_SSL_FOUND TRUE) endif() if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-TLS.cmake") include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-TLS.cmake") set(LIBRESSL_TLS_LIBRARY LibreSSL::TLS) + set(LibreSSL_TLS_FOUND TRUE) endif() set(LIBRESSL_LIBRARIES @@ -24,10 +27,10 @@ set(LIBRESSL_LIBRARIES ${LIBRESSL_TLS_LIBRARY} ) -check_required_components( - Crypto - SSL - TLS -) +check_required_components(LibreSSL) -set(LIBRESSL_FOUND TRUE) +if(DEFINED LibreSSL_FOUND) + set(LIBRESSL_FOUND ${LibreSSL_FOUND}) +else() + set(LIBRESSL_FOUND TRUE) +endif() From ef5867b4e6cd00554768644263bf4f554c703262 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 18 Sep 2023 13:01:29 -0600 Subject: [PATCH 0456/1283] Update man links --- man/links | 4 ---- 1 file changed, 4 deletions(-) diff --git a/man/links b/man/links index 6210cd0ec9..5669bb9028 100644 --- a/man/links +++ b/man/links @@ -1613,9 +1613,6 @@ RSA_get0_key.3,RSA_set0_factors.3 RSA_get0_key.3,RSA_set0_key.3 RSA_get0_key.3,RSA_set_flags.3 RSA_get0_key.3,RSA_test_flags.3 -RSA_get_ex_new_index.3,CRYPTO_EX_dup.3 -RSA_get_ex_new_index.3,CRYPTO_EX_free.3 -RSA_get_ex_new_index.3,CRYPTO_EX_new.3 RSA_get_ex_new_index.3,RSA_get_ex_data.3 RSA_get_ex_new_index.3,RSA_set_ex_data.3 RSA_meth_new.3,RSA_meth_dup.3 @@ -2928,7 +2925,6 @@ tls_ocsp_process_response.3,tls_peer_ocsp_url.3 tls_read.3,tls_close.3 tls_read.3,tls_error.3 tls_read.3,tls_handshake.3 -tls_read.3,tls_reset.3 tls_read.3,tls_write.3 x509_verify.3,x509_verify_ctx_chain.3 x509_verify.3,x509_verify_ctx_error_depth.3 From 9e5971d828eaeb0f03e8629bb06e2492e3f278a7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 24 Sep 2023 14:26:34 -0600 Subject: [PATCH 0457/1283] Update ChangeLog --- ChangeLog | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ChangeLog b/ChangeLog index 59188fdb53..fefc02c9ea 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,6 +34,14 @@ LibreSSL Portable Release Notes: * Internal improvements * Documentation improvements * Testing and Proactive Security + * Bug fixes + - Fixed EVP_PKEY_get{0,1}_RSA for RSA-PSS. + - Plug a potential memory leak in ASN1_TIME_normalize(). + - Avoid memory leak in EVP_CipherInit(). + - Redirect EVP_PKEY_get1_* through their get0 siblings. + - Fixed a use of uninitialized in i2r_IPAddrBlocks(). + - Rewrote CMS_SignerInfo_{sign,verify}(). + - Further cleanup and refactoring in the EC code. * Security fixes 3.8.1 - Development release From dbf729b46e6ec9c9b39732599ac44a8478432620 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 28 Sep 2023 07:50:19 -0600 Subject: [PATCH 0458/1283] Update changelog --- ChangeLog | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ChangeLog b/ChangeLog index fefc02c9ea..1549a6c60b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,6 +34,11 @@ LibreSSL Portable Release Notes: * Internal improvements * Documentation improvements * Testing and Proactive Security + * Compatibility changes + - Restrict the RFC 3779 code to IPv4 and IPv6. It was not written + to be able to deal with anything else. + - Fixed EVP_CIPHER_CTX_iv_length() to return what was set with + EVP_CTRL_AEAD_SET_IVLEN or one of its aliases. * Bug fixes - Fixed EVP_PKEY_get{0,1}_RSA for RSA-PSS. - Plug a potential memory leak in ASN1_TIME_normalize(). From f3c946b03fbfe28e71721d8d28cdb9dbf3035bf0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 28 Sep 2023 07:52:48 -0600 Subject: [PATCH 0459/1283] Update man links --- man/links | 40 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 39 insertions(+), 1 deletion(-) diff --git a/man/links b/man/links index 5669bb9028..56d7fc2601 100644 --- a/man/links +++ b/man/links @@ -6,6 +6,9 @@ AES_encrypt.3,AES_cbc_encrypt.3 AES_encrypt.3,AES_decrypt.3 AES_encrypt.3,AES_set_decrypt_key.3 AES_encrypt.3,AES_set_encrypt_key.3 +ASIdentifiers_new.3,ASIdentifiers_free.3 +ASIdentifiers_new.3,d2i_ASIdentifiers.3 +ASIdentifiers_new.3,i2d_ASIdentifiers.3 ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_get_bit.3 ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_set_bit.3 ASN1_INTEGER_get.3,ASN1_ENUMERATED_get.3 @@ -137,6 +140,17 @@ ASN1_put_object.3,ASN1_object_size.3 ASN1_put_object.3,ASN1_put_eoc.3 ASN1_time_parse.3,ASN1_TIME_set_tm.3 ASN1_time_parse.3,ASN1_time_tm_cmp.3 +ASRange_new.3,ASIdOrRange_free.3 +ASRange_new.3,ASIdOrRange_new.3 +ASRange_new.3,ASIdentifierChoice_free.3 +ASRange_new.3,ASIdentifierChoice_new.3 +ASRange_new.3,ASRange_free.3 +ASRange_new.3,d2i_ASIdOrRange.3 +ASRange_new.3,d2i_ASIdentifierChoice.3 +ASRange_new.3,d2i_ASRange.3 +ASRange_new.3,i2d_ASIdOrRange.3 +ASRange_new.3,i2d_ASIdentifierChoice.3 +ASRange_new.3,i2d_ASRange.3 AUTHORITY_KEYID_new.3,AUTHORITY_KEYID_free.3 BASIC_CONSTRAINTS_new.3,BASIC_CONSTRAINTS_free.3 BF_set_key.3,BF_cbc_encrypt.3 @@ -1290,6 +1304,21 @@ HMAC.3,HMAC_Init.3 HMAC.3,HMAC_Init_ex.3 HMAC.3,HMAC_Update.3 HMAC.3,HMAC_size.3 +IPAddressRange_new.3,IPAddressChoice_free.3 +IPAddressRange_new.3,IPAddressChoice_new.3 +IPAddressRange_new.3,IPAddressFamily_free.3 +IPAddressRange_new.3,IPAddressFamily_new.3 +IPAddressRange_new.3,IPAddressOrRange_free.3 +IPAddressRange_new.3,IPAddressOrRange_new.3 +IPAddressRange_new.3,IPAddressRange_free.3 +IPAddressRange_new.3,d2i_IPAddressChoice.3 +IPAddressRange_new.3,d2i_IPAddressFamily.3 +IPAddressRange_new.3,d2i_IPAddressOrRange.3 +IPAddressRange_new.3,d2i_IPAddressRange.3 +IPAddressRange_new.3,i2d_IPAddressChoice.3 +IPAddressRange_new.3,i2d_IPAddressFamily.3 +IPAddressRange_new.3,i2d_IPAddressOrRange.3 +IPAddressRange_new.3,i2d_IPAddressRange.3 MD5.3,MD4.3 MD5.3,MD4_Final.3 MD5.3,MD4_Init.3 @@ -1816,7 +1845,6 @@ SSL_CTX_set_client_cert_cb.3,client_cert_cb.3 SSL_CTX_set_default_passwd_cb.3,SSL_CTX_get_default_passwd_cb.3 SSL_CTX_set_default_passwd_cb.3,SSL_CTX_get_default_passwd_cb_userdata.3 SSL_CTX_set_default_passwd_cb.3,SSL_CTX_set_default_passwd_cb_userdata.3 -SSL_CTX_set_default_passwd_cb.3,pem_password_cb.3 SSL_CTX_set_generate_session_id.3,GEN_SESSION_CB.3 SSL_CTX_set_generate_session_id.3,SSL_has_matching_session_id.3 SSL_CTX_set_generate_session_id.3,SSL_set_generate_session_id.3 @@ -2448,6 +2476,16 @@ X509at_get_attr.3,X509at_get0_data_by_OBJ.3 X509at_get_attr.3,X509at_get_attr_by_NID.3 X509at_get_attr.3,X509at_get_attr_by_OBJ.3 X509at_get_attr.3,X509at_get_attr_count.3 +X509v3_addr_add_inherit.3,X509v3_addr_add_prefix.3 +X509v3_addr_add_inherit.3,X509v3_addr_add_range.3 +X509v3_addr_add_inherit.3,X509v3_addr_canonize.3 +X509v3_addr_add_inherit.3,X509v3_addr_is_canonical.3 +X509v3_addr_get_range.3,X509v3_addr_get_afi.3 +X509v3_addr_inherits.3,X509v3_asid_inherits.3 +X509v3_addr_subset.3,X509v3_asid_subset.3 +X509v3_asid_add_id_or_range.3,X509v3_asid_add_inherit.3 +X509v3_asid_add_id_or_range.3,X509v3_asid_canonize.3 +X509v3_asid_add_id_or_range.3,X509v3_asid_is_canonical.3 X509v3_get_ext_by_NID.3,X509_CRL_add_ext.3 X509v3_get_ext_by_NID.3,X509_CRL_delete_ext.3 X509v3_get_ext_by_NID.3,X509_CRL_get_ext.3 From 70db97f5a6d83582a16781f2d5cbbf6b6c796e39 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 29 Sep 2023 10:23:51 -0600 Subject: [PATCH 0460/1283] ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 1549a6c60b..8debff48a9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -47,6 +47,7 @@ LibreSSL Portable Release Notes: - Fixed a use of uninitialized in i2r_IPAddrBlocks(). - Rewrote CMS_SignerInfo_{sign,verify}(). - Further cleanup and refactoring in the EC code. + - Allow IP addresses to be specified in a URI. * Security fixes 3.8.1 - Development release From e56ec2ae95800645eb24bd0763989f6b52056664 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 29 Sep 2023 10:57:53 -0600 Subject: [PATCH 0461/1283] Update man links --- man/links | 3 +++ 1 file changed, 3 insertions(+) diff --git a/man/links b/man/links index 56d7fc2601..2a714f89b1 100644 --- a/man/links +++ b/man/links @@ -2483,6 +2483,9 @@ X509v3_addr_add_inherit.3,X509v3_addr_is_canonical.3 X509v3_addr_get_range.3,X509v3_addr_get_afi.3 X509v3_addr_inherits.3,X509v3_asid_inherits.3 X509v3_addr_subset.3,X509v3_asid_subset.3 +X509v3_addr_validate_path.3,X509v3_addr_validate_resource_set.3 +X509v3_addr_validate_path.3,X509v3_asid_validate_path.3 +X509v3_addr_validate_path.3,X509v3_asid_validate_resource_set.3 X509v3_asid_add_id_or_range.3,X509v3_asid_add_inherit.3 X509v3_asid_add_id_or_range.3,X509v3_asid_canonize.3 X509v3_asid_add_id_or_range.3,X509v3_asid_is_canonical.3 From c923880fb9c08a7a92e30f9fc836a85da0e848ad Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 1 Oct 2023 17:24:14 -0600 Subject: [PATCH 0462/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 8debff48a9..33ef8cc38b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -49,6 +49,9 @@ LibreSSL Portable Release Notes: - Further cleanup and refactoring in the EC code. - Allow IP addresses to be specified in a URI. * Security fixes + - Fixed a copy-paste error in ASN1_TIME_compare() that could lead + to two UTCTimes or two GeneralizedTimes incorrectly being compared + as equal. Reported by Duncan Thomson. 3.8.1 - Development release From 1defa3baa5be532cf36c913055700246dbf4ca78 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 1 Oct 2023 21:11:11 -0500 Subject: [PATCH 0463/1283] package getopt compat files --- crypto/Makefile.am | 1 + include/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index d93b879e16..0059b5974f 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -36,6 +36,7 @@ EXTRA_DIST += empty.c # needed for a CMake target EXTRA_DIST += compat/strcasecmp.c +EXTRA_DIST += compat/getopt_long.c BUILT_SOURCES = crypto_portable.sym CLEANFILES = crypto_portable.sym diff --git a/include/Makefile.am b/include/Makefile.am index 077637df6b..22819c8a38 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -10,6 +10,7 @@ noinst_HEADERS += compat/dirent_msvc.h noinst_HEADERS += compat/endian.h noinst_HEADERS += compat/err.h noinst_HEADERS += compat/fcntl.h +noinst_HEADERS += compat/getopt.h noinst_HEADERS += compat/limits.h noinst_HEADERS += compat/netdb.h noinst_HEADERS += compat/poll.h From 8e4af3b18b5ae6f0a4954d9c8494baacd76eab5c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 2 Oct 2023 06:39:11 -0600 Subject: [PATCH 0464/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 33ef8cc38b..daedd1f9ec 100644 --- a/ChangeLog +++ b/ChangeLog @@ -33,6 +33,7 @@ LibreSSL Portable Release Notes: * Portable changes * Internal improvements * Documentation improvements + - Documented the RFC 3779 API * Testing and Proactive Security * Compatibility changes - Restrict the RFC 3779 code to IPv4 and IPv6. It was not written From b112e372750f162659e16d4e7ff845289a537489 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 3 Oct 2023 10:46:50 -0600 Subject: [PATCH 0465/1283] Update ChangeLog --- ChangeLog | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index daedd1f9ec..a498842110 100644 --- a/ChangeLog +++ b/ChangeLog @@ -49,10 +49,9 @@ LibreSSL Portable Release Notes: - Rewrote CMS_SignerInfo_{sign,verify}(). - Further cleanup and refactoring in the EC code. - Allow IP addresses to be specified in a URI. - * Security fixes - Fixed a copy-paste error in ASN1_TIME_compare() that could lead to two UTCTimes or two GeneralizedTimes incorrectly being compared - as equal. Reported by Duncan Thomson. + as equal. 3.8.1 - Development release From 04fa997f5429a16f8ad17be99550f7d1f006aff5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 11 Oct 2023 09:56:40 -0600 Subject: [PATCH 0466/1283] Link x509_algor test to build --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index d09b9da402..aa00455a3d 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -769,6 +769,11 @@ add_executable(x509attribute x509attribute.c) target_link_libraries(x509attribute ${OPENSSL_TEST_LIBS}) add_test(x509attribute x509attribute) +# x509_algor +add_executable(x509_algor x509_algor.c) +target_link_libraries(x509_algor ${OPENSSL_TEST_LIBS}) +add_test(x509_algor x509_algor) + # x509_asn1 add_executable(x509_asn1 x509_asn1.c) target_link_libraries(x509_asn1 ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index b860acef08..5d87bde9d7 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -775,6 +775,11 @@ TESTS += x509attribute check_PROGRAMS += x509attribute x509attribute_SOURCES = x509attribute.c +# x509_algor +TESTS += x509_algor +check_PROGRAMS += x509_algor +x509_algor_SOURCES = x509_algor.c + # x509_asn1 TESTS += x509_asn1 check_PROGRAMS += x509_asn1 From fe731f3db0177af78a6615ecd79926e0bfd9288a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 19 Oct 2023 06:01:07 -0600 Subject: [PATCH 0467/1283] Update ChangeLog --- ChangeLog | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/ChangeLog b/ChangeLog index a498842110..b4dd2d0663 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,6 +28,15 @@ history is also available from Git. LibreSSL Portable Release Notes: +3.9.0 - In development + + * Portable changes + * Internal improvements + * Documentation improvements + * Testing and proactive security + * Bug fixes + - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp() + 3.8.2 - In development * Portable changes From fca20b23d6065af522c3f2a1b034fa0768d44730 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 2 Oct 2023 03:31:24 -0500 Subject: [PATCH 0468/1283] remove unneeded switch for MSVC, cleanup comment alignment --- CMakeLists.txt | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index f3c8a05e5c..8aaaf6283a 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -63,11 +63,7 @@ if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES) endif() # Enable asserts regardless of build type -if(MSVC) - add_definitions(/UNDEBUG) -else() - add_definitions(-UNDEBUG) -endif() +add_definitions(-UNDEBUG) set(BUILD_NC true) @@ -152,17 +148,17 @@ if(MSVC) "C4100" # 'identifier' : unreferenced formal parameter "C4127" # conditional expression is constant "C4146" # unary minus operator applied to unsigned type, - # result still unsigned + # result still unsigned "C4244" # 'argument' : conversion from 'type1' to 'type2', - # possible loss of data + # possible loss of data "C4245" # 'conversion' : conversion from 'type1' to 'type2', - # signed/unsigned mismatch + # signed/unsigned mismatch "C4267" # 'var' : conversion from 'size_t' to 'type', - # possible loss of data + # possible loss of data "C4389" # 'operator' : signed/unsigned mismatch "C4706" # assignment within conditional expression "C4996" # The POSIX name for this item is deprecated. - # Instead, use the ISO C and C++ conformant name + # Instead, use the ISO C and C++ conformant name ) elseif(CMAKE_C_COMPILER_ID MATCHES "Intel") add_definitions(-D_CRT_SUPPRESS_RESTRICT) From 01e3b10f5087dc228696f4c1e8f79f6f6657149d Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 29 Oct 2023 11:18:52 -0500 Subject: [PATCH 0469/1283] remove conflicting align directives for MASM --- update.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/update.sh b/update.sh index ef40eedf57..4c97ae3177 100755 --- a/update.sh +++ b/update.sh @@ -191,6 +191,7 @@ fixup_masm() { | sed -e 's/|/OR/g' \ | sed -e 's/~/NOT/g' \ | sed -e 's/1 << \([0-9]*\)/1 SHL \1/g' \ + | sed -e 's/^ALIGN.*//g' \ > $2 } From 321fa56d9af8f4cb0ce7cd69d4f91b8c1a37b7a8 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 9 Oct 2023 01:30:00 -0500 Subject: [PATCH 0470/1283] disable MSVC x64 asm --- CMakeLists.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index 8aaaf6283a..a1a007749f 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -341,6 +341,9 @@ elseif("${CMAKE_SYSTEM_NAME}" STREQUAL "SunOS" AND "${CMAKE_SYSTEM_PROCESSOR}" S set(HOST_X86_64 true) elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64|AMD64)") set(HOST_X86_64 true) + if (MSVC) + set(ENABLE_ASM false) + endif() elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(i[3-6]86|[xX]86)") set(ENABLE_ASM false) set(HOST_I386 true) From c4bb6b79ea36c05ccfe3033174a7950ac6a51609 Mon Sep 17 00:00:00 2001 From: Pierre Wendling Date: Tue, 12 Sep 2023 18:33:46 +0200 Subject: [PATCH 0471/1283] MSVC: Enable building ocspcheck. - Add `STDIN_FILENO` to compat unistd header. - Use quotes to include compat getopt header in the compat unistd. - Export additional symbols needed by ocspcheck (optarg, optind, ftruncate) --- apps/ocspcheck/CMakeLists.txt | 4 ---- crypto/CMakeLists.txt | 2 ++ include/compat/unistd.h | 3 ++- tls/CMakeLists.txt | 2 ++ 4 files changed, 6 insertions(+), 5 deletions(-) diff --git a/apps/ocspcheck/CMakeLists.txt b/apps/ocspcheck/CMakeLists.txt index 43eebdf466..9cf7a8b318 100644 --- a/apps/ocspcheck/CMakeLists.txt +++ b/apps/ocspcheck/CMakeLists.txt @@ -1,5 +1,3 @@ -if(NOT MSVC) - set( OCSPCHECK_SRC http.c @@ -33,5 +31,3 @@ if(ENABLE_LIBRESSL_INSTALL) install(FILES ocspcheck.8 DESTINATION ${CMAKE_INSTALL_MANDIR}/man8) endif(ENABLE_LIBRESSL_INSTALL) - -endif() diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 6ff46c8cbb..d61e607ccf 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -778,6 +778,8 @@ endif() if(NOT HAVE_GETOPT) set(CRYPTO_SRC ${CRYPTO_SRC} compat/getopt_long.c) set(EXTRA_EXPORT ${EXTRA_EXPORT} getopt) + set(EXTRA_EXPORT ${EXTRA_EXPORT} optarg) + set(EXTRA_EXPORT ${EXTRA_EXPORT} optind) endif() if(NOT HAVE_GETPAGESIZE) diff --git a/include/compat/unistd.h b/include/compat/unistd.h index 2583a6eae3..63c07fc3dc 100644 --- a/include/compat/unistd.h +++ b/include/compat/unistd.h @@ -23,6 +23,7 @@ ssize_t pwrite(int d, const void *buf, size_t nbytes, off_t offset); #include #include +#define STDIN_FILENO 0 #define STDOUT_FILENO 1 #define STDERR_FILENO 2 @@ -65,7 +66,7 @@ int getentropy(void *buf, size_t buflen); #endif #ifndef HAVE_GETOPT -#include +#include "getopt.h" #endif #ifndef HAVE_GETPAGESIZE diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 59deee3662..4beef36ea9 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -22,6 +22,8 @@ if(WIN32) compat/pread.c compat/pwrite.c ) + + set(LIBTLS_EXTRA_EXPORT ${LIBTLS_EXTRA_EXPORT} ftruncate) endif() if(NOT "${OPENSSLDIR}" STREQUAL "") From 1fd73818df53ae51adb681a34b2d5bca4bb37e49 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 15 Oct 2023 19:05:29 -0500 Subject: [PATCH 0472/1283] adjust how sizeof time_t is set, the current way causes issues with MSVC 2022's preprocessor --- CMakeLists.txt | 1 - include/compat/time.h | 8 ++++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 8c2e4ba04f..61ff1860fb 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -404,7 +404,6 @@ if(SIZEOF_TIME_T STREQUAL "4") message(WARNING " ** Warning, this system is unable to represent times past 2038\n" " ** It will behave incorrectly when handling valid RFC5280 dates") endif() -add_definitions(-DSIZEOF_TIME_T=${SIZEOF_TIME_T}) set(OPENSSL_LIBS ssl crypto ${PLATFORM_LIBS}) set(LIBTLS_LIBS tls ${PLATFORM_LIBS}) diff --git a/include/compat/time.h b/include/compat/time.h index 540807dd88..27485218fb 100644 --- a/include/compat/time.h +++ b/include/compat/time.h @@ -3,6 +3,14 @@ * sys/time.h compatibility shim */ +#ifndef SIZEOF_TIME_T +#ifdef SMALL_TIME_T +#define SIZEOF_TIME_T 4 +#else +#define SIZEOF_TIME_T 8 +#endif +#endif + #ifdef _MSC_VER #if _MSC_VER >= 1900 #include <../ucrt/time.h> From 98a5122bc6b6efc2729b5c29a570500311310ca0 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 10 Oct 2023 08:29:57 -0500 Subject: [PATCH 0473/1283] portable asm generator patches for portable This reverses changes from the 3.8.x upstream that are causing issues on a few different platforms, including macOS x64, Windows, and older Linux/FreeBSD. --- crypto/CMakeLists.txt | 3 +- crypto/Makefile.am.macosx-x86_64 | 1 - ...64-where-needed-by-inspection.-Passe.patch | 1055 +++++++++++++++++ ...cit-.text-instead-of-.previous-to-pl.patch | 162 +++ ...ion-.rodata-instead-of-a-plain-.roda.patch | 203 ++++ ...tants-out-of-text-segment-into-rodat.patch | 292 +++++ update.sh | 9 +- 7 files changed, 1721 insertions(+), 4 deletions(-) create mode 100644 patches/asm/0001-Revert-Add-endbr64-where-needed-by-inspection.-Passe.patch create mode 100644 patches/asm/0002-Revert-Use-explicit-.text-instead-of-.previous-to-pl.patch create mode 100644 patches/asm/0003-Revert-Use-.section-.rodata-instead-of-a-plain-.roda.patch create mode 100644 patches/asm/0004-Revert-Move-constants-out-of-text-segment-into-rodat.patch diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index d61e607ccf..7efb143ed8 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -111,7 +111,6 @@ if(HOST_ASM_MACOSX_X86_64) bn/arch/amd64/word_clz.S bn/arch/amd64/bn_arch.c ) - add_definitions(-Dendbr64=) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) add_definitions(-DVPAES_ASM) @@ -153,6 +152,7 @@ if(HOST_ASM_MASM_X86_64) whrlpool/wp-masm-x86_64.S cpuid-masm-x86_64.S ) + add_definitions(-Dendbr64=) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) add_definitions(-DVPAES_ASM) @@ -193,6 +193,7 @@ if(HOST_ASM_MINGW64_X86_64) whrlpool/wp-mingw64-x86_64.S cpuid-mingw64-x86_64.S ) + add_definitions(-Dendbr64=) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) add_definitions(-DVPAES_ASM) diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index 219a7acb42..b9b89cf04b 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -34,7 +34,6 @@ ASM_X86_64_MACOSX += bn/arch/amd64/bn_arch.c EXTRA_DIST += $(ASM_X86_64_MACOSX) if HOST_ASM_MACOSX_X86_64 -libcrypto_la_CPPFLAGS += -Dendbr64= libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM libcrypto_la_CPPFLAGS += -DVPAES_ASM diff --git a/patches/asm/0001-Revert-Add-endbr64-where-needed-by-inspection.-Passe.patch b/patches/asm/0001-Revert-Add-endbr64-where-needed-by-inspection.-Passe.patch new file mode 100644 index 0000000000..8ec94cdeb2 --- /dev/null +++ b/patches/asm/0001-Revert-Add-endbr64-where-needed-by-inspection.-Passe.patch @@ -0,0 +1,1055 @@ +From 5f7fafff280e6e17d7fafea20fda99762d74581f Mon Sep 17 00:00:00 2001 +From: Brent Cook +Date: Mon, 30 Oct 2023 21:59:32 -0500 +Subject: [PATCH 1/4] Revert "Add endbr64 where needed by inspection. Passes + regresson tests." + +This reverts commit e2118101444d3cf3cab87297b363cecd5357ae89. +--- + src/lib/libcrypto/aes/asm/aes-x86_64.pl | 13 ------------- + src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl | 4 ---- + src/lib/libcrypto/aes/asm/aesni-x86_64.pl | 15 --------------- + src/lib/libcrypto/aes/asm/bsaes-x86_64.pl | 14 -------------- + src/lib/libcrypto/aes/asm/vpaes-x86_64.pl | 14 -------------- + src/lib/libcrypto/bn/arch/amd64/bignum_add.S | 1 - + src/lib/libcrypto/bn/arch/amd64/bignum_cmadd.S | 1 - + src/lib/libcrypto/bn/arch/amd64/bignum_cmul.S | 1 - + src/lib/libcrypto/bn/arch/amd64/bignum_mul.S | 1 - + .../libcrypto/bn/arch/amd64/bignum_mul_4_8_alt.S | 1 - + .../libcrypto/bn/arch/amd64/bignum_mul_8_16_alt.S | 1 - + src/lib/libcrypto/bn/arch/amd64/bignum_sqr.S | 1 - + .../libcrypto/bn/arch/amd64/bignum_sqr_4_8_alt.S | 1 - + .../libcrypto/bn/arch/amd64/bignum_sqr_8_16_alt.S | 1 - + src/lib/libcrypto/bn/arch/amd64/bignum_sub.S | 1 - + src/lib/libcrypto/bn/arch/amd64/word_clz.S | 1 - + src/lib/libcrypto/bn/asm/modexp512-x86_64.pl | 5 ----- + src/lib/libcrypto/bn/asm/x86_64-mont.pl | 3 --- + src/lib/libcrypto/bn/asm/x86_64-mont5.pl | 5 ----- + src/lib/libcrypto/camellia/asm/cmll-x86_64.pl | 8 -------- + src/lib/libcrypto/md5/asm/md5-x86_64.pl | 1 - + src/lib/libcrypto/modes/asm/ghash-x86_64.pl | 4 ---- + src/lib/libcrypto/rc4/asm/rc4-md5-x86_64.pl | 6 ++---- + src/lib/libcrypto/rc4/asm/rc4-x86_64.pl | 7 ++----- + src/lib/libcrypto/sha/asm/sha1-x86_64.pl | 4 ---- + src/lib/libcrypto/sha/asm/sha512-x86_64.pl | 1 - + src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl | 1 - + src/lib/libcrypto/x86_64cpuid.pl | 2 -- + 28 files changed, 4 insertions(+), 114 deletions(-) + +diff --git a/src/lib/libcrypto/aes/asm/aes-x86_64.pl b/src/lib/libcrypto/aes/asm/aes-x86_64.pl +index 78ba20ca5..b7399b552 100755 +--- a/src/lib/libcrypto/aes/asm/aes-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/aes-x86_64.pl +@@ -318,7 +318,6 @@ $code.=<<___; + .type _x86_64_AES_encrypt,\@abi-omnipotent + .align 16 + _x86_64_AES_encrypt: +- endbr64 + xor 0($key),$s0 # xor with key + xor 4($key),$s1 + xor 8($key),$s2 +@@ -549,7 +548,6 @@ $code.=<<___; + .type _x86_64_AES_encrypt_compact,\@abi-omnipotent + .align 16 + _x86_64_AES_encrypt_compact: +- endbr64 + lea 128($sbox),$inp # size optimization + mov 0-128($inp),$acc1 # prefetch Te4 + mov 32-128($inp),$acc2 +@@ -595,7 +593,6 @@ $code.=<<___; + .hidden asm_AES_encrypt + asm_AES_encrypt: + AES_encrypt: +- endbr64 + push %rbx + push %rbp + push %r12 +@@ -887,7 +884,6 @@ $code.=<<___; + .type _x86_64_AES_decrypt,\@abi-omnipotent + .align 16 + _x86_64_AES_decrypt: +- endbr64 + xor 0($key),$s0 # xor with key + xor 4($key),$s1 + xor 8($key),$s2 +@@ -1142,7 +1138,6 @@ $code.=<<___; + .type _x86_64_AES_decrypt_compact,\@abi-omnipotent + .align 16 + _x86_64_AES_decrypt_compact: +- endbr64 + lea 128($sbox),$inp # size optimization + mov 0-128($inp),$acc1 # prefetch Td4 + mov 32-128($inp),$acc2 +@@ -1197,7 +1192,6 @@ $code.=<<___; + .hidden asm_AES_decrypt + asm_AES_decrypt: + AES_decrypt: +- endbr64 + push %rbx + push %rbp + push %r12 +@@ -1297,7 +1291,6 @@ $code.=<<___; + .type AES_set_encrypt_key,\@function,3 + .align 16 + AES_set_encrypt_key: +- endbr64 + push %rbx + push %rbp + push %r12 # redundant, but allows to share +@@ -1323,7 +1316,6 @@ AES_set_encrypt_key: + .type _x86_64_AES_set_encrypt_key,\@abi-omnipotent + .align 16 + _x86_64_AES_set_encrypt_key: +- endbr64 + mov %esi,%ecx # %ecx=bits + mov %rdi,%rsi # %rsi=userKey + mov %rdx,%rdi # %rdi=key +@@ -1569,7 +1561,6 @@ $code.=<<___; + .type AES_set_decrypt_key,\@function,3 + .align 16 + AES_set_decrypt_key: +- endbr64 + push %rbx + push %rbp + push %r12 +@@ -1669,7 +1660,6 @@ $code.=<<___; + .hidden asm_AES_cbc_encrypt + asm_AES_cbc_encrypt: + AES_cbc_encrypt: +- endbr64 + cmp \$0,%rdx # check length + je .Lcbc_epilogue + pushfq +@@ -2561,7 +2551,6 @@ $code.=<<___; + .type block_se_handler,\@abi-omnipotent + .align 16 + block_se_handler: +- endbr64 + push %rsi + push %rdi + push %rbx +@@ -2620,7 +2609,6 @@ block_se_handler: + .type key_se_handler,\@abi-omnipotent + .align 16 + key_se_handler: +- endbr64 + push %rsi + push %rdi + push %rbx +@@ -2678,7 +2666,6 @@ key_se_handler: + .type cbc_se_handler,\@abi-omnipotent + .align 16 + cbc_se_handler: +- endbr64 + push %rsi + push %rdi + push %rbx +diff --git a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl +index 879d16793..bafa906a0 100644 +--- a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl +@@ -89,7 +89,6 @@ $code.=<<___; + .type aesni_cbc_sha1_enc,\@abi-omnipotent + .align 16 + aesni_cbc_sha1_enc: +- endbr64 + # caller should check for SSSE3 and AES-NI bits + mov OPENSSL_ia32cap_P+0(%rip),%r10d + mov OPENSSL_ia32cap_P+4(%rip),%r11d +@@ -133,7 +132,6 @@ $code.=<<___; + .type aesni_cbc_sha1_enc_ssse3,\@function,6 + .align 16 + aesni_cbc_sha1_enc_ssse3: +- endbr64 + mov `($win64?56:8)`(%rsp),$inp # load 7th argument + #shr \$6,$len # debugging artefact + #jz .Lepilogue_ssse3 # debugging artefact +@@ -652,7 +650,6 @@ $code.=<<___; + .type aesni_cbc_sha1_enc_avx,\@function,6 + .align 16 + aesni_cbc_sha1_enc_avx: +- endbr64 + mov `($win64?56:8)`(%rsp),$inp # load 7th argument + #shr \$6,$len # debugging artefact + #jz .Lepilogue_avx # debugging artefact +@@ -1103,7 +1100,6 @@ $code.=<<___; + .type ssse3_handler,\@abi-omnipotent + .align 16 + ssse3_handler: +- endbr64 + push %rsi + push %rdi + push %rbx +diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl +index 07d40a84a..e662fbc7c 100644 +--- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl +@@ -242,7 +242,6 @@ $code.=<<___; + .type ${PREFIX}_encrypt,\@abi-omnipotent + .align 16 + ${PREFIX}_encrypt: +- endbr64 + movups ($inp),$inout0 # load input + mov 240($key),$rounds # key->rounds + ___ +@@ -256,7 +255,6 @@ $code.=<<___; + .type ${PREFIX}_decrypt,\@abi-omnipotent + .align 16 + ${PREFIX}_decrypt: +- endbr64 + movups ($inp),$inout0 # load input + mov 240($key),$rounds # key->rounds + ___ +@@ -286,7 +284,6 @@ $code.=<<___; + .type _aesni_${dir}rypt3,\@abi-omnipotent + .align 16 + _aesni_${dir}rypt3: +- endbr64 + $movkey ($key),$rndkey0 + shr \$1,$rounds + $movkey 16($key),$rndkey1 +@@ -331,7 +328,6 @@ $code.=<<___; + .type _aesni_${dir}rypt4,\@abi-omnipotent + .align 16 + _aesni_${dir}rypt4: +- endbr64 + $movkey ($key),$rndkey0 + shr \$1,$rounds + $movkey 16($key),$rndkey1 +@@ -377,7 +373,6 @@ $code.=<<___; + .type _aesni_${dir}rypt6,\@abi-omnipotent + .align 16 + _aesni_${dir}rypt6: +- endbr64 + $movkey ($key),$rndkey0 + shr \$1,$rounds + $movkey 16($key),$rndkey1 +@@ -442,7 +437,6 @@ $code.=<<___; + .type _aesni_${dir}rypt8,\@abi-omnipotent + .align 16 + _aesni_${dir}rypt8: +- endbr64 + $movkey ($key),$rndkey0 + shr \$1,$rounds + $movkey 16($key),$rndkey1 +@@ -531,7 +525,6 @@ $code.=<<___; + .type aesni_ecb_encrypt,\@function,5 + .align 16 + aesni_ecb_encrypt: +- endbr64 + and \$-16,$len + jz .Lecb_ret + +@@ -837,7 +830,6 @@ $code.=<<___; + .type aesni_ccm64_encrypt_blocks,\@function,6 + .align 16 + aesni_ccm64_encrypt_blocks: +- endbr64 + ___ + $code.=<<___ if ($win64); + lea -0x58(%rsp),%rsp +@@ -2487,7 +2479,6 @@ $code.=<<___; + .type ${PREFIX}_set_decrypt_key,\@abi-omnipotent + .align 16 + ${PREFIX}_set_decrypt_key: +- endbr64 + sub \$8,%rsp + call __aesni_set_encrypt_key + shl \$4,$bits # rounds-1 after _aesni_set_encrypt_key +@@ -2538,7 +2529,6 @@ $code.=<<___; + .type ${PREFIX}_set_encrypt_key,\@abi-omnipotent + .align 16 + ${PREFIX}_set_encrypt_key: +- endbr64 + __aesni_set_encrypt_key: + sub \$8,%rsp + mov \$-1,%rax +@@ -2760,7 +2750,6 @@ $code.=<<___ if ($PREFIX eq "aesni"); + .type ecb_se_handler,\@abi-omnipotent + .align 16 + ecb_se_handler: +- endbr64 + push %rsi + push %rdi + push %rbx +@@ -2780,7 +2769,6 @@ ecb_se_handler: + .type ccm64_se_handler,\@abi-omnipotent + .align 16 + ccm64_se_handler: +- endbr64 + push %rsi + push %rdi + push %rbx +@@ -2822,7 +2810,6 @@ ccm64_se_handler: + .type ctr32_se_handler,\@abi-omnipotent + .align 16 + ctr32_se_handler: +- endbr64 + push %rsi + push %rdi + push %rbx +@@ -2858,7 +2845,6 @@ ctr32_se_handler: + .type xts_se_handler,\@abi-omnipotent + .align 16 + xts_se_handler: +- endbr64 + push %rsi + push %rdi + push %rbx +@@ -2900,7 +2886,6 @@ $code.=<<___; + .type cbc_se_handler,\@abi-omnipotent + .align 16 + cbc_se_handler: +- endbr64 + push %rsi + push %rdi + push %rbx +diff --git a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl +index 7098ba27f..20e9e1f71 100644 +--- a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl +@@ -813,7 +813,6 @@ $code.=<<___; + .type _bsaes_encrypt8,\@abi-omnipotent + .align 64 + _bsaes_encrypt8: +- endbr64 + lea .LBS0(%rip), $const # constants table + + movdqa ($key), @XMM[9] # round 0 key +@@ -878,7 +877,6 @@ $code.=<<___; + .type _bsaes_decrypt8,\@abi-omnipotent + .align 64 + _bsaes_decrypt8: +- endbr64 + lea .LBS0(%rip), $const # constants table + + movdqa ($key), @XMM[9] # round 0 key +@@ -970,7 +968,6 @@ $code.=<<___; + .type _bsaes_key_convert,\@abi-omnipotent + .align 16 + _bsaes_key_convert: +- endbr64 + lea .Lmasks(%rip), $const + movdqu ($inp), %xmm7 # load round 0 key + lea 0x10($inp), $inp +@@ -1060,7 +1057,6 @@ $code.=<<___; + .type bsaes_enc_key_convert,\@function,2 + .align 16 + bsaes_enc_key_convert: +- endbr64 + mov 240($inp),%r10d # pass rounds + mov $inp,%rcx # pass key + mov $out,%rax # pass key schedule +@@ -1075,7 +1071,6 @@ bsaes_enc_key_convert: + .align 16 + bsaes_encrypt_128: + .Lenc128_loop: +- endbr64 + movdqu 0x00($inp), @XMM[0] # load input + movdqu 0x10($inp), @XMM[1] + movdqu 0x20($inp), @XMM[2] +@@ -1108,7 +1103,6 @@ bsaes_encrypt_128: + .type bsaes_dec_key_convert,\@function,2 + .align 16 + bsaes_dec_key_convert: +- endbr64 + mov 240($inp),%r10d # pass rounds + mov $inp,%rcx # pass key + mov $out,%rax # pass key schedule +@@ -1123,7 +1117,6 @@ bsaes_dec_key_convert: + .type bsaes_decrypt_128,\@function,4 + .align 16 + bsaes_decrypt_128: +- endbr64 + .Ldec128_loop: + movdqu 0x00($inp), @XMM[0] # load input + movdqu 0x10($inp), @XMM[1] +@@ -1169,7 +1162,6 @@ $code.=<<___; + .type bsaes_ecb_encrypt_blocks,\@abi-omnipotent + .align 16 + bsaes_ecb_encrypt_blocks: +- endbr64 + mov %rsp, %rax + .Lecb_enc_prologue: + push %rbp +@@ -1371,7 +1363,6 @@ $code.=<<___; + .type bsaes_ecb_decrypt_blocks,\@abi-omnipotent + .align 16 + bsaes_ecb_decrypt_blocks: +- endbr64 + mov %rsp, %rax + .Lecb_dec_prologue: + push %rbp +@@ -1577,7 +1568,6 @@ $code.=<<___; + .type bsaes_cbc_encrypt,\@abi-omnipotent + .align 16 + bsaes_cbc_encrypt: +- endbr64 + ___ + $code.=<<___ if ($win64); + mov 48(%rsp),$arg6 # pull direction flag +@@ -1865,7 +1855,6 @@ $code.=<<___; + .type bsaes_ctr32_encrypt_blocks,\@abi-omnipotent + .align 16 + bsaes_ctr32_encrypt_blocks: +- endbr64 + mov %rsp, %rax + .Lctr_enc_prologue: + push %rbp +@@ -2107,7 +2096,6 @@ $code.=<<___; + .type bsaes_xts_encrypt,\@abi-omnipotent + .align 16 + bsaes_xts_encrypt: +- endbr64 + mov %rsp, %rax + .Lxts_enc_prologue: + push %rbp +@@ -2489,7 +2477,6 @@ $code.=<<___; + .type bsaes_xts_decrypt,\@abi-omnipotent + .align 16 + bsaes_xts_decrypt: +- endbr64 + mov %rsp, %rax + .Lxts_dec_prologue: + push %rbp +@@ -2966,7 +2953,6 @@ $code.=<<___; + .type se_handler,\@abi-omnipotent + .align 16 + se_handler: +- endbr64 + push %rsi + push %rdi + push %rbx +diff --git a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl +index 8ff8d8602..3ffb1a303 100644 +--- a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl +@@ -82,7 +82,6 @@ $code.=<<___; + .type _vpaes_encrypt_core,\@abi-omnipotent + .align 16 + _vpaes_encrypt_core: +- endbr64 + mov %rdx, %r9 + mov \$16, %r11 + mov 240(%rdx),%eax +@@ -173,7 +172,6 @@ _vpaes_encrypt_core: + .type _vpaes_decrypt_core,\@abi-omnipotent + .align 16 + _vpaes_decrypt_core: +- endbr64 + mov %rdx, %r9 # load key + mov 240(%rdx),%eax + movdqa %xmm9, %xmm1 +@@ -281,7 +279,6 @@ _vpaes_decrypt_core: + .type _vpaes_schedule_core,\@abi-omnipotent + .align 16 + _vpaes_schedule_core: +- endbr64 + # rdi = key + # rsi = size in bits + # rdx = buffer +@@ -467,7 +464,6 @@ _vpaes_schedule_core: + .type _vpaes_schedule_192_smear,\@abi-omnipotent + .align 16 + _vpaes_schedule_192_smear: +- endbr64 + pshufd \$0x80, %xmm6, %xmm0 # d c 0 0 -> c 0 0 0 + pxor %xmm0, %xmm6 # -> c+d c 0 0 + pshufd \$0xFE, %xmm7, %xmm0 # b a _ _ -> b b b a +@@ -499,7 +495,6 @@ _vpaes_schedule_192_smear: + .type _vpaes_schedule_round,\@abi-omnipotent + .align 16 + _vpaes_schedule_round: +- endbr64 + # extract rcon from xmm8 + pxor %xmm1, %xmm1 + palignr \$15, %xmm8, %xmm1 +@@ -567,7 +562,6 @@ _vpaes_schedule_low_round: + .type _vpaes_schedule_transform,\@abi-omnipotent + .align 16 + _vpaes_schedule_transform: +- endbr64 + movdqa %xmm9, %xmm1 + pandn %xmm0, %xmm1 + psrld \$4, %xmm1 +@@ -606,7 +600,6 @@ _vpaes_schedule_transform: + .type _vpaes_schedule_mangle,\@abi-omnipotent + .align 16 + _vpaes_schedule_mangle: +- endbr64 + movdqa %xmm0, %xmm4 # save xmm0 for later + movdqa .Lk_mc_forward(%rip),%xmm5 + test %rcx, %rcx +@@ -680,7 +673,6 @@ _vpaes_schedule_mangle: + .type ${PREFIX}_set_encrypt_key,\@function,3 + .align 16 + ${PREFIX}_set_encrypt_key: +- endbr64 + ___ + $code.=<<___ if ($win64); + lea -0xb8(%rsp),%rsp +@@ -729,7 +721,6 @@ $code.=<<___; + .type ${PREFIX}_set_decrypt_key,\@function,3 + .align 16 + ${PREFIX}_set_decrypt_key: +- endbr64 + ___ + $code.=<<___ if ($win64); + lea -0xb8(%rsp),%rsp +@@ -783,7 +774,6 @@ $code.=<<___; + .type ${PREFIX}_encrypt,\@function,3 + .align 16 + ${PREFIX}_encrypt: +- endbr64 + ___ + $code.=<<___ if ($win64); + lea -0xb8(%rsp),%rsp +@@ -827,7 +817,6 @@ $code.=<<___; + .type ${PREFIX}_decrypt,\@function,3 + .align 16 + ${PREFIX}_decrypt: +- endbr64 + ___ + $code.=<<___ if ($win64); + lea -0xb8(%rsp),%rsp +@@ -877,7 +866,6 @@ $code.=<<___; + .type ${PREFIX}_cbc_encrypt,\@function,6 + .align 16 + ${PREFIX}_cbc_encrypt: +- endbr64 + xchg $key,$len + ___ + ($len,$key)=($key,$len); +@@ -961,7 +949,6 @@ $code.=<<___; + .type _vpaes_preheat,\@abi-omnipotent + .align 16 + _vpaes_preheat: +- endbr64 + lea .Lk_s0F(%rip), %r10 + movdqa -0x20(%r10), %xmm10 # .Lk_inv + movdqa -0x10(%r10), %xmm11 # .Lk_inv+16 +@@ -1092,7 +1079,6 @@ $code.=<<___; + .type se_handler,\@abi-omnipotent + .align 16 + se_handler: +- endbr64 + push %rsi + push %rdi + push %rbx +diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_add.S b/src/lib/libcrypto/bn/arch/amd64/bignum_add.S +index 06298ca69..d56fa5e3a 100644 +--- a/src/lib/libcrypto/bn/arch/amd64/bignum_add.S ++++ b/src/lib/libcrypto/bn/arch/amd64/bignum_add.S +@@ -49,7 +49,6 @@ + + + S2N_BN_SYMBOL(bignum_add): +- endbr64 + + #if WINDOWS_ABI + push rdi +diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_cmadd.S b/src/lib/libcrypto/bn/arch/amd64/bignum_cmadd.S +index 5ad712749..1dc1e5870 100644 +--- a/src/lib/libcrypto/bn/arch/amd64/bignum_cmadd.S ++++ b/src/lib/libcrypto/bn/arch/amd64/bignum_cmadd.S +@@ -54,7 +54,6 @@ + + + S2N_BN_SYMBOL(bignum_cmadd): +- endbr64 + + #if WINDOWS_ABI + push rdi +diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_cmul.S b/src/lib/libcrypto/bn/arch/amd64/bignum_cmul.S +index 9199c8f48..c1a23ccea 100644 +--- a/src/lib/libcrypto/bn/arch/amd64/bignum_cmul.S ++++ b/src/lib/libcrypto/bn/arch/amd64/bignum_cmul.S +@@ -51,7 +51,6 @@ + + + S2N_BN_SYMBOL(bignum_cmul): +- endbr64 + + #if WINDOWS_ABI + push rdi +diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_mul.S b/src/lib/libcrypto/bn/arch/amd64/bignum_mul.S +index 2d7ed1909..42ac988a1 100644 +--- a/src/lib/libcrypto/bn/arch/amd64/bignum_mul.S ++++ b/src/lib/libcrypto/bn/arch/amd64/bignum_mul.S +@@ -59,7 +59,6 @@ + + + S2N_BN_SYMBOL(bignum_mul): +- endbr64 + + #if WINDOWS_ABI + push rdi +diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_mul_4_8_alt.S b/src/lib/libcrypto/bn/arch/amd64/bignum_mul_4_8_alt.S +index f02b09b28..3b7848b28 100644 +--- a/src/lib/libcrypto/bn/arch/amd64/bignum_mul_4_8_alt.S ++++ b/src/lib/libcrypto/bn/arch/amd64/bignum_mul_4_8_alt.S +@@ -72,7 +72,6 @@ + adc h, rdx + + S2N_BN_SYMBOL(bignum_mul_4_8_alt): +- endbr64 + + #if WINDOWS_ABI + push rdi +diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_mul_8_16_alt.S b/src/lib/libcrypto/bn/arch/amd64/bignum_mul_8_16_alt.S +index 97be83e1f..1be37840d 100644 +--- a/src/lib/libcrypto/bn/arch/amd64/bignum_mul_8_16_alt.S ++++ b/src/lib/libcrypto/bn/arch/amd64/bignum_mul_8_16_alt.S +@@ -72,7 +72,6 @@ + adc h, rdx + + S2N_BN_SYMBOL(bignum_mul_8_16_alt): +- endbr64 + + #if WINDOWS_ABI + push rdi +diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_sqr.S b/src/lib/libcrypto/bn/arch/amd64/bignum_sqr.S +index c4a0cabf3..2e05b9c17 100644 +--- a/src/lib/libcrypto/bn/arch/amd64/bignum_sqr.S ++++ b/src/lib/libcrypto/bn/arch/amd64/bignum_sqr.S +@@ -62,7 +62,6 @@ + #define llshort ebp + + S2N_BN_SYMBOL(bignum_sqr): +- endbr64 + + #if WINDOWS_ABI + push rdi +diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_4_8_alt.S b/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_4_8_alt.S +index b228414dc..a635177c6 100644 +--- a/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_4_8_alt.S ++++ b/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_4_8_alt.S +@@ -71,7 +71,6 @@ + adc c, 0 + + S2N_BN_SYMBOL(bignum_sqr_4_8_alt): +- endbr64 + + #if WINDOWS_ABI + push rdi +diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_8_16_alt.S b/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_8_16_alt.S +index 04efeec7e..f698202d2 100644 +--- a/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_8_16_alt.S ++++ b/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_8_16_alt.S +@@ -103,7 +103,6 @@ + adc c, 0 + + S2N_BN_SYMBOL(bignum_sqr_8_16_alt): +- endbr64 + + #if WINDOWS_ABI + push rdi +diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_sub.S b/src/lib/libcrypto/bn/arch/amd64/bignum_sub.S +index 11a9bd7ed..f8e1fe35a 100644 +--- a/src/lib/libcrypto/bn/arch/amd64/bignum_sub.S ++++ b/src/lib/libcrypto/bn/arch/amd64/bignum_sub.S +@@ -49,7 +49,6 @@ + + + S2N_BN_SYMBOL(bignum_sub): +- endbr64 + + #if WINDOWS_ABI + push rdi +diff --git a/src/lib/libcrypto/bn/arch/amd64/word_clz.S b/src/lib/libcrypto/bn/arch/amd64/word_clz.S +index 464a9d90f..025e98f9c 100644 +--- a/src/lib/libcrypto/bn/arch/amd64/word_clz.S ++++ b/src/lib/libcrypto/bn/arch/amd64/word_clz.S +@@ -30,7 +30,6 @@ + .text + + S2N_BN_SYMBOL(word_clz): +- endbr64 + + #if WINDOWS_ABI + push rdi +diff --git a/src/lib/libcrypto/bn/asm/modexp512-x86_64.pl b/src/lib/libcrypto/bn/asm/modexp512-x86_64.pl +index af78fff54..2e71a7f03 100644 +--- a/src/lib/libcrypto/bn/asm/modexp512-x86_64.pl ++++ b/src/lib/libcrypto/bn/asm/modexp512-x86_64.pl +@@ -347,7 +347,6 @@ $code.=<<___; + .type MULADD_128x512,\@abi-omnipotent + .align 16 + MULADD_128x512: +- endbr64 + ___ + &MULSTEP_512([map("%r$_",(8..15))], "(+8*0)(%rcx)", "%rsi", "%rbp", "%rbx"); + $code.=<<___; +@@ -415,7 +414,6 @@ $code.=<<___; + .type mont_reduce,\@abi-omnipotent + .align 16 + mont_reduce: +- endbr64 + ___ + + my $STACK_DEPTH = 8; +@@ -678,7 +676,6 @@ $code.=<<___; + .type mont_mul_a3b,\@abi-omnipotent + .align 16 + mont_mul_a3b: +- endbr64 + # + # multiply tmp = src1 * src2 + # For multiply: dst = rcx, src1 = rdi, src2 = rsi +@@ -1080,7 +1077,6 @@ $code.=<<___; + .type sqr_reduce,\@abi-omnipotent + .align 16 + sqr_reduce: +- endbr64 + mov (+$pResult_offset+8)(%rsp), %rcx + ___ + &SQR_512("%rsp+$tmp16_offset+8", "%rcx", [map("%r$_",(10..15,8..9))], "%rbx", "%rbp", "%rsi", "%rdi"); +@@ -1110,7 +1106,6 @@ $code.=<<___; + .globl mod_exp_512 + .type mod_exp_512,\@function,4 + mod_exp_512: +- endbr64 + push %rbp + push %rbx + push %r12 +diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont.pl b/src/lib/libcrypto/bn/asm/x86_64-mont.pl +index 6f5ab331e..cae7309d5 100755 +--- a/src/lib/libcrypto/bn/asm/x86_64-mont.pl ++++ b/src/lib/libcrypto/bn/asm/x86_64-mont.pl +@@ -63,7 +63,6 @@ $code=<<___; + .type bn_mul_mont,\@function,6 + .align 16 + bn_mul_mont: +- endbr64 + test \$3,${num}d + jnz .Lmul_enter + cmp \$8,${num}d +@@ -279,7 +278,6 @@ $code.=<<___; + .align 16 + bn_mul4x_mont: + .Lmul4x_enter: +- endbr64 + push %rbx + push %rbp + push %r12 +@@ -707,7 +705,6 @@ $code.=<<___; + .align 16 + bn_sqr4x_mont: + .Lsqr4x_enter: +- endbr64 + push %rbx + push %rbp + push %r12 +diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl +index 3b3325a6c..7b9c6df27 100755 +--- a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl ++++ b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl +@@ -57,7 +57,6 @@ $code=<<___; + .type bn_mul_mont_gather5,\@function,6 + .align 64 + bn_mul_mont_gather5: +- endbr64 + test \$3,${num}d + jnz .Lmul_enter + cmp \$8,${num}d +@@ -388,7 +387,6 @@ $code.=<<___; + .type bn_mul4x_mont_gather5,\@function,6 + .align 16 + bn_mul4x_mont_gather5: +- endbr64 + .Lmul4x_enter: + mov ${num}d,${num}d + movd `($win64?56:8)`(%rsp),%xmm5 # load 7th argument +@@ -927,7 +925,6 @@ $code.=<<___; + .type bn_scatter5,\@abi-omnipotent + .align 16 + bn_scatter5: +- endbr64 + cmp \$0, $num + jz .Lscatter_epilogue + lea ($tbl,$idx,8),$tbl +@@ -946,7 +943,6 @@ bn_scatter5: + .type bn_gather5,\@abi-omnipotent + .align 16 + bn_gather5: +- endbr64 + .LSEH_begin_bn_gather5: # Win64 thing, but harmless in other cases + # I can't trust assembler to use specific encoding:-( + .byte 0x4c,0x8d,0x14,0x24 # lea (%rsp),%r10 +@@ -1057,7 +1053,6 @@ $code.=<<___; + .type mul_handler,\@abi-omnipotent + .align 16 + mul_handler: +- endbr64 + push %rsi + push %rdi + push %rbx +diff --git a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl +index 3ceed3e89..586e5d6e9 100644 +--- a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl ++++ b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl +@@ -116,7 +116,6 @@ $code=<<___; + .type Camellia_EncryptBlock,\@abi-omnipotent + .align 16 + Camellia_EncryptBlock: +- endbr64 + movl \$128,%eax + subl $arg0d,%eax + movl \$3,$arg0d +@@ -129,7 +128,6 @@ Camellia_EncryptBlock: + .align 16 + .Lenc_rounds: + Camellia_EncryptBlock_Rounds: +- endbr64 + push %rbx + push %rbp + push %r13 +@@ -178,7 +176,6 @@ Camellia_EncryptBlock_Rounds: + .type _x86_64_Camellia_encrypt,\@abi-omnipotent + .align 16 + _x86_64_Camellia_encrypt: +- endbr64 + xor 0($key),@S[1] + xor 4($key),@S[0] # ^=key[0-3] + xor 8($key),@S[3] +@@ -229,7 +226,6 @@ $code.=<<___; + .type Camellia_DecryptBlock,\@abi-omnipotent + .align 16 + Camellia_DecryptBlock: +- endbr64 + movl \$128,%eax + subl $arg0d,%eax + movl \$3,$arg0d +@@ -242,7 +238,6 @@ Camellia_DecryptBlock: + .align 16 + .Ldec_rounds: + Camellia_DecryptBlock_Rounds: +- endbr64 + push %rbx + push %rbp + push %r13 +@@ -291,7 +286,6 @@ Camellia_DecryptBlock_Rounds: + .type _x86_64_Camellia_decrypt,\@abi-omnipotent + .align 16 + _x86_64_Camellia_decrypt: +- endbr64 + xor 0($key),@S[1] + xor 4($key),@S[0] # ^=key[0-3] + xor 8($key),@S[3] +@@ -406,7 +400,6 @@ $code.=<<___; + .type Camellia_Ekeygen,\@function,3 + .align 16 + Camellia_Ekeygen: +- endbr64 + push %rbx + push %rbp + push %r13 +@@ -637,7 +630,6 @@ $code.=<<___; + .type Camellia_cbc_encrypt,\@function,6 + .align 16 + Camellia_cbc_encrypt: +- endbr64 + cmp \$0,%rdx + je .Lcbc_abort + push %rbx +diff --git a/src/lib/libcrypto/md5/asm/md5-x86_64.pl b/src/lib/libcrypto/md5/asm/md5-x86_64.pl +index 06d69094f..c902a1b53 100755 +--- a/src/lib/libcrypto/md5/asm/md5-x86_64.pl ++++ b/src/lib/libcrypto/md5/asm/md5-x86_64.pl +@@ -128,7 +128,6 @@ $code .= < +Date: Mon, 30 Oct 2023 22:00:12 -0500 +Subject: [PATCH 2/4] Revert "Use explicit .text instead of .previous to please + Windows/MinGW on amd64" + +This reverts commit e8192f57c4e5910ce7badced4a24c8827810d567. +--- + src/lib/libcrypto/aes/asm/aes-x86_64.pl | 2 +- + src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl | 2 +- + src/lib/libcrypto/aes/asm/aesni-x86_64.pl | 2 +- + src/lib/libcrypto/aes/asm/bsaes-x86_64.pl | 2 +- + src/lib/libcrypto/aes/asm/vpaes-x86_64.pl | 2 +- + src/lib/libcrypto/bn/asm/x86_64-mont5.pl | 2 +- + src/lib/libcrypto/camellia/asm/cmll-x86_64.pl | 2 +- + src/lib/libcrypto/modes/asm/ghash-x86_64.pl | 2 +- + src/lib/libcrypto/sha/asm/sha1-x86_64.pl | 2 +- + src/lib/libcrypto/sha/asm/sha512-x86_64.pl | 4 ++-- + 10 files changed, 11 insertions(+), 11 deletions(-) + +diff --git a/src/lib/libcrypto/aes/asm/aes-x86_64.pl b/src/lib/libcrypto/aes/asm/aes-x86_64.pl +index b7399b552..2986a9fcc 100755 +--- a/src/lib/libcrypto/aes/asm/aes-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/aes-x86_64.pl +@@ -2535,7 +2535,7 @@ $code.=<<___; + .long 0x80808080, 0x80808080, 0xfefefefe, 0xfefefefe + .long 0x1b1b1b1b, 0x1b1b1b1b, 0, 0 + .align 64 +-.text ++.previous + ___ + + # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, +diff --git a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl +index bafa906a0..8a428c9b1 100644 +--- a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl +@@ -1084,7 +1084,7 @@ K_XX_XX: + .long 0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6 # K_60_79 + .long 0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f # pbswap mask + .align 64 +-.text ++.previous + ___ + + # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, +diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl +index e662fbc7c..09612b1f8 100644 +--- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl +@@ -2732,7 +2732,7 @@ $code.=<<___; + .Lxts_magic: + .long 0x87,0,1,0 + .align 64 +-.text ++.previous + ___ + + # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, +diff --git a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl +index 20e9e1f71..347f4c302 100644 +--- a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl +@@ -2937,7 +2937,7 @@ _bsaes_const: + .quad 0x6363636363636363, 0x6363636363636363 + .align 64 + .size _bsaes_const,.-_bsaes_const +-.text ++.previous + ___ + + # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, +diff --git a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl +index 3ffb1a303..ad5fa7522 100644 +--- a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl +@@ -1063,7 +1063,7 @@ _vpaes_consts: + .quad 0x12D7560F93441D00, 0xCA4B8159D8C58E9C + .align 64 + .size _vpaes_consts,.-_vpaes_consts +-.text ++.previous + ___ + + if ($win64) { +diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl +index 7b9c6df27..1c8aa255c 100755 +--- a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl ++++ b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl +@@ -1037,7 +1037,7 @@ $code.=<<___; + .Linc: + .long 0,0, 1,1 + .long 2,2, 2,2 +-.text ++.previous + ___ + + # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, +diff --git a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl +index 586e5d6e9..c16725f5c 100644 +--- a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl ++++ b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl +@@ -625,7 +625,7 @@ $_ivp="40(%rsp)"; + $_rsp="48(%rsp)"; + + $code.=<<___; +-.text ++.previous + .globl Camellia_cbc_encrypt + .type Camellia_cbc_encrypt,\@function,6 + .align 16 +diff --git a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl +index 71d0822ac..bce62947f 100644 +--- a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl ++++ b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl +@@ -670,7 +670,7 @@ $code.=<<___; + .value 0xB5E0,0xB422,0xB664,0xB7A6,0xB2E8,0xB32A,0xB16C,0xB0AE + .value 0xBBF0,0xBA32,0xB874,0xB9B6,0xBCF8,0xBD3A,0xBF7C,0xBEBE + .align 64 +-.text ++.previous + ___ + + # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, +diff --git a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl +index 43eee73c4..1ec7f609a 100755 +--- a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl ++++ b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl +@@ -1079,7 +1079,7 @@ K_XX_XX: + .long 0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc # K_40_59 + .long 0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6 # K_60_79 + .long 0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f # pbswap mask +-.text ++.previous + ___ + }}} + $code.=<<___; +diff --git a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl +index 0517eab66..1a7d9bf2d 100755 +--- a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl ++++ b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl +@@ -289,7 +289,7 @@ $TABLE: + .long 0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3 + .long 0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208 + .long 0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2 +-.text ++.previous + ___ + } else { + $code.=<<___; +@@ -337,7 +337,7 @@ $TABLE: + .quad 0x3c9ebe0a15c9bebc,0x431d67c49c100d4c + .quad 0x4cc5d4becb3e42b6,0x597f299cfc657e2a + .quad 0x5fcb6fab3ad6faec,0x6c44198c4a475817 +-.text ++.previous + ___ + } + +-- +2.42.0 + diff --git a/patches/asm/0003-Revert-Use-.section-.rodata-instead-of-a-plain-.roda.patch b/patches/asm/0003-Revert-Use-.section-.rodata-instead-of-a-plain-.roda.patch new file mode 100644 index 0000000000..165f2c0ff8 --- /dev/null +++ b/patches/asm/0003-Revert-Use-.section-.rodata-instead-of-a-plain-.roda.patch @@ -0,0 +1,203 @@ +From 1407448470aff891f9a9eff550ecda06202ffd29 Mon Sep 17 00:00:00 2001 +From: Brent Cook +Date: Mon, 30 Oct 2023 22:00:49 -0500 +Subject: [PATCH 3/4] Revert "Use .section .rodata instead of a plain .rodata" + +This reverts commit 67afc07de0ed3a0ccc272df42853ba565a8277c6. +--- + src/lib/libcrypto/aes/asm/aes-x86_64.pl | 2 +- + src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl | 2 +- + src/lib/libcrypto/aes/asm/aesni-x86_64.pl | 2 +- + src/lib/libcrypto/aes/asm/bsaes-x86_64.pl | 2 +- + src/lib/libcrypto/aes/asm/vpaes-x86_64.pl | 2 +- + src/lib/libcrypto/bn/asm/x86_64-mont5.pl | 2 +- + src/lib/libcrypto/camellia/asm/cmll-x86_64.pl | 2 +- + src/lib/libcrypto/modes/asm/ghash-x86_64.pl | 2 +- + src/lib/libcrypto/perlasm/x86gas.pl | 2 +- + src/lib/libcrypto/sha/asm/sha1-x86_64.pl | 2 +- + src/lib/libcrypto/sha/asm/sha512-ppc.pl | 2 +- + src/lib/libcrypto/sha/asm/sha512-x86_64.pl | 4 ++-- + src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl | 2 +- + 13 files changed, 14 insertions(+), 14 deletions(-) + +diff --git a/src/lib/libcrypto/aes/asm/aes-x86_64.pl b/src/lib/libcrypto/aes/asm/aes-x86_64.pl +index 2986a9fcc..d9f501b25 100755 +--- a/src/lib/libcrypto/aes/asm/aes-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/aes-x86_64.pl +@@ -2113,7 +2113,7 @@ ___ + } + + $code.=<<___; +-.section .rodata ++.rodata + .align 64 + .LAES_Te: + ___ +diff --git a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl +index 8a428c9b1..4e83b6ba4 100644 +--- a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl +@@ -1075,7 +1075,7 @@ $code.=<<___; + ___ + } + $code.=<<___; +-.section .rodata ++.rodata + .align 64 + K_XX_XX: + .long 0x5a827999,0x5a827999,0x5a827999,0x5a827999 # K_00_19 +diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl +index 09612b1f8..2ab7106c0 100644 +--- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl +@@ -2721,7 +2721,7 @@ ___ + } + + $code.=<<___; +-.section .rodata ++.rodata + .align 64 + .Lbswap_mask: + .byte 15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0 +diff --git a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl +index 347f4c302..a40f83601 100644 +--- a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl +@@ -2882,7 +2882,7 @@ $code.=<<___; + ___ + } + $code.=<<___; +-.section .rodata ++.rodata + .type _bsaes_const,\@object + .align 64 + _bsaes_const: +diff --git a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl +index ad5fa7522..63af96c1d 100644 +--- a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl +@@ -964,7 +964,7 @@ _vpaes_preheat: + ## Constants ## + ## ## + ######################################################## +-.section .rodata ++.rodata + .type _vpaes_consts,\@object + .align 64 + _vpaes_consts: +diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl +index 1c8aa255c..5d30f210c 100755 +--- a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl ++++ b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl +@@ -1032,7 +1032,7 @@ $code.=<<___; + ___ + } + $code.=<<___; +-.section .rodata ++.rodata + .align 64 + .Linc: + .long 0,0, 1,1 +diff --git a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl +index c16725f5c..90c56d9e5 100644 +--- a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl ++++ b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl +@@ -599,7 +599,7 @@ sub S0222 { my $i=shift; $i=@SBOX[$i]; $i=($i<<1|$i>>7)&0xff; $i=$i<<16|$i<<8|$i + sub S3033 { my $i=shift; $i=@SBOX[$i]; $i=($i>>1|$i<<7)&0xff; $i=$i<<24|$i<<8|$i; sprintf("0x%08x",$i); } + + $code.=<<___; +-.section .rodata ++.rodata + .align 64 + .LCamellia_SIGMA: + .long 0x3bcc908b, 0xa09e667f, 0x4caa73b2, 0xb67ae858 +diff --git a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl +index bce62947f..3ae8629cb 100644 +--- a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl ++++ b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl +@@ -622,7 +622,7 @@ ___ + } + + $code.=<<___; +-.section .rodata ++.rodata + .align 64 + .Lbswap_mask: + .byte 15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0 +diff --git a/src/lib/libcrypto/perlasm/x86gas.pl b/src/lib/libcrypto/perlasm/x86gas.pl +index b84e28be9..f28a59054 100644 +--- a/src/lib/libcrypto/perlasm/x86gas.pl ++++ b/src/lib/libcrypto/perlasm/x86gas.pl +@@ -307,7 +307,7 @@ sub ::dataseg + { push(@out,".data\n"); } + + sub ::rodataseg +-{ push(@out,".section .rodata\n"); } ++{ push(@out,".rodata\n"); } + + sub ::previous + { push(@out,".previous\n"); } +diff --git a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl +index 1ec7f609a..0abbbab6b 100755 +--- a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl ++++ b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl +@@ -1071,7 +1071,7 @@ $code.=<<___; + ___ + } + $code.=<<___; +-.section .rodata ++.rodata + .align 64 + K_XX_XX: + .long 0x5a827999,0x5a827999,0x5a827999,0x5a827999 # K_00_19 +diff --git a/src/lib/libcrypto/sha/asm/sha512-ppc.pl b/src/lib/libcrypto/sha/asm/sha512-ppc.pl +index 28bd997cf..1f02cfdd5 100755 +--- a/src/lib/libcrypto/sha/asm/sha512-ppc.pl ++++ b/src/lib/libcrypto/sha/asm/sha512-ppc.pl +@@ -375,7 +375,7 @@ $code.=<<___; + $ST $H,`7*$SZ`($ctx) + bne Lsha2_block_private + blr +- .section .rodata ++ .rodata + Ltable: + ___ + $code.=<<___ if ($SZ==8); +diff --git a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl +index 1a7d9bf2d..6698b1d40 100755 +--- a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl ++++ b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl +@@ -269,7 +269,7 @@ ___ + + if ($SZ==4) { + $code.=<<___; +-.section .rodata ++.rodata + .align 64 + .type $TABLE,\@object + $TABLE: +@@ -293,7 +293,7 @@ $TABLE: + ___ + } else { + $code.=<<___; +-.section .rodata ++.rodata + .align 64 + .type $TABLE,\@object + $TABLE: +diff --git a/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl b/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl +index de5d3acfb..510a74b91 100644 +--- a/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl ++++ b/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl +@@ -204,7 +204,7 @@ $code.=<<___; + ret + .size $func,.-$func + +-.section .rodata ++.rodata + .align 64 + .type $table,\@object + $table: +-- +2.42.0 + diff --git a/patches/asm/0004-Revert-Move-constants-out-of-text-segment-into-rodat.patch b/patches/asm/0004-Revert-Move-constants-out-of-text-segment-into-rodat.patch new file mode 100644 index 0000000000..1a17540555 --- /dev/null +++ b/patches/asm/0004-Revert-Move-constants-out-of-text-segment-into-rodat.patch @@ -0,0 +1,292 @@ +From 87b24a6d5a932061cc88b84a856663b328d1c166 Mon Sep 17 00:00:00 2001 +From: Brent Cook +Date: Mon, 30 Oct 2023 22:01:49 -0500 +Subject: [PATCH 4/4] Revert "Move constants out of text segment into rodata to + prepare for xonly support" + +This reverts commit b5834617204e7520b0209bcff7f1c4a559e05422. +--- + src/lib/libcrypto/aes/asm/aes-x86_64.pl | 3 +-- + src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl | 4 ++-- + src/lib/libcrypto/aes/asm/aesni-x86_64.pl | 4 ++-- + src/lib/libcrypto/aes/asm/bsaes-x86_64.pl | 3 +-- + src/lib/libcrypto/aes/asm/vpaes-x86_64.pl | 3 +-- + src/lib/libcrypto/bn/asm/x86_64-mont.pl | 4 ++++ + src/lib/libcrypto/bn/asm/x86_64-mont5.pl | 3 +-- + src/lib/libcrypto/camellia/asm/cmll-x86_64.pl | 4 ++-- + src/lib/libcrypto/modes/asm/ghash-x86_64.pl | 4 ++-- + src/lib/libcrypto/sha/asm/sha1-x86_64.pl | 3 +-- + src/lib/libcrypto/sha/asm/sha512-x86_64.pl | 4 ---- + src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl | 1 - + 12 files changed, 17 insertions(+), 23 deletions(-) + +diff --git a/src/lib/libcrypto/aes/asm/aes-x86_64.pl b/src/lib/libcrypto/aes/asm/aes-x86_64.pl +index d9f501b25..9072f603a 100755 +--- a/src/lib/libcrypto/aes/asm/aes-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/aes-x86_64.pl +@@ -2113,7 +2113,6 @@ ___ + } + + $code.=<<___; +-.rodata + .align 64 + .LAES_Te: + ___ +@@ -2534,8 +2533,8 @@ ___ + $code.=<<___; + .long 0x80808080, 0x80808080, 0xfefefefe, 0xfefefefe + .long 0x1b1b1b1b, 0x1b1b1b1b, 0, 0 ++.asciz "AES for x86_64, CRYPTOGAMS by " + .align 64 +-.previous + ___ + + # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, +diff --git a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl +index 4e83b6ba4..880bcc2d5 100644 +--- a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl +@@ -1075,7 +1075,6 @@ $code.=<<___; + ___ + } + $code.=<<___; +-.rodata + .align 64 + K_XX_XX: + .long 0x5a827999,0x5a827999,0x5a827999,0x5a827999 # K_00_19 +@@ -1083,8 +1082,9 @@ K_XX_XX: + .long 0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc # K_40_59 + .long 0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6 # K_60_79 + .long 0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f # pbswap mask ++ ++.asciz "AESNI-CBC+SHA1 stitch for x86_64, CRYPTOGAMS by " + .align 64 +-.previous + ___ + + # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, +diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl +index 2ab7106c0..96978bd35 100644 +--- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl +@@ -2721,7 +2721,6 @@ ___ + } + + $code.=<<___; +-.rodata + .align 64 + .Lbswap_mask: + .byte 15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0 +@@ -2731,8 +2730,9 @@ $code.=<<___; + .long 1,0,0,0 + .Lxts_magic: + .long 0x87,0,1,0 ++ ++.asciz "AES for Intel AES-NI, CRYPTOGAMS by " + .align 64 +-.previous + ___ + + # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, +diff --git a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl +index a40f83601..14dc2c02e 100644 +--- a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl +@@ -2882,7 +2882,6 @@ $code.=<<___; + ___ + } + $code.=<<___; +-.rodata + .type _bsaes_const,\@object + .align 64 + _bsaes_const: +@@ -2935,9 +2934,9 @@ _bsaes_const: + .quad 0x02060a0e03070b0f, 0x0004080c0105090d + .L63: + .quad 0x6363636363636363, 0x6363636363636363 ++.asciz "Bit-sliced AES for x86_64/SSSE3, Emilia Käsper, Peter Schwabe, Andy Polyakov" + .align 64 + .size _bsaes_const,.-_bsaes_const +-.previous + ___ + + # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, +diff --git a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl +index 63af96c1d..bd7f45b85 100644 +--- a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl +@@ -964,7 +964,6 @@ _vpaes_preheat: + ## Constants ## + ## ## + ######################################################## +-.rodata + .type _vpaes_consts,\@object + .align 64 + _vpaes_consts: +@@ -1061,9 +1060,9 @@ _vpaes_consts: + .Lk_dsbo: # decryption sbox final output + .quad 0x1387EA537EF94000, 0xC7AA6DB9D4943E2D + .quad 0x12D7560F93441D00, 0xCA4B8159D8C58E9C ++.asciz "Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)" + .align 64 + .size _vpaes_consts,.-_vpaes_consts +-.previous + ___ + + if ($win64) { +diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont.pl b/src/lib/libcrypto/bn/asm/x86_64-mont.pl +index cae7309d5..c35493e80 100755 +--- a/src/lib/libcrypto/bn/asm/x86_64-mont.pl ++++ b/src/lib/libcrypto/bn/asm/x86_64-mont.pl +@@ -1495,6 +1495,10 @@ $code.=<<___; + .size bn_sqr4x_mont,.-bn_sqr4x_mont + ___ + }}} ++$code.=<<___; ++.asciz "Montgomery Multiplication for x86_64, CRYPTOGAMS by " ++.align 16 ++___ + + print $code; + close STDOUT; +diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl +index 5d30f210c..bb7ad4c4b 100755 +--- a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl ++++ b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl +@@ -1032,12 +1032,11 @@ $code.=<<___; + ___ + } + $code.=<<___; +-.rodata + .align 64 + .Linc: + .long 0,0, 1,1 + .long 2,2, 2,2 +-.previous ++.asciz "Montgomery Multiplication with scatter/gather for x86_64, CRYPTOGAMS by " + ___ + + # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, +diff --git a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl +index 90c56d9e5..df6bf11a2 100644 +--- a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl ++++ b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl +@@ -599,7 +599,6 @@ sub S0222 { my $i=shift; $i=@SBOX[$i]; $i=($i<<1|$i>>7)&0xff; $i=$i<<16|$i<<8|$i + sub S3033 { my $i=shift; $i=@SBOX[$i]; $i=($i>>1|$i<<7)&0xff; $i=$i<<24|$i<<8|$i; sprintf("0x%08x",$i); } + + $code.=<<___; +-.rodata + .align 64 + .LCamellia_SIGMA: + .long 0x3bcc908b, 0xa09e667f, 0x4caa73b2, 0xb67ae858 +@@ -625,7 +624,6 @@ $_ivp="40(%rsp)"; + $_rsp="48(%rsp)"; + + $code.=<<___; +-.previous + .globl Camellia_cbc_encrypt + .type Camellia_cbc_encrypt,\@function,6 + .align 16 +@@ -859,6 +857,8 @@ Camellia_cbc_encrypt: + .Lcbc_abort: + ret + .size Camellia_cbc_encrypt,.-Camellia_cbc_encrypt ++ ++.asciz "Camellia for x86_64 by " + ___ + } + +diff --git a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl +index 3ae8629cb..38d779edb 100644 +--- a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl ++++ b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl +@@ -622,7 +622,6 @@ ___ + } + + $code.=<<___; +-.rodata + .align 64 + .Lbswap_mask: + .byte 15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0 +@@ -669,8 +668,9 @@ $code.=<<___; + .value 0xA7D0,0xA612,0xA454,0xA596,0xA0D8,0xA11A,0xA35C,0xA29E + .value 0xB5E0,0xB422,0xB664,0xB7A6,0xB2E8,0xB32A,0xB16C,0xB0AE + .value 0xBBF0,0xBA32,0xB874,0xB9B6,0xBCF8,0xBD3A,0xBF7C,0xBEBE ++ ++.asciz "GHASH for x86_64, CRYPTOGAMS by " + .align 64 +-.previous + ___ + + # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, +diff --git a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl +index 0abbbab6b..cc8ef5337 100755 +--- a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl ++++ b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl +@@ -1071,7 +1071,6 @@ $code.=<<___; + ___ + } + $code.=<<___; +-.rodata + .align 64 + K_XX_XX: + .long 0x5a827999,0x5a827999,0x5a827999,0x5a827999 # K_00_19 +@@ -1079,10 +1078,10 @@ K_XX_XX: + .long 0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc # K_40_59 + .long 0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6 # K_60_79 + .long 0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f # pbswap mask +-.previous + ___ + }}} + $code.=<<___; ++.asciz "SHA1 block transform for x86_64, CRYPTOGAMS by " + .align 64 + ___ + +diff --git a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl +index 6698b1d40..bc4b2e748 100755 +--- a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl ++++ b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl +@@ -269,7 +269,6 @@ ___ + + if ($SZ==4) { + $code.=<<___; +-.rodata + .align 64 + .type $TABLE,\@object + $TABLE: +@@ -289,11 +288,9 @@ $TABLE: + .long 0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3 + .long 0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208 + .long 0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2 +-.previous + ___ + } else { + $code.=<<___; +-.rodata + .align 64 + .type $TABLE,\@object + $TABLE: +@@ -337,7 +334,6 @@ $TABLE: + .quad 0x3c9ebe0a15c9bebc,0x431d67c49c100d4c + .quad 0x4cc5d4becb3e42b6,0x597f299cfc657e2a + .quad 0x5fcb6fab3ad6faec,0x6c44198c4a475817 +-.previous + ___ + } + +diff --git a/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl b/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl +index 510a74b91..afadd5d2f 100644 +--- a/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl ++++ b/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl +@@ -204,7 +204,6 @@ $code.=<<___; + ret + .size $func,.-$func + +-.rodata + .align 64 + .type $table,\@object + $table: +-- +2.42.0 + diff --git a/update.sh b/update.sh index 4c97ae3177..93e71bb139 100755 --- a/update.sh +++ b/update.sh @@ -191,12 +191,17 @@ fixup_masm() { | sed -e 's/|/OR/g' \ | sed -e 's/~/NOT/g' \ | sed -e 's/1 << \([0-9]*\)/1 SHL \1/g' \ - | sed -e 's/^ALIGN.*//g' \ > $2 } # generate assembly crypto algorithms -asm_src=$libcrypto_src +asm_src=$CWD/asm +rm -fr $asm_src +cp -a $libcrypto_src $asm_src +for i in `ls -1 patches/asm/*.patch | sort -n`; do + patch -d $asm_src -p 4 < $i; +done + gen_asm_stdout() { CC=true perl $asm_src/$2 $1 > crypto/$3.tmp [ $1 = "elf" ] && cat <<-EOF >> crypto/$3.tmp From dd1d96f643b01a5edbe7e0db8399f3c88f5f0c8b Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 30 Oct 2023 22:49:47 -0500 Subject: [PATCH 0474/1283] fix cross-compilation on Windows 11 Arm64 signal.h is less populated in this environment, remove stub signal handlers --- crypto/compat/ui_openssl_win.c | 42 ---------------------------------- 1 file changed, 42 deletions(-) diff --git a/crypto/compat/ui_openssl_win.c b/crypto/compat/ui_openssl_win.c index c245111d66..b6a621f565 100644 --- a/crypto/compat/ui_openssl_win.c +++ b/crypto/compat/ui_openssl_win.c @@ -139,9 +139,6 @@ static int is_a_tty; /* Declare static functions */ static int read_till_nl(FILE *); -static void recsig(int); -static void pushsig(void); -static void popsig(void); static int read_string_inner(UI *ui, UI_STRING *uis, int echo, int strip_nl); static int read_string(UI *ui, UI_STRING *uis); @@ -236,8 +233,6 @@ read_till_nl(FILE *in) return 1; } -static volatile sig_atomic_t intr_signal; - static int read_string_inner(UI *ui, UI_STRING *uis, int echo, int strip_nl) { @@ -247,12 +242,9 @@ read_string_inner(UI *ui, UI_STRING *uis, int echo, int strip_nl) int maxsize = BUFSIZ - 1; char *p; - intr_signal = 0; ok = 0; ps = 0; - pushsig(); - ps = 1; if (!echo && !noecho_console(ui)) @@ -276,16 +268,11 @@ read_string_inner(UI *ui, UI_STRING *uis, int echo, int strip_nl) ok = 1; error: - if (intr_signal == SIGINT) - ok = -1; if (!echo) fprintf(tty_out, "\n"); if (ps >= 2 && !echo && !echo_console(ui)) ok = 0; - if (ps >= 1) - popsig(); - explicit_bzero(result, BUFSIZ); return ok; } @@ -348,32 +335,3 @@ close_console(UI *ui) return 1; } - -/* Internal functions to handle signals and act on them */ -static void -pushsig(void) -{ - savsig[SIGABRT] = signal(SIGABRT, recsig); - savsig[SIGFPE] = signal(SIGFPE, recsig); - savsig[SIGILL] = signal(SIGILL, recsig); - savsig[SIGINT] = signal(SIGINT, recsig); - savsig[SIGSEGV] = signal(SIGSEGV, recsig); - savsig[SIGTERM] = signal(SIGTERM, recsig); -} - -static void -popsig(void) -{ - signal(SIGABRT, savsig[SIGABRT]); - signal(SIGFPE, savsig[SIGFPE]); - signal(SIGILL, savsig[SIGILL]); - signal(SIGINT, savsig[SIGINT]); - signal(SIGSEGV, savsig[SIGSEGV]); - signal(SIGTERM, savsig[SIGTERM]); -} - -static void -recsig(int i) -{ - intr_signal = i; -} From 9bca15bad544eeaa12f59f1f49271e83a4b34ca3 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 29 Oct 2023 18:00:38 -0500 Subject: [PATCH 0475/1283] reenable assembly for MSVC --- CMakeLists.txt | 3 --- 1 file changed, 3 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 61ff1860fb..2f0dfa0e70 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -341,9 +341,6 @@ elseif("${CMAKE_SYSTEM_NAME}" STREQUAL "SunOS" AND "${CMAKE_SYSTEM_PROCESSOR}" S set(HOST_X86_64 true) elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64|AMD64)") set(HOST_X86_64 true) - if (MSVC) - set(ENABLE_ASM false) - endif() elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(i[3-6]86|[xX]86)") set(ENABLE_ASM false) set(HOST_I386 true) From 548b3d0485c0ad00c6041670c2192c4b5bd80e66 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 31 Oct 2023 09:25:23 -0500 Subject: [PATCH 0476/1283] restrict patches to windows / macos platforms --- update.sh | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/update.sh b/update.sh index 93e71bb139..1f2d78b529 100755 --- a/update.sh +++ b/update.sh @@ -196,11 +196,18 @@ fixup_masm() { # generate assembly crypto algorithms asm_src=$CWD/asm -rm -fr $asm_src -cp -a $libcrypto_src $asm_src -for i in `ls -1 patches/asm/*.patch | sort -n`; do - patch -d $asm_src -p 4 < $i; -done + +setup_asm_generator() { + rm -fr $asm_src + cp -a $libcrypto_src $asm_src +} + +setup_asm_generator_patched() { + setup_asm_generator + for i in `ls -1 patches/asm/*.patch | sort -n`; do + patch -d $asm_src -p 4 < $i 1> /dev/null 2>/dev/null ; + done +} gen_asm_stdout() { CC=true perl $asm_src/$2 $1 > crypto/$3.tmp @@ -242,6 +249,8 @@ gen_asm() { fi } +setup_asm_generator + echo generating mips ASM source for elf gen_asm_mips o32 aes aes-mips aes-mips gen_asm_mips o32 bn mips bn-mips @@ -271,6 +280,14 @@ $CP $libcrypto_src/arch/arm/arm_arch.h crypto for abi in elf macosx masm mingw64; do echo generating x86_64 ASM source for $abi + + # use patched generators for non-elf targets + if [ $abi = "elf" ]; then + setup_asm_generator + else + setup_asm_generator_patched + fi + gen_asm_stdout $abi aes/asm/aes-x86_64.pl aes/aes-$abi-x86_64.S gen_asm_stdout $abi aes/asm/vpaes-x86_64.pl aes/vpaes-$abi-x86_64.S gen_asm_stdout $abi aes/asm/bsaes-x86_64.pl aes/bsaes-$abi-x86_64.S From 124e0192c84fd6a48905dae0fbbad12f847db2a0 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 1 Nov 2023 06:43:41 -0500 Subject: [PATCH 0477/1283] enable system arc4random on FreeBSD 12+ --- m4/check-os-options.m4 | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/m4/check-os-options.m4 b/m4/check-os-options.m4 index bd389384b9..c73709dbb5 100644 --- a/m4/check-os-options.m4 +++ b/m4/check-os-options.m4 @@ -61,9 +61,15 @@ char buf[1]; getentropy(buf, 1); *freebsd*) HOST_OS=freebsd HOST_ABI=elf - # fork detection missing, weak seed on failure - # https://svnweb.freebsd.org/base/head/lib/libc/gen/arc4random.c?revision=268642&view=markup - USE_BUILTIN_ARC4RANDOM=yes + AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ +#include +#if __FreeBSD_version < 1200000 + undefined +#endif + ]], [[]])], + [ USE_BUILTIN_ARC4RANDOM=no ], + [ USE_BUILTIN_ARC4RANDOM=yes ] + ) AC_SUBST([PROG_LDADD], ['-lthr']) ;; *hpux*) From eed367e19c930472bc2d1c8026c1109afeea78d4 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 1 Nov 2023 13:21:25 +0100 Subject: [PATCH 0478/1283] Allow disabling warning about WINCRYPT overrides Fixes #919 --- patches/windows_headers.patch | 32 +++++++++++++++----------------- 1 file changed, 15 insertions(+), 17 deletions(-) diff --git a/patches/windows_headers.patch b/patches/windows_headers.patch index 087d5ab33b..6eafa499cd 100644 --- a/patches/windows_headers.patch +++ b/patches/windows_headers.patch @@ -1,26 +1,25 @@ -diff -u include/openssl.orig/dtls1.h include/openssl/dtls1.h ---- include/openssl.orig/dtls1.h Mon Dec 7 07:58:32 2015 -+++ include/openssl/dtls1.h Mon Dec 7 07:56:14 2015 +--- include/openssl/dtls1.h.orig Wed Nov 1 13:15:36 2023 ++++ include/openssl/dtls1.h Wed Nov 1 13:15:54 2023 @@ -60,7 +60,11 @@ #ifndef HEADER_DTLS1_H #define HEADER_DTLS1_H - + +#if defined(_WIN32) +#include +#else #include +#endif - + #include #include ---- include/openssl/ossl_typ.h.orig Fri Feb 18 16:30:39 2022 -+++ include/openssl/ossl_typ.h Mon Feb 21 05:39:35 2022 -@@ -82,6 +82,22 @@ +--- include/openssl/ossl_typ.h.orig Wed Nov 1 13:15:36 2023 ++++ include/openssl/ossl_typ.h Wed Nov 1 13:18:23 2023 +@@ -82,6 +82,22 @@ typedef struct asn1_object_st ASN1_OBJECT; typedef struct ASN1_ITEM_st ASN1_ITEM; typedef struct asn1_pctx_st ASN1_PCTX; +#if defined(_WIN32) && defined(__WINCRYPT_H__) -+#ifndef LIBRESSL_INTERNAL ++#if !defined(LIBRESSL_INTERNAL) && !defined(LIBRESSL_DISABLE_OVERRIDE_WINCRYPT_DEFINES_WARNING) +#ifdef _MSC_VER +#pragma message("Warning, overriding WinCrypt defines") +#else @@ -38,15 +37,14 @@ diff -u include/openssl.orig/dtls1.h include/openssl/dtls1.h #ifdef BIGNUM #undef BIGNUM #endif -diff -u include/openssl.orig/pkcs7.h include/openssl/pkcs7.h ---- include/openssl.orig/pkcs7.h Mon Dec 7 07:58:32 2015 -+++ include/openssl/pkcs7.h Mon Dec 7 07:56:14 2015 +--- include/openssl/pkcs7.h.orig Wed Nov 1 13:15:36 2023 ++++ include/openssl/pkcs7.h Wed Nov 1 13:17:58 2023 @@ -69,6 +69,18 @@ extern "C" { #endif - + +#if defined(_WIN32) && defined(__WINCRYPT_H__) -+#ifndef LIBRESSL_INTERNAL ++#if !defined(LIBRESSL_INTERNAL) && !defined(LIBRESSL_DISABLE_OVERRIDE_WINCRYPT_DEFINES_WARNING) +#ifdef _MSC_VER +#pragma message("Warning, overriding WinCrypt defines") +#else @@ -60,14 +58,14 @@ diff -u include/openssl.orig/pkcs7.h include/openssl/pkcs7.h /* Encryption_ID DES-CBC Digest_ID MD5 ---- include/openssl/x509.h.orig Thu Aug 3 13:35:00 2023 -+++ include/openssl/x509.h Thu Aug 3 13:35:18 2023 +--- include/openssl/x509.h.orig Wed Nov 1 13:15:36 2023 ++++ include/openssl/x509.h Wed Nov 1 13:18:44 2023 @@ -100,6 +100,19 @@ extern "C" { #endif +#if defined(_WIN32) && defined(__WINCRYPT_H__) -+#ifndef LIBRESSL_INTERNAL ++#if !defined(LIBRESSL_INTERNAL) && !defined(LIBRESSL_DISABLE_OVERRIDE_WINCRYPT_DEFINES_WARNING) +#ifdef _MSC_VER +#pragma message("Warning, overriding WinCrypt defines") +#else From c539117be944e2f234f016d5562e133715719d3d Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 1 Nov 2023 21:16:44 -0500 Subject: [PATCH 0479/1283] update 3.8.2 changelog --- ChangeLog | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index b4dd2d0663..b8b127023f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -37,13 +37,18 @@ LibreSSL Portable Release Notes: * Bug fixes - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp() -3.8.2 - In development +3.8.2 - Stable release * Portable changes - * Internal improvements + - Fixed processor detection for CMake targets. Thanks to jiegec. + - Enabled building oscpcheck with MSVC. Thanks to FtZPetruska + - Improve CMake package detection and installation. + Thanks to mark-groundctl + - Fixed assembly optimizations on x64 Windows targets + - Allow disabling warnings about + - Use system arc4random on FreeBSD 12 and newer. * Documentation improvements - Documented the RFC 3779 API - * Testing and Proactive Security * Compatibility changes - Restrict the RFC 3779 code to IPv4 and IPv6. It was not written to be able to deal with anything else. From ef426bf06bdad2148bea54cab5d6a74179ec38eb Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 2 Nov 2023 04:40:43 -0500 Subject: [PATCH 0480/1283] changelog revisions --- ChangeLog | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index b8b127023f..223352933d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -40,15 +40,17 @@ LibreSSL Portable Release Notes: 3.8.2 - Stable release * Portable changes - - Fixed processor detection for CMake targets. Thanks to jiegec. - - Enabled building oscpcheck with MSVC. Thanks to FtZPetruska + - Fixed processor detection for CMake targets. + Thanks to @jiegec from github. + - Enabled building oscpcheck with MSVC. + Thanks to @FtZPetruska from github. - Improve CMake package detection and installation. - Thanks to mark-groundctl - - Fixed assembly optimizations on x64 Windows targets - - Allow disabling warnings about + Thanks to @mark-groundctl from github. + - Fixed assembly optimizations on x64 Windows targets. + - Allow disabling warnings about WINCRYPT overrides. - Use system arc4random on FreeBSD 12 and newer. * Documentation improvements - - Documented the RFC 3779 API + - Documented the RFC 3779 API. * Compatibility changes - Restrict the RFC 3779 code to IPv4 and IPv6. It was not written to be able to deal with anything else. From 2fcf5b096470bfc987b90129122d4f8495e94aa0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 2 Nov 2023 23:36:16 -0600 Subject: [PATCH 0481/1283] Update ChangeLog --- ChangeLog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index 223352933d..7e986f09a1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,8 +34,12 @@ LibreSSL Portable Release Notes: * Internal improvements * Documentation improvements * Testing and proactive security + * Compatibility changes + - Added ChaCha20 and chacha20 aliases for ChaCha. * Bug fixes - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp() + - Fixed numerous misuses of X509_ALGOR_set0() resulting in leaks and + potentially incorrect encodings. 3.8.2 - Stable release From 287e0a285eb38bfd37f4e537d17847868aeff521 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 3 Nov 2023 08:32:08 -0600 Subject: [PATCH 0482/1283] ChangeLog: missing period --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 7e986f09a1..2acb8ca055 100644 --- a/ChangeLog +++ b/ChangeLog @@ -37,7 +37,7 @@ LibreSSL Portable Release Notes: * Compatibility changes - Added ChaCha20 and chacha20 aliases for ChaCha. * Bug fixes - - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp() + - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp(). - Fixed numerous misuses of X509_ALGOR_set0() resulting in leaks and potentially incorrect encodings. From b19acf362996ea4404c3df03a243571c13fd47a3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 3 Nov 2023 08:32:59 -0600 Subject: [PATCH 0483/1283] Update rust-openssl patch --- .github/rust-openssl.patch | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.github/rust-openssl.patch b/.github/rust-openssl.patch index e9586dd708..4a8dd3fd94 100644 --- a/.github/rust-openssl.patch +++ b/.github/rust-openssl.patch @@ -1,13 +1,12 @@ diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs -index 82013b6c..2974abed 100644 +index bbee7c5c..57033b2d 100644 --- a/openssl-sys/build/main.rs +++ b/openssl-sys/build/main.rs -@@ -273,7 +273,7 @@ See rust-openssl documentation for more information: - (3, 7, 1) => ('3', '7', '1'), - (3, 7, _) => ('3', '7', 'x'), +@@ -293,6 +293,7 @@ See rust-openssl documentation for more information: (3, 8, 0) => ('3', '8', '0'), -- (3, 8, 1) => ('3', '8', '1'), -+ (3, 8, _) => ('3', '8', 'x'), + (3, 8, 1) => ('3', '8', '1'), + (3, 8, _) => ('3', '8', 'x'), ++ (3, 9, _) => ('3', '8', 'x'), _ => version_error(), }; From e1217db87d2ff37ab6a41048d16327212f670bb4 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Fri, 3 Nov 2023 17:56:32 +0000 Subject: [PATCH 0484/1283] delete unused `savsig` variable Follow-up to dd1d96f643b01a5edbe7e0db8399f3c88f5f0c8b Fixes #925 --- crypto/compat/ui_openssl_win.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/crypto/compat/ui_openssl_win.c b/crypto/compat/ui_openssl_win.c index b6a621f565..a8c92f28f7 100644 --- a/crypto/compat/ui_openssl_win.c +++ b/crypto/compat/ui_openssl_win.c @@ -130,9 +130,6 @@ #define NX509_SIG 32 #endif -/* Define globals. They are protected by a lock */ -static void (*savsig[NX509_SIG])(int ); - DWORD console_mode; static FILE *tty_in, *tty_out; static int is_a_tty; From e6ae33d57216cfe0e88fdbdfb4f0bbf41fa76878 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Sat, 4 Nov 2023 00:29:23 +0000 Subject: [PATCH 0485/1283] cmake: fix default `TLS_DEFAULT_CA_FILE` value in libtls for Windows Matching the logic used for `libcrypto` (and in autotools builds for both `libcrypto` and `libtls`), set the default `TLS_DEFAULT_CA_FILE` value to `C:/Windows/libressl/ssl/...`, replacing the current, potentialy world-writable filename. --- tls/CMakeLists.txt | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 4beef36ea9..6a19a4b53c 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -29,7 +29,11 @@ endif() if(NOT "${OPENSSLDIR}" STREQUAL "") add_definitions(-DTLS_DEFAULT_CA_FILE=\"${OPENSSLDIR}/cert.pem\") else() - add_definitions(-DTLS_DEFAULT_CA_FILE=\"${CMAKE_INSTALL_PREFIX}/etc/ssl/cert.pem\") + if(WIN32) + add_definitions(-DTLS_DEFAULT_CA_FILE=\"C:/Windows/libressl/ssl/cert.pem\") + else() + add_definitions(-DTLS_DEFAULT_CA_FILE=\"${CMAKE_INSTALL_PREFIX}/etc/ssl/cert.pem\") + endif() endif() file(COPY ${CMAKE_CURRENT_SOURCE_DIR}/tls.sym DESTINATION From d193f43f8b90cbed65ffeec93543d8a3d17bdedc Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Sat, 4 Nov 2023 01:24:23 +0000 Subject: [PATCH 0486/1283] slim down `libtls` By dropping copies of `libcrypto` and `libssl` lib objects from it. This brings back its size to the normal ~100KB from ~4MB. autotools already worked like this. --- tls/CMakeLists.txt | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 4beef36ea9..240dbf833b 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -50,11 +50,10 @@ target_include_directories(tls_obj ../include ${CMAKE_BINARY_DIR}/include) -add_library(tls $ $ - $ empty.c) +add_library(tls $ empty.c) export_symbol(tls ${CMAKE_CURRENT_BINARY_DIR}/tls.sym) -target_link_libraries(tls ${PLATFORM_LIBS}) +target_link_libraries(tls ${OPENSSL_LIBS}) if (WIN32) set(TLS_POSTFIX -${TLS_MAJOR_VERSION} PARENT_SCOPE) endif() From 2c5abde778053272fdc0c5692691309e8f1e79b1 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Sat, 4 Nov 2023 02:37:34 +0000 Subject: [PATCH 0487/1283] slim `tls-static` library (used in tests) Instead of including a full copy of libcrypto and libssl in libtls-static, link existing libcrytpo-static and libssl-static to the test targets. This wasn't causing any issue, just unnecessarily duplicating a lot of objects. --- CMakeLists.txt | 2 +- tls/CMakeLists.txt | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 2f0dfa0e70..094d649330 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -408,7 +408,7 @@ set(LIBTLS_LIBS tls ${PLATFORM_LIBS}) # libraries for regression test if(BUILD_SHARED_LIBS) set(OPENSSL_TEST_LIBS ssl-static crypto-static ${PLATFORM_LIBS}) - set(LIBTLS_TEST_LIBS tls-static ${PLATFORM_LIBS}) + set(LIBTLS_TEST_LIBS tls-static ${OPENSSL_TEST_LIBS}) else() set(OPENSSL_TEST_LIBS ssl crypto ${PLATFORM_LIBS}) set(LIBTLS_TEST_LIBS tls ${PLATFORM_LIBS}) diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 4beef36ea9..442a57a95d 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -101,8 +101,7 @@ endif(ENABLE_LIBRESSL_INSTALL) # build static library for regression test if(BUILD_SHARED_LIBS) - add_library(tls-static STATIC $ - $ $) - target_link_libraries(tls-static ${PLATFORM_LIBS}) + add_library(tls-static STATIC $) + target_link_libraries(tls-static ${OPENSSL_TEST_LIBS}) endif() From 89fcb1a3e50ac224d68891a6014b74639a5f551a Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Sun, 5 Nov 2023 08:56:09 +0000 Subject: [PATCH 0488/1283] also fix ocspcheck and nc, dedupe build logic --- CMakeLists.txt | 18 ++++++++++++------ apps/nc/CMakeLists.txt | 6 +----- apps/ocspcheck/CMakeLists.txt | 6 +----- crypto/CMakeLists.txt | 10 +--------- tls/CMakeLists.txt | 10 +--------- 5 files changed, 16 insertions(+), 34 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 2f0dfa0e70..ca7f565d34 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -414,6 +414,18 @@ else() set(LIBTLS_TEST_LIBS tls ${PLATFORM_LIBS}) endif() +if(OPENSSLDIR STREQUAL "") + if(WIN32) + set(OPENSSLDIR "C:/Windows/libressl/ssl") + else() + set(OPENSSLDIR "${CMAKE_INSTALL_PREFIX}/etc/ssl") + endif() + + set(CONF_DIR "${CMAKE_INSTALL_PREFIX}/etc/ssl") +else() + set(CONF_DIR "${OPENSSLDIR}") +endif() + add_subdirectory(include) add_subdirectory(crypto) add_subdirectory(ssl) @@ -495,12 +507,6 @@ if(ENABLE_LIBRESSL_INSTALL) endif() endif(ENABLE_LIBRESSL_INSTALL) -if(NOT "${OPENSSLDIR}" STREQUAL "") - set(CONF_DIR "${OPENSSLDIR}") -else() - set(CONF_DIR "${CMAKE_INSTALL_PREFIX}/etc/ssl") -endif() - if(ENABLE_LIBRESSL_INSTALL) install(FILES cert.pem openssl.cnf x509v3.cnf DESTINATION ${CONF_DIR}) install(DIRECTORY DESTINATION ${CONF_DIR}/certs) diff --git a/apps/nc/CMakeLists.txt b/apps/nc/CMakeLists.txt index ffd68e55db..868b797361 100644 --- a/apps/nc/CMakeLists.txt +++ b/apps/nc/CMakeLists.txt @@ -29,11 +29,7 @@ else() set(NC_SRC ${NC_SRC} compat/readpassphrase.c) endif() -if(NOT "${OPENSSLDIR}" STREQUAL "") - add_definitions(-DDEFAULT_CA_FILE=\"${OPENSSLDIR}/cert.pem\") -else() - add_definitions(-DDEFAULT_CA_FILE=\"${CMAKE_INSTALL_PREFIX}/etc/ssl/cert.pem\") -endif() +add_definitions(-DDEFAULT_CA_FILE=\"${OPENSSLDIR}/cert.pem\") add_executable(nc ${NC_SRC}) target_include_directories(nc diff --git a/apps/ocspcheck/CMakeLists.txt b/apps/ocspcheck/CMakeLists.txt index 9cf7a8b318..41c7845ec7 100644 --- a/apps/ocspcheck/CMakeLists.txt +++ b/apps/ocspcheck/CMakeLists.txt @@ -11,11 +11,7 @@ else() set(OCSPCHECK_SRC ${OCSPCHECK_SRC} compat/memmem.c) endif() -if(NOT "${OPENSSLDIR}" STREQUAL "") - add_definitions(-DDEFAULT_CA_FILE=\"${OPENSSLDIR}/cert.pem\") -else() - add_definitions(-DDEFAULT_CA_FILE=\"${CMAKE_INSTALL_PREFIX}/etc/ssl/cert.pem\") -endif() +add_definitions(-DDEFAULT_CA_FILE=\"${OPENSSLDIR}/cert.pem\") add_executable(ocspcheck ${OCSPCHECK_SRC}) target_include_directories(ocspcheck diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 7efb143ed8..6056471510 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -912,15 +912,7 @@ else() endif() endif() -if(NOT "${OPENSSLDIR}" STREQUAL "") - add_definitions(-DOPENSSLDIR=\"${OPENSSLDIR}\") -else() - if(WIN32) - add_definitions(-DOPENSSLDIR=\"C:/Windows/libressl/ssl\") - else() - add_definitions(-DOPENSSLDIR=\"${CMAKE_INSTALL_PREFIX}/etc/ssl\") - endif() -endif() +add_definitions(-DOPENSSLDIR=\"${OPENSSLDIR}\") file(READ ${CMAKE_CURRENT_SOURCE_DIR}/crypto.sym SYMS) foreach(SYM IN LISTS CRYPTO_UNEXPORT) diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 6a19a4b53c..031a9beb23 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -26,15 +26,7 @@ if(WIN32) set(LIBTLS_EXTRA_EXPORT ${LIBTLS_EXTRA_EXPORT} ftruncate) endif() -if(NOT "${OPENSSLDIR}" STREQUAL "") - add_definitions(-DTLS_DEFAULT_CA_FILE=\"${OPENSSLDIR}/cert.pem\") -else() - if(WIN32) - add_definitions(-DTLS_DEFAULT_CA_FILE=\"C:/Windows/libressl/ssl/cert.pem\") - else() - add_definitions(-DTLS_DEFAULT_CA_FILE=\"${CMAKE_INSTALL_PREFIX}/etc/ssl/cert.pem\") - endif() -endif() +add_definitions(-DTLS_DEFAULT_CA_FILE=\"${OPENSSLDIR}/cert.pem\") file(COPY ${CMAKE_CURRENT_SOURCE_DIR}/tls.sym DESTINATION ${CMAKE_CURRENT_BINARY_DIR}) From 7a3d827729751b4321d83bb0b55eba26162b0d31 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Tue, 7 Nov 2023 01:02:16 +1100 Subject: [PATCH 0489/1283] Improve Android CI workflow --- .github/workflows/android.yml | 31 ++++++++++++++++++++++++++++++ .github/workflows/android_test.yml | 30 ----------------------------- 2 files changed, 31 insertions(+), 30 deletions(-) create mode 100644 .github/workflows/android.yml delete mode 100644 .github/workflows/android_test.yml diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml new file mode 100644 index 0000000000..205a400753 --- /dev/null +++ b/.github/workflows/android.yml @@ -0,0 +1,31 @@ +# GitHub Actions workflow to run tests on Android. +name: "Android" + +on: [push, pull_request] + +jobs: + test: + name: "Test ${{ matrix.name }}" + runs-on: ubuntu-latest + permissions: + contents: read + strategy: + fail-fast: false + matrix: + include: + - name: "Android 8-9" + min-nal: 26 + max-nal: 28 + - name: "Android 10-11" + min-nal: 29 + max-nal: 30 + steps: + - name: "Checkout repository" + uses: actions/checkout@v4 + + - name: "Run CI script" + run: ./scripts/test + env: + ARCH: "android" + MIN_NAL: "${{ matrix.min-nal }}" + MAX_NAL: "${{ matrix.max-nal }}" diff --git a/.github/workflows/android_test.yml b/.github/workflows/android_test.yml deleted file mode 100644 index ebce7948d2..0000000000 --- a/.github/workflows/android_test.yml +++ /dev/null @@ -1,30 +0,0 @@ -name: android_ci - -on: [push, pull_request] - -jobs: - build-android-8-9: - runs-on: ubuntu-22.04 - continue-on-error: false - env: - ARCH: android - MIN_NAL: 26 - MAX_NAL: 28 - name: Android 8.x 9 - steps: - - uses: actions/checkout@main - - name: Run CI script - run: ./scripts/test - - build-android-10-11: - runs-on: ubuntu-22.04 - continue-on-error: false - env: - ARCH: android - MIN_NAL: 29 - MAX_NAL: 30 - name: Android 10 11 - steps: - - uses: actions/checkout@main - - name: Run CI script - run: ./scripts/test From 690b98fe39a05eb193a57ca45dbd72a2142a9fb4 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Tue, 7 Nov 2023 11:56:33 +0000 Subject: [PATCH 0490/1283] cmake: fix arm64 to not trigger armv4 ASM Reported here: https://github.com/libressl/portable/pull/935#issuecomment-1798345787 --- CMakeLists.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index ec47fe8250..950a79ee17 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -364,7 +364,8 @@ if(ENABLE_ASM) if("${CMAKE_C_COMPILER_ABI}" STREQUAL "ELF") if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64)") set(HOST_ASM_ELF_X86_64 true) - elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm") + elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm" AND + NOT "${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm64") set(HOST_ASM_ELF_ARMV4 true) elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "i386") set(HOST_ASM_ELF_X86_64 true) From 557b5a191a3d413d3e3121fb7f1b6c92e9052771 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Tue, 7 Nov 2023 14:39:16 +0000 Subject: [PATCH 0491/1283] cmake: stop passing unused C macros - `-DCPPFLAGS`: probably a copy-paste typo from the initial CMake commit. - `-DNO_CRYPT`: `NO_CRYPT` is no longer used in the source and this macro is no longer set by autotools. --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 950a79ee17..541cc11a9f 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -129,7 +129,7 @@ if(WIN32) add_definitions(-D_CRT_SECURE_NO_WARNINGS) add_definitions(-D_CRT_DEPRECATED_NO_WARNINGS) add_definitions(-D_REENTRANT -D_POSIX_THREAD_SAFE_FUNCTIONS) - add_definitions(-DCPPFLAGS -DNO_SYSLOG -DNO_CRYPT) + add_definitions(-DNO_SYSLOG) add_definitions(-DWIN32_LEAN_AND_MEAN) if(NOT CMAKE_SYSTEM_NAME MATCHES "WindowsStore") add_definitions(-D_WIN32_WINNT=0x0600) From 27486b12e1793432dbc324fc8836c2c921d03fce Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Tue, 7 Nov 2023 16:55:52 +0000 Subject: [PATCH 0492/1283] simplify `MATCHES`/`STREQUAL` syntax --- CMakeLists.txt | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 950a79ee17..6695313c18 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -333,50 +333,50 @@ if(APPLE AND (NOT CMAKE_OSX_ARCHITECTURES STREQUAL "")) set(CMAKE_SYSTEM_PROCESSOR "${CMAKE_OSX_ARCHITECTURES}") endif() -if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(aarch64|arm64|ARM64)") +if(CMAKE_SYSTEM_PROCESSOR MATCHES "(aarch64|arm64|ARM64)") set(HOST_AARCH64 true) -elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm") +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm") set(HOST_ARM true) -elseif("${CMAKE_SYSTEM_NAME}" STREQUAL "SunOS" AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "i386") +elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND CMAKE_SYSTEM_PROCESSOR STREQUAL "i386") set(HOST_X86_64 true) -elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64|AMD64)") +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|amd64|AMD64)") set(HOST_X86_64 true) -elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(i[3-6]86|[xX]86)") +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(i[3-6]86|[xX]86)") set(ENABLE_ASM false) set(HOST_I386 true) -elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "mips64") +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "mips64") set(HOST_MIPS64 true) -elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "mips") +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "mips") set(HOST_MIPS true) -elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "powerpc") +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "powerpc") set(HOST_POWERPC true) -elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "ppc64") +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "ppc64") set(HOST_PPC64 true) -elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "riscv64") +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "riscv64") set(HOST_RISCV64 true) -elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "sparc64") +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "sparc64") set(HOST_SPARC64 true) else() set(ENABLE_ASM false) endif() if(ENABLE_ASM) - if("${CMAKE_C_COMPILER_ABI}" STREQUAL "ELF") - if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(x86_64|amd64)") + if(CMAKE_C_COMPILER_ABI STREQUAL "ELF") + if(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|amd64)") set(HOST_ASM_ELF_X86_64 true) - elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm" AND - NOT "${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm64") + elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm" AND + NOT CMAKE_SYSTEM_PROCESSOR MATCHES "arm64") set(HOST_ASM_ELF_ARMV4 true) - elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "i386") + elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND CMAKE_SYSTEM_PROCESSOR STREQUAL "i386") set(HOST_ASM_ELF_X86_64 true) endif() add_definitions(-DHAVE_GNU_STACK) - elseif(APPLE AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "x86_64") + elseif(APPLE AND CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64") set(HOST_ASM_MACOSX_X86_64 true) - elseif(MSVC AND ("${CMAKE_GENERATOR}" MATCHES "Win64" OR "${CMAKE_GENERATOR_PLATFORM}" STREQUAL "x64")) + elseif(MSVC AND (CMAKE_GENERATOR MATCHES "Win64" OR CMAKE_GENERATOR_PLATFORM STREQUAL "x64")) set(HOST_ASM_MASM_X86_64 true) ENABLE_LANGUAGE(ASM_MASM) - elseif(MINGW AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "x86_64") + elseif(MINGW AND CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64") set(HOST_ASM_MINGW64_X86_64 true) endif() endif() From abf3be5c56f68ecf4fe1e268d8a5515d8c8734ec Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Tue, 7 Nov 2023 17:00:56 +0000 Subject: [PATCH 0493/1283] always check `CMAKE_SYSTEM_PROCESSOR` with `MATCHES` This makes it accept values consistently. Before this patch mingw-w64, Apple and SunOS did not accept a CPU if it had a suffix or prefix (e.g. a triplet), while other targets did. --- CMakeLists.txt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 6695313c18..e8f93272df 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -337,7 +337,7 @@ if(CMAKE_SYSTEM_PROCESSOR MATCHES "(aarch64|arm64|ARM64)") set(HOST_AARCH64 true) elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm") set(HOST_ARM true) -elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND CMAKE_SYSTEM_PROCESSOR STREQUAL "i386") +elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND CMAKE_SYSTEM_PROCESSOR MATCHES "i386") set(HOST_X86_64 true) elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|amd64|AMD64)") set(HOST_X86_64 true) @@ -367,16 +367,16 @@ if(ENABLE_ASM) elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm" AND NOT CMAKE_SYSTEM_PROCESSOR MATCHES "arm64") set(HOST_ASM_ELF_ARMV4 true) - elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND CMAKE_SYSTEM_PROCESSOR STREQUAL "i386") + elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND CMAKE_SYSTEM_PROCESSOR MATCHES "i386") set(HOST_ASM_ELF_X86_64 true) endif() add_definitions(-DHAVE_GNU_STACK) - elseif(APPLE AND CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64") + elseif(APPLE AND CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64") set(HOST_ASM_MACOSX_X86_64 true) elseif(MSVC AND (CMAKE_GENERATOR MATCHES "Win64" OR CMAKE_GENERATOR_PLATFORM STREQUAL "x64")) set(HOST_ASM_MASM_X86_64 true) ENABLE_LANGUAGE(ASM_MASM) - elseif(MINGW AND CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64") + elseif(MINGW AND CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64") set(HOST_ASM_MINGW64_X86_64 true) endif() endif() From c48130741e39127072dd89a16a423b39e1c46e38 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 7 Nov 2023 14:08:10 -0700 Subject: [PATCH 0494/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 2acb8ca055..994063fee8 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,6 +34,7 @@ LibreSSL Portable Release Notes: * Internal improvements * Documentation improvements * Testing and proactive security + - Bug fixes and simplifications in the Wycheproof tests. * Compatibility changes - Added ChaCha20 and chacha20 aliases for ChaCha. * Bug fixes From 43cb91c947421c2dba6bc2f2104aa0b5aec80006 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Wed, 8 Nov 2023 02:09:32 +0000 Subject: [PATCH 0495/1283] amd64/bn_arch.h: avoid redefinition of `OPENSSL_NO_ASM` Fixes this warning when `OPENSSL_NO_ASM` is already set by the build system (seen with CMake): ``` In file included from ./libressl/crypto/bn/bn_mul.c:65: ./libressl/crypto/bn/arch/amd64/bn_arch.h:24:9: warning: 'OPENSSL_NO_ASM' macro redefined [-Wmacro-redefined] ^ :10:9: note: previous definition is here ^ ``` Reported in #910 --- patches/win32_amd64_bn_arch.h.patch | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/patches/win32_amd64_bn_arch.h.patch b/patches/win32_amd64_bn_arch.h.patch index 20205dcc22..ad7c89dfa1 100644 --- a/patches/win32_amd64_bn_arch.h.patch +++ b/patches/win32_amd64_bn_arch.h.patch @@ -1,17 +1,19 @@ --- crypto/bn/arch/amd64/bn_arch.h.orig 2023-02-27 04:43:12.257874699 -0600 +++ crypto/bn/arch/amd64/bn_arch.h 2023-02-27 04:44:05.541873870 -0600 -@@ -20,6 +20,10 @@ +@@ -20,6 +20,12 @@ #ifndef HEADER_BN_ARCH_H #define HEADER_BN_ARCH_H +#ifdef _WIN32 ++#ifndef OPENSSL_NO_ASM +#define OPENSSL_NO_ASM ++#endif +#else + #ifndef OPENSSL_NO_ASM #define HAVE_BN_ADD -@@ -85,6 +89,7 @@ +@@ -85,6 +91,7 @@ *out_r0 = r0; } #endif /* __GNUC__ */ From 59c22267b9edeaa7200033bc3c5368404127947e Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Wed, 8 Nov 2023 18:55:38 +1100 Subject: [PATCH 0496/1283] ci: clean up macOS workflow --- .github/workflows/macos.yml | 31 +++++++++++++++++++++++++++++++ .github/workflows/macos_test.yml | 21 --------------------- 2 files changed, 31 insertions(+), 21 deletions(-) create mode 100644 .github/workflows/macos.yml delete mode 100644 .github/workflows/macos_test.yml diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml new file mode 100644 index 0000000000..e813191d9e --- /dev/null +++ b/.github/workflows/macos.yml @@ -0,0 +1,31 @@ +# GitHub Actions workflow to run tests on macOS. +name: "macOS" + +on: + push: {} + pull_request: {} + schedule: + - cron: "0 0 * * 0" # At 00:00 weekly on Sunday. + +jobs: + test: + name: "${{ matrix.os }}/${{ matrix.arch }}" + runs-on: "${{ matrix.os }}" + permissions: + contents: read + strategy: + fail-fast: false + matrix: + os: ["macos-13", "macos-12"] + arch: ["arm64", "x86_64"] + steps: + - name: "Install required packages" + run: brew install automake + + - name: "Checkout repository" + uses: actions/checkout@v4 + + - name: "Run tests" + run: ./scripts/test + env: + ARCH: "${{ matrix.arch }}" diff --git a/.github/workflows/macos_test.yml b/.github/workflows/macos_test.yml deleted file mode 100644 index 9f88d77dcd..0000000000 --- a/.github/workflows/macos_test.yml +++ /dev/null @@ -1,21 +0,0 @@ -name: macos_ci - -on: [push, pull_request] - -jobs: - build-native: - strategy: - matrix: - os: [macos-13, macos-12] - arch: [arm64, x86_64] - runs-on: ${{ matrix.os }} - continue-on-error: false - env: - ARCH: ${{ matrix.arch }} - name: ${{ matrix.os }} - ${{ matrix.arch }} - steps: - - name: Install packages for macos - run: brew install automake - - uses: actions/checkout@main - - name: Run CI script - run: ./scripts/test From ba296ec66011f1cc0fe86c4101fb264e2cb9f3da Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Wed, 8 Nov 2023 18:07:34 +1100 Subject: [PATCH 0497/1283] ci: shrink and improve Linux workflows Add a new `linux` workflow that replaces cross_test, linux_ci, linux_ci_asan, and linux_ci_asan_noasm. --- .github/workflows/cross_test.yml | 20 ------- .github/workflows/linux.yml | 62 +++++++++++++++++++++ .github/workflows/linux_test.yml | 20 ------- .github/workflows/linux_test_asan.yml | 23 -------- .github/workflows/linux_test_asan_noasm.yml | 24 -------- 5 files changed, 62 insertions(+), 87 deletions(-) delete mode 100644 .github/workflows/cross_test.yml create mode 100644 .github/workflows/linux.yml delete mode 100644 .github/workflows/linux_test.yml delete mode 100644 .github/workflows/linux_test_asan.yml delete mode 100644 .github/workflows/linux_test_asan_noasm.yml diff --git a/.github/workflows/cross_test.yml b/.github/workflows/cross_test.yml deleted file mode 100644 index fc742e7d81..0000000000 --- a/.github/workflows/cross_test.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: cross_ci - -on: [push, pull_request] - -jobs: - build-other: - strategy: - matrix: - os: [ubuntu-20.04, ubuntu-22.04] - arch: [mingw32, mingw64, arm32, arm64, mips32, mips64] - runs-on: ${{ matrix.os }} - continue-on-error: false - env: - CC: gcc - ARCH: ${{ matrix.arch }} - name: ${{ matrix.arch }} - ${{ matrix.os }} - steps: - - uses: actions/checkout@main - - name: Run CI script - run: ./scripts/test diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml new file mode 100644 index 0000000000..f9ec4da7af --- /dev/null +++ b/.github/workflows/linux.yml @@ -0,0 +1,62 @@ +# GitHub Actions workflow to run tests on Linux. +name: "Linux" + +on: + push: {} + pull_request: {} + schedule: + - cron: "0 0 * * *" # At 00:00 daily. + +jobs: + # Test against all supported architectures. + test: + name: "${{ matrix.os }}/${{ matrix.arch }} (${{ matrix.compiler }})" + runs-on: "${{ matrix.os }}" + permissions: + contents: read + strategy: + fail-fast: false + matrix: + os: ["ubuntu-20.04", "ubuntu-22.04"] + arch: ["native", "arm32", "arm64", "mingw32", "mingw64", "mips32", "mips64"] + compiler: ["gcc"] + include: + - os: "ubuntu-20.04" + arch: "native" + compiler: "clang" + - os: "ubuntu-22.04" + arch: "native" + compiler: "clang" + steps: + - name: "Checkout repository" + uses: actions/checkout@v4 + + - name: "Run tests" + run: ./scripts/test + env: + ARCH: "${{ matrix.arch }}" + CC: "${{ matrix.compiler }}" + + # Test ASAN with and without ASM enabled. + test-asan: + name: "ASAN (${{ matrix.asm == 'ON' && 'asm' || 'no-asm' }})" + runs-on: "ubuntu-latest" + permissions: + contents: read + strategy: + fail-fast: false + matrix: + asm: [ON, OFF] + steps: + - name: "Checkout repository" + uses: actions/checkout@v4 + + - name: "Run tests" + run: ./scripts/test + env: + ARCH: "native" + CC: "clang" + CFLAGS: "-ggdb -fsanitize=address" + LDFLAGS: "-fsanitize=address" + ENABLE_ASM: "${{ matrix.asm }}" + CTEST_OUTPUT_ON_FAILURE: 1 diff --git a/.github/workflows/linux_test.yml b/.github/workflows/linux_test.yml deleted file mode 100644 index 94bef31544..0000000000 --- a/.github/workflows/linux_test.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: linux_ci - -on: [push, pull_request] - -jobs: - build-native: - strategy: - matrix: - os: [ubuntu-20.04, ubuntu-22.04] - compiler: [clang, gcc] - runs-on: ${{ matrix.os }} - continue-on-error: false - env: - CC: ${{ matrix.compiler }} - ARCH: native - name: ${{ matrix.compiler }} - ${{ matrix.os }} - steps: - - uses: actions/checkout@main - - name: Run CI script - run: ./scripts/test diff --git a/.github/workflows/linux_test_asan.yml b/.github/workflows/linux_test_asan.yml deleted file mode 100644 index 12e0889081..0000000000 --- a/.github/workflows/linux_test_asan.yml +++ /dev/null @@ -1,23 +0,0 @@ -name: linux_ci_asan - -on: [push, pull_request] - -jobs: - build-native: - strategy: - matrix: - os: [ubuntu-latest] - compiler: [clang] - runs-on: ${{ matrix.os }} - continue-on-error: false - env: - CC: ${{ matrix.compiler }} - ARCH: native - CFLAGS: "-ggdb -fsanitize=address" - LDFLAGS: "-fsanitize=address" - CTEST_OUTPUT_ON_FAILURE: 1 - name: ${{ matrix.compiler }} - ${{ matrix.os }} - steps: - - uses: actions/checkout@main - - name: Run CI script - run: ./scripts/test diff --git a/.github/workflows/linux_test_asan_noasm.yml b/.github/workflows/linux_test_asan_noasm.yml deleted file mode 100644 index 92ab2fccaf..0000000000 --- a/.github/workflows/linux_test_asan_noasm.yml +++ /dev/null @@ -1,24 +0,0 @@ -name: linux_ci_asan_noasm - -on: [push, pull_request] - -jobs: - build-native: - name: "${{ matrix.compiler }} - ${{ matrix.os }}" - runs-on: "${{ matrix.os }}" - strategy: - matrix: - os: ["ubuntu-latest"] - compiler: ["clang"] - env: - CC: "${{ matrix.compiler }}" - ARCH: native - CFLAGS: "-ggdb -fsanitize=address" - LDFLAGS: "-fsanitize=address" - CTEST_OUTPUT_ON_FAILURE: 1 - ENABLE_ASM: OFF - steps: - - name: "Checkout repository" - uses: actions/checkout@main - - name: "Run tests" - run: ./scripts/test From 0ff62e0a97d73c250849b86ccda1c2dafe10c7f4 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Thu, 9 Nov 2023 02:28:33 +1100 Subject: [PATCH 0498/1283] readme: fix CI workflow badge images Update the workflow badge images to use the new workflow names introduced in: #942, #941, #934 --- README.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 7906fcf17f..051c749af3 100644 --- a/README.md +++ b/README.md @@ -1,13 +1,11 @@ ![LibreSSL image](https://www.libressl.org/images/libressl.jpg) ## Official portable version of [LibreSSL](https://www.libressl.org) ## -[![Linux Build Status](https://github.com/libressl/portable/actions/workflows/linux_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/linux_test.yml) -[![macOS Build Status](https://github.com/libressl/portable/actions/workflows/macos_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/macos_test.yml) -[![Android Build Status](https://github.com/libressl/portable/actions/workflows/android_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/android_test.yml) -[![Cross Build Status](https://github.com/libressl/portable/actions/workflows/cross_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/cross_test.yml) +[![Linux Build Status](https://github.com/libressl/portable/actions/workflows/linux.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/linux.yml) +[![macOS Build Status](https://github.com/libressl/portable/actions/workflows/macos.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/macos.yml) +[![Android Build Status](https://github.com/libressl/portable/actions/workflows/android.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/android.yml) [![Solaris Build Status](https://github.com/libressl/portable/actions/workflows/solaris_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/solaris_test.yml) [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/libressl.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:libressl) -[![ASan Status](https://github.com/libressl/portable/actions/workflows/linux_test_asan.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/linux_test_asan.yml) LibreSSL is a fork of [OpenSSL](https://www.openssl.org) 1.0.1g developed by the [OpenBSD](https://www.openbsd.org) project. Our goal is to modernize the codebase, From d1ddc0fcb1bc5af4900244fecb247c5a6a8cbb3a Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Thu, 9 Nov 2023 13:16:51 +1100 Subject: [PATCH 0499/1283] ci: improve rust-openssl workflow --- .github/workflows/rust-openssl.yml | 40 ++++++++++++++++++++++++++++++ .github/workflows/rust_regress.yml | 33 ------------------------ 2 files changed, 40 insertions(+), 33 deletions(-) create mode 100644 .github/workflows/rust-openssl.yml delete mode 100644 .github/workflows/rust_regress.yml diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml new file mode 100644 index 0000000000..93256ec30f --- /dev/null +++ b/.github/workflows/rust-openssl.yml @@ -0,0 +1,40 @@ +# GitHub Actions workflow to run rust-openssl regress tests. +name: "rust-openssl" + +on: + workflow_dispatch: + schedule: + - cron: "0 0 * * *" # At 00:00 daily. + +jobs: + test: + name: "Test" + runs-on: "ubuntu-latest" + permissions: + contents: read + steps: + - name: "Checkout repository" + uses: actions/checkout@v4 + + - name: "Build LibreSSL" + run: | + ./autogen.sh + ./configure + make dist + tar zxvf libressl-*.tar.gz + rm libressl-*.tar.gz + cd libressl-* + ./configure --prefix="${HOME}/opt" + make all install + + - name: "Clone rust-openssl" + run: | + git clone https://github.com/sfackler/rust-openssl.git + + - name: "Run rust-openssl tests" + run: | + cd rust-openssl + OPENSSL_DIR=${HOME}/opt + LD_LIBRARY_PATH=${HOME}/opt/lib + patch -p1 < ../.github/rust-openssl.patch + cargo test diff --git a/.github/workflows/rust_regress.yml b/.github/workflows/rust_regress.yml deleted file mode 100644 index ef2d80e139..0000000000 --- a/.github/workflows/rust_regress.yml +++ /dev/null @@ -1,33 +0,0 @@ -name: rust regress tests - -on: - schedule: - - cron: "0 0 * * *" - -jobs: - rust-openssl: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@main - - name: Install apt dependencies - run: | - sudo apt-get update - sudo apt-get install -y cargo - - name: Build LibreSSL - run: | - ./autogen.sh - ./configure - make dist - tar zxvf libressl-*.tar.gz - rm libressl-*.tar.gz - cd libressl-* - ./configure --prefix="${HOME}/opt" - make all install - - name: run rust-openssl tests - run: | - git clone https://github.com/sfackler/rust-openssl.git - cd rust-openssl - export OPENSSL_DIR=${HOME}/opt - export LD_LIBRARY_PATH=${HOME}/opt/lib - patch -p1 < ../.github/rust-openssl.patch - cargo test From 3ee9b72671120dad1cbe0c38f9c593d8041fa6fd Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Thu, 9 Nov 2023 20:16:31 +1100 Subject: [PATCH 0500/1283] ci: tidy up rust-openssl libressl build step --- .github/workflows/rust-openssl.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index 93256ec30f..e5e6e02a32 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -19,11 +19,6 @@ jobs: - name: "Build LibreSSL" run: | ./autogen.sh - ./configure - make dist - tar zxvf libressl-*.tar.gz - rm libressl-*.tar.gz - cd libressl-* ./configure --prefix="${HOME}/opt" make all install From d0d17f89eff5ddc331b9ef8cb517335efde56e9f Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 9 Nov 2023 20:59:03 -0600 Subject: [PATCH 0501/1283] remove additional endbr64 patch, add tests for macos-11 --- .github/workflows/macos.yml | 2 +- patches/asm/0005-Revert-aesni-endbr64.patch | 20 ++++++++++++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 patches/asm/0005-Revert-aesni-endbr64.patch diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index e813191d9e..f8636ff4d1 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -16,7 +16,7 @@ jobs: strategy: fail-fast: false matrix: - os: ["macos-13", "macos-12"] + os: ["macos-13", "macos-12", "macos-11"] arch: ["arm64", "x86_64"] steps: - name: "Install required packages" diff --git a/patches/asm/0005-Revert-aesni-endbr64.patch b/patches/asm/0005-Revert-aesni-endbr64.patch new file mode 100644 index 0000000000..f2094e6821 --- /dev/null +++ b/patches/asm/0005-Revert-aesni-endbr64.patch @@ -0,0 +1,20 @@ +commit ac992937b461479b41f7f65e79646ef0a715f95d +Author: Brent Cook +Date: Thu Nov 9 12:29:33 2023 -0600 + + Revert "aesni_ctr32_encrypt_blocks() is called indirectly from C code, so it" + + This reverts commit 52f96c842e82486510ffc2513e71323b70242f28. + +diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl +index 07d40a84a..c261a3795 100644 +--- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl +@@ -1025,7 +1025,6 @@ $code.=<<___; + .type aesni_ctr32_encrypt_blocks,\@function,5 + .align 16 + aesni_ctr32_encrypt_blocks: +- endbr64 + lea (%rsp),%rax + push %rbp + sub \$$frame_size,%rsp From 96e5e35d5eafa368d6ebfce4b48f66a5a3620e61 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 10 Nov 2023 03:20:04 -0600 Subject: [PATCH 0502/1283] experiment forcing CI failure --- patches/asm/0005-Revert-aesni-endbr64.patch | 20 -------------------- 1 file changed, 20 deletions(-) delete mode 100644 patches/asm/0005-Revert-aesni-endbr64.patch diff --git a/patches/asm/0005-Revert-aesni-endbr64.patch b/patches/asm/0005-Revert-aesni-endbr64.patch deleted file mode 100644 index f2094e6821..0000000000 --- a/patches/asm/0005-Revert-aesni-endbr64.patch +++ /dev/null @@ -1,20 +0,0 @@ -commit ac992937b461479b41f7f65e79646ef0a715f95d -Author: Brent Cook -Date: Thu Nov 9 12:29:33 2023 -0600 - - Revert "aesni_ctr32_encrypt_blocks() is called indirectly from C code, so it" - - This reverts commit 52f96c842e82486510ffc2513e71323b70242f28. - -diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -index 07d40a84a..c261a3795 100644 ---- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -@@ -1025,7 +1025,6 @@ $code.=<<___; - .type aesni_ctr32_encrypt_blocks,\@function,5 - .align 16 - aesni_ctr32_encrypt_blocks: -- endbr64 - lea (%rsp),%rax - push %rbp - sub \$$frame_size,%rsp From 194a4a5fd45fab5967878296d575644789bcafb9 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Fri, 10 Nov 2023 23:10:40 +1100 Subject: [PATCH 0503/1283] ci: add --verbose flag to rust-openssl cargo test --- .github/workflows/rust-openssl.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index e5e6e02a32..149d2b7d18 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -32,4 +32,4 @@ jobs: OPENSSL_DIR=${HOME}/opt LD_LIBRARY_PATH=${HOME}/opt/lib patch -p1 < ../.github/rust-openssl.patch - cargo test + cargo test --verbose From 98291381ff8651b057112ebf52d1ef4a14892c87 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 11 Nov 2023 18:57:16 +0100 Subject: [PATCH 0504/1283] Fix rust-openssl regress Change around the order slightly. It seems more logical to apply the patch first, then export the env. --- .github/workflows/rust-openssl.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index 149d2b7d18..cec2de0e7b 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -29,7 +29,6 @@ jobs: - name: "Run rust-openssl tests" run: | cd rust-openssl - OPENSSL_DIR=${HOME}/opt - LD_LIBRARY_PATH=${HOME}/opt/lib patch -p1 < ../.github/rust-openssl.patch + export OPENSSL_DIR=${HOME}/opt LD_LIBRARY_PATH=${HOME}/opt/lib cargo test --verbose From da59bdcebffb6a933ef9d59f621812ecc551c846 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 11 Nov 2023 11:52:05 -0700 Subject: [PATCH 0505/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 994063fee8..e3d5090ead 100644 --- a/ChangeLog +++ b/ChangeLog @@ -41,6 +41,7 @@ LibreSSL Portable Release Notes: - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp(). - Fixed numerous misuses of X509_ALGOR_set0() resulting in leaks and potentially incorrect encodings. + - Fixed potential double free in X509v3_asid_add_id_or_range(). 3.8.2 - Stable release From 63635ea958fc6d643c099a54ef84182d8a64de11 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 11 Nov 2023 20:17:53 +0100 Subject: [PATCH 0506/1283] Revert "Land #945" This reverts commit c1b61a769d1b28d9309e5463e7b5abb65d460cba, reversing changes made to 194a4a5fd45fab5967878296d575644789bcafb9. --- .github/workflows/macos.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index f8636ff4d1..e813191d9e 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -16,7 +16,7 @@ jobs: strategy: fail-fast: false matrix: - os: ["macos-13", "macos-12", "macos-11"] + os: ["macos-13", "macos-12"] arch: ["arm64", "x86_64"] steps: - name: "Install required packages" From 291c0d96361428bf29ffb83d359d043ae26a2b21 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 12 Nov 2023 00:02:17 +0100 Subject: [PATCH 0507/1283] Replace rust-openssl patch with an ed script It is annoying to update this patch all the time. An easy ed script does the trick just as well. --- .github/rust-openssl.patch | 12 ------------ .github/workflows/rust-openssl.yml | 10 +++++++++- 2 files changed, 9 insertions(+), 13 deletions(-) delete mode 100644 .github/rust-openssl.patch diff --git a/.github/rust-openssl.patch b/.github/rust-openssl.patch deleted file mode 100644 index 4a8dd3fd94..0000000000 --- a/.github/rust-openssl.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs -index bbee7c5c..57033b2d 100644 ---- a/openssl-sys/build/main.rs -+++ b/openssl-sys/build/main.rs -@@ -293,6 +293,7 @@ See rust-openssl documentation for more information: - (3, 8, 0) => ('3', '8', '0'), - (3, 8, 1) => ('3', '8', '1'), - (3, 8, _) => ('3', '8', 'x'), -+ (3, 9, _) => ('3', '8', 'x'), - _ => version_error(), - }; - diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index cec2de0e7b..ef5a7b1977 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -29,6 +29,14 @@ jobs: - name: "Run rust-openssl tests" run: | cd rust-openssl - patch -p1 < ../.github/rust-openssl.patch + # instead of erroring use the last supported version + ed -s openssl-sys/build/main.rs <<-EOF + /_ => version_error/-1 + .t. + s/(.*=/_ = + +1d + w + q + EOF export OPENSSL_DIR=${HOME}/opt LD_LIBRARY_PATH=${HOME}/opt/lib cargo test --verbose From 746944b43576b8ea3773ffeb0b554b8b0964cf75 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 15 Nov 2023 15:27:32 -0700 Subject: [PATCH 0508/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index e3d5090ead..814131bfba 100644 --- a/ChangeLog +++ b/ChangeLog @@ -42,6 +42,9 @@ LibreSSL Portable Release Notes: - Fixed numerous misuses of X509_ALGOR_set0() resulting in leaks and potentially incorrect encodings. - Fixed potential double free in X509v3_asid_add_id_or_range(). + - Stopped using ASN1_time_parse() outside of libcrypto. + - Prepared OPENSSL_gmtime() and OPENSSL_timegm() as public API + wrappers of internal functions compatible with BoringSSL API. 3.8.2 - Stable release From 4cce3954e2095647e63a4c47dba8fd2f8accd3c7 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 9 Nov 2023 20:59:03 -0600 Subject: [PATCH 0509/1283] remove additional endbr64 patch, add tests for macos-11 --- .github/workflows/macos.yml | 2 +- patches/asm/0005-Revert-aesni-endbr64.patch | 20 ++++++++++++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 patches/asm/0005-Revert-aesni-endbr64.patch diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index e813191d9e..f8636ff4d1 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -16,7 +16,7 @@ jobs: strategy: fail-fast: false matrix: - os: ["macos-13", "macos-12"] + os: ["macos-13", "macos-12", "macos-11"] arch: ["arm64", "x86_64"] steps: - name: "Install required packages" diff --git a/patches/asm/0005-Revert-aesni-endbr64.patch b/patches/asm/0005-Revert-aesni-endbr64.patch new file mode 100644 index 0000000000..f2094e6821 --- /dev/null +++ b/patches/asm/0005-Revert-aesni-endbr64.patch @@ -0,0 +1,20 @@ +commit ac992937b461479b41f7f65e79646ef0a715f95d +Author: Brent Cook +Date: Thu Nov 9 12:29:33 2023 -0600 + + Revert "aesni_ctr32_encrypt_blocks() is called indirectly from C code, so it" + + This reverts commit 52f96c842e82486510ffc2513e71323b70242f28. + +diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl +index 07d40a84a..c261a3795 100644 +--- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl ++++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl +@@ -1025,7 +1025,6 @@ $code.=<<___; + .type aesni_ctr32_encrypt_blocks,\@function,5 + .align 16 + aesni_ctr32_encrypt_blocks: +- endbr64 + lea (%rsp),%rax + push %rbp + sub \$$frame_size,%rsp From e440e7fd8a4e3b51a7abfa842b01285449abb6d6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 19 Nov 2023 04:13:00 -0700 Subject: [PATCH 0510/1283] Update man links --- man/links | 127 +++++++----------------------------------------------- 1 file changed, 16 insertions(+), 111 deletions(-) diff --git a/man/links b/man/links index 2a714f89b1..f50152be06 100644 --- a/man/links +++ b/man/links @@ -107,6 +107,8 @@ ASN1_TIME_set.3,ASN1_UTCTIME_cmp_time_t.3 ASN1_TIME_set.3,ASN1_UTCTIME_print.3 ASN1_TIME_set.3,ASN1_UTCTIME_set.3 ASN1_TIME_set.3,ASN1_UTCTIME_set_string.3 +ASN1_TIME_set.3,OPENSSL_gmtime.3 +ASN1_TIME_set.3,OPENSSL_timegm.3 ASN1_TYPE_get.3,ASN1_TYPE_cmp.3 ASN1_TYPE_get.3,ASN1_TYPE_free.3 ASN1_TYPE_get.3,ASN1_TYPE_get_int_octetstring.3 @@ -238,9 +240,6 @@ BIO_get_ex_new_index.3,BIO_set_ex_data.3 BIO_get_ex_new_index.3,EC_KEY_get_ex_data.3 BIO_get_ex_new_index.3,EC_KEY_get_ex_new_index.3 BIO_get_ex_new_index.3,EC_KEY_set_ex_data.3 -BIO_get_ex_new_index.3,ENGINE_get_ex_data.3 -BIO_get_ex_new_index.3,ENGINE_get_ex_new_index.3 -BIO_get_ex_new_index.3,ENGINE_set_ex_data.3 BIO_get_ex_new_index.3,TYPE_get_app_data.3 BIO_get_ex_new_index.3,TYPE_get_ex_data.3 BIO_get_ex_new_index.3,TYPE_get_ex_new_index.3 @@ -745,101 +744,21 @@ EC_POINT_new.3,EC_POINT_set_affine_coordinates_GFp.3 EC_POINT_new.3,EC_POINT_set_compressed_coordinates.3 EC_POINT_new.3,EC_POINT_set_compressed_coordinates_GFp.3 EC_POINT_new.3,EC_POINT_set_to_infinity.3 -ENGINE_add.3,ENGINE_by_id.3 -ENGINE_add.3,ENGINE_cleanup.3 -ENGINE_add.3,ENGINE_get_first.3 -ENGINE_add.3,ENGINE_get_id.3 -ENGINE_add.3,ENGINE_get_last.3 -ENGINE_add.3,ENGINE_get_name.3 -ENGINE_add.3,ENGINE_get_next.3 -ENGINE_add.3,ENGINE_get_prev.3 -ENGINE_add.3,ENGINE_remove.3 -ENGINE_add.3,ENGINE_set_id.3 -ENGINE_add.3,ENGINE_set_name.3 -ENGINE_ctrl.3,ENGINE_CTRL_FUNC_PTR.3 -ENGINE_ctrl.3,ENGINE_cmd_is_executable.3 -ENGINE_ctrl.3,ENGINE_ctrl_cmd.3 -ENGINE_ctrl.3,ENGINE_ctrl_cmd_string.3 -ENGINE_ctrl.3,ENGINE_get_cmd_defns.3 -ENGINE_ctrl.3,ENGINE_get_ctrl_function.3 -ENGINE_ctrl.3,ENGINE_set_cmd_defns.3 -ENGINE_ctrl.3,ENGINE_set_ctrl_function.3 -ENGINE_get_default_RSA.3,ENGINE_get_cipher_engine.3 -ENGINE_get_default_RSA.3,ENGINE_get_default_DH.3 -ENGINE_get_default_RSA.3,ENGINE_get_default_DSA.3 -ENGINE_get_default_RSA.3,ENGINE_get_default_EC.3 -ENGINE_get_default_RSA.3,ENGINE_get_default_RAND.3 -ENGINE_get_default_RSA.3,ENGINE_get_digest_engine.3 -ENGINE_get_default_RSA.3,ENGINE_get_table_flags.3 -ENGINE_get_default_RSA.3,ENGINE_set_table_flags.3 -ENGINE_init.3,ENGINE_GEN_INT_FUNC_PTR.3 -ENGINE_init.3,ENGINE_finish.3 -ENGINE_init.3,ENGINE_get_finish_function.3 -ENGINE_init.3,ENGINE_get_init_function.3 -ENGINE_init.3,ENGINE_set_finish_function.3 -ENGINE_init.3,ENGINE_set_init_function.3 -ENGINE_new.3,ENGINE_GEN_INT_FUNC_PTR.3 +ENGINE_new.3,ENGINE_by_id.3 +ENGINE_new.3,ENGINE_finish.3 ENGINE_new.3,ENGINE_free.3 -ENGINE_new.3,ENGINE_get_destroy_function.3 -ENGINE_new.3,ENGINE_set_destroy_function.3 -ENGINE_new.3,ENGINE_up_ref.3 -ENGINE_register_RSA.3,ENGINE_register_DH.3 -ENGINE_register_RSA.3,ENGINE_register_DSA.3 -ENGINE_register_RSA.3,ENGINE_register_ECDH.3 -ENGINE_register_RSA.3,ENGINE_register_ECDSA.3 -ENGINE_register_RSA.3,ENGINE_register_RAND.3 -ENGINE_register_RSA.3,ENGINE_register_STORE.3 -ENGINE_register_RSA.3,ENGINE_register_ciphers.3 -ENGINE_register_RSA.3,ENGINE_register_complete.3 -ENGINE_register_RSA.3,ENGINE_register_digests.3 -ENGINE_register_all_RSA.3,ENGINE_load_builtin_engines.3 -ENGINE_register_all_RSA.3,ENGINE_load_dynamic.3 -ENGINE_register_all_RSA.3,ENGINE_register_all_DH.3 -ENGINE_register_all_RSA.3,ENGINE_register_all_DSA.3 -ENGINE_register_all_RSA.3,ENGINE_register_all_ECDH.3 -ENGINE_register_all_RSA.3,ENGINE_register_all_ECDSA.3 -ENGINE_register_all_RSA.3,ENGINE_register_all_RAND.3 -ENGINE_register_all_RSA.3,ENGINE_register_all_STORE.3 -ENGINE_register_all_RSA.3,ENGINE_register_all_ciphers.3 -ENGINE_register_all_RSA.3,ENGINE_register_all_complete.3 -ENGINE_register_all_RSA.3,ENGINE_register_all_digests.3 -ENGINE_set_RSA.3,ENGINE_CIPHERS_PTR.3 -ENGINE_set_RSA.3,ENGINE_DIGESTS_PTR.3 -ENGINE_set_RSA.3,ENGINE_get_DH.3 -ENGINE_set_RSA.3,ENGINE_get_DSA.3 -ENGINE_set_RSA.3,ENGINE_get_EC.3 -ENGINE_set_RSA.3,ENGINE_get_RAND.3 -ENGINE_set_RSA.3,ENGINE_get_RSA.3 -ENGINE_set_RSA.3,ENGINE_get_STORE.3 -ENGINE_set_RSA.3,ENGINE_get_cipher.3 -ENGINE_set_RSA.3,ENGINE_get_ciphers.3 -ENGINE_set_RSA.3,ENGINE_get_digest.3 -ENGINE_set_RSA.3,ENGINE_get_digests.3 -ENGINE_set_RSA.3,ENGINE_set_DH.3 -ENGINE_set_RSA.3,ENGINE_set_DSA.3 -ENGINE_set_RSA.3,ENGINE_set_EC.3 -ENGINE_set_RSA.3,ENGINE_set_RAND.3 -ENGINE_set_RSA.3,ENGINE_set_STORE.3 -ENGINE_set_RSA.3,ENGINE_set_ciphers.3 -ENGINE_set_RSA.3,ENGINE_set_digests.3 -ENGINE_set_default.3,ENGINE_set_default_DH.3 -ENGINE_set_default.3,ENGINE_set_default_DSA.3 -ENGINE_set_default.3,ENGINE_set_default_ECDH.3 -ENGINE_set_default.3,ENGINE_set_default_ECDSA.3 -ENGINE_set_default.3,ENGINE_set_default_RAND.3 -ENGINE_set_default.3,ENGINE_set_default_RSA.3 -ENGINE_set_default.3,ENGINE_set_default_ciphers.3 -ENGINE_set_default.3,ENGINE_set_default_digests.3 -ENGINE_set_default.3,ENGINE_set_default_string.3 -ENGINE_set_flags.3,ENGINE_get_flags.3 -ENGINE_unregister_RSA.3,ENGINE_unregister_DH.3 -ENGINE_unregister_RSA.3,ENGINE_unregister_DSA.3 -ENGINE_unregister_RSA.3,ENGINE_unregister_ECDH.3 -ENGINE_unregister_RSA.3,ENGINE_unregister_ECDSA.3 -ENGINE_unregister_RSA.3,ENGINE_unregister_RAND.3 -ENGINE_unregister_RSA.3,ENGINE_unregister_STORE.3 -ENGINE_unregister_RSA.3,ENGINE_unregister_ciphers.3 -ENGINE_unregister_RSA.3,ENGINE_unregister_digests.3 +ENGINE_new.3,ENGINE_get_default_RSA.3 +ENGINE_new.3,ENGINE_get_id.3 +ENGINE_new.3,ENGINE_get_name.3 +ENGINE_new.3,ENGINE_init.3 +ENGINE_new.3,ENGINE_load_builtin_engines.3 +ENGINE_new.3,ENGINE_load_dynamic.3 +ENGINE_new.3,ENGINE_load_openssl.3 +ENGINE_new.3,ENGINE_load_private_key.3 +ENGINE_new.3,ENGINE_load_public_key.3 +ENGINE_new.3,ENGINE_register_all_complete.3 +ENGINE_new.3,ENGINE_set_default.3 +ENGINE_new.3,ENGINE_set_default_RSA.3 ERR_GET_LIB.3,ERR_FATAL_ERROR.3 ERR_GET_LIB.3,ERR_GET_FUNC.3 ERR_GET_LIB.3,ERR_GET_REASON.3 @@ -2517,32 +2436,18 @@ X509v3_get_ext_by_NID.3,X509v3_get_ext_by_OBJ.3 X509v3_get_ext_by_NID.3,X509v3_get_ext_by_critical.3 X509v3_get_ext_by_NID.3,X509v3_get_ext_count.3 bn_dump.3,bn_add_words.3 -bn_dump.3,bn_check_top.3 -bn_dump.3,bn_cmp_words.3 bn_dump.3,bn_div_words.3 bn_dump.3,bn_expand.3 -bn_dump.3,bn_expand2.3 -bn_dump.3,bn_fix_top.3 bn_dump.3,bn_mul_add_words.3 bn_dump.3,bn_mul_comba4.3 bn_dump.3,bn_mul_comba8.3 bn_dump.3,bn_mul_normal.3 -bn_dump.3,bn_mul_part_recursive.3 -bn_dump.3,bn_mul_recursive.3 bn_dump.3,bn_mul_words.3 -bn_dump.3,bn_set_high.3 -bn_dump.3,bn_set_low.3 -bn_dump.3,bn_set_max.3 bn_dump.3,bn_sqr_comba4.3 bn_dump.3,bn_sqr_comba8.3 -bn_dump.3,bn_sqr_normal.3 -bn_dump.3,bn_sqr_recursive.3 bn_dump.3,bn_sqr_words.3 bn_dump.3,bn_sub_words.3 bn_dump.3,bn_wexpand.3 -bn_dump.3,mul.3 -bn_dump.3,mul_add.3 -bn_dump.3,sqr.3 d2i_ASN1_NULL.3,i2d_ASN1_NULL.3 d2i_ASN1_OBJECT.3,OBJ_get0_data.3 d2i_ASN1_OBJECT.3,OBJ_length.3 From a332334ec11c68ca15613158b94fc72528564c38 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 22 Nov 2023 09:11:05 -0700 Subject: [PATCH 0511/1283] ssl_algs.c was removed --- ssl/CMakeLists.txt | 1 - ssl/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 9ba2a9e6f1..22385ba1f1 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -8,7 +8,6 @@ set( pqueue.c s3_cbc.c s3_lib.c - ssl_algs.c ssl_asn1.c ssl_both.c ssl_cert.c diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 9acacd7bc5..dca98e2181 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -58,7 +58,6 @@ libssl_la_SOURCES += d1_srtp.c libssl_la_SOURCES += pqueue.c libssl_la_SOURCES += s3_cbc.c libssl_la_SOURCES += s3_lib.c -libssl_la_SOURCES += ssl_algs.c libssl_la_SOURCES += ssl_asn1.c libssl_la_SOURCES += ssl_both.c libssl_la_SOURCES += ssl_cert.c From 4884c6564df765454f4c38897a3bce2b1785765d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 22 Nov 2023 09:15:19 -0700 Subject: [PATCH 0512/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 814131bfba..b56da0280f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -37,6 +37,7 @@ LibreSSL Portable Release Notes: - Bug fixes and simplifications in the Wycheproof tests. * Compatibility changes - Added ChaCha20 and chacha20 aliases for ChaCha. + - SSL_library_init() now has the same effect as OPENSSL_init_ssl(). * Bug fixes - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp(). - Fixed numerous misuses of X509_ALGOR_set0() resulting in leaks and @@ -45,6 +46,8 @@ LibreSSL Portable Release Notes: - Stopped using ASN1_time_parse() outside of libcrypto. - Prepared OPENSSL_gmtime() and OPENSSL_timegm() as public API wrappers of internal functions compatible with BoringSSL API. + - Removed print_bin() to avoid overwriting the stack with 5 bytes + of ' ' when ECPK parameters are printed with large indentation. 3.8.2 - Stable release From 477e8e1f49cc49d22ceae03bad915d6ef5fee994 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 28 Nov 2023 00:30:22 -0600 Subject: [PATCH 0513/1283] disable periodic builds of broken CI workflows Neither of these has built in over a month. Solaris looks to be an upstream timeout issue (seems the hack it uses may not work anymore). Not sure if cifuzz is really needed either, since we're still being tested through clusterfuzz actively. --- .github/workflows/cifuzz.yml | 5 ----- .github/workflows/solaris_test.yml | 5 ----- 2 files changed, 10 deletions(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index bdb3b2c0f0..eec21d96c6 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -1,10 +1,5 @@ name: CIFuzz -on: - workflow_dispatch: - schedule: - - cron: "0 0 * * *" - jobs: Fuzzing: runs-on: ubuntu-latest diff --git a/.github/workflows/solaris_test.yml b/.github/workflows/solaris_test.yml index f5e6bf49d7..314f4785d7 100644 --- a/.github/workflows/solaris_test.yml +++ b/.github/workflows/solaris_test.yml @@ -1,10 +1,5 @@ name: solaris_ci -on: - workflow_dispatch: - schedule: - - cron: "0 0 * * *" - jobs: build-native: strategy: From 3a42f77aa9e0276d5ce3401d3643c184cd8ad34c Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 28 Nov 2023 06:59:32 -0600 Subject: [PATCH 0514/1283] remove Solaris build status --- README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/README.md b/README.md index 051c749af3..009efd5016 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,6 @@ [![Linux Build Status](https://github.com/libressl/portable/actions/workflows/linux.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/linux.yml) [![macOS Build Status](https://github.com/libressl/portable/actions/workflows/macos.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/macos.yml) [![Android Build Status](https://github.com/libressl/portable/actions/workflows/android.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/android.yml) -[![Solaris Build Status](https://github.com/libressl/portable/actions/workflows/solaris_test.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/solaris_test.yml) [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/libressl.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:libressl) LibreSSL is a fork of [OpenSSL](https://www.openssl.org) 1.0.1g developed by the From 71fcee9b6e2d5da2073215a679cb219e6b177957 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 28 Nov 2023 07:06:03 -0600 Subject: [PATCH 0515/1283] there has to be some trigger, even a manual one --- .github/workflows/cifuzz.yml | 3 +++ .github/workflows/solaris_test.yml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index eec21d96c6..bbf3f4444d 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -1,5 +1,8 @@ name: CIFuzz +on: + workflow_dispatch: + jobs: Fuzzing: runs-on: ubuntu-latest diff --git a/.github/workflows/solaris_test.yml b/.github/workflows/solaris_test.yml index 314f4785d7..217efd24ba 100644 --- a/.github/workflows/solaris_test.yml +++ b/.github/workflows/solaris_test.yml @@ -1,5 +1,8 @@ name: solaris_ci +on: + workflow_dispatch: + jobs: build-native: strategy: From dc0827bf7622bc017c010649680ac227c7d0072c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 28 Nov 2023 07:17:07 -0700 Subject: [PATCH 0516/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index b56da0280f..876abd307d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -48,6 +48,8 @@ LibreSSL Portable Release Notes: wrappers of internal functions compatible with BoringSSL API. - Removed print_bin() to avoid overwriting the stack with 5 bytes of ' ' when ECPK parameters are printed with large indentation. + - Avoid a NULL dereference after memory allocation failure during TLS + version downgrade. 3.8.2 - Stable release From 4fc28f4cc5e080f3639fb89e37c88b094cf7a55e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 29 Nov 2023 18:23:10 +0100 Subject: [PATCH 0517/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 876abd307d..75db71f474 100644 --- a/ChangeLog +++ b/ChangeLog @@ -32,6 +32,7 @@ LibreSSL Portable Release Notes: * Portable changes * Internal improvements + - Converted uses of OBJ_bsearch_() to standard bsearch(). * Documentation improvements * Testing and proactive security - Bug fixes and simplifications in the Wycheproof tests. From 5b404cb858718777391c745417944ca0e0c01036 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 1 Dec 2023 15:08:20 -0700 Subject: [PATCH 0518/1283] Update ChangeLog --- ChangeLog | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ChangeLog b/ChangeLog index 75db71f474..c30fd8ef31 100644 --- a/ChangeLog +++ b/ChangeLog @@ -33,7 +33,10 @@ LibreSSL Portable Release Notes: * Portable changes * Internal improvements - Converted uses of OBJ_bsearch_() to standard bsearch(). + - Greatly simplified by_file_ctrl(). * Documentation improvements + - ENGINE documentation was updated to reflect reality. + - Made EVP API documentation more accurate and less incoherent. * Testing and proactive security - Bug fixes and simplifications in the Wycheproof tests. * Compatibility changes @@ -51,6 +54,8 @@ LibreSSL Portable Release Notes: of ' ' when ECPK parameters are printed with large indentation. - Avoid a NULL dereference after memory allocation failure during TLS version downgrade. + - Fixed various bugs in CMAC internals. + - Removed all remaining ENGINE tentacles. 3.8.2 - Stable release From fb16370480ee26be8b3c40d675be93bbefa7f344 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 1 Dec 2023 15:10:16 -0700 Subject: [PATCH 0519/1283] Update man links --- man/links | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/man/links b/man/links index f50152be06..f5ea0cbfb5 100644 --- a/man/links +++ b/man/links @@ -745,6 +745,9 @@ EC_POINT_new.3,EC_POINT_set_compressed_coordinates.3 EC_POINT_new.3,EC_POINT_set_compressed_coordinates_GFp.3 EC_POINT_new.3,EC_POINT_set_to_infinity.3 ENGINE_new.3,ENGINE_by_id.3 +ENGINE_new.3,ENGINE_cleanup.3 +ENGINE_new.3,ENGINE_ctrl_cmd.3 +ENGINE_new.3,ENGINE_ctrl_cmd_string.3 ENGINE_new.3,ENGINE_finish.3 ENGINE_new.3,ENGINE_free.3 ENGINE_new.3,ENGINE_get_default_RSA.3 @@ -812,6 +815,8 @@ EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_iv_length.3 EVP_CIPHER_CTX_ctrl.3,EVP_CIPHER_key_length.3 EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_buf_noconst.3 EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_set_cipher_data.3 +EVP_CIPHER_CTX_init.3,EVP_CIPHER_CTX_cleanup.3 +EVP_CIPHER_CTX_init.3,EVP_Cipher.3 EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_clear_flags.3 EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_get_app_data.3 EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_CTX_rand_key.3 @@ -885,14 +890,11 @@ EVP_EncodeInit.3,EVP_EncodeBlock.3 EVP_EncodeInit.3,EVP_EncodeFinal.3 EVP_EncodeInit.3,EVP_EncodeUpdate.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_cipher.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_cleanup.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_copy.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_encrypting.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_free.3 -EVP_EncryptInit.3,EVP_CIPHER_CTX_init.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_new.3 EVP_EncryptInit.3,EVP_CIPHER_CTX_reset.3 -EVP_EncryptInit.3,EVP_Cipher.3 EVP_EncryptInit.3,EVP_CipherFinal.3 EVP_EncryptInit.3,EVP_CipherFinal_ex.3 EVP_EncryptInit.3,EVP_CipherInit.3 @@ -1342,7 +1344,6 @@ OPENSSL_VERSION_NUMBER.3,SSLeay_version.3 OPENSSL_config.3,OPENSSL_no_config.3 OPENSSL_init_crypto.3,OPENSSL_init.3 OPENSSL_load_builtin_modules.3,ASN1_add_oid_module.3 -OPENSSL_load_builtin_modules.3,ENGINE_add_conf_module.3 OPENSSL_malloc.3,CRYPTO_free.3 OPENSSL_malloc.3,CRYPTO_malloc.3 OPENSSL_malloc.3,CRYPTO_realloc.3 From e6271f8e41ccf51ea094cc0585d0a07f47d25454 Mon Sep 17 00:00:00 2001 From: Mathieu Mirmont Date: Tue, 5 Dec 2023 09:56:22 +0100 Subject: [PATCH 0520/1283] Fix build on mips --- crypto/CMakeLists.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 6056471510..00a005a5f6 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -964,6 +964,8 @@ elseif(HOST_I386) target_include_directories(crypto_obj PRIVATE bn/arch/i386/) elseif(HOST_MIPS64) target_include_directories(crypto_obj PRIVATE bn/arch/mips64) +elseif(HOST_MIPS) + target_include_directories(crypto_obj PRIVATE bn/arch/mips) elseif(HOST_POWERPC) target_include_directories(crypto_obj PRIVATE bn/arch/powerpc) elseif(HOST_POWERPC64) From b9a52efb86ded8b198faa1d0f76bf2c780572fd6 Mon Sep 17 00:00:00 2001 From: neil Date: Sat, 9 Dec 2023 10:39:14 +0100 Subject: [PATCH 0521/1283] Update solaris vm to latest version Update solaris vm to latest version --- .github/workflows/solaris_test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/solaris_test.yml b/.github/workflows/solaris_test.yml index 217efd24ba..6470278ba8 100644 --- a/.github/workflows/solaris_test.yml +++ b/.github/workflows/solaris_test.yml @@ -8,7 +8,7 @@ jobs: strategy: matrix: release: [11.4] - runs-on: macos-12 + runs-on: ubuntu-latest continue-on-error: false name: Solaris ${{ matrix.release }} steps: @@ -19,7 +19,7 @@ jobs: brew install automake autoconf libtool ./autogen.sh - name: Build on VM - uses: vmactions/solaris-vm@v0 + uses: vmactions/solaris-vm@v1 with: prepare: | pkg install gcc make From 8844e9cd7ff5252ac86aba03c76dcd88efd07ba3 Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Sun, 10 Dec 2023 17:27:18 +0100 Subject: [PATCH 0522/1283] windows: always upload build artifacts, even in case of failure --- .github/workflows/windows_test.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/windows_test.yml b/.github/workflows/windows_test.yml index ff91f9a6d7..bac948e9f8 100644 --- a/.github/workflows/windows_test.yml +++ b/.github/workflows/windows_test.yml @@ -40,6 +40,7 @@ jobs: if: ${{ matrix.arch != 'ARM64' }} run: ctest --test-dir build -C Release --output-on-failure - uses: actions/upload-artifact@v3 + if: always() with: name: windows-build-results-${{ matrix.os }}-${{ matrix.arch }} path: build From 5e6ab003465832ae934d6b8a836fcc86fae60196 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Sun, 10 Dec 2023 22:52:31 +0000 Subject: [PATCH 0523/1283] check-release.sh: use HTTPS when downloading sources --- check-release.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/check-release.sh b/check-release.sh index bdafa0840c..c5f9c5f9b8 100755 --- a/check-release.sh +++ b/check-release.sh @@ -26,7 +26,7 @@ if [ ! -e releases/$tarball ]; then mkdir -p releases rm -f $tarball if [ -z "$LIBRESSL_SSH" ]; then - $download http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/$tarball releases/ + $download https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/$tarball releases/ mv $tarball releases else scp $LIBRESSL_SSH/$tarball releases From 0a446e81ed77c20aa87563d45ef0ef8f5fa283d8 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 18 Nov 2023 10:53:09 +0100 Subject: [PATCH 0524/1283] Prefix some compat symbols with libressl_ See #928. This isn't a full fix, but should remove much of the friction already. --- include/compat/stdio.h | 2 ++ include/compat/stdlib.h | 10 ++++++++++ include/compat/string.h | 11 +++++++++++ 3 files changed, 23 insertions(+) diff --git a/include/compat/stdio.h b/include/compat/stdio.h index d5725c9ac9..4ddd63aee1 100644 --- a/include/compat/stdio.h +++ b/include/compat/stdio.h @@ -20,7 +20,9 @@ #ifndef HAVE_ASPRINTF #include +#define vasprintf libressl_vasprintf int vasprintf(char **str, const char *fmt, va_list ap); +#define asprintf libressl_asprintf int asprintf(char **str, const char *fmt, ...); #endif diff --git a/include/compat/stdlib.h b/include/compat/stdlib.h index 2eaea244c0..76dc07c35a 100644 --- a/include/compat/stdlib.h +++ b/include/compat/stdlib.h @@ -20,26 +20,36 @@ #include #ifndef HAVE_ARC4RANDOM_BUF +#define arc4random libressl_arc4random uint32_t arc4random(void); +#define arc4random_buf libressl_arc4random_buf void arc4random_buf(void *_buf, size_t n); +#define arc4random_uniform libressl_arc4random_uniform uint32_t arc4random_uniform(uint32_t upper_bound); #endif #ifndef HAVE_FREEZERO +#define freezero libressl_freezero void freezero(void *ptr, size_t sz); #endif #ifndef HAVE_GETPROGNAME +#define getprogname libressl_getprogname const char * getprogname(void); #endif +#ifndef HAVE_REALLOCARRAY +#define reallocarray libressl_reallocarray void *reallocarray(void *, size_t, size_t); +#endif #ifndef HAVE_RECALLOCARRAY +#define recallocarray libressl_recallocarray void *recallocarray(void *, size_t, size_t, size_t); #endif #ifndef HAVE_STRTONUM +#define strtonum libressl_strtonum long long strtonum(const char *nptr, long long minval, long long maxval, const char **errstr); #endif diff --git a/include/compat/string.h b/include/compat/string.h index 4bf7519b5b..6a82793f62 100644 --- a/include/compat/string.h +++ b/include/compat/string.h @@ -27,43 +27,54 @@ #endif #ifndef HAVE_STRCASECMP +#define strcasecmp libressl_strcasecmp int strcasecmp(const char *s1, const char *s2); +#define strncasecmp libressl_strncasecmp int strncasecmp(const char *s1, const char *s2, size_t len); #endif #ifndef HAVE_STRLCPY +#define strlcpy libressl_strlcpy size_t strlcpy(char *dst, const char *src, size_t siz); #endif #ifndef HAVE_STRLCAT +#define strlcat libressl_strlcat size_t strlcat(char *dst, const char *src, size_t siz); #endif #ifndef HAVE_STRNDUP +#define strndup libressl_strndup char * strndup(const char *str, size_t maxlen); /* the only user of strnlen is strndup, so only build it if needed */ #ifndef HAVE_STRNLEN +#define strnlen libressl_strnlen size_t strnlen(const char *str, size_t maxlen); #endif #endif #ifndef HAVE_STRSEP +#define strsep libressl_strsep char *strsep(char **stringp, const char *delim); #endif #ifndef HAVE_EXPLICIT_BZERO +#define explicit_bzero libressl_explicit_bzero void explicit_bzero(void *, size_t); #endif #ifndef HAVE_TIMINGSAFE_BCMP +#define timingsafe_bcmp libressl_timingsafe_bcmp int timingsafe_bcmp(const void *b1, const void *b2, size_t n); #endif #ifndef HAVE_TIMINGSAFE_MEMCMP +#define timingsafe_memcmp libressl_timingsafe_memcmp int timingsafe_memcmp(const void *b1, const void *b2, size_t len); #endif #ifndef HAVE_MEMMEM +#define memmem libressl_memmem void * memmem(const void *big, size_t big_len, const void *little, size_t little_len); #endif From 2d6d9fcc8faf8319c8e7e19fb0c4ab80445ad4ea Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Mon, 11 Dec 2023 16:21:00 +0000 Subject: [PATCH 0525/1283] upgrade links in comments to HTTPS --- crypto/compat/ui_openssl_win.c | 4 ++-- m4/check-os-options.m4 | 2 +- tap-driver.sh | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/crypto/compat/ui_openssl_win.c b/crypto/compat/ui_openssl_win.c index a8c92f28f7..09705e48d9 100644 --- a/crypto/compat/ui_openssl_win.c +++ b/crypto/compat/ui_openssl_win.c @@ -20,7 +20,7 @@ * 3. All advertising materials mentioning features or use of this * software must display the following acknowledgment: * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * for use in the OpenSSL Toolkit. (https://www.openssl.org/)" * * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to * endorse or promote products derived from this software without @@ -34,7 +34,7 @@ * 6. Redistributions of any form whatsoever must retain the following * acknowledgment: * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * for use in the OpenSSL Toolkit (https://www.openssl.org/)" * * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE diff --git a/m4/check-os-options.m4 b/m4/check-os-options.m4 index c73709dbb5..77edd14c91 100644 --- a/m4/check-os-options.m4 +++ b/m4/check-os-options.m4 @@ -22,7 +22,7 @@ case $host_os in # Don't use arc4random on systems before 10.12 because of # weak seed on failure to open /dev/random, based on latest # public source: - # http://www.opensource.apple.com/source/Libc/Libc-997.90.3/gen/FreeBSD/arc4random.c + # https://www.opensource.apple.com/source/Libc/Libc-997.90.3/gen/FreeBSD/arc4random.c # # We use the presence of getentropy() to detect 10.12. The # following check take into account that: diff --git a/tap-driver.sh b/tap-driver.sh index fea066f56e..115e859b03 100755 --- a/tap-driver.sh +++ b/tap-driver.sh @@ -464,7 +464,7 @@ function get_test_exit_message(status) # in $? an exit status of 256+n instead of the more standard 128+n. # Apparently, both behaviours are allowed by POSIX (2008), so be # prepared to handle them both. See also Austing Group report ID - # 0000051 + # 0000051 exit_details = sprintf(" (terminated by signal %d?)", status - 256) else # Never seen in practice. From d83d983a3659109f2b2b2de42108f3b665140629 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Mon, 11 Dec 2023 16:29:44 +0000 Subject: [PATCH 0526/1283] delete broken link --- tap-driver.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/tap-driver.sh b/tap-driver.sh index 115e859b03..1e444b2a6a 100755 --- a/tap-driver.sh +++ b/tap-driver.sh @@ -131,9 +131,8 @@ fi # expects on its last input line (which is displayed below by the # last `echo $?' statement), and would thus die reporting an internal # error. - # For more information, see the Autoconf manual and the threads: + # For more information, see the Autoconf manual and the thread: # - # trap : 1 3 2 13 15 if test $merge -gt 0; then exec 2>&1 From 0de236a7c1ef37663d0b37f656bedb6fc202ca6f Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Mon, 11 Dec 2023 16:21:30 +0000 Subject: [PATCH 0527/1283] cmake: auto-detect `strtonum` Notice that just like in autotools, this detection also doesn't take into account the targeted OS version. Meaning it detects `strtonum` even if targeting e.g. macOS older than release v11 Big Sur (which introduced this funcitions), if the SDK declares it. Wrong detection will either cause a binary broken on older macOS and/or trigger compiler warnings. Ref: https://github.com/libressl/portable/issues/928#issuecomment-1850178282 Ref: https://github.com/libressl/portable/issues/928#issuecomment-1850276298 Prerequisite: https://github.com/libressl/portable/issues/928#issuecomment-1850356408 --- CMakeLists.txt | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index 605cfde3de..ac3e5a0e6d 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -234,6 +234,11 @@ if(HAVE_STRSEP) add_definitions(-DHAVE_STRSEP) endif() +check_function_exists(strtonum HAVE_STRTONUM) +if(HAVE_STRTONUM) + add_definitions(-DHAVE_STRTONUM) +endif() + check_function_exists(timegm HAVE_TIMEGM) if(HAVE_TIMEGM) add_definitions(-DHAVE_TIMEGM) From 9e7eb88ac8bc3b3b178b38c5a04e95e14c4d5379 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 11 Dec 2023 17:40:31 +0100 Subject: [PATCH 0528/1283] Add configure check for strcasecmp --- m4/check-libc.m4 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/m4/check-libc.m4 b/m4/check-libc.m4 index dc8d6bd7c8..50fb8e13d1 100644 --- a/m4/check-libc.m4 +++ b/m4/check-libc.m4 @@ -9,7 +9,7 @@ AC_HEADER_RESOLV # Check for general libc functions AC_CHECK_FUNCS([asprintf freezero memmem]) AC_CHECK_FUNCS([readpassphrase reallocarray recallocarray]) -AC_CHECK_FUNCS([strlcat strlcpy strndup strnlen strsep strtonum]) +AC_CHECK_FUNCS([strcasecmp strlcat strlcpy strndup strnlen strsep strtonum]) AC_CHECK_FUNCS([timegm _mkgmtime timespecsub]) AC_CHECK_FUNCS([getopt getprogname syslog syslog_r]) AC_CACHE_CHECK([for getpagesize], ac_cv_func_getpagesize, [ @@ -30,6 +30,7 @@ AM_CONDITIONAL([HAVE_MEMMEM], [test "x$ac_cv_func_memmem" = xyes]) AM_CONDITIONAL([HAVE_READPASSPHRASE], [test "x$ac_cv_func_readpassphrase" = xyes]) AM_CONDITIONAL([HAVE_REALLOCARRAY], [test "x$ac_cv_func_reallocarray" = xyes]) AM_CONDITIONAL([HAVE_RECALLOCARRAY], [test "x$ac_cv_func_recallocarray" = xyes]) +AM_CONDITIONAL([HAVE_STRCASECMP], [test "x$ac_cv_func_strcasecmp" = xyes]) AM_CONDITIONAL([HAVE_STRLCAT], [test "x$ac_cv_func_strlcat" = xyes]) AM_CONDITIONAL([HAVE_STRLCPY], [test "x$ac_cv_func_strlcpy" = xyes]) AM_CONDITIONAL([HAVE_STRNDUP], [test "x$ac_cv_func_strndup" = xyes]) From c54bd8ba318dec4b4fbf4df1d92acbe2c032f3fd Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 11 Dec 2023 17:56:33 +0100 Subject: [PATCH 0529/1283] Fix a few symbols in EXTRA_EXPORT I thought we stopped doing this, but that's for a separate thread. --- crypto/CMakeLists.txt | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 6056471510..8046efe87f 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -767,13 +767,13 @@ endif() if(NOT HAVE_ASPRINTF) set(CRYPTO_SRC ${CRYPTO_SRC} compat/bsd-asprintf.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} asprintf) - set(EXTRA_EXPORT ${EXTRA_EXPORT} vasprintf) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_asprintf) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_vasprintf) endif() if(NOT HAVE_FREEZERO) set(CRYPTO_SRC ${CRYPTO_SRC} compat/freezero.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} freezero) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_freezero) endif() if(NOT HAVE_GETOPT) @@ -799,46 +799,46 @@ endif() if(NOT HAVE_REALLOCARRAY) set(CRYPTO_SRC ${CRYPTO_SRC} compat/reallocarray.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} reallocarray) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_reallocarray) endif() if(NOT HAVE_RECALLOCARRAY) set(CRYPTO_SRC ${CRYPTO_SRC} compat/recallocarray.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} recallocarray) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_recallocarray) endif() if(NOT HAVE_STRCASECMP) set(CRYPTO_SRC ${CRYPTO_SRC} compat/strcasecmp.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} strcasecmp) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_strcasecmp) endif() if(NOT HAVE_STRLCAT) set(CRYPTO_SRC ${CRYPTO_SRC} compat/strlcat.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} strlcat) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_strlcat) endif() if(NOT HAVE_STRLCPY) set(CRYPTO_SRC ${CRYPTO_SRC} compat/strlcpy.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} strlcpy) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_strlcpy) endif() if(NOT HAVE_STRNDUP) set(CRYPTO_SRC ${CRYPTO_SRC} compat/strndup.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} strndup) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_strndup) if(NOT HAVE_STRNLEN) set(CRYPTO_SRC ${CRYPTO_SRC} compat/strnlen.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} strnlen) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_strnlen) endif() endif() if(NOT HAVE_STRSEP) set(CRYPTO_SRC ${CRYPTO_SRC} compat/strsep.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} strsep) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_strsep) endif() if(NOT HAVE_STRTONUM) set(CRYPTO_SRC ${CRYPTO_SRC} compat/strtonum.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} strtonum) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_strtonum) endif() if(NOT HAVE_SYSLOG_R) @@ -857,15 +857,15 @@ if(NOT HAVE_EXPLICIT_BZERO) set(CRYPTO_SRC ${CRYPTO_SRC} compat/explicit_bzero.c) set_source_files_properties(compat/explicit_bzero.c PROPERTIES COMPILE_FLAGS -O0) endif() - set(EXTRA_EXPORT ${EXTRA_EXPORT} explicit_bzero) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_explicit_bzero) endif() if(NOT HAVE_ARC4RANDOM_BUF) set(CRYPTO_SRC ${CRYPTO_SRC} compat/arc4random.c) set(CRYPTO_SRC ${CRYPTO_SRC} compat/arc4random_uniform.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} arc4random) - set(EXTRA_EXPORT ${EXTRA_EXPORT} arc4random_buf) - set(EXTRA_EXPORT ${EXTRA_EXPORT} arc4random_uniform) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_arc4random) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_arc4random_buf) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_arc4random_uniform) if(NOT HAVE_GETENTROPY) if(WIN32) @@ -891,12 +891,12 @@ endif() if(NOT HAVE_TIMINGSAFE_BCMP) set(CRYPTO_SRC ${CRYPTO_SRC} compat/timingsafe_bcmp.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} timingsafe_bcmp) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_timingsafe_bcmp) endif() if(NOT HAVE_TIMINGSAFE_MEMCMP) set(CRYPTO_SRC ${CRYPTO_SRC} compat/timingsafe_memcmp.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} timingsafe_memcmp) + set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_timingsafe_memcmp) endif() if(NOT ENABLE_ASM) @@ -919,6 +919,7 @@ foreach(SYM IN LISTS CRYPTO_UNEXPORT) string(REPLACE "${SYM}\n" "" SYMS ${SYMS}) endforeach() file(WRITE ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym ${SYMS}) +# XXX should we still be doing this? if(EXTRA_EXPORT) list(SORT EXTRA_EXPORT) foreach(SYM IN LISTS EXTRA_EXPORT) From 529f90ddd8f95664e53a818536f093f2d936bd44 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Mon, 11 Dec 2023 21:53:59 +0000 Subject: [PATCH 0530/1283] windows: minor compat header fixes - posix_win.c: use `snprintf` as-is with _MSC_VER >= 1900 - stdio.h: include socket header before windows.h - pthread.h: delete exec permission from source file --- crypto/compat/posix_win.c | 2 +- include/compat/pthread.h | 0 include/compat/stdio.h | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-) mode change 100755 => 100644 include/compat/pthread.h diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index b3a4687212..c7cf6af3d8 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -9,8 +9,8 @@ #define NO_REDEF_POSIX_FUNCTIONS -#include #include +#include #include #include diff --git a/include/compat/pthread.h b/include/compat/pthread.h old mode 100755 new mode 100644 diff --git a/include/compat/stdio.h b/include/compat/stdio.h index d5725c9ac9..1874aa5ebd 100644 --- a/include/compat/stdio.h +++ b/include/compat/stdio.h @@ -42,7 +42,7 @@ int posix_rename(const char *oldpath, const char *newpath); #define rename(oldpath, newpath) posix_rename(oldpath, newpath) #endif -#ifdef _MSC_VER +#if defined(_MSC_VER) && _MSC_VER < 1900 #define snprintf _snprintf #endif From a553514cd9270ae90b27dffb7481cd459905d787 Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Tue, 12 Dec 2023 00:28:52 +0100 Subject: [PATCH 0531/1283] CI: automatically create release, upload windows builds --- .github/workflows/release_by_tag.yml | 66 ++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 .github/workflows/release_by_tag.yml diff --git a/.github/workflows/release_by_tag.yml b/.github/workflows/release_by_tag.yml new file mode 100644 index 0000000000..75b695eda4 --- /dev/null +++ b/.github/workflows/release_by_tag.yml @@ -0,0 +1,66 @@ + +on: + push: + tags: [ "v*" ] + +permissions: write-all + +jobs: + release: + runs-on: ubuntu-latest + outputs: + upload_url: ${{ steps.create_release.outputs.upload_url }} + steps: + - id: create_release + uses: actions/create-release@v1 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + tag_name: ${{ github.ref }} + release_name: Release ${{ github.ref }} + draft: false + prerelease: false + + build-windows: + needs: release + strategy: + matrix: + arch: [ Win32, x64, ARM64 ] + runs-on: windows-2022 + name: windows - ${{ matrix.arch }} + steps: + - uses: msys2/setup-msys2@v2 + with: + update: true + install: >- + autoconf + automake + diffutils + libtool + gcc + git + patch + perl + - uses: actions/checkout@main + - shell: msys2 {0} + run: ./autogen.sh + - shell: cmd + run: cmake -Bbuild -G "Visual Studio 17 2022" -A ${{ matrix.arch }} -DCMAKE_INSTALL_PREFIX=local + - shell: cmd + run: cmake --build build --config Release + - shell: cmd + run: cmake --install build --config Release + - shell: pwsh + run: | + Compress-Archive -Path local\* local.zip + + - name: upload release + uses: actions/upload-release-asset@v1 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + upload_url: ${{ needs.release.outputs.upload_url }} + asset_path: local.zip + asset_name: windows-${{ matrix.arch }}-${{ github.ref }} + asset_content_type: application/zip + From bb6a55be82ba2f42c38e24888873b7c988a466bc Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Tue, 12 Dec 2023 08:17:48 +0100 Subject: [PATCH 0532/1283] Update .github/workflows/release_by_tag.yml Co-authored-by: Joshua Sing --- .github/workflows/release_by_tag.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release_by_tag.yml b/.github/workflows/release_by_tag.yml index 75b695eda4..14072ce070 100644 --- a/.github/workflows/release_by_tag.yml +++ b/.github/workflows/release_by_tag.yml @@ -3,7 +3,8 @@ on: push: tags: [ "v*" ] -permissions: write-all +permissions: + contents: write jobs: release: From 223bc4e01e283db48693f631852a0f83ea232308 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 12 Dec 2023 13:57:56 +0100 Subject: [PATCH 0533/1283] zap stray whitespace --- .github/workflows/release_by_tag.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release_by_tag.yml b/.github/workflows/release_by_tag.yml index 14072ce070..ed056199fe 100644 --- a/.github/workflows/release_by_tag.yml +++ b/.github/workflows/release_by_tag.yml @@ -1,5 +1,5 @@ -on: +on: push: tags: [ "v*" ] From 0491aef86c41e9d1de19a64e1780ff82d35ccf54 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 12 Dec 2023 23:20:44 +0100 Subject: [PATCH 0534/1283] pthreads.h: avoid undefined behavior You can't pass a function pointer through a void pointer. So wrap the pthread callback in a struct. Fixes #966 --- include/compat/pthread.h | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/include/compat/pthread.h b/include/compat/pthread.h index 1ab011c396..ed1b9dc51a 100644 --- a/include/compat/pthread.h +++ b/include/compat/pthread.h @@ -30,18 +30,23 @@ struct pthread_once { }; typedef struct pthread_once pthread_once_t; +struct _pthread_win32_cb_arg { + void (*cb)(void); +}; + static inline BOOL CALLBACK _pthread_once_win32_cb(PINIT_ONCE once, PVOID param, PVOID *context) { - void (*cb) (void) = param; - cb(); + struct _pthread_win32_cb_arg *arg = param; + arg->cb(); return TRUE; } static inline int pthread_once(pthread_once_t *once, void (*cb) (void)) { - BOOL rc = InitOnceExecuteOnce(&once->once, _pthread_once_win32_cb, cb, NULL); + struct _pthread_win32_cb_arg arg = { .cb = cb }; + BOOL rc = InitOnceExecuteOnce(&once->once, _pthread_once_win32_cb, &arg, NULL); if (rc == 0) return -1; else From 910aa6a9b8b833362c19a8b2dc3a863607c04e75 Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Wed, 13 Dec 2023 00:42:33 +0100 Subject: [PATCH 0535/1283] CI: fix automatic releases assets extension "zip" --- .github/workflows/release_by_tag.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/release_by_tag.yml b/.github/workflows/release_by_tag.yml index ed056199fe..de05254480 100644 --- a/.github/workflows/release_by_tag.yml +++ b/.github/workflows/release_by_tag.yml @@ -62,6 +62,5 @@ jobs: with: upload_url: ${{ needs.release.outputs.upload_url }} asset_path: local.zip - asset_name: windows-${{ matrix.arch }}-${{ github.ref }} + asset_name: windows-${{ matrix.arch }}-${{ github.ref }}.zip asset_content_type: application/zip - From 848950877fb2d66d76cb1258fc28a2b1b453a42d Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Thu, 14 Dec 2023 03:36:09 +0000 Subject: [PATCH 0536/1283] cmake: stop exporting compat functions --- CMakeLists.txt | 6 +- apps/ocspcheck/CMakeLists.txt | 2 +- apps/openssl/CMakeLists.txt | 2 +- crypto/CMakeLists.txt | 111 ++++++++++++---------------------- ssl/CMakeLists.txt | 2 +- tls/CMakeLists.txt | 30 +++++---- 6 files changed, 63 insertions(+), 90 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index ac3e5a0e6d..32b5b15e42 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -413,11 +413,11 @@ set(LIBTLS_LIBS tls ${PLATFORM_LIBS}) # libraries for regression test if(BUILD_SHARED_LIBS) - set(OPENSSL_TEST_LIBS ssl-static crypto-static ${PLATFORM_LIBS}) + set(OPENSSL_TEST_LIBS ssl-static crypto-static ${PLATFORM_LIBS} compat_obj) set(LIBTLS_TEST_LIBS tls-static ${OPENSSL_TEST_LIBS}) else() - set(OPENSSL_TEST_LIBS ssl crypto ${PLATFORM_LIBS}) - set(LIBTLS_TEST_LIBS tls ${PLATFORM_LIBS}) + set(OPENSSL_TEST_LIBS ssl crypto ${PLATFORM_LIBS} compat_obj) + set(LIBTLS_TEST_LIBS tls ${PLATFORM_LIBS} compat_obj) endif() if(OPENSSLDIR STREQUAL "") diff --git a/apps/ocspcheck/CMakeLists.txt b/apps/ocspcheck/CMakeLists.txt index 41c7845ec7..778e837629 100644 --- a/apps/ocspcheck/CMakeLists.txt +++ b/apps/ocspcheck/CMakeLists.txt @@ -20,7 +20,7 @@ target_include_directories(ocspcheck PUBLIC ../../include ${CMAKE_BINARY_DIR}/include) -target_link_libraries(ocspcheck tls ${OPENSSL_LIBS}) +target_link_libraries(ocspcheck tls ${OPENSSL_LIBS} compat_obj tls_compat_obj) if(ENABLE_LIBRESSL_INSTALL) install(TARGETS ocspcheck DESTINATION ${CMAKE_INSTALL_BINDIR}) diff --git a/apps/openssl/CMakeLists.txt b/apps/openssl/CMakeLists.txt index efea2175ed..f2dcf97c6a 100644 --- a/apps/openssl/CMakeLists.txt +++ b/apps/openssl/CMakeLists.txt @@ -75,7 +75,7 @@ target_include_directories(openssl PUBLIC ../../include ${CMAKE_BINARY_DIR}/include) -target_link_libraries(openssl ${OPENSSL_LIBS}) +target_link_libraries(openssl ${OPENSSL_LIBS} compat_obj) if(ENABLE_LIBRESSL_INSTALL) install(TARGETS openssl DESTINATION ${CMAKE_INSTALL_BINDIR}) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 8046efe87f..496d64bba5 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -734,6 +734,8 @@ set( x509/x_all.c ) +set(COMPAT_SRC "") + if(UNIX) set(CRYPTO_SRC ${CRYPTO_SRC} crypto_lock.c) set(CRYPTO_SRC ${CRYPTO_SRC} bio/b_posix.c) @@ -749,38 +751,19 @@ if(WIN32) endif() if(WIN32) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/posix_win.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} gettimeofday) - set(EXTRA_EXPORT ${EXTRA_EXPORT} getuid) - set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_perror) - set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_fopen) - set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_fgets) - set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_open) - set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_rename) - set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_connect) - set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_close) - set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_read) - set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_write) - set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_getsockopt) - set(EXTRA_EXPORT ${EXTRA_EXPORT} posix_setsockopt) + set(COMPAT_SRC ${COMPAT_SRC} compat/posix_win.c) endif() if(NOT HAVE_ASPRINTF) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/bsd-asprintf.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_asprintf) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_vasprintf) + set(COMPAT_SRC ${COMPAT_SRC} compat/bsd-asprintf.c) endif() if(NOT HAVE_FREEZERO) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/freezero.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_freezero) + set(COMPAT_SRC ${COMPAT_SRC} compat/freezero.c) endif() if(NOT HAVE_GETOPT) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/getopt_long.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} getopt) - set(EXTRA_EXPORT ${EXTRA_EXPORT} optarg) - set(EXTRA_EXPORT ${EXTRA_EXPORT} optind) + set(COMPAT_SRC ${COMPAT_SRC} compat/getopt_long.c) endif() if(NOT HAVE_GETPAGESIZE) @@ -798,47 +781,38 @@ if(NOT HAVE_GETPROGNAME) endif() if(NOT HAVE_REALLOCARRAY) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/reallocarray.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_reallocarray) + set(COMPAT_SRC ${COMPAT_SRC} compat/reallocarray.c) endif() if(NOT HAVE_RECALLOCARRAY) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/recallocarray.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_recallocarray) + set(COMPAT_SRC ${COMPAT_SRC} compat/recallocarray.c) endif() if(NOT HAVE_STRCASECMP) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/strcasecmp.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_strcasecmp) + set(COMPAT_SRC ${COMPAT_SRC} compat/strcasecmp.c) endif() if(NOT HAVE_STRLCAT) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/strlcat.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_strlcat) + set(COMPAT_SRC ${COMPAT_SRC} compat/strlcat.c) endif() if(NOT HAVE_STRLCPY) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/strlcpy.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_strlcpy) + set(COMPAT_SRC ${COMPAT_SRC} compat/strlcpy.c) endif() if(NOT HAVE_STRNDUP) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/strndup.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_strndup) + set(COMPAT_SRC ${COMPAT_SRC} compat/strndup.c) if(NOT HAVE_STRNLEN) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/strnlen.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_strnlen) + set(COMPAT_SRC ${COMPAT_SRC} compat/strnlen.c) endif() endif() if(NOT HAVE_STRSEP) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/strsep.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_strsep) + set(COMPAT_SRC ${COMPAT_SRC} compat/strsep.c) endif() if(NOT HAVE_STRTONUM) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/strtonum.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_strtonum) + set(COMPAT_SRC ${COMPAT_SRC} compat/strtonum.c) endif() if(NOT HAVE_SYSLOG_R) @@ -846,57 +820,49 @@ if(NOT HAVE_SYSLOG_R) endif() if(NOT HAVE_TIMEGM) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/timegm.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} timegm) + set(COMPAT_SRC ${COMPAT_SRC} compat/timegm.c) endif() if(NOT HAVE_EXPLICIT_BZERO) if(WIN32) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/explicit_bzero_win.c) + set(COMPAT_SRC ${COMPAT_SRC} compat/explicit_bzero_win.c) else() - set(CRYPTO_SRC ${CRYPTO_SRC} compat/explicit_bzero.c) + set(COMPAT_SRC ${COMPAT_SRC} compat/explicit_bzero.c) set_source_files_properties(compat/explicit_bzero.c PROPERTIES COMPILE_FLAGS -O0) endif() - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_explicit_bzero) endif() if(NOT HAVE_ARC4RANDOM_BUF) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/arc4random.c) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/arc4random_uniform.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_arc4random) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_arc4random_buf) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_arc4random_uniform) + set(COMPAT_SRC ${COMPAT_SRC} compat/arc4random.c) + set(COMPAT_SRC ${COMPAT_SRC} compat/arc4random_uniform.c) if(NOT HAVE_GETENTROPY) if(WIN32) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/getentropy_win.c) + set(COMPAT_SRC ${COMPAT_SRC} compat/getentropy_win.c) elseif(CMAKE_SYSTEM_NAME MATCHES "AIX") - set(CRYPTO_SRC ${CRYPTO_SRC} compat/getentropy_aix.c) + set(COMPAT_SRC ${COMPAT_SRC} compat/getentropy_aix.c) elseif(CMAKE_SYSTEM_NAME MATCHES "FreeBSD") - set(CRYPTO_SRC ${CRYPTO_SRC} compat/getentropy_freebsd.c) + set(COMPAT_SRC ${COMPAT_SRC} compat/getentropy_freebsd.c) elseif(CMAKE_SYSTEM_NAME MATCHES "HP-UX") - set(CRYPTO_SRC ${CRYPTO_SRC} compat/getentropy_hpux.c) + set(COMPAT_SRC ${COMPAT_SRC} compat/getentropy_hpux.c) elseif(CMAKE_SYSTEM_NAME MATCHES "Linux") - set(CRYPTO_SRC ${CRYPTO_SRC} compat/getentropy_linux.c) + set(COMPAT_SRC ${COMPAT_SRC} compat/getentropy_linux.c) elseif(CMAKE_SYSTEM_NAME MATCHES "NetBSD") - set(CRYPTO_SRC ${CRYPTO_SRC} compat/getentropy_netbsd.c) + set(COMPAT_SRC ${COMPAT_SRC} compat/getentropy_netbsd.c) elseif(CMAKE_SYSTEM_NAME MATCHES "Darwin") - set(CRYPTO_SRC ${CRYPTO_SRC} compat/getentropy_osx.c) + set(COMPAT_SRC ${COMPAT_SRC} compat/getentropy_osx.c) elseif(CMAKE_SYSTEM_NAME MATCHES "SunOS") - set(CRYPTO_SRC ${CRYPTO_SRC} compat/getentropy_solaris.c) + set(COMPAT_SRC ${COMPAT_SRC} compat/getentropy_solaris.c) endif() - set(EXTRA_EXPORT ${EXTRA_EXPORT} getentropy) endif() endif() if(NOT HAVE_TIMINGSAFE_BCMP) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/timingsafe_bcmp.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_timingsafe_bcmp) + set(COMPAT_SRC ${COMPAT_SRC} compat/timingsafe_bcmp.c) endif() if(NOT HAVE_TIMINGSAFE_MEMCMP) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/timingsafe_memcmp.c) - set(EXTRA_EXPORT ${EXTRA_EXPORT} libressl_timingsafe_memcmp) + set(COMPAT_SRC ${COMPAT_SRC} compat/timingsafe_memcmp.c) endif() if(NOT ENABLE_ASM) @@ -919,15 +885,14 @@ foreach(SYM IN LISTS CRYPTO_UNEXPORT) string(REPLACE "${SYM}\n" "" SYMS ${SYMS}) endforeach() file(WRITE ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym ${SYMS}) -# XXX should we still be doing this? -if(EXTRA_EXPORT) - list(SORT EXTRA_EXPORT) - foreach(SYM IN LISTS EXTRA_EXPORT) - file(APPEND ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym "${SYM}\n") - endforeach() -endif() -set(LIBTLS_EXTRA_EXPORT ${EXTRA_EXPORT} PARENT_SCOPE) +add_library(compat_obj OBJECT ${COMPAT_SRC}) +target_include_directories(compat_obj + PRIVATE + ../include/compat + PUBLIC + ../include + ${CMAKE_BINARY_DIR}/include) add_library(crypto_obj OBJECT ${CRYPTO_SRC}) target_include_directories(crypto_obj @@ -977,7 +942,7 @@ elseif(HOST_X86_64) target_include_directories(crypto_obj PRIVATE bn/arch/amd64) endif() -add_library(crypto $ empty.c) +add_library(crypto $ $ empty.c) export_symbol(crypto ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym) target_link_libraries(crypto ${PLATFORM_LIBS}) diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 22385ba1f1..9be9e99858 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -78,7 +78,7 @@ target_include_directories(bs_obj ../include/compat) if(BUILD_SHARED_LIBS) - add_library(ssl $ $) + add_library(ssl $ $ $) else() add_library(ssl $ empty.c) endif() diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index c3c942446f..33ae1849d0 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -14,28 +14,32 @@ set( tls_verify.c ) +set(TLS_COMPAT_SRC "") + if(WIN32) set( TLS_SRC ${TLS_SRC} - compat/ftruncate.c - compat/pread.c - compat/pwrite.c ) - set(LIBTLS_EXTRA_EXPORT ${LIBTLS_EXTRA_EXPORT} ftruncate) + set(TLS_COMPAT_SRC ${TLS_COMPAT_SRC} compat/ftruncate.c) + set(TLS_COMPAT_SRC ${TLS_COMPAT_SRC} compat/pread.c) + set(TLS_COMPAT_SRC ${TLS_COMPAT_SRC} compat/pwrite.c) endif() add_definitions(-DTLS_DEFAULT_CA_FILE=\"${OPENSSLDIR}/cert.pem\") file(COPY ${CMAKE_CURRENT_SOURCE_DIR}/tls.sym DESTINATION ${CMAKE_CURRENT_BINARY_DIR}) -if(LIBTLS_EXTRA_EXPORT) - list(SORT LIBTLS_EXTRA_EXPORT) - foreach(SYM IN LISTS LIBTLS_EXTRA_EXPORT) - file(APPEND ${CMAKE_CURRENT_BINARY_DIR}/tls.sym "${SYM}\n") - endforeach() -endif() + +add_library(tls_compat_obj OBJECT ${TLS_COMPAT_SRC}) +target_include_directories(tls_compat_obj + PRIVATE + . + ../include/compat + PUBLIC + ../include + ${CMAKE_BINARY_DIR}/include) add_library(tls_obj OBJECT ${TLS_SRC}) target_include_directories(tls_obj @@ -46,7 +50,11 @@ target_include_directories(tls_obj ../include ${CMAKE_BINARY_DIR}/include) -add_library(tls $ empty.c) +if(BUILD_SHARED_LIBS) + add_library(tls $ $ $ empty.c) +else() + add_library(tls $ $ empty.c) +endif() export_symbol(tls ${CMAKE_CURRENT_BINARY_DIR}/tls.sym) target_link_libraries(tls ${OPENSSL_LIBS}) From 834434b27dfd02a51c6f71938eb6ec9096ec0b6c Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Thu, 14 Dec 2023 03:45:52 +0000 Subject: [PATCH 0537/1283] try avoiding empty compat libs --- crypto/CMakeLists.txt | 2 +- tls/CMakeLists.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 496d64bba5..128a7748f4 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -734,7 +734,7 @@ set( x509/x_all.c ) -set(COMPAT_SRC "") +set(COMPAT_SRC empty.c) if(UNIX) set(CRYPTO_SRC ${CRYPTO_SRC} crypto_lock.c) diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 33ae1849d0..919b1fa7bb 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -14,7 +14,7 @@ set( tls_verify.c ) -set(TLS_COMPAT_SRC "") +set(TLS_COMPAT_SRC empty.c) if(WIN32) set( From fccbb9b556e4922380c296ee03364fb2cde87d13 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Thu, 14 Dec 2023 04:39:35 +0000 Subject: [PATCH 0538/1283] nc needs compat_obj on some platforms --- apps/nc/CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/nc/CMakeLists.txt b/apps/nc/CMakeLists.txt index 868b797361..7bbdb025f0 100644 --- a/apps/nc/CMakeLists.txt +++ b/apps/nc/CMakeLists.txt @@ -40,7 +40,7 @@ target_include_directories(nc PUBLIC ../../include ${CMAKE_BINARY_DIR}/include) -target_link_libraries(nc ${LIBTLS_LIBS}) +target_link_libraries(nc ${LIBTLS_LIBS} compat_obj) if(ENABLE_NC) if(ENABLE_LIBRESSL_INSTALL) From 906e10ea83472110616d28831bc000a3e5ab4225 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Thu, 14 Dec 2023 04:59:04 +0000 Subject: [PATCH 0539/1283] try fixing missing tls-compat for tests --- CMakeLists.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 32b5b15e42..bba5a02890 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -414,10 +414,10 @@ set(LIBTLS_LIBS tls ${PLATFORM_LIBS}) # libraries for regression test if(BUILD_SHARED_LIBS) set(OPENSSL_TEST_LIBS ssl-static crypto-static ${PLATFORM_LIBS} compat_obj) - set(LIBTLS_TEST_LIBS tls-static ${OPENSSL_TEST_LIBS}) + set(LIBTLS_TEST_LIBS tls-static ${OPENSSL_TEST_LIBS} tls_compat_obj) else() set(OPENSSL_TEST_LIBS ssl crypto ${PLATFORM_LIBS} compat_obj) - set(LIBTLS_TEST_LIBS tls ${PLATFORM_LIBS} compat_obj) + set(LIBTLS_TEST_LIBS tls ${PLATFORM_LIBS} compat_obj tls_compat_obj) endif() if(OPENSSLDIR STREQUAL "") From 5bb45527ea0bbc22a9b8da4c5990c80f12c5d8de Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 14 Dec 2023 08:38:09 +0100 Subject: [PATCH 0540/1283] Add reminder to remove timegm after the next library bump --- crypto/CMakeLists.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 128a7748f4..d545325ab9 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -820,6 +820,7 @@ if(NOT HAVE_SYSLOG_R) endif() if(NOT HAVE_TIMEGM) + # XXX - Remove after next bump once libtls, ocspcheck, and asn1time are fixed. set(COMPAT_SRC ${COMPAT_SRC} compat/timegm.c) endif() From 17cf672a04ad1e105b21182bf936234ba95d2ac3 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Thu, 14 Dec 2023 13:43:04 +0000 Subject: [PATCH 0541/1283] cmake: limit some macros to mingw Syncing this up with autotools. Also use the built-in `MINGW` variable. --- CMakeLists.txt | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index bba5a02890..6cb96f8008 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -84,12 +84,14 @@ if(CMAKE_SYSTEM_NAME MATCHES "Linux") set(PLATFORM_LIBS ${PLATFORM_LIBS} pthread) endif() -if(WIN32 OR (CMAKE_SYSTEM_NAME MATCHES "MINGW")) +if(WIN32) set(BUILD_NC false) - add_definitions(-D_GNU_SOURCE) - add_definitions(-D_POSIX) - add_definitions(-D_POSIX_SOURCE) - add_definitions(-D__USE_MINGW_ANSI_STDIO) + if(MINGW) + add_definitions(-D_GNU_SOURCE) + add_definitions(-D_POSIX) + add_definitions(-D_POSIX_SOURCE) + add_definitions(-D__USE_MINGW_ANSI_STDIO) + endif() endif() set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall") From 3994fee6beb5b676b207d4af81c65e1287b20874 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 14 Dec 2023 18:16:46 +0100 Subject: [PATCH 0542/1283] Update ChangeLog --- ChangeLog | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ChangeLog b/ChangeLog index c30fd8ef31..eaee6b0450 100644 --- a/ChangeLog +++ b/ChangeLog @@ -31,9 +31,14 @@ LibreSSL Portable Release Notes: 3.9.0 - In development * Portable changes + - libcrypto no longer exports compat symbols in cmake builds. + - Most compatibility symbols are prefixed with libressl_ to avoid + symbol clashes in static links. + - Fixed various warnings on Windows. * Internal improvements - Converted uses of OBJ_bsearch_() to standard bsearch(). - Greatly simplified by_file_ctrl(). + - Simplified and cleaned up the OBJ_ API. * Documentation improvements - ENGINE documentation was updated to reflect reality. - Made EVP API documentation more accurate and less incoherent. From f6f90b977913fbd1951c249f6e7bbf76ea32de77 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 14 Dec 2023 18:28:55 +0100 Subject: [PATCH 0543/1283] Fix build on windows --- include/compat/syslog.h | 1 + 1 file changed, 1 insertion(+) diff --git a/include/compat/syslog.h b/include/compat/syslog.h index f400ff66d5..c7a2608bdc 100644 --- a/include/compat/syslog.h +++ b/include/compat/syslog.h @@ -15,6 +15,7 @@ #include #ifdef _WIN32 +#define LOG_CONS LOG_INFO #define LOG_INFO 6 /* informational */ #define LOG_USER (1<<3) /* random user-level messages */ #define LOG_LOCAL2 (18<<3) /* reserved for local use */ From 77f1dbb7887443af6c3a20742bc1f76fdee8801f Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Fri, 15 Dec 2023 15:16:02 +1100 Subject: [PATCH 0544/1283] ci: reenable and clean up solaris workflow --- .github/workflows/solaris.yml | 31 ++++++++++++++++++++++++++++++ .github/workflows/solaris_test.yml | 28 --------------------------- 2 files changed, 31 insertions(+), 28 deletions(-) create mode 100644 .github/workflows/solaris.yml delete mode 100644 .github/workflows/solaris_test.yml diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml new file mode 100644 index 0000000000..415ff1fd89 --- /dev/null +++ b/.github/workflows/solaris.yml @@ -0,0 +1,31 @@ +# GitHub Actions workflow to run tests on a Solaris VM. +name: "Solaris" + +on: + workflow_dispatch: + schedule: + - cron: "0 0 * * *" # At 00:00 daily. + +jobs: + test: + name: "Solaris" + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: "Checkout repository" + uses: actions/checkout@v4 + + - name: "Setup" + run: | + apt-get install automake autoconf libtool + ./autogen.sh + + - name: "Build on VM" + uses: vmactions/solaris-vm@v1 + with: + prepare: | + pkg install gcc make + run: | + MAKE=gmake ./configure + gmake -j2 check || (cat tests/test-suite.log && exit 1) diff --git a/.github/workflows/solaris_test.yml b/.github/workflows/solaris_test.yml deleted file mode 100644 index 6470278ba8..0000000000 --- a/.github/workflows/solaris_test.yml +++ /dev/null @@ -1,28 +0,0 @@ -name: solaris_ci - -on: - workflow_dispatch: - -jobs: - build-native: - strategy: - matrix: - release: [11.4] - runs-on: ubuntu-latest - continue-on-error: false - name: Solaris ${{ matrix.release }} - steps: - - name: Checkout source - uses: actions/checkout@main - - name: Configure source - run: | - brew install automake autoconf libtool - ./autogen.sh - - name: Build on VM - uses: vmactions/solaris-vm@v1 - with: - prepare: | - pkg install gcc make - run: | - MAKE=gmake ./configure - gmake -j2 check || (cat tests/test-suite.log && exit 1) From b5940135e8302915902ee7428e150089c1f7fe39 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Fri, 15 Dec 2023 16:20:21 +1100 Subject: [PATCH 0545/1283] ci: cleanup coverity workflow --- .github/workflows/coverity.yml | 97 ++++++++++++++++++++-------------- 1 file changed, 57 insertions(+), 40 deletions(-) diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index e1bfcb0c96..7b01aa4ce1 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -1,48 +1,65 @@ -name: Coverity +# GitHub Actions workflow to run Coverity scans. +name: "Coverity" on: workflow_dispatch: schedule: - - cron: "0 0 * * *" + - cron: "0 0 * * *" # At 00:00 daily. jobs: scan: - runs-on: ubuntu-latest - if: ${{ github.repository_owner == 'libressl' }} + name: "Scan" + runs-on: "ubuntu-latest" + if: github.repository_owner == 'libressl' # Prevent running on forks + permissions: + contents: read steps: - - uses: actions/checkout@main - - name: Install apt dependencies - run: | - sudo apt-get update - sudo apt-get install -y cmake ninja-build - - name: Download Coverity build tool - run: | - wget -c -N https://scan.coverity.com/download/linux64 --post-data "token=${{ secrets.COVERITY_SCAN_TOKEN }}&project=libressl-portable%2Fportable" -O coverity_tool.tar.gz - mkdir coverity_tool - tar xzf coverity_tool.tar.gz --strip 1 -C coverity_tool - - name: Configure - run: | - ./autogen.sh - ./configure - make dist - tar zxf libressl-*.tar.gz - rm libressl-*.tar.gz - cd libressl-* - mkdir build-static - mkdir build-shared - cmake -GNinja -DBUILD_SHARED_LIBS=ON .. - - name: Build with Coverity build tool - run: | - export PATH=`pwd`/coverity_tool/bin:$PATH - cd libressl-* - cov-build --dir cov-int ninja - - name: Submit build result to Coverity Scan - run: | - cd libressl-* - tar czvf cov.tar.gz cov-int - curl --form token=${{ secrets.COVERITY_SCAN_TOKEN }} \ - --form email=libressl-security@openbsd.org \ - --form file=@cov.tar.gz \ - --form version="Commit $GITHUB_SHA" \ - --form description="Build submitted via CI" \ - https://scan.coverity.com/builds?project=libressl-portable%2Fportable + - name: "Checkout repository" + uses: actions/checkout@v4 + + - name: "Install dependencies" + run: | + sudo apt-get update + sudo apt-get install -y cmake ninja-build + + - name: "Download Coverity build tool" + env: + PROJECT: "libressl-portable%2Fportable" + COVERITY_SCAN_TOKEN: "${{ secrets.COVERITY_SCAN_TOKEN }}" + run: | + wget -c -N https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$PROJECT" -O coverity_tool.tar.gz + mkdir coverity_tool + tar xzf coverity_tool.tar.gz --strip 1 -C coverity_tool + + - name: "Setup" + run: | + ./autogen.sh + ./configure + make dist + tar zxf libressl-*.tar.gz + rm libressl-*.tar.gz + cd libressl-* + mkdir build-static + mkdir build-shared + cmake -GNinja -DBUILD_SHARED_LIBS=ON .. + + - name: "Build with Coverity build tool" + run: | + export PATH=`pwd`/coverity_tool/bin:$PATH + cd libressl-* + cov-build --dir cov-int ninja + + - name: "Submit build result to Coverity Scan" + env: + EMAIL: "libressl-security@openbsd.org" + PROJECT: "libressl-portable%2Fportable" + COVERITY_SCAN_TOKEN: "${{ secrets.COVERITY_SCAN_TOKEN }}" + run: | + cd libressl-* + tar czvf cov.tar.gz cov-int + curl --form token=$COVERITY_SCAN_TOKEN \ + --form email=$EMAIL \ + --form file=@cov.tar.gz \ + --form version="Commit $GITHUB_SHA" \ + --form description="Build submitted via CI" \ + https://scan.coverity.com/builds?project=$PROJECT From 06fbf277e4536eddcf4eb61d9ae190b2a2a6634d Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Fri, 15 Dec 2023 16:25:26 +1100 Subject: [PATCH 0546/1283] ci: fix apt commands in solaris workflow --- .github/workflows/solaris.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index 415ff1fd89..2c6ee49ad4 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -18,7 +18,8 @@ jobs: - name: "Setup" run: | - apt-get install automake autoconf libtool + sudo apt-get update + sudo apt-get install -y automake autoconf libtool ./autogen.sh - name: "Build on VM" From c8556c3af812f33499e607361b424c47d0fa6d2c Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Fri, 15 Dec 2023 16:36:25 +1100 Subject: [PATCH 0547/1283] ci: clean up release workflow --- .github/scripts/changelog.sh | 74 +++++++++++++++++++++++++ .github/workflows/release.yml | 81 ++++++++++++++++++++++++++++ .github/workflows/release_by_tag.yml | 66 ----------------------- 3 files changed, 155 insertions(+), 66 deletions(-) create mode 100644 .github/scripts/changelog.sh create mode 100644 .github/workflows/release.yml delete mode 100644 .github/workflows/release_by_tag.yml diff --git a/.github/scripts/changelog.sh b/.github/scripts/changelog.sh new file mode 100644 index 0000000000..76492cf8a5 --- /dev/null +++ b/.github/scripts/changelog.sh @@ -0,0 +1,74 @@ +#!/bin/sh +# Copyright (c) 2023 Joshua Sing +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + +# +# Usage: changelog.sh +# Reads the changelog for the specified version from the changelog file. +# The output will be reformatted for use in GitHub releases. +# +# The changelog file defaults to "ChangeLog", but can be changed by setting +# the environment variable $CHANGELOG_FILE +# + +set -e + +# Check if the version argument is provided +if [ "$#" -ne 1 ]; then + echo "Usage: $0 " + exit 1 +fi + +version="${1#v}" +changelog_file="${CHANGELOG_FILE:-ChangeLog}" +found_version=false +changelog="" + +# Check if the specified changelog file exists +if [ ! -f "$changelog_file" ]; then + echo "Error: Changelog file '$changelog_file' not found" + exit 1 +fi + +# Read the changelog file line by line +while IFS= read -r line; do + # Check for the version line + if echo "$line" | grep -Eq "^${version} - "; then + found_version=true + continue + fi + + # Continue reading the changelog until the next version or end of file, + # skipping empty lines + if $found_version; then + echo "$line" | grep -Eq "^\s*$" && continue + echo "$line" | grep -Eq "^[0-9]+\.[0-9]+\.[0-9]+ - " && break + changelog="${changelog}${line}\n" + fi +done < "$changelog_file" + +# If the specified version was not found, print an error +if ! $found_version; then + echo "Error: Version $version was not found in changelog" + exit 1 +fi + +# Tidy up the changelog for displaying on GitHub +changelog=$(echo "$changelog" | sed -e 's/^\t\*/###/' -e 's/^\t//') + +# Print the changelog for the specified version +echo "$changelog" +echo +echo "Full changelog: https://github.com/libressl/portable/blob/master/ChangeLog" +exit 0 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000000..8230b8222c --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,81 @@ +# GitHub Actions workflow to create releases from tags. +name: "Release" + +on: + push: + tags: [ "v*" ] + +permissions: + contents: write + +jobs: + release: + name: "Release" + runs-on: "ubuntu-latest" + outputs: + upload_url: "${{ steps.create_release.outputs.upload_url }}" + steps: + - name: "Checkout repository" + uses: actions/checkout@v4 + + - name: "Generate version changelog" + run: .github/scripts/changelog.sh "$VERSION" > release-changelog.txt + env: + VERSION: "${{ github.ref_name }}" + + - name: "Create GitHub release" + id: create_release + uses: softprops/action-gh-release@v1 + with: + body_path: "${{ github.workspace }}/release-changelog.txt" + + build-windows: + name: "${{ matrix.os }}/${{ matrix.arch }}" + runs-on: "${{ matrix.os }}" + needs: ["release"] + strategy: + matrix: + os: [ "windows-2022" ] + arch: [ "Win32", "x64", "ARM64" ] + steps: + - name: "Checkout repository" + uses: actions/checkout@v4 + + - name: "Setup MSYS2" + uses: msys2/setup-msys2@v2 + with: + update: true + install: >- + autoconf + automake + diffutils + libtool + gcc + git + patch + perl + + - shell: msys2 {0} + run: ./autogen.sh + + - shell: cmd + run: cmake -Bbuild -G "Visual Studio 17 2022" -A ${{ matrix.arch }} -DCMAKE_INSTALL_PREFIX=local + + - shell: cmd + run: cmake --build build --config Release + + - shell: cmd + run: cmake --install build --config Release + + - shell: pwsh + run: Compress-Archive -Path local\* local.zip + + - name: "Upload release artifact" + uses: actions/upload-release-asset@v1 + env: + GITHUB_TOKEN: "${{ github.token }}" + with: + upload_url: "${{ needs.release.outputs.upload_url }}" + asset_path: "local.zip" + asset_name: "libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip" + asset_content_type: "application/zip" diff --git a/.github/workflows/release_by_tag.yml b/.github/workflows/release_by_tag.yml deleted file mode 100644 index de05254480..0000000000 --- a/.github/workflows/release_by_tag.yml +++ /dev/null @@ -1,66 +0,0 @@ - -on: - push: - tags: [ "v*" ] - -permissions: - contents: write - -jobs: - release: - runs-on: ubuntu-latest - outputs: - upload_url: ${{ steps.create_release.outputs.upload_url }} - steps: - - id: create_release - uses: actions/create-release@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - tag_name: ${{ github.ref }} - release_name: Release ${{ github.ref }} - draft: false - prerelease: false - - build-windows: - needs: release - strategy: - matrix: - arch: [ Win32, x64, ARM64 ] - runs-on: windows-2022 - name: windows - ${{ matrix.arch }} - steps: - - uses: msys2/setup-msys2@v2 - with: - update: true - install: >- - autoconf - automake - diffutils - libtool - gcc - git - patch - perl - - uses: actions/checkout@main - - shell: msys2 {0} - run: ./autogen.sh - - shell: cmd - run: cmake -Bbuild -G "Visual Studio 17 2022" -A ${{ matrix.arch }} -DCMAKE_INSTALL_PREFIX=local - - shell: cmd - run: cmake --build build --config Release - - shell: cmd - run: cmake --install build --config Release - - shell: pwsh - run: | - Compress-Archive -Path local\* local.zip - - - name: upload release - uses: actions/upload-release-asset@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - upload_url: ${{ needs.release.outputs.upload_url }} - asset_path: local.zip - asset_name: windows-${{ matrix.arch }}-${{ github.ref }}.zip - asset_content_type: application/zip From 276e5767f0e681ce880759f96647cf519f362a96 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Fri, 15 Dec 2023 17:04:56 +1100 Subject: [PATCH 0548/1283] Add Solaris workflow badge to readme --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 009efd5016..c623fe99bb 100644 --- a/README.md +++ b/README.md @@ -4,6 +4,7 @@ [![Linux Build Status](https://github.com/libressl/portable/actions/workflows/linux.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/linux.yml) [![macOS Build Status](https://github.com/libressl/portable/actions/workflows/macos.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/macos.yml) [![Android Build Status](https://github.com/libressl/portable/actions/workflows/android.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/android.yml) +[![Solaris Build Status](https://github.com/libressl/portable/actions/workflows/solaris.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/solaris.yml) [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/libressl.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:libressl) LibreSSL is a fork of [OpenSSL](https://www.openssl.org) 1.0.1g developed by the From fc008206b3b67f763f4de7b19887a095a7ac05d0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 15 Dec 2023 22:29:00 +0100 Subject: [PATCH 0549/1283] Unhook string_table test. It will go away. --- .gitignore | 1 - tests/CMakeLists.txt | 5 ----- tests/Makefile.am | 5 ----- 3 files changed, 11 deletions(-) diff --git a/.gitignore b/.gitignore index bdae627a77..b061ae67a0 100644 --- a/.gitignore +++ b/.gitignore @@ -120,7 +120,6 @@ tests/ssl_methods* tests/ssl_set_alpn_protos* tests/ssl_verify_param* tests/ssl_versions* -tests/string_table* tests/timingsafe* tests/tls_ext_alpn* tests/tls_prf* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index aa00455a3d..2beaa29dc4 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -670,11 +670,6 @@ else() endif() set_tests_properties(ssltest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") -# string_table -add_executable(string_table string_table.c) -target_link_libraries(string_table ${OPENSSL_TEST_LIBS}) -add_test(string_table string_table) - # testdsa if(NOT MSVC) add_test(NAME testdsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testdsa.sh) diff --git a/tests/Makefile.am b/tests/Makefile.am index 5d87bde9d7..5ca0fe9de9 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -698,11 +698,6 @@ EXTRA_DIST += server2-ecdsa.pem server2-rsa-chain.pem server2-rsa.pem EXTRA_DIST += server3-ecdsa-chain.pem server3-ecdsa.pem server3-rsa-chain.pem EXTRA_DIST += server3-rsa.pem -# string_table -TESTS += string_table -check_PROGRAMS += string_table -string_table_SOURCES = string_table.c - # testdsa TESTS += testdsa.sh EXTRA_DIST += testdsa.sh testdsa.bat From 0850f783aa131ccb355668ae20da32dd65c85980 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 16 Dec 2023 11:53:57 -0700 Subject: [PATCH 0550/1283] Update man links --- man/links | 2 -- 1 file changed, 2 deletions(-) diff --git a/man/links b/man/links index f5ea0cbfb5..17f908704e 100644 --- a/man/links +++ b/man/links @@ -29,8 +29,6 @@ ASN1_INTEGER_get.3,BN_to_ASN1_INTEGER.3 ASN1_NULL_new.3,ASN1_NULL_free.3 ASN1_OBJECT_new.3,ASN1_OBJECT_create.3 ASN1_OBJECT_new.3,ASN1_OBJECT_free.3 -ASN1_STRING_TABLE_add.3,ASN1_STRING_TABLE_cleanup.3 -ASN1_STRING_TABLE_add.3,ASN1_STRING_TABLE_get.3 ASN1_STRING_length.3,ASN1_OCTET_STRING_cmp.3 ASN1_STRING_length.3,ASN1_OCTET_STRING_dup.3 ASN1_STRING_length.3,ASN1_OCTET_STRING_set.3 From 5107617db58ed76566835eaa5bb5ca4a318435f2 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Tue, 19 Dec 2023 17:21:24 +1100 Subject: [PATCH 0551/1283] ci: clean up windows workflow --- .github/workflows/windows.yml | 66 ++++++++++++++++++++++++++++++ .github/workflows/windows_test.yml | 46 --------------------- 2 files changed, 66 insertions(+), 46 deletions(-) create mode 100644 .github/workflows/windows.yml delete mode 100644 .github/workflows/windows_test.yml diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml new file mode 100644 index 0000000000..421ebf358a --- /dev/null +++ b/.github/workflows/windows.yml @@ -0,0 +1,66 @@ +# GitHub Actions workflow to run tests on Windows. +name: "Windows" + +on: + push: {} + pull_request: {} + schedule: + - cron: "0 0 * * 0" # At 00:00 weekly on Sunday. + +jobs: + test: + name: "${{ matrix.os }}/${{ matrix.arch }}${{ matrix.generator && ' (' + matrix.generator + ')' || '' }}" + runs-on: "${{ matrix.os }}" + permissions: + contents: read + strategy: + fail-fast: false + matrix: + os: ["windows-2022", "windows-2019"] + arch: ["ARM64", "x64", "Win32"] + include: + - os: "windows-2022" + generator: "Visual Studio 17 2022" + - os: "windows-2019" + generator: "Visual Studio 16 2019" + steps: + - name: "Checkout repository" + uses: actions/checkout@v4 + + - name: "Setup MSYS2" + uses: msys2/setup-msys2@v2 + with: + update: true + install: >- + autoconf + automake + diffutils + libtool + gcc + git + patch + perl + + - name: "Setup" + shell: msys2 {0} + run: ./autogen.sh + + - name: "Configure CMake" + shell: cmd + run: cmake -Bbuild -G "${{ matrix.generator }}" -A ${{ matrix.arch }} -DCMAKE_INSTALL_PREFIX=../local + + - name: "Build" + shell: cmd + run: cmake --build build --config Release + + - name: "Test" + if: matrix.arch != 'ARM64' + shell: cmd + run: ctest --test-dir build -C Release --output-on-failure + + - name: "Upload build artifacts" + if: always() + uses: actions/upload-artifact@v4 + with: + name: "${{ matrix.os }}-${{ matrix.arch }}-build-results" + path: "build" diff --git a/.github/workflows/windows_test.yml b/.github/workflows/windows_test.yml deleted file mode 100644 index bac948e9f8..0000000000 --- a/.github/workflows/windows_test.yml +++ /dev/null @@ -1,46 +0,0 @@ -name: windows_ci - -on: [push, pull_request] - -jobs: - build-native: - strategy: - matrix: - os: [windows-2019, windows-2022] - arch: [Win32, x64, ARM64] - include: - - generator: "Visual Studio 16 2019" - os: windows-2019 - - generator: "Visual Studio 17 2022" - os: windows-2022 - runs-on: ${{ matrix.os }} - continue-on-error: false - name: ${{ matrix.os }} - ${{ matrix.arch }} - steps: - - uses: msys2/setup-msys2@v2 - with: - update: true - install: >- - autoconf - automake - diffutils - libtool - gcc - git - patch - perl - - uses: actions/checkout@main - - shell: msys2 {0} - run: ./autogen.sh - - shell: cmd - run: cmake -Bbuild -G "${{ matrix.generator }}" -A ${{ matrix.arch }} -DCMAKE_INSTALL_PREFIX=../local - - shell: cmd - run: cmake --build build --config Release - - shell: cmd - if: ${{ matrix.arch != 'ARM64' }} - run: ctest --test-dir build -C Release --output-on-failure - - uses: actions/upload-artifact@v3 - if: always() - with: - name: windows-build-results-${{ matrix.os }}-${{ matrix.arch }} - path: build From 7108fb424b509f0b5672396e67805213bd73defb Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Tue, 19 Dec 2023 17:22:13 +1100 Subject: [PATCH 0552/1283] readme: add windows badge --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index c623fe99bb..77f9a37a8c 100644 --- a/README.md +++ b/README.md @@ -3,6 +3,7 @@ [![Linux Build Status](https://github.com/libressl/portable/actions/workflows/linux.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/linux.yml) [![macOS Build Status](https://github.com/libressl/portable/actions/workflows/macos.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/macos.yml) +[![Windows Build Status](https://github.com/libressl/portable/actions/workflows/windows.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/windows.yml) [![Android Build Status](https://github.com/libressl/portable/actions/workflows/android.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/android.yml) [![Solaris Build Status](https://github.com/libressl/portable/actions/workflows/solaris.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/solaris.yml) [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/libressl.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:libressl) From dc4ce0d90d8d69a46dc0857b839fcffa4a3a5d3b Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Tue, 19 Dec 2023 17:32:44 +1100 Subject: [PATCH 0553/1283] ci: fix windows workflow syntax --- .github/workflows/windows.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 421ebf358a..fa0b9d0cae 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -9,7 +9,7 @@ on: jobs: test: - name: "${{ matrix.os }}/${{ matrix.arch }}${{ matrix.generator && ' (' + matrix.generator + ')' || '' }}" + name: "${{ matrix.os }}/${{ matrix.arch }}${{ matrix.generator && format(' ({0})', matrix.generator) || '' }}" runs-on: "${{ matrix.os }}" permissions: contents: read From 509eb6486f8d5e96eaa6c16e72443bfc5d4e9027 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Tue, 19 Dec 2023 17:34:10 +1100 Subject: [PATCH 0554/1283] ci: tidy windows workflow job name --- .github/workflows/windows.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index fa0b9d0cae..ce6e9ce54b 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -9,7 +9,7 @@ on: jobs: test: - name: "${{ matrix.os }}/${{ matrix.arch }}${{ matrix.generator && format(' ({0})', matrix.generator) || '' }}" + name: "${{ matrix.os }}/${{ matrix.arch }} (${{ matrix.generator }})" runs-on: "${{ matrix.os }}" permissions: contents: read From 46d8c871188db5e2b98b1b3072af8b0cc457968a Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Tue, 19 Dec 2023 20:25:54 +1100 Subject: [PATCH 0555/1283] ci: avoid unnecessary steps in windows workflow --- .github/workflows/windows.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index ce6e9ce54b..d581b3edc0 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -33,17 +33,15 @@ jobs: update: true install: >- autoconf - automake diffutils - libtool gcc git patch perl - - name: "Setup" + - name: "Update" shell: msys2 {0} - run: ./autogen.sh + run: ./update.sh - name: "Configure CMake" shell: cmd From 747c270d93f4525b33afbc5874cf1d935884d01a Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Wed, 20 Dec 2023 00:49:46 +1100 Subject: [PATCH 0556/1283] ci: remove autoconf from msys2 in windows workflow --- .github/workflows/windows.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index d581b3edc0..e68ef4d6d5 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -32,7 +32,6 @@ jobs: with: update: true install: >- - autoconf diffutils gcc git From d0785f79e3158974442dd16f6e6b1a160ace7e46 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Wed, 20 Dec 2023 01:33:08 +1100 Subject: [PATCH 0557/1283] ci: add concurrency groups to workflows --- .github/workflows/android.yml | 4 ++++ .github/workflows/cifuzz.yml | 4 ++++ .github/workflows/cmake_config.yml | 4 ++++ .github/workflows/coverity.yml | 4 ++++ .github/workflows/fedora-rawhide.yml | 4 ++++ .github/workflows/linux.yml | 4 ++++ .github/workflows/macos.yml | 4 ++++ .github/workflows/release.yml | 4 ++++ .github/workflows/rust-openssl.yml | 4 ++++ .github/workflows/solaris.yml | 4 ++++ .github/workflows/windows.yml | 4 ++++ 11 files changed, 44 insertions(+) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index 205a400753..fe4e757ef4 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -3,6 +3,10 @@ name: "Android" on: [push, pull_request] +concurrency: + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: true + jobs: test: name: "Test ${{ matrix.name }}" diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index bbf3f4444d..a75c678e28 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -3,6 +3,10 @@ name: CIFuzz on: workflow_dispatch: +concurrency: + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: true + jobs: Fuzzing: runs-on: ubuntu-latest diff --git a/.github/workflows/cmake_config.yml b/.github/workflows/cmake_config.yml index ad1ad7500a..ed2c0afe70 100644 --- a/.github/workflows/cmake_config.yml +++ b/.github/workflows/cmake_config.yml @@ -2,6 +2,10 @@ name: cmake_config on: [push, pull_request] +concurrency: + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: true + jobs: cmake-check: defaults: diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 7b01aa4ce1..bb6a805be6 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -6,6 +6,10 @@ on: schedule: - cron: "0 0 * * *" # At 00:00 daily. +concurrency: + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: true + jobs: scan: name: "Scan" diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index 092a437151..86195d1cc5 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -5,6 +5,10 @@ on: schedule: - cron: "0 0 * * *" +concurrency: + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: true + permissions: contents: read diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index f9ec4da7af..c51ade2913 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -7,6 +7,10 @@ on: schedule: - cron: "0 0 * * *" # At 00:00 daily. +concurrency: + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: true + jobs: # Test against all supported architectures. test: diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index f8636ff4d1..ae7b9f0ba4 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -7,6 +7,10 @@ on: schedule: - cron: "0 0 * * 0" # At 00:00 weekly on Sunday. +concurrency: + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: true + jobs: test: name: "${{ matrix.os }}/${{ matrix.arch }}" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8230b8222c..a146f5c202 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -5,6 +5,10 @@ on: push: tags: [ "v*" ] +concurrency: + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: true + permissions: contents: write diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index ef5a7b1977..865219e4d6 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -6,6 +6,10 @@ on: schedule: - cron: "0 0 * * *" # At 00:00 daily. +concurrency: + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: true + jobs: test: name: "Test" diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index 2c6ee49ad4..69ae1471ff 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -6,6 +6,10 @@ on: schedule: - cron: "0 0 * * *" # At 00:00 daily. +concurrency: + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: true + jobs: test: name: "Solaris" diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index e68ef4d6d5..a78a1ed480 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -7,6 +7,10 @@ on: schedule: - cron: "0 0 * * 0" # At 00:00 weekly on Sunday. +concurrency: + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: true + jobs: test: name: "${{ matrix.os }}/${{ matrix.arch }} (${{ matrix.generator }})" From f25f055c64d54c62f1a1a1e97a903bce7b5e6ed3 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Wed, 20 Dec 2023 02:05:48 +1100 Subject: [PATCH 0558/1283] readme: tidy up styling --- README.md | 94 +++++++++++++++++++++++++++++++++---------------------- 1 file changed, 57 insertions(+), 37 deletions(-) diff --git a/README.md b/README.md index 77f9a37a8c..a132ff70fc 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,6 @@ ![LibreSSL image](https://www.libressl.org/images/libressl.jpg) -## Official portable version of [LibreSSL](https://www.libressl.org) ## + +## Official portable version of [LibreSSL](https://www.libressl.org) [![Linux Build Status](https://github.com/libressl/portable/actions/workflows/linux.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/linux.yml) [![macOS Build Status](https://github.com/libressl/portable/actions/workflows/macos.yml/badge.svg)](https://github.com/libressl/portable/actions/workflows/macos.yml) @@ -12,7 +13,7 @@ LibreSSL is a fork of [OpenSSL](https://www.openssl.org) 1.0.1g developed by the [OpenBSD](https://www.openbsd.org) project. Our goal is to modernize the codebase, improve security, and apply best practice development processes from OpenBSD. -## Compatibility with OpenSSL: ## +## Compatibility with OpenSSL LibreSSL provides much of the OpenSSL 1.1 API. The OpenSSL 3 API is not currently supported. Incompatibilities between the projects exist and are unavoidable since @@ -27,7 +28,7 @@ LibreSSL in order to use it, just as in moving between major versions of OpenSSL LibreSSL's installed library version numbers are incremented to account for ABI and API changes. -## Compatibility with other operating systems: ## +## Compatibility with other operating systems While primarily developed on and taking advantage of APIs available on OpenBSD, the LibreSSL portable project attempts to provide working alternatives for @@ -45,6 +46,7 @@ At the time of this writing, LibreSSL is known to build and work on: * AIX (5.3 and later) LibreSSL also supports the following Windows environments: + * Microsoft Windows (Windows 7 / Windows Server 2008r2 or later, x86 and x64) * Wine (32-bit and 64-bit) * Mingw-w64, Cygwin, and Visual Studio @@ -64,20 +66,24 @@ or to the GitHub Severe vulnerabilities or bugs requiring coordination with OpenSSL can be sent to the core team at libressl-security@openbsd.org. -# Building LibreSSL # +# Building LibreSSL -## Prerequisites when building from a Git checkout ## +## Prerequisites when building from a Git checkout If you have checked this source using Git, or have downloaded a source tarball -from Github, follow these initial steps to prepare the source tree for -building. _Note: Your build will fail if you do not follow these instructions! If you cannot follow these instructions (e.g. Windows system using CMake) or cannot meet these prerequistes, please download an official release distribution from https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/ instead. Using official releases is strongly advised if you are not a developer._ +from GitHub, follow these initial steps to prepare the source tree for +building. _Note: Your build will fail if you do not follow these instructions! +If you cannot follow these instructions (e.g. Windows system using CMake) or +cannot meet these prerequistes, please download an official release distribution +from https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/ instead. Using official +releases is strongly advised if you are not a developer._ 1. Ensure you have the following packages installed: automake, autoconf, git, libtool, perl 2. Run `./autogen.sh` to prepare the source tree for building or run `./dist.sh` to prepare a tarball. -## Steps that apply to all builds ## +## Steps that apply to all builds Once you have a source tree, either by downloaded using git and having run the `autogen.sh` script above, or by downloading a release distribution from @@ -110,9 +116,9 @@ ninja ninja test ``` -### OS specific build information: ### +### OS specific build information -#### HP-UX (11i) #### +#### HP-UX (11i) Set the UNIX_STD environment variable to `2003` before running `configure` in order to build with the HP C/aC++ compiler. See the "standards(5)" man @@ -124,64 +130,70 @@ export UNIX_STD=2003 make ``` -#### Windows - Mingw-w64 #### +#### Windows - Mingw-w64 LibreSSL builds against relatively recent versions of Mingw-w64, not to be -confused with the original mingw.org project. Mingw-w64 3.2 or later +confused with the original mingw.org project. Mingw-w64 3.2 or later should work. See README.windows for more information -#### Windows - Visual Studio #### +#### Windows - Visual Studio LibreSSL builds using the CMake target "Visual Studio 12 2013" and newer. To generate a Visual Studio project, install CMake, enter the LibreSSL source directory and run: ```sh - mkdir build-vs2013 - cd build-vs2013 - cmake -G"Visual Studio 12 2013" .. +mkdir build-vs2013 +cd build-vs2013 +cmake -G"Visual Studio 12 2013" .. ``` Replace "Visual Studio 12 2013" with whatever version of Visual Studio you have installed. This will generate a LibreSSL.sln file that you can incorporate into other projects or build by itself. -#### Cmake - Additional Options #### +#### CMake - Additional Options -| Option Name | Default | Description -| ------------ | -----: | ------ -| LIBRESSL_SKIP_INSTALL | OFF | allows skipping install() rules. Can be specified from command line using
```-DLIBRESSL_SKIP_INSTALL=ON``` | -| LIBRESSL_APPS | ON | allows skipping application builds. Apps are required to run tests | -| LIBRESSL_TESTS | ON | allows skipping of tests. Tests are only available in static builds | -| BUILD_SHARED_LIBS | OFF | CMake option for building shared libraries. | -| ENABLE_ASM | ON | builds assembly optimized rules. | -| ENABLE_EXTRATESTS | OFF | Enable extra tests that may be unreliable on some platforms | -| ENABLE_NC | OFF | Enable installing TLS-enabled nc(1) | -| OPENSSLDIR | Blank | Set the default openssl directory. Can be specified from command line using
```-DOPENSSLDIR=``` | +| Option Name | Default | Description | +|-------------------------|--------:|-----------------------------------------------------------------------------------------------------------------| +| `LIBRESSL_SKIP_INSTALL` | `OFF` | allows skipping install() rules. Can be specified from command line using
```-DLIBRESSL_SKIP_INSTALL=ON``` | +| `LIBRESSL_APPS` | `ON` | allows skipping application builds. Apps are required to run tests | +| `LIBRESSL_TESTS` | `ON` | allows skipping of tests. Tests are only available in static builds | +| `BUILD_SHARED_LIBS` | `OFF` | CMake option for building shared libraries. | +| `ENABLE_ASM` | `ON` | builds assembly optimized rules. | +| `ENABLE_EXTRATESTS` | `OFF` | Enable extra tests that may be unreliable on some platforms | +| `ENABLE_NC` | `OFF` | Enable installing TLS-enabled nc(1) | +| `OPENSSLDIR` | Blank | Set the default openssl directory. Can be specified from command line using
```-DOPENSSLDIR=``` | -# Using LibreSSL # +# Using LibreSSL -## CMake ## +## CMake -Make a new folder in your project root (where your main CMakeLists.txt file is located) called CMake. Copy the FindLibreSSL.cmake file to that folder, and add the following line to your main CMakeLists.txt: +Make a new folder in your project root (where your main `CMakeLists.txt` file is +located) called CMake. Copy the `FindLibreSSL.cmake` file to that folder, and +add the following line to your main `CMakeLists.txt`: ```cmake set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/CMake;${CMAKE_MODULE_PATH}") ``` -After your **add_executable** or **add_library** line in your CMakeLists.txt file add the following: +After your `add_executable` or `add_library` line in your `CMakeLists.txt` file +add the following: ```cmake find_package(LibreSSL REQUIRED) ``` -It will tell CMake to find LibreSSL and if found will let you use the following 3 interfaces in your CMakeLists.txt file: +It will tell CMake to find LibreSSL and if found will let you use the following +3 interfaces in your `CMakeLists.txt` file: * LibreSSL::Crypto * LibreSSL::SSL * LibreSSL::TLS -If you for example want to use the LibreSSL TLS library in your test program, include it like so (SSL and Crypto are required by TLS and included automatically too): +If you for example want to use the LibreSSL TLS library in your test program, +include it like so (SSL and Crypto are required by TLS and included +automatically too): ```cmake target_link_libraries(test LibreSSL::TLS) @@ -203,10 +215,18 @@ find_package(LibreSSL REQUIRED) target_link_libraries(test LibreSSL::TLS) ``` -#### Linux #### +#### Linux -Following the guide in the sections above to compile LibreSSL using make and running "sudo make install" will install LibreSSL to the /usr/local/ folder, and will found automatically by find_package. If your system installs it to another location or you have placed them yourself in a different location, you can set the CMake variable LIBRESSL_ROOT_DIR to the correct path, to help CMake find the library. +Following the guide in the sections above to compile LibreSSL using make and +running `sudo make install` will install LibreSSL to the `/usr/local/` folder, +and will found automatically by find_package. If your system installs it to +another location, or you have placed them yourself in a different location, you +can set the CMake variable `LIBRESSL_ROOT_DIR` to the correct path, to help +CMake find the library. -#### Windows #### +#### Windows -Placing the library files in C:/Program Files/LibreSSL/lib and the include files in C:/Program Files/LibreSSL/include should let CMake find them automatically, but it is recommended that you use CMake-GUI to set the paths. It is more convenient as you can have the files in any folder you choose. +Placing the library files in `C:/Program Files/LibreSSL/lib` and the include +files in `C:/Program Files/LibreSSL/include` should let CMake find them +automatically, but it is recommended that you use CMake-GUI to set the paths. +It is more convenient as you can have the files in any folder you choose. From 02cfc0911df952f6ee9a49ca31b11edaefe20ec8 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Wed, 20 Dec 2023 02:23:16 +1100 Subject: [PATCH 0559/1283] readme: fix grammatical error Co-authored-by: Theo Buehler --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index a132ff70fc..e4f56b17e2 100644 --- a/README.md +++ b/README.md @@ -219,7 +219,7 @@ target_link_libraries(test LibreSSL::TLS) Following the guide in the sections above to compile LibreSSL using make and running `sudo make install` will install LibreSSL to the `/usr/local/` folder, -and will found automatically by find_package. If your system installs it to +and will be found automatically by find_package. If your system installs it to another location, or you have placed them yourself in a different location, you can set the CMake variable `LIBRESSL_ROOT_DIR` to the correct path, to help CMake find the library. From ee791f9d2aa7bc727607a5692ed42179f3b95906 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 19 Dec 2023 20:12:20 +0100 Subject: [PATCH 0560/1283] Stop undefining X509_CERT_PAIR Pointed out in #910 --- patches/windows_headers.patch | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/patches/windows_headers.patch b/patches/windows_headers.patch index 6eafa499cd..2e257be1aa 100644 --- a/patches/windows_headers.patch +++ b/patches/windows_headers.patch @@ -14,7 +14,7 @@ #include --- include/openssl/ossl_typ.h.orig Wed Nov 1 13:15:36 2023 +++ include/openssl/ossl_typ.h Wed Nov 1 13:18:23 2023 -@@ -82,6 +82,22 @@ typedef struct asn1_object_st ASN1_OBJECT; +@@ -82,6 +82,21 @@ typedef struct asn1_object_st ASN1_OBJECT; typedef struct ASN1_ITEM_st ASN1_ITEM; typedef struct asn1_pctx_st ASN1_PCTX; @@ -27,7 +27,6 @@ +#endif +#endif +#undef X509_NAME -+#undef X509_CERT_PAIR +#undef X509_EXTENSIONS +#undef OCSP_REQUEST +#undef OCSP_RESPONSE @@ -60,7 +59,7 @@ Digest_ID MD5 --- include/openssl/x509.h.orig Wed Nov 1 13:15:36 2023 +++ include/openssl/x509.h Wed Nov 1 13:18:44 2023 -@@ -100,6 +100,19 @@ +@@ -100,6 +100,18 @@ extern "C" { #endif @@ -73,7 +72,6 @@ +#endif +#endif +#undef X509_NAME -+#undef X509_CERT_PAIR +#undef X509_EXTENSIONS +#endif + From c515f24515e226c1f9b402adacac146868a273f0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 19 Dec 2023 20:18:29 +0100 Subject: [PATCH 0561/1283] pthread_once() returns an error code on failure --- include/compat/pthread.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/compat/pthread.h b/include/compat/pthread.h index ed1b9dc51a..8211dda327 100644 --- a/include/compat/pthread.h +++ b/include/compat/pthread.h @@ -48,7 +48,7 @@ pthread_once(pthread_once_t *once, void (*cb) (void)) struct _pthread_win32_cb_arg arg = { .cb = cb }; BOOL rc = InitOnceExecuteOnce(&once->once, _pthread_once_win32_cb, &arg, NULL); if (rc == 0) - return -1; + return EINVAL; else return 0; } From d441bd3469ef09394e50dfeeac26a094500d9b0f Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 20 Dec 2023 07:32:16 +0100 Subject: [PATCH 0562/1283] rand_key.c is no more --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index bf1e1c247d..418f4f9f61 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -439,7 +439,6 @@ set( des/ofb_enc.c des/pcbc_enc.c des/qud_cksm.c - des/rand_key.c des/set_key.c des/str2key.c des/xcbc_enc.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 0059b5974f..1752d9e923 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -530,7 +530,6 @@ libcrypto_la_SOURCES += des/ofb64enc.c libcrypto_la_SOURCES += des/ofb_enc.c libcrypto_la_SOURCES += des/pcbc_enc.c libcrypto_la_SOURCES += des/qud_cksm.c -libcrypto_la_SOURCES += des/rand_key.c libcrypto_la_SOURCES += des/set_key.c libcrypto_la_SOURCES += des/str2key.c libcrypto_la_SOURCES += des/xcbc_enc.c From 12685f94d57d5181e1d1e5e8f392fb45caaed0ca Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 20 Dec 2023 05:08:35 -0700 Subject: [PATCH 0563/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index eaee6b0450..9b614ed57e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,6 +39,7 @@ LibreSSL Portable Release Notes: - Converted uses of OBJ_bsearch_() to standard bsearch(). - Greatly simplified by_file_ctrl(). - Simplified and cleaned up the OBJ_ API. + - Cleaned up the EVP_Cipher{Init,Update,Final}() implementations * Documentation improvements - ENGINE documentation was updated to reflect reality. - Made EVP API documentation more accurate and less incoherent. From 308b137b9999d298b0cd279985a8fdf9b19cb4ee Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 20 Dec 2023 15:37:14 +0100 Subject: [PATCH 0564/1283] Some files were merged into p_legacy.c --- crypto/CMakeLists.txt | 5 +---- crypto/Makefile.am | 5 +---- 2 files changed, 2 insertions(+), 8 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 418f4f9f61..816269d106 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -531,11 +531,8 @@ set( evp/names.c evp/p5_crpt.c evp/p5_crpt2.c - evp/p_dec.c - evp/p_enc.c + evp/p_legacy.c evp/p_lib.c - evp/p_open.c - evp/p_seal.c evp/p_sign.c evp/p_verify.c evp/pmeth_fn.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 1752d9e923..f0725e19eb 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -644,11 +644,8 @@ libcrypto_la_SOURCES += evp/m_wp.c libcrypto_la_SOURCES += evp/names.c libcrypto_la_SOURCES += evp/p5_crpt.c libcrypto_la_SOURCES += evp/p5_crpt2.c -libcrypto_la_SOURCES += evp/p_dec.c -libcrypto_la_SOURCES += evp/p_enc.c +libcrypto_la_SOURCES += evp/p_legacy.c libcrypto_la_SOURCES += evp/p_lib.c -libcrypto_la_SOURCES += evp/p_open.c -libcrypto_la_SOURCES += evp/p_seal.c libcrypto_la_SOURCES += evp/p_sign.c libcrypto_la_SOURCES += evp/p_verify.c libcrypto_la_SOURCES += evp/pmeth_fn.c From 14639912c9335653d5ff1007077a4fc3fcd03332 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 20 Dec 2023 16:09:18 +0100 Subject: [PATCH 0565/1283] Fix timingsafe memcmp detection --- CMakeLists.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 6cb96f8008..3b8c1aaa6f 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -302,8 +302,8 @@ if(HAVE_TIMINGSAFE_BCMP) endif() check_function_exists(timingsafe_memcmp HAVE_TIMINGSAFE_MEMCMP) -if(HAVE_MEMCMP) - add_definitions(-DHAVE_MEMCMP) +if(HAVE_TIMINGSAFE_MEMCMP) + add_definitions(-DHAVE_TIMINGSAFE_MEMCMP) endif() check_function_exists(memmem HAVE_MEMMEM) From 68ad61fd6d199607af327188c2dad0779f98fa46 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 21 Dec 2023 16:41:57 -0700 Subject: [PATCH 0566/1283] Update man links --- man/links | 2 -- 1 file changed, 2 deletions(-) diff --git a/man/links b/man/links index 17f908704e..55b6d4f84a 100644 --- a/man/links +++ b/man/links @@ -1005,8 +1005,6 @@ EVP_PKEY_asn1_get_count.3,EVP_PKEY_asn1_find_str.3 EVP_PKEY_asn1_get_count.3,EVP_PKEY_asn1_get0.3 EVP_PKEY_asn1_get_count.3,EVP_PKEY_asn1_get0_info.3 EVP_PKEY_asn1_get_count.3,EVP_PKEY_get0_asn1.3 -EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_add0.3 -EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_add_alias.3 EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_copy.3 EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_free.3 EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_check.3 From 81fd7aafaf660e37f9c8173ea7659386760f163b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 22 Dec 2023 10:32:41 -0700 Subject: [PATCH 0567/1283] Update ChangeLog --- ChangeLog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index 9b614ed57e..6a4f66a0f5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -40,6 +40,7 @@ LibreSSL Portable Release Notes: - Greatly simplified by_file_ctrl(). - Simplified and cleaned up the OBJ_ API. - Cleaned up the EVP_Cipher{Init,Update,Final}() implementations + - Removed unused function pointers from X.509 stores and contexts. * Documentation improvements - ENGINE documentation was updated to reflect reality. - Made EVP API documentation more accurate and less incoherent. @@ -48,6 +49,9 @@ LibreSSL Portable Release Notes: * Compatibility changes - Added ChaCha20 and chacha20 aliases for ChaCha. - SSL_library_init() now has the same effect as OPENSSL_init_ssl(). + - The thread unsafe global tables are no longer supported. It is no + longer possible to add aliases for ciphers and digests, custom ASN.1 + strings table entries, ASN.1 methods, or X.509 extensions. * Bug fixes - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp(). - Fixed numerous misuses of X509_ALGOR_set0() resulting in leaks and From 5eeffce117fc086e4c458c09d99dad57ddd3fb6a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 26 Dec 2023 02:25:37 -0700 Subject: [PATCH 0568/1283] Retire the engine test --- tests/CMakeLists.txt | 5 ----- tests/Makefile.am | 5 ----- 2 files changed, 10 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 2beaa29dc4..86aacec37e 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -349,11 +349,6 @@ add_executable(ed25519test ed25519test.c) target_link_libraries(ed25519test ${OPENSSL_TEST_LIBS}) add_test(ed25519test ed25519test) -# enginetest -add_executable(enginetest enginetest.c) -target_link_libraries(enginetest ${OPENSSL_TEST_LIBS}) -add_test(enginetest enginetest) - # evp_ecx_test add_executable(evp_ecx_test evp_ecx_test.c) target_link_libraries(evp_ecx_test ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 5ca0fe9de9..cb81e0227e 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -366,11 +366,6 @@ TESTS += ed25519test check_PROGRAMS += ed25519test ed25519test_SOURCES = ed25519test.c -# enginetest -TESTS += enginetest -check_PROGRAMS += enginetest -enginetest_SOURCES = enginetest.c - # evp_ecx_test TESTS += evp_ecx_test check_PROGRAMS += evp_ecx_test From 63c5a678eaabe79723935080b1f487d4db9c3e93 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 27 Dec 2023 08:23:09 -0700 Subject: [PATCH 0569/1283] Hook up exdata_test --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 86aacec37e..828574e5c7 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -374,6 +374,11 @@ add_executable(evp_test evp_test.c) target_link_libraries(evp_test ${OPENSSL_TEST_LIBS}) add_test(evp_test evp_test) +# exdata_test +add_executable(exdata_test exdata_test.c) +target_link_libraries(exdata_test ${OPENSSL_TEST_LIBS}) +add_test(exdata_test exdata_test) + # expirecallback.c # explicit_bzero diff --git a/tests/Makefile.am b/tests/Makefile.am index cb81e0227e..dc9ccd3a6c 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -393,6 +393,11 @@ TESTS += evp_test check_PROGRAMS += evp_test evp_test_SOURCES = evp_test.c +# exdata_test +TESTS += exdata_test +check_PROGRAMS += exdata_test +exdata_test_SOURCES = exdata_test.c + # expirecallback.c # explicit_bzero From af0a8e9269d518eb2be690426fc379448f034c66 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 28 Dec 2023 23:41:44 -0700 Subject: [PATCH 0570/1283] Some evp files were renamed and merged --- crypto/CMakeLists.txt | 8 +++----- crypto/Makefile.am | 8 +++----- 2 files changed, 6 insertions(+), 10 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 816269d106..4716ddd043 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -488,8 +488,6 @@ set( evp/bio_enc.c evp/bio_md.c evp/c_all.c - evp/cipher_method_lib.c - evp/digest.c evp/e_aes.c evp/e_aes_cbc_hmac_sha1.c evp/e_bf.c @@ -507,12 +505,12 @@ set( evp/e_rc4_hmac_md5.c evp/e_sm4.c evp/e_xcbc_d.c - evp/encode.c evp/evp_aead.c - evp/evp_enc.c + evp/evp_cipher.c + evp/evp_digest.c + evp/evp_encode.c evp/evp_err.c evp/evp_key.c - evp/evp_lib.c evp/evp_pbe.c evp/evp_pkey.c evp/m_gost2814789.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index f0725e19eb..611d7e021d 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -601,8 +601,6 @@ libcrypto_la_SOURCES += evp/bio_b64.c libcrypto_la_SOURCES += evp/bio_enc.c libcrypto_la_SOURCES += evp/bio_md.c libcrypto_la_SOURCES += evp/c_all.c -libcrypto_la_SOURCES += evp/cipher_method_lib.c -libcrypto_la_SOURCES += evp/digest.c libcrypto_la_SOURCES += evp/e_aes.c libcrypto_la_SOURCES += evp/e_aes_cbc_hmac_sha1.c libcrypto_la_SOURCES += evp/e_bf.c @@ -620,12 +618,12 @@ libcrypto_la_SOURCES += evp/e_rc4.c libcrypto_la_SOURCES += evp/e_rc4_hmac_md5.c libcrypto_la_SOURCES += evp/e_sm4.c libcrypto_la_SOURCES += evp/e_xcbc_d.c -libcrypto_la_SOURCES += evp/encode.c libcrypto_la_SOURCES += evp/evp_aead.c -libcrypto_la_SOURCES += evp/evp_enc.c +libcrypto_la_SOURCES += evp/evp_cipher.c +libcrypto_la_SOURCES += evp/evp_digest.c +libcrypto_la_SOURCES += evp/evp_encode.c libcrypto_la_SOURCES += evp/evp_err.c libcrypto_la_SOURCES += evp/evp_key.c -libcrypto_la_SOURCES += evp/evp_lib.c libcrypto_la_SOURCES += evp/evp_pbe.c libcrypto_la_SOURCES += evp/evp_pkey.c libcrypto_la_SOURCES += evp/m_gost2814789.c From fa9745041e5a3ddce4cfbce85e8e8fd1d9f292f5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 29 Dec 2023 13:40:17 -0700 Subject: [PATCH 0571/1283] Missing period --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 6a4f66a0f5..4c65bb976c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,7 +39,7 @@ LibreSSL Portable Release Notes: - Converted uses of OBJ_bsearch_() to standard bsearch(). - Greatly simplified by_file_ctrl(). - Simplified and cleaned up the OBJ_ API. - - Cleaned up the EVP_Cipher{Init,Update,Final}() implementations + - Cleaned up the EVP_Cipher{Init,Update,Final}() implementations. - Removed unused function pointers from X.509 stores and contexts. * Documentation improvements - ENGINE documentation was updated to reflect reality. From 0b6d6610c989cc203c5a71550f8b016fe962b665 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 30 Dec 2023 12:28:53 -0700 Subject: [PATCH 0572/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 4c65bb976c..f78baa980d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -52,6 +52,7 @@ LibreSSL Portable Release Notes: - The thread unsafe global tables are no longer supported. It is no longer possible to add aliases for ciphers and digests, custom ASN.1 strings table entries, ASN.1 methods, or X.509 extensions. + - Turn the long dysfunctional openss(1) s_client -pause into a noop. * Bug fixes - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp(). - Fixed numerous misuses of X509_ALGOR_set0() resulting in leaks and From bebf63788f2165f8352fe08586526d056a3f547f Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Tue, 2 Jan 2024 03:08:14 +0000 Subject: [PATCH 0573/1283] cmake: disable ASM for Windows ARM64 With ASM support the builds either exit with an assert or hang (with asserts disabled). --- CMakeLists.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index 3b8c1aaa6f..78840b243e 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -342,6 +342,9 @@ endif() if(CMAKE_SYSTEM_PROCESSOR MATCHES "(aarch64|arm64|ARM64)") set(HOST_AARCH64 true) + if(WIN32) + set(ENABLE_ASM false) + endif() elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm") set(HOST_ARM true) elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND CMAKE_SYSTEM_PROCESSOR MATCHES "i386") From 91a85025f0e45c489f0fa082385793a27d879291 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 4 Jan 2024 12:48:33 -0700 Subject: [PATCH 0574/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index f78baa980d..dd69603cea 100644 --- a/ChangeLog +++ b/ChangeLog @@ -41,6 +41,7 @@ LibreSSL Portable Release Notes: - Simplified and cleaned up the OBJ_ API. - Cleaned up the EVP_Cipher{Init,Update,Final}() implementations. - Removed unused function pointers from X.509 stores and contexts. + - A lot of cleanup and reaorganization in EVP. * Documentation improvements - ENGINE documentation was updated to reflect reality. - Made EVP API documentation more accurate and less incoherent. From d2263ec4080982715cf44b3c46e1f433813608b4 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 6 Jan 2024 14:22:07 -0700 Subject: [PATCH 0575/1283] Update ChangeLog --- ChangeLog | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index dd69603cea..74ebff64b6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -52,7 +52,8 @@ LibreSSL Portable Release Notes: - SSL_library_init() now has the same effect as OPENSSL_init_ssl(). - The thread unsafe global tables are no longer supported. It is no longer possible to add aliases for ciphers and digests, custom ASN.1 - strings table entries, ASN.1 methods, or X.509 extensions. + strings table entries, ASN.1 methods, PKEY methods, CRL methods, + or X.509 extensions. - Turn the long dysfunctional openss(1) s_client -pause into a noop. * Bug fixes - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp(). From eb55f9fefe6f4e67cb274bfc1061fe39c7c53f9f Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 7 Jan 2024 13:30:58 -0700 Subject: [PATCH 0576/1283] Update ChangeLog --- ChangeLog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 74ebff64b6..23b1042e1e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -52,8 +52,8 @@ LibreSSL Portable Release Notes: - SSL_library_init() now has the same effect as OPENSSL_init_ssl(). - The thread unsafe global tables are no longer supported. It is no longer possible to add aliases for ciphers and digests, custom ASN.1 - strings table entries, ASN.1 methods, PKEY methods, CRL methods, - or X.509 extensions. + strings table entries, ASN.1 methods, PKEY methods, digest methods, + CRL methods, purpose and trust identifiers, or X.509 extensions. - Turn the long dysfunctional openss(1) s_client -pause into a noop. * Bug fixes - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp(). From 2871c025b42117cf71dbb9599012f2ef7b8f623c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 8 Jan 2024 10:05:58 -0700 Subject: [PATCH 0577/1283] ChangeLog: fix typo --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 23b1042e1e..1e20b3b204 100644 --- a/ChangeLog +++ b/ChangeLog @@ -54,7 +54,7 @@ LibreSSL Portable Release Notes: longer possible to add aliases for ciphers and digests, custom ASN.1 strings table entries, ASN.1 methods, PKEY methods, digest methods, CRL methods, purpose and trust identifiers, or X.509 extensions. - - Turn the long dysfunctional openss(1) s_client -pause into a noop. + - Turn the long dysfunctional openssl(1) s_client -pause into a noop. * Bug fixes - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp(). - Fixed numerous misuses of X509_ALGOR_set0() resulting in leaks and From 3ca3130613118f7698479e85a835c0dbc8566570 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 10 Jan 2024 15:13:51 -0700 Subject: [PATCH 0578/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 1e20b3b204..a22af28a15 100644 --- a/ChangeLog +++ b/ChangeLog @@ -42,6 +42,7 @@ LibreSSL Portable Release Notes: - Cleaned up the EVP_Cipher{Init,Update,Final}() implementations. - Removed unused function pointers from X.509 stores and contexts. - A lot of cleanup and reaorganization in EVP. + - Simplified internals of X509_TRUST handling. * Documentation improvements - ENGINE documentation was updated to reflect reality. - Made EVP API documentation more accurate and less incoherent. From 29581725a3aab2a1740c7384aeff8d59780c36ad Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 12 Jan 2024 06:19:57 -0700 Subject: [PATCH 0579/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index a22af28a15..c884db9a2f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -56,6 +56,9 @@ LibreSSL Portable Release Notes: strings table entries, ASN.1 methods, PKEY methods, digest methods, CRL methods, purpose and trust identifiers, or X.509 extensions. - Turn the long dysfunctional openssl(1) s_client -pause into a noop. + - openssl(1) x509 now supports -force_pubkey, -multivalue-rdn, + -set_issuer, -set_subject, and -utf8. + openssl(1) x509 * Bug fixes - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp(). - Fixed numerous misuses of X509_ALGOR_set0() resulting in leaks and From 62643dbd4795aaa795af55cc93e4b9f3ee0c90c7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 13 Jan 2024 06:11:32 -0700 Subject: [PATCH 0580/1283] Update ChangeLog --- ChangeLog | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index c884db9a2f..fa2dc167b9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -51,6 +51,9 @@ LibreSSL Portable Release Notes: * Compatibility changes - Added ChaCha20 and chacha20 aliases for ChaCha. - SSL_library_init() now has the same effect as OPENSSL_init_ssl(). + - EVP_add_{cipher,digest}() were removed. From the OBJ_NAME API, + only OBJ_NAME_do_all*() remain. In particular, it is no longer + possible to add aliases for ciphers and digests. - The thread unsafe global tables are no longer supported. It is no longer possible to add aliases for ciphers and digests, custom ASN.1 strings table entries, ASN.1 methods, PKEY methods, digest methods, @@ -58,7 +61,6 @@ LibreSSL Portable Release Notes: - Turn the long dysfunctional openssl(1) s_client -pause into a noop. - openssl(1) x509 now supports -force_pubkey, -multivalue-rdn, -set_issuer, -set_subject, and -utf8. - openssl(1) x509 * Bug fixes - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp(). - Fixed numerous misuses of X509_ALGOR_set0() resulting in leaks and From a13c8dd73a13336528b9853b153ae1c3f76ac305 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 13 Jan 2024 06:14:56 -0700 Subject: [PATCH 0581/1283] evp/evp_names.c replaces a few other files --- crypto/CMakeLists.txt | 4 +--- crypto/Makefile.am | 4 +--- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 4716ddd043..89405a55ba 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -487,7 +487,6 @@ set( evp/bio_b64.c evp/bio_enc.c evp/bio_md.c - evp/c_all.c evp/e_aes.c evp/e_aes_cbc_hmac_sha1.c evp/e_bf.c @@ -511,6 +510,7 @@ set( evp/evp_encode.c evp/evp_err.c evp/evp_key.c + evp/evp_names.c evp/evp_pbe.c evp/evp_pkey.c evp/m_gost2814789.c @@ -526,7 +526,6 @@ set( evp/m_streebog.c evp/m_sm3.c evp/m_wp.c - evp/names.c evp/p5_crpt.c evp/p5_crpt2.c evp/p_legacy.c @@ -572,7 +571,6 @@ set( modes/gcm128.c modes/ofb128.c modes/xts128.c - objects/o_names.c objects/obj_dat.c objects/obj_err.c objects/obj_lib.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 611d7e021d..28dd0eed84 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -600,7 +600,6 @@ libcrypto_la_SOURCES += err/err_prn.c libcrypto_la_SOURCES += evp/bio_b64.c libcrypto_la_SOURCES += evp/bio_enc.c libcrypto_la_SOURCES += evp/bio_md.c -libcrypto_la_SOURCES += evp/c_all.c libcrypto_la_SOURCES += evp/e_aes.c libcrypto_la_SOURCES += evp/e_aes_cbc_hmac_sha1.c libcrypto_la_SOURCES += evp/e_bf.c @@ -624,6 +623,7 @@ libcrypto_la_SOURCES += evp/evp_digest.c libcrypto_la_SOURCES += evp/evp_encode.c libcrypto_la_SOURCES += evp/evp_err.c libcrypto_la_SOURCES += evp/evp_key.c +libcrypto_la_SOURCES += evp/evp_names.c libcrypto_la_SOURCES += evp/evp_pbe.c libcrypto_la_SOURCES += evp/evp_pkey.c libcrypto_la_SOURCES += evp/m_gost2814789.c @@ -639,7 +639,6 @@ libcrypto_la_SOURCES += evp/m_sigver.c libcrypto_la_SOURCES += evp/m_streebog.c libcrypto_la_SOURCES += evp/m_sm3.c libcrypto_la_SOURCES += evp/m_wp.c -libcrypto_la_SOURCES += evp/names.c libcrypto_la_SOURCES += evp/p5_crpt.c libcrypto_la_SOURCES += evp/p5_crpt2.c libcrypto_la_SOURCES += evp/p_legacy.c @@ -758,7 +757,6 @@ libcrypto_la_SOURCES += modes/xts128.c noinst_HEADERS += modes/modes_local.h # objects -libcrypto_la_SOURCES += objects/o_names.c libcrypto_la_SOURCES += objects/obj_dat.c libcrypto_la_SOURCES += objects/obj_err.c libcrypto_la_SOURCES += objects/obj_lib.c From e0d67e1e23c93c5a154a942a9a504dcad0a06ded Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 13 Jan 2024 22:14:55 -0700 Subject: [PATCH 0582/1283] Update man links --- man/links | 4 ---- 1 file changed, 4 deletions(-) diff --git a/man/links b/man/links index 55b6d4f84a..c21b4d057a 100644 --- a/man/links +++ b/man/links @@ -594,7 +594,6 @@ DSA_SIG_new.3,DSA_SIG_free.3 DSA_SIG_new.3,DSA_SIG_get0.3 DSA_SIG_new.3,DSA_SIG_set0.3 DSA_do_sign.3,DSA_do_verify.3 -DSA_generate_parameters.3,DSA_generate_parameters_ex.3 DSA_get0_pqg.3,DSA_clear_flags.3 DSA_get0_pqg.3,DSA_get0_engine.3 DSA_get0_pqg.3,DSA_get0_g.3 @@ -1257,8 +1256,6 @@ OBJ_create.3,OBJ_add_object.3 OBJ_create.3,OBJ_cleanup.3 OBJ_create.3,OBJ_create_objects.3 OBJ_create.3,OBJ_new_nid.3 -OBJ_create.3,check_defer.3 -OBJ_create.3,obj_cleanup_defer.3 OBJ_find_sigid_algs.3,OBJ_find_sigid_by_algs.3 OBJ_nid2obj.3,OBJ_cmp.3 OBJ_nid2obj.3,OBJ_dup.3 @@ -2206,7 +2203,6 @@ X509_STORE_CTX_new.3,X509_STORE_CTX_set_cert.3 X509_STORE_CTX_new.3,X509_STORE_CTX_set_chain.3 X509_STORE_CTX_new.3,X509_STORE_CTX_trusted_stack.3 X509_STORE_CTX_set_flags.3,X509_STORE_CTX_get0_param.3 -X509_STORE_CTX_set_flags.3,X509_STORE_CTX_purpose_inherit.3 X509_STORE_CTX_set_flags.3,X509_STORE_CTX_set0_param.3 X509_STORE_CTX_set_flags.3,X509_STORE_CTX_set_default.3 X509_STORE_CTX_set_flags.3,X509_STORE_CTX_set_depth.3 From 9a84163934f41632c2196fa9b8938394cdf69670 Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Sun, 14 Jan 2024 14:46:52 +0100 Subject: [PATCH 0583/1283] CI: limit scheduled runs to "libressl" org only --- .github/workflows/fedora-rawhide.yml | 1 + .github/workflows/linux.yml | 1 + .github/workflows/macos.yml | 1 + .github/workflows/rust-openssl.yml | 1 + .github/workflows/solaris.yml | 1 + .github/workflows/windows.yml | 1 + 6 files changed, 6 insertions(+) diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index 86195d1cc5..1303af295f 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -19,6 +19,7 @@ jobs: cc: [ gcc, clang ] name: ${{ matrix.cc }} runs-on: ubuntu-latest + if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} container: image: fedora:rawhide steps: diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index c51ade2913..d48c1e81d0 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -16,6 +16,7 @@ jobs: test: name: "${{ matrix.os }}/${{ matrix.arch }} (${{ matrix.compiler }})" runs-on: "${{ matrix.os }}" + if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} permissions: contents: read strategy: diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index ae7b9f0ba4..e1395d1c8c 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -15,6 +15,7 @@ jobs: test: name: "${{ matrix.os }}/${{ matrix.arch }}" runs-on: "${{ matrix.os }}" + if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} permissions: contents: read strategy: diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index 865219e4d6..6487b47aa3 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -14,6 +14,7 @@ jobs: test: name: "Test" runs-on: "ubuntu-latest" + if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} permissions: contents: read steps: diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index 69ae1471ff..e331e00baa 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -14,6 +14,7 @@ jobs: test: name: "Solaris" runs-on: ubuntu-latest + if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} permissions: contents: read steps: diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index a78a1ed480..8adb9f9048 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -15,6 +15,7 @@ jobs: test: name: "${{ matrix.os }}/${{ matrix.arch }} (${{ matrix.generator }})" runs-on: "${{ matrix.os }}" + if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} permissions: contents: read strategy: From 267dada70fae48beb1c1e264ea0c9bbdb52dd2e7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 19 Jan 2024 03:01:58 -0700 Subject: [PATCH 0584/1283] Add shutdowntest to build --- tests/CMakeLists.txt | 11 +++++++++++ tests/Makefile.am | 6 ++++++ tests/shutdowntest.bat | 14 ++++++++++++++ tests/shutdowntest.sh | 13 +++++++++++++ 4 files changed, 44 insertions(+) create mode 100644 tests/shutdowntest.bat create mode 100755 tests/shutdowntest.sh diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 828574e5c7..d77a9f0d7f 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -601,6 +601,17 @@ add_executable(sha_test sha_test.c) target_link_libraries(sha_test ${OPENSSL_TEST_LIBS}) add_test(sha_test sha_test) +# shutdowntest +set(SHUTDOWNTEST_SRC shutdowntest.c) +add_executable(shutdowntest ${SHUTDOWNTEST_SRC}) +target_link_libraries(shutdowntest ${OPENSSL_TEST_LIBS}) +if(NOT MSVC) + add_test(NAME shutdowntest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/shutdowntest.sh) +else() + add_test(NAME shutdowntest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/shutdowntest.bat $) +endif() +set_tests_properties(shutdowntest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") + # signertest if(NOT CMAKE_SYSTEM_NAME MATCHES "WindowsStore") set(SIGNERTEST_SRC signertest.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index dc9ccd3a6c..a93e7fc0f7 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -631,6 +631,12 @@ TESTS += sha_test check_PROGRAMS += sha_test sha_test_SOURCES = sha_test.c +# shutdowntest +TESTS += shutdowntest.sh +check_PROGRAMS += shutdowntest +shutdowntest_SOURCES = shutdowntest.c +EXTRA_DIST += shutdowntest.sh shutdowntest.bat + # signertest TESTS += signertest check_PROGRAMS += signertest diff --git a/tests/shutdowntest.bat b/tests/shutdowntest.bat new file mode 100644 index 0000000000..46db6e8e5b --- /dev/null +++ b/tests/shutdowntest.bat @@ -0,0 +1,14 @@ +@echo off +setlocal enabledelayedexpansion +REM shutdowntest.bat + +set shutdowntest_bin=%1 +set shutdowntest_bin=%shutdowntest_bin:/=\% +if not exist %shutdowntest_bin% exit /b 1 + +%shutdowntest_bin% %srcdir%\server.pem %srcdir%\server.pem %srcdir%\ca.pem +if !errorlevel! neq 0 ( + exit /b 1 +) + +endlocal diff --git a/tests/shutdowntest.sh b/tests/shutdowntest.sh new file mode 100755 index 0000000000..22e2b1dae1 --- /dev/null +++ b/tests/shutdowntest.sh @@ -0,0 +1,13 @@ +#!/bin/sh +set -e + +shutdowntest_bin=./shutdowntest +if [ -e ./shutdowntest.exe ]; then + shutdowntest_bin=./shutdowntest.exe +fi + +if [ -z $srcdir ]; then + srcdir=. +fi + +$shutdowntest_bin $srcdir/server.pem $srcdir/server.pem $srcdir/ca.pem From 90c99a878d55eb3f07bbf91d9cfa57d4bec54618 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 22 Jan 2024 08:17:42 -0700 Subject: [PATCH 0585/1283] Update man links --- man/links | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/man/links b/man/links index c21b4d057a..c4b1d4d707 100644 --- a/man/links +++ b/man/links @@ -494,6 +494,25 @@ CMS_get0_type.3,CMS_set1_eContentType.3 CMS_get1_ReceiptRequest.3,CMS_ReceiptRequest_create0.3 CMS_get1_ReceiptRequest.3,CMS_ReceiptRequest_get0_values.3 CMS_get1_ReceiptRequest.3,CMS_add1_ReceiptRequest.3 +CMS_signed_add1_attr.3,CMS_signed_add1_attr_by_NID.3 +CMS_signed_add1_attr.3,CMS_signed_add1_attr_by_OBJ.3 +CMS_signed_add1_attr.3,CMS_signed_add1_attr_by_txt.3 +CMS_signed_add1_attr.3,CMS_signed_delete_attr.3 +CMS_signed_add1_attr.3,CMS_signed_get0_data_by_OBJ.3 +CMS_signed_add1_attr.3,CMS_signed_get_attr.3 +CMS_signed_add1_attr.3,CMS_signed_get_attr_by_NID.3 +CMS_signed_add1_attr.3,CMS_signed_get_attr_by_OBJ.3 +CMS_signed_add1_attr.3,CMS_signed_get_attr_count.3 +CMS_signed_add1_attr.3,CMS_unsigned_add1_attr.3 +CMS_signed_add1_attr.3,CMS_unsigned_add1_attr_by_NID.3 +CMS_signed_add1_attr.3,CMS_unsigned_add1_attr_by_OBJ.3 +CMS_signed_add1_attr.3,CMS_unsigned_add1_attr_by_txt.3 +CMS_signed_add1_attr.3,CMS_unsigned_delete_attr.3 +CMS_signed_add1_attr.3,CMS_unsigned_get0_data_by_OBJ.3 +CMS_signed_add1_attr.3,CMS_unsigned_get_attr.3 +CMS_signed_add1_attr.3,CMS_unsigned_get_attr_by_NID.3 +CMS_signed_add1_attr.3,CMS_unsigned_get_attr_by_OBJ.3 +CMS_signed_add1_attr.3,CMS_unsigned_get_attr_count.3 CMS_verify.3,CMS_get0_signers.3 CONF_modules_free.3,CONF_modules_finish.3 CONF_modules_free.3,CONF_modules_unload.3 From 90c543964dcbbc3cb07ba08943e358519b077cc0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 24 Jan 2024 09:20:46 -0700 Subject: [PATCH 0586/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index fa2dc167b9..4d90e1cf95 100644 --- a/ChangeLog +++ b/ChangeLog @@ -75,6 +75,7 @@ LibreSSL Portable Release Notes: version downgrade. - Fixed various bugs in CMAC internals. - Removed all remaining ENGINE tentacles. + - Fixed 4-byte overreads in GHASH assembly on amd64 and i386. 3.8.2 - Stable release From 21b4da742cf7eb58b3425c6d3327229af7485fdd Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 25 Jan 2024 10:06:42 -0700 Subject: [PATCH 0587/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 4d90e1cf95..67f9886f99 100644 --- a/ChangeLog +++ b/ChangeLog @@ -76,6 +76,8 @@ LibreSSL Portable Release Notes: - Fixed various bugs in CMAC internals. - Removed all remaining ENGINE tentacles. - Fixed 4-byte overreads in GHASH assembly on amd64 and i386. + - Fixed various NULL dereferences in PKCS #12 code due to mishandling + of OPTIONAL content in PKCS #7 ContentInfo. 3.8.2 - Stable release From 935d9852afa5889b7b60262788afc0ba4405ac0e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 26 Jan 2024 10:32:42 -0700 Subject: [PATCH 0588/1283] Update ChangeLog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 67f9886f99..733cc10d3b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -59,7 +59,7 @@ LibreSSL Portable Release Notes: strings table entries, ASN.1 methods, PKEY methods, digest methods, CRL methods, purpose and trust identifiers, or X.509 extensions. - Turn the long dysfunctional openssl(1) s_client -pause into a noop. - - openssl(1) x509 now supports -force_pubkey, -multivalue-rdn, + - openssl(1) x509 now supports -new -force_pubkey, -multivalue-rdn, -set_issuer, -set_subject, and -utf8. * Bug fixes - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp(). From 0dd636aee71978029e8576fa7eb473b413f130fb Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 27 Jan 2024 10:36:33 -0700 Subject: [PATCH 0589/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 733cc10d3b..4c54779511 100644 --- a/ChangeLog +++ b/ChangeLog @@ -61,6 +61,8 @@ LibreSSL Portable Release Notes: - Turn the long dysfunctional openssl(1) s_client -pause into a noop. - openssl(1) x509 now supports -new -force_pubkey, -multivalue-rdn, -set_issuer, -set_subject, and -utf8. + - Support ECDSA with SHA-3 signature algorithms. + - Support HMAC with truncated SHA-2 and SHA-3 as PBE PRF. * Bug fixes - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp(). - Fixed numerous misuses of X509_ALGOR_set0() resulting in leaks and @@ -78,6 +80,7 @@ LibreSSL Portable Release Notes: - Fixed 4-byte overreads in GHASH assembly on amd64 and i386. - Fixed various NULL dereferences in PKCS #12 code due to mishandling of OPTIONAL content in PKCS #7 ContentInfo. + - Aligned SSL_shutdown() behavior in TLSv1.3 with the legacy stack. 3.8.2 - Stable release From 4c2a66817142cd0ae7beb1a1dbfc7b4409ad50d1 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 27 Jan 2024 10:47:01 -0700 Subject: [PATCH 0590/1283] Unhook p5_crypt{,2}.c and p12_crpt.c --- crypto/CMakeLists.txt | 3 --- crypto/Makefile.am | 3 --- 2 files changed, 6 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 89405a55ba..a5e08c5957 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -526,8 +526,6 @@ set( evp/m_streebog.c evp/m_sm3.c evp/m_wp.c - evp/p5_crpt.c - evp/p5_crpt2.c evp/p_legacy.c evp/p_lib.c evp/p_sign.c @@ -598,7 +596,6 @@ set( pkcs12/p12_add.c pkcs12/p12_asn.c pkcs12/p12_attr.c - pkcs12/p12_crpt.c pkcs12/p12_crt.c pkcs12/p12_decr.c pkcs12/p12_init.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 28dd0eed84..207853188a 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -639,8 +639,6 @@ libcrypto_la_SOURCES += evp/m_sigver.c libcrypto_la_SOURCES += evp/m_streebog.c libcrypto_la_SOURCES += evp/m_sm3.c libcrypto_la_SOURCES += evp/m_wp.c -libcrypto_la_SOURCES += evp/p5_crpt.c -libcrypto_la_SOURCES += evp/p5_crpt2.c libcrypto_la_SOURCES += evp/p_legacy.c libcrypto_la_SOURCES += evp/p_lib.c libcrypto_la_SOURCES += evp/p_sign.c @@ -792,7 +790,6 @@ libcrypto_la_SOURCES += pem/pvkfmt.c libcrypto_la_SOURCES += pkcs12/p12_add.c libcrypto_la_SOURCES += pkcs12/p12_asn.c libcrypto_la_SOURCES += pkcs12/p12_attr.c -libcrypto_la_SOURCES += pkcs12/p12_crpt.c libcrypto_la_SOURCES += pkcs12/p12_crt.c libcrypto_la_SOURCES += pkcs12/p12_decr.c libcrypto_la_SOURCES += pkcs12/p12_init.c From 7d4657e273377056877e968958184bb6c221e03c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 28 Jan 2024 14:33:37 -0700 Subject: [PATCH 0591/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 4c54779511..4179d381fc 100644 --- a/ChangeLog +++ b/ChangeLog @@ -43,6 +43,7 @@ LibreSSL Portable Release Notes: - Removed unused function pointers from X.509 stores and contexts. - A lot of cleanup and reaorganization in EVP. - Simplified internals of X509_TRUST handling. + - Made deletion from a lhash doall callback safe. * Documentation improvements - ENGINE documentation was updated to reflect reality. - Made EVP API documentation more accurate and less incoherent. From f719dff2bd75560c92459b467446854e39026126 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 30 Jan 2024 10:14:14 -0700 Subject: [PATCH 0592/1283] Update ChangeLog --- ChangeLog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 4179d381fc..e550595407 100644 --- a/ChangeLog +++ b/ChangeLog @@ -41,7 +41,8 @@ LibreSSL Portable Release Notes: - Simplified and cleaned up the OBJ_ API. - Cleaned up the EVP_Cipher{Init,Update,Final}() implementations. - Removed unused function pointers from X.509 stores and contexts. - - A lot of cleanup and reaorganization in EVP. + - A lot of cleanup and reorganization in EVP. + - Removed all remaining ENGINE tentacles. - Simplified internals of X509_TRUST handling. - Made deletion from a lhash doall callback safe. * Documentation improvements @@ -77,7 +78,6 @@ LibreSSL Portable Release Notes: - Avoid a NULL dereference after memory allocation failure during TLS version downgrade. - Fixed various bugs in CMAC internals. - - Removed all remaining ENGINE tentacles. - Fixed 4-byte overreads in GHASH assembly on amd64 and i386. - Fixed various NULL dereferences in PKCS #12 code due to mishandling of OPTIONAL content in PKCS #7 ContentInfo. From 008953535b2403fe80484f24748eeca5fc5ffa1c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 1 Feb 2024 16:36:02 -0700 Subject: [PATCH 0593/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index e550595407..9d42d8e3d0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -60,6 +60,7 @@ LibreSSL Portable Release Notes: longer possible to add aliases for ciphers and digests, custom ASN.1 strings table entries, ASN.1 methods, PKEY methods, digest methods, CRL methods, purpose and trust identifiers, or X.509 extensions. + - Removed the _cb() and _fp() versions of BIO_dump{,_indent}(). - Turn the long dysfunctional openssl(1) s_client -pause into a noop. - openssl(1) x509 now supports -new -force_pubkey, -multivalue-rdn, -set_issuer, -set_subject, and -utf8. @@ -82,6 +83,8 @@ LibreSSL Portable Release Notes: - Fixed various NULL dereferences in PKCS #12 code due to mishandling of OPTIONAL content in PKCS #7 ContentInfo. - Aligned SSL_shutdown() behavior in TLSv1.3 with the legacy stack. + - Fixed the new X.509 verifier to find trust anchors in the trusted + stack. 3.8.2 - Stable release From 37d868b0d632e17912bd465cc972481d95bc2e0c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 2 Feb 2024 00:54:51 -0700 Subject: [PATCH 0594/1283] Link bio_dump test to build --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index d77a9f0d7f..4923cc1b00 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -131,6 +131,11 @@ add_executable(bio_chain bio_chain.c) target_link_libraries(bio_chain ${OPENSSL_TEST_LIBS}) add_test(bio_chain bio_chain) +# bio_dump +add_executable(bio_dump bio_dump.c) +target_link_libraries(bio_dump ${OPENSSL_TEST_LIBS}) +add_test(bio_dump bio_dump) + # bio_host # this test relies on resolver results that are OS and environment-specific if(ENABLE_EXTRATESTS) diff --git a/tests/Makefile.am b/tests/Makefile.am index a93e7fc0f7..bd119fb375 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -147,6 +147,11 @@ TESTS += bio_chain check_PROGRAMS += bio_chain bio_chain_SOURCES = bio_chain.c +# bio_dump +TESTS += bio_dump +check_PROGRAMS += bio_dump +bio_dump_SOURCES = bio_dump.c + # bio_host # this test relies on resolver results that are OS and environment-specific if ENABLE_EXTRATESTS From 3d30672656b840756910809a52ac5fe54c24ec01 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 2 Feb 2024 04:49:03 -0700 Subject: [PATCH 0595/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 9d42d8e3d0..b7dd5591d8 100644 --- a/ChangeLog +++ b/ChangeLog @@ -45,6 +45,7 @@ LibreSSL Portable Release Notes: - Removed all remaining ENGINE tentacles. - Simplified internals of X509_TRUST handling. - Made deletion from a lhash doall callback safe. + - Rewrote BIO_dump*(3) internals to be less bad. * Documentation improvements - ENGINE documentation was updated to reflect reality. - Made EVP API documentation more accurate and less incoherent. From 11c5075c2a062b4d64142419acac86325edac6c8 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 3 Feb 2024 09:15:58 -0700 Subject: [PATCH 0596/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index b7dd5591d8..f433c1f946 100644 --- a/ChangeLog +++ b/ChangeLog @@ -67,6 +67,7 @@ LibreSSL Portable Release Notes: -set_issuer, -set_subject, and -utf8. - Support ECDSA with SHA-3 signature algorithms. - Support HMAC with truncated SHA-2 and SHA-3 as PBE PRF. + - GOST and STREEBOG support was removed from libssl. * Bug fixes - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp(). - Fixed numerous misuses of X509_ALGOR_set0() resulting in leaks and From 64f18675926684056ad1be81a59cfef44944e240 Mon Sep 17 00:00:00 2001 From: Christian Andersen Date: Sun, 4 Feb 2024 17:04:09 +0100 Subject: [PATCH 0597/1283] Windows: Fix assertion pop-up up when using Debug compiled libressl. When running the signertest, or the test project in https://github.com/libressl/portable/issues/266 an assertion window pops up. This was fixed in afcd4be8a72a for a release compiled library. To prevent the issue in debug mode, it looks like it is necessary to also disable the assertion window popup. With this all tests pass when compiling and running them with a Debug, Release or RelWithDebInfo CMake build on windows (for me). --- crypto/compat/posix_win.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index c7cf6af3d8..3e78a07c64 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -164,8 +164,10 @@ static void noop_handler(const wchar_t *expression, const wchar_t *function, } #define BEGIN_SUPPRESS_IPH \ + int old_report_mode = _CrtSetReportMode(_CRT_ASSERT, 0); \ _invalid_parameter_handler old_handler = _set_thread_local_invalid_parameter_handler(noop_handler) #define END_SUPPRESS_IPH \ + _CrtSetReportMode(_CRT_ASSERT, old_report_mode); \ _set_thread_local_invalid_parameter_handler(old_handler) #else From 78970524817b51b3a4ba37581bece44c1c410549 Mon Sep 17 00:00:00 2001 From: Christian Andersen Date: Sun, 4 Feb 2024 19:26:00 +0100 Subject: [PATCH 0598/1283] Windows: Don't set -Wall when compiling with Visual Studio. As it enables a lot of spammed warnings that are not part of W4. This reduces the warnings a lot when compiling LibreSSL in CLion for me. --- CMakeLists.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 3b8c1aaa6f..3f8cbb42ef 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -94,8 +94,6 @@ if(WIN32) endif() endif() -set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall") - if(CMAKE_SYSTEM_NAME MATCHES "HP-UX") if(CMAKE_C_COMPILER MATCHES "gcc") set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -std=gnu99 -fno-strict-aliasing") @@ -184,6 +182,8 @@ if(MSVC) ${MSVC_DISABLED_WARNINGS_LIST}) string(REGEX REPLACE "[/-]W[1234][ ]?" "" CMAKE_C_FLAGS ${CMAKE_C_FLAGS}) set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -MP -W4 ${MSVC_DISABLED_WARNINGS_STR}") +else() + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall") endif() check_function_exists(asprintf HAVE_ASPRINTF) From 5bd332ec20ea1c66e769f841b510a76320b995c3 Mon Sep 17 00:00:00 2001 From: Christian Andersen Date: Sun, 4 Feb 2024 19:16:14 +0100 Subject: [PATCH 0599/1283] Windows: Improve the check for endianness when using Visual Studio. Visual studio does not define __BYTE_ORDER__ so all architectures were detected as LITTLE_ENDIAN since both __BYTE_ORDER__ and __ORDER_LITTLE_ENDIAN__ would evaluate to 0 and compare equal. This updates the checks to use CMakes detection of endianness, with a hard error, if this also fails. --- CMakeLists.txt | 9 +++++++++ include/compat/endian.h | 17 ++++++++++++++++- 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 3b8c1aaa6f..730b84d780 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -142,6 +142,15 @@ endif() if(MSVC) add_definitions(-Dinline=__inline) message(STATUS "Using [${CMAKE_C_COMPILER_ID}] compiler") + + include(TestBigEndian) + TEST_BIG_ENDIAN(HAVE_BIG_ENDIAN) + if(HAVE_BIG_ENDIAN) + add_definitions(-DHAVE_BIG_ENDIAN) + else() + add_definitions(-DHAVE_LITTLE_ENDIAN) + endif() + if(CMAKE_C_COMPILER_ID MATCHES "MSVC" OR CMAKE_C_COMPILER_ID MATCHES "Clang") set(MSVC_DISABLED_WARNINGS_LIST "C4018" # 'expression' : signed/unsigned mismatch diff --git a/include/compat/endian.h b/include/compat/endian.h index d0dcfe3251..5376c1a17e 100644 --- a/include/compat/endian.h +++ b/include/compat/endian.h @@ -13,13 +13,28 @@ #define PDP_ENDIAN 3412 /* - * Use GCC and Visual Studio compiler defines to determine endian. + * Use GCC compiler defines to determine endianness. */ +#if defined(__BYTE_ORDER__) #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ #define BYTE_ORDER LITTLE_ENDIAN #else #define BYTE_ORDER BIG_ENDIAN #endif +#endif + +/* + * Use build system defines to determine endianness. + */ +#if !defined(BYTE_ORDER) +#if defined(HAVE_LITTLE_ENDIAN) +#define BYTE_ORDER LITTLE_ENDIAN +#elif defined(HAVE_BIG_ENDIAN) +#define BYTE_ORDER BIG_ENDIAN +#else +#error "Could not detect endianness." +#endif +#endif #elif defined(HAVE_ENDIAN_H) #include_next From cc78bdf3dd7ed883412bd22c2638214fe0ca3619 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 7 Jan 2024 18:29:10 -0600 Subject: [PATCH 0600/1283] integrate new upstream endbr64 test code, remove os-specific reverts --- ...64-where-needed-by-inspection.-Passe.patch | 1055 -------------- ...cit-.text-instead-of-.previous-to-pl.patch | 162 --- ...ion-.rodata-instead-of-a-plain-.roda.patch | 203 --- ...tants-out-of-text-segment-into-rodat.patch | 292 ---- patches/asm/0005-Revert-aesni-endbr64.patch | 20 - patches/asm/endbr64.patch | 1215 +++++++++++++++++ update.sh | 27 +- 7 files changed, 1223 insertions(+), 1751 deletions(-) delete mode 100644 patches/asm/0001-Revert-Add-endbr64-where-needed-by-inspection.-Passe.patch delete mode 100644 patches/asm/0002-Revert-Use-explicit-.text-instead-of-.previous-to-pl.patch delete mode 100644 patches/asm/0003-Revert-Use-.section-.rodata-instead-of-a-plain-.roda.patch delete mode 100644 patches/asm/0004-Revert-Move-constants-out-of-text-segment-into-rodat.patch delete mode 100644 patches/asm/0005-Revert-aesni-endbr64.patch create mode 100644 patches/asm/endbr64.patch diff --git a/patches/asm/0001-Revert-Add-endbr64-where-needed-by-inspection.-Passe.patch b/patches/asm/0001-Revert-Add-endbr64-where-needed-by-inspection.-Passe.patch deleted file mode 100644 index 8ec94cdeb2..0000000000 --- a/patches/asm/0001-Revert-Add-endbr64-where-needed-by-inspection.-Passe.patch +++ /dev/null @@ -1,1055 +0,0 @@ -From 5f7fafff280e6e17d7fafea20fda99762d74581f Mon Sep 17 00:00:00 2001 -From: Brent Cook -Date: Mon, 30 Oct 2023 21:59:32 -0500 -Subject: [PATCH 1/4] Revert "Add endbr64 where needed by inspection. Passes - regresson tests." - -This reverts commit e2118101444d3cf3cab87297b363cecd5357ae89. ---- - src/lib/libcrypto/aes/asm/aes-x86_64.pl | 13 ------------- - src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl | 4 ---- - src/lib/libcrypto/aes/asm/aesni-x86_64.pl | 15 --------------- - src/lib/libcrypto/aes/asm/bsaes-x86_64.pl | 14 -------------- - src/lib/libcrypto/aes/asm/vpaes-x86_64.pl | 14 -------------- - src/lib/libcrypto/bn/arch/amd64/bignum_add.S | 1 - - src/lib/libcrypto/bn/arch/amd64/bignum_cmadd.S | 1 - - src/lib/libcrypto/bn/arch/amd64/bignum_cmul.S | 1 - - src/lib/libcrypto/bn/arch/amd64/bignum_mul.S | 1 - - .../libcrypto/bn/arch/amd64/bignum_mul_4_8_alt.S | 1 - - .../libcrypto/bn/arch/amd64/bignum_mul_8_16_alt.S | 1 - - src/lib/libcrypto/bn/arch/amd64/bignum_sqr.S | 1 - - .../libcrypto/bn/arch/amd64/bignum_sqr_4_8_alt.S | 1 - - .../libcrypto/bn/arch/amd64/bignum_sqr_8_16_alt.S | 1 - - src/lib/libcrypto/bn/arch/amd64/bignum_sub.S | 1 - - src/lib/libcrypto/bn/arch/amd64/word_clz.S | 1 - - src/lib/libcrypto/bn/asm/modexp512-x86_64.pl | 5 ----- - src/lib/libcrypto/bn/asm/x86_64-mont.pl | 3 --- - src/lib/libcrypto/bn/asm/x86_64-mont5.pl | 5 ----- - src/lib/libcrypto/camellia/asm/cmll-x86_64.pl | 8 -------- - src/lib/libcrypto/md5/asm/md5-x86_64.pl | 1 - - src/lib/libcrypto/modes/asm/ghash-x86_64.pl | 4 ---- - src/lib/libcrypto/rc4/asm/rc4-md5-x86_64.pl | 6 ++---- - src/lib/libcrypto/rc4/asm/rc4-x86_64.pl | 7 ++----- - src/lib/libcrypto/sha/asm/sha1-x86_64.pl | 4 ---- - src/lib/libcrypto/sha/asm/sha512-x86_64.pl | 1 - - src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl | 1 - - src/lib/libcrypto/x86_64cpuid.pl | 2 -- - 28 files changed, 4 insertions(+), 114 deletions(-) - -diff --git a/src/lib/libcrypto/aes/asm/aes-x86_64.pl b/src/lib/libcrypto/aes/asm/aes-x86_64.pl -index 78ba20ca5..b7399b552 100755 ---- a/src/lib/libcrypto/aes/asm/aes-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/aes-x86_64.pl -@@ -318,7 +318,6 @@ $code.=<<___; - .type _x86_64_AES_encrypt,\@abi-omnipotent - .align 16 - _x86_64_AES_encrypt: -- endbr64 - xor 0($key),$s0 # xor with key - xor 4($key),$s1 - xor 8($key),$s2 -@@ -549,7 +548,6 @@ $code.=<<___; - .type _x86_64_AES_encrypt_compact,\@abi-omnipotent - .align 16 - _x86_64_AES_encrypt_compact: -- endbr64 - lea 128($sbox),$inp # size optimization - mov 0-128($inp),$acc1 # prefetch Te4 - mov 32-128($inp),$acc2 -@@ -595,7 +593,6 @@ $code.=<<___; - .hidden asm_AES_encrypt - asm_AES_encrypt: - AES_encrypt: -- endbr64 - push %rbx - push %rbp - push %r12 -@@ -887,7 +884,6 @@ $code.=<<___; - .type _x86_64_AES_decrypt,\@abi-omnipotent - .align 16 - _x86_64_AES_decrypt: -- endbr64 - xor 0($key),$s0 # xor with key - xor 4($key),$s1 - xor 8($key),$s2 -@@ -1142,7 +1138,6 @@ $code.=<<___; - .type _x86_64_AES_decrypt_compact,\@abi-omnipotent - .align 16 - _x86_64_AES_decrypt_compact: -- endbr64 - lea 128($sbox),$inp # size optimization - mov 0-128($inp),$acc1 # prefetch Td4 - mov 32-128($inp),$acc2 -@@ -1197,7 +1192,6 @@ $code.=<<___; - .hidden asm_AES_decrypt - asm_AES_decrypt: - AES_decrypt: -- endbr64 - push %rbx - push %rbp - push %r12 -@@ -1297,7 +1291,6 @@ $code.=<<___; - .type AES_set_encrypt_key,\@function,3 - .align 16 - AES_set_encrypt_key: -- endbr64 - push %rbx - push %rbp - push %r12 # redundant, but allows to share -@@ -1323,7 +1316,6 @@ AES_set_encrypt_key: - .type _x86_64_AES_set_encrypt_key,\@abi-omnipotent - .align 16 - _x86_64_AES_set_encrypt_key: -- endbr64 - mov %esi,%ecx # %ecx=bits - mov %rdi,%rsi # %rsi=userKey - mov %rdx,%rdi # %rdi=key -@@ -1569,7 +1561,6 @@ $code.=<<___; - .type AES_set_decrypt_key,\@function,3 - .align 16 - AES_set_decrypt_key: -- endbr64 - push %rbx - push %rbp - push %r12 -@@ -1669,7 +1660,6 @@ $code.=<<___; - .hidden asm_AES_cbc_encrypt - asm_AES_cbc_encrypt: - AES_cbc_encrypt: -- endbr64 - cmp \$0,%rdx # check length - je .Lcbc_epilogue - pushfq -@@ -2561,7 +2551,6 @@ $code.=<<___; - .type block_se_handler,\@abi-omnipotent - .align 16 - block_se_handler: -- endbr64 - push %rsi - push %rdi - push %rbx -@@ -2620,7 +2609,6 @@ block_se_handler: - .type key_se_handler,\@abi-omnipotent - .align 16 - key_se_handler: -- endbr64 - push %rsi - push %rdi - push %rbx -@@ -2678,7 +2666,6 @@ key_se_handler: - .type cbc_se_handler,\@abi-omnipotent - .align 16 - cbc_se_handler: -- endbr64 - push %rsi - push %rdi - push %rbx -diff --git a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl -index 879d16793..bafa906a0 100644 ---- a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl -@@ -89,7 +89,6 @@ $code.=<<___; - .type aesni_cbc_sha1_enc,\@abi-omnipotent - .align 16 - aesni_cbc_sha1_enc: -- endbr64 - # caller should check for SSSE3 and AES-NI bits - mov OPENSSL_ia32cap_P+0(%rip),%r10d - mov OPENSSL_ia32cap_P+4(%rip),%r11d -@@ -133,7 +132,6 @@ $code.=<<___; - .type aesni_cbc_sha1_enc_ssse3,\@function,6 - .align 16 - aesni_cbc_sha1_enc_ssse3: -- endbr64 - mov `($win64?56:8)`(%rsp),$inp # load 7th argument - #shr \$6,$len # debugging artefact - #jz .Lepilogue_ssse3 # debugging artefact -@@ -652,7 +650,6 @@ $code.=<<___; - .type aesni_cbc_sha1_enc_avx,\@function,6 - .align 16 - aesni_cbc_sha1_enc_avx: -- endbr64 - mov `($win64?56:8)`(%rsp),$inp # load 7th argument - #shr \$6,$len # debugging artefact - #jz .Lepilogue_avx # debugging artefact -@@ -1103,7 +1100,6 @@ $code.=<<___; - .type ssse3_handler,\@abi-omnipotent - .align 16 - ssse3_handler: -- endbr64 - push %rsi - push %rdi - push %rbx -diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -index 07d40a84a..e662fbc7c 100644 ---- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -@@ -242,7 +242,6 @@ $code.=<<___; - .type ${PREFIX}_encrypt,\@abi-omnipotent - .align 16 - ${PREFIX}_encrypt: -- endbr64 - movups ($inp),$inout0 # load input - mov 240($key),$rounds # key->rounds - ___ -@@ -256,7 +255,6 @@ $code.=<<___; - .type ${PREFIX}_decrypt,\@abi-omnipotent - .align 16 - ${PREFIX}_decrypt: -- endbr64 - movups ($inp),$inout0 # load input - mov 240($key),$rounds # key->rounds - ___ -@@ -286,7 +284,6 @@ $code.=<<___; - .type _aesni_${dir}rypt3,\@abi-omnipotent - .align 16 - _aesni_${dir}rypt3: -- endbr64 - $movkey ($key),$rndkey0 - shr \$1,$rounds - $movkey 16($key),$rndkey1 -@@ -331,7 +328,6 @@ $code.=<<___; - .type _aesni_${dir}rypt4,\@abi-omnipotent - .align 16 - _aesni_${dir}rypt4: -- endbr64 - $movkey ($key),$rndkey0 - shr \$1,$rounds - $movkey 16($key),$rndkey1 -@@ -377,7 +373,6 @@ $code.=<<___; - .type _aesni_${dir}rypt6,\@abi-omnipotent - .align 16 - _aesni_${dir}rypt6: -- endbr64 - $movkey ($key),$rndkey0 - shr \$1,$rounds - $movkey 16($key),$rndkey1 -@@ -442,7 +437,6 @@ $code.=<<___; - .type _aesni_${dir}rypt8,\@abi-omnipotent - .align 16 - _aesni_${dir}rypt8: -- endbr64 - $movkey ($key),$rndkey0 - shr \$1,$rounds - $movkey 16($key),$rndkey1 -@@ -531,7 +525,6 @@ $code.=<<___; - .type aesni_ecb_encrypt,\@function,5 - .align 16 - aesni_ecb_encrypt: -- endbr64 - and \$-16,$len - jz .Lecb_ret - -@@ -837,7 +830,6 @@ $code.=<<___; - .type aesni_ccm64_encrypt_blocks,\@function,6 - .align 16 - aesni_ccm64_encrypt_blocks: -- endbr64 - ___ - $code.=<<___ if ($win64); - lea -0x58(%rsp),%rsp -@@ -2487,7 +2479,6 @@ $code.=<<___; - .type ${PREFIX}_set_decrypt_key,\@abi-omnipotent - .align 16 - ${PREFIX}_set_decrypt_key: -- endbr64 - sub \$8,%rsp - call __aesni_set_encrypt_key - shl \$4,$bits # rounds-1 after _aesni_set_encrypt_key -@@ -2538,7 +2529,6 @@ $code.=<<___; - .type ${PREFIX}_set_encrypt_key,\@abi-omnipotent - .align 16 - ${PREFIX}_set_encrypt_key: -- endbr64 - __aesni_set_encrypt_key: - sub \$8,%rsp - mov \$-1,%rax -@@ -2760,7 +2750,6 @@ $code.=<<___ if ($PREFIX eq "aesni"); - .type ecb_se_handler,\@abi-omnipotent - .align 16 - ecb_se_handler: -- endbr64 - push %rsi - push %rdi - push %rbx -@@ -2780,7 +2769,6 @@ ecb_se_handler: - .type ccm64_se_handler,\@abi-omnipotent - .align 16 - ccm64_se_handler: -- endbr64 - push %rsi - push %rdi - push %rbx -@@ -2822,7 +2810,6 @@ ccm64_se_handler: - .type ctr32_se_handler,\@abi-omnipotent - .align 16 - ctr32_se_handler: -- endbr64 - push %rsi - push %rdi - push %rbx -@@ -2858,7 +2845,6 @@ ctr32_se_handler: - .type xts_se_handler,\@abi-omnipotent - .align 16 - xts_se_handler: -- endbr64 - push %rsi - push %rdi - push %rbx -@@ -2900,7 +2886,6 @@ $code.=<<___; - .type cbc_se_handler,\@abi-omnipotent - .align 16 - cbc_se_handler: -- endbr64 - push %rsi - push %rdi - push %rbx -diff --git a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl -index 7098ba27f..20e9e1f71 100644 ---- a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl -@@ -813,7 +813,6 @@ $code.=<<___; - .type _bsaes_encrypt8,\@abi-omnipotent - .align 64 - _bsaes_encrypt8: -- endbr64 - lea .LBS0(%rip), $const # constants table - - movdqa ($key), @XMM[9] # round 0 key -@@ -878,7 +877,6 @@ $code.=<<___; - .type _bsaes_decrypt8,\@abi-omnipotent - .align 64 - _bsaes_decrypt8: -- endbr64 - lea .LBS0(%rip), $const # constants table - - movdqa ($key), @XMM[9] # round 0 key -@@ -970,7 +968,6 @@ $code.=<<___; - .type _bsaes_key_convert,\@abi-omnipotent - .align 16 - _bsaes_key_convert: -- endbr64 - lea .Lmasks(%rip), $const - movdqu ($inp), %xmm7 # load round 0 key - lea 0x10($inp), $inp -@@ -1060,7 +1057,6 @@ $code.=<<___; - .type bsaes_enc_key_convert,\@function,2 - .align 16 - bsaes_enc_key_convert: -- endbr64 - mov 240($inp),%r10d # pass rounds - mov $inp,%rcx # pass key - mov $out,%rax # pass key schedule -@@ -1075,7 +1071,6 @@ bsaes_enc_key_convert: - .align 16 - bsaes_encrypt_128: - .Lenc128_loop: -- endbr64 - movdqu 0x00($inp), @XMM[0] # load input - movdqu 0x10($inp), @XMM[1] - movdqu 0x20($inp), @XMM[2] -@@ -1108,7 +1103,6 @@ bsaes_encrypt_128: - .type bsaes_dec_key_convert,\@function,2 - .align 16 - bsaes_dec_key_convert: -- endbr64 - mov 240($inp),%r10d # pass rounds - mov $inp,%rcx # pass key - mov $out,%rax # pass key schedule -@@ -1123,7 +1117,6 @@ bsaes_dec_key_convert: - .type bsaes_decrypt_128,\@function,4 - .align 16 - bsaes_decrypt_128: -- endbr64 - .Ldec128_loop: - movdqu 0x00($inp), @XMM[0] # load input - movdqu 0x10($inp), @XMM[1] -@@ -1169,7 +1162,6 @@ $code.=<<___; - .type bsaes_ecb_encrypt_blocks,\@abi-omnipotent - .align 16 - bsaes_ecb_encrypt_blocks: -- endbr64 - mov %rsp, %rax - .Lecb_enc_prologue: - push %rbp -@@ -1371,7 +1363,6 @@ $code.=<<___; - .type bsaes_ecb_decrypt_blocks,\@abi-omnipotent - .align 16 - bsaes_ecb_decrypt_blocks: -- endbr64 - mov %rsp, %rax - .Lecb_dec_prologue: - push %rbp -@@ -1577,7 +1568,6 @@ $code.=<<___; - .type bsaes_cbc_encrypt,\@abi-omnipotent - .align 16 - bsaes_cbc_encrypt: -- endbr64 - ___ - $code.=<<___ if ($win64); - mov 48(%rsp),$arg6 # pull direction flag -@@ -1865,7 +1855,6 @@ $code.=<<___; - .type bsaes_ctr32_encrypt_blocks,\@abi-omnipotent - .align 16 - bsaes_ctr32_encrypt_blocks: -- endbr64 - mov %rsp, %rax - .Lctr_enc_prologue: - push %rbp -@@ -2107,7 +2096,6 @@ $code.=<<___; - .type bsaes_xts_encrypt,\@abi-omnipotent - .align 16 - bsaes_xts_encrypt: -- endbr64 - mov %rsp, %rax - .Lxts_enc_prologue: - push %rbp -@@ -2489,7 +2477,6 @@ $code.=<<___; - .type bsaes_xts_decrypt,\@abi-omnipotent - .align 16 - bsaes_xts_decrypt: -- endbr64 - mov %rsp, %rax - .Lxts_dec_prologue: - push %rbp -@@ -2966,7 +2953,6 @@ $code.=<<___; - .type se_handler,\@abi-omnipotent - .align 16 - se_handler: -- endbr64 - push %rsi - push %rdi - push %rbx -diff --git a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl -index 8ff8d8602..3ffb1a303 100644 ---- a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl -@@ -82,7 +82,6 @@ $code.=<<___; - .type _vpaes_encrypt_core,\@abi-omnipotent - .align 16 - _vpaes_encrypt_core: -- endbr64 - mov %rdx, %r9 - mov \$16, %r11 - mov 240(%rdx),%eax -@@ -173,7 +172,6 @@ _vpaes_encrypt_core: - .type _vpaes_decrypt_core,\@abi-omnipotent - .align 16 - _vpaes_decrypt_core: -- endbr64 - mov %rdx, %r9 # load key - mov 240(%rdx),%eax - movdqa %xmm9, %xmm1 -@@ -281,7 +279,6 @@ _vpaes_decrypt_core: - .type _vpaes_schedule_core,\@abi-omnipotent - .align 16 - _vpaes_schedule_core: -- endbr64 - # rdi = key - # rsi = size in bits - # rdx = buffer -@@ -467,7 +464,6 @@ _vpaes_schedule_core: - .type _vpaes_schedule_192_smear,\@abi-omnipotent - .align 16 - _vpaes_schedule_192_smear: -- endbr64 - pshufd \$0x80, %xmm6, %xmm0 # d c 0 0 -> c 0 0 0 - pxor %xmm0, %xmm6 # -> c+d c 0 0 - pshufd \$0xFE, %xmm7, %xmm0 # b a _ _ -> b b b a -@@ -499,7 +495,6 @@ _vpaes_schedule_192_smear: - .type _vpaes_schedule_round,\@abi-omnipotent - .align 16 - _vpaes_schedule_round: -- endbr64 - # extract rcon from xmm8 - pxor %xmm1, %xmm1 - palignr \$15, %xmm8, %xmm1 -@@ -567,7 +562,6 @@ _vpaes_schedule_low_round: - .type _vpaes_schedule_transform,\@abi-omnipotent - .align 16 - _vpaes_schedule_transform: -- endbr64 - movdqa %xmm9, %xmm1 - pandn %xmm0, %xmm1 - psrld \$4, %xmm1 -@@ -606,7 +600,6 @@ _vpaes_schedule_transform: - .type _vpaes_schedule_mangle,\@abi-omnipotent - .align 16 - _vpaes_schedule_mangle: -- endbr64 - movdqa %xmm0, %xmm4 # save xmm0 for later - movdqa .Lk_mc_forward(%rip),%xmm5 - test %rcx, %rcx -@@ -680,7 +673,6 @@ _vpaes_schedule_mangle: - .type ${PREFIX}_set_encrypt_key,\@function,3 - .align 16 - ${PREFIX}_set_encrypt_key: -- endbr64 - ___ - $code.=<<___ if ($win64); - lea -0xb8(%rsp),%rsp -@@ -729,7 +721,6 @@ $code.=<<___; - .type ${PREFIX}_set_decrypt_key,\@function,3 - .align 16 - ${PREFIX}_set_decrypt_key: -- endbr64 - ___ - $code.=<<___ if ($win64); - lea -0xb8(%rsp),%rsp -@@ -783,7 +774,6 @@ $code.=<<___; - .type ${PREFIX}_encrypt,\@function,3 - .align 16 - ${PREFIX}_encrypt: -- endbr64 - ___ - $code.=<<___ if ($win64); - lea -0xb8(%rsp),%rsp -@@ -827,7 +817,6 @@ $code.=<<___; - .type ${PREFIX}_decrypt,\@function,3 - .align 16 - ${PREFIX}_decrypt: -- endbr64 - ___ - $code.=<<___ if ($win64); - lea -0xb8(%rsp),%rsp -@@ -877,7 +866,6 @@ $code.=<<___; - .type ${PREFIX}_cbc_encrypt,\@function,6 - .align 16 - ${PREFIX}_cbc_encrypt: -- endbr64 - xchg $key,$len - ___ - ($len,$key)=($key,$len); -@@ -961,7 +949,6 @@ $code.=<<___; - .type _vpaes_preheat,\@abi-omnipotent - .align 16 - _vpaes_preheat: -- endbr64 - lea .Lk_s0F(%rip), %r10 - movdqa -0x20(%r10), %xmm10 # .Lk_inv - movdqa -0x10(%r10), %xmm11 # .Lk_inv+16 -@@ -1092,7 +1079,6 @@ $code.=<<___; - .type se_handler,\@abi-omnipotent - .align 16 - se_handler: -- endbr64 - push %rsi - push %rdi - push %rbx -diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_add.S b/src/lib/libcrypto/bn/arch/amd64/bignum_add.S -index 06298ca69..d56fa5e3a 100644 ---- a/src/lib/libcrypto/bn/arch/amd64/bignum_add.S -+++ b/src/lib/libcrypto/bn/arch/amd64/bignum_add.S -@@ -49,7 +49,6 @@ - - - S2N_BN_SYMBOL(bignum_add): -- endbr64 - - #if WINDOWS_ABI - push rdi -diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_cmadd.S b/src/lib/libcrypto/bn/arch/amd64/bignum_cmadd.S -index 5ad712749..1dc1e5870 100644 ---- a/src/lib/libcrypto/bn/arch/amd64/bignum_cmadd.S -+++ b/src/lib/libcrypto/bn/arch/amd64/bignum_cmadd.S -@@ -54,7 +54,6 @@ - - - S2N_BN_SYMBOL(bignum_cmadd): -- endbr64 - - #if WINDOWS_ABI - push rdi -diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_cmul.S b/src/lib/libcrypto/bn/arch/amd64/bignum_cmul.S -index 9199c8f48..c1a23ccea 100644 ---- a/src/lib/libcrypto/bn/arch/amd64/bignum_cmul.S -+++ b/src/lib/libcrypto/bn/arch/amd64/bignum_cmul.S -@@ -51,7 +51,6 @@ - - - S2N_BN_SYMBOL(bignum_cmul): -- endbr64 - - #if WINDOWS_ABI - push rdi -diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_mul.S b/src/lib/libcrypto/bn/arch/amd64/bignum_mul.S -index 2d7ed1909..42ac988a1 100644 ---- a/src/lib/libcrypto/bn/arch/amd64/bignum_mul.S -+++ b/src/lib/libcrypto/bn/arch/amd64/bignum_mul.S -@@ -59,7 +59,6 @@ - - - S2N_BN_SYMBOL(bignum_mul): -- endbr64 - - #if WINDOWS_ABI - push rdi -diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_mul_4_8_alt.S b/src/lib/libcrypto/bn/arch/amd64/bignum_mul_4_8_alt.S -index f02b09b28..3b7848b28 100644 ---- a/src/lib/libcrypto/bn/arch/amd64/bignum_mul_4_8_alt.S -+++ b/src/lib/libcrypto/bn/arch/amd64/bignum_mul_4_8_alt.S -@@ -72,7 +72,6 @@ - adc h, rdx - - S2N_BN_SYMBOL(bignum_mul_4_8_alt): -- endbr64 - - #if WINDOWS_ABI - push rdi -diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_mul_8_16_alt.S b/src/lib/libcrypto/bn/arch/amd64/bignum_mul_8_16_alt.S -index 97be83e1f..1be37840d 100644 ---- a/src/lib/libcrypto/bn/arch/amd64/bignum_mul_8_16_alt.S -+++ b/src/lib/libcrypto/bn/arch/amd64/bignum_mul_8_16_alt.S -@@ -72,7 +72,6 @@ - adc h, rdx - - S2N_BN_SYMBOL(bignum_mul_8_16_alt): -- endbr64 - - #if WINDOWS_ABI - push rdi -diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_sqr.S b/src/lib/libcrypto/bn/arch/amd64/bignum_sqr.S -index c4a0cabf3..2e05b9c17 100644 ---- a/src/lib/libcrypto/bn/arch/amd64/bignum_sqr.S -+++ b/src/lib/libcrypto/bn/arch/amd64/bignum_sqr.S -@@ -62,7 +62,6 @@ - #define llshort ebp - - S2N_BN_SYMBOL(bignum_sqr): -- endbr64 - - #if WINDOWS_ABI - push rdi -diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_4_8_alt.S b/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_4_8_alt.S -index b228414dc..a635177c6 100644 ---- a/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_4_8_alt.S -+++ b/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_4_8_alt.S -@@ -71,7 +71,6 @@ - adc c, 0 - - S2N_BN_SYMBOL(bignum_sqr_4_8_alt): -- endbr64 - - #if WINDOWS_ABI - push rdi -diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_8_16_alt.S b/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_8_16_alt.S -index 04efeec7e..f698202d2 100644 ---- a/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_8_16_alt.S -+++ b/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_8_16_alt.S -@@ -103,7 +103,6 @@ - adc c, 0 - - S2N_BN_SYMBOL(bignum_sqr_8_16_alt): -- endbr64 - - #if WINDOWS_ABI - push rdi -diff --git a/src/lib/libcrypto/bn/arch/amd64/bignum_sub.S b/src/lib/libcrypto/bn/arch/amd64/bignum_sub.S -index 11a9bd7ed..f8e1fe35a 100644 ---- a/src/lib/libcrypto/bn/arch/amd64/bignum_sub.S -+++ b/src/lib/libcrypto/bn/arch/amd64/bignum_sub.S -@@ -49,7 +49,6 @@ - - - S2N_BN_SYMBOL(bignum_sub): -- endbr64 - - #if WINDOWS_ABI - push rdi -diff --git a/src/lib/libcrypto/bn/arch/amd64/word_clz.S b/src/lib/libcrypto/bn/arch/amd64/word_clz.S -index 464a9d90f..025e98f9c 100644 ---- a/src/lib/libcrypto/bn/arch/amd64/word_clz.S -+++ b/src/lib/libcrypto/bn/arch/amd64/word_clz.S -@@ -30,7 +30,6 @@ - .text - - S2N_BN_SYMBOL(word_clz): -- endbr64 - - #if WINDOWS_ABI - push rdi -diff --git a/src/lib/libcrypto/bn/asm/modexp512-x86_64.pl b/src/lib/libcrypto/bn/asm/modexp512-x86_64.pl -index af78fff54..2e71a7f03 100644 ---- a/src/lib/libcrypto/bn/asm/modexp512-x86_64.pl -+++ b/src/lib/libcrypto/bn/asm/modexp512-x86_64.pl -@@ -347,7 +347,6 @@ $code.=<<___; - .type MULADD_128x512,\@abi-omnipotent - .align 16 - MULADD_128x512: -- endbr64 - ___ - &MULSTEP_512([map("%r$_",(8..15))], "(+8*0)(%rcx)", "%rsi", "%rbp", "%rbx"); - $code.=<<___; -@@ -415,7 +414,6 @@ $code.=<<___; - .type mont_reduce,\@abi-omnipotent - .align 16 - mont_reduce: -- endbr64 - ___ - - my $STACK_DEPTH = 8; -@@ -678,7 +676,6 @@ $code.=<<___; - .type mont_mul_a3b,\@abi-omnipotent - .align 16 - mont_mul_a3b: -- endbr64 - # - # multiply tmp = src1 * src2 - # For multiply: dst = rcx, src1 = rdi, src2 = rsi -@@ -1080,7 +1077,6 @@ $code.=<<___; - .type sqr_reduce,\@abi-omnipotent - .align 16 - sqr_reduce: -- endbr64 - mov (+$pResult_offset+8)(%rsp), %rcx - ___ - &SQR_512("%rsp+$tmp16_offset+8", "%rcx", [map("%r$_",(10..15,8..9))], "%rbx", "%rbp", "%rsi", "%rdi"); -@@ -1110,7 +1106,6 @@ $code.=<<___; - .globl mod_exp_512 - .type mod_exp_512,\@function,4 - mod_exp_512: -- endbr64 - push %rbp - push %rbx - push %r12 -diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont.pl b/src/lib/libcrypto/bn/asm/x86_64-mont.pl -index 6f5ab331e..cae7309d5 100755 ---- a/src/lib/libcrypto/bn/asm/x86_64-mont.pl -+++ b/src/lib/libcrypto/bn/asm/x86_64-mont.pl -@@ -63,7 +63,6 @@ $code=<<___; - .type bn_mul_mont,\@function,6 - .align 16 - bn_mul_mont: -- endbr64 - test \$3,${num}d - jnz .Lmul_enter - cmp \$8,${num}d -@@ -279,7 +278,6 @@ $code.=<<___; - .align 16 - bn_mul4x_mont: - .Lmul4x_enter: -- endbr64 - push %rbx - push %rbp - push %r12 -@@ -707,7 +705,6 @@ $code.=<<___; - .align 16 - bn_sqr4x_mont: - .Lsqr4x_enter: -- endbr64 - push %rbx - push %rbp - push %r12 -diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl -index 3b3325a6c..7b9c6df27 100755 ---- a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl -+++ b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl -@@ -57,7 +57,6 @@ $code=<<___; - .type bn_mul_mont_gather5,\@function,6 - .align 64 - bn_mul_mont_gather5: -- endbr64 - test \$3,${num}d - jnz .Lmul_enter - cmp \$8,${num}d -@@ -388,7 +387,6 @@ $code.=<<___; - .type bn_mul4x_mont_gather5,\@function,6 - .align 16 - bn_mul4x_mont_gather5: -- endbr64 - .Lmul4x_enter: - mov ${num}d,${num}d - movd `($win64?56:8)`(%rsp),%xmm5 # load 7th argument -@@ -927,7 +925,6 @@ $code.=<<___; - .type bn_scatter5,\@abi-omnipotent - .align 16 - bn_scatter5: -- endbr64 - cmp \$0, $num - jz .Lscatter_epilogue - lea ($tbl,$idx,8),$tbl -@@ -946,7 +943,6 @@ bn_scatter5: - .type bn_gather5,\@abi-omnipotent - .align 16 - bn_gather5: -- endbr64 - .LSEH_begin_bn_gather5: # Win64 thing, but harmless in other cases - # I can't trust assembler to use specific encoding:-( - .byte 0x4c,0x8d,0x14,0x24 # lea (%rsp),%r10 -@@ -1057,7 +1053,6 @@ $code.=<<___; - .type mul_handler,\@abi-omnipotent - .align 16 - mul_handler: -- endbr64 - push %rsi - push %rdi - push %rbx -diff --git a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl -index 3ceed3e89..586e5d6e9 100644 ---- a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl -+++ b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl -@@ -116,7 +116,6 @@ $code=<<___; - .type Camellia_EncryptBlock,\@abi-omnipotent - .align 16 - Camellia_EncryptBlock: -- endbr64 - movl \$128,%eax - subl $arg0d,%eax - movl \$3,$arg0d -@@ -129,7 +128,6 @@ Camellia_EncryptBlock: - .align 16 - .Lenc_rounds: - Camellia_EncryptBlock_Rounds: -- endbr64 - push %rbx - push %rbp - push %r13 -@@ -178,7 +176,6 @@ Camellia_EncryptBlock_Rounds: - .type _x86_64_Camellia_encrypt,\@abi-omnipotent - .align 16 - _x86_64_Camellia_encrypt: -- endbr64 - xor 0($key),@S[1] - xor 4($key),@S[0] # ^=key[0-3] - xor 8($key),@S[3] -@@ -229,7 +226,6 @@ $code.=<<___; - .type Camellia_DecryptBlock,\@abi-omnipotent - .align 16 - Camellia_DecryptBlock: -- endbr64 - movl \$128,%eax - subl $arg0d,%eax - movl \$3,$arg0d -@@ -242,7 +238,6 @@ Camellia_DecryptBlock: - .align 16 - .Ldec_rounds: - Camellia_DecryptBlock_Rounds: -- endbr64 - push %rbx - push %rbp - push %r13 -@@ -291,7 +286,6 @@ Camellia_DecryptBlock_Rounds: - .type _x86_64_Camellia_decrypt,\@abi-omnipotent - .align 16 - _x86_64_Camellia_decrypt: -- endbr64 - xor 0($key),@S[1] - xor 4($key),@S[0] # ^=key[0-3] - xor 8($key),@S[3] -@@ -406,7 +400,6 @@ $code.=<<___; - .type Camellia_Ekeygen,\@function,3 - .align 16 - Camellia_Ekeygen: -- endbr64 - push %rbx - push %rbp - push %r13 -@@ -637,7 +630,6 @@ $code.=<<___; - .type Camellia_cbc_encrypt,\@function,6 - .align 16 - Camellia_cbc_encrypt: -- endbr64 - cmp \$0,%rdx - je .Lcbc_abort - push %rbx -diff --git a/src/lib/libcrypto/md5/asm/md5-x86_64.pl b/src/lib/libcrypto/md5/asm/md5-x86_64.pl -index 06d69094f..c902a1b53 100755 ---- a/src/lib/libcrypto/md5/asm/md5-x86_64.pl -+++ b/src/lib/libcrypto/md5/asm/md5-x86_64.pl -@@ -128,7 +128,6 @@ $code .= < -Date: Mon, 30 Oct 2023 22:00:12 -0500 -Subject: [PATCH 2/4] Revert "Use explicit .text instead of .previous to please - Windows/MinGW on amd64" - -This reverts commit e8192f57c4e5910ce7badced4a24c8827810d567. ---- - src/lib/libcrypto/aes/asm/aes-x86_64.pl | 2 +- - src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl | 2 +- - src/lib/libcrypto/aes/asm/aesni-x86_64.pl | 2 +- - src/lib/libcrypto/aes/asm/bsaes-x86_64.pl | 2 +- - src/lib/libcrypto/aes/asm/vpaes-x86_64.pl | 2 +- - src/lib/libcrypto/bn/asm/x86_64-mont5.pl | 2 +- - src/lib/libcrypto/camellia/asm/cmll-x86_64.pl | 2 +- - src/lib/libcrypto/modes/asm/ghash-x86_64.pl | 2 +- - src/lib/libcrypto/sha/asm/sha1-x86_64.pl | 2 +- - src/lib/libcrypto/sha/asm/sha512-x86_64.pl | 4 ++-- - 10 files changed, 11 insertions(+), 11 deletions(-) - -diff --git a/src/lib/libcrypto/aes/asm/aes-x86_64.pl b/src/lib/libcrypto/aes/asm/aes-x86_64.pl -index b7399b552..2986a9fcc 100755 ---- a/src/lib/libcrypto/aes/asm/aes-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/aes-x86_64.pl -@@ -2535,7 +2535,7 @@ $code.=<<___; - .long 0x80808080, 0x80808080, 0xfefefefe, 0xfefefefe - .long 0x1b1b1b1b, 0x1b1b1b1b, 0, 0 - .align 64 --.text -+.previous - ___ - - # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, -diff --git a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl -index bafa906a0..8a428c9b1 100644 ---- a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl -@@ -1084,7 +1084,7 @@ K_XX_XX: - .long 0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6 # K_60_79 - .long 0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f # pbswap mask - .align 64 --.text -+.previous - ___ - - # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, -diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -index e662fbc7c..09612b1f8 100644 ---- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -@@ -2732,7 +2732,7 @@ $code.=<<___; - .Lxts_magic: - .long 0x87,0,1,0 - .align 64 --.text -+.previous - ___ - - # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, -diff --git a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl -index 20e9e1f71..347f4c302 100644 ---- a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl -@@ -2937,7 +2937,7 @@ _bsaes_const: - .quad 0x6363636363636363, 0x6363636363636363 - .align 64 - .size _bsaes_const,.-_bsaes_const --.text -+.previous - ___ - - # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, -diff --git a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl -index 3ffb1a303..ad5fa7522 100644 ---- a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl -@@ -1063,7 +1063,7 @@ _vpaes_consts: - .quad 0x12D7560F93441D00, 0xCA4B8159D8C58E9C - .align 64 - .size _vpaes_consts,.-_vpaes_consts --.text -+.previous - ___ - - if ($win64) { -diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl -index 7b9c6df27..1c8aa255c 100755 ---- a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl -+++ b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl -@@ -1037,7 +1037,7 @@ $code.=<<___; - .Linc: - .long 0,0, 1,1 - .long 2,2, 2,2 --.text -+.previous - ___ - - # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, -diff --git a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl -index 586e5d6e9..c16725f5c 100644 ---- a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl -+++ b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl -@@ -625,7 +625,7 @@ $_ivp="40(%rsp)"; - $_rsp="48(%rsp)"; - - $code.=<<___; --.text -+.previous - .globl Camellia_cbc_encrypt - .type Camellia_cbc_encrypt,\@function,6 - .align 16 -diff --git a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl -index 71d0822ac..bce62947f 100644 ---- a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl -+++ b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl -@@ -670,7 +670,7 @@ $code.=<<___; - .value 0xB5E0,0xB422,0xB664,0xB7A6,0xB2E8,0xB32A,0xB16C,0xB0AE - .value 0xBBF0,0xBA32,0xB874,0xB9B6,0xBCF8,0xBD3A,0xBF7C,0xBEBE - .align 64 --.text -+.previous - ___ - - # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, -diff --git a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl -index 43eee73c4..1ec7f609a 100755 ---- a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl -+++ b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl -@@ -1079,7 +1079,7 @@ K_XX_XX: - .long 0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc # K_40_59 - .long 0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6 # K_60_79 - .long 0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f # pbswap mask --.text -+.previous - ___ - }}} - $code.=<<___; -diff --git a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl -index 0517eab66..1a7d9bf2d 100755 ---- a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl -+++ b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl -@@ -289,7 +289,7 @@ $TABLE: - .long 0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3 - .long 0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208 - .long 0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2 --.text -+.previous - ___ - } else { - $code.=<<___; -@@ -337,7 +337,7 @@ $TABLE: - .quad 0x3c9ebe0a15c9bebc,0x431d67c49c100d4c - .quad 0x4cc5d4becb3e42b6,0x597f299cfc657e2a - .quad 0x5fcb6fab3ad6faec,0x6c44198c4a475817 --.text -+.previous - ___ - } - --- -2.42.0 - diff --git a/patches/asm/0003-Revert-Use-.section-.rodata-instead-of-a-plain-.roda.patch b/patches/asm/0003-Revert-Use-.section-.rodata-instead-of-a-plain-.roda.patch deleted file mode 100644 index 165f2c0ff8..0000000000 --- a/patches/asm/0003-Revert-Use-.section-.rodata-instead-of-a-plain-.roda.patch +++ /dev/null @@ -1,203 +0,0 @@ -From 1407448470aff891f9a9eff550ecda06202ffd29 Mon Sep 17 00:00:00 2001 -From: Brent Cook -Date: Mon, 30 Oct 2023 22:00:49 -0500 -Subject: [PATCH 3/4] Revert "Use .section .rodata instead of a plain .rodata" - -This reverts commit 67afc07de0ed3a0ccc272df42853ba565a8277c6. ---- - src/lib/libcrypto/aes/asm/aes-x86_64.pl | 2 +- - src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl | 2 +- - src/lib/libcrypto/aes/asm/aesni-x86_64.pl | 2 +- - src/lib/libcrypto/aes/asm/bsaes-x86_64.pl | 2 +- - src/lib/libcrypto/aes/asm/vpaes-x86_64.pl | 2 +- - src/lib/libcrypto/bn/asm/x86_64-mont5.pl | 2 +- - src/lib/libcrypto/camellia/asm/cmll-x86_64.pl | 2 +- - src/lib/libcrypto/modes/asm/ghash-x86_64.pl | 2 +- - src/lib/libcrypto/perlasm/x86gas.pl | 2 +- - src/lib/libcrypto/sha/asm/sha1-x86_64.pl | 2 +- - src/lib/libcrypto/sha/asm/sha512-ppc.pl | 2 +- - src/lib/libcrypto/sha/asm/sha512-x86_64.pl | 4 ++-- - src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl | 2 +- - 13 files changed, 14 insertions(+), 14 deletions(-) - -diff --git a/src/lib/libcrypto/aes/asm/aes-x86_64.pl b/src/lib/libcrypto/aes/asm/aes-x86_64.pl -index 2986a9fcc..d9f501b25 100755 ---- a/src/lib/libcrypto/aes/asm/aes-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/aes-x86_64.pl -@@ -2113,7 +2113,7 @@ ___ - } - - $code.=<<___; --.section .rodata -+.rodata - .align 64 - .LAES_Te: - ___ -diff --git a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl -index 8a428c9b1..4e83b6ba4 100644 ---- a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl -@@ -1075,7 +1075,7 @@ $code.=<<___; - ___ - } - $code.=<<___; --.section .rodata -+.rodata - .align 64 - K_XX_XX: - .long 0x5a827999,0x5a827999,0x5a827999,0x5a827999 # K_00_19 -diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -index 09612b1f8..2ab7106c0 100644 ---- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -@@ -2721,7 +2721,7 @@ ___ - } - - $code.=<<___; --.section .rodata -+.rodata - .align 64 - .Lbswap_mask: - .byte 15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0 -diff --git a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl -index 347f4c302..a40f83601 100644 ---- a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl -@@ -2882,7 +2882,7 @@ $code.=<<___; - ___ - } - $code.=<<___; --.section .rodata -+.rodata - .type _bsaes_const,\@object - .align 64 - _bsaes_const: -diff --git a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl -index ad5fa7522..63af96c1d 100644 ---- a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl -@@ -964,7 +964,7 @@ _vpaes_preheat: - ## Constants ## - ## ## - ######################################################## --.section .rodata -+.rodata - .type _vpaes_consts,\@object - .align 64 - _vpaes_consts: -diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl -index 1c8aa255c..5d30f210c 100755 ---- a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl -+++ b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl -@@ -1032,7 +1032,7 @@ $code.=<<___; - ___ - } - $code.=<<___; --.section .rodata -+.rodata - .align 64 - .Linc: - .long 0,0, 1,1 -diff --git a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl -index c16725f5c..90c56d9e5 100644 ---- a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl -+++ b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl -@@ -599,7 +599,7 @@ sub S0222 { my $i=shift; $i=@SBOX[$i]; $i=($i<<1|$i>>7)&0xff; $i=$i<<16|$i<<8|$i - sub S3033 { my $i=shift; $i=@SBOX[$i]; $i=($i>>1|$i<<7)&0xff; $i=$i<<24|$i<<8|$i; sprintf("0x%08x",$i); } - - $code.=<<___; --.section .rodata -+.rodata - .align 64 - .LCamellia_SIGMA: - .long 0x3bcc908b, 0xa09e667f, 0x4caa73b2, 0xb67ae858 -diff --git a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl -index bce62947f..3ae8629cb 100644 ---- a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl -+++ b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl -@@ -622,7 +622,7 @@ ___ - } - - $code.=<<___; --.section .rodata -+.rodata - .align 64 - .Lbswap_mask: - .byte 15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0 -diff --git a/src/lib/libcrypto/perlasm/x86gas.pl b/src/lib/libcrypto/perlasm/x86gas.pl -index b84e28be9..f28a59054 100644 ---- a/src/lib/libcrypto/perlasm/x86gas.pl -+++ b/src/lib/libcrypto/perlasm/x86gas.pl -@@ -307,7 +307,7 @@ sub ::dataseg - { push(@out,".data\n"); } - - sub ::rodataseg --{ push(@out,".section .rodata\n"); } -+{ push(@out,".rodata\n"); } - - sub ::previous - { push(@out,".previous\n"); } -diff --git a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl -index 1ec7f609a..0abbbab6b 100755 ---- a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl -+++ b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl -@@ -1071,7 +1071,7 @@ $code.=<<___; - ___ - } - $code.=<<___; --.section .rodata -+.rodata - .align 64 - K_XX_XX: - .long 0x5a827999,0x5a827999,0x5a827999,0x5a827999 # K_00_19 -diff --git a/src/lib/libcrypto/sha/asm/sha512-ppc.pl b/src/lib/libcrypto/sha/asm/sha512-ppc.pl -index 28bd997cf..1f02cfdd5 100755 ---- a/src/lib/libcrypto/sha/asm/sha512-ppc.pl -+++ b/src/lib/libcrypto/sha/asm/sha512-ppc.pl -@@ -375,7 +375,7 @@ $code.=<<___; - $ST $H,`7*$SZ`($ctx) - bne Lsha2_block_private - blr -- .section .rodata -+ .rodata - Ltable: - ___ - $code.=<<___ if ($SZ==8); -diff --git a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl -index 1a7d9bf2d..6698b1d40 100755 ---- a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl -+++ b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl -@@ -269,7 +269,7 @@ ___ - - if ($SZ==4) { - $code.=<<___; --.section .rodata -+.rodata - .align 64 - .type $TABLE,\@object - $TABLE: -@@ -293,7 +293,7 @@ $TABLE: - ___ - } else { - $code.=<<___; --.section .rodata -+.rodata - .align 64 - .type $TABLE,\@object - $TABLE: -diff --git a/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl b/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl -index de5d3acfb..510a74b91 100644 ---- a/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl -+++ b/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl -@@ -204,7 +204,7 @@ $code.=<<___; - ret - .size $func,.-$func - --.section .rodata -+.rodata - .align 64 - .type $table,\@object - $table: --- -2.42.0 - diff --git a/patches/asm/0004-Revert-Move-constants-out-of-text-segment-into-rodat.patch b/patches/asm/0004-Revert-Move-constants-out-of-text-segment-into-rodat.patch deleted file mode 100644 index 1a17540555..0000000000 --- a/patches/asm/0004-Revert-Move-constants-out-of-text-segment-into-rodat.patch +++ /dev/null @@ -1,292 +0,0 @@ -From 87b24a6d5a932061cc88b84a856663b328d1c166 Mon Sep 17 00:00:00 2001 -From: Brent Cook -Date: Mon, 30 Oct 2023 22:01:49 -0500 -Subject: [PATCH 4/4] Revert "Move constants out of text segment into rodata to - prepare for xonly support" - -This reverts commit b5834617204e7520b0209bcff7f1c4a559e05422. ---- - src/lib/libcrypto/aes/asm/aes-x86_64.pl | 3 +-- - src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl | 4 ++-- - src/lib/libcrypto/aes/asm/aesni-x86_64.pl | 4 ++-- - src/lib/libcrypto/aes/asm/bsaes-x86_64.pl | 3 +-- - src/lib/libcrypto/aes/asm/vpaes-x86_64.pl | 3 +-- - src/lib/libcrypto/bn/asm/x86_64-mont.pl | 4 ++++ - src/lib/libcrypto/bn/asm/x86_64-mont5.pl | 3 +-- - src/lib/libcrypto/camellia/asm/cmll-x86_64.pl | 4 ++-- - src/lib/libcrypto/modes/asm/ghash-x86_64.pl | 4 ++-- - src/lib/libcrypto/sha/asm/sha1-x86_64.pl | 3 +-- - src/lib/libcrypto/sha/asm/sha512-x86_64.pl | 4 ---- - src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl | 1 - - 12 files changed, 17 insertions(+), 23 deletions(-) - -diff --git a/src/lib/libcrypto/aes/asm/aes-x86_64.pl b/src/lib/libcrypto/aes/asm/aes-x86_64.pl -index d9f501b25..9072f603a 100755 ---- a/src/lib/libcrypto/aes/asm/aes-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/aes-x86_64.pl -@@ -2113,7 +2113,6 @@ ___ - } - - $code.=<<___; --.rodata - .align 64 - .LAES_Te: - ___ -@@ -2534,8 +2533,8 @@ ___ - $code.=<<___; - .long 0x80808080, 0x80808080, 0xfefefefe, 0xfefefefe - .long 0x1b1b1b1b, 0x1b1b1b1b, 0, 0 -+.asciz "AES for x86_64, CRYPTOGAMS by " - .align 64 --.previous - ___ - - # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, -diff --git a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl -index 4e83b6ba4..880bcc2d5 100644 ---- a/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl -@@ -1075,7 +1075,6 @@ $code.=<<___; - ___ - } - $code.=<<___; --.rodata - .align 64 - K_XX_XX: - .long 0x5a827999,0x5a827999,0x5a827999,0x5a827999 # K_00_19 -@@ -1083,8 +1082,9 @@ K_XX_XX: - .long 0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc # K_40_59 - .long 0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6 # K_60_79 - .long 0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f # pbswap mask -+ -+.asciz "AESNI-CBC+SHA1 stitch for x86_64, CRYPTOGAMS by " - .align 64 --.previous - ___ - - # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, -diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -index 2ab7106c0..96978bd35 100644 ---- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -@@ -2721,7 +2721,6 @@ ___ - } - - $code.=<<___; --.rodata - .align 64 - .Lbswap_mask: - .byte 15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0 -@@ -2731,8 +2730,9 @@ $code.=<<___; - .long 1,0,0,0 - .Lxts_magic: - .long 0x87,0,1,0 -+ -+.asciz "AES for Intel AES-NI, CRYPTOGAMS by " - .align 64 --.previous - ___ - - # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, -diff --git a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl -index a40f83601..14dc2c02e 100644 ---- a/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl -@@ -2882,7 +2882,6 @@ $code.=<<___; - ___ - } - $code.=<<___; --.rodata - .type _bsaes_const,\@object - .align 64 - _bsaes_const: -@@ -2935,9 +2934,9 @@ _bsaes_const: - .quad 0x02060a0e03070b0f, 0x0004080c0105090d - .L63: - .quad 0x6363636363636363, 0x6363636363636363 -+.asciz "Bit-sliced AES for x86_64/SSSE3, Emilia Käsper, Peter Schwabe, Andy Polyakov" - .align 64 - .size _bsaes_const,.-_bsaes_const --.previous - ___ - - # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, -diff --git a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl -index 63af96c1d..bd7f45b85 100644 ---- a/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl -@@ -964,7 +964,6 @@ _vpaes_preheat: - ## Constants ## - ## ## - ######################################################## --.rodata - .type _vpaes_consts,\@object - .align 64 - _vpaes_consts: -@@ -1061,9 +1060,9 @@ _vpaes_consts: - .Lk_dsbo: # decryption sbox final output - .quad 0x1387EA537EF94000, 0xC7AA6DB9D4943E2D - .quad 0x12D7560F93441D00, 0xCA4B8159D8C58E9C -+.asciz "Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)" - .align 64 - .size _vpaes_consts,.-_vpaes_consts --.previous - ___ - - if ($win64) { -diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont.pl b/src/lib/libcrypto/bn/asm/x86_64-mont.pl -index cae7309d5..c35493e80 100755 ---- a/src/lib/libcrypto/bn/asm/x86_64-mont.pl -+++ b/src/lib/libcrypto/bn/asm/x86_64-mont.pl -@@ -1495,6 +1495,10 @@ $code.=<<___; - .size bn_sqr4x_mont,.-bn_sqr4x_mont - ___ - }}} -+$code.=<<___; -+.asciz "Montgomery Multiplication for x86_64, CRYPTOGAMS by " -+.align 16 -+___ - - print $code; - close STDOUT; -diff --git a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl -index 5d30f210c..bb7ad4c4b 100755 ---- a/src/lib/libcrypto/bn/asm/x86_64-mont5.pl -+++ b/src/lib/libcrypto/bn/asm/x86_64-mont5.pl -@@ -1032,12 +1032,11 @@ $code.=<<___; - ___ - } - $code.=<<___; --.rodata - .align 64 - .Linc: - .long 0,0, 1,1 - .long 2,2, 2,2 --.previous -+.asciz "Montgomery Multiplication with scatter/gather for x86_64, CRYPTOGAMS by " - ___ - - # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, -diff --git a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl -index 90c56d9e5..df6bf11a2 100644 ---- a/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl -+++ b/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl -@@ -599,7 +599,6 @@ sub S0222 { my $i=shift; $i=@SBOX[$i]; $i=($i<<1|$i>>7)&0xff; $i=$i<<16|$i<<8|$i - sub S3033 { my $i=shift; $i=@SBOX[$i]; $i=($i>>1|$i<<7)&0xff; $i=$i<<24|$i<<8|$i; sprintf("0x%08x",$i); } - - $code.=<<___; --.rodata - .align 64 - .LCamellia_SIGMA: - .long 0x3bcc908b, 0xa09e667f, 0x4caa73b2, 0xb67ae858 -@@ -625,7 +624,6 @@ $_ivp="40(%rsp)"; - $_rsp="48(%rsp)"; - - $code.=<<___; --.previous - .globl Camellia_cbc_encrypt - .type Camellia_cbc_encrypt,\@function,6 - .align 16 -@@ -859,6 +857,8 @@ Camellia_cbc_encrypt: - .Lcbc_abort: - ret - .size Camellia_cbc_encrypt,.-Camellia_cbc_encrypt -+ -+.asciz "Camellia for x86_64 by " - ___ - } - -diff --git a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl -index 3ae8629cb..38d779edb 100644 ---- a/src/lib/libcrypto/modes/asm/ghash-x86_64.pl -+++ b/src/lib/libcrypto/modes/asm/ghash-x86_64.pl -@@ -622,7 +622,6 @@ ___ - } - - $code.=<<___; --.rodata - .align 64 - .Lbswap_mask: - .byte 15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0 -@@ -669,8 +668,9 @@ $code.=<<___; - .value 0xA7D0,0xA612,0xA454,0xA596,0xA0D8,0xA11A,0xA35C,0xA29E - .value 0xB5E0,0xB422,0xB664,0xB7A6,0xB2E8,0xB32A,0xB16C,0xB0AE - .value 0xBBF0,0xBA32,0xB874,0xB9B6,0xBCF8,0xBD3A,0xBF7C,0xBEBE -+ -+.asciz "GHASH for x86_64, CRYPTOGAMS by " - .align 64 --.previous - ___ - - # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame, -diff --git a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl -index 0abbbab6b..cc8ef5337 100755 ---- a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl -+++ b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl -@@ -1071,7 +1071,6 @@ $code.=<<___; - ___ - } - $code.=<<___; --.rodata - .align 64 - K_XX_XX: - .long 0x5a827999,0x5a827999,0x5a827999,0x5a827999 # K_00_19 -@@ -1079,10 +1078,10 @@ K_XX_XX: - .long 0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc # K_40_59 - .long 0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6 # K_60_79 - .long 0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f # pbswap mask --.previous - ___ - }}} - $code.=<<___; -+.asciz "SHA1 block transform for x86_64, CRYPTOGAMS by " - .align 64 - ___ - -diff --git a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl -index 6698b1d40..bc4b2e748 100755 ---- a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl -+++ b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl -@@ -269,7 +269,6 @@ ___ - - if ($SZ==4) { - $code.=<<___; --.rodata - .align 64 - .type $TABLE,\@object - $TABLE: -@@ -289,11 +288,9 @@ $TABLE: - .long 0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3 - .long 0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208 - .long 0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2 --.previous - ___ - } else { - $code.=<<___; --.rodata - .align 64 - .type $TABLE,\@object - $TABLE: -@@ -337,7 +334,6 @@ $TABLE: - .quad 0x3c9ebe0a15c9bebc,0x431d67c49c100d4c - .quad 0x4cc5d4becb3e42b6,0x597f299cfc657e2a - .quad 0x5fcb6fab3ad6faec,0x6c44198c4a475817 --.previous - ___ - } - -diff --git a/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl b/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl -index 510a74b91..afadd5d2f 100644 ---- a/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl -+++ b/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl -@@ -204,7 +204,6 @@ $code.=<<___; - ret - .size $func,.-$func - --.rodata - .align 64 - .type $table,\@object - $table: --- -2.42.0 - diff --git a/patches/asm/0005-Revert-aesni-endbr64.patch b/patches/asm/0005-Revert-aesni-endbr64.patch deleted file mode 100644 index f2094e6821..0000000000 --- a/patches/asm/0005-Revert-aesni-endbr64.patch +++ /dev/null @@ -1,20 +0,0 @@ -commit ac992937b461479b41f7f65e79646ef0a715f95d -Author: Brent Cook -Date: Thu Nov 9 12:29:33 2023 -0600 - - Revert "aesni_ctr32_encrypt_blocks() is called indirectly from C code, so it" - - This reverts commit 52f96c842e82486510ffc2513e71323b70242f28. - -diff --git a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -index 07d40a84a..c261a3795 100644 ---- a/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -+++ b/src/lib/libcrypto/aes/asm/aesni-x86_64.pl -@@ -1025,7 +1025,6 @@ $code.=<<___; - .type aesni_ctr32_encrypt_blocks,\@function,5 - .align 16 - aesni_ctr32_encrypt_blocks: -- endbr64 - lea (%rsp),%rax - push %rbp - sub \$$frame_size,%rsp diff --git a/patches/asm/endbr64.patch b/patches/asm/endbr64.patch new file mode 100644 index 0000000000..05cf0eb97b --- /dev/null +++ b/patches/asm/endbr64.patch @@ -0,0 +1,1215 @@ +Replace uses of endbr64 with _CET_ENDBR from cet.h + +cet.h is needed for other platforms to emit the relevant .gnu.properties +sections that are necessary for them to enable IBT. It also avoids issues +with older toolchains on macOS that explode on encountering endbr64. + +based on a diff by kettenis +ok beck kettenis tb + +Index: x86_64cpuid.pl +=================================================================== +RCS file: /cvs/src/lib/libcrypto/x86_64cpuid.pl,v +diff -u -p -r1.15 x86_64cpuid.pl +--- x86_64cpuid.pl 25 Apr 2023 04:42:25 -0000 1.15 ++++ x86_64cpuid.pl 3 Dec 2023 20:18:30 -0000 +@@ -18,7 +18,7 @@ print<<___; + .extern OPENSSL_cpuid_setup + .hidden OPENSSL_cpuid_setup + .section .init +- endbr64 ++ _CET_ENDBR + call OPENSSL_cpuid_setup + + .extern OPENSSL_ia32cap_P +@@ -30,7 +30,7 @@ print<<___; + .type OPENSSL_ia32_cpuid,\@abi-omnipotent + .align 16 + OPENSSL_ia32_cpuid: +- endbr64 ++ _CET_ENDBR + mov %rbx,%r8 # save %rbx + + xor %eax,%eax +Index: aes/asm/aes-x86_64.pl +=================================================================== +RCS file: /cvs/src/lib/libcrypto/aes/asm/aes-x86_64.pl,v +diff -u -p -r1.12 aes-x86_64.pl +--- aes/asm/aes-x86_64.pl 25 Apr 2023 04:42:25 -0000 1.12 ++++ aes/asm/aes-x86_64.pl 3 Dec 2023 20:18:30 -0000 +@@ -318,7 +318,7 @@ $code.=<<___; + .type _x86_64_AES_encrypt,\@abi-omnipotent + .align 16 + _x86_64_AES_encrypt: +- endbr64 ++ _CET_ENDBR + xor 0($key),$s0 # xor with key + xor 4($key),$s1 + xor 8($key),$s2 +@@ -549,7 +549,7 @@ $code.=<<___; + .type _x86_64_AES_encrypt_compact,\@abi-omnipotent + .align 16 + _x86_64_AES_encrypt_compact: +- endbr64 ++ _CET_ENDBR + lea 128($sbox),$inp # size optimization + mov 0-128($inp),$acc1 # prefetch Te4 + mov 32-128($inp),$acc2 +@@ -595,7 +595,7 @@ $code.=<<___; + .hidden asm_AES_encrypt + asm_AES_encrypt: + AES_encrypt: +- endbr64 ++ _CET_ENDBR + push %rbx + push %rbp + push %r12 +@@ -887,7 +887,7 @@ $code.=<<___; + .type _x86_64_AES_decrypt,\@abi-omnipotent + .align 16 + _x86_64_AES_decrypt: +- endbr64 ++ _CET_ENDBR + xor 0($key),$s0 # xor with key + xor 4($key),$s1 + xor 8($key),$s2 +@@ -1142,7 +1142,7 @@ $code.=<<___; + .type _x86_64_AES_decrypt_compact,\@abi-omnipotent + .align 16 + _x86_64_AES_decrypt_compact: +- endbr64 ++ _CET_ENDBR + lea 128($sbox),$inp # size optimization + mov 0-128($inp),$acc1 # prefetch Td4 + mov 32-128($inp),$acc2 +@@ -1197,7 +1197,7 @@ $code.=<<___; + .hidden asm_AES_decrypt + asm_AES_decrypt: + AES_decrypt: +- endbr64 ++ _CET_ENDBR + push %rbx + push %rbp + push %r12 +@@ -1297,7 +1297,7 @@ $code.=<<___; + .type AES_set_encrypt_key,\@function,3 + .align 16 + AES_set_encrypt_key: +- endbr64 ++ _CET_ENDBR + push %rbx + push %rbp + push %r12 # redundant, but allows to share +@@ -1323,7 +1323,7 @@ AES_set_encrypt_key: + .type _x86_64_AES_set_encrypt_key,\@abi-omnipotent + .align 16 + _x86_64_AES_set_encrypt_key: +- endbr64 ++ _CET_ENDBR + mov %esi,%ecx # %ecx=bits + mov %rdi,%rsi # %rsi=userKey + mov %rdx,%rdi # %rdi=key +@@ -1569,7 +1569,7 @@ $code.=<<___; + .type AES_set_decrypt_key,\@function,3 + .align 16 + AES_set_decrypt_key: +- endbr64 ++ _CET_ENDBR + push %rbx + push %rbp + push %r12 +@@ -1669,7 +1669,7 @@ $code.=<<___; + .hidden asm_AES_cbc_encrypt + asm_AES_cbc_encrypt: + AES_cbc_encrypt: +- endbr64 ++ _CET_ENDBR + cmp \$0,%rdx # check length + je .Lcbc_epilogue + pushfq +@@ -2561,7 +2561,7 @@ $code.=<<___; + .type block_se_handler,\@abi-omnipotent + .align 16 + block_se_handler: +- endbr64 ++ _CET_ENDBR + push %rsi + push %rdi + push %rbx +@@ -2620,7 +2620,7 @@ block_se_handler: + .type key_se_handler,\@abi-omnipotent + .align 16 + key_se_handler: +- endbr64 ++ _CET_ENDBR + push %rsi + push %rdi + push %rbx +@@ -2678,7 +2678,7 @@ key_se_handler: + .type cbc_se_handler,\@abi-omnipotent + .align 16 + cbc_se_handler: +- endbr64 ++ _CET_ENDBR + push %rsi + push %rdi + push %rbx +Index: aes/asm/aesni-sha1-x86_64.pl +=================================================================== +RCS file: /cvs/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl,v +diff -u -p -r1.8 aesni-sha1-x86_64.pl +--- aes/asm/aesni-sha1-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.8 ++++ aes/asm/aesni-sha1-x86_64.pl 3 Dec 2023 20:18:30 -0000 +@@ -89,7 +89,7 @@ $code.=<<___; + .type aesni_cbc_sha1_enc,\@abi-omnipotent + .align 16 + aesni_cbc_sha1_enc: +- endbr64 ++ _CET_ENDBR + # caller should check for SSSE3 and AES-NI bits + mov OPENSSL_ia32cap_P+0(%rip),%r10d + mov OPENSSL_ia32cap_P+4(%rip),%r11d +@@ -133,7 +133,7 @@ $code.=<<___; + .type aesni_cbc_sha1_enc_ssse3,\@function,6 + .align 16 + aesni_cbc_sha1_enc_ssse3: +- endbr64 ++ _CET_ENDBR + mov `($win64?56:8)`(%rsp),$inp # load 7th argument + #shr \$6,$len # debugging artefact + #jz .Lepilogue_ssse3 # debugging artefact +@@ -652,7 +652,7 @@ $code.=<<___; + .type aesni_cbc_sha1_enc_avx,\@function,6 + .align 16 + aesni_cbc_sha1_enc_avx: +- endbr64 ++ _CET_ENDBR + mov `($win64?56:8)`(%rsp),$inp # load 7th argument + #shr \$6,$len # debugging artefact + #jz .Lepilogue_avx # debugging artefact +@@ -1103,7 +1103,7 @@ $code.=<<___; + .type ssse3_handler,\@abi-omnipotent + .align 16 + ssse3_handler: +- endbr64 ++ _CET_ENDBR + push %rsi + push %rdi + push %rbx +Index: aes/asm/aesni-x86_64.pl +=================================================================== +RCS file: /cvs/src/lib/libcrypto/aes/asm/aesni-x86_64.pl,v +diff -u -p -r1.12 aesni-x86_64.pl +--- aes/asm/aesni-x86_64.pl 18 Sep 2023 22:38:16 -0000 1.12 ++++ aes/asm/aesni-x86_64.pl 3 Dec 2023 20:18:30 -0000 +@@ -242,7 +242,7 @@ $code.=<<___; + .type ${PREFIX}_encrypt,\@abi-omnipotent + .align 16 + ${PREFIX}_encrypt: +- endbr64 ++ _CET_ENDBR + movups ($inp),$inout0 # load input + mov 240($key),$rounds # key->rounds + ___ +@@ -256,7 +256,7 @@ $code.=<<___; + .type ${PREFIX}_decrypt,\@abi-omnipotent + .align 16 + ${PREFIX}_decrypt: +- endbr64 ++ _CET_ENDBR + movups ($inp),$inout0 # load input + mov 240($key),$rounds # key->rounds + ___ +@@ -286,7 +286,7 @@ $code.=<<___; + .type _aesni_${dir}rypt3,\@abi-omnipotent + .align 16 + _aesni_${dir}rypt3: +- endbr64 ++ _CET_ENDBR + $movkey ($key),$rndkey0 + shr \$1,$rounds + $movkey 16($key),$rndkey1 +@@ -331,7 +331,7 @@ $code.=<<___; + .type _aesni_${dir}rypt4,\@abi-omnipotent + .align 16 + _aesni_${dir}rypt4: +- endbr64 ++ _CET_ENDBR + $movkey ($key),$rndkey0 + shr \$1,$rounds + $movkey 16($key),$rndkey1 +@@ -377,7 +377,7 @@ $code.=<<___; + .type _aesni_${dir}rypt6,\@abi-omnipotent + .align 16 + _aesni_${dir}rypt6: +- endbr64 ++ _CET_ENDBR + $movkey ($key),$rndkey0 + shr \$1,$rounds + $movkey 16($key),$rndkey1 +@@ -442,7 +442,7 @@ $code.=<<___; + .type _aesni_${dir}rypt8,\@abi-omnipotent + .align 16 + _aesni_${dir}rypt8: +- endbr64 ++ _CET_ENDBR + $movkey ($key),$rndkey0 + shr \$1,$rounds + $movkey 16($key),$rndkey1 +@@ -531,7 +531,7 @@ $code.=<<___; + .type aesni_ecb_encrypt,\@function,5 + .align 16 + aesni_ecb_encrypt: +- endbr64 ++ _CET_ENDBR + and \$-16,$len + jz .Lecb_ret + +@@ -837,7 +837,7 @@ $code.=<<___; + .type aesni_ccm64_encrypt_blocks,\@function,6 + .align 16 + aesni_ccm64_encrypt_blocks: +- endbr64 ++ _CET_ENDBR + ___ + $code.=<<___ if ($win64); + lea -0x58(%rsp),%rsp +@@ -1025,7 +1025,7 @@ $code.=<<___; + .type aesni_ctr32_encrypt_blocks,\@function,5 + .align 16 + aesni_ctr32_encrypt_blocks: +- endbr64 ++ _CET_ENDBR + lea (%rsp),%rax + push %rbp + sub \$$frame_size,%rsp +@@ -2487,7 +2487,7 @@ $code.=<<___; + .type ${PREFIX}_set_decrypt_key,\@abi-omnipotent + .align 16 + ${PREFIX}_set_decrypt_key: +- endbr64 ++ _CET_ENDBR + sub \$8,%rsp + call __aesni_set_encrypt_key + shl \$4,$bits # rounds-1 after _aesni_set_encrypt_key +@@ -2538,7 +2538,7 @@ $code.=<<___; + .type ${PREFIX}_set_encrypt_key,\@abi-omnipotent + .align 16 + ${PREFIX}_set_encrypt_key: +- endbr64 ++ _CET_ENDBR + __aesni_set_encrypt_key: + sub \$8,%rsp + mov \$-1,%rax +@@ -2760,7 +2760,7 @@ $code.=<<___ if ($PREFIX eq "aesni"); + .type ecb_se_handler,\@abi-omnipotent + .align 16 + ecb_se_handler: +- endbr64 ++ _CET_ENDBR + push %rsi + push %rdi + push %rbx +@@ -2780,7 +2780,7 @@ ecb_se_handler: + .type ccm64_se_handler,\@abi-omnipotent + .align 16 + ccm64_se_handler: +- endbr64 ++ _CET_ENDBR + push %rsi + push %rdi + push %rbx +@@ -2822,7 +2822,7 @@ ccm64_se_handler: + .type ctr32_se_handler,\@abi-omnipotent + .align 16 + ctr32_se_handler: +- endbr64 ++ _CET_ENDBR + push %rsi + push %rdi + push %rbx +@@ -2858,7 +2858,7 @@ ctr32_se_handler: + .type xts_se_handler,\@abi-omnipotent + .align 16 + xts_se_handler: +- endbr64 ++ _CET_ENDBR + push %rsi + push %rdi + push %rbx +@@ -2900,7 +2900,7 @@ $code.=<<___; + .type cbc_se_handler,\@abi-omnipotent + .align 16 + cbc_se_handler: +- endbr64 ++ _CET_ENDBR + push %rsi + push %rdi + push %rbx +Index: aes/asm/bsaes-x86_64.pl +=================================================================== +RCS file: /cvs/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl,v +diff -u -p -r1.6 bsaes-x86_64.pl +--- aes/asm/bsaes-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.6 ++++ aes/asm/bsaes-x86_64.pl 3 Dec 2023 20:18:30 -0000 +@@ -813,7 +813,7 @@ $code.=<<___; + .type _bsaes_encrypt8,\@abi-omnipotent + .align 64 + _bsaes_encrypt8: +- endbr64 ++ _CET_ENDBR + lea .LBS0(%rip), $const # constants table + + movdqa ($key), @XMM[9] # round 0 key +@@ -878,7 +878,7 @@ $code.=<<___; + .type _bsaes_decrypt8,\@abi-omnipotent + .align 64 + _bsaes_decrypt8: +- endbr64 ++ _CET_ENDBR + lea .LBS0(%rip), $const # constants table + + movdqa ($key), @XMM[9] # round 0 key +@@ -970,7 +970,7 @@ $code.=<<___; + .type _bsaes_key_convert,\@abi-omnipotent + .align 16 + _bsaes_key_convert: +- endbr64 ++ _CET_ENDBR + lea .Lmasks(%rip), $const + movdqu ($inp), %xmm7 # load round 0 key + lea 0x10($inp), $inp +@@ -1060,7 +1060,7 @@ $code.=<<___; + .type bsaes_enc_key_convert,\@function,2 + .align 16 + bsaes_enc_key_convert: +- endbr64 ++ _CET_ENDBR + mov 240($inp),%r10d # pass rounds + mov $inp,%rcx # pass key + mov $out,%rax # pass key schedule +@@ -1075,7 +1075,7 @@ bsaes_enc_key_convert: + .align 16 + bsaes_encrypt_128: + .Lenc128_loop: +- endbr64 ++ _CET_ENDBR + movdqu 0x00($inp), @XMM[0] # load input + movdqu 0x10($inp), @XMM[1] + movdqu 0x20($inp), @XMM[2] +@@ -1108,7 +1108,7 @@ bsaes_encrypt_128: + .type bsaes_dec_key_convert,\@function,2 + .align 16 + bsaes_dec_key_convert: +- endbr64 ++ _CET_ENDBR + mov 240($inp),%r10d # pass rounds + mov $inp,%rcx # pass key + mov $out,%rax # pass key schedule +@@ -1123,7 +1123,7 @@ bsaes_dec_key_convert: + .type bsaes_decrypt_128,\@function,4 + .align 16 + bsaes_decrypt_128: +- endbr64 ++ _CET_ENDBR + .Ldec128_loop: + movdqu 0x00($inp), @XMM[0] # load input + movdqu 0x10($inp), @XMM[1] +@@ -1169,7 +1169,7 @@ $code.=<<___; + .type bsaes_ecb_encrypt_blocks,\@abi-omnipotent + .align 16 + bsaes_ecb_encrypt_blocks: +- endbr64 ++ _CET_ENDBR + mov %rsp, %rax + .Lecb_enc_prologue: + push %rbp +@@ -1371,7 +1371,7 @@ $code.=<<___; + .type bsaes_ecb_decrypt_blocks,\@abi-omnipotent + .align 16 + bsaes_ecb_decrypt_blocks: +- endbr64 ++ _CET_ENDBR + mov %rsp, %rax + .Lecb_dec_prologue: + push %rbp +@@ -1577,7 +1577,7 @@ $code.=<<___; + .type bsaes_cbc_encrypt,\@abi-omnipotent + .align 16 + bsaes_cbc_encrypt: +- endbr64 ++ _CET_ENDBR + ___ + $code.=<<___ if ($win64); + mov 48(%rsp),$arg6 # pull direction flag +@@ -1865,7 +1865,7 @@ $code.=<<___; + .type bsaes_ctr32_encrypt_blocks,\@abi-omnipotent + .align 16 + bsaes_ctr32_encrypt_blocks: +- endbr64 ++ _CET_ENDBR + mov %rsp, %rax + .Lctr_enc_prologue: + push %rbp +@@ -2107,7 +2107,7 @@ $code.=<<___; + .type bsaes_xts_encrypt,\@abi-omnipotent + .align 16 + bsaes_xts_encrypt: +- endbr64 ++ _CET_ENDBR + mov %rsp, %rax + .Lxts_enc_prologue: + push %rbp +@@ -2489,7 +2489,7 @@ $code.=<<___; + .type bsaes_xts_decrypt,\@abi-omnipotent + .align 16 + bsaes_xts_decrypt: +- endbr64 ++ _CET_ENDBR + mov %rsp, %rax + .Lxts_dec_prologue: + push %rbp +@@ -2966,7 +2966,7 @@ $code.=<<___; + .type se_handler,\@abi-omnipotent + .align 16 + se_handler: +- endbr64 ++ _CET_ENDBR + push %rsi + push %rdi + push %rbx +Index: aes/asm/vpaes-x86_64.pl +=================================================================== +RCS file: /cvs/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl,v +diff -u -p -r1.5 vpaes-x86_64.pl +--- aes/asm/vpaes-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.5 ++++ aes/asm/vpaes-x86_64.pl 3 Dec 2023 20:18:30 -0000 +@@ -82,7 +82,7 @@ $code.=<<___; + .type _vpaes_encrypt_core,\@abi-omnipotent + .align 16 + _vpaes_encrypt_core: +- endbr64 ++ _CET_ENDBR + mov %rdx, %r9 + mov \$16, %r11 + mov 240(%rdx),%eax +@@ -173,7 +173,7 @@ _vpaes_encrypt_core: + .type _vpaes_decrypt_core,\@abi-omnipotent + .align 16 + _vpaes_decrypt_core: +- endbr64 ++ _CET_ENDBR + mov %rdx, %r9 # load key + mov 240(%rdx),%eax + movdqa %xmm9, %xmm1 +@@ -281,7 +281,7 @@ _vpaes_decrypt_core: + .type _vpaes_schedule_core,\@abi-omnipotent + .align 16 + _vpaes_schedule_core: +- endbr64 ++ _CET_ENDBR + # rdi = key + # rsi = size in bits + # rdx = buffer +@@ -467,7 +467,7 @@ _vpaes_schedule_core: + .type _vpaes_schedule_192_smear,\@abi-omnipotent + .align 16 + _vpaes_schedule_192_smear: +- endbr64 ++ _CET_ENDBR + pshufd \$0x80, %xmm6, %xmm0 # d c 0 0 -> c 0 0 0 + pxor %xmm0, %xmm6 # -> c+d c 0 0 + pshufd \$0xFE, %xmm7, %xmm0 # b a _ _ -> b b b a +@@ -499,7 +499,7 @@ _vpaes_schedule_192_smear: + .type _vpaes_schedule_round,\@abi-omnipotent + .align 16 + _vpaes_schedule_round: +- endbr64 ++ _CET_ENDBR + # extract rcon from xmm8 + pxor %xmm1, %xmm1 + palignr \$15, %xmm8, %xmm1 +@@ -567,7 +567,7 @@ _vpaes_schedule_low_round: + .type _vpaes_schedule_transform,\@abi-omnipotent + .align 16 + _vpaes_schedule_transform: +- endbr64 ++ _CET_ENDBR + movdqa %xmm9, %xmm1 + pandn %xmm0, %xmm1 + psrld \$4, %xmm1 +@@ -606,7 +606,7 @@ _vpaes_schedule_transform: + .type _vpaes_schedule_mangle,\@abi-omnipotent + .align 16 + _vpaes_schedule_mangle: +- endbr64 ++ _CET_ENDBR + movdqa %xmm0, %xmm4 # save xmm0 for later + movdqa .Lk_mc_forward(%rip),%xmm5 + test %rcx, %rcx +@@ -680,7 +680,7 @@ _vpaes_schedule_mangle: + .type ${PREFIX}_set_encrypt_key,\@function,3 + .align 16 + ${PREFIX}_set_encrypt_key: +- endbr64 ++ _CET_ENDBR + ___ + $code.=<<___ if ($win64); + lea -0xb8(%rsp),%rsp +@@ -729,7 +729,7 @@ $code.=<<___; + .type ${PREFIX}_set_decrypt_key,\@function,3 + .align 16 + ${PREFIX}_set_decrypt_key: +- endbr64 ++ _CET_ENDBR + ___ + $code.=<<___ if ($win64); + lea -0xb8(%rsp),%rsp +@@ -783,7 +783,7 @@ $code.=<<___; + .type ${PREFIX}_encrypt,\@function,3 + .align 16 + ${PREFIX}_encrypt: +- endbr64 ++ _CET_ENDBR + ___ + $code.=<<___ if ($win64); + lea -0xb8(%rsp),%rsp +@@ -827,7 +827,7 @@ $code.=<<___; + .type ${PREFIX}_decrypt,\@function,3 + .align 16 + ${PREFIX}_decrypt: +- endbr64 ++ _CET_ENDBR + ___ + $code.=<<___ if ($win64); + lea -0xb8(%rsp),%rsp +@@ -877,7 +877,7 @@ $code.=<<___; + .type ${PREFIX}_cbc_encrypt,\@function,6 + .align 16 + ${PREFIX}_cbc_encrypt: +- endbr64 ++ _CET_ENDBR + xchg $key,$len + ___ + ($len,$key)=($key,$len); +@@ -961,7 +961,7 @@ $code.=<<___; + .type _vpaes_preheat,\@abi-omnipotent + .align 16 + _vpaes_preheat: +- endbr64 ++ _CET_ENDBR + lea .Lk_s0F(%rip), %r10 + movdqa -0x20(%r10), %xmm10 # .Lk_inv + movdqa -0x10(%r10), %xmm11 # .Lk_inv+16 +@@ -1092,7 +1092,7 @@ $code.=<<___; + .type se_handler,\@abi-omnipotent + .align 16 + se_handler: +- endbr64 ++ _CET_ENDBR + push %rsi + push %rdi + push %rbx +Index: bn/s2n_bignum_internal.h +=================================================================== +RCS file: /cvs/src/lib/libcrypto/bn/s2n_bignum_internal.h,v +diff -u -p -r1.2 s2n_bignum_internal.h +--- bn/s2n_bignum_internal.h 21 Jan 2023 15:53:54 -0000 1.2 ++++ bn/s2n_bignum_internal.h 3 Dec 2023 20:22:18 -0000 +@@ -18,6 +18,12 @@ + # define S2N_BN_SYMBOL(name) name + #endif + ++#ifdef __CET__ ++# include ++#else ++# define _CET_ENDBR ++#endif ++ + #define S2N_BN_SYM_VISIBILITY_DIRECTIVE(name) .globl S2N_BN_SYMBOL(name) + #ifdef S2N_BN_HIDE_SYMBOLS + # ifdef __APPLE__ +Index: bn/arch/amd64/bignum_add.S +=================================================================== +RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_add.S,v +diff -u -p -r1.4 bignum_add.S +--- bn/arch/amd64/bignum_add.S 25 Apr 2023 04:42:26 -0000 1.4 ++++ bn/arch/amd64/bignum_add.S 3 Dec 2023 20:18:30 -0000 +@@ -49,7 +49,7 @@ + + + S2N_BN_SYMBOL(bignum_add): +- endbr64 ++ _CET_ENDBR + + #if WINDOWS_ABI + push rdi +Index: bn/arch/amd64/bignum_cmadd.S +=================================================================== +RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_cmadd.S,v +diff -u -p -r1.4 bignum_cmadd.S +--- bn/arch/amd64/bignum_cmadd.S 25 Apr 2023 04:42:26 -0000 1.4 ++++ bn/arch/amd64/bignum_cmadd.S 3 Dec 2023 20:18:30 -0000 +@@ -54,7 +54,7 @@ + + + S2N_BN_SYMBOL(bignum_cmadd): +- endbr64 ++ _CET_ENDBR + + #if WINDOWS_ABI + push rdi +Index: bn/arch/amd64/bignum_cmul.S +=================================================================== +RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_cmul.S,v +diff -u -p -r1.4 bignum_cmul.S +--- bn/arch/amd64/bignum_cmul.S 25 Apr 2023 04:42:26 -0000 1.4 ++++ bn/arch/amd64/bignum_cmul.S 3 Dec 2023 20:18:30 -0000 +@@ -51,7 +51,7 @@ + + + S2N_BN_SYMBOL(bignum_cmul): +- endbr64 ++ _CET_ENDBR + + #if WINDOWS_ABI + push rdi +Index: bn/arch/amd64/bignum_mul.S +=================================================================== +RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_mul.S,v +diff -u -p -r1.4 bignum_mul.S +--- bn/arch/amd64/bignum_mul.S 25 Apr 2023 04:42:26 -0000 1.4 ++++ bn/arch/amd64/bignum_mul.S 3 Dec 2023 20:18:30 -0000 +@@ -59,7 +59,7 @@ + + + S2N_BN_SYMBOL(bignum_mul): +- endbr64 ++ _CET_ENDBR + + #if WINDOWS_ABI + push rdi +Index: bn/arch/amd64/bignum_mul_4_8_alt.S +=================================================================== +RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_mul_4_8_alt.S,v +diff -u -p -r1.4 bignum_mul_4_8_alt.S +--- bn/arch/amd64/bignum_mul_4_8_alt.S 25 Apr 2023 04:42:26 -0000 1.4 ++++ bn/arch/amd64/bignum_mul_4_8_alt.S 3 Dec 2023 20:18:30 -0000 +@@ -72,7 +72,7 @@ + adc h, rdx + + S2N_BN_SYMBOL(bignum_mul_4_8_alt): +- endbr64 ++ _CET_ENDBR + + #if WINDOWS_ABI + push rdi +Index: bn/arch/amd64/bignum_mul_8_16_alt.S +=================================================================== +RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_mul_8_16_alt.S,v +diff -u -p -r1.4 bignum_mul_8_16_alt.S +--- bn/arch/amd64/bignum_mul_8_16_alt.S 25 Apr 2023 04:42:26 -0000 1.4 ++++ bn/arch/amd64/bignum_mul_8_16_alt.S 3 Dec 2023 20:18:30 -0000 +@@ -72,7 +72,7 @@ + adc h, rdx + + S2N_BN_SYMBOL(bignum_mul_8_16_alt): +- endbr64 ++ _CET_ENDBR + + #if WINDOWS_ABI + push rdi +Index: bn/arch/amd64/bignum_sqr.S +=================================================================== +RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_sqr.S,v +diff -u -p -r1.4 bignum_sqr.S +--- bn/arch/amd64/bignum_sqr.S 25 Apr 2023 04:42:26 -0000 1.4 ++++ bn/arch/amd64/bignum_sqr.S 3 Dec 2023 20:18:30 -0000 +@@ -62,7 +62,7 @@ + #define llshort ebp + + S2N_BN_SYMBOL(bignum_sqr): +- endbr64 ++ _CET_ENDBR + + #if WINDOWS_ABI + push rdi +Index: bn/arch/amd64/bignum_sqr_4_8_alt.S +=================================================================== +RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_4_8_alt.S,v +diff -u -p -r1.4 bignum_sqr_4_8_alt.S +--- bn/arch/amd64/bignum_sqr_4_8_alt.S 25 Apr 2023 04:42:26 -0000 1.4 ++++ bn/arch/amd64/bignum_sqr_4_8_alt.S 3 Dec 2023 20:18:30 -0000 +@@ -71,7 +71,7 @@ + adc c, 0 + + S2N_BN_SYMBOL(bignum_sqr_4_8_alt): +- endbr64 ++ _CET_ENDBR + + #if WINDOWS_ABI + push rdi +Index: bn/arch/amd64/bignum_sqr_8_16_alt.S +=================================================================== +RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_8_16_alt.S,v +diff -u -p -r1.4 bignum_sqr_8_16_alt.S +--- bn/arch/amd64/bignum_sqr_8_16_alt.S 25 Apr 2023 04:42:26 -0000 1.4 ++++ bn/arch/amd64/bignum_sqr_8_16_alt.S 3 Dec 2023 20:18:30 -0000 +@@ -103,7 +103,7 @@ + adc c, 0 + + S2N_BN_SYMBOL(bignum_sqr_8_16_alt): +- endbr64 ++ _CET_ENDBR + + #if WINDOWS_ABI + push rdi +Index: bn/arch/amd64/bignum_sub.S +=================================================================== +RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_sub.S,v +diff -u -p -r1.4 bignum_sub.S +--- bn/arch/amd64/bignum_sub.S 25 Apr 2023 04:42:26 -0000 1.4 ++++ bn/arch/amd64/bignum_sub.S 3 Dec 2023 20:18:30 -0000 +@@ -49,7 +49,7 @@ + + + S2N_BN_SYMBOL(bignum_sub): +- endbr64 ++ _CET_ENDBR + + #if WINDOWS_ABI + push rdi +Index: bn/arch/amd64/word_clz.S +=================================================================== +RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/word_clz.S,v +diff -u -p -r1.4 word_clz.S +--- bn/arch/amd64/word_clz.S 25 Apr 2023 04:42:26 -0000 1.4 ++++ bn/arch/amd64/word_clz.S 3 Dec 2023 20:18:30 -0000 +@@ -30,7 +30,7 @@ + .text + + S2N_BN_SYMBOL(word_clz): +- endbr64 ++ _CET_ENDBR + + #if WINDOWS_ABI + push rdi +Index: bn/asm/modexp512-x86_64.pl +=================================================================== +RCS file: /cvs/src/lib/libcrypto/bn/asm/modexp512-x86_64.pl,v +diff -u -p -r1.4 modexp512-x86_64.pl +--- bn/asm/modexp512-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.4 ++++ bn/asm/modexp512-x86_64.pl 3 Dec 2023 20:18:30 -0000 +@@ -347,7 +347,7 @@ $code.=<<___; + .type MULADD_128x512,\@abi-omnipotent + .align 16 + MULADD_128x512: +- endbr64 ++ _CET_ENDBR + ___ + &MULSTEP_512([map("%r$_",(8..15))], "(+8*0)(%rcx)", "%rsi", "%rbp", "%rbx"); + $code.=<<___; +@@ -415,7 +415,7 @@ $code.=<<___; + .type mont_reduce,\@abi-omnipotent + .align 16 + mont_reduce: +- endbr64 ++ _CET_ENDBR + ___ + + my $STACK_DEPTH = 8; +@@ -678,7 +678,7 @@ $code.=<<___; + .type mont_mul_a3b,\@abi-omnipotent + .align 16 + mont_mul_a3b: +- endbr64 ++ _CET_ENDBR + # + # multiply tmp = src1 * src2 + # For multiply: dst = rcx, src1 = rdi, src2 = rsi +@@ -1080,7 +1080,7 @@ $code.=<<___; + .type sqr_reduce,\@abi-omnipotent + .align 16 + sqr_reduce: +- endbr64 ++ _CET_ENDBR + mov (+$pResult_offset+8)(%rsp), %rcx + ___ + &SQR_512("%rsp+$tmp16_offset+8", "%rcx", [map("%r$_",(10..15,8..9))], "%rbx", "%rbp", "%rsi", "%rdi"); +@@ -1110,7 +1110,7 @@ $code.=<<___; + .globl mod_exp_512 + .type mod_exp_512,\@function,4 + mod_exp_512: +- endbr64 ++ _CET_ENDBR + push %rbp + push %rbx + push %r12 +Index: bn/asm/x86_64-mont.pl +=================================================================== +RCS file: /cvs/src/lib/libcrypto/bn/asm/x86_64-mont.pl,v +diff -u -p -r1.5 x86_64-mont.pl +--- bn/asm/x86_64-mont.pl 25 Apr 2023 04:42:26 -0000 1.5 ++++ bn/asm/x86_64-mont.pl 3 Dec 2023 20:18:30 -0000 +@@ -63,7 +63,7 @@ $code=<<___; + .type bn_mul_mont,\@function,6 + .align 16 + bn_mul_mont: +- endbr64 ++ _CET_ENDBR + test \$3,${num}d + jnz .Lmul_enter + cmp \$8,${num}d +@@ -279,7 +279,7 @@ $code.=<<___; + .align 16 + bn_mul4x_mont: + .Lmul4x_enter: +- endbr64 ++ _CET_ENDBR + push %rbx + push %rbp + push %r12 +@@ -707,7 +707,7 @@ $code.=<<___; + .align 16 + bn_sqr4x_mont: + .Lsqr4x_enter: +- endbr64 ++ _CET_ENDBR + push %rbx + push %rbp + push %r12 +Index: bn/asm/x86_64-mont5.pl +=================================================================== +RCS file: /cvs/src/lib/libcrypto/bn/asm/x86_64-mont5.pl,v +diff -u -p -r1.8 x86_64-mont5.pl +--- bn/asm/x86_64-mont5.pl 25 Apr 2023 04:42:26 -0000 1.8 ++++ bn/asm/x86_64-mont5.pl 3 Dec 2023 20:18:30 -0000 +@@ -57,7 +57,7 @@ $code=<<___; + .type bn_mul_mont_gather5,\@function,6 + .align 64 + bn_mul_mont_gather5: +- endbr64 ++ _CET_ENDBR + test \$3,${num}d + jnz .Lmul_enter + cmp \$8,${num}d +@@ -388,7 +388,7 @@ $code.=<<___; + .type bn_mul4x_mont_gather5,\@function,6 + .align 16 + bn_mul4x_mont_gather5: +- endbr64 ++ _CET_ENDBR + .Lmul4x_enter: + mov ${num}d,${num}d + movd `($win64?56:8)`(%rsp),%xmm5 # load 7th argument +@@ -927,7 +927,7 @@ $code.=<<___; + .type bn_scatter5,\@abi-omnipotent + .align 16 + bn_scatter5: +- endbr64 ++ _CET_ENDBR + cmp \$0, $num + jz .Lscatter_epilogue + lea ($tbl,$idx,8),$tbl +@@ -946,7 +946,7 @@ bn_scatter5: + .type bn_gather5,\@abi-omnipotent + .align 16 + bn_gather5: +- endbr64 ++ _CET_ENDBR + .LSEH_begin_bn_gather5: # Win64 thing, but harmless in other cases + # I can't trust assembler to use specific encoding:-( + .byte 0x4c,0x8d,0x14,0x24 # lea (%rsp),%r10 +@@ -1057,7 +1057,7 @@ $code.=<<___; + .type mul_handler,\@abi-omnipotent + .align 16 + mul_handler: +- endbr64 ++ _CET_ENDBR + push %rsi + push %rdi + push %rbx +Index: camellia/asm/cmll-x86_64.pl +=================================================================== +RCS file: /cvs/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl,v +diff -u -p -r1.7 cmll-x86_64.pl +--- camellia/asm/cmll-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.7 ++++ camellia/asm/cmll-x86_64.pl 3 Dec 2023 20:18:30 -0000 +@@ -116,7 +116,7 @@ $code=<<___; + .type Camellia_EncryptBlock,\@abi-omnipotent + .align 16 + Camellia_EncryptBlock: +- endbr64 ++ _CET_ENDBR + movl \$128,%eax + subl $arg0d,%eax + movl \$3,$arg0d +@@ -129,7 +129,7 @@ Camellia_EncryptBlock: + .align 16 + .Lenc_rounds: + Camellia_EncryptBlock_Rounds: +- endbr64 ++ _CET_ENDBR + push %rbx + push %rbp + push %r13 +@@ -178,7 +178,7 @@ Camellia_EncryptBlock_Rounds: + .type _x86_64_Camellia_encrypt,\@abi-omnipotent + .align 16 + _x86_64_Camellia_encrypt: +- endbr64 ++ _CET_ENDBR + xor 0($key),@S[1] + xor 4($key),@S[0] # ^=key[0-3] + xor 8($key),@S[3] +@@ -229,7 +229,7 @@ $code.=<<___; + .type Camellia_DecryptBlock,\@abi-omnipotent + .align 16 + Camellia_DecryptBlock: +- endbr64 ++ _CET_ENDBR + movl \$128,%eax + subl $arg0d,%eax + movl \$3,$arg0d +@@ -242,7 +242,7 @@ Camellia_DecryptBlock: + .align 16 + .Ldec_rounds: + Camellia_DecryptBlock_Rounds: +- endbr64 ++ _CET_ENDBR + push %rbx + push %rbp + push %r13 +@@ -291,7 +291,7 @@ Camellia_DecryptBlock_Rounds: + .type _x86_64_Camellia_decrypt,\@abi-omnipotent + .align 16 + _x86_64_Camellia_decrypt: +- endbr64 ++ _CET_ENDBR + xor 0($key),@S[1] + xor 4($key),@S[0] # ^=key[0-3] + xor 8($key),@S[3] +@@ -406,7 +406,7 @@ $code.=<<___; + .type Camellia_Ekeygen,\@function,3 + .align 16 + Camellia_Ekeygen: +- endbr64 ++ _CET_ENDBR + push %rbx + push %rbp + push %r13 +@@ -637,7 +637,7 @@ $code.=<<___; + .type Camellia_cbc_encrypt,\@function,6 + .align 16 + Camellia_cbc_encrypt: +- endbr64 ++ _CET_ENDBR + cmp \$0,%rdx + je .Lcbc_abort + push %rbx +Index: md5/asm/md5-x86_64.pl +=================================================================== +RCS file: /cvs/src/lib/libcrypto/md5/asm/md5-x86_64.pl,v +diff -u -p -r1.3 md5-x86_64.pl +--- md5/asm/md5-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.3 ++++ md5/asm/md5-x86_64.pl 3 Dec 2023 20:18:30 -0000 +@@ -128,7 +128,7 @@ $code .= < ++#else ++#define _CET_ENDBR ++#endif ++ ++___ ++} ++ + print "#include \"x86_arch.h\"\n"; + + while($line=<>) { +Index: rc4/asm/rc4-md5-x86_64.pl +=================================================================== +RCS file: /cvs/src/lib/libcrypto/rc4/asm/rc4-md5-x86_64.pl,v +diff -u -p -r1.4 rc4-md5-x86_64.pl +--- rc4/asm/rc4-md5-x86_64.pl 28 Jul 2023 10:35:14 -0000 1.4 ++++ rc4/asm/rc4-md5-x86_64.pl 3 Dec 2023 20:18:30 -0000 +@@ -109,7 +109,7 @@ $code.=<<___; + .globl $func + .type $func,\@function,$nargs + $func: +- endbr64 ++ _CET_ENDBR + cmp \$0,$len + je .Labort + push %rbx +@@ -454,7 +454,7 @@ $code.=<<___; + .type RC4_set_key,\@function,3 + .align 16 + RC4_set_key: +- endbr64 ++ _CET_ENDBR + lea 8($dat),$dat + lea ($inp,$len),$inp + neg $len +Index: rc4/asm/rc4-x86_64.pl +=================================================================== +RCS file: /cvs/src/lib/libcrypto/rc4/asm/rc4-x86_64.pl,v +diff -u -p -r1.16 rc4-x86_64.pl +--- rc4/asm/rc4-x86_64.pl 28 Jul 2023 10:35:14 -0000 1.16 ++++ rc4/asm/rc4-x86_64.pl 3 Dec 2023 20:18:30 -0000 +@@ -128,7 +128,7 @@ $code=<<___; + .type RC4,\@function,4 + .align 16 + RC4: +- endbr64 ++ _CET_ENDBR + or $len,$len + jne .Lentry + ret +@@ -435,7 +435,7 @@ $code.=<<___; + .type RC4_set_key,\@function,3 + .align 16 + RC4_set_key: +- endbr64 ++ _CET_ENDBR + lea 8($dat),$dat + lea ($inp,$len),$inp + neg $len +Index: sha/asm/sha1-x86_64.pl +=================================================================== +RCS file: /cvs/src/lib/libcrypto/sha/asm/sha1-x86_64.pl,v +diff -u -p -r1.7 sha1-x86_64.pl +--- sha/asm/sha1-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.7 ++++ sha/asm/sha1-x86_64.pl 3 Dec 2023 20:18:30 -0000 +@@ -222,7 +222,7 @@ $code.=<<___; + .type sha1_block_data_order,\@function,3 + .align 16 + sha1_block_data_order: +- endbr64 ++ _CET_ENDBR + mov OPENSSL_ia32cap_P+0(%rip),%r9d + mov OPENSSL_ia32cap_P+4(%rip),%r8d + test \$IA32CAP_MASK1_SSSE3,%r8d # check SSSE3 bit +@@ -310,7 +310,7 @@ $code.=<<___; + .align 16 + sha1_block_data_order_ssse3: + _ssse3_shortcut: +- endbr64 ++ _CET_ENDBR + push %rbx + push %rbp + push %r12 +@@ -731,7 +731,7 @@ $code.=<<___; + .align 16 + sha1_block_data_order_avx: + _avx_shortcut: +- endbr64 ++ _CET_ENDBR + push %rbx + push %rbp + push %r12 +@@ -1102,7 +1102,7 @@ $code.=<<___; + .type se_handler,\@abi-omnipotent + .align 16 + se_handler: +- endbr64 ++ _CET_ENDBR + push %rsi + push %rdi + push %rbx +Index: sha/asm/sha512-x86_64.pl +=================================================================== +RCS file: /cvs/src/lib/libcrypto/sha/asm/sha512-x86_64.pl,v +diff -u -p -r1.7 sha512-x86_64.pl +--- sha/asm/sha512-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.7 ++++ sha/asm/sha512-x86_64.pl 3 Dec 2023 20:18:30 -0000 +@@ -175,7 +175,7 @@ $code=<<___; + .type $func,\@function,4 + .align 16 + $func: +- endbr64 ++ _CET_ENDBR + push %rbx + push %rbp + push %r12 +Index: whrlpool/asm/wp-x86_64.pl +=================================================================== +RCS file: /cvs/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl,v +diff -u -p -r1.5 wp-x86_64.pl +--- whrlpool/asm/wp-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.5 ++++ whrlpool/asm/wp-x86_64.pl 3 Dec 2023 20:18:30 -0000 +@@ -57,7 +57,7 @@ $code=<<___; + .type $func,\@function,3 + .align 16 + $func: +- endbr64 ++ _CET_ENDBR + push %rbx + push %rbp + push %r12 diff --git a/update.sh b/update.sh index 1f2d78b529..58bbfa5dcc 100755 --- a/update.sh +++ b/update.sh @@ -197,18 +197,6 @@ fixup_masm() { # generate assembly crypto algorithms asm_src=$CWD/asm -setup_asm_generator() { - rm -fr $asm_src - cp -a $libcrypto_src $asm_src -} - -setup_asm_generator_patched() { - setup_asm_generator - for i in `ls -1 patches/asm/*.patch | sort -n`; do - patch -d $asm_src -p 4 < $i 1> /dev/null 2>/dev/null ; - done -} - gen_asm_stdout() { CC=true perl $asm_src/$2 $1 > crypto/$3.tmp [ $1 = "elf" ] && cat <<-EOF >> crypto/$3.tmp @@ -249,6 +237,14 @@ gen_asm() { fi } +setup_asm_generator() { + rm -fr $asm_src + cp -a $libcrypto_src $asm_src + for i in `ls -1 patches/asm/*.patch | sort -n`; do + patch -d $asm_src -p0 < $i 1> /dev/null 2>/dev/null ; + done +} + setup_asm_generator echo generating mips ASM source for elf @@ -281,13 +277,6 @@ $CP $libcrypto_src/arch/arm/arm_arch.h crypto for abi in elf macosx masm mingw64; do echo generating x86_64 ASM source for $abi - # use patched generators for non-elf targets - if [ $abi = "elf" ]; then - setup_asm_generator - else - setup_asm_generator_patched - fi - gen_asm_stdout $abi aes/asm/aes-x86_64.pl aes/aes-$abi-x86_64.S gen_asm_stdout $abi aes/asm/vpaes-x86_64.pl aes/vpaes-$abi-x86_64.S gen_asm_stdout $abi aes/asm/bsaes-x86_64.pl aes/bsaes-$abi-x86_64.S From 31bb2f25f9968970cebc84e7da54a3a02d2fc4de Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 8 Jan 2024 22:43:31 -0600 Subject: [PATCH 0601/1283] check for control flow integrity support in compiler --- m4/check-hardening-options.m4 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/m4/check-hardening-options.m4 b/m4/check-hardening-options.m4 index 4b5784b627..2cb3083788 100644 --- a/m4/check-hardening-options.m4 +++ b/m4/check-hardening-options.m4 @@ -94,6 +94,11 @@ AC_DEFUN([CHECK_C_HARDENING_OPTIONS], [ AC_SEARCH_LIBS([__stack_chk_guard],[ssp]) ]) ]) + + # Check for control-flow integrity support + AS_IF([test "x$HOST_OS" != "xdarwin"], [ + CHECK_CFLAG([[-fcf-protection=full]]) + ]) ]) # Restore CC, LD From 37cff9e9a408570a96e3080249f8c70f6296a26f Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 8 Jan 2024 21:57:01 -0600 Subject: [PATCH 0602/1283] align read only sections on masm/windows to 64 bytes Avoid conflicts where alignment is specified later in the underlying assembly. --- patches/asm/masm-align-64.patch | 30 ++++++++++++++++++++++++++++++ update.sh | 5 ++--- 2 files changed, 32 insertions(+), 3 deletions(-) create mode 100644 patches/asm/masm-align-64.patch diff --git a/patches/asm/masm-align-64.patch b/patches/asm/masm-align-64.patch new file mode 100644 index 0000000000..ba41c71024 --- /dev/null +++ b/patches/asm/masm-align-64.patch @@ -0,0 +1,30 @@ +commit 3797e05de28ab07bb522898cbf022bdf67a71c99 +Author: Brent Cook +Date: Sun Feb 4 22:53:59 2024 -0600 + + align read-only sections on masm/windows to 64 bytes + + Avoid conflicts where alignment is specified later in the underlying + assembly. + +diff --git a/src/lib/libcrypto/perlasm/x86_64-xlate.pl b/src/lib/libcrypto/perlasm/x86_64-xlate.pl +index 5dbed2a8c..d8b607b5c 100755 +--- a/src/lib/libcrypto/perlasm/x86_64-xlate.pl ++++ b/src/lib/libcrypto/perlasm/x86_64-xlate.pl +@@ -567,7 +567,15 @@ my %globals; + $v.="$line\tSEGMENT"; + if ($line=~/\.([prx])data/) { + $v.=" READONLY"; +- $v.=" ALIGN(".($1 eq "p" ? 4 : 8).")" if ($masm>=$masmref); ++ if ($masm>=$masmref) { ++ if ($1 eq "r") { ++ $v.=" ALIGN(64)"; ++ } elsif ($1 eq "p") { ++ $v.=" ALIGN(4)"; ++ } else { ++ $v.=" ALIGN(8)"; ++ } ++ } + } elsif ($line=~/\.CRT\$/i) { + $v.=" READONLY "; + $v.=$masm>=$masmref ? "ALIGN(8)" : "DWORD"; diff --git a/update.sh b/update.sh index 58bbfa5dcc..70a6ee6873 100755 --- a/update.sh +++ b/update.sh @@ -240,9 +240,8 @@ gen_asm() { setup_asm_generator() { rm -fr $asm_src cp -a $libcrypto_src $asm_src - for i in `ls -1 patches/asm/*.patch | sort -n`; do - patch -d $asm_src -p0 < $i 1> /dev/null 2>/dev/null ; - done + patch -d $asm_src -p0 < patches/asm/endbr64.patch + patch -d $asm_src -p4 < patches/asm/masm-align-64.patch } setup_asm_generator From ff0300c550905b7b7a28e452c2d48a3f2e98dad5 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 12 Feb 2024 03:10:44 -0600 Subject: [PATCH 0603/1283] delete checked-in tap-driver.sh it is autogenerated, so don't keep it in tree --- .gitignore | 1 + tap-driver.sh | 650 -------------------------------------------------- 2 files changed, 1 insertion(+), 650 deletions(-) delete mode 100755 tap-driver.sh diff --git a/.gitignore b/.gitignore index b061ae67a0..89962ea038 100644 --- a/.gitignore +++ b/.gitignore @@ -59,6 +59,7 @@ openssl.cnf x509v3.cnf # tests +tap-driver.sh test-driver *.log *.trs diff --git a/tap-driver.sh b/tap-driver.sh deleted file mode 100755 index 1e444b2a6a..0000000000 --- a/tap-driver.sh +++ /dev/null @@ -1,650 +0,0 @@ -#! /bin/sh -# Copyright (C) 2011-2021 Free Software Foundation, Inc. -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2, or (at your option) -# any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see . - -# As a special exception to the GNU General Public License, if you -# distribute this file as part of a program that contains a -# configuration script generated by Autoconf, you may include it under -# the same distribution terms that you use for the rest of that program. - -# This file is maintained in Automake, please report -# bugs to or send patches to -# . - -scriptversion=2013-12-23.17; # UTC - -# Make unconditional expansion of undefined variables an error. This -# helps a lot in preventing typo-related bugs. -set -u - -me=tap-driver.sh - -fatal () -{ - echo "$me: fatal: $*" >&2 - exit 1 -} - -usage_error () -{ - echo "$me: $*" >&2 - print_usage >&2 - exit 2 -} - -print_usage () -{ - cat < - trap : 1 3 2 13 15 - if test $merge -gt 0; then - exec 2>&1 - else - exec 2>&3 - fi - "$@" - echo $? - ) | LC_ALL=C ${AM_TAP_AWK-awk} \ - -v me="$me" \ - -v test_script_name="$test_name" \ - -v log_file="$log_file" \ - -v trs_file="$trs_file" \ - -v expect_failure="$expect_failure" \ - -v merge="$merge" \ - -v ignore_exit="$ignore_exit" \ - -v comments="$comments" \ - -v diag_string="$diag_string" \ -' -# TODO: the usages of "cat >&3" below could be optimized when using -# GNU awk, and/on on systems that supports /dev/fd/. - -# Implementation note: in what follows, `result_obj` will be an -# associative array that (partly) simulates a TAP result object -# from the `TAP::Parser` perl module. - -## ----------- ## -## FUNCTIONS ## -## ----------- ## - -function fatal(msg) -{ - print me ": " msg | "cat >&2" - exit 1 -} - -function abort(where) -{ - fatal("internal error " where) -} - -# Convert a boolean to a "yes"/"no" string. -function yn(bool) -{ - return bool ? "yes" : "no"; -} - -function add_test_result(result) -{ - if (!test_results_index) - test_results_index = 0 - test_results_list[test_results_index] = result - test_results_index += 1 - test_results_seen[result] = 1; -} - -# Whether the test script should be re-run by "make recheck". -function must_recheck() -{ - for (k in test_results_seen) - if (k != "XFAIL" && k != "PASS" && k != "SKIP") - return 1 - return 0 -} - -# Whether the content of the log file associated to this test should -# be copied into the "global" test-suite.log. -function copy_in_global_log() -{ - for (k in test_results_seen) - if (k != "PASS") - return 1 - return 0 -} - -function get_global_test_result() -{ - if ("ERROR" in test_results_seen) - return "ERROR" - if ("FAIL" in test_results_seen || "XPASS" in test_results_seen) - return "FAIL" - all_skipped = 1 - for (k in test_results_seen) - if (k != "SKIP") - all_skipped = 0 - if (all_skipped) - return "SKIP" - return "PASS"; -} - -function stringify_result_obj(result_obj) -{ - if (result_obj["is_unplanned"] || result_obj["number"] != testno) - return "ERROR" - - if (plan_seen == LATE_PLAN) - return "ERROR" - - if (result_obj["directive"] == "TODO") - return result_obj["is_ok"] ? "XPASS" : "XFAIL" - - if (result_obj["directive"] == "SKIP") - return result_obj["is_ok"] ? "SKIP" : COOKED_FAIL; - - if (length(result_obj["directive"])) - abort("in function stringify_result_obj()") - - return result_obj["is_ok"] ? COOKED_PASS : COOKED_FAIL -} - -function decorate_result(result) -{ - color_name = color_for_result[result] - if (color_name) - return color_map[color_name] "" result "" color_map["std"] - # If we are not using colorized output, or if we do not know how - # to colorize the given result, we should return it unchanged. - return result -} - -function report(result, details) -{ - if (result ~ /^(X?(PASS|FAIL)|SKIP|ERROR)/) - { - msg = ": " test_script_name - add_test_result(result) - } - else if (result == "#") - { - msg = " " test_script_name ":" - } - else - { - abort("in function report()") - } - if (length(details)) - msg = msg " " details - # Output on console might be colorized. - print decorate_result(result) msg - # Log the result in the log file too, to help debugging (this is - # especially true when said result is a TAP error or "Bail out!"). - print result msg | "cat >&3"; -} - -function testsuite_error(error_message) -{ - report("ERROR", "- " error_message) -} - -function handle_tap_result() -{ - details = result_obj["number"]; - if (length(result_obj["description"])) - details = details " " result_obj["description"] - - if (plan_seen == LATE_PLAN) - { - details = details " # AFTER LATE PLAN"; - } - else if (result_obj["is_unplanned"]) - { - details = details " # UNPLANNED"; - } - else if (result_obj["number"] != testno) - { - details = sprintf("%s # OUT-OF-ORDER (expecting %d)", - details, testno); - } - else if (result_obj["directive"]) - { - details = details " # " result_obj["directive"]; - if (length(result_obj["explanation"])) - details = details " " result_obj["explanation"] - } - - report(stringify_result_obj(result_obj), details) -} - -# `skip_reason` should be empty whenever planned > 0. -function handle_tap_plan(planned, skip_reason) -{ - planned += 0 # Avoid getting confused if, say, `planned` is "00" - if (length(skip_reason) && planned > 0) - abort("in function handle_tap_plan()") - if (plan_seen) - { - # Error, only one plan per stream is acceptable. - testsuite_error("multiple test plans") - return; - } - planned_tests = planned - # The TAP plan can come before or after *all* the TAP results; we speak - # respectively of an "early" or a "late" plan. If we see the plan line - # after at least one TAP result has been seen, assume we have a late - # plan; in this case, any further test result seen after the plan will - # be flagged as an error. - plan_seen = (testno >= 1 ? LATE_PLAN : EARLY_PLAN) - # If testno > 0, we have an error ("too many tests run") that will be - # automatically dealt with later, so do not worry about it here. If - # $plan_seen is true, we have an error due to a repeated plan, and that - # has already been dealt with above. Otherwise, we have a valid "plan - # with SKIP" specification, and should report it as a particular kind - # of SKIP result. - if (planned == 0 && testno == 0) - { - if (length(skip_reason)) - skip_reason = "- " skip_reason; - report("SKIP", skip_reason); - } -} - -function extract_tap_comment(line) -{ - if (index(line, diag_string) == 1) - { - # Strip leading `diag_string` from `line`. - line = substr(line, length(diag_string) + 1) - # And strip any leading and trailing whitespace left. - sub("^[ \t]*", "", line) - sub("[ \t]*$", "", line) - # Return what is left (if any). - return line; - } - return ""; -} - -# When this function is called, we know that line is a TAP result line, -# so that it matches the (perl) RE "^(not )?ok\b". -function setup_result_obj(line) -{ - # Get the result, and remove it from the line. - result_obj["is_ok"] = (substr(line, 1, 2) == "ok" ? 1 : 0) - sub("^(not )?ok[ \t]*", "", line) - - # If the result has an explicit number, get it and strip it; otherwise, - # automatically assign the next test number to it. - if (line ~ /^[0-9]+$/ || line ~ /^[0-9]+[^a-zA-Z0-9_]/) - { - match(line, "^[0-9]+") - # The final `+ 0` is to normalize numbers with leading zeros. - result_obj["number"] = substr(line, 1, RLENGTH) + 0 - line = substr(line, RLENGTH + 1) - } - else - { - result_obj["number"] = testno - } - - if (plan_seen == LATE_PLAN) - # No further test results are acceptable after a "late" TAP plan - # has been seen. - result_obj["is_unplanned"] = 1 - else if (plan_seen && testno > planned_tests) - result_obj["is_unplanned"] = 1 - else - result_obj["is_unplanned"] = 0 - - # Strip trailing and leading whitespace. - sub("^[ \t]*", "", line) - sub("[ \t]*$", "", line) - - # This will have to be corrected if we have a "TODO"/"SKIP" directive. - result_obj["description"] = line - result_obj["directive"] = "" - result_obj["explanation"] = "" - - if (index(line, "#") == 0) - return # No possible directive, nothing more to do. - - # Directives are case-insensitive. - rx = "[ \t]*#[ \t]*([tT][oO][dD][oO]|[sS][kK][iI][pP])[ \t]*" - - # See whether we have the directive, and if yes, where. - pos = match(line, rx "$") - if (!pos) - pos = match(line, rx "[^a-zA-Z0-9_]") - - # If there was no TAP directive, we have nothing more to do. - if (!pos) - return - - # Let`s now see if the TAP directive has been escaped. For example: - # escaped: ok \# SKIP - # not escaped: ok \\# SKIP - # escaped: ok \\\\\# SKIP - # not escaped: ok \ # SKIP - if (substr(line, pos, 1) == "#") - { - bslash_count = 0 - for (i = pos; i > 1 && substr(line, i - 1, 1) == "\\"; i--) - bslash_count += 1 - if (bslash_count % 2) - return # Directive was escaped. - } - - # Strip the directive and its explanation (if any) from the test - # description. - result_obj["description"] = substr(line, 1, pos - 1) - # Now remove the test description from the line, that has been dealt - # with already. - line = substr(line, pos) - # Strip the directive, and save its value (normalized to upper case). - sub("^[ \t]*#[ \t]*", "", line) - result_obj["directive"] = toupper(substr(line, 1, 4)) - line = substr(line, 5) - # Now get the explanation for the directive (if any), with leading - # and trailing whitespace removed. - sub("^[ \t]*", "", line) - sub("[ \t]*$", "", line) - result_obj["explanation"] = line -} - -function get_test_exit_message(status) -{ - if (status == 0) - return "" - if (status !~ /^[1-9][0-9]*$/) - abort("getting exit status") - if (status < 127) - exit_details = "" - else if (status == 127) - exit_details = " (command not found?)" - else if (status >= 128 && status <= 255) - exit_details = sprintf(" (terminated by signal %d?)", status - 128) - else if (status > 256 && status <= 384) - # We used to report an "abnormal termination" here, but some Korn - # shells, when a child process die due to signal number n, can leave - # in $? an exit status of 256+n instead of the more standard 128+n. - # Apparently, both behaviours are allowed by POSIX (2008), so be - # prepared to handle them both. See also Austing Group report ID - # 0000051 - exit_details = sprintf(" (terminated by signal %d?)", status - 256) - else - # Never seen in practice. - exit_details = " (abnormal termination)" - return sprintf("exited with status %d%s", status, exit_details) -} - -function write_test_results() -{ - print ":global-test-result: " get_global_test_result() > trs_file - print ":recheck: " yn(must_recheck()) > trs_file - print ":copy-in-global-log: " yn(copy_in_global_log()) > trs_file - for (i = 0; i < test_results_index; i += 1) - print ":test-result: " test_results_list[i] > trs_file - close(trs_file); -} - -BEGIN { - -## ------- ## -## SETUP ## -## ------- ## - -'"$init_colors"' - -# Properly initialized once the TAP plan is seen. -planned_tests = 0 - -COOKED_PASS = expect_failure ? "XPASS": "PASS"; -COOKED_FAIL = expect_failure ? "XFAIL": "FAIL"; - -# Enumeration-like constants to remember which kind of plan (if any) -# has been seen. It is important that NO_PLAN evaluates "false" as -# a boolean. -NO_PLAN = 0 -EARLY_PLAN = 1 -LATE_PLAN = 2 - -testno = 0 # Number of test results seen so far. -bailed_out = 0 # Whether a "Bail out!" directive has been seen. - -# Whether the TAP plan has been seen or not, and if yes, which kind -# it is ("early" is seen before any test result, "late" otherwise). -plan_seen = NO_PLAN - -## --------- ## -## PARSING ## -## --------- ## - -is_first_read = 1 - -while (1) - { - # Involutions required so that we are able to read the exit status - # from the last input line. - st = getline - if (st < 0) # I/O error. - fatal("I/O error while reading from input stream") - else if (st == 0) # End-of-input - { - if (is_first_read) - abort("in input loop: only one input line") - break - } - if (is_first_read) - { - is_first_read = 0 - nextline = $0 - continue - } - else - { - curline = nextline - nextline = $0 - $0 = curline - } - # Copy any input line verbatim into the log file. - print | "cat >&3" - # Parsing of TAP input should stop after a "Bail out!" directive. - if (bailed_out) - continue - - # TAP test result. - if ($0 ~ /^(not )?ok$/ || $0 ~ /^(not )?ok[^a-zA-Z0-9_]/) - { - testno += 1 - setup_result_obj($0) - handle_tap_result() - } - # TAP plan (normal or "SKIP" without explanation). - else if ($0 ~ /^1\.\.[0-9]+[ \t]*$/) - { - # The next two lines will put the number of planned tests in $0. - sub("^1\\.\\.", "") - sub("[^0-9]*$", "") - handle_tap_plan($0, "") - continue - } - # TAP "SKIP" plan, with an explanation. - else if ($0 ~ /^1\.\.0+[ \t]*#/) - { - # The next lines will put the skip explanation in $0, stripping - # any leading and trailing whitespace. This is a little more - # tricky in truth, since we want to also strip a potential leading - # "SKIP" string from the message. - sub("^[^#]*#[ \t]*(SKIP[: \t][ \t]*)?", "") - sub("[ \t]*$", ""); - handle_tap_plan(0, $0) - } - # "Bail out!" magic. - # Older versions of prove and TAP::Harness (e.g., 3.17) did not - # recognize a "Bail out!" directive when preceded by leading - # whitespace, but more modern versions (e.g., 3.23) do. So we - # emulate the latter, "more modern" behaviour. - else if ($0 ~ /^[ \t]*Bail out!/) - { - bailed_out = 1 - # Get the bailout message (if any), with leading and trailing - # whitespace stripped. The message remains stored in `$0`. - sub("^[ \t]*Bail out![ \t]*", ""); - sub("[ \t]*$", ""); - # Format the error message for the - bailout_message = "Bail out!" - if (length($0)) - bailout_message = bailout_message " " $0 - testsuite_error(bailout_message) - } - # Maybe we have too look for dianogtic comments too. - else if (comments != 0) - { - comment = extract_tap_comment($0); - if (length(comment)) - report("#", comment); - } - } - -## -------- ## -## FINISH ## -## -------- ## - -# A "Bail out!" directive should cause us to ignore any following TAP -# error, as well as a non-zero exit status from the TAP producer. -if (!bailed_out) - { - if (!plan_seen) - { - testsuite_error("missing test plan") - } - else if (planned_tests != testno) - { - bad_amount = testno > planned_tests ? "many" : "few" - testsuite_error(sprintf("too %s tests run (expected %d, got %d)", - bad_amount, planned_tests, testno)) - } - if (!ignore_exit) - { - # Fetch exit status from the last line. - exit_message = get_test_exit_message(nextline) - if (exit_message) - testsuite_error(exit_message) - } - } - -write_test_results() - -exit 0 - -} # End of "BEGIN" block. -' - -# TODO: document that we consume the file descriptor 3 :-( -} 3>"$log_file" - -test $? -eq 0 || fatal "I/O or internal error" - -# Local Variables: -# mode: shell-script -# sh-indentation: 2 -# eval: (add-hook 'before-save-hook 'time-stamp) -# time-stamp-start: "scriptversion=" -# time-stamp-format: "%:y-%02m-%02d.%02H" -# time-stamp-time-zone: "UTC0" -# time-stamp-end: "; # UTC" -# End: From 1f0e198ed641527e6bc60cbdc1d2b74da20972f7 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 8 Feb 2024 07:41:23 -0600 Subject: [PATCH 0604/1283] fix file comparison failures testing with WSL + CMake Using FC on Windows through a WSL mount assumes all filenames are UPPERCASE. So make the filenames UPPERCASE in the first place. --- tests/testenc.bat | 37 ++++++++++++++++++++----------------- 1 file changed, 20 insertions(+), 17 deletions(-) diff --git a/tests/testenc.bat b/tests/testenc.bat index 93dfc0c8b3..84f48f2a3f 100644 --- a/tests/testenc.bat +++ b/tests/testenc.bat @@ -2,32 +2,35 @@ setlocal enabledelayedexpansion REM testenc.bat -set test=p +set test=P set openssl_bin=%1 set openssl_bin=%openssl_bin:/=\% if not exist %openssl_bin% exit /b 1 +echo copy %srcdir%\openssl.cnf %test% copy %srcdir%\openssl.cnf %test% echo cat -%openssl_bin% enc -in %test% -out %test%.cipher -%openssl_bin% enc -in %test%.cipher -out %test%.clear -fc /b %test% %test%.clear +echo %openssl_bin% enc -in %test% -out %test%.CIPHER +%openssl_bin% enc -in %test% -out %test%.CIPHER +%openssl_bin% enc -in %test%.CIPHER -out %test%.CLEAR +fc /b %test% %test%.CLEAR if !errorlevel! neq 0 ( exit /b 1 ) else ( - del %test%.cipher %test%.clear + del %test%.CIPHER %test%.CLEAR ) echo base64 -%openssl_bin% enc -a -e -in %test% -out %test%.cipher -%openssl_bin% enc -a -d -in %test%.cipher -out %test%.clear -fc /b %test% %test%.clear +%openssl_bin% enc -a -e -in %test% -out %test%.CIPHER +%openssl_bin% enc -a -d -in %test%.CIPHER -out %test%.CLEAR +dir +fc /b %test% %test%.CLEAR if !errorlevel! neq 0 ( exit /b 1 ) else ( - del %test%.cipher %test%.clear + del %test%.CIPHER %test%.CLEAR ) for %%i in ( @@ -45,23 +48,23 @@ for %%i in ( rc4 rc4-40 ) do ( echo %%i - %openssl_bin% %%i -e -k test -in %test% -out %test%.%%i.cipher - %openssl_bin% %%i -d -k test -in %test%.%%i.cipher -out %test%.%%i.clear - fc /b %test% %test%.%%i.clear + %openssl_bin% %%i -e -k test -in %test% -out %test%.%%i.CIPHER + %openssl_bin% %%i -d -k test -in %test%.%%i.CIPHER -out %test%.%%i.CLEAR + fc /b %test% %test%.%%i.CLEAR if !errorlevel! neq 0 ( exit /b 1 ) else ( - del %test%.%%i.cipher %test%.%%i.clear + del %test%.%%i.CIPHER %test%.%%i.CLEAR ) echo %%i base64 - %openssl_bin% %%i -a -e -k test -in %test% -out %test%.%%i.cipher - %openssl_bin% %%i -a -d -k test -in %test%.%%i.cipher -out %test%.%%i.clear - fc /b %test% %test%.%%i.clear + %openssl_bin% %%i -a -e -k test -in %test% -out %test%.%%i.CIPHER + %openssl_bin% %%i -a -d -k test -in %test%.%%i.CIPHER -out %test%.%%i.CLEAR + fc /b %test% %test%.%%i.CLEAR if !errorlevel! neq 0 ( exit /b 1 ) else ( - del %test%.%%i.cipher %test%.%%i.clear + del %test%.%%i.CIPHER %test%.%%i.CLEAR ) ) From d68ec1fa0233fc871063d43bcd8d1dc2717ed0c8 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 13 Feb 2024 03:24:53 -0600 Subject: [PATCH 0605/1283] test windows builds with shared libs enabled --- .github/workflows/windows.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 8adb9f9048..be8ce5731e 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -13,7 +13,7 @@ concurrency: jobs: test: - name: "${{ matrix.os }}/${{ matrix.arch }} (${{ matrix.generator }})" + name: "${{ matrix.os }}/${{ matrix.arch }}/shared ${{ matrix.shared }} (${{ matrix.generator }})" runs-on: "${{ matrix.os }}" if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} permissions: @@ -23,6 +23,7 @@ jobs: matrix: os: ["windows-2022", "windows-2019"] arch: ["ARM64", "x64", "Win32"] + shared: ["ON", "OFF"] include: - os: "windows-2022" generator: "Visual Studio 17 2022" @@ -49,7 +50,7 @@ jobs: - name: "Configure CMake" shell: cmd - run: cmake -Bbuild -G "${{ matrix.generator }}" -A ${{ matrix.arch }} -DCMAKE_INSTALL_PREFIX=../local + run: cmake -Bbuild -G "${{ matrix.generator }}" -A ${{ matrix.arch }} DBUILD_SHARED_LIBS=${{ matrix.shared }} -DCMAKE_INSTALL_PREFIX=../local - name: "Build" shell: cmd @@ -64,5 +65,5 @@ jobs: if: always() uses: actions/upload-artifact@v4 with: - name: "${{ matrix.os }}-${{ matrix.arch }}-build-results" + name: "${{ matrix.os }}-${{ matrix.arch }}-shared-${{ matrix.shared }}-build-results" path: "build" From 94ed5ffd8733fee5f14feb79932171918d910f1a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 17 Feb 2024 03:16:03 -0700 Subject: [PATCH 0606/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index f433c1f946..8a81f14dd1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -49,6 +49,7 @@ LibreSSL Portable Release Notes: * Documentation improvements - ENGINE documentation was updated to reflect reality. - Made EVP API documentation more accurate and less incoherent. + - Call out some shortcomings of the EC_KEY_set_* API explicitly. * Testing and proactive security - Bug fixes and simplifications in the Wycheproof tests. * Compatibility changes From d0d91f6c9934498ea83fd9a7d773ed1ea83a982e Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Sat, 17 Feb 2024 20:58:31 +0100 Subject: [PATCH 0607/1283] CI: add "x" permission to release helper --- .github/scripts/changelog.sh | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 .github/scripts/changelog.sh diff --git a/.github/scripts/changelog.sh b/.github/scripts/changelog.sh old mode 100644 new mode 100755 From 9dfeb07676f0fb141b4172807e86691b386ffe0e Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Sun, 18 Feb 2024 10:41:20 +0100 Subject: [PATCH 0608/1283] CI: redirect changelog error to stdout during CI stdout is redirected to "changelog.txt" and thus not seen --- .github/scripts/changelog.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/scripts/changelog.sh b/.github/scripts/changelog.sh index 76492cf8a5..026549eb9a 100755 --- a/.github/scripts/changelog.sh +++ b/.github/scripts/changelog.sh @@ -26,7 +26,7 @@ set -e # Check if the version argument is provided if [ "$#" -ne 1 ]; then - echo "Usage: $0 " + echo "Usage: $0 " 1>&2 exit 1 fi @@ -37,7 +37,7 @@ changelog="" # Check if the specified changelog file exists if [ ! -f "$changelog_file" ]; then - echo "Error: Changelog file '$changelog_file' not found" + echo "Error: Changelog file '$changelog_file' not found" 1>&2 exit 1 fi @@ -60,7 +60,7 @@ done < "$changelog_file" # If the specified version was not found, print an error if ! $found_version; then - echo "Error: Version $version was not found in changelog" + echo "Error: Version $version was not found in changelog" 1>&2 exit 1 fi From b9b65324ecda2ed5a54ef425ed527762fcf28fe3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 18 Feb 2024 10:24:23 -0700 Subject: [PATCH 0609/1283] Add posix_time.h --- crypto/Makefile.am | 1 + update.sh | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 207853188a..0fed0ccddb 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -699,6 +699,7 @@ noinst_HEADERS += hidden/openssl/pem.h noinst_HEADERS += hidden/openssl/pkcs12.h noinst_HEADERS += hidden/openssl/pkcs7.h noinst_HEADERS += hidden/openssl/poly1305.h +noinst_HEADERS += hidden/openssl/posix_time.h noinst_HEADERS += hidden/openssl/rand.h noinst_HEADERS += hidden/openssl/rc2.h noinst_HEADERS += hidden/openssl/rsa.h diff --git a/update.sh b/update.sh index 70a6ee6873..19166ecd0b 100755 --- a/update.sh +++ b/update.sh @@ -129,7 +129,7 @@ copy_hdrs() { copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h ossl_typ.h err/err.h crypto.h comp/comp.h x509/x509.h buffer/buffer.h - objects/objects.h asn1/asn1.h bn/bn.h ec/ec.h ecdsa/ecdsa.h + objects/objects.h asn1/asn1.h asn1/posix_time.h bn/bn.h ec/ec.h ecdsa/ecdsa.h ecdh/ecdh.h rsa/rsa.h sha/sha.h x509/x509_vfy.h pkcs7/pkcs7.h pem/pem.h pem/pem2.h hkdf/hkdf.h hmac/hmac.h rand/rand.h md5/md5.h x509/x509v3.h conf/conf.h ocsp/ocsp.h From 43f4827f75c5bbe03b66cbbaea3242ed3d088a91 Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Wed, 21 Feb 2024 16:53:31 +0100 Subject: [PATCH 0610/1283] CI: limit scheduled runs to "libressl" org only this was commited in https://github.com/libressl/portable/pull/995 somehow it was lost, maybe due to force push --- .github/workflows/linux.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index d48c1e81d0..180f43cb13 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -46,6 +46,7 @@ jobs: test-asan: name: "ASAN (${{ matrix.asm == 'ON' && 'asm' || 'no-asm' }})" runs-on: "ubuntu-latest" + if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} permissions: contents: read strategy: From 9394a1b775f60d69c3996252a995852358bae31b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 18 Feb 2024 23:23:30 -0700 Subject: [PATCH 0611/1283] Update man links --- man/links | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/man/links b/man/links index c4b1d4d707..e22c433535 100644 --- a/man/links +++ b/man/links @@ -106,7 +106,9 @@ ASN1_TIME_set.3,ASN1_UTCTIME_print.3 ASN1_TIME_set.3,ASN1_UTCTIME_set.3 ASN1_TIME_set.3,ASN1_UTCTIME_set_string.3 ASN1_TIME_set.3,OPENSSL_gmtime.3 +ASN1_TIME_set.3,OPENSSL_posix_to_tm.3 ASN1_TIME_set.3,OPENSSL_timegm.3 +ASN1_TIME_set.3,OPENSSL_tm_to_posix.3 ASN1_TYPE_get.3,ASN1_TYPE_cmp.3 ASN1_TYPE_get.3,ASN1_TYPE_free.3 ASN1_TYPE_get.3,ASN1_TYPE_get_int_octetstring.3 @@ -843,6 +845,8 @@ EVP_CIPHER_CTX_set_flags.3,EVP_CIPHER_param_to_asn1.3 EVP_CIPHER_do_all.3,EVP_CIPHER_do_all_sorted.3 EVP_CIPHER_do_all.3,EVP_MD_do_all.3 EVP_CIPHER_do_all.3,EVP_MD_do_all_sorted.3 +EVP_CIPHER_do_all.3,OBJ_NAME_do_all.3 +EVP_CIPHER_do_all.3,OBJ_NAME_do_all_sorted.3 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_dup.3 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_free.3 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_cleanup.3 @@ -1265,8 +1269,6 @@ NAME_CONSTRAINTS_new.3,GENERAL_SUBTREE_free.3 NAME_CONSTRAINTS_new.3,GENERAL_SUBTREE_new.3 NAME_CONSTRAINTS_new.3,NAME_CONSTRAINTS_free.3 OBJ_NAME_add.3,OBJ_NAME_cleanup.3 -OBJ_NAME_add.3,OBJ_NAME_do_all.3 -OBJ_NAME_add.3,OBJ_NAME_do_all_sorted.3 OBJ_NAME_add.3,OBJ_NAME_get.3 OBJ_NAME_add.3,OBJ_NAME_init.3 OBJ_NAME_add.3,OBJ_NAME_new_index.3 From 2548f2479d96f0a3d67ca01f9759bedb69163e13 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 24 Feb 2024 09:34:05 -0700 Subject: [PATCH 0612/1283] The endbr64.patch is now upstream --- patches/asm/endbr64.patch | 1215 ------------------------------------- 1 file changed, 1215 deletions(-) delete mode 100644 patches/asm/endbr64.patch diff --git a/patches/asm/endbr64.patch b/patches/asm/endbr64.patch deleted file mode 100644 index 05cf0eb97b..0000000000 --- a/patches/asm/endbr64.patch +++ /dev/null @@ -1,1215 +0,0 @@ -Replace uses of endbr64 with _CET_ENDBR from cet.h - -cet.h is needed for other platforms to emit the relevant .gnu.properties -sections that are necessary for them to enable IBT. It also avoids issues -with older toolchains on macOS that explode on encountering endbr64. - -based on a diff by kettenis -ok beck kettenis tb - -Index: x86_64cpuid.pl -=================================================================== -RCS file: /cvs/src/lib/libcrypto/x86_64cpuid.pl,v -diff -u -p -r1.15 x86_64cpuid.pl ---- x86_64cpuid.pl 25 Apr 2023 04:42:25 -0000 1.15 -+++ x86_64cpuid.pl 3 Dec 2023 20:18:30 -0000 -@@ -18,7 +18,7 @@ print<<___; - .extern OPENSSL_cpuid_setup - .hidden OPENSSL_cpuid_setup - .section .init -- endbr64 -+ _CET_ENDBR - call OPENSSL_cpuid_setup - - .extern OPENSSL_ia32cap_P -@@ -30,7 +30,7 @@ print<<___; - .type OPENSSL_ia32_cpuid,\@abi-omnipotent - .align 16 - OPENSSL_ia32_cpuid: -- endbr64 -+ _CET_ENDBR - mov %rbx,%r8 # save %rbx - - xor %eax,%eax -Index: aes/asm/aes-x86_64.pl -=================================================================== -RCS file: /cvs/src/lib/libcrypto/aes/asm/aes-x86_64.pl,v -diff -u -p -r1.12 aes-x86_64.pl ---- aes/asm/aes-x86_64.pl 25 Apr 2023 04:42:25 -0000 1.12 -+++ aes/asm/aes-x86_64.pl 3 Dec 2023 20:18:30 -0000 -@@ -318,7 +318,7 @@ $code.=<<___; - .type _x86_64_AES_encrypt,\@abi-omnipotent - .align 16 - _x86_64_AES_encrypt: -- endbr64 -+ _CET_ENDBR - xor 0($key),$s0 # xor with key - xor 4($key),$s1 - xor 8($key),$s2 -@@ -549,7 +549,7 @@ $code.=<<___; - .type _x86_64_AES_encrypt_compact,\@abi-omnipotent - .align 16 - _x86_64_AES_encrypt_compact: -- endbr64 -+ _CET_ENDBR - lea 128($sbox),$inp # size optimization - mov 0-128($inp),$acc1 # prefetch Te4 - mov 32-128($inp),$acc2 -@@ -595,7 +595,7 @@ $code.=<<___; - .hidden asm_AES_encrypt - asm_AES_encrypt: - AES_encrypt: -- endbr64 -+ _CET_ENDBR - push %rbx - push %rbp - push %r12 -@@ -887,7 +887,7 @@ $code.=<<___; - .type _x86_64_AES_decrypt,\@abi-omnipotent - .align 16 - _x86_64_AES_decrypt: -- endbr64 -+ _CET_ENDBR - xor 0($key),$s0 # xor with key - xor 4($key),$s1 - xor 8($key),$s2 -@@ -1142,7 +1142,7 @@ $code.=<<___; - .type _x86_64_AES_decrypt_compact,\@abi-omnipotent - .align 16 - _x86_64_AES_decrypt_compact: -- endbr64 -+ _CET_ENDBR - lea 128($sbox),$inp # size optimization - mov 0-128($inp),$acc1 # prefetch Td4 - mov 32-128($inp),$acc2 -@@ -1197,7 +1197,7 @@ $code.=<<___; - .hidden asm_AES_decrypt - asm_AES_decrypt: - AES_decrypt: -- endbr64 -+ _CET_ENDBR - push %rbx - push %rbp - push %r12 -@@ -1297,7 +1297,7 @@ $code.=<<___; - .type AES_set_encrypt_key,\@function,3 - .align 16 - AES_set_encrypt_key: -- endbr64 -+ _CET_ENDBR - push %rbx - push %rbp - push %r12 # redundant, but allows to share -@@ -1323,7 +1323,7 @@ AES_set_encrypt_key: - .type _x86_64_AES_set_encrypt_key,\@abi-omnipotent - .align 16 - _x86_64_AES_set_encrypt_key: -- endbr64 -+ _CET_ENDBR - mov %esi,%ecx # %ecx=bits - mov %rdi,%rsi # %rsi=userKey - mov %rdx,%rdi # %rdi=key -@@ -1569,7 +1569,7 @@ $code.=<<___; - .type AES_set_decrypt_key,\@function,3 - .align 16 - AES_set_decrypt_key: -- endbr64 -+ _CET_ENDBR - push %rbx - push %rbp - push %r12 -@@ -1669,7 +1669,7 @@ $code.=<<___; - .hidden asm_AES_cbc_encrypt - asm_AES_cbc_encrypt: - AES_cbc_encrypt: -- endbr64 -+ _CET_ENDBR - cmp \$0,%rdx # check length - je .Lcbc_epilogue - pushfq -@@ -2561,7 +2561,7 @@ $code.=<<___; - .type block_se_handler,\@abi-omnipotent - .align 16 - block_se_handler: -- endbr64 -+ _CET_ENDBR - push %rsi - push %rdi - push %rbx -@@ -2620,7 +2620,7 @@ block_se_handler: - .type key_se_handler,\@abi-omnipotent - .align 16 - key_se_handler: -- endbr64 -+ _CET_ENDBR - push %rsi - push %rdi - push %rbx -@@ -2678,7 +2678,7 @@ key_se_handler: - .type cbc_se_handler,\@abi-omnipotent - .align 16 - cbc_se_handler: -- endbr64 -+ _CET_ENDBR - push %rsi - push %rdi - push %rbx -Index: aes/asm/aesni-sha1-x86_64.pl -=================================================================== -RCS file: /cvs/src/lib/libcrypto/aes/asm/aesni-sha1-x86_64.pl,v -diff -u -p -r1.8 aesni-sha1-x86_64.pl ---- aes/asm/aesni-sha1-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.8 -+++ aes/asm/aesni-sha1-x86_64.pl 3 Dec 2023 20:18:30 -0000 -@@ -89,7 +89,7 @@ $code.=<<___; - .type aesni_cbc_sha1_enc,\@abi-omnipotent - .align 16 - aesni_cbc_sha1_enc: -- endbr64 -+ _CET_ENDBR - # caller should check for SSSE3 and AES-NI bits - mov OPENSSL_ia32cap_P+0(%rip),%r10d - mov OPENSSL_ia32cap_P+4(%rip),%r11d -@@ -133,7 +133,7 @@ $code.=<<___; - .type aesni_cbc_sha1_enc_ssse3,\@function,6 - .align 16 - aesni_cbc_sha1_enc_ssse3: -- endbr64 -+ _CET_ENDBR - mov `($win64?56:8)`(%rsp),$inp # load 7th argument - #shr \$6,$len # debugging artefact - #jz .Lepilogue_ssse3 # debugging artefact -@@ -652,7 +652,7 @@ $code.=<<___; - .type aesni_cbc_sha1_enc_avx,\@function,6 - .align 16 - aesni_cbc_sha1_enc_avx: -- endbr64 -+ _CET_ENDBR - mov `($win64?56:8)`(%rsp),$inp # load 7th argument - #shr \$6,$len # debugging artefact - #jz .Lepilogue_avx # debugging artefact -@@ -1103,7 +1103,7 @@ $code.=<<___; - .type ssse3_handler,\@abi-omnipotent - .align 16 - ssse3_handler: -- endbr64 -+ _CET_ENDBR - push %rsi - push %rdi - push %rbx -Index: aes/asm/aesni-x86_64.pl -=================================================================== -RCS file: /cvs/src/lib/libcrypto/aes/asm/aesni-x86_64.pl,v -diff -u -p -r1.12 aesni-x86_64.pl ---- aes/asm/aesni-x86_64.pl 18 Sep 2023 22:38:16 -0000 1.12 -+++ aes/asm/aesni-x86_64.pl 3 Dec 2023 20:18:30 -0000 -@@ -242,7 +242,7 @@ $code.=<<___; - .type ${PREFIX}_encrypt,\@abi-omnipotent - .align 16 - ${PREFIX}_encrypt: -- endbr64 -+ _CET_ENDBR - movups ($inp),$inout0 # load input - mov 240($key),$rounds # key->rounds - ___ -@@ -256,7 +256,7 @@ $code.=<<___; - .type ${PREFIX}_decrypt,\@abi-omnipotent - .align 16 - ${PREFIX}_decrypt: -- endbr64 -+ _CET_ENDBR - movups ($inp),$inout0 # load input - mov 240($key),$rounds # key->rounds - ___ -@@ -286,7 +286,7 @@ $code.=<<___; - .type _aesni_${dir}rypt3,\@abi-omnipotent - .align 16 - _aesni_${dir}rypt3: -- endbr64 -+ _CET_ENDBR - $movkey ($key),$rndkey0 - shr \$1,$rounds - $movkey 16($key),$rndkey1 -@@ -331,7 +331,7 @@ $code.=<<___; - .type _aesni_${dir}rypt4,\@abi-omnipotent - .align 16 - _aesni_${dir}rypt4: -- endbr64 -+ _CET_ENDBR - $movkey ($key),$rndkey0 - shr \$1,$rounds - $movkey 16($key),$rndkey1 -@@ -377,7 +377,7 @@ $code.=<<___; - .type _aesni_${dir}rypt6,\@abi-omnipotent - .align 16 - _aesni_${dir}rypt6: -- endbr64 -+ _CET_ENDBR - $movkey ($key),$rndkey0 - shr \$1,$rounds - $movkey 16($key),$rndkey1 -@@ -442,7 +442,7 @@ $code.=<<___; - .type _aesni_${dir}rypt8,\@abi-omnipotent - .align 16 - _aesni_${dir}rypt8: -- endbr64 -+ _CET_ENDBR - $movkey ($key),$rndkey0 - shr \$1,$rounds - $movkey 16($key),$rndkey1 -@@ -531,7 +531,7 @@ $code.=<<___; - .type aesni_ecb_encrypt,\@function,5 - .align 16 - aesni_ecb_encrypt: -- endbr64 -+ _CET_ENDBR - and \$-16,$len - jz .Lecb_ret - -@@ -837,7 +837,7 @@ $code.=<<___; - .type aesni_ccm64_encrypt_blocks,\@function,6 - .align 16 - aesni_ccm64_encrypt_blocks: -- endbr64 -+ _CET_ENDBR - ___ - $code.=<<___ if ($win64); - lea -0x58(%rsp),%rsp -@@ -1025,7 +1025,7 @@ $code.=<<___; - .type aesni_ctr32_encrypt_blocks,\@function,5 - .align 16 - aesni_ctr32_encrypt_blocks: -- endbr64 -+ _CET_ENDBR - lea (%rsp),%rax - push %rbp - sub \$$frame_size,%rsp -@@ -2487,7 +2487,7 @@ $code.=<<___; - .type ${PREFIX}_set_decrypt_key,\@abi-omnipotent - .align 16 - ${PREFIX}_set_decrypt_key: -- endbr64 -+ _CET_ENDBR - sub \$8,%rsp - call __aesni_set_encrypt_key - shl \$4,$bits # rounds-1 after _aesni_set_encrypt_key -@@ -2538,7 +2538,7 @@ $code.=<<___; - .type ${PREFIX}_set_encrypt_key,\@abi-omnipotent - .align 16 - ${PREFIX}_set_encrypt_key: -- endbr64 -+ _CET_ENDBR - __aesni_set_encrypt_key: - sub \$8,%rsp - mov \$-1,%rax -@@ -2760,7 +2760,7 @@ $code.=<<___ if ($PREFIX eq "aesni"); - .type ecb_se_handler,\@abi-omnipotent - .align 16 - ecb_se_handler: -- endbr64 -+ _CET_ENDBR - push %rsi - push %rdi - push %rbx -@@ -2780,7 +2780,7 @@ ecb_se_handler: - .type ccm64_se_handler,\@abi-omnipotent - .align 16 - ccm64_se_handler: -- endbr64 -+ _CET_ENDBR - push %rsi - push %rdi - push %rbx -@@ -2822,7 +2822,7 @@ ccm64_se_handler: - .type ctr32_se_handler,\@abi-omnipotent - .align 16 - ctr32_se_handler: -- endbr64 -+ _CET_ENDBR - push %rsi - push %rdi - push %rbx -@@ -2858,7 +2858,7 @@ ctr32_se_handler: - .type xts_se_handler,\@abi-omnipotent - .align 16 - xts_se_handler: -- endbr64 -+ _CET_ENDBR - push %rsi - push %rdi - push %rbx -@@ -2900,7 +2900,7 @@ $code.=<<___; - .type cbc_se_handler,\@abi-omnipotent - .align 16 - cbc_se_handler: -- endbr64 -+ _CET_ENDBR - push %rsi - push %rdi - push %rbx -Index: aes/asm/bsaes-x86_64.pl -=================================================================== -RCS file: /cvs/src/lib/libcrypto/aes/asm/bsaes-x86_64.pl,v -diff -u -p -r1.6 bsaes-x86_64.pl ---- aes/asm/bsaes-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.6 -+++ aes/asm/bsaes-x86_64.pl 3 Dec 2023 20:18:30 -0000 -@@ -813,7 +813,7 @@ $code.=<<___; - .type _bsaes_encrypt8,\@abi-omnipotent - .align 64 - _bsaes_encrypt8: -- endbr64 -+ _CET_ENDBR - lea .LBS0(%rip), $const # constants table - - movdqa ($key), @XMM[9] # round 0 key -@@ -878,7 +878,7 @@ $code.=<<___; - .type _bsaes_decrypt8,\@abi-omnipotent - .align 64 - _bsaes_decrypt8: -- endbr64 -+ _CET_ENDBR - lea .LBS0(%rip), $const # constants table - - movdqa ($key), @XMM[9] # round 0 key -@@ -970,7 +970,7 @@ $code.=<<___; - .type _bsaes_key_convert,\@abi-omnipotent - .align 16 - _bsaes_key_convert: -- endbr64 -+ _CET_ENDBR - lea .Lmasks(%rip), $const - movdqu ($inp), %xmm7 # load round 0 key - lea 0x10($inp), $inp -@@ -1060,7 +1060,7 @@ $code.=<<___; - .type bsaes_enc_key_convert,\@function,2 - .align 16 - bsaes_enc_key_convert: -- endbr64 -+ _CET_ENDBR - mov 240($inp),%r10d # pass rounds - mov $inp,%rcx # pass key - mov $out,%rax # pass key schedule -@@ -1075,7 +1075,7 @@ bsaes_enc_key_convert: - .align 16 - bsaes_encrypt_128: - .Lenc128_loop: -- endbr64 -+ _CET_ENDBR - movdqu 0x00($inp), @XMM[0] # load input - movdqu 0x10($inp), @XMM[1] - movdqu 0x20($inp), @XMM[2] -@@ -1108,7 +1108,7 @@ bsaes_encrypt_128: - .type bsaes_dec_key_convert,\@function,2 - .align 16 - bsaes_dec_key_convert: -- endbr64 -+ _CET_ENDBR - mov 240($inp),%r10d # pass rounds - mov $inp,%rcx # pass key - mov $out,%rax # pass key schedule -@@ -1123,7 +1123,7 @@ bsaes_dec_key_convert: - .type bsaes_decrypt_128,\@function,4 - .align 16 - bsaes_decrypt_128: -- endbr64 -+ _CET_ENDBR - .Ldec128_loop: - movdqu 0x00($inp), @XMM[0] # load input - movdqu 0x10($inp), @XMM[1] -@@ -1169,7 +1169,7 @@ $code.=<<___; - .type bsaes_ecb_encrypt_blocks,\@abi-omnipotent - .align 16 - bsaes_ecb_encrypt_blocks: -- endbr64 -+ _CET_ENDBR - mov %rsp, %rax - .Lecb_enc_prologue: - push %rbp -@@ -1371,7 +1371,7 @@ $code.=<<___; - .type bsaes_ecb_decrypt_blocks,\@abi-omnipotent - .align 16 - bsaes_ecb_decrypt_blocks: -- endbr64 -+ _CET_ENDBR - mov %rsp, %rax - .Lecb_dec_prologue: - push %rbp -@@ -1577,7 +1577,7 @@ $code.=<<___; - .type bsaes_cbc_encrypt,\@abi-omnipotent - .align 16 - bsaes_cbc_encrypt: -- endbr64 -+ _CET_ENDBR - ___ - $code.=<<___ if ($win64); - mov 48(%rsp),$arg6 # pull direction flag -@@ -1865,7 +1865,7 @@ $code.=<<___; - .type bsaes_ctr32_encrypt_blocks,\@abi-omnipotent - .align 16 - bsaes_ctr32_encrypt_blocks: -- endbr64 -+ _CET_ENDBR - mov %rsp, %rax - .Lctr_enc_prologue: - push %rbp -@@ -2107,7 +2107,7 @@ $code.=<<___; - .type bsaes_xts_encrypt,\@abi-omnipotent - .align 16 - bsaes_xts_encrypt: -- endbr64 -+ _CET_ENDBR - mov %rsp, %rax - .Lxts_enc_prologue: - push %rbp -@@ -2489,7 +2489,7 @@ $code.=<<___; - .type bsaes_xts_decrypt,\@abi-omnipotent - .align 16 - bsaes_xts_decrypt: -- endbr64 -+ _CET_ENDBR - mov %rsp, %rax - .Lxts_dec_prologue: - push %rbp -@@ -2966,7 +2966,7 @@ $code.=<<___; - .type se_handler,\@abi-omnipotent - .align 16 - se_handler: -- endbr64 -+ _CET_ENDBR - push %rsi - push %rdi - push %rbx -Index: aes/asm/vpaes-x86_64.pl -=================================================================== -RCS file: /cvs/src/lib/libcrypto/aes/asm/vpaes-x86_64.pl,v -diff -u -p -r1.5 vpaes-x86_64.pl ---- aes/asm/vpaes-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.5 -+++ aes/asm/vpaes-x86_64.pl 3 Dec 2023 20:18:30 -0000 -@@ -82,7 +82,7 @@ $code.=<<___; - .type _vpaes_encrypt_core,\@abi-omnipotent - .align 16 - _vpaes_encrypt_core: -- endbr64 -+ _CET_ENDBR - mov %rdx, %r9 - mov \$16, %r11 - mov 240(%rdx),%eax -@@ -173,7 +173,7 @@ _vpaes_encrypt_core: - .type _vpaes_decrypt_core,\@abi-omnipotent - .align 16 - _vpaes_decrypt_core: -- endbr64 -+ _CET_ENDBR - mov %rdx, %r9 # load key - mov 240(%rdx),%eax - movdqa %xmm9, %xmm1 -@@ -281,7 +281,7 @@ _vpaes_decrypt_core: - .type _vpaes_schedule_core,\@abi-omnipotent - .align 16 - _vpaes_schedule_core: -- endbr64 -+ _CET_ENDBR - # rdi = key - # rsi = size in bits - # rdx = buffer -@@ -467,7 +467,7 @@ _vpaes_schedule_core: - .type _vpaes_schedule_192_smear,\@abi-omnipotent - .align 16 - _vpaes_schedule_192_smear: -- endbr64 -+ _CET_ENDBR - pshufd \$0x80, %xmm6, %xmm0 # d c 0 0 -> c 0 0 0 - pxor %xmm0, %xmm6 # -> c+d c 0 0 - pshufd \$0xFE, %xmm7, %xmm0 # b a _ _ -> b b b a -@@ -499,7 +499,7 @@ _vpaes_schedule_192_smear: - .type _vpaes_schedule_round,\@abi-omnipotent - .align 16 - _vpaes_schedule_round: -- endbr64 -+ _CET_ENDBR - # extract rcon from xmm8 - pxor %xmm1, %xmm1 - palignr \$15, %xmm8, %xmm1 -@@ -567,7 +567,7 @@ _vpaes_schedule_low_round: - .type _vpaes_schedule_transform,\@abi-omnipotent - .align 16 - _vpaes_schedule_transform: -- endbr64 -+ _CET_ENDBR - movdqa %xmm9, %xmm1 - pandn %xmm0, %xmm1 - psrld \$4, %xmm1 -@@ -606,7 +606,7 @@ _vpaes_schedule_transform: - .type _vpaes_schedule_mangle,\@abi-omnipotent - .align 16 - _vpaes_schedule_mangle: -- endbr64 -+ _CET_ENDBR - movdqa %xmm0, %xmm4 # save xmm0 for later - movdqa .Lk_mc_forward(%rip),%xmm5 - test %rcx, %rcx -@@ -680,7 +680,7 @@ _vpaes_schedule_mangle: - .type ${PREFIX}_set_encrypt_key,\@function,3 - .align 16 - ${PREFIX}_set_encrypt_key: -- endbr64 -+ _CET_ENDBR - ___ - $code.=<<___ if ($win64); - lea -0xb8(%rsp),%rsp -@@ -729,7 +729,7 @@ $code.=<<___; - .type ${PREFIX}_set_decrypt_key,\@function,3 - .align 16 - ${PREFIX}_set_decrypt_key: -- endbr64 -+ _CET_ENDBR - ___ - $code.=<<___ if ($win64); - lea -0xb8(%rsp),%rsp -@@ -783,7 +783,7 @@ $code.=<<___; - .type ${PREFIX}_encrypt,\@function,3 - .align 16 - ${PREFIX}_encrypt: -- endbr64 -+ _CET_ENDBR - ___ - $code.=<<___ if ($win64); - lea -0xb8(%rsp),%rsp -@@ -827,7 +827,7 @@ $code.=<<___; - .type ${PREFIX}_decrypt,\@function,3 - .align 16 - ${PREFIX}_decrypt: -- endbr64 -+ _CET_ENDBR - ___ - $code.=<<___ if ($win64); - lea -0xb8(%rsp),%rsp -@@ -877,7 +877,7 @@ $code.=<<___; - .type ${PREFIX}_cbc_encrypt,\@function,6 - .align 16 - ${PREFIX}_cbc_encrypt: -- endbr64 -+ _CET_ENDBR - xchg $key,$len - ___ - ($len,$key)=($key,$len); -@@ -961,7 +961,7 @@ $code.=<<___; - .type _vpaes_preheat,\@abi-omnipotent - .align 16 - _vpaes_preheat: -- endbr64 -+ _CET_ENDBR - lea .Lk_s0F(%rip), %r10 - movdqa -0x20(%r10), %xmm10 # .Lk_inv - movdqa -0x10(%r10), %xmm11 # .Lk_inv+16 -@@ -1092,7 +1092,7 @@ $code.=<<___; - .type se_handler,\@abi-omnipotent - .align 16 - se_handler: -- endbr64 -+ _CET_ENDBR - push %rsi - push %rdi - push %rbx -Index: bn/s2n_bignum_internal.h -=================================================================== -RCS file: /cvs/src/lib/libcrypto/bn/s2n_bignum_internal.h,v -diff -u -p -r1.2 s2n_bignum_internal.h ---- bn/s2n_bignum_internal.h 21 Jan 2023 15:53:54 -0000 1.2 -+++ bn/s2n_bignum_internal.h 3 Dec 2023 20:22:18 -0000 -@@ -18,6 +18,12 @@ - # define S2N_BN_SYMBOL(name) name - #endif - -+#ifdef __CET__ -+# include -+#else -+# define _CET_ENDBR -+#endif -+ - #define S2N_BN_SYM_VISIBILITY_DIRECTIVE(name) .globl S2N_BN_SYMBOL(name) - #ifdef S2N_BN_HIDE_SYMBOLS - # ifdef __APPLE__ -Index: bn/arch/amd64/bignum_add.S -=================================================================== -RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_add.S,v -diff -u -p -r1.4 bignum_add.S ---- bn/arch/amd64/bignum_add.S 25 Apr 2023 04:42:26 -0000 1.4 -+++ bn/arch/amd64/bignum_add.S 3 Dec 2023 20:18:30 -0000 -@@ -49,7 +49,7 @@ - - - S2N_BN_SYMBOL(bignum_add): -- endbr64 -+ _CET_ENDBR - - #if WINDOWS_ABI - push rdi -Index: bn/arch/amd64/bignum_cmadd.S -=================================================================== -RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_cmadd.S,v -diff -u -p -r1.4 bignum_cmadd.S ---- bn/arch/amd64/bignum_cmadd.S 25 Apr 2023 04:42:26 -0000 1.4 -+++ bn/arch/amd64/bignum_cmadd.S 3 Dec 2023 20:18:30 -0000 -@@ -54,7 +54,7 @@ - - - S2N_BN_SYMBOL(bignum_cmadd): -- endbr64 -+ _CET_ENDBR - - #if WINDOWS_ABI - push rdi -Index: bn/arch/amd64/bignum_cmul.S -=================================================================== -RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_cmul.S,v -diff -u -p -r1.4 bignum_cmul.S ---- bn/arch/amd64/bignum_cmul.S 25 Apr 2023 04:42:26 -0000 1.4 -+++ bn/arch/amd64/bignum_cmul.S 3 Dec 2023 20:18:30 -0000 -@@ -51,7 +51,7 @@ - - - S2N_BN_SYMBOL(bignum_cmul): -- endbr64 -+ _CET_ENDBR - - #if WINDOWS_ABI - push rdi -Index: bn/arch/amd64/bignum_mul.S -=================================================================== -RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_mul.S,v -diff -u -p -r1.4 bignum_mul.S ---- bn/arch/amd64/bignum_mul.S 25 Apr 2023 04:42:26 -0000 1.4 -+++ bn/arch/amd64/bignum_mul.S 3 Dec 2023 20:18:30 -0000 -@@ -59,7 +59,7 @@ - - - S2N_BN_SYMBOL(bignum_mul): -- endbr64 -+ _CET_ENDBR - - #if WINDOWS_ABI - push rdi -Index: bn/arch/amd64/bignum_mul_4_8_alt.S -=================================================================== -RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_mul_4_8_alt.S,v -diff -u -p -r1.4 bignum_mul_4_8_alt.S ---- bn/arch/amd64/bignum_mul_4_8_alt.S 25 Apr 2023 04:42:26 -0000 1.4 -+++ bn/arch/amd64/bignum_mul_4_8_alt.S 3 Dec 2023 20:18:30 -0000 -@@ -72,7 +72,7 @@ - adc h, rdx - - S2N_BN_SYMBOL(bignum_mul_4_8_alt): -- endbr64 -+ _CET_ENDBR - - #if WINDOWS_ABI - push rdi -Index: bn/arch/amd64/bignum_mul_8_16_alt.S -=================================================================== -RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_mul_8_16_alt.S,v -diff -u -p -r1.4 bignum_mul_8_16_alt.S ---- bn/arch/amd64/bignum_mul_8_16_alt.S 25 Apr 2023 04:42:26 -0000 1.4 -+++ bn/arch/amd64/bignum_mul_8_16_alt.S 3 Dec 2023 20:18:30 -0000 -@@ -72,7 +72,7 @@ - adc h, rdx - - S2N_BN_SYMBOL(bignum_mul_8_16_alt): -- endbr64 -+ _CET_ENDBR - - #if WINDOWS_ABI - push rdi -Index: bn/arch/amd64/bignum_sqr.S -=================================================================== -RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_sqr.S,v -diff -u -p -r1.4 bignum_sqr.S ---- bn/arch/amd64/bignum_sqr.S 25 Apr 2023 04:42:26 -0000 1.4 -+++ bn/arch/amd64/bignum_sqr.S 3 Dec 2023 20:18:30 -0000 -@@ -62,7 +62,7 @@ - #define llshort ebp - - S2N_BN_SYMBOL(bignum_sqr): -- endbr64 -+ _CET_ENDBR - - #if WINDOWS_ABI - push rdi -Index: bn/arch/amd64/bignum_sqr_4_8_alt.S -=================================================================== -RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_4_8_alt.S,v -diff -u -p -r1.4 bignum_sqr_4_8_alt.S ---- bn/arch/amd64/bignum_sqr_4_8_alt.S 25 Apr 2023 04:42:26 -0000 1.4 -+++ bn/arch/amd64/bignum_sqr_4_8_alt.S 3 Dec 2023 20:18:30 -0000 -@@ -71,7 +71,7 @@ - adc c, 0 - - S2N_BN_SYMBOL(bignum_sqr_4_8_alt): -- endbr64 -+ _CET_ENDBR - - #if WINDOWS_ABI - push rdi -Index: bn/arch/amd64/bignum_sqr_8_16_alt.S -=================================================================== -RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_sqr_8_16_alt.S,v -diff -u -p -r1.4 bignum_sqr_8_16_alt.S ---- bn/arch/amd64/bignum_sqr_8_16_alt.S 25 Apr 2023 04:42:26 -0000 1.4 -+++ bn/arch/amd64/bignum_sqr_8_16_alt.S 3 Dec 2023 20:18:30 -0000 -@@ -103,7 +103,7 @@ - adc c, 0 - - S2N_BN_SYMBOL(bignum_sqr_8_16_alt): -- endbr64 -+ _CET_ENDBR - - #if WINDOWS_ABI - push rdi -Index: bn/arch/amd64/bignum_sub.S -=================================================================== -RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/bignum_sub.S,v -diff -u -p -r1.4 bignum_sub.S ---- bn/arch/amd64/bignum_sub.S 25 Apr 2023 04:42:26 -0000 1.4 -+++ bn/arch/amd64/bignum_sub.S 3 Dec 2023 20:18:30 -0000 -@@ -49,7 +49,7 @@ - - - S2N_BN_SYMBOL(bignum_sub): -- endbr64 -+ _CET_ENDBR - - #if WINDOWS_ABI - push rdi -Index: bn/arch/amd64/word_clz.S -=================================================================== -RCS file: /cvs/src/lib/libcrypto/bn/arch/amd64/word_clz.S,v -diff -u -p -r1.4 word_clz.S ---- bn/arch/amd64/word_clz.S 25 Apr 2023 04:42:26 -0000 1.4 -+++ bn/arch/amd64/word_clz.S 3 Dec 2023 20:18:30 -0000 -@@ -30,7 +30,7 @@ - .text - - S2N_BN_SYMBOL(word_clz): -- endbr64 -+ _CET_ENDBR - - #if WINDOWS_ABI - push rdi -Index: bn/asm/modexp512-x86_64.pl -=================================================================== -RCS file: /cvs/src/lib/libcrypto/bn/asm/modexp512-x86_64.pl,v -diff -u -p -r1.4 modexp512-x86_64.pl ---- bn/asm/modexp512-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.4 -+++ bn/asm/modexp512-x86_64.pl 3 Dec 2023 20:18:30 -0000 -@@ -347,7 +347,7 @@ $code.=<<___; - .type MULADD_128x512,\@abi-omnipotent - .align 16 - MULADD_128x512: -- endbr64 -+ _CET_ENDBR - ___ - &MULSTEP_512([map("%r$_",(8..15))], "(+8*0)(%rcx)", "%rsi", "%rbp", "%rbx"); - $code.=<<___; -@@ -415,7 +415,7 @@ $code.=<<___; - .type mont_reduce,\@abi-omnipotent - .align 16 - mont_reduce: -- endbr64 -+ _CET_ENDBR - ___ - - my $STACK_DEPTH = 8; -@@ -678,7 +678,7 @@ $code.=<<___; - .type mont_mul_a3b,\@abi-omnipotent - .align 16 - mont_mul_a3b: -- endbr64 -+ _CET_ENDBR - # - # multiply tmp = src1 * src2 - # For multiply: dst = rcx, src1 = rdi, src2 = rsi -@@ -1080,7 +1080,7 @@ $code.=<<___; - .type sqr_reduce,\@abi-omnipotent - .align 16 - sqr_reduce: -- endbr64 -+ _CET_ENDBR - mov (+$pResult_offset+8)(%rsp), %rcx - ___ - &SQR_512("%rsp+$tmp16_offset+8", "%rcx", [map("%r$_",(10..15,8..9))], "%rbx", "%rbp", "%rsi", "%rdi"); -@@ -1110,7 +1110,7 @@ $code.=<<___; - .globl mod_exp_512 - .type mod_exp_512,\@function,4 - mod_exp_512: -- endbr64 -+ _CET_ENDBR - push %rbp - push %rbx - push %r12 -Index: bn/asm/x86_64-mont.pl -=================================================================== -RCS file: /cvs/src/lib/libcrypto/bn/asm/x86_64-mont.pl,v -diff -u -p -r1.5 x86_64-mont.pl ---- bn/asm/x86_64-mont.pl 25 Apr 2023 04:42:26 -0000 1.5 -+++ bn/asm/x86_64-mont.pl 3 Dec 2023 20:18:30 -0000 -@@ -63,7 +63,7 @@ $code=<<___; - .type bn_mul_mont,\@function,6 - .align 16 - bn_mul_mont: -- endbr64 -+ _CET_ENDBR - test \$3,${num}d - jnz .Lmul_enter - cmp \$8,${num}d -@@ -279,7 +279,7 @@ $code.=<<___; - .align 16 - bn_mul4x_mont: - .Lmul4x_enter: -- endbr64 -+ _CET_ENDBR - push %rbx - push %rbp - push %r12 -@@ -707,7 +707,7 @@ $code.=<<___; - .align 16 - bn_sqr4x_mont: - .Lsqr4x_enter: -- endbr64 -+ _CET_ENDBR - push %rbx - push %rbp - push %r12 -Index: bn/asm/x86_64-mont5.pl -=================================================================== -RCS file: /cvs/src/lib/libcrypto/bn/asm/x86_64-mont5.pl,v -diff -u -p -r1.8 x86_64-mont5.pl ---- bn/asm/x86_64-mont5.pl 25 Apr 2023 04:42:26 -0000 1.8 -+++ bn/asm/x86_64-mont5.pl 3 Dec 2023 20:18:30 -0000 -@@ -57,7 +57,7 @@ $code=<<___; - .type bn_mul_mont_gather5,\@function,6 - .align 64 - bn_mul_mont_gather5: -- endbr64 -+ _CET_ENDBR - test \$3,${num}d - jnz .Lmul_enter - cmp \$8,${num}d -@@ -388,7 +388,7 @@ $code.=<<___; - .type bn_mul4x_mont_gather5,\@function,6 - .align 16 - bn_mul4x_mont_gather5: -- endbr64 -+ _CET_ENDBR - .Lmul4x_enter: - mov ${num}d,${num}d - movd `($win64?56:8)`(%rsp),%xmm5 # load 7th argument -@@ -927,7 +927,7 @@ $code.=<<___; - .type bn_scatter5,\@abi-omnipotent - .align 16 - bn_scatter5: -- endbr64 -+ _CET_ENDBR - cmp \$0, $num - jz .Lscatter_epilogue - lea ($tbl,$idx,8),$tbl -@@ -946,7 +946,7 @@ bn_scatter5: - .type bn_gather5,\@abi-omnipotent - .align 16 - bn_gather5: -- endbr64 -+ _CET_ENDBR - .LSEH_begin_bn_gather5: # Win64 thing, but harmless in other cases - # I can't trust assembler to use specific encoding:-( - .byte 0x4c,0x8d,0x14,0x24 # lea (%rsp),%r10 -@@ -1057,7 +1057,7 @@ $code.=<<___; - .type mul_handler,\@abi-omnipotent - .align 16 - mul_handler: -- endbr64 -+ _CET_ENDBR - push %rsi - push %rdi - push %rbx -Index: camellia/asm/cmll-x86_64.pl -=================================================================== -RCS file: /cvs/src/lib/libcrypto/camellia/asm/cmll-x86_64.pl,v -diff -u -p -r1.7 cmll-x86_64.pl ---- camellia/asm/cmll-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.7 -+++ camellia/asm/cmll-x86_64.pl 3 Dec 2023 20:18:30 -0000 -@@ -116,7 +116,7 @@ $code=<<___; - .type Camellia_EncryptBlock,\@abi-omnipotent - .align 16 - Camellia_EncryptBlock: -- endbr64 -+ _CET_ENDBR - movl \$128,%eax - subl $arg0d,%eax - movl \$3,$arg0d -@@ -129,7 +129,7 @@ Camellia_EncryptBlock: - .align 16 - .Lenc_rounds: - Camellia_EncryptBlock_Rounds: -- endbr64 -+ _CET_ENDBR - push %rbx - push %rbp - push %r13 -@@ -178,7 +178,7 @@ Camellia_EncryptBlock_Rounds: - .type _x86_64_Camellia_encrypt,\@abi-omnipotent - .align 16 - _x86_64_Camellia_encrypt: -- endbr64 -+ _CET_ENDBR - xor 0($key),@S[1] - xor 4($key),@S[0] # ^=key[0-3] - xor 8($key),@S[3] -@@ -229,7 +229,7 @@ $code.=<<___; - .type Camellia_DecryptBlock,\@abi-omnipotent - .align 16 - Camellia_DecryptBlock: -- endbr64 -+ _CET_ENDBR - movl \$128,%eax - subl $arg0d,%eax - movl \$3,$arg0d -@@ -242,7 +242,7 @@ Camellia_DecryptBlock: - .align 16 - .Ldec_rounds: - Camellia_DecryptBlock_Rounds: -- endbr64 -+ _CET_ENDBR - push %rbx - push %rbp - push %r13 -@@ -291,7 +291,7 @@ Camellia_DecryptBlock_Rounds: - .type _x86_64_Camellia_decrypt,\@abi-omnipotent - .align 16 - _x86_64_Camellia_decrypt: -- endbr64 -+ _CET_ENDBR - xor 0($key),@S[1] - xor 4($key),@S[0] # ^=key[0-3] - xor 8($key),@S[3] -@@ -406,7 +406,7 @@ $code.=<<___; - .type Camellia_Ekeygen,\@function,3 - .align 16 - Camellia_Ekeygen: -- endbr64 -+ _CET_ENDBR - push %rbx - push %rbp - push %r13 -@@ -637,7 +637,7 @@ $code.=<<___; - .type Camellia_cbc_encrypt,\@function,6 - .align 16 - Camellia_cbc_encrypt: -- endbr64 -+ _CET_ENDBR - cmp \$0,%rdx - je .Lcbc_abort - push %rbx -Index: md5/asm/md5-x86_64.pl -=================================================================== -RCS file: /cvs/src/lib/libcrypto/md5/asm/md5-x86_64.pl,v -diff -u -p -r1.3 md5-x86_64.pl ---- md5/asm/md5-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.3 -+++ md5/asm/md5-x86_64.pl 3 Dec 2023 20:18:30 -0000 -@@ -128,7 +128,7 @@ $code .= < -+#else -+#define _CET_ENDBR -+#endif -+ -+___ -+} -+ - print "#include \"x86_arch.h\"\n"; - - while($line=<>) { -Index: rc4/asm/rc4-md5-x86_64.pl -=================================================================== -RCS file: /cvs/src/lib/libcrypto/rc4/asm/rc4-md5-x86_64.pl,v -diff -u -p -r1.4 rc4-md5-x86_64.pl ---- rc4/asm/rc4-md5-x86_64.pl 28 Jul 2023 10:35:14 -0000 1.4 -+++ rc4/asm/rc4-md5-x86_64.pl 3 Dec 2023 20:18:30 -0000 -@@ -109,7 +109,7 @@ $code.=<<___; - .globl $func - .type $func,\@function,$nargs - $func: -- endbr64 -+ _CET_ENDBR - cmp \$0,$len - je .Labort - push %rbx -@@ -454,7 +454,7 @@ $code.=<<___; - .type RC4_set_key,\@function,3 - .align 16 - RC4_set_key: -- endbr64 -+ _CET_ENDBR - lea 8($dat),$dat - lea ($inp,$len),$inp - neg $len -Index: rc4/asm/rc4-x86_64.pl -=================================================================== -RCS file: /cvs/src/lib/libcrypto/rc4/asm/rc4-x86_64.pl,v -diff -u -p -r1.16 rc4-x86_64.pl ---- rc4/asm/rc4-x86_64.pl 28 Jul 2023 10:35:14 -0000 1.16 -+++ rc4/asm/rc4-x86_64.pl 3 Dec 2023 20:18:30 -0000 -@@ -128,7 +128,7 @@ $code=<<___; - .type RC4,\@function,4 - .align 16 - RC4: -- endbr64 -+ _CET_ENDBR - or $len,$len - jne .Lentry - ret -@@ -435,7 +435,7 @@ $code.=<<___; - .type RC4_set_key,\@function,3 - .align 16 - RC4_set_key: -- endbr64 -+ _CET_ENDBR - lea 8($dat),$dat - lea ($inp,$len),$inp - neg $len -Index: sha/asm/sha1-x86_64.pl -=================================================================== -RCS file: /cvs/src/lib/libcrypto/sha/asm/sha1-x86_64.pl,v -diff -u -p -r1.7 sha1-x86_64.pl ---- sha/asm/sha1-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.7 -+++ sha/asm/sha1-x86_64.pl 3 Dec 2023 20:18:30 -0000 -@@ -222,7 +222,7 @@ $code.=<<___; - .type sha1_block_data_order,\@function,3 - .align 16 - sha1_block_data_order: -- endbr64 -+ _CET_ENDBR - mov OPENSSL_ia32cap_P+0(%rip),%r9d - mov OPENSSL_ia32cap_P+4(%rip),%r8d - test \$IA32CAP_MASK1_SSSE3,%r8d # check SSSE3 bit -@@ -310,7 +310,7 @@ $code.=<<___; - .align 16 - sha1_block_data_order_ssse3: - _ssse3_shortcut: -- endbr64 -+ _CET_ENDBR - push %rbx - push %rbp - push %r12 -@@ -731,7 +731,7 @@ $code.=<<___; - .align 16 - sha1_block_data_order_avx: - _avx_shortcut: -- endbr64 -+ _CET_ENDBR - push %rbx - push %rbp - push %r12 -@@ -1102,7 +1102,7 @@ $code.=<<___; - .type se_handler,\@abi-omnipotent - .align 16 - se_handler: -- endbr64 -+ _CET_ENDBR - push %rsi - push %rdi - push %rbx -Index: sha/asm/sha512-x86_64.pl -=================================================================== -RCS file: /cvs/src/lib/libcrypto/sha/asm/sha512-x86_64.pl,v -diff -u -p -r1.7 sha512-x86_64.pl ---- sha/asm/sha512-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.7 -+++ sha/asm/sha512-x86_64.pl 3 Dec 2023 20:18:30 -0000 -@@ -175,7 +175,7 @@ $code=<<___; - .type $func,\@function,4 - .align 16 - $func: -- endbr64 -+ _CET_ENDBR - push %rbx - push %rbp - push %r12 -Index: whrlpool/asm/wp-x86_64.pl -=================================================================== -RCS file: /cvs/src/lib/libcrypto/whrlpool/asm/wp-x86_64.pl,v -diff -u -p -r1.5 wp-x86_64.pl ---- whrlpool/asm/wp-x86_64.pl 25 Apr 2023 04:42:26 -0000 1.5 -+++ whrlpool/asm/wp-x86_64.pl 3 Dec 2023 20:18:30 -0000 -@@ -57,7 +57,7 @@ $code=<<___; - .type $func,\@function,3 - .align 16 - $func: -- endbr64 -+ _CET_ENDBR - push %rbx - push %rbp - push %r12 From 500a1029e95215a2d37f7cdd5dd4090cd0685bd6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 24 Feb 2024 10:41:41 -0700 Subject: [PATCH 0613/1283] Remove use of endbr64.patch --- update.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/update.sh b/update.sh index 19166ecd0b..d6a8aa6f13 100755 --- a/update.sh +++ b/update.sh @@ -240,7 +240,6 @@ gen_asm() { setup_asm_generator() { rm -fr $asm_src cp -a $libcrypto_src $asm_src - patch -d $asm_src -p0 < patches/asm/endbr64.patch patch -d $asm_src -p4 < patches/asm/masm-align-64.patch } From 950b5bc1fb98c6e394a9aa05ecdb9dbd4253fd76 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 25 Feb 2024 18:12:24 -0600 Subject: [PATCH 0614/1283] include placeholder cet.h for cpp --- include/compat/cet.h | 13 +++++++++++++ update.sh | 2 +- 2 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 include/compat/cet.h diff --git a/include/compat/cet.h b/include/compat/cet.h new file mode 100644 index 0000000000..95517b0f0c --- /dev/null +++ b/include/compat/cet.h @@ -0,0 +1,13 @@ +/* + * Public domain + * cet.h compatibility shim + */ + +#ifndef LIBCOMPAT_CET_H +#define LIBCOMPAT_CET_H + +#ifndef _MSC_VER +#include_next +#endif + +#endif diff --git a/update.sh b/update.sh index d6a8aa6f13..e414f0d8bb 100755 --- a/update.sh +++ b/update.sh @@ -186,7 +186,7 @@ $CP crypto/compat/ui_openssl_win.c crypto/ui $GREP -v OPENSSL_ia32cap_P $libcrypto_src/Symbols.list | $GREP '^[A-Za-z0-9_]' > crypto/crypto.sym fixup_masm() { - cpp -I./crypto $1 \ + cpp -I./crypto -I./include/compat $1 \ | sed -e 's/^#/;/' \ | sed -e 's/|/OR/g' \ | sed -e 's/~/NOT/g' \ From 53edbd00c12ee1d27f1b9533933b32781125c758 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 25 Feb 2024 18:29:14 -0600 Subject: [PATCH 0615/1283] define _MSC_VER when preprocessing, add guards --- include/compat/cet.h | 8 +++++++- update.sh | 2 +- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/include/compat/cet.h b/include/compat/cet.h index 95517b0f0c..bb845deb6f 100644 --- a/include/compat/cet.h +++ b/include/compat/cet.h @@ -7,7 +7,13 @@ #define LIBCOMPAT_CET_H #ifndef _MSC_VER -#include_next + +#ifdef __CET__ +# include_next +#else +# define _CET_ENDBR +#endif + #endif #endif diff --git a/update.sh b/update.sh index e414f0d8bb..08cac6ffaa 100755 --- a/update.sh +++ b/update.sh @@ -186,7 +186,7 @@ $CP crypto/compat/ui_openssl_win.c crypto/ui $GREP -v OPENSSL_ia32cap_P $libcrypto_src/Symbols.list | $GREP '^[A-Za-z0-9_]' > crypto/crypto.sym fixup_masm() { - cpp -I./crypto -I./include/compat $1 \ + cpp -I./crypto -I./include/compat -D_MSC_VER $1 \ | sed -e 's/^#/;/' \ | sed -e 's/|/OR/g' \ | sed -e 's/~/NOT/g' \ From 839fa4df5a77cc0ecb18d40393414c76a20bf3ad Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 27 Feb 2024 06:59:24 -0600 Subject: [PATCH 0616/1283] adjust formatting of results --- .github/workflows/windows.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index be8ce5731e..facc4967ba 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -13,7 +13,7 @@ concurrency: jobs: test: - name: "${{ matrix.os }}/${{ matrix.arch }}/shared ${{ matrix.shared }} (${{ matrix.generator }})" + name: "${{ matrix.os }}/${{ matrix.arch }} (${{ matrix.generator }}${{ matrix.shared == 'ON' && ', shared' || '' }})" runs-on: "${{ matrix.os }}" if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} permissions: From b0689627c43e464c92d49fee13bc6b6d533c4057 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 27 Feb 2024 07:02:15 -0600 Subject: [PATCH 0617/1283] format artifacts with shared conditionally --- .github/workflows/windows.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index facc4967ba..fe14501915 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -65,5 +65,5 @@ jobs: if: always() uses: actions/upload-artifact@v4 with: - name: "${{ matrix.os }}-${{ matrix.arch }}-shared-${{ matrix.shared }}-build-results" + name: "${{ matrix.os }}-${{ matrix.arch }}${{ matrix.shared == 'ON' && '-shared' || '' }}-build-results" path: "build" From d8702f6951420d7641e02c04c8ce4db5762ddb07 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 27 Feb 2024 07:18:09 -0600 Subject: [PATCH 0618/1283] upstreamed masm alignment fix --- patches/asm/masm-align-64.patch | 30 ------------------------------ update.sh | 12 +++--------- 2 files changed, 3 insertions(+), 39 deletions(-) delete mode 100644 patches/asm/masm-align-64.patch diff --git a/patches/asm/masm-align-64.patch b/patches/asm/masm-align-64.patch deleted file mode 100644 index ba41c71024..0000000000 --- a/patches/asm/masm-align-64.patch +++ /dev/null @@ -1,30 +0,0 @@ -commit 3797e05de28ab07bb522898cbf022bdf67a71c99 -Author: Brent Cook -Date: Sun Feb 4 22:53:59 2024 -0600 - - align read-only sections on masm/windows to 64 bytes - - Avoid conflicts where alignment is specified later in the underlying - assembly. - -diff --git a/src/lib/libcrypto/perlasm/x86_64-xlate.pl b/src/lib/libcrypto/perlasm/x86_64-xlate.pl -index 5dbed2a8c..d8b607b5c 100755 ---- a/src/lib/libcrypto/perlasm/x86_64-xlate.pl -+++ b/src/lib/libcrypto/perlasm/x86_64-xlate.pl -@@ -567,7 +567,15 @@ my %globals; - $v.="$line\tSEGMENT"; - if ($line=~/\.([prx])data/) { - $v.=" READONLY"; -- $v.=" ALIGN(".($1 eq "p" ? 4 : 8).")" if ($masm>=$masmref); -+ if ($masm>=$masmref) { -+ if ($1 eq "r") { -+ $v.=" ALIGN(64)"; -+ } elsif ($1 eq "p") { -+ $v.=" ALIGN(4)"; -+ } else { -+ $v.=" ALIGN(8)"; -+ } -+ } - } elsif ($line=~/\.CRT\$/i) { - $v.=" READONLY "; - $v.=$masm>=$masmref ? "ALIGN(8)" : "DWORD"; diff --git a/update.sh b/update.sh index 08cac6ffaa..4fd1ab290c 100755 --- a/update.sh +++ b/update.sh @@ -195,7 +195,7 @@ fixup_masm() { } # generate assembly crypto algorithms -asm_src=$CWD/asm +asm_src=$libcrypto_src gen_asm_stdout() { CC=true perl $asm_src/$2 $1 > crypto/$3.tmp @@ -210,6 +210,7 @@ gen_asm_stdout() { $MV crypto/$3.tmp crypto/$3 fi } + gen_asm_mips() { abi=$1 dir=$2 @@ -223,6 +224,7 @@ gen_asm_mips() { EOF mv $dst.S crypto/$dir/$dst.S } + gen_asm() { CC=true perl $asm_src/$2 $1 crypto/$3.tmp [ $1 = "elf" ] && cat <<-EOF >> crypto/$3.tmp @@ -237,14 +239,6 @@ gen_asm() { fi } -setup_asm_generator() { - rm -fr $asm_src - cp -a $libcrypto_src $asm_src - patch -d $asm_src -p4 < patches/asm/masm-align-64.patch -} - -setup_asm_generator - echo generating mips ASM source for elf gen_asm_mips o32 aes aes-mips aes-mips gen_asm_mips o32 bn mips bn-mips From 9b54faaf977458a3c9c44aafe81ceee00956ba37 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 2 Mar 2024 07:37:36 -0700 Subject: [PATCH 0619/1283] Update build system for file removal --- crypto/CMakeLists.txt | 24 ++---------------------- crypto/Makefile.am | 32 +++++--------------------------- tests/CMakeLists.txt | 5 ----- tests/Makefile.am | 5 ----- update.sh | 2 +- 5 files changed, 8 insertions(+), 60 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index a5e08c5957..c61473506e 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -277,7 +277,6 @@ set( asn1/a_time_tm.c asn1/a_type.c asn1/a_utf8.c - asn1/ameth_lib.c asn1/asn1_err.c asn1/asn1_gen.c asn1/asn1_item.c @@ -488,7 +487,6 @@ set( evp/bio_enc.c evp/bio_md.c evp/e_aes.c - evp/e_aes_cbc_hmac_sha1.c evp/e_bf.c evp/e_camellia.c evp/e_cast.c @@ -496,12 +494,10 @@ set( evp/e_chacha20poly1305.c evp/e_des.c evp/e_des3.c - evp/e_gost2814789.c evp/e_idea.c evp/e_null.c evp/e_rc2.c evp/e_rc4.c - evp/e_rc4_hmac_md5.c evp/e_sm4.c evp/e_xcbc_d.c evp/evp_aead.c @@ -513,8 +509,6 @@ set( evp/evp_names.c evp/evp_pbe.c evp/evp_pkey.c - evp/m_gost2814789.c - evp/m_gostr341194.c evp/m_md4.c evp/m_md5.c evp/m_md5_sha1.c @@ -523,7 +517,6 @@ set( evp/m_sha1.c evp/m_sha3.c evp/m_sigver.c - evp/m_streebog.c evp/m_sm3.c evp/m_wp.c evp/p_legacy.c @@ -533,20 +526,6 @@ set( evp/pmeth_fn.c evp/pmeth_gn.c evp/pmeth_lib.c - gost/gost2814789.c - gost/gost89_keywrap.c - gost/gost89_params.c - gost/gost89imit_ameth.c - gost/gost89imit_pmeth.c - gost/gost_asn1.c - gost/gost_err.c - gost/gostr341001.c - gost/gostr341001_ameth.c - gost/gostr341001_key.c - gost/gostr341001_params.c - gost/gostr341001_pmeth.c - gost/gostr341194.c - gost/streebog.c hkdf/hkdf.c hmac/hm_ameth.c hmac/hm_pmeth.c @@ -558,7 +537,6 @@ set( idea/i_skey.c kdf/hkdf_evp.c kdf/kdf_err.c - lhash/lh_stats.c lhash/lhash.c md4/md4.c md5/md5.c @@ -901,11 +879,13 @@ target_include_directories(crypto_obj evp hidden hmac + lhash modes ocsp pkcs12 rsa sha + stack x509 ../include/compat PUBLIC diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 0fed0ccddb..d6fb3d0f0e 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -13,11 +13,13 @@ AM_CPPFLAGS += -I$(top_srcdir)/crypto/ecdh AM_CPPFLAGS += -I$(top_srcdir)/crypto/ecdsa AM_CPPFLAGS += -I$(top_srcdir)/crypto/evp AM_CPPFLAGS += -I$(top_srcdir)/crypto/hmac +AM_CPPFLAGS += -I$(top_srcdir)/crypto/lhash AM_CPPFLAGS += -I$(top_srcdir)/crypto/modes AM_CPPFLAGS += -I$(top_srcdir)/crypto/ocsp AM_CPPFLAGS += -I$(top_srcdir)/crypto/pkcs12 AM_CPPFLAGS += -I$(top_srcdir)/crypto/rsa AM_CPPFLAGS += -I$(top_srcdir)/crypto/sha +AM_CPPFLAGS += -I$(top_srcdir)/crypto/stack AM_CPPFLAGS += -I$(top_srcdir)/crypto/x509 AM_CPPFLAGS += -I$(top_srcdir)/crypto @@ -229,6 +231,7 @@ noinst_HEADERS += arm_arch.h noinst_HEADERS += constant_time.h noinst_HEADERS += cryptlib.h noinst_HEADERS += crypto_internal.h +noinst_HEADERS += crypto_local.h noinst_HEADERS += md32_common.h noinst_HEADERS += x86_arch.h @@ -259,7 +262,6 @@ libcrypto_la_SOURCES += asn1/a_time_posix.c libcrypto_la_SOURCES += asn1/a_time_tm.c libcrypto_la_SOURCES += asn1/a_type.c libcrypto_la_SOURCES += asn1/a_utf8.c -libcrypto_la_SOURCES += asn1/ameth_lib.c libcrypto_la_SOURCES += asn1/asn1_err.c libcrypto_la_SOURCES += asn1/asn1_gen.c libcrypto_la_SOURCES += asn1/asn1_item.c @@ -601,7 +603,6 @@ libcrypto_la_SOURCES += evp/bio_b64.c libcrypto_la_SOURCES += evp/bio_enc.c libcrypto_la_SOURCES += evp/bio_md.c libcrypto_la_SOURCES += evp/e_aes.c -libcrypto_la_SOURCES += evp/e_aes_cbc_hmac_sha1.c libcrypto_la_SOURCES += evp/e_bf.c libcrypto_la_SOURCES += evp/e_camellia.c libcrypto_la_SOURCES += evp/e_cast.c @@ -609,12 +610,10 @@ libcrypto_la_SOURCES += evp/e_chacha.c libcrypto_la_SOURCES += evp/e_chacha20poly1305.c libcrypto_la_SOURCES += evp/e_des.c libcrypto_la_SOURCES += evp/e_des3.c -libcrypto_la_SOURCES += evp/e_gost2814789.c libcrypto_la_SOURCES += evp/e_idea.c libcrypto_la_SOURCES += evp/e_null.c libcrypto_la_SOURCES += evp/e_rc2.c libcrypto_la_SOURCES += evp/e_rc4.c -libcrypto_la_SOURCES += evp/e_rc4_hmac_md5.c libcrypto_la_SOURCES += evp/e_sm4.c libcrypto_la_SOURCES += evp/e_xcbc_d.c libcrypto_la_SOURCES += evp/evp_aead.c @@ -626,8 +625,6 @@ libcrypto_la_SOURCES += evp/evp_key.c libcrypto_la_SOURCES += evp/evp_names.c libcrypto_la_SOURCES += evp/evp_pbe.c libcrypto_la_SOURCES += evp/evp_pkey.c -libcrypto_la_SOURCES += evp/m_gost2814789.c -libcrypto_la_SOURCES += evp/m_gostr341194.c libcrypto_la_SOURCES += evp/m_md4.c libcrypto_la_SOURCES += evp/m_md5.c libcrypto_la_SOURCES += evp/m_md5_sha1.c @@ -636,7 +633,6 @@ libcrypto_la_SOURCES += evp/m_ripemd.c libcrypto_la_SOURCES += evp/m_sha1.c libcrypto_la_SOURCES += evp/m_sha3.c libcrypto_la_SOURCES += evp/m_sigver.c -libcrypto_la_SOURCES += evp/m_streebog.c libcrypto_la_SOURCES += evp/m_sm3.c libcrypto_la_SOURCES += evp/m_wp.c libcrypto_la_SOURCES += evp/p_legacy.c @@ -648,24 +644,6 @@ libcrypto_la_SOURCES += evp/pmeth_gn.c libcrypto_la_SOURCES += evp/pmeth_lib.c noinst_HEADERS += evp/evp_local.h -# gost -libcrypto_la_SOURCES += gost/gost2814789.c -libcrypto_la_SOURCES += gost/gost89_keywrap.c -libcrypto_la_SOURCES += gost/gost89_params.c -libcrypto_la_SOURCES += gost/gost89imit_ameth.c -libcrypto_la_SOURCES += gost/gost89imit_pmeth.c -libcrypto_la_SOURCES += gost/gost_asn1.c -libcrypto_la_SOURCES += gost/gost_err.c -libcrypto_la_SOURCES += gost/gostr341001.c -libcrypto_la_SOURCES += gost/gostr341001_ameth.c -libcrypto_la_SOURCES += gost/gostr341001_key.c -libcrypto_la_SOURCES += gost/gostr341001_params.c -libcrypto_la_SOURCES += gost/gostr341001_pmeth.c -libcrypto_la_SOURCES += gost/gostr341194.c -libcrypto_la_SOURCES += gost/streebog.c -noinst_HEADERS += gost/gost_asn1.h -noinst_HEADERS += gost/gost_local.h - # hidden noinst_HEADERS += hidden/crypto_namespace.h noinst_HEADERS += hidden/openssl/asn1.h @@ -685,7 +663,6 @@ noinst_HEADERS += hidden/openssl/dh.h noinst_HEADERS += hidden/openssl/dsa.h noinst_HEADERS += hidden/openssl/ec.h noinst_HEADERS += hidden/openssl/err.h -noinst_HEADERS += hidden/openssl/gost.h noinst_HEADERS += hidden/openssl/hkdf.h noinst_HEADERS += hidden/openssl/hmac.h noinst_HEADERS += hidden/openssl/idea.h @@ -736,8 +713,8 @@ libcrypto_la_SOURCES += kdf/hkdf_evp.c libcrypto_la_SOURCES += kdf/kdf_err.c # lhash -libcrypto_la_SOURCES += lhash/lh_stats.c libcrypto_la_SOURCES += lhash/lhash.c +noinst_HEADERS += lhash/lhash_local.h # md4 libcrypto_la_SOURCES += md4/md4.c @@ -874,6 +851,7 @@ libcrypto_la_SOURCES += sm4/sm4.c # stack libcrypto_la_SOURCES += stack/stack.c +noinst_HEADERS += stack/stack_local.h # ts libcrypto_la_SOURCES += ts/ts_asn1.c diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 4923cc1b00..714f331d6b 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -415,11 +415,6 @@ add_executable(gcm128test gcm128test.c) target_link_libraries(gcm128test ${OPENSSL_TEST_LIBS}) add_test(gcm128test gcm128test) -# gost2814789t -add_executable(gost2814789t gost2814789t.c) -target_link_libraries(gost2814789t ${OPENSSL_TEST_LIBS}) -add_test(gost2814789t gost2814789t) - # handshake_table add_executable(handshake_table handshake_table.c) target_link_libraries(handshake_table ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index bd119fb375..e0e5a32e64 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -434,11 +434,6 @@ TESTS += gcm128test check_PROGRAMS += gcm128test gcm128test_SOURCES = gcm128test.c -# gost2814789t -TESTS += gost2814789t -check_PROGRAMS += gost2814789t -gost2814789t_SOURCES = gost2814789t.c - # handshake_table TESTS += handshake_table check_PROGRAMS += handshake_table diff --git a/update.sh b/update.sh index 4fd1ab290c..95d852cfab 100755 --- a/update.sh +++ b/update.sh @@ -139,7 +139,7 @@ copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h md4/md4.h ripemd/ripemd.h whrlpool/whrlpool.h idea/idea.h rc2/rc2.h rc4/rc4.h ui/ui_compat.h txt_db/txt_db.h sm3/sm3.h sm4/sm4.h chacha/chacha.h evp/evp.h poly1305/poly1305.h - camellia/camellia.h gost/gost.h curve25519/curve25519.h + camellia/camellia.h curve25519/curve25519.h ct/ct.h kdf/kdf.h" copy_hdrs $libssl_src "srtp.h ssl.h ssl2.h ssl3.h ssl23.h tls1.h dtls1.h" From e53b004d2a61abb53e9f52bbf02cf341518043be Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 2 Mar 2024 07:56:18 -0700 Subject: [PATCH 0620/1283] Update man links --- man/links | 9 --------- 1 file changed, 9 deletions(-) diff --git a/man/links b/man/links index e22c433535..027abba698 100644 --- a/man/links +++ b/man/links @@ -274,9 +274,6 @@ BIO_new.3,BIO_free_all.3 BIO_new.3,BIO_set.3 BIO_new.3,BIO_up_ref.3 BIO_new.3,BIO_vfree.3 -BIO_printf.3,BIO_snprintf.3 -BIO_printf.3,BIO_vprintf.3 -BIO_printf.3,BIO_vsnprintf.3 BIO_push.3,BIO_pop.3 BIO_push.3,BIO_set_next.3 BIO_read.3,BIO_gets.3 @@ -461,7 +458,6 @@ CMAC_Init.3,CMAC_CTX_get0_cipher_ctx.3 CMAC_Init.3,CMAC_CTX_new.3 CMAC_Init.3,CMAC_Final.3 CMAC_Init.3,CMAC_Update.3 -CMAC_Init.3,CMAC_resume.3 CMS_ContentInfo_new.3,CMS_ContentInfo_free.3 CMS_ContentInfo_new.3,CMS_ContentInfo_print_ctx.3 CMS_ContentInfo_new.3,CMS_ReceiptRequest_free.3 @@ -2800,11 +2796,6 @@ lh_new.3,lh_free.3 lh_new.3,lh_insert.3 lh_new.3,lh_retrieve.3 lh_new.3,lh_strhash.3 -lh_stats.3,lh_node_stats.3 -lh_stats.3,lh_node_stats_bio.3 -lh_stats.3,lh_node_usage_stats.3 -lh_stats.3,lh_node_usage_stats_bio.3 -lh_stats.3,lh_stats_bio.3 s2i_ASN1_INTEGER.3,i2s_ASN1_ENUMERATED.3 s2i_ASN1_INTEGER.3,i2s_ASN1_ENUMERATED_TABLE.3 s2i_ASN1_INTEGER.3,i2s_ASN1_INTEGER.3 From bbe18e1cd59df29432168ebdb5763f3796ac32f1 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 4 Mar 2024 21:37:30 +0100 Subject: [PATCH 0621/1283] Update ChangeLog --- ChangeLog | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 8a81f14dd1..a901eb975b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -63,12 +63,24 @@ LibreSSL Portable Release Notes: strings table entries, ASN.1 methods, PKEY methods, digest methods, CRL methods, purpose and trust identifiers, or X.509 extensions. - Removed the _cb() and _fp() versions of BIO_dump{,_indent}(). + - BIO_set() was removed. + - BIO_{sn,v,vsn}printf() were removed. - Turn the long dysfunctional openssl(1) s_client -pause into a noop. - openssl(1) x509 now supports -new -force_pubkey, -multivalue-rdn, -set_issuer, -set_subject, and -utf8. - Support ECDSA with SHA-3 signature algorithms. - Support HMAC with truncated SHA-2 and SHA-3 as PBE PRF. - - GOST and STREEBOG support was removed from libssl. + - GOST and STREEBOG support was removed. + - CRYPTO_THREADID, _LHASH, _STACK, X509_PURPOSE are now opaque, + X509_CERT_AUX and X509_TRUST were removed from the public API. + - ASN1_STRING_TABLE_get() and X509_PURPOSE_get0*() now return const + pointers. + - EVP_{CIPHER,MD}_CTX_init()'s signatures and semantics now match + OpenSSL's behavior. + - sk_find_ex() and OBJ_bsearch_() were removed. + - CRYPTO_malloc() was fixed to use size_t argument. CRYPTO_malloc() + and CRYPTO_free() now accept file and line arguments. + - A lot of decrepit CRYPTO memory API was removed. * Bug fixes - Fixed aliasing issues in BN_mod_exp_simple() and BN_mod_exp_recp(). - Fixed numerous misuses of X509_ALGOR_set0() resulting in leaks and From 2cd38a2c61e18749bed5eaceb8a4947ffc698a8e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 4 Mar 2024 13:42:31 -0700 Subject: [PATCH 0622/1283] Regen openssl.c.patch --- patches/openssl.c.patch | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/patches/openssl.c.patch b/patches/openssl.c.patch index 9b9d7f0d7e..15afb78b6a 100644 --- a/patches/openssl.c.patch +++ b/patches/openssl.c.patch @@ -1,6 +1,6 @@ ---- apps/openssl/openssl.c.orig Sat Jun 17 13:06:00 2023 -+++ apps/openssl/openssl.c Sat Jun 24 04:44:55 2023 -@@ -354,7 +354,9 @@ +--- apps/openssl/openssl.c.orig Mon Mar 4 13:39:56 2024 ++++ apps/openssl/openssl.c Mon Mar 4 13:40:15 2024 +@@ -348,7 +348,9 @@ static void openssl_startup(void) { From 5e2a489947a53ec3cbf6dbe5d8abd73b069b84f5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 4 Mar 2024 13:43:51 -0700 Subject: [PATCH 0623/1283] Update man links --- man/links | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/man/links b/man/links index 027abba698..8a6b634baf 100644 --- a/man/links +++ b/man/links @@ -522,10 +522,6 @@ CRYPTO_get_mem_functions.3,CRYPTO_mem_leaks.3 CRYPTO_get_mem_functions.3,CRYPTO_mem_leaks_cb.3 CRYPTO_get_mem_functions.3,CRYPTO_mem_leaks_fp.3 CRYPTO_get_mem_functions.3,CRYPTO_set_mem_functions.3 -CRYPTO_lock.3,CRYPTO_THREADID_cmp.3 -CRYPTO_lock.3,CRYPTO_THREADID_cpy.3 -CRYPTO_lock.3,CRYPTO_THREADID_current.3 -CRYPTO_lock.3,CRYPTO_THREADID_hash.3 CRYPTO_lock.3,CRYPTO_add.3 CRYPTO_lock.3,CRYPTO_r_lock.3 CRYPTO_lock.3,CRYPTO_r_unlock.3 @@ -1124,11 +1120,6 @@ EVP_SignInit.3,EVP_SignUpdate.3 EVP_VerifyInit.3,EVP_VerifyFinal.3 EVP_VerifyInit.3,EVP_VerifyInit_ex.3 EVP_VerifyInit.3,EVP_VerifyUpdate.3 -EVP_add_cipher.3,EVP_add_cipher_alias.3 -EVP_add_cipher.3,EVP_add_digest.3 -EVP_add_cipher.3,EVP_add_digest_alias.3 -EVP_add_cipher.3,EVP_delete_cipher_alias.3 -EVP_add_cipher.3,EVP_delete_digest_alias.3 EVP_aes_128_cbc.3,EVP_aes_128_cbc_hmac_sha1.3 EVP_aes_128_cbc.3,EVP_aes_128_ccm.3 EVP_aes_128_cbc.3,EVP_aes_128_cfb.3 @@ -1365,7 +1356,6 @@ OPENSSL_sk_new.3,sk_delete.3 OPENSSL_sk_new.3,sk_delete_ptr.3 OPENSSL_sk_new.3,sk_dup.3 OPENSSL_sk_new.3,sk_find.3 -OPENSSL_sk_new.3,sk_find_ex.3 OPENSSL_sk_new.3,sk_free.3 OPENSSL_sk_new.3,sk_insert.3 OPENSSL_sk_new.3,sk_is_sorted.3 @@ -2253,6 +2243,7 @@ X509_STORE_set1_param.3,X509_STORE_add_cert.3 X509_STORE_set1_param.3,X509_STORE_add_crl.3 X509_STORE_set1_param.3,X509_STORE_get0_objects.3 X509_STORE_set1_param.3,X509_STORE_get0_param.3 +X509_STORE_set1_param.3,X509_STORE_get1_objects.3 X509_STORE_set1_param.3,X509_STORE_get_ex_data.3 X509_STORE_set1_param.3,X509_STORE_get_ex_new_index.3 X509_STORE_set1_param.3,X509_STORE_set_depth.3 From 833cc83e5d438c3f8209602330de93a771d953c8 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 3 Mar 2024 17:57:30 -0600 Subject: [PATCH 0624/1283] add additional portable improvements --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index a901eb975b..837fb8595d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -35,6 +35,9 @@ LibreSSL Portable Release Notes: - Most compatibility symbols are prefixed with libressl_ to avoid symbol clashes in static links. - Fixed various warnings on Windows. + - Disabled assert pop-ups with debug builds on Windows. + - Fixed asserts and hangs in Windows ARM64 builds. + - Fixed issues building where CET is not supported. * Internal improvements - Converted uses of OBJ_bsearch_() to standard bsearch(). - Greatly simplified by_file_ctrl(). From 41034e540c77d0bbcffd640afb4195b5b151eed6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 7 Mar 2024 08:29:32 -0700 Subject: [PATCH 0625/1283] Update man links --- man/links | 19 ------------------- 1 file changed, 19 deletions(-) diff --git a/man/links b/man/links index 8a6b634baf..b91d877ac7 100644 --- a/man/links +++ b/man/links @@ -140,8 +140,6 @@ ASN1_mbstring_copy.3,ASN1_tag2bit.3 ASN1_parse_dump.3,ASN1_parse.3 ASN1_put_object.3,ASN1_object_size.3 ASN1_put_object.3,ASN1_put_eoc.3 -ASN1_time_parse.3,ASN1_TIME_set_tm.3 -ASN1_time_parse.3,ASN1_time_tm_cmp.3 ASRange_new.3,ASIdOrRange_free.3 ASRange_new.3,ASIdOrRange_new.3 ASRange_new.3,ASIdentifierChoice_free.3 @@ -953,18 +951,6 @@ EVP_MD_CTX_ctrl.3,EVP_MD_CTX_pkey_ctx.3 EVP_MD_CTX_ctrl.3,EVP_MD_CTX_set_flags.3 EVP_MD_CTX_ctrl.3,EVP_MD_CTX_set_pkey_ctx.3 EVP_MD_CTX_ctrl.3,EVP_MD_CTX_test_flags.3 -EVP_MD_meth_new.3,EVP_MD_meth_dup.3 -EVP_MD_meth_new.3,EVP_MD_meth_free.3 -EVP_MD_meth_new.3,EVP_MD_meth_set_app_datasize.3 -EVP_MD_meth_new.3,EVP_MD_meth_set_cleanup.3 -EVP_MD_meth_new.3,EVP_MD_meth_set_copy.3 -EVP_MD_meth_new.3,EVP_MD_meth_set_ctrl.3 -EVP_MD_meth_new.3,EVP_MD_meth_set_final.3 -EVP_MD_meth_new.3,EVP_MD_meth_set_flags.3 -EVP_MD_meth_new.3,EVP_MD_meth_set_init.3 -EVP_MD_meth_new.3,EVP_MD_meth_set_input_blocksize.3 -EVP_MD_meth_new.3,EVP_MD_meth_set_result_size.3 -EVP_MD_meth_new.3,EVP_MD_meth_set_update.3 EVP_MD_nid.3,EVP_MD_CTX_block_size.3 EVP_MD_nid.3,EVP_MD_CTX_size.3 EVP_MD_nid.3,EVP_MD_CTX_type.3 @@ -1087,7 +1073,6 @@ EVP_PKEY_set1_RSA.3,EVP_PKEY_assign.3 EVP_PKEY_set1_RSA.3,EVP_PKEY_assign_DH.3 EVP_PKEY_set1_RSA.3,EVP_PKEY_assign_DSA.3 EVP_PKEY_set1_RSA.3,EVP_PKEY_assign_EC_KEY.3 -EVP_PKEY_set1_RSA.3,EVP_PKEY_assign_GOST.3 EVP_PKEY_set1_RSA.3,EVP_PKEY_assign_RSA.3 EVP_PKEY_set1_RSA.3,EVP_PKEY_base_id.3 EVP_PKEY_set1_RSA.3,EVP_PKEY_get0.3 @@ -2048,10 +2033,6 @@ X509_CINF_new.3,X509_CERT_AUX_new.3 X509_CINF_new.3,X509_CINF_free.3 X509_CINF_new.3,X509_VAL_free.3 X509_CINF_new.3,X509_VAL_new.3 -X509_CRL_METHOD_new.3,X509_CRL_METHOD_free.3 -X509_CRL_METHOD_new.3,X509_CRL_get_meth_data.3 -X509_CRL_METHOD_new.3,X509_CRL_set_default_method.3 -X509_CRL_METHOD_new.3,X509_CRL_set_meth_data.3 X509_CRL_get0_by_serial.3,X509_CRL_add0_revoked.3 X509_CRL_get0_by_serial.3,X509_CRL_get0_by_cert.3 X509_CRL_get0_by_serial.3,X509_CRL_get_REVOKED.3 From c7d8355a01e3a3ef56bd650176d3ef6370faf74e Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 7 Mar 2024 10:35:45 -0600 Subject: [PATCH 0626/1283] put compat getpagesize into the right object list Was getting this linker error building shared libraries on Windows: Creating library C:/projects/portable/build/ssl/Release/ssl.lib and object C:/projects/portable/build/ssl/Release/ssl.exp recallocarray.obj : error LNK2019: unresolved external symbol getpagesize referenced in function getpagesize should be in compat rather than crypto object file list. --- crypto/CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index c61473506e..c431df1069 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -734,7 +734,7 @@ if(NOT HAVE_GETOPT) endif() if(NOT HAVE_GETPAGESIZE) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/getpagesize.c) + set(COMPAT_SRC ${COMPAT_SRC} compat/getpagesize.c) endif() if(NOT HAVE_GETPROGNAME) From 530084a5f641eb290fdb9bd663d810bcaecb0f48 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 7 Mar 2024 21:02:11 -0600 Subject: [PATCH 0627/1283] move syslog_r and getprogname into compat src list --- crypto/CMakeLists.txt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index c431df1069..f371d84581 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -739,11 +739,11 @@ endif() if(NOT HAVE_GETPROGNAME) if(WIN32) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/getprogname_windows.c) + set(COMPAT_SRC ${COMPAT_SRC} compat/getprogname_windows.c) elseif(CMAKE_SYSTEM_NAME MATCHES "Linux") - set(CRYPTO_SRC ${CRYPTO_SRC} compat/getprogname_linux.c) + set(COMPAT_SRC ${COMPAT_SRC} compat/getprogname_linux.c) else() - set(CRYPTO_SRC ${CRYPTO_SRC} compat/getprogname_unimpl.c) + set(COMPAT_SRC ${COMPAT_SRC} compat/getprogname_unimpl.c) endif() endif() @@ -783,7 +783,7 @@ if(NOT HAVE_STRTONUM) endif() if(NOT HAVE_SYSLOG_R) - set(CRYPTO_SRC ${CRYPTO_SRC} compat/syslog_r.c) + set(COMPAT_SRC ${COMPAT_SRC} compat/syslog_r.c) endif() if(NOT HAVE_TIMEGM) From 69449e791b5e99408a686fa68c2e5745a950162f Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 8 Mar 2024 00:53:26 -0600 Subject: [PATCH 0628/1283] changelog updates --- ChangeLog | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 837fb8595d..e892b0fdf4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -35,9 +35,9 @@ LibreSSL Portable Release Notes: - Most compatibility symbols are prefixed with libressl_ to avoid symbol clashes in static links. - Fixed various warnings on Windows. - - Disabled assert pop-ups with debug builds on Windows. - - Fixed asserts and hangs in Windows ARM64 builds. - - Fixed issues building where CET is not supported. + - Removed assert pop-ups with Windows debug builds. + - Fixed crashes and hangs in Windows ARM64 builds. + - Improved control-flow enforcement (CET) support. * Internal improvements - Converted uses of OBJ_bsearch_() to standard bsearch(). - Greatly simplified by_file_ctrl(). @@ -104,6 +104,13 @@ LibreSSL Portable Release Notes: - Fixed the new X.509 verifier to find trust anchors in the trusted stack. +3.8.3 - Stable release + + * Portable changes + - Removed assert pop-ups with Windows debug builds. + - Fixed crashes and hangs in Windows ARM64 builds. + - Improved control-flow enforcement (CET) support. + 3.8.2 - Stable release * Portable changes From 6664303ae2d0407d06b77a21b26d6ae08b7535f1 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Mon, 11 Mar 2024 15:31:14 +0000 Subject: [PATCH 0629/1283] cmake: disable default NDEBUG differently Before this patch `NDEBUG` was force-disabled, preventing a build with debug asserts disabled. After this patch `NDEBUG` works again when passed as a custom build option, e.g.: `-DCMAKE_C_FLAGS=-DNDEBUG` Previously submitted as #988, which was merged, but the commit vanished from master and ended up missing from both 3.8.3 and 3.9.0 releases. --- CMakeLists.txt | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index dc1458332d..01a42fb7b6 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -62,8 +62,13 @@ if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES) STRINGS "Debug" "Release" "MinSizeRel" "RelWithDebInfo") endif() -# Enable asserts regardless of build type -add_definitions(-UNDEBUG) +# Do not disable assertions based on CMAKE_BUILD_TYPE +foreach(_build_type "Release" "MinSizeRel" "RelWithDebInfo") + foreach(_lang C CXX) + string(TOUPPER "CMAKE_${_lang}_FLAGS_${_build_type}" _var) + string(REGEX REPLACE "(^| )[/-]D *NDEBUG($| )" " " ${_var} "${${_var}}") + endforeach() +endforeach() set(BUILD_NC true) From cb2fd0abb21fc2ed4a725de0c57df25e10eee7e8 Mon Sep 17 00:00:00 2001 From: Ilia Shipitsin Date: Sun, 17 Mar 2024 20:00:26 +0100 Subject: [PATCH 0630/1283] CI: setup kernel entropy to work with asan --- .github/workflows/linux.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 180f43cb13..af76b5dece 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -57,6 +57,15 @@ jobs: - name: "Checkout repository" uses: actions/checkout@v4 +# +# temporary hack +# should be revisited after https://github.com/actions/runner-images/issues/9491 is resolved +# + + - name: Setup entropy + run: | + sudo sysctl vm.mmap_rnd_bits=28 + - name: "Run tests" run: ./scripts/test env: From 0dfd83e89993f39ca6cafed62d13399b937ed983 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Mon, 18 Mar 2024 15:51:43 +0900 Subject: [PATCH 0631/1283] Add tests/bio_dump* and tests/x509_algor* to gitignore --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index 89962ea038..6f00d6fe04 100644 --- a/.gitignore +++ b/.gitignore @@ -78,6 +78,7 @@ tests/asn1time* tests/asn1x509* tests/bio_asn1* tests/bio_chain* +tests/bio_dump* tests/bio_host* tests/bio_mem* tests/bnaddsub* @@ -133,6 +134,7 @@ tests/testssl tests/*.txt tests/compat/*.c tests/verify* +tests/x509_algor* tests/x509_asn1* tests/x509_info* tests/x509attribute* From 0b611062d4aa50c070d25261bff531fb76b7acad Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Mon, 18 Mar 2024 16:54:53 +0900 Subject: [PATCH 0632/1283] Add macos-14 test --- .github/workflows/macos.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index e1395d1c8c..6bd3f437fc 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -21,7 +21,7 @@ jobs: strategy: fail-fast: false matrix: - os: ["macos-13", "macos-12", "macos-11"] + os: ["macos-14", "macos-13", "macos-12", "macos-11"] arch: ["arm64", "x86_64"] steps: - name: "Install required packages" From 4882cf9ed4bbf03e197eb23a78cdfc24a19ff241 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Mon, 18 Mar 2024 17:44:48 +0900 Subject: [PATCH 0633/1283] Add libtool --- .github/workflows/macos.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index 6bd3f437fc..d4b4123dc4 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -25,7 +25,7 @@ jobs: arch: ["arm64", "x86_64"] steps: - name: "Install required packages" - run: brew install automake + run: brew install automake libtool - name: "Checkout repository" uses: actions/checkout@v4 From 3515c2fb5566d832cb30858cb466f1a366237142 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Tue, 19 Mar 2024 09:29:50 +0900 Subject: [PATCH 0634/1283] Drop macos-11 from test --- .github/workflows/macos.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index d4b4123dc4..f570f19d75 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -21,7 +21,7 @@ jobs: strategy: fail-fast: false matrix: - os: ["macos-14", "macos-13", "macos-12", "macos-11"] + os: ["macos-14", "macos-13", "macos-12"] arch: ["arm64", "x86_64"] steps: - name: "Install required packages" From 9b9122950f4240c9637301850947116f09b86b34 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 19 Mar 2024 13:36:02 -0600 Subject: [PATCH 0635/1283] rm o_init.c --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index f371d84581..110a673ae1 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -252,7 +252,6 @@ set( mem_clr.c mem_dbg.c o_fips.c - o_init.c o_str.c aes/aes_cfb.c aes/aes_ctr.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index d6fb3d0f0e..49dcaae16e 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -225,7 +225,6 @@ libcrypto_la_SOURCES += malloc-wrapper.c libcrypto_la_SOURCES += mem_clr.c libcrypto_la_SOURCES += mem_dbg.c libcrypto_la_SOURCES += o_fips.c -libcrypto_la_SOURCES += o_init.c libcrypto_la_SOURCES += o_str.c noinst_HEADERS += arm_arch.h noinst_HEADERS += constant_time.h From 55f21a399f56695990d5495384146b55a5e56823 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 19 Mar 2024 14:32:44 -0600 Subject: [PATCH 0636/1283] Update man links --- man/links | 3 --- 1 file changed, 3 deletions(-) diff --git a/man/links b/man/links index b91d877ac7..3475e43a59 100644 --- a/man/links +++ b/man/links @@ -1332,10 +1332,8 @@ OPENSSL_init_crypto.3,OPENSSL_init.3 OPENSSL_load_builtin_modules.3,ASN1_add_oid_module.3 OPENSSL_malloc.3,CRYPTO_free.3 OPENSSL_malloc.3,CRYPTO_malloc.3 -OPENSSL_malloc.3,CRYPTO_realloc.3 OPENSSL_malloc.3,CRYPTO_strdup.3 OPENSSL_malloc.3,OPENSSL_free.3 -OPENSSL_malloc.3,OPENSSL_realloc.3 OPENSSL_malloc.3,OPENSSL_strdup.3 OPENSSL_sk_new.3,sk_delete.3 OPENSSL_sk_new.3,sk_delete_ptr.3 @@ -2017,7 +2015,6 @@ X509_ALGOR_dup.3,X509_ALGOR_free.3 X509_ALGOR_dup.3,X509_ALGOR_get0.3 X509_ALGOR_dup.3,X509_ALGOR_new.3 X509_ALGOR_dup.3,X509_ALGOR_set0.3 -X509_ALGOR_dup.3,X509_ALGOR_set_md.3 X509_ATTRIBUTE_get0_object.3,X509_ATTRIBUTE_count.3 X509_ATTRIBUTE_get0_object.3,X509_ATTRIBUTE_get0_data.3 X509_ATTRIBUTE_get0_object.3,X509_ATTRIBUTE_get0_type.3 From 24bb326b72218486fbae858bbbf4f4eb1039caeb Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Wed, 20 Mar 2024 17:52:50 +0000 Subject: [PATCH 0637/1283] update.sh: use shallow clone to spare time/bandwidth --- update.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/update.sh b/update.sh index 95d852cfab..21a3682e65 100755 --- a/update.sh +++ b/update.sh @@ -7,9 +7,9 @@ openbsd_branch=`cat OPENBSD_BRANCH` echo "pulling upstream openbsd source" if [ ! -d openbsd ]; then if [ -z "$LIBRESSL_GIT" ]; then - git clone https://github.com/libressl/openbsd.git + git clone --depth=8 https://github.com/libressl/openbsd.git else - git clone $LIBRESSL_GIT/openbsd + git clone --depth=8 $LIBRESSL_GIT/openbsd fi fi From 86e4965d7f20c3a6afc41d95590c9f6abb4fe788 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 1 Apr 2026 19:26:44 -0600 Subject: [PATCH 0638/1283] Replace expiring certs with more modern versions Ref: #1018 --- tests/CMakeLists.txt | 6 +++--- tests/Makefile.am | 4 ++-- tests/dtlstest.sh | 2 +- tests/keypairtest.sh | 2 +- tests/quictest.bat | 2 +- tests/quictest.sh | 2 +- tests/servertest.bat | 2 +- tests/servertest.sh | 2 +- tests/shutdowntest.bat | 2 +- tests/shutdowntest.sh | 2 +- tests/tlstest.bat | 2 +- tests/tlstest.sh | 2 +- 12 files changed, 15 insertions(+), 15 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 714f331d6b..1a4f142286 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -452,9 +452,9 @@ add_executable(keypairtest keypairtest.c) target_link_libraries(keypairtest ${LIBTLS_TEST_LIBS}) target_include_directories(keypairtest BEFORE PUBLIC ../tls) add_test(keypairtest keypairtest - ${CMAKE_CURRENT_SOURCE_DIR}/ca.pem - ${CMAKE_CURRENT_SOURCE_DIR}/server.pem - ${CMAKE_CURRENT_SOURCE_DIR}/server.pem) + ${CMAKE_CURRENT_SOURCE_DIR}/ca-root-rsa.pem + ${CMAKE_CURRENT_SOURCE_DIR}/server1-rsa.pem + ${CMAKE_CURRENT_SOURCE_DIR}/server1-rsa.pem) # md_test add_executable(md_test md_test.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index e0e5a32e64..e79958c47e 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -693,12 +693,12 @@ ssltest_SOURCES = ssltest.c EXTRA_DIST += ssltest.sh ssltest.bat EXTRA_DIST += testssl testssl.bat EXTRA_DIST += ca-int-ecdsa.crl ca-int-ecdsa.pem ca-int-rsa.crl ca-int-rsa.pem -EXTRA_DIST += ca-root-ecdsa.pem ca-root-rsa.pem ca.pem client.pem +EXTRA_DIST += ca-root-ecdsa.pem ca-root-rsa.pem EXTRA_DIST += client1-ecdsa-chain.pem client1-ecdsa.pem client1-rsa-chain.pem EXTRA_DIST += client1-rsa.pem client2-ecdsa-chain.pem client2-ecdsa.pem EXTRA_DIST += client2-rsa-chain.pem client2-rsa.pem client3-ecdsa-chain.pem EXTRA_DIST += client3-ecdsa.pem client3-rsa-chain.pem client3-rsa.pem -EXTRA_DIST += server.pem server1-ecdsa-chain.pem server1-ecdsa.pem +EXTRA_DIST += server1-ecdsa-chain.pem server1-ecdsa.pem EXTRA_DIST += server1-rsa-chain.pem server1-rsa.pem server2-ecdsa-chain.pem EXTRA_DIST += server2-ecdsa.pem server2-rsa-chain.pem server2-rsa.pem EXTRA_DIST += server3-ecdsa-chain.pem server3-ecdsa.pem server3-rsa-chain.pem diff --git a/tests/dtlstest.sh b/tests/dtlstest.sh index ef18cfcb0f..8f9b229d92 100755 --- a/tests/dtlstest.sh +++ b/tests/dtlstest.sh @@ -10,4 +10,4 @@ if [ -z $srcdir ]; then srcdir=. fi -$dtlstest_bin $srcdir/server.pem $srcdir/server.pem $srcdir/ca.pem +$dtlstest_bin $srcdir/server1-rsa.pem $srcdir/server1-rsa.pem $srcdir/ca-int-rsa.pem diff --git a/tests/keypairtest.sh b/tests/keypairtest.sh index 3c24869b42..8bb7d9f6ae 100755 --- a/tests/keypairtest.sh +++ b/tests/keypairtest.sh @@ -9,4 +9,4 @@ if [ -z $srcdir ]; then srcdir=. fi -$TEST $srcdir/ca.pem $srcdir/server.pem $srcdir/server.pem +$TEST $srcdir/ca-root-rsa.pem $srcdir/server1-rsa.pem $srcdir/server1-rsa.pem diff --git a/tests/quictest.bat b/tests/quictest.bat index cfbf2cd80e..645fc2f2f1 100644 --- a/tests/quictest.bat +++ b/tests/quictest.bat @@ -6,7 +6,7 @@ set quictest_bin=%1 set quictest_bin=%quictest_bin:/=\% if not exist %quictest_bin% exit /b 1 -%quictest_bin% %srcdir%\server.pem %srcdir%\server.pem %srcdir%\ca.pem +%quictest_bin% %srcdir%\server1-rsa.pem %srcdir%\server1-rsa-chain.pem %srcdir%\ca-root-rsa.pem if !errorlevel! neq 0 ( exit /b 1 ) diff --git a/tests/quictest.sh b/tests/quictest.sh index cc1982f644..018417962a 100755 --- a/tests/quictest.sh +++ b/tests/quictest.sh @@ -10,4 +10,4 @@ if [ -z $srcdir ]; then srcdir=. fi -$quictest_bin $srcdir/server.pem $srcdir/server.pem $srcdir/ca.pem +$quictest_bin $srcdir/server1-rsa.pem $srcdir/server1-rsa-chain.pem $srcdir/ca-root-rsa.pem diff --git a/tests/servertest.bat b/tests/servertest.bat index 8c9bd97c40..c0bfaa4548 100644 --- a/tests/servertest.bat +++ b/tests/servertest.bat @@ -6,7 +6,7 @@ set servertest_bin=%1 set servertest_bin=%servertest_bin:/=\% if not exist %servertest_bin% exit /b 1 -%servertest_bin% %srcdir%\server.pem %srcdir%\server.pem %srcdir%\ca.pem +%servertest_bin% %srcdir%\server1-rsa.pem %srcdir%\server1-rsa-chain.pem %srcdir%\ca-root.pem if !errorlevel! neq 0 ( exit /b 1 ) diff --git a/tests/servertest.sh b/tests/servertest.sh index f1efeb0581..d6497bdc4b 100755 --- a/tests/servertest.sh +++ b/tests/servertest.sh @@ -10,4 +10,4 @@ if [ -z $srcdir ]; then srcdir=. fi -$servertest_bin $srcdir/server.pem $srcdir/server.pem $srcdir/ca.pem +$servertest_bin $srcdir/server1-rsa.pem $srcdir/server1-rsa-chain.pem $srcdir/ca-root-rsa.pem diff --git a/tests/shutdowntest.bat b/tests/shutdowntest.bat index 46db6e8e5b..f087dbb435 100644 --- a/tests/shutdowntest.bat +++ b/tests/shutdowntest.bat @@ -6,7 +6,7 @@ set shutdowntest_bin=%1 set shutdowntest_bin=%shutdowntest_bin:/=\% if not exist %shutdowntest_bin% exit /b 1 -%shutdowntest_bin% %srcdir%\server.pem %srcdir%\server.pem %srcdir%\ca.pem +%shutdowntest_bin% %srcdir%\server1-rsa.pem %srcdir%\server1-rsa-chain.pem %srcdir%\ca-root-rsa.pem if !errorlevel! neq 0 ( exit /b 1 ) diff --git a/tests/shutdowntest.sh b/tests/shutdowntest.sh index 22e2b1dae1..d4aec1c87a 100755 --- a/tests/shutdowntest.sh +++ b/tests/shutdowntest.sh @@ -10,4 +10,4 @@ if [ -z $srcdir ]; then srcdir=. fi -$shutdowntest_bin $srcdir/server.pem $srcdir/server.pem $srcdir/ca.pem +$shutdowntest_bin $srcdir/server1-rsa.pem $srcdir/server1-rsa-chain.pem $srcdir/ca-root-rsa.pem diff --git a/tests/tlstest.bat b/tests/tlstest.bat index 25664cf08a..5f5f6a6e13 100644 --- a/tests/tlstest.bat +++ b/tests/tlstest.bat @@ -6,7 +6,7 @@ set tlstest_bin=%1 set tlstest_bin=%tlstest_bin:/=\% if not exist %tlstest_bin% exit /b 1 -%tlstest_bin% %srcdir%\ca.pem %srcdir%\server.pem %srcdir%\server.pem +%tlstest_bin% %srcdir%\ca-root-rsa.pem %srcdir%\server1-rsa-chain.pem %srcdir%\server1-rsa.pem if !errorlevel! neq 0 ( exit /b 1 ) diff --git a/tests/tlstest.sh b/tests/tlstest.sh index 25f8647b7f..4024007bae 100755 --- a/tests/tlstest.sh +++ b/tests/tlstest.sh @@ -10,4 +10,4 @@ if [ -z $srcdir ]; then srcdir=. fi -$tlstest_bin $srcdir/ca.pem $srcdir/server.pem $srcdir/server.pem +$tlstest_bin $srcdir/ca-root-rsa.pem $srcdir/server1-rsa-chain.pem $srcdir/server1-rsa.pem From 73787b1824c12c5aa73c875b6321b0a0e7f885be Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Thu, 21 Mar 2024 19:05:27 +0900 Subject: [PATCH 0639/1283] Run tests for macos-14 on arm64 macos-12 and macos-13 fails `make test` on arm64 but macos-14 does not. Hence this patch enables it on github action. --- .github/workflows/macos.yml | 1 + scripts/test | 8 ++++++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index f570f19d75..cd52d2c20b 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -34,3 +34,4 @@ jobs: run: ./scripts/test env: ARCH: "${{ matrix.arch }}" + OS: "${{ matrix.os }}" diff --git a/scripts/test b/scripts/test index 97e316e0b2..d093eab364 100755 --- a/scripts/test +++ b/scripts/test @@ -34,7 +34,9 @@ if [ `uname` = "Darwin" ]; then cd build-static cmake -DCMAKE_OSX_ARCHITECTURES=$ARCH .. make -j 4 - if [ "$ARCH" = "x86_64" ]; then + if [ "$ARCH" = "arm64" ] && [ "$OS" = "macos-12" ] || [ "$OS" = "macos-13" ]; then + echo "##### skip tests" + else make test fi ) @@ -44,7 +46,9 @@ if [ `uname` = "Darwin" ]; then cd build-shared cmake -DBUILD_SHARED_LIBS=ON -DCMAKE_OSX_ARCHITECTURES=$ARCH .. make -j 4 - if [ "$ARCH" = "x86_64" ]; then + if [ "$ARCH" = "arm64" ] && [ "$OS" = "macos-12" ] || [ "$OS" = "macos-13" ]; then + echo "##### skip tests" + else make test fi ) From 51e6f0ec5a9e3c68ec610d47d6a915b61e8f6a85 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Fri, 22 Mar 2024 09:24:49 +0900 Subject: [PATCH 0640/1283] Split the jobs into two files, macOS and macOS-legacy. --- .github/workflows/macos-legacy.yml | 37 ++++++++++++++++++++++++++++++ .github/workflows/macos.yml | 2 +- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/macos-legacy.yml diff --git a/.github/workflows/macos-legacy.yml b/.github/workflows/macos-legacy.yml new file mode 100644 index 0000000000..f2634235b4 --- /dev/null +++ b/.github/workflows/macos-legacy.yml @@ -0,0 +1,37 @@ +# GitHub Actions workflow to run tests on macOS. +name: "macOS-legacy" + +on: + push: {} + pull_request: {} + schedule: + - cron: "0 0 * * 0" # At 00:00 weekly on Sunday. + +concurrency: + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: true + +jobs: + test: + name: "${{ matrix.os }}/${{ matrix.arch }}" + runs-on: "${{ matrix.os }}" + if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} + permissions: + contents: read + strategy: + fail-fast: false + matrix: + os: ["macos-13", "macos-12"] + arch: ["arm64", "x86_64"] + steps: + - name: "Install required packages" + run: brew install automake + + - name: "Checkout repository" + uses: actions/checkout@v4 + + - name: "Run tests" + run: ./scripts/test + env: + ARCH: "${{ matrix.arch }}" + OS: "${{ matrix.os }}" diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index cd52d2c20b..7874521c57 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -21,7 +21,7 @@ jobs: strategy: fail-fast: false matrix: - os: ["macos-14", "macos-13", "macos-12"] + os: ["macos-14"] arch: ["arm64", "x86_64"] steps: - name: "Install required packages" From 9646391f9212ee35c60882d6173a86a685ac9bd3 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Fri, 22 Mar 2024 08:44:46 +0000 Subject: [PATCH 0641/1283] update.sh: add LIBRESSL_GIT_OPTIONS --- update.sh | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/update.sh b/update.sh index 21a3682e65..c154ad7cf0 100755 --- a/update.sh +++ b/update.sh @@ -6,11 +6,9 @@ openbsd_branch=`cat OPENBSD_BRANCH` # pull in latest upstream code echo "pulling upstream openbsd source" if [ ! -d openbsd ]; then - if [ -z "$LIBRESSL_GIT" ]; then - git clone --depth=8 https://github.com/libressl/openbsd.git - else - git clone --depth=8 $LIBRESSL_GIT/openbsd - fi + LIBRESSL_GIT_OPTIONS="${LIBRESSL_GIT_OPTIONS:- --depth=8}" + LIBRESSL_GIT="${LIBRESSL_GIT:- https://github.com/libressl}" + git clone $LIBRESSL_GIT_OPTIONS $LIBRESSL_GIT/openbsd fi # pull either the latest or if on a tag, the matching tag From bbcc775c199bc11a9e47b8f8381a0cd27c88b974 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 23 Mar 2024 02:04:00 +1000 Subject: [PATCH 0642/1283] Revert "CI: setup kernel entropy to work with asan" This reverts commit cb2fd0abb21fc2ed4a725de0c57df25e10eee7e8 from #1019. --- .github/workflows/linux.yml | 9 --------- 1 file changed, 9 deletions(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index af76b5dece..180f43cb13 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -57,15 +57,6 @@ jobs: - name: "Checkout repository" uses: actions/checkout@v4 -# -# temporary hack -# should be revisited after https://github.com/actions/runner-images/issues/9491 is resolved -# - - - name: Setup entropy - run: | - sudo sysctl vm.mmap_rnd_bits=28 - - name: "Run tests" run: ./scripts/test env: From b76bc318e6c109efe8083320da18282ec8e0828e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 20 Mar 2024 23:15:38 -0600 Subject: [PATCH 0643/1283] Initial 4.0.0 changelog --- ChangeLog | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index e892b0fdf4..4be4a278d3 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,7 +28,21 @@ history is also available from Git. LibreSSL Portable Release Notes: -3.9.0 - In development +4.0.0 - In development + + * Portable changes + * Internal improvements + - Cleaned up parts of the conf directory. Simplified some logic, + fixed memory leaks. + * Documentation improvements + - Removed documentation of no longer existing API. + * Testing and proactive security + - Switched the remaining tests to new certs. + * Compatibility changes + * Bug fixes + - Fixed signed integer overflow in bnrand(). + +3.9.0 - Development release * Portable changes - libcrypto no longer exports compat symbols in cmake builds. From d481bacadbe99d4b551600fe6ece20667638b4c6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 25 Mar 2024 00:04:32 -0600 Subject: [PATCH 0644/1283] Update ChangeLog --- ChangeLog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ChangeLog b/ChangeLog index 4be4a278d3..6d13119d10 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,6 +34,12 @@ LibreSSL Portable Release Notes: * Internal improvements - Cleaned up parts of the conf directory. Simplified some logic, fixed memory leaks. + - Simplified X509_check_trust() internals to be somewhat readable. + - Removed last internal uses of gmtime() and timegm() and replaced + them with BoringSSL's posix time conversion API. + - Removed unnecessary stat calls in by_dir. + - Split parsing and processing of TLS extensions to ensure that + extension callbacks are called in a predefined order. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security From adc4d4332cb33a8630b9c6aa2d58c14a6b45c86d Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Mon, 25 Mar 2024 15:51:24 +0900 Subject: [PATCH 0645/1283] Revert "Split the jobs into two files, macOS and macOS-legacy." This reverts commit 51e6f0ec5a9e3c68ec610d47d6a915b61e8f6a85. --- .github/workflows/macos-legacy.yml | 37 ------------------------------ .github/workflows/macos.yml | 2 +- 2 files changed, 1 insertion(+), 38 deletions(-) delete mode 100644 .github/workflows/macos-legacy.yml diff --git a/.github/workflows/macos-legacy.yml b/.github/workflows/macos-legacy.yml deleted file mode 100644 index f2634235b4..0000000000 --- a/.github/workflows/macos-legacy.yml +++ /dev/null @@ -1,37 +0,0 @@ -# GitHub Actions workflow to run tests on macOS. -name: "macOS-legacy" - -on: - push: {} - pull_request: {} - schedule: - - cron: "0 0 * * 0" # At 00:00 weekly on Sunday. - -concurrency: - group: "${{ github.workflow }}-${{ github.ref }}" - cancel-in-progress: true - -jobs: - test: - name: "${{ matrix.os }}/${{ matrix.arch }}" - runs-on: "${{ matrix.os }}" - if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} - permissions: - contents: read - strategy: - fail-fast: false - matrix: - os: ["macos-13", "macos-12"] - arch: ["arm64", "x86_64"] - steps: - - name: "Install required packages" - run: brew install automake - - - name: "Checkout repository" - uses: actions/checkout@v4 - - - name: "Run tests" - run: ./scripts/test - env: - ARCH: "${{ matrix.arch }}" - OS: "${{ matrix.os }}" diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index 7874521c57..cd52d2c20b 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -21,7 +21,7 @@ jobs: strategy: fail-fast: false matrix: - os: ["macos-14"] + os: ["macos-14", "macos-13", "macos-12"] arch: ["arm64", "x86_64"] steps: - name: "Install required packages" From f7a0f40d52b994d0bca0eacd88b39f71e447c5d9 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Mon, 25 Mar 2024 22:14:22 +0100 Subject: [PATCH 0646/1283] Add libssl and libcrypto to libtls's Libs.private Since d193f43 ("slim down `libtls`"), statically linking libtls requires also linking libssl and libcrypto, so express that in the pkg-config file. --- libtls.pc.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libtls.pc.in b/libtls.pc.in index d1769299ad..3c49391ab0 100644 --- a/libtls.pc.in +++ b/libtls.pc.in @@ -9,5 +9,5 @@ Name: LibreSSL-libtls Description: Secure communications using the TLS socket protocol. Version: @VERSION@ Libs: -L${libdir} -ltls -Libs.private: @LIBS@ @PLATFORM_LDADD@ +Libs.private: @LIBS@ @PLATFORM_LDADD@ -lssl -lcrypto Cflags: -I${includedir} From 8cddaf034550bfea6e7d9ec57af1af822eb33053 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Tue, 26 Mar 2024 00:38:32 +0000 Subject: [PATCH 0647/1283] mingw: re-enable endbr opcode, add workaround for clang `cet.h` issue - https://github.com/libressl/openbsd/pull/149 fixes to crash on startup issue, thus nuking all endbr opcodes is no longer necessary. This effectively enables CET in ASM code for MinGW x86_64 builds. - llvm `cet.h` (as of v18) assigns `endbr32` instead of `endbr64` to `_CET_ENDBR` macro for MinGW x86_64 targets. https://github.com/llvm/llvm-project/blob/llvmorg-18.1.1/clang/lib/Headers/cet.h#L15-L35 Work this around by mapping `endbr32` to `endbr64`. Prerequisite: https://github.com/libressl/openbsd/pull/149 Fixes: https://github.com/libressl/portable/issues/1015 --- crypto/CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 110a673ae1..87fb2d8dce 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -193,7 +193,7 @@ if(HOST_ASM_MINGW64_X86_64) whrlpool/wp-mingw64-x86_64.S cpuid-mingw64-x86_64.S ) - add_definitions(-Dendbr64=) + add_definitions(-Dendbr32=endbr64) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) add_definitions(-DVPAES_ASM) From 49d4d3fbb3814c79a512643c1267566aa8f9cec7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 26 Mar 2024 15:22:40 +1100 Subject: [PATCH 0648/1283] Temporarily disable the clienttest --- tests/CMakeLists.txt | 8 ++++---- tests/Makefile.am | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 1a4f142286..9038ab4e68 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -268,10 +268,10 @@ add_executable(cipherstest cipherstest.c) target_link_libraries(cipherstest ${OPENSSL_TEST_LIBS}) add_test(cipherstest cipherstest) -# clienttest -add_executable(clienttest clienttest.c) -target_link_libraries(clienttest ${OPENSSL_TEST_LIBS}) -add_test(clienttest clienttest) +## clienttest +#add_executable(clienttest clienttest.c) +#target_link_libraries(clienttest ${OPENSSL_TEST_LIBS}) +#add_test(clienttest clienttest) # cmstest add_executable(cmstest cmstest.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index e79958c47e..e4c0af6150 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -283,10 +283,10 @@ TESTS += cipherstest check_PROGRAMS += cipherstest cipherstest_SOURCES = cipherstest.c -# clienttest -TESTS += clienttest -check_PROGRAMS += clienttest -clienttest_SOURCES = clienttest.c +## clienttest +#TESTS += clienttest +#check_PROGRAMS += clienttest +#clienttest_SOURCES = clienttest.c # cmstest TESTS += cmstest From 6b55fd7f4cb7b36d0691739650bb9a8e3e8398f9 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Tue, 26 Mar 2024 07:13:18 +0000 Subject: [PATCH 0649/1283] also for autotools --- crypto/Makefile.am.mingw64-x86_64 | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index 5a277c5900..12f41a5460 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -21,6 +21,7 @@ ASM_X86_64_MINGW64 += cpuid-mingw64-x86_64.S EXTRA_DIST += $(ASM_X86_64_MINGW64) if HOST_ASM_MINGW64_X86_64 +libcrypto_la_CPPFLAGS += -Dendbr32=endbr64 libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM libcrypto_la_CPPFLAGS += -DVPAES_ASM From aa0df244d2e1184cb1f09360187269f7a66351ac Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 27 Mar 2024 00:12:17 -0600 Subject: [PATCH 0650/1283] Add hidden engine.h --- crypto/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 49dcaae16e..9da71d0ca7 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -661,6 +661,7 @@ noinst_HEADERS += hidden/openssl/curve25519.h noinst_HEADERS += hidden/openssl/dh.h noinst_HEADERS += hidden/openssl/dsa.h noinst_HEADERS += hidden/openssl/ec.h +noinst_HEADERS += hidden/openssl/engine.h noinst_HEADERS += hidden/openssl/err.h noinst_HEADERS += hidden/openssl/hkdf.h noinst_HEADERS += hidden/openssl/hmac.h From 0d3e173e2614a95d1a81d1e62bfbbd8a20abfb23 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 27 Mar 2024 05:15:03 -0600 Subject: [PATCH 0651/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 6d13119d10..ac46a543ee 100644 --- a/ChangeLog +++ b/ChangeLog @@ -40,6 +40,7 @@ LibreSSL Portable Release Notes: - Removed unnecessary stat calls in by_dir. - Split parsing and processing of TLS extensions to ensure that extension callbacks are called in a predefined order. + - Cleaned up the MD4 and MD5 implementations. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security From 78a45a8ae0d31d0d02612f23142db40a19686585 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 27 Mar 2024 05:32:12 -0600 Subject: [PATCH 0652/1283] Blowfish was simplified --- crypto/CMakeLists.txt | 6 +----- crypto/Makefile.am | 6 +----- 2 files changed, 2 insertions(+), 10 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 110a673ae1..4f0eb888f0 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -319,11 +319,7 @@ set( asn1/x_val.c asn1/x_x509.c asn1/x_x509a.c - bf/bf_cfb64.c - bf/bf_ecb.c - bf/bf_enc.c - bf/bf_ofb64.c - bf/bf_skey.c + bf/blowfish.c bio/b_dump.c bio/b_print.c bio/b_sock.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 9da71d0ca7..dc5039254e 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -308,11 +308,7 @@ noinst_HEADERS += asn1/asn1_local.h noinst_HEADERS += asn1/charmap.h # bf -libcrypto_la_SOURCES += bf/bf_cfb64.c -libcrypto_la_SOURCES += bf/bf_ecb.c -libcrypto_la_SOURCES += bf/bf_enc.c -libcrypto_la_SOURCES += bf/bf_ofb64.c -libcrypto_la_SOURCES += bf/bf_skey.c +libcrypto_la_SOURCES += bf/blowfish.c noinst_HEADERS += bf/bf_local.h # bio From 72f00343f2f1d8a442a1de02bde062186d84f4e6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 27 Mar 2024 16:33:48 -0600 Subject: [PATCH 0653/1283] Drop some no longer existing files --- crypto/CMakeLists.txt | 10 +--------- crypto/Makefile.am | 6 +----- 2 files changed, 2 insertions(+), 14 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 4f0eb888f0..c7c8876045 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -30,7 +30,6 @@ if(HOST_ASM_ELF_X86_64) aes/bsaes-elf-x86_64.S aes/vpaes-elf-x86_64.S aes/aesni-elf-x86_64.S - aes/aesni-sha1-elf-x86_64.S bn/modexp512-elf-x86_64.S bn/mont-elf-x86_64.S bn/mont5-elf-x86_64.S @@ -83,7 +82,6 @@ if(HOST_ASM_MACOSX_X86_64) aes/bsaes-macosx-x86_64.S aes/vpaes-macosx-x86_64.S aes/aesni-macosx-x86_64.S - aes/aesni-sha1-macosx-x86_64.S bn/modexp512-macosx-x86_64.S bn/mont-macosx-x86_64.S bn/mont5-macosx-x86_64.S @@ -91,7 +89,6 @@ if(HOST_ASM_MACOSX_X86_64) md5/md5-macosx-x86_64.S modes/ghash-macosx-x86_64.S rc4/rc4-macosx-x86_64.S - rc4/rc4-md5-macosx-x86_64.S sha/sha1-macosx-x86_64.S sha/sha256-macosx-x86_64.S sha/sha512-macosx-x86_64.S @@ -137,7 +134,6 @@ if(HOST_ASM_MASM_X86_64) aes/bsaes-masm-x86_64.S aes/vpaes-masm-x86_64.S aes/aesni-masm-x86_64.S - aes/aesni-sha1-masm-x86_64.S #bn/modexp512-masm-x86_64.S #bn/mont-masm-x86_64.S #bn/mont5-masm-x86_64.S @@ -145,7 +141,6 @@ if(HOST_ASM_MASM_X86_64) md5/md5-masm-x86_64.S modes/ghash-masm-x86_64.S rc4/rc4-masm-x86_64.S - rc4/rc4-md5-masm-x86_64.S sha/sha1-masm-x86_64.S sha/sha256-masm-x86_64.S sha/sha512-masm-x86_64.S @@ -178,7 +173,6 @@ if(HOST_ASM_MINGW64_X86_64) aes/bsaes-mingw64-x86_64.S aes/vpaes-mingw64-x86_64.S aes/aesni-mingw64-x86_64.S - aes/aesni-sha1-mingw64-x86_64.S #bn/modexp512-mingw64-x86_64.S #bn/mont-mingw64-x86_64.S #bn/mont5-mingw64-x86_64.S @@ -186,7 +180,6 @@ if(HOST_ASM_MINGW64_X86_64) md5/md5-mingw64-x86_64.S modes/ghash-mingw64-x86_64.S rc4/rc4-mingw64-x86_64.S - rc4/rc4-md5-mingw64-x86_64.S sha/sha1-mingw64-x86_64.S sha/sha256-mingw64-x86_64.S sha/sha512-mingw64-x86_64.S @@ -234,8 +227,7 @@ if((NOT HOST_ASM_ELF_X86_64) AND aes/aes_cbc.c camellia/camellia.c camellia/cmll_cbc.c - rc4/rc4_enc.c - rc4/rc4_skey.c + rc4/rc4.c whrlpool/wp_block.c ) endif() diff --git a/crypto/Makefile.am b/crypto/Makefile.am index dc5039254e..97c5ebd52f 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -200,8 +200,7 @@ libcrypto_la_SOURCES += aes/aes_cbc.c libcrypto_la_SOURCES += aes/aes_core.c libcrypto_la_SOURCES += camellia/camellia.c libcrypto_la_SOURCES += camellia/cmll_cbc.c -libcrypto_la_SOURCES += rc4/rc4_enc.c -libcrypto_la_SOURCES += rc4/rc4_skey.c +libcrypto_la_SOURCES += rc4/rc4.c libcrypto_la_SOURCES += whrlpool/wp_block.c endif endif @@ -804,9 +803,6 @@ libcrypto_la_SOURCES += rc2/rc2cfb64.c libcrypto_la_SOURCES += rc2/rc2ofb64.c noinst_HEADERS += rc2/rc2_local.h -# rc4 -noinst_HEADERS += rc4/rc4_local.h - # ripemd libcrypto_la_SOURCES += ripemd/ripemd.c From 7f652d45cb7967df2f146d4973fc4251263cd0d9 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 27 Mar 2024 16:54:42 -0600 Subject: [PATCH 0654/1283] More garbage was hiding here --- update.sh | 2 -- 1 file changed, 2 deletions(-) diff --git a/update.sh b/update.sh index c154ad7cf0..2976ac493f 100755 --- a/update.sh +++ b/update.sh @@ -271,7 +271,6 @@ for abi in elf macosx masm mingw64; do gen_asm_stdout $abi aes/asm/vpaes-x86_64.pl aes/vpaes-$abi-x86_64.S gen_asm_stdout $abi aes/asm/bsaes-x86_64.pl aes/bsaes-$abi-x86_64.S gen_asm_stdout $abi aes/asm/aesni-x86_64.pl aes/aesni-$abi-x86_64.S - gen_asm_stdout $abi aes/asm/aesni-sha1-x86_64.pl aes/aesni-sha1-$abi-x86_64.S gen_asm_stdout $abi bn/asm/modexp512-x86_64.pl bn/modexp512-$abi-x86_64.S gen_asm_stdout $abi bn/asm/x86_64-mont.pl bn/mont-$abi-x86_64.S gen_asm_stdout $abi bn/asm/x86_64-mont5.pl bn/mont5-$abi-x86_64.S @@ -279,7 +278,6 @@ for abi in elf macosx masm mingw64; do gen_asm_stdout $abi md5/asm/md5-x86_64.pl md5/md5-$abi-x86_64.S gen_asm_stdout $abi modes/asm/ghash-x86_64.pl modes/ghash-$abi-x86_64.S gen_asm_stdout $abi rc4/asm/rc4-x86_64.pl rc4/rc4-$abi-x86_64.S - gen_asm_stdout $abi rc4/asm/rc4-md5-x86_64.pl rc4/rc4-md5-$abi-x86_64.S gen_asm_stdout $abi sha/asm/sha1-x86_64.pl sha/sha1-$abi-x86_64.S gen_asm $abi sha/asm/sha512-x86_64.pl sha/sha256-$abi-x86_64.S gen_asm $abi sha/asm/sha512-x86_64.pl sha/sha512-$abi-x86_64.S From 019665af6641adf8e28e3915cb1df044d42ffcd9 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 27 Mar 2024 17:00:00 -0600 Subject: [PATCH 0655/1283] More garbage --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am.elf-x86_64 | 2 -- 2 files changed, 3 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index c7c8876045..06e25e6f2e 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -37,7 +37,6 @@ if(HOST_ASM_ELF_X86_64) md5/md5-elf-x86_64.S modes/ghash-elf-x86_64.S rc4/rc4-elf-x86_64.S - rc4/rc4-md5-elf-x86_64.S sha/sha1-elf-x86_64.S sha/sha256-elf-x86_64.S sha/sha512-elf-x86_64.S diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index 88be1d5023..7a4d22cb71 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -3,7 +3,6 @@ ASM_X86_64_ELF = aes/aes-elf-x86_64.S ASM_X86_64_ELF += aes/bsaes-elf-x86_64.S ASM_X86_64_ELF += aes/vpaes-elf-x86_64.S ASM_X86_64_ELF += aes/aesni-elf-x86_64.S -ASM_X86_64_ELF += aes/aesni-sha1-elf-x86_64.S ASM_X86_64_ELF += bn/modexp512-elf-x86_64.S ASM_X86_64_ELF += bn/mont-elf-x86_64.S ASM_X86_64_ELF += bn/mont5-elf-x86_64.S @@ -11,7 +10,6 @@ ASM_X86_64_ELF += camellia/cmll-elf-x86_64.S ASM_X86_64_ELF += md5/md5-elf-x86_64.S ASM_X86_64_ELF += modes/ghash-elf-x86_64.S ASM_X86_64_ELF += rc4/rc4-elf-x86_64.S -ASM_X86_64_ELF += rc4/rc4-md5-elf-x86_64.S ASM_X86_64_ELF += sha/sha1-elf-x86_64.S ASM_X86_64_ELF += sha/sha256-elf-x86_64.S ASM_X86_64_ELF += sha/sha512-elf-x86_64.S From e31c38bb4c2f44c9730dd50a26e88b4d652fd6e5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 27 Mar 2024 17:05:08 -0600 Subject: [PATCH 0656/1283] More rc4 wants to go --- crypto/Makefile.am.elf-arm | 3 +-- crypto/Makefile.am.elf-mips | 3 +-- crypto/Makefile.am.elf-mips64 | 3 +-- 3 files changed, 3 insertions(+), 6 deletions(-) diff --git a/crypto/Makefile.am.elf-arm b/crypto/Makefile.am.elf-arm index 041c27c7a1..af869caac2 100644 --- a/crypto/Makefile.am.elf-arm +++ b/crypto/Makefile.am.elf-arm @@ -10,8 +10,7 @@ ASM_ARM_ELF += armcap.c ASM_ARM_ELF += aes/aes_cbc.c ASM_ARM_ELF += camellia/camellia.c ASM_ARM_ELF += camellia/cmll_cbc.c -ASM_ARM_ELF += rc4/rc4_enc.c -ASM_ARM_ELF += rc4/rc4_skey.c +ASM_ARM_ELF += rc4/rc4.c ASM_ARM_ELF += whrlpool/wp_block.c EXTRA_DIST += $(ASM_ARM_ELF) diff --git a/crypto/Makefile.am.elf-mips b/crypto/Makefile.am.elf-mips index 9c4a70f151..7e04da4600 100644 --- a/crypto/Makefile.am.elf-mips +++ b/crypto/Makefile.am.elf-mips @@ -8,8 +8,7 @@ ASM_MIPS_ELF += sha/sha256-mips.S ASM_MIPS_ELF += aes/aes_cbc.c ASM_MIPS_ELF += camellia/camellia.c ASM_MIPS_ELF += camellia/cmll_cbc.c -ASM_MIPS_ELF += rc4/rc4_enc.c -ASM_MIPS_ELF += rc4/rc4_skey.c +ASM_MIPS_ELF += rc4/rc4.c ASM_MIPS_ELF += whrlpool/wp_block.c EXTRA_DIST += $(ASM_MIPS_ELF) diff --git a/crypto/Makefile.am.elf-mips64 b/crypto/Makefile.am.elf-mips64 index c599fa8396..1526020000 100644 --- a/crypto/Makefile.am.elf-mips64 +++ b/crypto/Makefile.am.elf-mips64 @@ -8,8 +8,7 @@ ASM_MIPS64_ELF += sha/sha256-mips.S ASM_MIPS64_ELF += aes/aes_cbc.c ASM_MIPS64_ELF += camellia/camellia.c ASM_MIPS64_ELF += camellia/cmll_cbc.c -ASM_MIPS64_ELF += rc4/rc4_enc.c -ASM_MIPS64_ELF += rc4/rc4_skey.c +ASM_MIPS64_ELF += rc4/rc4.c ASM_MIPS64_ELF += whrlpool/wp_block.c EXTRA_DIST += $(ASM_MIPS64_ELF) From 8b4c82506a56697b36afeeddc4d1d90e8b8b071d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 27 Mar 2024 17:11:35 -0600 Subject: [PATCH 0657/1283] why is this such a mess --- crypto/Makefile.am.macosx-x86_64 | 2 -- crypto/Makefile.am.masm-x86_64 | 2 -- crypto/Makefile.am.mingw64-x86_64 | 2 -- 3 files changed, 6 deletions(-) diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index b9b89cf04b..ad1c39f1be 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -3,7 +3,6 @@ ASM_X86_64_MACOSX = aes/aes-macosx-x86_64.S ASM_X86_64_MACOSX += aes/bsaes-macosx-x86_64.S ASM_X86_64_MACOSX += aes/vpaes-macosx-x86_64.S ASM_X86_64_MACOSX += aes/aesni-macosx-x86_64.S -ASM_X86_64_MACOSX += aes/aesni-sha1-macosx-x86_64.S ASM_X86_64_MACOSX += bn/modexp512-macosx-x86_64.S ASM_X86_64_MACOSX += bn/mont-macosx-x86_64.S ASM_X86_64_MACOSX += bn/mont5-macosx-x86_64.S @@ -11,7 +10,6 @@ ASM_X86_64_MACOSX += camellia/cmll-macosx-x86_64.S ASM_X86_64_MACOSX += md5/md5-macosx-x86_64.S ASM_X86_64_MACOSX += modes/ghash-macosx-x86_64.S ASM_X86_64_MACOSX += rc4/rc4-macosx-x86_64.S -ASM_X86_64_MACOSX += rc4/rc4-md5-macosx-x86_64.S ASM_X86_64_MACOSX += sha/sha1-macosx-x86_64.S ASM_X86_64_MACOSX += sha/sha256-macosx-x86_64.S ASM_X86_64_MACOSX += sha/sha512-macosx-x86_64.S diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index b914cb6c2b..4feacbae9c 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -3,7 +3,6 @@ ASM_X86_64_MASM = aes/aes-masm-x86_64.S ASM_X86_64_MASM += aes/bsaes-masm-x86_64.S ASM_X86_64_MASM += aes/vpaes-masm-x86_64.S ASM_X86_64_MASM += aes/aesni-masm-x86_64.S -ASM_X86_64_MASM += aes/aesni-sha1-masm-x86_64.S ASM_X86_64_MASM += bn/modexp512-masm-x86_64.S ASM_X86_64_MASM += bn/mont-masm-x86_64.S ASM_X86_64_MASM += bn/mont5-masm-x86_64.S @@ -11,7 +10,6 @@ ASM_X86_64_MASM += camellia/cmll-masm-x86_64.S ASM_X86_64_MASM += md5/md5-masm-x86_64.S ASM_X86_64_MASM += modes/ghash-masm-x86_64.S ASM_X86_64_MASM += rc4/rc4-masm-x86_64.S -ASM_X86_64_MASM += rc4/rc4-md5-masm-x86_64.S ASM_X86_64_MASM += sha/sha1-masm-x86_64.S ASM_X86_64_MASM += sha/sha256-masm-x86_64.S ASM_X86_64_MASM += sha/sha512-masm-x86_64.S diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index 5a277c5900..8c430a11ee 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -3,7 +3,6 @@ ASM_X86_64_MINGW64 = aes/aes-mingw64-x86_64.S ASM_X86_64_MINGW64 += aes/bsaes-mingw64-x86_64.S ASM_X86_64_MINGW64 += aes/vpaes-mingw64-x86_64.S ASM_X86_64_MINGW64 += aes/aesni-mingw64-x86_64.S -ASM_X86_64_MINGW64 += aes/aesni-sha1-mingw64-x86_64.S #ASM_X86_64_MINGW64 += bn/modexp512-mingw64-x86_64.S #ASM_X86_64_MINGW64 += bn/mont-mingw64-x86_64.S #ASM_X86_64_MINGW64 += bn/mont5-mingw64-x86_64.S @@ -11,7 +10,6 @@ ASM_X86_64_MINGW64 += camellia/cmll-mingw64-x86_64.S ASM_X86_64_MINGW64 += md5/md5-mingw64-x86_64.S ASM_X86_64_MINGW64 += modes/ghash-mingw64-x86_64.S ASM_X86_64_MINGW64 += rc4/rc4-mingw64-x86_64.S -ASM_X86_64_MINGW64 += rc4/rc4-md5-mingw64-x86_64.S ASM_X86_64_MINGW64 += sha/sha1-mingw64-x86_64.S ASM_X86_64_MINGW64 += sha/sha256-mingw64-x86_64.S ASM_X86_64_MINGW64 += sha/sha512-mingw64-x86_64.S From addc4a1e9bca4aeafa1be00515c556fe53590fb1 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 27 Mar 2024 18:38:12 -0600 Subject: [PATCH 0658/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index ac46a543ee..ec82540d09 100644 --- a/ChangeLog +++ b/ChangeLog @@ -46,6 +46,7 @@ LibreSSL Portable Release Notes: * Testing and proactive security - Switched the remaining tests to new certs. * Compatibility changes + - Removed workaround for F5 middle boxes. * Bug fixes - Fixed signed integer overflow in bnrand(). From c4afef67c4f82bebc5d06276baea0d87c272f1b1 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 27 Mar 2024 18:57:01 -0600 Subject: [PATCH 0659/1283] Cope with aes consolidation --- crypto/CMakeLists.txt | 6 +----- crypto/Makefile.am | 6 +----- 2 files changed, 2 insertions(+), 10 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 06e25e6f2e..f7d0bfe022 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -244,12 +244,8 @@ set( mem_dbg.c o_fips.c o_str.c - aes/aes_cfb.c - aes/aes_ctr.c - aes/aes_ecb.c + aes/aes.c aes/aes_ige.c - aes/aes_ofb.c - aes/aes_wrap.c asn1/a_bitstr.c asn1/a_enum.c asn1/a_int.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 97c5ebd52f..c14c34dcd8 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -234,12 +234,8 @@ noinst_HEADERS += md32_common.h noinst_HEADERS += x86_arch.h # aes -libcrypto_la_SOURCES += aes/aes_cfb.c -libcrypto_la_SOURCES += aes/aes_ctr.c -libcrypto_la_SOURCES += aes/aes_ecb.c +libcrypto_la_SOURCES += aes/aes.c libcrypto_la_SOURCES += aes/aes_ige.c -libcrypto_la_SOURCES += aes/aes_ofb.c -libcrypto_la_SOURCES += aes/aes_wrap.c noinst_HEADERS += aes/aes_local.h # asn1 From ade8bb88919cd1c42018ee9cee1e77ba118518cf Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 27 Mar 2024 22:39:38 -0600 Subject: [PATCH 0660/1283] Rebase weird _WIN32 hack for BN --- patches/win32_amd64_bn_arch.h.patch | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/patches/win32_amd64_bn_arch.h.patch b/patches/win32_amd64_bn_arch.h.patch index ad7c89dfa1..b7926e3cb6 100644 --- a/patches/win32_amd64_bn_arch.h.patch +++ b/patches/win32_amd64_bn_arch.h.patch @@ -1,21 +1,26 @@ ---- crypto/bn/arch/amd64/bn_arch.h.orig 2023-02-27 04:43:12.257874699 -0600 -+++ crypto/bn/arch/amd64/bn_arch.h 2023-02-27 04:44:05.541873870 -0600 -@@ -20,6 +20,12 @@ +We should consider a OPENSSL_NO_BN_ASM if we can't figure +out how to fix BIGNUM on this OS + +--- crypto/bn/arch/amd64/bn_arch.h.orig Wed Mar 27 22:17:03 2024 ++++ crypto/bn/arch/amd64/bn_arch.h Wed Mar 27 22:17:31 2024 +@@ -20,8 +20,14 @@ #ifndef HEADER_BN_ARCH_H #define HEADER_BN_ARCH_H +#ifdef _WIN32 -+#ifndef OPENSSL_NO_ASM + #ifndef OPENSSL_NO_ASM +#define OPENSSL_NO_ASM +#endif +#else -+ - #ifndef OPENSSL_NO_ASM ++#ifndef OPENSSL_NO_ASM ++ #define HAVE_BN_ADD -@@ -85,6 +91,7 @@ - *out_r0 = r0; + #define HAVE_BN_ADD_WORDS + +@@ -104,6 +110,7 @@ bn_subw(BN_ULONG a, BN_ULONG b, BN_ULONG *out_borrow, } + #endif /* __GNUC__ */ +#endif /* _WIN32 */ From 785c2d27c57f365370588bbab71c72b36678621c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 28 Mar 2024 02:19:14 -0600 Subject: [PATCH 0661/1283] Add hiddens in rc4 --- crypto/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index c14c34dcd8..399a6a1b2e 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -670,6 +670,7 @@ noinst_HEADERS += hidden/openssl/poly1305.h noinst_HEADERS += hidden/openssl/posix_time.h noinst_HEADERS += hidden/openssl/rand.h noinst_HEADERS += hidden/openssl/rc2.h +noinst_HEADERS += hidden/openssl/rc4.h noinst_HEADERS += hidden/openssl/rsa.h noinst_HEADERS += hidden/openssl/sha.h noinst_HEADERS += hidden/openssl/sm3.h From 95b74a0b10ccd36e6462778cbf246a25dcf196c4 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 28 Mar 2024 04:59:12 -0600 Subject: [PATCH 0662/1283] Place rc4.c in a more sensible place Fixes #1036 and https://github.com/google/oss-fuzz/pull/11741 --- crypto/CMakeLists.txt | 2 +- crypto/Makefile.am | 4 +++- crypto/Makefile.am.elf-arm | 1 - crypto/Makefile.am.elf-mips | 1 - crypto/Makefile.am.elf-mips64 | 1 - 5 files changed, 4 insertions(+), 5 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index f7d0bfe022..47ab73317b 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -226,7 +226,6 @@ if((NOT HOST_ASM_ELF_X86_64) AND aes/aes_cbc.c camellia/camellia.c camellia/cmll_cbc.c - rc4/rc4.c whrlpool/wp_block.c ) endif() @@ -584,6 +583,7 @@ set( rc2/rc2_skey.c rc2/rc2cfb64.c rc2/rc2ofb64.c + rc4/rc4.c ripemd/ripemd.c rsa/rsa_ameth.c rsa/rsa_asn1.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 399a6a1b2e..a71d918c1a 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -200,7 +200,6 @@ libcrypto_la_SOURCES += aes/aes_cbc.c libcrypto_la_SOURCES += aes/aes_core.c libcrypto_la_SOURCES += camellia/camellia.c libcrypto_la_SOURCES += camellia/cmll_cbc.c -libcrypto_la_SOURCES += rc4/rc4.c libcrypto_la_SOURCES += whrlpool/wp_block.c endif endif @@ -800,6 +799,9 @@ libcrypto_la_SOURCES += rc2/rc2cfb64.c libcrypto_la_SOURCES += rc2/rc2ofb64.c noinst_HEADERS += rc2/rc2_local.h +# rc4 +libcrypto_la_SOURCES += rc4/rc4.c + # ripemd libcrypto_la_SOURCES += ripemd/ripemd.c diff --git a/crypto/Makefile.am.elf-arm b/crypto/Makefile.am.elf-arm index af869caac2..e24f87bd04 100644 --- a/crypto/Makefile.am.elf-arm +++ b/crypto/Makefile.am.elf-arm @@ -10,7 +10,6 @@ ASM_ARM_ELF += armcap.c ASM_ARM_ELF += aes/aes_cbc.c ASM_ARM_ELF += camellia/camellia.c ASM_ARM_ELF += camellia/cmll_cbc.c -ASM_ARM_ELF += rc4/rc4.c ASM_ARM_ELF += whrlpool/wp_block.c EXTRA_DIST += $(ASM_ARM_ELF) diff --git a/crypto/Makefile.am.elf-mips b/crypto/Makefile.am.elf-mips index 7e04da4600..34fda49db7 100644 --- a/crypto/Makefile.am.elf-mips +++ b/crypto/Makefile.am.elf-mips @@ -8,7 +8,6 @@ ASM_MIPS_ELF += sha/sha256-mips.S ASM_MIPS_ELF += aes/aes_cbc.c ASM_MIPS_ELF += camellia/camellia.c ASM_MIPS_ELF += camellia/cmll_cbc.c -ASM_MIPS_ELF += rc4/rc4.c ASM_MIPS_ELF += whrlpool/wp_block.c EXTRA_DIST += $(ASM_MIPS_ELF) diff --git a/crypto/Makefile.am.elf-mips64 b/crypto/Makefile.am.elf-mips64 index 1526020000..abf2026b87 100644 --- a/crypto/Makefile.am.elf-mips64 +++ b/crypto/Makefile.am.elf-mips64 @@ -8,7 +8,6 @@ ASM_MIPS64_ELF += sha/sha256-mips.S ASM_MIPS64_ELF += aes/aes_cbc.c ASM_MIPS64_ELF += camellia/camellia.c ASM_MIPS64_ELF += camellia/cmll_cbc.c -ASM_MIPS64_ELF += rc4/rc4.c ASM_MIPS64_ELF += whrlpool/wp_block.c EXTRA_DIST += $(ASM_MIPS64_ELF) From 35970684c0819127b582d4659ee05fac124a1f21 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 25 Mar 2024 21:42:48 -0500 Subject: [PATCH 0663/1283] explicitly undef __CET__ on masm cpp Some systems (e.g. OpenBSD) unconditionally set __CET__ in the C preprocessor. --- update.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/update.sh b/update.sh index 2976ac493f..c88851faef 100755 --- a/update.sh +++ b/update.sh @@ -184,7 +184,7 @@ $CP crypto/compat/ui_openssl_win.c crypto/ui $GREP -v OPENSSL_ia32cap_P $libcrypto_src/Symbols.list | $GREP '^[A-Za-z0-9_]' > crypto/crypto.sym fixup_masm() { - cpp -I./crypto -I./include/compat -D_MSC_VER $1 \ + cpp -I./crypto -I./include/compat -D_MSC_VER -U__CET__ $1 \ | sed -e 's/^#/;/' \ | sed -e 's/|/OR/g' \ | sed -e 's/~/NOT/g' \ From 0207f1e2261c85a3c33d13d9b444ad2bae20feb2 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 28 Mar 2024 06:55:55 -0600 Subject: [PATCH 0664/1283] Remove md32_common.h, unconditionally link aes.c --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 2 -- crypto/Makefile.am.elf-arm | 1 - crypto/Makefile.am.elf-mips | 1 - crypto/Makefile.am.elf-mips64 | 1 - 5 files changed, 6 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 47ab73317b..9d29e45769 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -223,7 +223,6 @@ if((NOT HOST_ASM_ELF_X86_64) AND set( CRYPTO_SRC ${CRYPTO_SRC} - aes/aes_cbc.c camellia/camellia.c camellia/cmll_cbc.c whrlpool/wp_block.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index a71d918c1a..398acf07d1 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -196,7 +196,6 @@ if !HOST_ASM_MACOSX_X86_64 if !HOST_ASM_MASM_X86_64 if !HOST_ASM_MINGW64_X86_64 libcrypto_la_CPPFLAGS += -DOPENSSL_NO_ASM -libcrypto_la_SOURCES += aes/aes_cbc.c libcrypto_la_SOURCES += aes/aes_core.c libcrypto_la_SOURCES += camellia/camellia.c libcrypto_la_SOURCES += camellia/cmll_cbc.c @@ -229,7 +228,6 @@ noinst_HEADERS += constant_time.h noinst_HEADERS += cryptlib.h noinst_HEADERS += crypto_internal.h noinst_HEADERS += crypto_local.h -noinst_HEADERS += md32_common.h noinst_HEADERS += x86_arch.h # aes diff --git a/crypto/Makefile.am.elf-arm b/crypto/Makefile.am.elf-arm index e24f87bd04..3ff4bc93f7 100644 --- a/crypto/Makefile.am.elf-arm +++ b/crypto/Makefile.am.elf-arm @@ -7,7 +7,6 @@ ASM_ARM_ELF += modes/ghash-elf-armv4.S ASM_ARM_ELF += armv4cpuid.S ASM_ARM_ELF += armcap.c -ASM_ARM_ELF += aes/aes_cbc.c ASM_ARM_ELF += camellia/camellia.c ASM_ARM_ELF += camellia/cmll_cbc.c ASM_ARM_ELF += whrlpool/wp_block.c diff --git a/crypto/Makefile.am.elf-mips b/crypto/Makefile.am.elf-mips index 34fda49db7..d10e59edaa 100644 --- a/crypto/Makefile.am.elf-mips +++ b/crypto/Makefile.am.elf-mips @@ -5,7 +5,6 @@ ASM_MIPS_ELF += sha/sha1-mips.S ASM_MIPS_ELF += sha/sha512-mips.S ASM_MIPS_ELF += sha/sha256-mips.S -ASM_MIPS_ELF += aes/aes_cbc.c ASM_MIPS_ELF += camellia/camellia.c ASM_MIPS_ELF += camellia/cmll_cbc.c ASM_MIPS_ELF += whrlpool/wp_block.c diff --git a/crypto/Makefile.am.elf-mips64 b/crypto/Makefile.am.elf-mips64 index abf2026b87..1c03584ab4 100644 --- a/crypto/Makefile.am.elf-mips64 +++ b/crypto/Makefile.am.elf-mips64 @@ -5,7 +5,6 @@ ASM_MIPS64_ELF += sha/sha1-mips.S ASM_MIPS64_ELF += sha/sha512-mips.S ASM_MIPS64_ELF += sha/sha256-mips.S -ASM_MIPS64_ELF += aes/aes_cbc.c ASM_MIPS64_ELF += camellia/camellia.c ASM_MIPS64_ELF += camellia/cmll_cbc.c ASM_MIPS64_ELF += whrlpool/wp_block.c From 3f631b7f445ce75305038fff837bbd984637629b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 28 Mar 2024 17:57:32 -0600 Subject: [PATCH 0665/1283] Add hidden ripemd.h --- crypto/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 398acf07d1..362d9bfd74 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -668,6 +668,7 @@ noinst_HEADERS += hidden/openssl/posix_time.h noinst_HEADERS += hidden/openssl/rand.h noinst_HEADERS += hidden/openssl/rc2.h noinst_HEADERS += hidden/openssl/rc4.h +noinst_HEADERS += hidden/openssl/ripemd.h noinst_HEADERS += hidden/openssl/rsa.h noinst_HEADERS += hidden/openssl/sha.h noinst_HEADERS += hidden/openssl/sm3.h From 4e41fc8721249798971a6032bcb0754401f1f1da Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 28 Mar 2024 19:48:05 -0600 Subject: [PATCH 0666/1283] Hook up hidden DES --- crypto/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 362d9bfd74..c97de66072 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -646,6 +646,7 @@ noinst_HEADERS += hidden/openssl/conf_api.h noinst_HEADERS += hidden/openssl/crypto.h noinst_HEADERS += hidden/openssl/ct.h noinst_HEADERS += hidden/openssl/curve25519.h +noinst_HEADERS += hidden/openssl/des.h noinst_HEADERS += hidden/openssl/dh.h noinst_HEADERS += hidden/openssl/dsa.h noinst_HEADERS += hidden/openssl/ec.h From c370c924d1e4ce41dac0b661755e02532bc1b71a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 28 Mar 2024 20:24:58 -0600 Subject: [PATCH 0667/1283] Add hidden blowfish.h --- crypto/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index c97de66072..0c3192f04f 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -636,6 +636,7 @@ noinst_HEADERS += hidden/crypto_namespace.h noinst_HEADERS += hidden/openssl/asn1.h noinst_HEADERS += hidden/openssl/asn1t.h noinst_HEADERS += hidden/openssl/bio.h +noinst_HEADERS += hidden/openssl/blowfish.h noinst_HEADERS += hidden/openssl/bn.h noinst_HEADERS += hidden/openssl/buffer.h noinst_HEADERS += hidden/openssl/cast.h From f95940836bd539b08a91bfdfcec0bf5cc1b7c0ac Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 28 Mar 2024 20:47:48 -0600 Subject: [PATCH 0668/1283] Consolidate whirlpool --- crypto/CMakeLists.txt | 7 +------ crypto/Makefile.am | 4 +--- crypto/Makefile.am.elf-arm | 1 - crypto/Makefile.am.elf-mips | 1 - crypto/Makefile.am.elf-mips64 | 1 - crypto/Makefile.am.elf-x86_64 | 1 - crypto/Makefile.am.macosx-x86_64 | 1 - crypto/Makefile.am.masm-x86_64 | 1 - crypto/Makefile.am.mingw64-x86_64 | 1 - update.sh | 1 - 10 files changed, 2 insertions(+), 17 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 9d29e45769..b3c4c521fa 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -40,7 +40,6 @@ if(HOST_ASM_ELF_X86_64) sha/sha1-elf-x86_64.S sha/sha256-elf-x86_64.S sha/sha512-elf-x86_64.S - whrlpool/wp-elf-x86_64.S cpuid-elf-x86_64.S bn/arch/amd64/bignum_add.S @@ -91,7 +90,6 @@ if(HOST_ASM_MACOSX_X86_64) sha/sha1-macosx-x86_64.S sha/sha256-macosx-x86_64.S sha/sha512-macosx-x86_64.S - whrlpool/wp-macosx-x86_64.S cpuid-macosx-x86_64.S bn/arch/amd64/bignum_add.S @@ -143,7 +141,6 @@ if(HOST_ASM_MASM_X86_64) sha/sha1-masm-x86_64.S sha/sha256-masm-x86_64.S sha/sha512-masm-x86_64.S - whrlpool/wp-masm-x86_64.S cpuid-masm-x86_64.S ) add_definitions(-Dendbr64=) @@ -182,7 +179,6 @@ if(HOST_ASM_MINGW64_X86_64) sha/sha1-mingw64-x86_64.S sha/sha256-mingw64-x86_64.S sha/sha512-mingw64-x86_64.S - whrlpool/wp-mingw64-x86_64.S cpuid-mingw64-x86_64.S ) add_definitions(-Dendbr64=) @@ -225,7 +221,6 @@ if((NOT HOST_ASM_ELF_X86_64) AND ${CRYPTO_SRC} camellia/camellia.c camellia/cmll_cbc.c - whrlpool/wp_block.c ) endif() @@ -625,7 +620,7 @@ set( ui/ui_lib.c ui/ui_null.c ui/ui_util.c - whrlpool/wp_dgst.c + whrlpool/whirlpool.c x509/by_dir.c x509/by_file.c x509/by_mem.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 0c3192f04f..31637c0417 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -199,7 +199,6 @@ libcrypto_la_CPPFLAGS += -DOPENSSL_NO_ASM libcrypto_la_SOURCES += aes/aes_core.c libcrypto_la_SOURCES += camellia/camellia.c libcrypto_la_SOURCES += camellia/cmll_cbc.c -libcrypto_la_SOURCES += whrlpool/wp_block.c endif endif endif @@ -876,8 +875,7 @@ libcrypto_la_SOURCES += ui/ui_util.c noinst_HEADERS += ui/ui_local.h # whrlpool -libcrypto_la_SOURCES += whrlpool/wp_dgst.c -noinst_HEADERS += whrlpool/wp_local.h +libcrypto_la_sources += whrlpool/whirlpool.c # x509 libcrypto_la_SOURCES += x509/by_dir.c diff --git a/crypto/Makefile.am.elf-arm b/crypto/Makefile.am.elf-arm index 3ff4bc93f7..c0fc7f8562 100644 --- a/crypto/Makefile.am.elf-arm +++ b/crypto/Makefile.am.elf-arm @@ -9,7 +9,6 @@ ASM_ARM_ELF += armcap.c ASM_ARM_ELF += camellia/camellia.c ASM_ARM_ELF += camellia/cmll_cbc.c -ASM_ARM_ELF += whrlpool/wp_block.c EXTRA_DIST += $(ASM_ARM_ELF) diff --git a/crypto/Makefile.am.elf-mips b/crypto/Makefile.am.elf-mips index d10e59edaa..b85bc0928b 100644 --- a/crypto/Makefile.am.elf-mips +++ b/crypto/Makefile.am.elf-mips @@ -7,7 +7,6 @@ ASM_MIPS_ELF += sha/sha256-mips.S ASM_MIPS_ELF += camellia/camellia.c ASM_MIPS_ELF += camellia/cmll_cbc.c -ASM_MIPS_ELF += whrlpool/wp_block.c EXTRA_DIST += $(ASM_MIPS_ELF) diff --git a/crypto/Makefile.am.elf-mips64 b/crypto/Makefile.am.elf-mips64 index 1c03584ab4..138ddf789c 100644 --- a/crypto/Makefile.am.elf-mips64 +++ b/crypto/Makefile.am.elf-mips64 @@ -7,7 +7,6 @@ ASM_MIPS64_ELF += sha/sha256-mips.S ASM_MIPS64_ELF += camellia/camellia.c ASM_MIPS64_ELF += camellia/cmll_cbc.c -ASM_MIPS64_ELF += whrlpool/wp_block.c EXTRA_DIST += $(ASM_MIPS64_ELF) diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index 7a4d22cb71..2303531ac1 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -13,7 +13,6 @@ ASM_X86_64_ELF += rc4/rc4-elf-x86_64.S ASM_X86_64_ELF += sha/sha1-elf-x86_64.S ASM_X86_64_ELF += sha/sha256-elf-x86_64.S ASM_X86_64_ELF += sha/sha512-elf-x86_64.S -ASM_X86_64_ELF += whrlpool/wp-elf-x86_64.S ASM_X86_64_ELF += cpuid-elf-x86_64.S ASM_X86_64_ELF += bn/arch/amd64/bignum_add.S diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index ad1c39f1be..53593e2de2 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -13,7 +13,6 @@ ASM_X86_64_MACOSX += rc4/rc4-macosx-x86_64.S ASM_X86_64_MACOSX += sha/sha1-macosx-x86_64.S ASM_X86_64_MACOSX += sha/sha256-macosx-x86_64.S ASM_X86_64_MACOSX += sha/sha512-macosx-x86_64.S -ASM_X86_64_MACOSX += whrlpool/wp-macosx-x86_64.S ASM_X86_64_MACOSX += cpuid-macosx-x86_64.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_add.S diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index 4feacbae9c..af168b2f2d 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -13,7 +13,6 @@ ASM_X86_64_MASM += rc4/rc4-masm-x86_64.S ASM_X86_64_MASM += sha/sha1-masm-x86_64.S ASM_X86_64_MASM += sha/sha256-masm-x86_64.S ASM_X86_64_MASM += sha/sha512-masm-x86_64.S -ASM_X86_64_MASM += whrlpool/wp-masm-x86_64.S ASM_X86_64_MASM += cpuid-masm-x86_64.S EXTRA_DIST += $(ASM_X86_64_MASM) diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index 8c430a11ee..5f95b5296f 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -13,7 +13,6 @@ ASM_X86_64_MINGW64 += rc4/rc4-mingw64-x86_64.S ASM_X86_64_MINGW64 += sha/sha1-mingw64-x86_64.S ASM_X86_64_MINGW64 += sha/sha256-mingw64-x86_64.S ASM_X86_64_MINGW64 += sha/sha512-mingw64-x86_64.S -ASM_X86_64_MINGW64 += whrlpool/wp-mingw64-x86_64.S ASM_X86_64_MINGW64 += cpuid-mingw64-x86_64.S EXTRA_DIST += $(ASM_X86_64_MINGW64) diff --git a/update.sh b/update.sh index 2976ac493f..f4f77850af 100755 --- a/update.sh +++ b/update.sh @@ -281,7 +281,6 @@ for abi in elf macosx masm mingw64; do gen_asm_stdout $abi sha/asm/sha1-x86_64.pl sha/sha1-$abi-x86_64.S gen_asm $abi sha/asm/sha512-x86_64.pl sha/sha256-$abi-x86_64.S gen_asm $abi sha/asm/sha512-x86_64.pl sha/sha512-$abi-x86_64.S - gen_asm_stdout $abi whrlpool/asm/wp-x86_64.pl whrlpool/wp-$abi-x86_64.S gen_asm $abi x86_64cpuid.pl cpuid-$abi-x86_64.S done From 34c4d6621a0b58709cd2418cce9953a8d457f175 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 28 Mar 2024 23:05:09 -0600 Subject: [PATCH 0669/1283] Uppercase SOURCES --- crypto/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 31637c0417..e070867be4 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -875,7 +875,7 @@ libcrypto_la_SOURCES += ui/ui_util.c noinst_HEADERS += ui/ui_local.h # whrlpool -libcrypto_la_sources += whrlpool/whirlpool.c +libcrypto_la_SOURCES += whrlpool/whirlpool.c # x509 libcrypto_la_SOURCES += x509/by_dir.c From 1d6c6c1cbda79a42049acd7fb0556bdbddd74d93 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 28 Mar 2024 23:15:05 -0600 Subject: [PATCH 0670/1283] Consolidate AES sources --- crypto/CMakeLists.txt | 13 +------------ crypto/Makefile.am | 2 +- 2 files changed, 2 insertions(+), 13 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index b3c4c521fa..fdc0089dfd 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -200,18 +200,6 @@ if(HOST_ASM_MINGW64_X86_64) set_property(SOURCE ${ASM_X86_64_MINGW64_SRC} PROPERTY LANGUAGE C) endif() -if((NOT HOST_ASM_ELF_X86_64) AND - (NOT HOST_ASM_MACOSX_X86_64) AND - (NOT HOST_ASM_MASM_X86_64) AND - (NOT HOST_ASM_MINGW64_X86_64) AND - (NOT HOST_ASM_ELF_ARMV4)) - set( - CRYPTO_SRC - ${CRYPTO_SRC} - aes/aes_core.c - ) -endif() - if((NOT HOST_ASM_ELF_X86_64) AND (NOT HOST_ASM_MACOSX_X86_64) AND (NOT HOST_ASM_MASM_X86_64) AND @@ -238,6 +226,7 @@ set( o_fips.c o_str.c aes/aes.c + aes/aes_core.c aes/aes_ige.c asn1/a_bitstr.c asn1/a_enum.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index e070867be4..d6a551b73c 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -196,7 +196,6 @@ if !HOST_ASM_MACOSX_X86_64 if !HOST_ASM_MASM_X86_64 if !HOST_ASM_MINGW64_X86_64 libcrypto_la_CPPFLAGS += -DOPENSSL_NO_ASM -libcrypto_la_SOURCES += aes/aes_core.c libcrypto_la_SOURCES += camellia/camellia.c libcrypto_la_SOURCES += camellia/cmll_cbc.c endif @@ -231,6 +230,7 @@ noinst_HEADERS += x86_arch.h # aes libcrypto_la_SOURCES += aes/aes.c +libcrypto_la_SOURCES += aes/aes_core.c libcrypto_la_SOURCES += aes/aes_ige.c noinst_HEADERS += aes/aes_local.h From fd57ce50769f9a8490456b18ff24938c58072e18 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 28 Mar 2024 23:26:00 -0600 Subject: [PATCH 0671/1283] A concentration of ideas has happened --- crypto/CMakeLists.txt | 6 +----- crypto/Makefile.am | 6 +----- 2 files changed, 2 insertions(+), 10 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index fdc0089dfd..4c50bc3522 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -494,11 +494,7 @@ set( hmac/hm_ameth.c hmac/hm_pmeth.c hmac/hmac.c - idea/i_cbc.c - idea/i_cfb64.c - idea/i_ecb.c - idea/i_ofb64.c - idea/i_skey.c + idea/idea.c kdf/hkdf_evp.c kdf/kdf_err.c lhash/lhash.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index d6a551b73c..9e8b5e66e7 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -692,11 +692,7 @@ libcrypto_la_SOURCES += hmac/hmac.c noinst_HEADERS += hmac/hmac_local.h # idea -libcrypto_la_SOURCES += idea/i_cbc.c -libcrypto_la_SOURCES += idea/i_cfb64.c -libcrypto_la_SOURCES += idea/i_ecb.c -libcrypto_la_SOURCES += idea/i_ofb64.c -libcrypto_la_SOURCES += idea/i_skey.c +libcrypto_la_SOURCES += idea/idea.c noinst_HEADERS += idea/idea_local.h # kdf From 70d384d5371c95ff84c79fa7cb6fa31a744dd9b3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 29 Mar 2024 01:45:13 -0600 Subject: [PATCH 0672/1283] camellia/cast consolidation coping --- crypto/CMakeLists.txt | 28 ++-------------------------- crypto/Makefile.am | 16 ++-------------- crypto/Makefile.am.elf-arm | 3 --- crypto/Makefile.am.elf-mips | 3 --- crypto/Makefile.am.elf-mips64 | 3 --- crypto/Makefile.am.elf-x86_64 | 1 - crypto/Makefile.am.macosx-x86_64 | 1 - crypto/Makefile.am.masm-x86_64 | 1 - crypto/Makefile.am.mingw64-x86_64 | 1 - update.sh | 1 - 10 files changed, 4 insertions(+), 54 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 4c50bc3522..c0c05f2e30 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -33,7 +33,6 @@ if(HOST_ASM_ELF_X86_64) bn/modexp512-elf-x86_64.S bn/mont-elf-x86_64.S bn/mont5-elf-x86_64.S - camellia/cmll-elf-x86_64.S md5/md5-elf-x86_64.S modes/ghash-elf-x86_64.S rc4/rc4-elf-x86_64.S @@ -83,7 +82,6 @@ if(HOST_ASM_MACOSX_X86_64) bn/modexp512-macosx-x86_64.S bn/mont-macosx-x86_64.S bn/mont5-macosx-x86_64.S - camellia/cmll-macosx-x86_64.S md5/md5-macosx-x86_64.S modes/ghash-macosx-x86_64.S rc4/rc4-macosx-x86_64.S @@ -134,7 +132,6 @@ if(HOST_ASM_MASM_X86_64) #bn/modexp512-masm-x86_64.S #bn/mont-masm-x86_64.S #bn/mont5-masm-x86_64.S - camellia/cmll-masm-x86_64.S md5/md5-masm-x86_64.S modes/ghash-masm-x86_64.S rc4/rc4-masm-x86_64.S @@ -172,7 +169,6 @@ if(HOST_ASM_MINGW64_X86_64) #bn/modexp512-mingw64-x86_64.S #bn/mont-mingw64-x86_64.S #bn/mont5-mingw64-x86_64.S - camellia/cmll-mingw64-x86_64.S md5/md5-mingw64-x86_64.S modes/ghash-mingw64-x86_64.S rc4/rc4-mingw64-x86_64.S @@ -200,18 +196,6 @@ if(HOST_ASM_MINGW64_X86_64) set_property(SOURCE ${ASM_X86_64_MINGW64_SRC} PROPERTY LANGUAGE C) endif() -if((NOT HOST_ASM_ELF_X86_64) AND - (NOT HOST_ASM_MACOSX_X86_64) AND - (NOT HOST_ASM_MASM_X86_64) AND - (NOT HOST_ASM_MINGW64_X86_64)) - set( - CRYPTO_SRC - ${CRYPTO_SRC} - camellia/camellia.c - camellia/cmll_cbc.c - ) -endif() - set( CRYPTO_SRC ${CRYPTO_SRC} @@ -338,16 +322,8 @@ set( bytestring/bs_ber.c bytestring/bs_cbb.c bytestring/bs_cbs.c - camellia/cmll_cfb.c - camellia/cmll_ctr.c - camellia/cmll_ecb.c - camellia/cmll_misc.c - camellia/cmll_ofb.c - cast/c_cfb64.c - cast/c_ecb.c - cast/c_enc.c - cast/c_ofb64.c - cast/c_skey.c + camellia/camellia.c + cast/cast.c chacha/chacha.c cmac/cm_ameth.c cmac/cm_pmeth.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 9e8b5e66e7..cd03c7d370 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -196,8 +196,6 @@ if !HOST_ASM_MACOSX_X86_64 if !HOST_ASM_MASM_X86_64 if !HOST_ASM_MINGW64_X86_64 libcrypto_la_CPPFLAGS += -DOPENSSL_NO_ASM -libcrypto_la_SOURCES += camellia/camellia.c -libcrypto_la_SOURCES += camellia/cmll_cbc.c endif endif endif @@ -427,22 +425,12 @@ libcrypto_la_SOURCES += bytestring/bs_cbb.c libcrypto_la_SOURCES += bytestring/bs_cbs.c # camellia -libcrypto_la_SOURCES += camellia/cmll_cfb.c -libcrypto_la_SOURCES += camellia/cmll_ctr.c -libcrypto_la_SOURCES += camellia/cmll_ecb.c -libcrypto_la_SOURCES += camellia/cmll_misc.c -libcrypto_la_SOURCES += camellia/cmll_ofb.c +libcrypto_la_SOURCES += camellia/camellia.c noinst_HEADERS += camellia/camellia.h -noinst_HEADERS += camellia/cmll_local.h # cast -libcrypto_la_SOURCES += cast/c_cfb64.c -libcrypto_la_SOURCES += cast/c_ecb.c -libcrypto_la_SOURCES += cast/c_enc.c -libcrypto_la_SOURCES += cast/c_ofb64.c -libcrypto_la_SOURCES += cast/c_skey.c +libcrypto_la_SOURCES += cast/cast.c noinst_HEADERS += cast/cast_local.h -noinst_HEADERS += cast/cast_s.h # chacha EXTRA_libcrypto_la_SOURCES += chacha/chacha-merged.c diff --git a/crypto/Makefile.am.elf-arm b/crypto/Makefile.am.elf-arm index c0fc7f8562..4f88994d4f 100644 --- a/crypto/Makefile.am.elf-arm +++ b/crypto/Makefile.am.elf-arm @@ -7,9 +7,6 @@ ASM_ARM_ELF += modes/ghash-elf-armv4.S ASM_ARM_ELF += armv4cpuid.S ASM_ARM_ELF += armcap.c -ASM_ARM_ELF += camellia/camellia.c -ASM_ARM_ELF += camellia/cmll_cbc.c - EXTRA_DIST += $(ASM_ARM_ELF) if HOST_ASM_ELF_ARM diff --git a/crypto/Makefile.am.elf-mips b/crypto/Makefile.am.elf-mips index b85bc0928b..ea0a730477 100644 --- a/crypto/Makefile.am.elf-mips +++ b/crypto/Makefile.am.elf-mips @@ -5,9 +5,6 @@ ASM_MIPS_ELF += sha/sha1-mips.S ASM_MIPS_ELF += sha/sha512-mips.S ASM_MIPS_ELF += sha/sha256-mips.S -ASM_MIPS_ELF += camellia/camellia.c -ASM_MIPS_ELF += camellia/cmll_cbc.c - EXTRA_DIST += $(ASM_MIPS_ELF) if HOST_ASM_ELF_MIPS diff --git a/crypto/Makefile.am.elf-mips64 b/crypto/Makefile.am.elf-mips64 index 138ddf789c..8f851f37df 100644 --- a/crypto/Makefile.am.elf-mips64 +++ b/crypto/Makefile.am.elf-mips64 @@ -5,9 +5,6 @@ ASM_MIPS64_ELF += sha/sha1-mips.S ASM_MIPS64_ELF += sha/sha512-mips.S ASM_MIPS64_ELF += sha/sha256-mips.S -ASM_MIPS64_ELF += camellia/camellia.c -ASM_MIPS64_ELF += camellia/cmll_cbc.c - EXTRA_DIST += $(ASM_MIPS64_ELF) if HOST_ASM_ELF_MIPS64 diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index 2303531ac1..990475e04c 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -6,7 +6,6 @@ ASM_X86_64_ELF += aes/aesni-elf-x86_64.S ASM_X86_64_ELF += bn/modexp512-elf-x86_64.S ASM_X86_64_ELF += bn/mont-elf-x86_64.S ASM_X86_64_ELF += bn/mont5-elf-x86_64.S -ASM_X86_64_ELF += camellia/cmll-elf-x86_64.S ASM_X86_64_ELF += md5/md5-elf-x86_64.S ASM_X86_64_ELF += modes/ghash-elf-x86_64.S ASM_X86_64_ELF += rc4/rc4-elf-x86_64.S diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index 53593e2de2..c380003068 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -6,7 +6,6 @@ ASM_X86_64_MACOSX += aes/aesni-macosx-x86_64.S ASM_X86_64_MACOSX += bn/modexp512-macosx-x86_64.S ASM_X86_64_MACOSX += bn/mont-macosx-x86_64.S ASM_X86_64_MACOSX += bn/mont5-macosx-x86_64.S -ASM_X86_64_MACOSX += camellia/cmll-macosx-x86_64.S ASM_X86_64_MACOSX += md5/md5-macosx-x86_64.S ASM_X86_64_MACOSX += modes/ghash-macosx-x86_64.S ASM_X86_64_MACOSX += rc4/rc4-macosx-x86_64.S diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index af168b2f2d..437638c1ea 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -6,7 +6,6 @@ ASM_X86_64_MASM += aes/aesni-masm-x86_64.S ASM_X86_64_MASM += bn/modexp512-masm-x86_64.S ASM_X86_64_MASM += bn/mont-masm-x86_64.S ASM_X86_64_MASM += bn/mont5-masm-x86_64.S -ASM_X86_64_MASM += camellia/cmll-masm-x86_64.S ASM_X86_64_MASM += md5/md5-masm-x86_64.S ASM_X86_64_MASM += modes/ghash-masm-x86_64.S ASM_X86_64_MASM += rc4/rc4-masm-x86_64.S diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index 5f95b5296f..90a58d2ee7 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -6,7 +6,6 @@ ASM_X86_64_MINGW64 += aes/aesni-mingw64-x86_64.S #ASM_X86_64_MINGW64 += bn/modexp512-mingw64-x86_64.S #ASM_X86_64_MINGW64 += bn/mont-mingw64-x86_64.S #ASM_X86_64_MINGW64 += bn/mont5-mingw64-x86_64.S -ASM_X86_64_MINGW64 += camellia/cmll-mingw64-x86_64.S ASM_X86_64_MINGW64 += md5/md5-mingw64-x86_64.S ASM_X86_64_MINGW64 += modes/ghash-mingw64-x86_64.S ASM_X86_64_MINGW64 += rc4/rc4-mingw64-x86_64.S diff --git a/update.sh b/update.sh index f4f77850af..3e6dc5dc53 100755 --- a/update.sh +++ b/update.sh @@ -274,7 +274,6 @@ for abi in elf macosx masm mingw64; do gen_asm_stdout $abi bn/asm/modexp512-x86_64.pl bn/modexp512-$abi-x86_64.S gen_asm_stdout $abi bn/asm/x86_64-mont.pl bn/mont-$abi-x86_64.S gen_asm_stdout $abi bn/asm/x86_64-mont5.pl bn/mont5-$abi-x86_64.S - gen_asm_stdout $abi camellia/asm/cmll-x86_64.pl camellia/cmll-$abi-x86_64.S gen_asm_stdout $abi md5/asm/md5-x86_64.pl md5/md5-$abi-x86_64.S gen_asm_stdout $abi modes/asm/ghash-x86_64.pl modes/ghash-$abi-x86_64.S gen_asm_stdout $abi rc4/asm/rc4-x86_64.pl rc4/rc4-$abi-x86_64.S From e982ab4133921ebd263f8a4cadb3d28dca1526aa Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Fri, 29 Mar 2024 18:37:03 +1100 Subject: [PATCH 0673/1283] Add whirlpool test --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 9038ab4e68..f6bfcdd420 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -765,6 +765,11 @@ add_executable(verifytest verifytest.c) target_link_libraries(verifytest ${LIBTLS_TEST_LIBS}) add_test(verifytest verifytest) +# whirlpool_test +add_executable(whirlpool_test whirlpool_test.c) +target_link_libraries(whirlpool_test ${OPENSSL_TEST_LIBS}) +add_test(whirlpool_test whirlpool_test) + # x25519test add_executable(x25519test x25519test.c) target_link_libraries(x25519test ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index e4c0af6150..9ff9980bab 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -766,6 +766,11 @@ TESTS += verifytest check_PROGRAMS += verifytest verifytest_SOURCES = verifytest.c +# whirlpool +TESTS += whirlpool_test +check_PROGRAMS += whirlpool_test +whirlpool_test_SOURCES = whirlpool_test.c + # x25519test TESTS += x25519test check_PROGRAMS += x25519test From a07d3f6484a1a1ce966b31e3a8ec18c3de3aab9e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 29 Mar 2024 18:44:03 -0600 Subject: [PATCH 0674/1283] Link rsa_padding_test to build --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index f6bfcdd420..7e384bf8d7 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -579,6 +579,11 @@ add_executable(rmd_test rmd_test.c) target_link_libraries(rmd_test ${OPENSSL_TEST_LIBS}) add_test(rmd_test rmd_test) +# rsa_padding_test +add_executable(rsa_padding_test rsa_padding_test.c) +target_link_libraries(rsa_padding_test ${OPENSSL_TEST_LIBS}) +add_test(rsa_padding_test rsa_padding_test) + # rsa_test add_executable(rsa_test rsa_test.c) target_link_libraries(rsa_test ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 9ff9980bab..9e462996e4 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -613,6 +613,11 @@ TESTS += rmd_test check_PROGRAMS += rmd_test rmd_test_SOURCES = rmd_test.c +# rsa_padding_test +TESTS += rsa_padding_test +check_PROGRAMS += rsa_padding_test +rsa_padding_test_SOURCES = rsa_padding_test.c + # rsa_test TESTS += rsa_test check_PROGRAMS += rsa_test From 364e1fa7163c3ec49e48468c000fab5a7ecb440a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 29 Mar 2024 21:47:18 -0600 Subject: [PATCH 0675/1283] Add hidden whrlpool --- crypto/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index cd03c7d370..608d485b05 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -666,6 +666,7 @@ noinst_HEADERS += hidden/openssl/stack.h noinst_HEADERS += hidden/openssl/ts.h noinst_HEADERS += hidden/openssl/txt_db.h noinst_HEADERS += hidden/openssl/ui.h +noinst_HEADERS += hidden/openssl/whrlpool.h noinst_HEADERS += hidden/openssl/x509.h noinst_HEADERS += hidden/openssl/x509_vfy.h noinst_HEADERS += hidden/openssl/x509v3.h From c2f5a90ed03035634a3527e4b7968a7edf118405 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 29 Mar 2024 21:47:34 -0600 Subject: [PATCH 0676/1283] Add HAVE_AES_* flags to all x86_64 asm builds --- crypto/Makefile.am.elf-x86_64 | 5 +++++ crypto/Makefile.am.macosx-x86_64 | 5 +++++ crypto/Makefile.am.masm-x86_64 | 5 +++++ crypto/Makefile.am.mingw64-x86_64 | 5 +++++ 4 files changed, 20 insertions(+) diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index 990475e04c..6933a11d08 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -33,6 +33,11 @@ if HOST_ASM_ELF_X86_64 libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM libcrypto_la_CPPFLAGS += -DVPAES_ASM +libcrypto_la_CPPFLAGS += -DHAVE_AES_CBC_ENCRYPT_INTERNAL +libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL +libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_DECRYPT_KEY_INTERNAL +libcrypto_la_CPPFLAGS += -DHAVE_AES_ENCRYPT_INTERNAL +libcrypto_la_CPPFLAGS += -DHAVE_AES_DECRYPT_INTERNAL libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index c380003068..10205672c5 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -33,6 +33,11 @@ if HOST_ASM_MACOSX_X86_64 libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM libcrypto_la_CPPFLAGS += -DVPAES_ASM +libcrypto_la_CPPFLAGS += -DHAVE_AES_CBC_ENCRYPT_INTERNAL +libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL +libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_DECRYPT_KEY_INTERNAL +libcrypto_la_CPPFLAGS += -DHAVE_AES_ENCRYPT_INTERNAL +libcrypto_la_CPPFLAGS += -DHAVE_AES_DECRYPT_INTERNAL libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index 437638c1ea..7da3cc242f 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -20,6 +20,11 @@ if HOST_ASM_MASM_X86_64 libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM libcrypto_la_CPPFLAGS += -DVPAES_ASM +libcrypto_la_CPPFLAGS += -DHAVE_AES_CBC_ENCRYPT_INTERNAL +libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL +libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_DECRYPT_KEY_INTERNAL +libcrypto_la_CPPFLAGS += -DHAVE_AES_ENCRYPT_INTERNAL +libcrypto_la_CPPFLAGS += -DHAVE_AES_DECRYPT_INTERNAL libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index 90a58d2ee7..3c279c4b88 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -20,6 +20,11 @@ if HOST_ASM_MINGW64_X86_64 libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM libcrypto_la_CPPFLAGS += -DVPAES_ASM +libcrypto_la_CPPFLAGS += -DHAVE_AES_CBC_ENCRYPT_INTERNAL +libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL +libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_DECRYPT_KEY_INTERNAL +libcrypto_la_CPPFLAGS += -DHAVE_AES_ENCRYPT_INTERNAL +libcrypto_la_CPPFLAGS += -DHAVE_AES_DECRYPT_INTERNAL libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 #libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT #libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 From 5ff4c4ace74c37da7d7e7304ee19b258bbb38c5f Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 29 Mar 2024 23:37:15 -0600 Subject: [PATCH 0677/1283] Add hidden aes.h and camellia.h --- crypto/Makefile.am | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 608d485b05..9533907fa0 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -620,12 +620,14 @@ noinst_HEADERS += evp/evp_local.h # hidden noinst_HEADERS += hidden/crypto_namespace.h +noinst_HEADERS += hidden/openssl/aes.h noinst_HEADERS += hidden/openssl/asn1.h noinst_HEADERS += hidden/openssl/asn1t.h noinst_HEADERS += hidden/openssl/bio.h noinst_HEADERS += hidden/openssl/blowfish.h noinst_HEADERS += hidden/openssl/bn.h noinst_HEADERS += hidden/openssl/buffer.h +noinst_HEADERS += hidden/openssl/camellia.h noinst_HEADERS += hidden/openssl/cast.h noinst_HEADERS += hidden/openssl/chacha.h noinst_HEADERS += hidden/openssl/cmac.h From 7362be429ccf7c8381cc3e7f91c1a57ff1a11f7f Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 30 Mar 2024 05:18:22 -0600 Subject: [PATCH 0678/1283] Update ChangeLog --- ChangeLog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ChangeLog b/ChangeLog index ec82540d09..b49641ce6b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -41,6 +41,12 @@ LibreSSL Portable Release Notes: - Split parsing and processing of TLS extensions to ensure that extension callbacks are called in a predefined order. - Cleaned up the MD4 and MD5 implementations. + - Assembly functions are no longer exposed in the public API, they + are all wrapped by C functions. + - Removed assembly implementations of legacy ciphers on legacy + architectures. + - Merged most multi-file implementations of ciphers into one or two + C files. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security From 067bff0c51eb3199366a3e75e0dd932349f51c89 Mon Sep 17 00:00:00 2001 From: Bob Beck Date: Sat, 30 Mar 2024 05:25:41 -0600 Subject: [PATCH 0679/1283] add stuff --- ChangeLog | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/ChangeLog b/ChangeLog index b49641ce6b..c67eefa56d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -54,6 +54,13 @@ LibreSSL Portable Release Notes: * Compatibility changes - Removed workaround for F5 middle boxes. * Bug fixes + - Improved standards compliance for supported groups and key shares + extensions + - Duplicate key shares are disallowed + - Duplicate supported groups are disallowed + - Key shares must be sent in the order of supported groups. + - Key shares will only be selected if they match the most + preferred supported group by client preference order. - Fixed signed integer overflow in bnrand(). 3.9.0 - Development release From 9f64e1d14d81d6cf0a5b837731c7c6cd5d31332a Mon Sep 17 00:00:00 2001 From: Jim B Date: Sat, 6 Apr 2024 12:17:32 -0700 Subject: [PATCH 0680/1283] Update CMakeLists.txt Collapse the same if condition blocks into one block. Include the uninstall rule when building install rules; if there was no install, shouldn't need uninstall (for this build; a previous build that was installed would have an uninstall rule) --- CMakeLists.txt | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 01a42fb7b6..28e184d9e3 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -509,9 +509,7 @@ if(ENABLE_LIBRESSL_INSTALL) "${CMAKE_CURRENT_BINARY_DIR}/LibreSSLConfigVersion.cmake" DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}" ) -endif() -if(ENABLE_LIBRESSL_INSTALL) if(NOT MSVC) # Create pkgconfig files. set(prefix ${CMAKE_INSTALL_PREFIX}) @@ -530,19 +528,17 @@ if(ENABLE_LIBRESSL_INSTALL) install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/pkgconfig DESTINATION ${CMAKE_INSTALL_LIBDIR}) endif() -endif(ENABLE_LIBRESSL_INSTALL) -if(ENABLE_LIBRESSL_INSTALL) install(FILES cert.pem openssl.cnf x509v3.cnf DESTINATION ${CONF_DIR}) install(DIRECTORY DESTINATION ${CONF_DIR}/certs) -endif(ENABLE_LIBRESSL_INSTALL) -if(NOT TARGET uninstall) - configure_file( - "${CMAKE_CURRENT_SOURCE_DIR}/cmake_uninstall.cmake.in" - "${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake" - IMMEDIATE @ONLY) + if(NOT TARGET uninstall) + configure_file( + "${CMAKE_CURRENT_SOURCE_DIR}/cmake_uninstall.cmake.in" + "${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake" + IMMEDIATE @ONLY) - add_custom_target(uninstall - COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake) -endif() + add_custom_target(uninstall + COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake) + endif() +endif(ENABLE_LIBRESSL_INSTALL) From fdfbde785d95fa1fb04bd67a95049fc483123ba5 Mon Sep 17 00:00:00 2001 From: Jim B Date: Sun, 7 Apr 2024 20:45:02 -0700 Subject: [PATCH 0681/1283] Update CMakeLists.txt Co-authored-by: Viktor Szakats --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 28e184d9e3..95fe60154f 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -541,4 +541,4 @@ if(ENABLE_LIBRESSL_INSTALL) add_custom_target(uninstall COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake) endif() -endif(ENABLE_LIBRESSL_INSTALL) +endif() From 7ff4e2874b5f9dc97a74ec724b7c3731400b7278 Mon Sep 17 00:00:00 2001 From: Christian Andersen Date: Mon, 8 Apr 2024 22:54:59 +0200 Subject: [PATCH 0682/1283] [Windows] Mention running update.sh in readme. So it is a bit easier to setup, without having to try and figure out why CMake is not generating a valid build. To improve #1044. --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index e4f56b17e2..ab159aba8d 100644 --- a/README.md +++ b/README.md @@ -143,6 +143,7 @@ generate a Visual Studio project, install CMake, enter the LibreSSL source directory and run: ```sh +./update.sh mkdir build-vs2013 cd build-vs2013 cmake -G"Visual Studio 12 2013" .. From 9091d5551c40315149912ff447264bde8e811453 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 8 Apr 2024 20:05:29 -0500 Subject: [PATCH 0683/1283] use a specific version number in test scripts This avoids issue reported in #1041 with file glob confusing cd. Also remove extra newline from VERSION when update.sh runs. --- scripts/test | 9 +++++---- update.sh | 2 +- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/scripts/test b/scripts/test index d093eab364..3e4b291e25 100755 --- a/scripts/test +++ b/scripts/test @@ -4,6 +4,7 @@ set -x unset CC ENABLE_ASM="${ENABLE_ASM:=ON}" +VERSION=`cat VERSION` if type apt-get >/dev/null 2>&1; then sudo apt-get update @@ -26,8 +27,8 @@ if [ `uname` = "Darwin" ]; then make -j 4 distcheck # test cmake - tar zxvf libressl-*.tar.gz - cd libressl-* + tar zxvf libressl-$VERSION.tar.gz + cd libressl-$VERSION ( mkdir build-static @@ -61,8 +62,8 @@ elif [ "$ARCH" = "native" ]; then # make distribution make -j 4 distcheck - tar zxvf libressl-*.tar.gz - cd libressl-* + tar zxvf libressl-$VERSION.tar.gz + cd libressl-$VERSION # test cmake and ninja diff --git a/update.sh b/update.sh index 3e6dc5dc53..84bc0d22cf 100755 --- a/update.sh +++ b/update.sh @@ -149,7 +149,7 @@ else $CP $libcrypto_src/opensslv.h include/openssl fi -awk '/LIBRESSL_VERSION_TEXT/ {print $4}' < include/openssl/opensslv.h | cut -d\" -f1 > VERSION +awk '/LIBRESSL_VERSION_TEXT/ {print $4}' < include/openssl/opensslv.h | cut -d\" -f1 | head -n1 > VERSION echo "LibreSSL version `cat VERSION`" # copy libcrypto source From d88107b3863b05385e15e2dc096a99e7f0749ba9 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 8 Apr 2024 20:10:31 -0500 Subject: [PATCH 0684/1283] read VERSION after it is generated by update script --- scripts/test | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/test b/scripts/test index 3e4b291e25..e389728702 100755 --- a/scripts/test +++ b/scripts/test @@ -4,7 +4,6 @@ set -x unset CC ENABLE_ASM="${ENABLE_ASM:=ON}" -VERSION=`cat VERSION` if type apt-get >/dev/null 2>&1; then sudo apt-get update @@ -14,6 +13,8 @@ fi # generate source tree ./autogen.sh +VERSION=`cat VERSION` + if [ "$ARCH" = "" ]; then ARCH=`uname -m` fi From a826268f431deb11179183b08408302cc3c92da5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 9 Apr 2024 01:12:57 -0600 Subject: [PATCH 0685/1283] Update ChangeLog --- ChangeLog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ChangeLog b/ChangeLog index c67eefa56d..b0b0b32161 100644 --- a/ChangeLog +++ b/ChangeLog @@ -47,6 +47,10 @@ LibreSSL Portable Release Notes: architectures. - Merged most multi-file implementations of ciphers into one or two C files. + - Removed the cache of certificate validity. This was added for + performance reasons which no longer apply since BoringSSL's time + conversion API isn't slow. Also, a recently added error check led + to obscure, undesirable validation failures. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security @@ -54,6 +58,8 @@ LibreSSL Portable Release Notes: * Compatibility changes - Removed workaround for F5 middle boxes. * Bug fixes + - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match + their documentation and always set an RFC 5280 conformant time. - Improved standards compliance for supported groups and key shares extensions - Duplicate key shares are disallowed From 52982071f044a879c9417cb574b906b3af10c906 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 9 Apr 2024 08:36:40 -0600 Subject: [PATCH 0686/1283] ChangeLog: add a couple of missing periods --- ChangeLog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index b0b0b32161..2ed5dee219 100644 --- a/ChangeLog +++ b/ChangeLog @@ -62,8 +62,8 @@ LibreSSL Portable Release Notes: their documentation and always set an RFC 5280 conformant time. - Improved standards compliance for supported groups and key shares extensions - - Duplicate key shares are disallowed - - Duplicate supported groups are disallowed + - Duplicate key shares are disallowed. + - Duplicate supported groups are disallowed. - Key shares must be sent in the order of supported groups. - Key shares will only be selected if they match the most preferred supported group by client preference order. From 4a9c3341d7003e5c24f2cc7d97ca1ab71e3271e5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 9 Apr 2024 09:07:29 -0600 Subject: [PATCH 0687/1283] Add hidden evp.h and conf.h --- crypto/Makefile.am | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 9533907fa0..89c542f250 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -632,6 +632,7 @@ noinst_HEADERS += hidden/openssl/cast.h noinst_HEADERS += hidden/openssl/chacha.h noinst_HEADERS += hidden/openssl/cmac.h noinst_HEADERS += hidden/openssl/cms.h +noinst_HEADERS += hidden/openssl/conf.h noinst_HEADERS += hidden/openssl/conf_api.h noinst_HEADERS += hidden/openssl/crypto.h noinst_HEADERS += hidden/openssl/ct.h @@ -642,6 +643,7 @@ noinst_HEADERS += hidden/openssl/dsa.h noinst_HEADERS += hidden/openssl/ec.h noinst_HEADERS += hidden/openssl/engine.h noinst_HEADERS += hidden/openssl/err.h +noinst_HEADERS += hidden/openssl/evp.h noinst_HEADERS += hidden/openssl/hkdf.h noinst_HEADERS += hidden/openssl/hmac.h noinst_HEADERS += hidden/openssl/idea.h From ff2d4b649f2dab39448a7dd5a9b7229ccb36dbf9 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 9 Apr 2024 09:45:16 -0600 Subject: [PATCH 0688/1283] Link bn_bits to regress --- .gitignore | 1 + tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 3 files changed, 11 insertions(+) diff --git a/.gitignore b/.gitignore index 6f00d6fe04..329b8c0991 100644 --- a/.gitignore +++ b/.gitignore @@ -83,6 +83,7 @@ tests/bio_host* tests/bio_mem* tests/bnaddsub* tests/bn_add_sub* +tests/bn_bits* tests/bn_cmp* tests/bn_convert* tests/bn_gcd* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 7e384bf8d7..005f6515c7 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -154,6 +154,11 @@ add_executable(bn_add_sub bn_add_sub.c) target_link_libraries(bn_add_sub ${OPENSSL_TEST_LIBS}) add_test(bn_add_sub bn_add_sub) +# bn_bits +add_executable(bn_bits bn_bits.c) +target_link_libraries(bn_bits ${OPENSSL_TEST_LIBS}) +add_test(bn_bits bn_bits) + # bn_cmp add_executable(bn_cmp bn_cmp.c) target_link_libraries(bn_cmp ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 9e462996e4..3aa748982d 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -170,6 +170,11 @@ TESTS += bn_add_sub check_PROGRAMS += bn_add_sub bn_add_sub_SOURCES = bn_add_sub.c +# bn_bits +TESTS += bn_bits +check_PROGRAMS += bn_bits +bn_bits_SOURCES = bn_bits.c + # bn_cmp TESTS += bn_cmp check_PROGRAMS += bn_cmp From f87d891109ee97caff9343016602d18a260c88f0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 9 Apr 2024 13:05:34 -0600 Subject: [PATCH 0689/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 2ed5dee219..332c5b4993 100644 --- a/ChangeLog +++ b/ChangeLog @@ -51,6 +51,8 @@ LibreSSL Portable Release Notes: performance reasons which no longer apply since BoringSSL's time conversion API isn't slow. Also, a recently added error check led to obscure, undesirable validation failures. + - Stopped calling OPENSSL_cpuid_setup() from the .init section on + amd64 and i386. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security From 8ce97109256eb6df13c091510485a83821424971 Mon Sep 17 00:00:00 2001 From: Christian Andersen Date: Mon, 1 Apr 2024 22:00:33 +0200 Subject: [PATCH 0690/1283] [Windows] Mark old_report_mode as unused When compiling in release mode the _CrtSetReportMode macro gets replaced by void(0). This makes old_report_mode unused. Silence a warning about it. --- crypto/compat/posix_win.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index 3e78a07c64..bb3e653408 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -164,9 +164,10 @@ static void noop_handler(const wchar_t *expression, const wchar_t *function, } #define BEGIN_SUPPRESS_IPH \ - int old_report_mode = _CrtSetReportMode(_CRT_ASSERT, 0); \ - _invalid_parameter_handler old_handler = _set_thread_local_invalid_parameter_handler(noop_handler) + const int old_report_mode = _CrtSetReportMode(_CRT_ASSERT, 0); \ + const _invalid_parameter_handler old_handler = _set_thread_local_invalid_parameter_handler(noop_handler) #define END_SUPPRESS_IPH \ + (void)old_report_mode; /* Silence warning in release mode when _CrtSetReportMode compiles to void. */ \ _CrtSetReportMode(_CRT_ASSERT, old_report_mode); \ _set_thread_local_invalid_parameter_handler(old_handler) From 13d2bf18d4622f185b4b5cbd5646f933503d0888 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 10 Apr 2024 22:26:10 -0600 Subject: [PATCH 0691/1283] Tweak ChangeLog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 332c5b4993..941e9cc3cd 100644 --- a/ChangeLog +++ b/ChangeLog @@ -61,7 +61,7 @@ LibreSSL Portable Release Notes: - Removed workaround for F5 middle boxes. * Bug fixes - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match - their documentation and always set an RFC 5280 conformant time. + their documentation. They always set an RFC 5280 conformant time. - Improved standards compliance for supported groups and key shares extensions - Duplicate key shares are disallowed. From 2e6ce7b0fdc584445d5bc282436505a51538bb03 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 11 Apr 2024 02:38:14 -0600 Subject: [PATCH 0692/1283] Rebase crypto_namespace.h.patch --- patches/crypto_namespace.h.patch | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/patches/crypto_namespace.h.patch b/patches/crypto_namespace.h.patch index 171e7f54cd..c18f0daa5a 100644 --- a/patches/crypto_namespace.h.patch +++ b/patches/crypto_namespace.h.patch @@ -1,5 +1,5 @@ ---- openbsd/src/lib/libcrypto/hidden/crypto_namespace.h 2023-03-15 11:41:37.614024500 -0600 -+++ crypto/hidden/crypto_namespace.h 2023-03-15 17:12:55.297157400 -0600 +--- crypto/hidden/crypto_namespace.h.orig 2024-04-09 10:12:22.320737957 +0200 ++++ crypto/hidden/crypto_namespace.h 2024-04-11 09:09:31.163350515 +0200 @@ -24,6 +24,12 @@ * external calls use the latter name. */ @@ -11,9 +11,9 @@ +# define LCRYPTO_ALIAS(x) +#else #ifdef LIBRESSL_NAMESPACE - # define LCRYPTO_UNUSED(x) typeof(x) x __attribute__((deprecated)) #ifdef LIBRESSL_CRYPTO_NAMESPACE -@@ -40,5 +46,6 @@ + # define LCRYPTO_UNUSED(x) __attribute__((deprecated)) \ +@@ -43,5 +49,6 @@ # define LCRYPTO_ALIAS1(pre,x) # define LCRYPTO_ALIAS(x) asm("") #endif From 64e0f7c5d644e55e0bbbf985335e42c4f59e615d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 15 Apr 2024 23:31:19 -0600 Subject: [PATCH 0693/1283] Unhook o_str.c --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 835bb2b672..a1c3c2e246 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -208,7 +208,6 @@ set( mem_clr.c mem_dbg.c o_fips.c - o_str.c aes/aes.c aes/aes_core.c aes/aes_ige.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 89c542f250..32dbba8e6c 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -218,7 +218,6 @@ libcrypto_la_SOURCES += malloc-wrapper.c libcrypto_la_SOURCES += mem_clr.c libcrypto_la_SOURCES += mem_dbg.c libcrypto_la_SOURCES += o_fips.c -libcrypto_la_SOURCES += o_str.c noinst_HEADERS += arm_arch.h noinst_HEADERS += constant_time.h noinst_HEADERS += cryptlib.h From b1b491410f47d7e78716d2504ff739284fcdbbd8 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 17 Apr 2024 10:27:04 -0600 Subject: [PATCH 0694/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 941e9cc3cd..79f3304e04 100644 --- a/ChangeLog +++ b/ChangeLog @@ -53,6 +53,7 @@ LibreSSL Portable Release Notes: to obscure, undesirable validation failures. - Stopped calling OPENSSL_cpuid_setup() from the .init section on amd64 and i386. + - Rewrote various BN conversion functions. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security @@ -70,6 +71,8 @@ LibreSSL Portable Release Notes: - Key shares will only be selected if they match the most preferred supported group by client preference order. - Fixed signed integer overflow in bnrand(). + - Prevent negative zero from being created via BN_clear_bit() and + BN_mask_bits(). Avoids a one byte overread in BN_bn2mpi(). 3.9.0 - Development release From a8bd03a588988394b825bdcf71c9e4381b78213f Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 25 Apr 2024 12:42:07 -0600 Subject: [PATCH 0695/1283] pem2.h headed to the bit bucket --- update.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/update.sh b/update.sh index 474a0ff52a..415c15a8fe 100755 --- a/update.sh +++ b/update.sh @@ -129,7 +129,7 @@ copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h ossl_typ.h err/err.h crypto.h comp/comp.h x509/x509.h buffer/buffer.h objects/objects.h asn1/asn1.h asn1/posix_time.h bn/bn.h ec/ec.h ecdsa/ecdsa.h ecdh/ecdh.h rsa/rsa.h sha/sha.h x509/x509_vfy.h pkcs7/pkcs7.h pem/pem.h - pem/pem2.h hkdf/hkdf.h hmac/hmac.h rand/rand.h md5/md5.h + hkdf/hkdf.h hmac/hmac.h rand/rand.h md5/md5.h x509/x509v3.h conf/conf.h ocsp/ocsp.h aes/aes.h modes/modes.h asn1/asn1t.h bf/blowfish.h bio/bio.h cast/cast.h cmac/cmac.h cms/cms.h conf/conf_api.h des/des.h dh/dh.h From d0221daff6a2dac582cf0239eb0b1930b8f8c1d3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 25 Apr 2024 12:45:38 -0600 Subject: [PATCH 0696/1283] link crypto_test to the build --- .gitignore | 1 + tests/CMakeLists.txt | 6 ++++++ tests/Makefile.am | 6 ++++++ 3 files changed, 13 insertions(+) diff --git a/.gitignore b/.gitignore index 329b8c0991..9e27a4ecef 100644 --- a/.gitignore +++ b/.gitignore @@ -104,6 +104,7 @@ tests/bn_word* tests/callback* tests/cipher* tests/constraints* +tests/crypto_test* tests/ctlog.conf tests/*.crt tests/ec_point_conversion* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 005f6515c7..e1e4a9c645 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -2,6 +2,7 @@ add_definitions(-DLIBRESSL_CRYPTO_INTERNAL) include_directories( . + ../crypto/ ../crypto/asn1 ../crypto/bio ../crypto/bn @@ -293,6 +294,11 @@ add_executable(constraints constraints.c) target_link_libraries(constraints ${OPENSSL_TEST_LIBS}) add_test(constraints constraints) +# crypto_test +add_executable(crypto_test crypto_test.c) +target_link_libraries(crypto_test ${OPENSSL_TEST_LIBS}) +add_test(crypto_test crypto_test) + # cttest add_executable(cttest cttest.c) target_link_libraries(cttest ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 3aa748982d..2f14f8f7d5 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -6,6 +6,7 @@ include $(top_srcdir)/Makefile.am.common AM_CPPFLAGS += -DLIBRESSL_CRYPTO_INTERNAL +AM_CPPFLAGS += -I $(top_srcdir)/crypto/ AM_CPPFLAGS += -I $(top_srcdir)/crypto/asn1 AM_CPPFLAGS += -I $(top_srcdir)/crypto/bio AM_CPPFLAGS += -I $(top_srcdir)/crypto/bn @@ -308,6 +309,11 @@ TESTS += constraints check_PROGRAMS += constraints constraints_SOURCES = constraints.c +# crypto_test +TESTS += crypto_test +check_PROGRAMS += crypto_test +crypto_test_SOURCES = crypto_test.c + # cttest TESTS += cttest check_PROGRAMS += cttest From 84d355b31effee09407483b1275e99fec58e4583 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 25 Apr 2024 12:54:22 -0600 Subject: [PATCH 0697/1283] Update man links --- man/links | 6 ------ 1 file changed, 6 deletions(-) diff --git a/man/links b/man/links index 3475e43a59..3f79dc33b3 100644 --- a/man/links +++ b/man/links @@ -2055,15 +2055,9 @@ X509_LOOKUP_hash_dir.3,X509_LOOKUP_file.3 X509_LOOKUP_hash_dir.3,X509_LOOKUP_mem.3 X509_LOOKUP_new.3,X509_LOOKUP_add_dir.3 X509_LOOKUP_new.3,X509_LOOKUP_add_mem.3 -X509_LOOKUP_new.3,X509_LOOKUP_by_alias.3 -X509_LOOKUP_new.3,X509_LOOKUP_by_fingerprint.3 -X509_LOOKUP_new.3,X509_LOOKUP_by_issuer_serial.3 -X509_LOOKUP_new.3,X509_LOOKUP_by_subject.3 X509_LOOKUP_new.3,X509_LOOKUP_ctrl.3 X509_LOOKUP_new.3,X509_LOOKUP_free.3 -X509_LOOKUP_new.3,X509_LOOKUP_init.3 X509_LOOKUP_new.3,X509_LOOKUP_load_file.3 -X509_LOOKUP_new.3,X509_LOOKUP_shutdown.3 X509_LOOKUP_new.3,X509_get_default_cert_dir.3 X509_LOOKUP_new.3,X509_get_default_cert_dir_env.3 X509_LOOKUP_new.3,X509_get_default_cert_file.3 From 57745591233a55b09d7014ab1fc6b0adc5806ae5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 29 Apr 2024 12:06:36 -0600 Subject: [PATCH 0698/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 79f3304e04..2cbe0aa695 100644 --- a/ChangeLog +++ b/ChangeLog @@ -60,6 +60,8 @@ LibreSSL Portable Release Notes: - Switched the remaining tests to new certs. * Compatibility changes - Removed workaround for F5 middle boxes. + - Removed the useless pem2.h, a public header that was added since + it was too hard to add a prototype to one file. * Bug fixes - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match their documentation. They always set an RFC 5280 conformant time. From 79a40fca3f851bcdf9b945bc2254ad97817e0b4e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 30 Apr 2024 12:03:31 -0600 Subject: [PATCH 0699/1283] Update man links --- man/links | 2 ++ 1 file changed, 2 insertions(+) diff --git a/man/links b/man/links index 3f79dc33b3..08041d7099 100644 --- a/man/links +++ b/man/links @@ -678,6 +678,8 @@ EC_GROUP_new.3,EC_GROUP_new_by_curve_name.3 EC_GROUP_new.3,EC_GROUP_new_curve_GFp.3 EC_GROUP_new.3,EC_GROUP_set_curve.3 EC_GROUP_new.3,EC_GROUP_set_curve_GFp.3 +EC_GROUP_new.3,EC_curve_nid2nist.3 +EC_GROUP_new.3,EC_curve_nist2nid.3 EC_GROUP_new.3,EC_get_builtin_curves.3 EC_KEY_METHOD_new.3,EC_KEY_METHOD_free.3 EC_KEY_METHOD_new.3,EC_KEY_METHOD_get_compute_key.3 From 08eefd163be1423f3378cdb685bd7bb281c46e49 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 30 Apr 2024 20:25:07 +0200 Subject: [PATCH 0700/1283] Add libtool for cmake_config CI --- .github/workflows/cmake_config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cmake_config.yml b/.github/workflows/cmake_config.yml index ed2c0afe70..3222e087bf 100644 --- a/.github/workflows/cmake_config.yml +++ b/.github/workflows/cmake_config.yml @@ -35,7 +35,7 @@ jobs: - name: Setup macOS dependencies if: runner.os == 'macOS' - run: brew install automake + run: brew install automake libtool - uses: actions/checkout@main From 410e176f2c1c02893ecfbf8465c5eea9a22d0888 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 4 May 2024 11:57:33 -0600 Subject: [PATCH 0701/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 2cbe0aa695..002b7618d3 100644 --- a/ChangeLog +++ b/ChangeLog @@ -62,6 +62,7 @@ LibreSSL Portable Release Notes: - Removed workaround for F5 middle boxes. - Removed the useless pem2.h, a public header that was added since it was too hard to add a prototype to one file. + - Only specified versions can be set on certs, CRLs and CSRs. * Bug fixes - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match their documentation. They always set an RFC 5280 conformant time. From 3f0218f4b32b5ae55f11d1faf6d3628807613a22 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 6 May 2024 10:59:21 -0600 Subject: [PATCH 0702/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 002b7618d3..5cde68c72e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -76,6 +76,9 @@ LibreSSL Portable Release Notes: - Fixed signed integer overflow in bnrand(). - Prevent negative zero from being created via BN_clear_bit() and BN_mask_bits(). Avoids a one byte overread in BN_bn2mpi(). + - Add guard to avoid contracting the number linear hash buckets + to zero, which could lead to a crash due to accessing a zero + sized allocation. 3.9.0 - Development release From 1892ae76dfc41a7b2c10f4bb91868ffd2b6e6aca Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 6 May 2024 11:03:08 -0600 Subject: [PATCH 0703/1283] Link lhash_test to build --- .gitignore | 1 + tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 3 files changed, 11 insertions(+) diff --git a/.gitignore b/.gitignore index 9e27a4ecef..0bc4f02fe8 100644 --- a/.gitignore +++ b/.gitignore @@ -115,6 +115,7 @@ tests/explicit_bzero* tests/freenull* tests/gost2814789t* tests/key_schedule* +tests/lhash_test* tests/mont* tests/policy* tests/rfc3779* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index e1e4a9c645..6861bd364a 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -467,6 +467,11 @@ add_test(keypairtest keypairtest ${CMAKE_CURRENT_SOURCE_DIR}/server1-rsa.pem ${CMAKE_CURRENT_SOURCE_DIR}/server1-rsa.pem) +# lhash_test +add_executable(lhash_test lhash_test.c) +target_link_libraries(lhash_test ${OPENSSL_TEST_LIBS}) +add_test(lhash_test lhash_test) + # md_test add_executable(md_test md_test.c) target_link_libraries(md_test ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 2f14f8f7d5..57e2acfcfe 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -484,6 +484,11 @@ check_PROGRAMS += keypairtest keypairtest_SOURCES = keypairtest.c EXTRA_DIST += keypairtest.sh +# lhash_test +TESTS += lhash_test +check_PROGRAMS += lhash_test +lhash_test_SOURCES = lhash_test.c + # md_test TESTS += md_test check_PROGRAMS += md_test From 1a424b31f6bfb38b9fd25aaf2b9a2d593f8f6bd8 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 8 May 2024 12:29:14 -0600 Subject: [PATCH 0704/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 5cde68c72e..a092823042 100644 --- a/ChangeLog +++ b/ChangeLog @@ -63,6 +63,7 @@ LibreSSL Portable Release Notes: - Removed the useless pem2.h, a public header that was added since it was too hard to add a prototype to one file. - Only specified versions can be set on certs, CRLs and CSRs. + - Prepared X509_REQ_{get,set}_extension_nids() for removal. * Bug fixes - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match their documentation. They always set an RFC 5280 conformant time. From cbacfb4f0695b0859c44552d146e1c2a3ca8065a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 9 May 2024 16:08:43 -0600 Subject: [PATCH 0705/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index a092823042..0d713a0edf 100644 --- a/ChangeLog +++ b/ChangeLog @@ -54,6 +54,7 @@ LibreSSL Portable Release Notes: - Stopped calling OPENSSL_cpuid_setup() from the .init section on amd64 and i386. - Rewrote various BN conversion functions. + - Improved certification request internals. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security From 2b57096119552107e580b45f28d4af0c6a460fef Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 11 May 2024 07:16:25 -0600 Subject: [PATCH 0706/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 0d713a0edf..87449d60cb 100644 --- a/ChangeLog +++ b/ChangeLog @@ -55,6 +55,7 @@ LibreSSL Portable Release Notes: amd64 and i386. - Rewrote various BN conversion functions. - Improved certification request internals. + - Removed unused DSA methods. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security @@ -65,6 +66,7 @@ LibreSSL Portable Release Notes: it was too hard to add a prototype to one file. - Only specified versions can be set on certs, CRLs and CSRs. - Prepared X509_REQ_{get,set}_extension_nids() for removal. + - Removed unused PEM_USER and PEM_CTX types from pem.h. * Bug fixes - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match their documentation. They always set an RFC 5280 conformant time. From fa24a41a094978e7e926604279dea44e9972d761 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 13 May 2024 10:39:04 -0600 Subject: [PATCH 0707/1283] Update man links --- man/links | 1 + 1 file changed, 1 insertion(+) diff --git a/man/links b/man/links index 08041d7099..c187ed16db 100644 --- a/man/links +++ b/man/links @@ -1999,6 +1999,7 @@ X25519.3,ED25519_keypair.3 X25519.3,ED25519_sign.3 X25519.3,ED25519_verify.3 X25519.3,X25519_keypair.3 +X509V3_EXT_get_nid.3,X509V3_EXT_get.3 X509V3_get_d2i.3,X509V3_EXT_d2i.3 X509V3_get_d2i.3,X509V3_EXT_i2d.3 X509V3_get_d2i.3,X509V3_add1_i2d.3 From f4018bc3947b97d720deb2e6f1f4b733725ad578 Mon Sep 17 00:00:00 2001 From: Ilia Shipitsin Date: Fri, 17 May 2024 20:22:23 +0200 Subject: [PATCH 0708/1283] CI: introduce Ubuntu 24.04 --- .github/workflows/linux.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 180f43cb13..57222df1ef 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -22,7 +22,7 @@ jobs: strategy: fail-fast: false matrix: - os: ["ubuntu-20.04", "ubuntu-22.04"] + os: ["ubuntu-20.04", "ubuntu-22.04", "ubuntu-24.04"] arch: ["native", "arm32", "arm64", "mingw32", "mingw64", "mips32", "mips64"] compiler: ["gcc"] include: From 5a0c55e5c779a175117eaf1f7ed06c069aef6935 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 22 May 2024 08:22:08 -0600 Subject: [PATCH 0709/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 87449d60cb..040c0563e5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -159,6 +159,7 @@ LibreSSL Portable Release Notes: - Aligned SSL_shutdown() behavior in TLSv1.3 with the legacy stack. - Fixed the new X.509 verifier to find trust anchors in the trusted stack. + - Made in-place decryption work for EVP_chacha20_poly1305(). 3.8.3 - Stable release From 53120acdbd96110f8bb0be4f4cd86160226c240c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 24 May 2024 13:24:19 -0600 Subject: [PATCH 0710/1283] bye bye enc_writ.c --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index a1c3c2e246..5c0f3e6b2e 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -369,7 +369,6 @@ set( des/ecb_enc.c des/ede_cbcm_enc.c des/enc_read.c - des/enc_writ.c des/fcrypt.c des/fcrypt_b.c des/ofb64ede.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 32dbba8e6c..81d4524d9e 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -496,7 +496,6 @@ libcrypto_la_SOURCES += des/ecb3_enc.c libcrypto_la_SOURCES += des/ecb_enc.c libcrypto_la_SOURCES += des/ede_cbcm_enc.c libcrypto_la_SOURCES += des/enc_read.c -libcrypto_la_SOURCES += des/enc_writ.c libcrypto_la_SOURCES += des/fcrypt.c libcrypto_la_SOURCES += des/fcrypt_b.c EXTRA_libcrypto_la_SOURCES += des/ncbc_enc.c From f785e2954a847ebaa8559b65c2b5030489ce5556 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 25 May 2024 00:28:47 -0600 Subject: [PATCH 0711/1283] Update man links --- man/links | 2 -- 1 file changed, 2 deletions(-) diff --git a/man/links b/man/links index c187ed16db..c07d534954 100644 --- a/man/links +++ b/man/links @@ -551,8 +551,6 @@ DES_set_key.3,DES_ede3_cbc_encrypt.3 DES_set_key.3,DES_ede3_cbcm_encrypt.3 DES_set_key.3,DES_ede3_cfb64_encrypt.3 DES_set_key.3,DES_ede3_ofb64_encrypt.3 -DES_set_key.3,DES_enc_read.3 -DES_set_key.3,DES_enc_write.3 DES_set_key.3,DES_fcrypt.3 DES_set_key.3,DES_is_weak_key.3 DES_set_key.3,DES_key_sched.3 From ac75aab32321a1c4f469018d9b3596fd89f5bf14 Mon Sep 17 00:00:00 2001 From: Christian Andersen Date: Tue, 9 Apr 2024 21:39:21 +0200 Subject: [PATCH 0712/1283] Remove the dist-win compilation script With the CMake version of building for windows there is support for building with MINGW, clang, and Visual Studio. CMake can build for MINGW using the regular method of autogen and CMake. Removing this makes it a bit simpler to get an overview of how to build for windows. Reducing confusion. --- README.windows | 22 ---------------------- dist-win.sh | 48 ------------------------------------------------ 2 files changed, 70 deletions(-) delete mode 100755 dist-win.sh diff --git a/README.windows b/README.windows index 4d74a2eba8..2d342fa31c 100644 --- a/README.windows +++ b/README.windows @@ -41,25 +41,3 @@ use the new ABI. 64-bit systems always have a 64-bit time_t and are not affected by this problem. - -# Using Libressl with Visual Studio - -A script for generating ready-to-use .DLL and static .LIB files is included in -the source repository at -https://github.com/libressl/portable/blob/master/dist-win.sh - -This script uses mingw-w64 to build LibreSSL and then uses Visual Studio tools -to generate compatible library import files ready-to-use with Visual -Studio projects. Static and dynamic libraries are included. The script uses -cv2pdb to generate Visual Studio and windbg compatible debug files. cv2pdb is a -tool developed for the D language and can be found here: -https://github.com/rainers/cv2pdb - -The mingw-w64 code is largely, but not 100%, compatible with code built from -Visual Studio. Notably, FILE * pointers cannot be shared between code built for -Mingw-w64 and Visual Studio. - -As of LibreSSL 2.2.2, Visual Studio Native builds can also be produced using -CMake. This produces ABI-compatible libraries for linking with native code -generated by Visual Studio. Currently tested versions are VS 2019 and 2022, -though earlier versions may work as well. diff --git a/dist-win.sh b/dist-win.sh deleted file mode 100755 index e4e0fd025d..0000000000 --- a/dist-win.sh +++ /dev/null @@ -1,48 +0,0 @@ -#!/bin/bash -set -e -#set -x - -export PATH=/cygdrive/c/Program\ Files\ \(x86\)/Microsoft\ Visual\ Studio\ 12.0/VC/bin:$PATH -VERSION=`cat VERSION` -DIST=libressl-$VERSION-windows - -rm -fr $DIST -mkdir -p $DIST -autoreconf -i - -for ARCH in X86 X64; do - - if [ $ARCH = X86 ]; then - HOST=i686-w64-mingw32 - ARCHDIR=x86 - else - HOST=x86_64-w64-mingw32 - ARCHDIR=x64 - fi - - echo Building for $HOST - - CC=$HOST-gcc ./configure --host=$HOST --with-openssldir=c:/libressl/ssl - make clean - PATH=$PATH:/usr/$HOST/sys-root/mingw/bin \ - make -j 4 check - make -j 4 install DESTDIR=`pwd`/stage-$ARCHDIR - - mkdir -p $DIST/$ARCHDIR - if [ ! -e $DIST/include ]; then - cp -r stage-$ARCHDIR/usr/local/include $DIST - fi - - cp stage-$ARCHDIR/usr/local/bin/* $DIST/$ARCHDIR - - for i in libcrypto libssl libtls; do - DLL=$(basename `ls -1 $DIST/$ARCHDIR/$i*.dll`|cut -d. -f1) - echo EXPORTS > $DLL.def - dumpbin /exports $DIST/$ARCHDIR/$DLL.dll | \ - awk '{print $4}' | awk 'NF' |tail -n +9 >> $DLL.def - lib /MACHINE:$ARCH /def:$DLL.def /out:$DIST/$ARCHDIR/$DLL.lib - cv2pdb $DIST/$ARCHDIR/$DLL.dll - done -done - -zip -r $DIST.zip $DIST From ad6e77ca9fe3da77a23b6b89e9678c92663c9cc8 Mon Sep 17 00:00:00 2001 From: Christian Andersen Date: Tue, 9 Apr 2024 21:44:41 +0200 Subject: [PATCH 0713/1283] Rename README.windows to README.mingw.md Since it is mingw specific and does not really involve other compilers. --- Makefile.am | 2 +- README.md | 2 +- README.windows => README.mingw.md | 4 ++-- m4/check-os-options.m4 | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) rename README.windows => README.mingw.md (93%) diff --git a/Makefile.am b/Makefile.am index 2edef0db5a..3f62cd9697 100644 --- a/Makefile.am +++ b/Makefile.am @@ -10,7 +10,7 @@ if !ENABLE_LIBTLS_ONLY pkgconfig_DATA += libcrypto.pc libssl.pc openssl.pc endif -EXTRA_DIST = README.md README.windows VERSION config scripts +EXTRA_DIST = README.md README.mingw.md VERSION config scripts EXTRA_DIST += CMakeLists.txt cmake_export_symbol.cmake cmake_uninstall.cmake.in FindLibreSSL.cmake LibreSSLConfig.cmake.in EXTRA_DIST += cert.pem openssl.cnf x509v3.cnf diff --git a/README.md b/README.md index ab159aba8d..9c071756d4 100644 --- a/README.md +++ b/README.md @@ -134,7 +134,7 @@ make LibreSSL builds against relatively recent versions of Mingw-w64, not to be confused with the original mingw.org project. Mingw-w64 3.2 or later -should work. See README.windows for more information +should work. See README.mingw.md for more information. #### Windows - Visual Studio diff --git a/README.windows b/README.mingw.md similarity index 93% rename from README.windows rename to README.mingw.md index 2d342fa31c..7c567bcfb8 100644 --- a/README.windows +++ b/README.mingw.md @@ -1,4 +1,4 @@ -# Building +## Building with mingw-w64 for 32- and 64-bit For Windows systems, LibreSSL supports the mingw-w64 toolchain, which can use GCC or Clang as the compiler. Contrary to its name, mingw-w64 supports both @@ -23,7 +23,7 @@ For 64-bit builds, use these instead: make make check -# Why the -D__MINGW_USE_VC2005_COMPAT flag on 32-bit systems? +### Why the -D__MINGW_USE_VC2005_COMPAT flag on 32-bit systems? An ABI change introduced with Microsoft Visual C++ 2005 (also known as Visual C++ 8.0) switched time_t from 32-bit to 64-bit. It is important to diff --git a/m4/check-os-options.m4 b/m4/check-os-options.m4 index 77edd14c91..3775b79ba9 100644 --- a/m4/check-os-options.m4 +++ b/m4/check-os-options.m4 @@ -145,7 +145,7 @@ if test "$ac_cv_sizeof_time_t" = "4"; then if test "$host_os" = "mingw32" ; then echo " **" echo " ** You can solve this by adjusting the build flags in your" - echo " ** mingw-w64 toolchain. Refer to README.windows for details." + echo " ** mingw-w64 toolchain. Refer to README.mingw.md for details." fi fi From 937a3d920ead4c5a8bff162bbc719f39208988ee Mon Sep 17 00:00:00 2001 From: Christian Andersen Date: Tue, 9 Apr 2024 22:14:04 +0200 Subject: [PATCH 0714/1283] Try to simplify build instruction. In particular simplify the Windows build instructions, by only having a short CMake section about it. While mentioning that bash shell is required also on Windows up-front. Splits the build section into a section for configure and one for CMake so it is easier to pick one of them. Moves the additional CMake options into the CMake section. Moves dist.sh text into the configure section as it is configure specific. --- README.md | 96 +++++++++++++++++++++++-------------------------- README.mingw.md | 16 ++++----- 2 files changed, 52 insertions(+), 60 deletions(-) diff --git a/README.md b/README.md index 9c071756d4..b4fff87c4d 100644 --- a/README.md +++ b/README.md @@ -49,7 +49,7 @@ LibreSSL also supports the following Windows environments: * Microsoft Windows (Windows 7 / Windows Server 2008r2 or later, x86 and x64) * Wine (32-bit and 64-bit) -* Mingw-w64, Cygwin, and Visual Studio +* MinGW-w64, Cygwin, and Visual Studio Official release tarballs are available at your friendly neighborhood OpenBSD mirror in directory @@ -68,27 +68,24 @@ sent to the core team at libressl-security@openbsd.org. # Building LibreSSL -## Prerequisites when building from a Git checkout +## Building from a Git checkout -If you have checked this source using Git, or have downloaded a source tarball -from GitHub, follow these initial steps to prepare the source tree for +If you have checked out this source using Git, or have downloaded a source +tarball from GitHub, follow these initial steps to prepare the source tree for building. _Note: Your build will fail if you do not follow these instructions! -If you cannot follow these instructions (e.g. Windows system using CMake) or -cannot meet these prerequistes, please download an official release distribution -from https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/ instead. Using official +If you cannot follow these instructions or cannot meet these prerequisites, +please download an official release distribution from +https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/ instead. Using official releases is strongly advised if you are not a developer._ -1. Ensure you have the following packages installed: - automake, autoconf, git, libtool, perl -2. Run `./autogen.sh` to prepare the source tree for building or - run `./dist.sh` to prepare a tarball. +1. Ensure that you have a bash shell. This is also required on Windows. +2. Ensure that you have the following packages installed: + automake, autoconf, git, libtool, perl. +3. Run `./autogen.sh` to prepare the source tree for building. -## Steps that apply to all builds +## Build steps using configure -Once you have a source tree, either by downloaded using git and having -run the `autogen.sh` script above, or by downloading a release distribution from -an OpenBSD mirror, run these commands to build and install the package on most -systems: +Once you have the source tree prepared, run these commands to build and install: ```sh ./configure # see ./configure --help for configuration options @@ -96,7 +93,11 @@ make check # runs builtin unit tests make install # set DESTDIR= to install to an alternate location ``` -If you wish to use the CMake build system, use these commands: +Alternatively, it is possible to run `./dist.sh` to prepare a tarball. + +## Build steps using CMake + +Once you have the source tree prepared, run these commands to build and install: ```sh mkdir build @@ -106,7 +107,7 @@ make make test ``` -For faster builds, you can use Ninja as well: +For faster builds, you can use Ninja: ```sh mkdir build-ninja @@ -116,44 +117,15 @@ ninja ninja test ``` -### OS specific build information - -#### HP-UX (11i) - -Set the UNIX_STD environment variable to `2003` before running `configure` -in order to build with the HP C/aC++ compiler. See the "standards(5)" man -page for more details. - -```sh -export UNIX_STD=2003 -./configure -make -``` - -#### Windows - Mingw-w64 - -LibreSSL builds against relatively recent versions of Mingw-w64, not to be -confused with the original mingw.org project. Mingw-w64 3.2 or later -should work. See README.mingw.md for more information. - -#### Windows - Visual Studio - -LibreSSL builds using the CMake target "Visual Studio 12 2013" and newer. To -generate a Visual Studio project, install CMake, enter the LibreSSL source -directory and run: +Or another supported build system like Visual Studio: ```sh -./update.sh -mkdir build-vs2013 -cd build-vs2013 -cmake -G"Visual Studio 12 2013" .. +mkdir build-vs2022 +cd build-vs2022 +cmake -G"Visual Studio 17 2022" .. ``` -Replace "Visual Studio 12 2013" with whatever version of Visual Studio you -have installed. This will generate a LibreSSL.sln file that you can incorporate -into other projects or build by itself. - -#### CMake - Additional Options +#### Additional CMake Options | Option Name | Default | Description | |-------------------------|--------:|-----------------------------------------------------------------------------------------------------------------| @@ -166,6 +138,26 @@ into other projects or build by itself. | `ENABLE_NC` | `OFF` | Enable installing TLS-enabled nc(1) | | `OPENSSLDIR` | Blank | Set the default openssl directory. Can be specified from command line using
```-DOPENSSLDIR=``` | +## Build information for specific systems + +### HP-UX (11i) + +Set the UNIX_STD environment variable to `2003` before running `configure` +in order to build with the HP C/aC++ compiler. See the "standards(5)" man +page for more details. + +```sh +export UNIX_STD=2003 +./configure +make +``` + +### MinGW-w64 - Windows + +LibreSSL builds against relatively recent versions of [MinGW-w64](https://www.mingw-w64.org/), not to be +confused with the original mingw.org project. MinGW-w64 3.2 or later +should work. See [README.mingw.md](README.mingw.md) for more information. + # Using LibreSSL ## CMake diff --git a/README.mingw.md b/README.mingw.md index 7c567bcfb8..a90de5f32c 100644 --- a/README.mingw.md +++ b/README.mingw.md @@ -1,13 +1,13 @@ -## Building with mingw-w64 for 32- and 64-bit +## Building with MinGW-w64 for 32- and 64-bit -For Windows systems, LibreSSL supports the mingw-w64 toolchain, which can use -GCC or Clang as the compiler. Contrary to its name, mingw-w64 supports both -32-bit and 64-bit build environments. If your project already uses mingw-w64, -then LibreSSL should integrate very nicely. Old versions of the mingw-w64 +For Windows systems, LibreSSL supports the MinGW-w64 toolchain, which can use +GCC or Clang as the compiler. Contrary to its name, MinGW-w64 supports both +32-bit and 64-bit build environments. If your project already uses MinGW-w64, +then LibreSSL should integrate very nicely. Old versions of the MinGW-w64 toolchain, such as the one packaged with Ubuntu 12.04, may have trouble building LibreSSL. Please try it with a recent toolchain if you encounter -troubles. Cygwin provides an easy method of installing the latest mingw-w64 -cross compilers on Windows. +troubles. Cygwin provides an easy method of installing the latest MinGW-w64 +cross-compilers on Windows. To configure and build LibreSSL for a 32-bit system, use the following build steps: @@ -36,7 +36,7 @@ expiry date is set past 19 January 2038, it will be unable to tell if the certificate has expired or not, and thus take the safe stance and reject it. In order to avoid this, you need to build LibreSSL (and everything that links -with it) with the -D__MINGW_USE_VC2005_COMPAT flag. This tells mingw-w64 to +with it) with the -D__MINGW_USE_VC2005_COMPAT flag. This tells MinGW-w64 to use the new ABI. 64-bit systems always have a 64-bit time_t and are not affected by this From f9874d49f651177d643cc86f8837db44c4a29558 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 25 May 2024 08:56:45 +0200 Subject: [PATCH 0715/1283] Remove timegm() compat Now that all uses of gmtime_r() and timegm() have been converted to OPENSSL_gmtime() and OPENSSL_timegm(), this is no longer needed. --- .gitignore | 1 - CMakeLists.txt | 5 - crypto/CMakeLists.txt | 5 - crypto/Makefile.am | 4 - crypto/compat/timegm.c | 220 ----------------------------------------- include/compat/time.h | 9 -- m4/check-libc.m4 | 1 - 7 files changed, 245 deletions(-) delete mode 100644 crypto/compat/timegm.c diff --git a/.gitignore b/.gitignore index 0bc4f02fe8..678e87d5fc 100644 --- a/.gitignore +++ b/.gitignore @@ -241,7 +241,6 @@ include/openssl/*.h !/crypto/compat/getpagesize.c !/crypto/compat/posix_win.c !/crypto/compat/bsd_asprintf.c -!/crypto/compat/timegm.c !/crypto/compat/ui_openssl_win.c !/crypto/compat/crypto_lock_win.c !/crypto/CMakeLists.txt diff --git a/CMakeLists.txt b/CMakeLists.txt index 95fe60154f..438e6229a4 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -255,11 +255,6 @@ if(HAVE_STRTONUM) add_definitions(-DHAVE_STRTONUM) endif() -check_function_exists(timegm HAVE_TIMEGM) -if(HAVE_TIMEGM) - add_definitions(-DHAVE_TIMEGM) -endif() - check_function_exists(arc4random_buf HAVE_ARC4RANDOM_BUF) if(HAVE_ARC4RANDOM_BUF) add_definitions(-DHAVE_ARC4RANDOM_BUF) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 5c0f3e6b2e..b3e09b3430 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -721,11 +721,6 @@ if(NOT HAVE_SYSLOG_R) set(COMPAT_SRC ${COMPAT_SRC} compat/syslog_r.c) endif() -if(NOT HAVE_TIMEGM) - # XXX - Remove after next bump once libtls, ocspcheck, and asn1time are fixed. - set(COMPAT_SRC ${COMPAT_SRC} compat/timegm.c) -endif() - if(NOT HAVE_EXPLICIT_BZERO) if(WIN32) set(COMPAT_SRC ${COMPAT_SRC} compat/explicit_bzero_win.c) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 81d4524d9e..08c632dcad 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -147,10 +147,6 @@ endif endif endif -if !HAVE_TIMEGM -libcompat_la_SOURCES += compat/timegm.c -endif - if !HAVE_REALLOCARRAY libcompat_la_SOURCES += compat/reallocarray.c endif diff --git a/crypto/compat/timegm.c b/crypto/compat/timegm.c deleted file mode 100644 index 2658445fce..0000000000 --- a/crypto/compat/timegm.c +++ /dev/null @@ -1,220 +0,0 @@ -/* - * ---------------------------------------------------------------------- - * Copyright © 2005-2014 Rich Felker, et al. - * - * Permission is hereby granted, free of charge, to any person obtaining - * a copy of this software and associated documentation files (the - * "Software"), to deal in the Software without restriction, including - * without limitation the rights to use, copy, modify, merge, publish, - * distribute, sublicense, and/or sell copies of the Software, and to - * permit persons to whom the Software is furnished to do so, subject to - * the following conditions: - * - * The above copyright notice and this permission notice shall be - * included in all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, - * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF - * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. - * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY - * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, - * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE - * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - * ---------------------------------------------------------------------- - */ - -#include -#include -#include - -/* 2000-03-01 (mod 400 year, immediately after feb29 */ -#define LEAPOCH (946684800LL + 86400*(31+29)) - -#define DAYS_PER_400Y (365*400 + 97) -#define DAYS_PER_100Y (365*100 + 24) -#define DAYS_PER_4Y (365*4 + 1) - -static int __month_to_secs(int month, int is_leap) -{ - static const int secs_through_month[] = { - 0, 31*86400, 59*86400, 90*86400, - 120*86400, 151*86400, 181*86400, 212*86400, - 243*86400, 273*86400, 304*86400, 334*86400 }; - int t = secs_through_month[month]; - if (is_leap && month >= 2) t+=86400; - return t; -} - -static long long __year_to_secs(long long year, int *is_leap) -{ - if (year-2ULL <= 136) { - int y = year; - int leaps = (y-68)>>2; - if (!((y-68)&3)) { - leaps--; - if (is_leap) *is_leap = 1; - } else if (is_leap) *is_leap = 0; - return 31536000*(y-70) + 86400*leaps; - } - - int cycles, centuries, leaps, rem; - - if (!is_leap) is_leap = &(int){0}; - cycles = (year-100) / 400; - rem = (year-100) % 400; - if (rem < 0) { - cycles--; - rem += 400; - } - if (!rem) { - *is_leap = 1; - centuries = 0; - leaps = 0; - } else { - if (rem >= 200) { - if (rem >= 300) centuries = 3, rem -= 300; - else centuries = 2, rem -= 200; - } else { - if (rem >= 100) centuries = 1, rem -= 100; - else centuries = 0; - } - if (!rem) { - *is_leap = 0; - leaps = 0; - } else { - leaps = rem / 4U; - rem %= 4U; - *is_leap = !rem; - } - } - - leaps += 97*cycles + 24*centuries - *is_leap; - - return (year-100) * 31536000LL + leaps * 86400LL + 946684800 + 86400; -} - -static long long __tm_to_secs(const struct tm *tm) -{ - int is_leap; - long long year = tm->tm_year; - int month = tm->tm_mon; - if (month >= 12 || month < 0) { - int adj = month / 12; - month %= 12; - if (month < 0) { - adj--; - month += 12; - } - year += adj; - } - long long t = __year_to_secs(year, &is_leap); - t += __month_to_secs(month, is_leap); - t += 86400LL * (tm->tm_mday-1); - t += 3600LL * tm->tm_hour; - t += 60LL * tm->tm_min; - t += tm->tm_sec; - return t; -} - -static int __secs_to_tm(long long t, struct tm *tm) -{ - long long days, secs; - int remdays, remsecs, remyears; - int qc_cycles, c_cycles, q_cycles; - int years, months; - int wday, yday, leap; - static const char days_in_month[] = {31,30,31,30,31,31,30,31,30,31,31,29}; - - /* Reject time_t values whose year would overflow int */ - if (t < INT_MIN * 31622400LL || t > INT_MAX * 31622400LL) - return -1; - - secs = t - LEAPOCH; - days = secs / 86400; - remsecs = secs % 86400; - if (remsecs < 0) { - remsecs += 86400; - days--; - } - - wday = (3+days)%7; - if (wday < 0) wday += 7; - - qc_cycles = days / DAYS_PER_400Y; - remdays = days % DAYS_PER_400Y; - if (remdays < 0) { - remdays += DAYS_PER_400Y; - qc_cycles--; - } - - c_cycles = remdays / DAYS_PER_100Y; - if (c_cycles == 4) c_cycles--; - remdays -= c_cycles * DAYS_PER_100Y; - - q_cycles = remdays / DAYS_PER_4Y; - if (q_cycles == 25) q_cycles--; - remdays -= q_cycles * DAYS_PER_4Y; - - remyears = remdays / 365; - if (remyears == 4) remyears--; - remdays -= remyears * 365; - - leap = !remyears && (q_cycles || !c_cycles); - yday = remdays + 31 + 28 + leap; - if (yday >= 365+leap) yday -= 365+leap; - - years = remyears + 4*q_cycles + 100*c_cycles + 400*qc_cycles; - - for (months=0; days_in_month[months] <= remdays; months++) - remdays -= days_in_month[months]; - - if (years+100 > INT_MAX || years+100 < INT_MIN) - return -1; - - tm->tm_year = years + 100; - tm->tm_mon = months + 2; - if (tm->tm_mon >= 12) { - tm->tm_mon -=12; - tm->tm_year++; - } - tm->tm_mday = remdays + 1; - tm->tm_wday = wday; - tm->tm_yday = yday; - - tm->tm_hour = remsecs / 3600; - tm->tm_min = remsecs / 60 % 60; - tm->tm_sec = remsecs % 60; - - return 0; -} - -#ifdef _WIN32 -struct tm *__gmtime_r(const time_t *t, struct tm *tm) -{ - if (__secs_to_tm(*t, tm) < 0) { - errno = EOVERFLOW; - return 0; - } - tm->tm_isdst = 0; - return tm; -} -#endif - -time_t timegm(struct tm *tm) -{ - struct tm new; - long long t = __tm_to_secs(tm); - if (__secs_to_tm(t, &new) < 0) { - errno = EOVERFLOW; - return -1; - } -#if SIZEOF_TIME_T != 8 - if (t > (long long)INT_MAX || t < (long long)INT_MIN) { - errno = EOVERFLOW; - return -1; - } -#endif - *tm = new; - tm->tm_isdst = 0; - return t; -} diff --git a/include/compat/time.h b/include/compat/time.h index 27485218fb..a0f6d298a3 100644 --- a/include/compat/time.h +++ b/include/compat/time.h @@ -24,15 +24,6 @@ #ifndef LIBCRYPTOCOMPAT_TIME_H #define LIBCRYPTOCOMPAT_TIME_H -#ifdef _WIN32 -struct tm *__gmtime_r(const time_t * t, struct tm * tm); -#define gmtime_r(tp, tm) __gmtime_r(tp, tm) -#endif - -#ifndef HAVE_TIMEGM -time_t timegm(struct tm *tm); -#endif - #ifndef CLOCK_MONOTONIC #define CLOCK_MONOTONIC CLOCK_REALTIME #endif diff --git a/m4/check-libc.m4 b/m4/check-libc.m4 index 50fb8e13d1..40df15bc49 100644 --- a/m4/check-libc.m4 +++ b/m4/check-libc.m4 @@ -37,7 +37,6 @@ AM_CONDITIONAL([HAVE_STRNDUP], [test "x$ac_cv_func_strndup" = xyes]) AM_CONDITIONAL([HAVE_STRNLEN], [test "x$ac_cv_func_strnlen" = xyes]) AM_CONDITIONAL([HAVE_STRSEP], [test "x$ac_cv_func_strsep" = xyes]) AM_CONDITIONAL([HAVE_STRTONUM], [test "x$ac_cv_func_strtonum" = xyes]) -AM_CONDITIONAL([HAVE_TIMEGM], [test "x$ac_cv_func_timegm" = xyes]) AM_CONDITIONAL([HAVE_GETPROGNAME], [test "x$ac_cv_func_getprogname" = xyes]) AM_CONDITIONAL([HAVE_SYSLOG], [test "x$ac_cv_func_syslog" = xyes]) AM_CONDITIONAL([HAVE_SYSLOG_R], [test "x$ac_cv_func_syslog_r" = xyes]) From c6c43a4aef9ff5b6f2dcfe73aa911e628f5d00a8 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 25 May 2024 08:00:38 -0600 Subject: [PATCH 0716/1283] tweak ChangeLog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 040c0563e5..c153b7fb5d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -71,7 +71,7 @@ LibreSSL Portable Release Notes: - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match their documentation. They always set an RFC 5280 conformant time. - Improved standards compliance for supported groups and key shares - extensions + extensions: - Duplicate key shares are disallowed. - Duplicate supported groups are disallowed. - Key shares must be sent in the order of supported groups. From 03d54d8c9dde74c4994d31467394912246af58be Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 25 May 2024 13:30:24 -0600 Subject: [PATCH 0717/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index c153b7fb5d..7c8ed65cee 100644 --- a/ChangeLog +++ b/ChangeLog @@ -31,6 +31,8 @@ LibreSSL Portable Release Notes: 4.0.0 - In development * Portable changes + - Removed timegm() compatibility layer since all uses were replaced + with OPENSSL_timegm(). Clean up the corresponding test harness. * Internal improvements - Cleaned up parts of the conf directory. Simplified some logic, fixed memory leaks. From 7f39dda15a1232ae253680c07a17a0845c365ef1 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 25 May 2024 20:10:43 +0200 Subject: [PATCH 0718/1283] Clean up the time_t test mess The RFC 5280 test now passes also with small time_t. The ASN.1 time test now has a test case that makes it fail for small time t. In that case use a wrapper script that prins why the test is expected to fail and makes the test suite fail if it passes. --- tests/CMakeLists.txt | 9 ++++----- tests/Makefile.am | 14 ++++++++------ tests/asn1time_small.test | 10 ++++++++++ tests/rfc5280time_small.test | 10 ---------- 4 files changed, 22 insertions(+), 21 deletions(-) create mode 100755 tests/asn1time_small.test delete mode 100755 tests/rfc5280time_small.test diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 6861bd364a..3497cb556b 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -101,6 +101,9 @@ add_test(asn1test asn1test) add_executable(asn1time asn1time.c) target_link_libraries(asn1time ${OPENSSL_TEST_LIBS}) add_test(asn1time asn1time) +if(SMALL_TIME_T) + set_property(TEST asn1time PROPERTY WILL_FAIL TRUE) +endif() # asn1x509 add_executable(asn1x509 asn1x509.c) @@ -584,11 +587,7 @@ add_test(rfc3779 rfc3779) # rfc5280time add_executable(rfc5280time rfc5280time.c) target_link_libraries(rfc5280time ${OPENSSL_TEST_LIBS}) -if(SMALL_TIME_T) - add_test(rfc5280time ${CMAKE_CURRENT_SOURCE_DIR}/rfc5280time_small.test) -else() - add_test(rfc5280time rfc5280time) -endif() +add_test(rfc5280time rfc5280time) # rmd_test add_executable(rmd_test rmd_test.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index 57e2acfcfe..0e19106896 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -32,6 +32,7 @@ LDADD = libtest.la $(PLATFORM_LDADD) $(PROG_LDADD) TEST_LOG_DRIVER = env AM_TAP_AWK='$(AWK)' $(SHELL) $(top_srcdir)/tap-driver.sh TESTS = +XFAIL_TESTS = check_PROGRAMS = EXTRA_DIST = CMakeLists.txt DISTCLEANFILES = pidwraptest.txt @@ -119,9 +120,15 @@ check_PROGRAMS += asn1test asn1test_SOURCES = asn1test.c # asn1time -TESTS += asn1time check_PROGRAMS += asn1time asn1time_SOURCES = asn1time.c +if SMALL_TIME_T +TESTS += asn1time_small.test +XFAIL_TESTS += asn1time_small.test +else +TESTS += asn1time +endif +EXTRA_DIST += asn1time_small.test # asn1x509 TESTS += asn1x509 @@ -617,12 +624,7 @@ rfc3779_SOURCES = rfc3779.c # rfc5280time check_PROGRAMS += rfc5280time rfc5280time_SOURCES = rfc5280time.c -if SMALL_TIME_T -TESTS += rfc5280time_small.test -else TESTS += rfc5280time -endif -EXTRA_DIST += rfc5280time_small.test # rmd_test TESTS += rmd_test diff --git a/tests/asn1time_small.test b/tests/asn1time_small.test new file mode 100755 index 0000000000..94fbebfc02 --- /dev/null +++ b/tests/asn1time_small.test @@ -0,0 +1,10 @@ +#!/bin/sh +echo 1..1 +TEST=./asn1time +if [ -e ./asn1time.exe ]; then + TEST=./asn1time.exe +fi + +# map test failure to XFAIL and success to XPASS +$TEST || echo -n "not " +echo "ok # this system is unable to represent times past 2038" diff --git a/tests/rfc5280time_small.test b/tests/rfc5280time_small.test deleted file mode 100755 index 3730597863..0000000000 --- a/tests/rfc5280time_small.test +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/sh -set -e -echo 1..2 -TEST=./rfc5280time -if [ -e ./rfc5280time.exe ]; then - TEST=./rfc5280time.exe -fi -$TEST -echo "ok 1" -echo "ok 2 - rfc5280time_64-bit # SKIP this system is unable to represent times past 2038" From 1fec7bea51f6537276aef9d5d95d67b11d7be907 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 26 May 2024 07:23:36 +0200 Subject: [PATCH 0719/1283] Make RFC 5280 test xfail on 32-bit time_t systems --- patches/rfc5280.c.patch | 48 ------------------------------------ tests/CMakeLists.txt | 3 +++ tests/Makefile.am | 6 +++++ tests/rfc5280time_small.test | 10 ++++++++ 4 files changed, 19 insertions(+), 48 deletions(-) delete mode 100644 patches/rfc5280.c.patch create mode 100755 tests/rfc5280time_small.test diff --git a/patches/rfc5280.c.patch b/patches/rfc5280.c.patch deleted file mode 100644 index 9807f00d52..0000000000 --- a/patches/rfc5280.c.patch +++ /dev/null @@ -1,48 +0,0 @@ ---- tests/rfc5280time.c.orig Mon Nov 2 20:00:31 2015 -+++ tests/rfc5280time.c Mon Nov 2 20:03:12 2015 -@@ -91,6 +91,7 @@ - .data = "20150923032700Z", - .time = 1442978820, - }, -+#if SIZEOF_TIME_T == 8 - { - /* (times before 2050 must be UTCTIME) Per RFC 5280 4.1.2.5 */ - .str = "00000101000000Z", -@@ -103,6 +104,7 @@ - .data = "20491231235959Z", - .time = 2524607999LL, - }, -+#endif - { - /* (times before 2050 must be UTCTIME) Per RFC 5280 4.1.2.5 */ - .str = "19500101000000Z", -@@ -112,6 +114,7 @@ - }; - - struct rfc5280_time_test rfc5280_gentime_tests[] = { -+#if SIZEOF_TIME_T == 8 - { - /* Biggest RFC 5280 time */ - .str = "99991231235959Z", -@@ -129,6 +132,7 @@ - .data = "20500101000000Z", - .time = 2524608000LL, - }, -+#endif - }; - struct rfc5280_time_test rfc5280_utctime_tests[] = { - { -@@ -141,11 +145,13 @@ - .data = "540226230640Z", - .time = -500000000, - }, -+#if SIZEOF_TIME_T == 8 - { - .str = "491231235959Z", - .data = "491231235959Z", - .time = 2524607999LL, - }, -+#endif - { - .str = "700101000000Z", - .data = "700101000000Z", diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 3497cb556b..f39eb20292 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -588,6 +588,9 @@ add_test(rfc3779 rfc3779) add_executable(rfc5280time rfc5280time.c) target_link_libraries(rfc5280time ${OPENSSL_TEST_LIBS}) add_test(rfc5280time rfc5280time) +if(SMALL_TIME_T) + set_property(TEST rfc5280time PROPERTY WILL_FAIL TRUE) +endif() # rmd_test add_executable(rmd_test rmd_test.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index 0e19106896..629dbcb3f9 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -624,7 +624,13 @@ rfc3779_SOURCES = rfc3779.c # rfc5280time check_PROGRAMS += rfc5280time rfc5280time_SOURCES = rfc5280time.c +if SMALL_TIME_T +TESTS += rfc5280time_small.test +XFAIL_TESTS += rfc5280time_small.test +else TESTS += rfc5280time +endif +EXTRA_DIST += rfc5280time_small.test # rmd_test TESTS += rmd_test diff --git a/tests/rfc5280time_small.test b/tests/rfc5280time_small.test new file mode 100755 index 0000000000..61e5a054ed --- /dev/null +++ b/tests/rfc5280time_small.test @@ -0,0 +1,10 @@ +#!/bin/sh +echo 1..1 +TEST=./rfc5280 +if [ -e ./rfc5280.exe ]; then + TEST=./rfc5280.exe +fi + +# map test failure to XFAIL and success to XPASS +$TEST || echo -n "not " +echo "ok # this system is unable to represent times past 2038" From 0dfa4f3b764521f4ee23850b705973c4b55b23b7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 26 May 2024 00:06:14 -0600 Subject: [PATCH 0720/1283] Update ChangeLog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 7c8ed65cee..7d61b9e72d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -32,7 +32,7 @@ LibreSSL Portable Release Notes: * Portable changes - Removed timegm() compatibility layer since all uses were replaced - with OPENSSL_timegm(). Clean up the corresponding test harness. + with OPENSSL_timegm(). Cleaned up the corresponding test harness. * Internal improvements - Cleaned up parts of the conf directory. Simplified some logic, fixed memory leaks. From 1e0d453f05c316e5d568b43cb59128ba696a89b5 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 28 May 2024 07:00:04 -0500 Subject: [PATCH 0721/1283] Remove dead bitrig support, error on unsupported platforms --- configure.ac | 4 ++++ m4/check-os-options.m4 | 6 ++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index 51e096bd90..87a80cc02d 100644 --- a/configure.ac +++ b/configure.ac @@ -32,6 +32,10 @@ LT_INIT([pic-only]) CHECK_OS_OPTIONS +if test "$HOST_OS" = "unsupported"; then + AC_MSG_ERROR([unsupported platform: $host_os]) +fi + CHECK_C_HARDENING_OPTIONS DISABLE_AS_EXECUTABLE_STACK diff --git a/m4/check-os-options.m4 b/m4/check-os-options.m4 index 77edd14c91..a8c4904f44 100644 --- a/m4/check-os-options.m4 +++ b/m4/check-os-options.m4 @@ -109,7 +109,7 @@ char buf[1]; getentropy(buf, 1); ) CPPFLAGS="$CPPFLAGS -D_OPENBSD_SOURCE" ;; - *openbsd* | *bitrig*) + *openbsd*) HOST_OS=openbsd HOST_ABI=elf AC_DEFINE([HAVE_ATTRIBUTE__BOUNDED__], [1], [OpenBSD gcc has bounded]) @@ -131,7 +131,9 @@ char buf[1]; getentropy(buf, 1); CPPFLAGS="$CPPFLAGS -D__EXTENSIONS__ -D_XOPEN_SOURCE=600 -DBSD_COMP" AC_SUBST([PLATFORM_LDADD], ['-ldl -lmd -lnsl -lsocket']) ;; - *) ;; + *) + HOST_OS=unsupported + ;; esac # Check if time_t is sized correctly From e8bd2e956ee08053d03ce361fdeae12f4c7cf899 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 28 May 2024 12:07:44 -0600 Subject: [PATCH 0722/1283] Link x509_extensions_test to build --- .gitignore | 1 + tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 3 files changed, 11 insertions(+) diff --git a/.gitignore b/.gitignore index 678e87d5fc..4f4cf890ad 100644 --- a/.gitignore +++ b/.gitignore @@ -139,6 +139,7 @@ tests/compat/*.c tests/verify* tests/x509_algor* tests/x509_asn1* +tests/x509_extensions_test* tests/x509_info* tests/x509attribute* tests/x509name* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index f39eb20292..0c82880d59 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -813,6 +813,11 @@ add_executable(x509_asn1 x509_asn1.c) target_link_libraries(x509_asn1 ${OPENSSL_TEST_LIBS}) add_test(x509_asn1 x509_asn1) +# x509_extensions_test +add_executable(x509_extensions_test x509_extensions_test.c) +target_link_libraries(x509_extensions_test ${OPENSSL_TEST_LIBS}) +add_test(x509_extensions_test x509_extensions_test) + # x509_info add_executable(x509_info x509_info.c) target_link_libraries(x509_info ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 629dbcb3f9..76ed83aa34 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -820,6 +820,11 @@ TESTS += x509_asn1 check_PROGRAMS += x509_asn1 x509_asn1_SOURCES = x509_asn1.c +# x509_extensions_test +TESTS += x509_extensions_test +check_PROGRAMS += x509_extensions_test +x509_extensions_test_SOURCES = x509_extensions_test.c + # x509_info TESTS += x509_info check_PROGRAMS += x509_info From efebc91c976436f004e1726d7e8b0b1105c363af Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Wed, 29 May 2024 17:25:18 +1000 Subject: [PATCH 0723/1283] ci: add event number to concurrency group --- .github/workflows/android.yml | 2 +- .github/workflows/cifuzz.yml | 2 +- .github/workflows/cmake_config.yml | 2 +- .github/workflows/coverity.yml | 2 +- .github/workflows/fedora-rawhide.yml | 2 +- .github/workflows/linux.yml | 2 +- .github/workflows/macos.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/rust-openssl.yml | 2 +- .github/workflows/solaris.yml | 2 +- .github/workflows/windows.yml | 2 +- 11 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index fe4e757ef4..d095d6d29d 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -4,7 +4,7 @@ name: "Android" on: [push, pull_request] concurrency: - group: "${{ github.workflow }}-${{ github.ref }}" + group: "${{ github.workflow }}-${{ github.event.number || github.ref }}" cancel-in-progress: true jobs: diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index a75c678e28..966d92a0fc 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -4,7 +4,7 @@ on: workflow_dispatch: concurrency: - group: "${{ github.workflow }}-${{ github.ref }}" + group: "${{ github.workflow }}-${{ github.event.number || github.ref }}" cancel-in-progress: true jobs: diff --git a/.github/workflows/cmake_config.yml b/.github/workflows/cmake_config.yml index 3222e087bf..be9f114f51 100644 --- a/.github/workflows/cmake_config.yml +++ b/.github/workflows/cmake_config.yml @@ -3,7 +3,7 @@ name: cmake_config on: [push, pull_request] concurrency: - group: "${{ github.workflow }}-${{ github.ref }}" + group: "${{ github.workflow }}-${{ github.event.number || github.ref }}" cancel-in-progress: true jobs: diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index bb6a805be6..112678fd0d 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -7,7 +7,7 @@ on: - cron: "0 0 * * *" # At 00:00 daily. concurrency: - group: "${{ github.workflow }}-${{ github.ref }}" + group: "${{ github.workflow }}-${{ github.event.number || github.ref }}" cancel-in-progress: true jobs: diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index 1303af295f..ec3c63d66b 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -6,7 +6,7 @@ on: - cron: "0 0 * * *" concurrency: - group: "${{ github.workflow }}-${{ github.ref }}" + group: "${{ github.workflow }}-${{ github.event.number || github.ref }}" cancel-in-progress: true permissions: diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 57222df1ef..5c85d4b025 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -8,7 +8,7 @@ on: - cron: "0 0 * * *" # At 00:00 daily. concurrency: - group: "${{ github.workflow }}-${{ github.ref }}" + group: "${{ github.workflow }}-${{ github.event.number || github.ref }}" cancel-in-progress: true jobs: diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index cd52d2c20b..d5dd3eb365 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -8,7 +8,7 @@ on: - cron: "0 0 * * 0" # At 00:00 weekly on Sunday. concurrency: - group: "${{ github.workflow }}-${{ github.ref }}" + group: "${{ github.workflow }}-${{ github.event.number || github.ref }}" cancel-in-progress: true jobs: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a146f5c202..c2e94b8af1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,7 +6,7 @@ on: tags: [ "v*" ] concurrency: - group: "${{ github.workflow }}-${{ github.ref }}" + group: "${{ github.workflow }}-${{ github.event.number || github.ref }}" cancel-in-progress: true permissions: diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index 6487b47aa3..b707c4beb6 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -7,7 +7,7 @@ on: - cron: "0 0 * * *" # At 00:00 daily. concurrency: - group: "${{ github.workflow }}-${{ github.ref }}" + group: "${{ github.workflow }}-${{ github.event.number || github.ref }}" cancel-in-progress: true jobs: diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index e331e00baa..f68a2aaf10 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -7,7 +7,7 @@ on: - cron: "0 0 * * *" # At 00:00 daily. concurrency: - group: "${{ github.workflow }}-${{ github.ref }}" + group: "${{ github.workflow }}-${{ github.event.number || github.ref }}" cancel-in-progress: true jobs: diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index fe14501915..6aca153976 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -8,7 +8,7 @@ on: - cron: "0 0 * * 0" # At 00:00 weekly on Sunday. concurrency: - group: "${{ github.workflow }}-${{ github.ref }}" + group: "${{ github.workflow }}-${{ github.event.number || github.ref }}" cancel-in-progress: true jobs: From 44521813543436d797d0d2d314d029547f95fba2 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 28 May 2024 23:05:17 +0200 Subject: [PATCH 0724/1283] cmake: match autoconf build in terms of HAVE_AES macros --- crypto/CMakeLists.txt | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index b3e09b3430..5ec9eb8f10 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -57,6 +57,11 @@ if(HOST_ASM_ELF_X86_64) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) add_definitions(-DVPAES_ASM) + add_definitions(-DHAVE_AES_CBC_ENCRYPT_INTERNAL) + add_definitions(-DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL) + add_definitions(-DHAVE_AES_SET_DECRYPT_KEY_INTERNAL) + add_definitions(-DHAVE_AES_ENCRYPT_INTERNAL) + add_definitions(-DHAVE_AES_DECRYPT_INTERNAL) add_definitions(-DOPENSSL_IA32_SSE2) add_definitions(-DOPENSSL_BN_ASM_MONT) add_definitions(-DOPENSSL_BN_ASM_MONT5) @@ -106,6 +111,11 @@ if(HOST_ASM_MACOSX_X86_64) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) add_definitions(-DVPAES_ASM) + add_definitions(-DHAVE_AES_CBC_ENCRYPT_INTERNAL) + add_definitions(-DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL) + add_definitions(-DHAVE_AES_SET_DECRYPT_KEY_INTERNAL) + add_definitions(-DHAVE_AES_ENCRYPT_INTERNAL) + add_definitions(-DHAVE_AES_DECRYPT_INTERNAL) add_definitions(-DOPENSSL_IA32_SSE2) add_definitions(-DOPENSSL_BN_ASM_MONT) add_definitions(-DOPENSSL_BN_ASM_MONT5) @@ -144,6 +154,11 @@ if(HOST_ASM_MASM_X86_64) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) add_definitions(-DVPAES_ASM) + add_definitions(-DHAVE_AES_CBC_ENCRYPT_INTERNAL) + add_definitions(-DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL) + add_definitions(-DHAVE_AES_SET_DECRYPT_KEY_INTERNAL) + add_definitions(-DHAVE_AES_ENCRYPT_INTERNAL) + add_definitions(-DHAVE_AES_DECRYPT_INTERNAL) add_definitions(-DOPENSSL_IA32_SSE2) #add_definitions(-DOPENSSL_BN_ASM_MONT) #add_definitions(-DOPENSSL_BN_ASM_MONT5) @@ -181,6 +196,11 @@ if(HOST_ASM_MINGW64_X86_64) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) add_definitions(-DVPAES_ASM) + add_definitions(-DHAVE_AES_CBC_ENCRYPT_INTERNAL) + add_definitions(-DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL) + add_definitions(-DHAVE_AES_SET_DECRYPT_KEY_INTERNAL) + add_definitions(-DHAVE_AES_ENCRYPT_INTERNAL) + add_definitions(-DHAVE_AES_DECRYPT_INTERNAL) add_definitions(-DOPENSSL_IA32_SSE2) #add_definitions(-DOPENSSL_BN_ASM_MONT) #add_definitions(-DOPENSSL_BN_ASM_MONT5) From 729dd9fe115cf278ac95a045af582a9599501194 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 30 May 2024 23:42:53 -0600 Subject: [PATCH 0725/1283] Update ChangeLog --- ChangeLog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index 7d61b9e72d..8806a8570a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -69,6 +69,9 @@ LibreSSL Portable Release Notes: - Only specified versions can be set on certs, CRLs and CSRs. - Prepared X509_REQ_{get,set}_extension_nids() for removal. - Removed unused PEM_USER and PEM_CTX types from pem.h. + - Removed typdefs for COMP_CTX, COMP_METHOD, X509_CRL_METHOD, STORE, + STORE_METHOD, and SSL_AEAD_CTX. + - i2d_ASN1_OBJECT() now returns -1 on error like most other i2d_*. * Bug fixes - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match their documentation. They always set an RFC 5280 conformant time. @@ -85,6 +88,7 @@ LibreSSL Portable Release Notes: - Add guard to avoid contracting the number linear hash buckets to zero, which could lead to a crash due to accessing a zero sized allocation. + - Fixed i2d_ASN1_OBJECT() with an output buffer pointing to NULL. 3.9.0 - Development release From 25612395c21024c73cb8ca9c80176347fb4c9e8d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 1 Jun 2024 01:49:31 -0600 Subject: [PATCH 0726/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 8806a8570a..92d0f3940b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -63,6 +63,8 @@ LibreSSL Portable Release Notes: * Testing and proactive security - Switched the remaining tests to new certs. * Compatibility changes + - The one-step hashing functions, MD4(), MD5(), RIPEMD160(), SHA1(), + all SHA-2, and HMAC() no longer support returning a static buffer. - Removed workaround for F5 middle boxes. - Removed the useless pem2.h, a public header that was added since it was too hard to add a prototype to one file. From 714b687483b52b73322a72e8d52c82d3eaf4eb0c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 1 Jun 2024 13:33:44 -0600 Subject: [PATCH 0727/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 92d0f3940b..2471e339b5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -65,6 +65,7 @@ LibreSSL Portable Release Notes: * Compatibility changes - The one-step hashing functions, MD4(), MD5(), RIPEMD160(), SHA1(), all SHA-2, and HMAC() no longer support returning a static buffer. + Callers must now pass in a buffer to calculate the digest. - Removed workaround for F5 middle boxes. - Removed the useless pem2.h, a public header that was added since it was too hard to add a prototype to one file. From a445294ba52898ac5863e3ae0adfb6bb82287be9 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 2 Jun 2024 10:28:15 -0600 Subject: [PATCH 0728/1283] Tweak changelog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 2471e339b5..5c90e8a2f5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -65,7 +65,7 @@ LibreSSL Portable Release Notes: * Compatibility changes - The one-step hashing functions, MD4(), MD5(), RIPEMD160(), SHA1(), all SHA-2, and HMAC() no longer support returning a static buffer. - Callers must now pass in a buffer to calculate the digest. + Callers must pass in a correctly sized buffer. - Removed workaround for F5 middle boxes. - Removed the useless pem2.h, a public header that was added since it was too hard to add a prototype to one file. From a279b68be958d4044b32d37321443bfea1b5f550 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Wed, 5 Jun 2024 21:05:24 +0200 Subject: [PATCH 0729/1283] distribute `compat/stdint.h` Fixes #1064 --- include/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/include/Makefile.am b/include/Makefile.am index 22819c8a38..feaaa605e3 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -17,6 +17,7 @@ noinst_HEADERS += compat/poll.h noinst_HEADERS += compat/pthread.h noinst_HEADERS += compat/readpassphrase.h noinst_HEADERS += compat/resolv.h +noinst_HEADERS += compat/stdint.h noinst_HEADERS += compat/stdio.h noinst_HEADERS += compat/stdlib.h noinst_HEADERS += compat/string.h From 3478d5cfc72165f306295d4b02d88808b9210931 Mon Sep 17 00:00:00 2001 From: Mostafa Saad Date: Tue, 28 May 2024 23:39:52 +0300 Subject: [PATCH 0730/1283] Add Emscripten branch to arc4random The Emscripten platform already supports the necessary Linux API. The only missing piece was adding a branch specifically for Emscripten and including the existing Linux file. This update enables all LibreSSL libraries to be built using the Emscripten toolchain. --- crypto/compat/arc4random.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/crypto/compat/arc4random.h b/crypto/compat/arc4random.h index ffa32398d9..fbf2dce5de 100644 --- a/crypto/compat/arc4random.h +++ b/crypto/compat/arc4random.h @@ -30,6 +30,9 @@ #elif defined(_WIN32) #include "arc4random_win.h" +#elif defined(__EMSCRIPTEN__) +#include "arc4random_linux.h" + #else #error "No arc4random hooks defined for this platform." From 3835fed84288d7800744bef29b01182318e558fd Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 18:01:01 +0300 Subject: [PATCH 0731/1283] disable explicit_bzero because of lack of sigsuspend support on Emscripten --- tests/CMakeLists.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 0c82880d59..ab277dd052 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -402,7 +402,8 @@ add_test(exdata_test exdata_test) # explicit_bzero # explicit_bzero relies on SA_ONSTACK, which is unavailable on Windows -if(NOT WIN32) +# explicit_bzero relies on sigsuspend, which is unavailable on Emscripten +if(NOT (WIN32 OR EMSCRIPTEN)) if(HAVE_MEMMEM) add_executable(explicit_bzero explicit_bzero.c) else() From c86535df80f77589bfd6e24f4a779ca0b73a7a13 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 18:08:40 +0300 Subject: [PATCH 0732/1283] replace add_test with add_platform_test In WebAssembly, you need to pass the generated a.out.js to node to run it, as it's not an executable by itself. --- tests/CMakeLists.txt | 252 ++++++++++++++++++++++--------------------- 1 file changed, 130 insertions(+), 122 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index ab277dd052..3a7420c455 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -22,6 +22,14 @@ add_definitions(-D_PATH_SSL_CA_FILE=\"${CMAKE_CURRENT_SOURCE_DIR}/../cert.pem\") file(TO_NATIVE_PATH ${CMAKE_CURRENT_SOURCE_DIR} TEST_SOURCE_DIR) +function(add_platform_test TEST_NAME) + if (EMSCRIPTEN) + add_test(NAME ${TEST_NAME} COMMAND node ${ARGN}) + else() + add_test(NAME ${TEST_NAME} COMMAND ${ARGN}) + endif() +endfunction() + # aeadtest add_executable(aeadtest aeadtest.c) target_link_libraries(aeadtest ${OPENSSL_TEST_LIBS}) @@ -29,25 +37,25 @@ if(NOT WIN32) add_test(NAME aeadtest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/aeadtest.sh) set_tests_properties(aeadtest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") else() - add_test(aeadtest aeadtest aead ${CMAKE_CURRENT_SOURCE_DIR}/aeadtests.txt) + add_platform_test(aeadtest aeadtest aead ${CMAKE_CURRENT_SOURCE_DIR}/aeadtests.txt) endif() # aes_test add_executable(aes_test aes_test.c) target_link_libraries(aes_test ${OPENSSL_TEST_LIBS}) -add_test(aes_test aes_test) +add_platform_test(aes_test aes_test) # aes_wrap add_executable(aes_wrap aes_wrap.c) target_link_libraries(aes_wrap ${OPENSSL_TEST_LIBS}) -add_test(aes_wrap aes_wrap) +add_platform_test(aes_wrap aes_wrap) # apitest add_executable(apitest apitest.c) target_link_libraries(apitest ${OPENSSL_TEST_LIBS}) set_source_files_properties(apitest.c PROPERTIES COMPILE_FLAGS -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") -add_test(apitest apitest) +add_platform_test(apitest apitest) # arc4randomforktest # Windows/mingw does not have fork, but Cygwin does. @@ -60,47 +68,47 @@ endif() # asn1api add_executable(asn1api asn1api.c) target_link_libraries(asn1api ${OPENSSL_TEST_LIBS}) -add_test(asn1api asn1api) +add_platform_test(asn1api asn1api) # asn1basic add_executable(asn1basic asn1basic.c) target_link_libraries(asn1basic ${OPENSSL_TEST_LIBS}) -add_test(asn1basic asn1basic) +add_platform_test(asn1basic asn1basic) # asn1complex add_executable(asn1complex asn1complex.c) target_link_libraries(asn1complex ${OPENSSL_TEST_LIBS}) -add_test(asn1complex asn1complex) +add_platform_test(asn1complex asn1complex) # asn1evp add_executable(asn1evp asn1evp.c) target_link_libraries(asn1evp ${OPENSSL_TEST_LIBS}) -add_test(asn1evp asn1evp) +add_platform_test(asn1evp asn1evp) # asn1object add_executable(asn1object asn1object.c) target_link_libraries(asn1object ${OPENSSL_TEST_LIBS}) -add_test(asn1object asn1object) +add_platform_test(asn1object asn1object) # asn1oct add_executable(asn1oct asn1oct.c) target_link_libraries(asn1oct ${OPENSSL_TEST_LIBS}) -add_test(asn1oct asn1oct) +add_platform_test(asn1oct asn1oct) # asn1string_copy add_executable(asn1string_copy asn1string_copy.c) target_link_libraries(asn1string_copy ${OPENSSL_TEST_LIBS}) -add_test(asn1string_copy asn1string_copy) +add_platform_test(asn1string_copy asn1string_copy) # asn1test add_executable(asn1test asn1test.c) target_link_libraries(asn1test ${OPENSSL_TEST_LIBS}) -add_test(asn1test asn1test) +add_platform_test(asn1test asn1test) # asn1time add_executable(asn1time asn1time.c) target_link_libraries(asn1time ${OPENSSL_TEST_LIBS}) -add_test(asn1time asn1time) +add_platform_test(asn1time asn1time) if(SMALL_TIME_T) set_property(TEST asn1time PROPERTY WILL_FAIL TRUE) endif() @@ -108,151 +116,151 @@ endif() # asn1x509 add_executable(asn1x509 asn1x509.c) target_link_libraries(asn1x509 ${OPENSSL_TEST_LIBS}) -add_test(asn1x509 asn1x509) +add_platform_test(asn1x509 asn1x509) # asn1_string_to_utf8 add_executable(asn1_string_to_utf8 asn1_string_to_utf8.c) target_link_libraries(asn1_string_to_utf8 ${OPENSSL_TEST_LIBS}) -add_test(asn1_string_to_utf8 asn1_string_to_utf8) +add_platform_test(asn1_string_to_utf8 asn1_string_to_utf8) # base64test add_executable(base64test base64test.c) target_link_libraries(base64test ${OPENSSL_TEST_LIBS}) -add_test(base64test base64test) +add_platform_test(base64test base64test) # bf_test add_executable(bf_test bf_test.c) target_link_libraries(bf_test ${OPENSSL_TEST_LIBS}) -add_test(bf_test bf_test) +add_platform_test(bf_test bf_test) # bio_asn1 add_executable(bio_asn1 bio_asn1.c) target_link_libraries(bio_asn1 ${OPENSSL_TEST_LIBS}) -add_test(bio_asn1 bio_asn1) +add_platform_test(bio_asn1 bio_asn1) # bio_chain add_executable(bio_chain bio_chain.c) target_link_libraries(bio_chain ${OPENSSL_TEST_LIBS}) -add_test(bio_chain bio_chain) +add_platform_test(bio_chain bio_chain) # bio_dump add_executable(bio_dump bio_dump.c) target_link_libraries(bio_dump ${OPENSSL_TEST_LIBS}) -add_test(bio_dump bio_dump) +add_platform_test(bio_dump bio_dump) # bio_host # this test relies on resolver results that are OS and environment-specific if(ENABLE_EXTRATESTS) add_executable(bio_host bio_host.c) target_link_libraries(bio_host ${OPENSSL_TEST_LIBS}) - add_test(bio_host bio_host) + add_platform_test(bio_host bio_host) endif() # bio_mem add_executable(bio_mem bio_mem.c) target_link_libraries(bio_mem ${OPENSSL_TEST_LIBS}) -add_test(bio_mem bio_mem) +add_platform_test(bio_mem bio_mem) # bn_add_sub add_executable(bn_add_sub bn_add_sub.c) target_link_libraries(bn_add_sub ${OPENSSL_TEST_LIBS}) -add_test(bn_add_sub bn_add_sub) +add_platform_test(bn_add_sub bn_add_sub) # bn_bits add_executable(bn_bits bn_bits.c) target_link_libraries(bn_bits ${OPENSSL_TEST_LIBS}) -add_test(bn_bits bn_bits) +add_platform_test(bn_bits bn_bits) # bn_cmp add_executable(bn_cmp bn_cmp.c) target_link_libraries(bn_cmp ${OPENSSL_TEST_LIBS}) -add_test(bn_cmp bn_cmp) +add_platform_test(bn_cmp bn_cmp) # bn_convert add_executable(bn_convert bn_convert.c) target_link_libraries(bn_convert ${OPENSSL_TEST_LIBS}) -add_test(bn_convert bn_convert) +add_platform_test(bn_convert bn_convert) # bn_gcd add_executable(bn_gcd bn_cmp.c) target_link_libraries(bn_gcd ${OPENSSL_TEST_LIBS}) -add_test(bn_gcd bn_gcd) +add_platform_test(bn_gcd bn_gcd) # bn_general is a benchmark # bn_isqrt add_executable(bn_isqrt bn_isqrt.c) target_link_libraries(bn_isqrt ${OPENSSL_TEST_LIBS}) -add_test(bn_isqrt bn_isqrt) +add_platform_test(bn_isqrt bn_isqrt) # bn_mod_exp add_executable(bn_mod_exp bn_mod_exp.c) set_source_files_properties(bn_mod_exp.c PROPERTIES COMPILE_FLAGS -ULIBRESSL_INTERNAL) target_link_libraries(bn_mod_exp ${OPENSSL_TEST_LIBS}) -add_test(bn_mod_exp bn_mod_exp) +add_platform_test(bn_mod_exp bn_mod_exp) # bn_mod_inverse add_executable(bn_mod_inverse bn_mod_inverse.c) target_link_libraries(bn_mod_inverse ${OPENSSL_TEST_LIBS}) -add_test(bn_mod_inverse bn_mod_inverse) +add_platform_test(bn_mod_inverse bn_mod_inverse) # bn_mod_sqrt add_executable(bn_mod_sqrt bn_mod_sqrt.c) target_link_libraries(bn_mod_sqrt ${OPENSSL_TEST_LIBS}) -add_test(bn_mod_sqrt bn_mod_sqrt) +add_platform_test(bn_mod_sqrt bn_mod_sqrt) # bn_mont add_executable(bn_mont bn_mont.c) target_link_libraries(bn_mont ${OPENSSL_TEST_LIBS}) -add_test(bn_mont bn_mont) +add_platform_test(bn_mont bn_mont) # bn_primes add_executable(bn_primes bn_primes.c) target_link_libraries(bn_primes ${OPENSSL_TEST_LIBS}) -add_test(bn_primes bn_primes) +add_platform_test(bn_primes bn_primes) # bn_print add_executable(bn_print bn_print.c) target_link_libraries(bn_print ${OPENSSL_TEST_LIBS}) -add_test(bn_print bn_print) +add_platform_test(bn_print bn_print) # bn_shift add_executable(bn_shift bn_shift.c) target_link_libraries(bn_shift ${OPENSSL_TEST_LIBS}) -add_test(bn_shift bn_shift) +add_platform_test(bn_shift bn_shift) # bn_test add_executable(bn_test bn_test.c) set_source_files_properties(bn_test.c PROPERTIES COMPILE_FLAGS -ULIBRESSL_INTERNAL) target_link_libraries(bn_test ${OPENSSL_TEST_LIBS}) -add_test(bn_test bn_test) +add_platform_test(bn_test bn_test) # bn_to_string add_executable(bn_to_string bn_to_string.c) target_link_libraries(bn_to_string ${OPENSSL_TEST_LIBS}) -add_test(bn_to_string bn_to_string) +add_platform_test(bn_to_string bn_to_string) # bn_unit add_executable(bn_unit bn_unit.c) target_link_libraries(bn_unit ${OPENSSL_TEST_LIBS}) -add_test(bn_unit bn_unit) +add_platform_test(bn_unit bn_unit) # bn_word add_executable(bn_word bn_word.c) target_link_libraries(bn_word ${OPENSSL_TEST_LIBS}) -add_test(bn_word bn_word) +add_platform_test(bn_word bn_word) # buffertest add_executable(buffertest buffertest.c) target_link_libraries(buffertest ${OPENSSL_TEST_LIBS}) -add_test(buffertest buffertest) +add_platform_test(buffertest buffertest) # bytestringtest add_executable(bytestringtest bytestringtest.c) target_link_libraries(bytestringtest ${OPENSSL_TEST_LIBS}) -add_test(bytestringtest bytestringtest) +add_platform_test(bytestringtest bytestringtest) # callback # callbackfailures @@ -260,69 +268,69 @@ add_test(bytestringtest bytestringtest) # casttest add_executable(casttest casttest.c) target_link_libraries(casttest ${OPENSSL_TEST_LIBS}) -add_test(casttest casttest) +add_platform_test(casttest casttest) # chachatest add_executable(chachatest chachatest.c) target_link_libraries(chachatest ${OPENSSL_TEST_LIBS}) -add_test(chachatest chachatest) +add_platform_test(chachatest chachatest) # cipher_list add_executable(cipher_list cipher_list.c) target_link_libraries(cipher_list ${OPENSSL_TEST_LIBS}) -add_test(cipher_list cipher_list) +add_platform_test(cipher_list cipher_list) # cipherstest add_executable(cipherstest cipherstest.c) target_link_libraries(cipherstest ${OPENSSL_TEST_LIBS}) -add_test(cipherstest cipherstest) +add_platform_test(cipherstest cipherstest) ## clienttest #add_executable(clienttest clienttest.c) #target_link_libraries(clienttest ${OPENSSL_TEST_LIBS}) -#add_test(clienttest clienttest) +#add_platform_test(clienttest clienttest) # cmstest add_executable(cmstest cmstest.c) target_link_libraries(cmstest ${OPENSSL_TEST_LIBS}) -add_test(cmstest cmstest) +add_platform_test(cmstest cmstest) # configtest add_executable(configtest configtest.c) target_link_libraries(configtest ${LIBTLS_TEST_LIBS}) -add_test(configtest configtest) +add_platform_test(configtest configtest) # constraints add_executable(constraints constraints.c) target_link_libraries(constraints ${OPENSSL_TEST_LIBS}) -add_test(constraints constraints) +add_platform_test(constraints constraints) # crypto_test add_executable(crypto_test crypto_test.c) target_link_libraries(crypto_test ${OPENSSL_TEST_LIBS}) -add_test(crypto_test crypto_test) +add_platform_test(crypto_test crypto_test) # cttest add_executable(cttest cttest.c) target_link_libraries(cttest ${OPENSSL_TEST_LIBS}) set_source_files_properties(cttest.c PROPERTIES COMPILE_FLAGS -DCTPATH=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") -add_test(cttest cttest) +add_platform_test(cttest cttest) # destest add_executable(destest destest.c) target_link_libraries(destest ${OPENSSL_TEST_LIBS}) -add_test(destest destest) +add_platform_test(destest destest) # dhtest add_executable(dhtest dhtest.c) target_link_libraries(dhtest ${OPENSSL_TEST_LIBS}) -add_test(dhtest dhtest) +add_platform_test(dhtest dhtest) # dsatest add_executable(dsatest dsatest.c) target_link_libraries(dsatest ${OPENSSL_TEST_LIBS}) -add_test(dsatest dsatest) +add_platform_test(dsatest dsatest) # XXX This test is too flaky for CI. Disable it until it is fixed. # # dtlstest @@ -336,67 +344,67 @@ add_test(dsatest dsatest) # ecc_cdh add_executable(ecc_cdh ecc_cdh.c) target_link_libraries(ecc_cdh ${OPENSSL_TEST_LIBS}) -add_test(ecc_cdh ecc_cdh) +add_platform_test(ecc_cdh ecc_cdh) # ec_asn1_test add_executable(ec_asn1_test ec_asn1_test.c) target_link_libraries(ec_asn1_test ${OPENSSL_TEST_LIBS}) -add_test(ec_asn1_test ec_asn1_test) +add_platform_test(ec_asn1_test ec_asn1_test) # ec_point_conversion add_executable(ec_point_conversion ec_point_conversion.c) target_link_libraries(ec_point_conversion ${OPENSSL_TEST_LIBS}) -add_test(ec_point_conversion ec_point_conversion) +add_platform_test(ec_point_conversion ec_point_conversion) # ecdhtest add_executable(ecdhtest ecdhtest.c) target_link_libraries(ecdhtest ${OPENSSL_TEST_LIBS}) -add_test(ecdhtest ecdhtest) +add_platform_test(ecdhtest ecdhtest) # ecdsatest add_executable(ecdsatest ecdsatest.c) target_link_libraries(ecdsatest ${OPENSSL_TEST_LIBS}) -add_test(ecdsatest ecdsatest) +add_platform_test(ecdsatest ecdsatest) # ectest add_executable(ectest ectest.c) target_link_libraries(ectest ${OPENSSL_TEST_LIBS}) -add_test(ectest ectest) +add_platform_test(ectest ectest) # ed25519test add_executable(ed25519test ed25519test.c) target_link_libraries(ed25519test ${OPENSSL_TEST_LIBS}) -add_test(ed25519test ed25519test) +add_platform_test(ed25519test ed25519test) # evp_ecx_test add_executable(evp_ecx_test evp_ecx_test.c) target_link_libraries(evp_ecx_test ${OPENSSL_TEST_LIBS}) -add_test(evp_ecx_test evp_ecx_test) +add_platform_test(evp_ecx_test evp_ecx_test) # evp_pkey_check add_executable(evp_pkey_check evp_pkey_check.c) target_link_libraries(evp_pkey_check ${OPENSSL_TEST_LIBS}) -add_test(evp_pkey_check evp_pkey_check) +add_platform_test(evp_pkey_check evp_pkey_check) # evp_pkey_cleanup add_executable(evp_pkey_cleanup evp_pkey_cleanup.c) target_link_libraries(evp_pkey_cleanup ${OPENSSL_TEST_LIBS}) -add_test(evp_pkey_cleanup evp_pkey_cleanup) +add_platform_test(evp_pkey_cleanup evp_pkey_cleanup) # evptest add_executable(evptest evptest.c) target_link_libraries(evptest ${OPENSSL_TEST_LIBS}) -add_test(evptest evptest ${CMAKE_CURRENT_SOURCE_DIR}/evptests.txt) +add_platform_test(evptest evptest ${CMAKE_CURRENT_SOURCE_DIR}/evptests.txt) # evp_test add_executable(evp_test evp_test.c) target_link_libraries(evp_test ${OPENSSL_TEST_LIBS}) -add_test(evp_test evp_test) +add_platform_test(evp_test evp_test) # exdata_test add_executable(exdata_test exdata_test.c) target_link_libraries(exdata_test ${OPENSSL_TEST_LIBS}) -add_test(exdata_test exdata_test) +add_platform_test(exdata_test exdata_test) # expirecallback.c @@ -416,57 +424,57 @@ endif() # exportertest add_executable(exportertest exportertest.c) target_link_libraries(exportertest ${OPENSSL_TEST_LIBS}) -add_test(exportertest exportertest) +add_platform_test(exportertest exportertest) # freenull add_executable(freenull freenull.c) set_source_files_properties(freenull.c PROPERTIES COMPILE_FLAGS -ULIBRESSL_INTERNAL) target_link_libraries(freenull ${OPENSSL_TEST_LIBS}) -add_test(freenull freenull) +add_platform_test(freenull freenull) # gcm128test add_executable(gcm128test gcm128test.c) target_link_libraries(gcm128test ${OPENSSL_TEST_LIBS}) -add_test(gcm128test gcm128test) +add_platform_test(gcm128test gcm128test) # handshake_table add_executable(handshake_table handshake_table.c) target_link_libraries(handshake_table ${OPENSSL_TEST_LIBS}) -add_test(handshake_table handshake_table) +add_platform_test(handshake_table handshake_table) # hkdf_test add_executable(hkdf_test hkdf_test.c) target_link_libraries(hkdf_test ${OPENSSL_TEST_LIBS}) -add_test(hkdf_test hkdf_test) +add_platform_test(hkdf_test hkdf_test) # hmactest add_executable(hmactest hmactest.c) target_link_libraries(hmactest ${OPENSSL_TEST_LIBS}) -add_test(hmactest hmactest) +add_platform_test(hmactest hmactest) # ideatest add_executable(ideatest ideatest.c) target_link_libraries(ideatest ${OPENSSL_TEST_LIBS}) -add_test(ideatest ideatest) +add_platform_test(ideatest ideatest) # igetest add_executable(igetest igetest.c) target_link_libraries(igetest ${OPENSSL_TEST_LIBS}) -add_test(igetest igetest) +add_platform_test(igetest igetest) # init_pledge # key_schedule add_executable(key_schedule key_schedule.c) target_link_libraries(key_schedule ${OPENSSL_TEST_LIBS}) -add_test(key_schedule key_schedule) +add_platform_test(key_schedule key_schedule) # keypair add_executable(keypairtest keypairtest.c) target_link_libraries(keypairtest ${LIBTLS_TEST_LIBS}) target_include_directories(keypairtest BEFORE PUBLIC ../tls) -add_test(keypairtest keypairtest +add_platform_test(keypairtest keypairtest ${CMAKE_CURRENT_SOURCE_DIR}/ca-root-rsa.pem ${CMAKE_CURRENT_SOURCE_DIR}/server1-rsa.pem ${CMAKE_CURRENT_SOURCE_DIR}/server1-rsa.pem) @@ -474,17 +482,17 @@ add_test(keypairtest keypairtest # lhash_test add_executable(lhash_test lhash_test.c) target_link_libraries(lhash_test ${OPENSSL_TEST_LIBS}) -add_test(lhash_test lhash_test) +add_platform_test(lhash_test lhash_test) # md_test add_executable(md_test md_test.c) target_link_libraries(md_test ${OPENSSL_TEST_LIBS}) -add_test(md_test md_test) +add_platform_test(md_test md_test) # objectstest add_executable(objectstest objectstest.c) target_link_libraries(objectstest ${OPENSSL_TEST_LIBS}) -add_test(objectstest objectstest) +add_platform_test(objectstest objectstest) # ocsp_test if(ENABLE_EXTRATESTS) @@ -500,12 +508,12 @@ endif() # optionstest add_executable(optionstest optionstest.c) target_link_libraries(optionstest ${OPENSSL_TEST_LIBS}) -add_test(optionstest optionstest) +add_platform_test(optionstest optionstest) # pbkdf2 add_executable(pbkdf2 pbkdf2.c) target_link_libraries(pbkdf2 ${OPENSSL_TEST_LIBS}) -add_test(pbkdf2 pbkdf2) +add_platform_test(pbkdf2 pbkdf2) # pidwraptest # pidwraptest relies on an OS-specific way to give out pids and is generally @@ -519,19 +527,19 @@ endif() # pkcs7test add_executable(pkcs7test pkcs7test.c) target_link_libraries(pkcs7test ${OPENSSL_TEST_LIBS}) -add_test(pkcs7test pkcs7test) +add_platform_test(pkcs7test pkcs7test) # poly1305test add_executable(poly1305test poly1305test.c) target_link_libraries(poly1305test ${OPENSSL_TEST_LIBS}) -add_test(poly1305test poly1305test) +add_platform_test(poly1305test poly1305test) # policy add_executable(policy policy.c) set_source_files_properties(policy.c PROPERTIES COMPILE_FLAGS -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") target_link_libraries(policy ${OPENSSL_TEST_LIBS}) -add_test(policy policy) +add_platform_test(policy policy) # pq_test add_executable(pq_test pq_test.c) @@ -558,37 +566,37 @@ set_tests_properties(quictest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}" # randtest add_executable(randtest randtest.c) target_link_libraries(randtest ${OPENSSL_TEST_LIBS}) -add_test(randtest randtest) +add_platform_test(randtest randtest) # rc2_test add_executable(rc2_test rc2_test.c) target_link_libraries(rc2_test ${OPENSSL_TEST_LIBS}) -add_test(rc2_test rc2_test) +add_platform_test(rc2_test rc2_test) # rc4_test add_executable(rc4_test rc4_test.c) target_link_libraries(rc4_test ${OPENSSL_TEST_LIBS}) -add_test(rc4_test rc4_test) +add_platform_test(rc4_test rc4_test) # recordtest add_executable(recordtest recordtest.c) target_link_libraries(recordtest ${OPENSSL_TEST_LIBS}) -add_test(recordtest recordtest) +add_platform_test(recordtest recordtest) # record_layer_test add_executable(record_layer_test record_layer_test.c) target_link_libraries(record_layer_test ${OPENSSL_TEST_LIBS}) -add_test(record_layer_test record_layer_test) +add_platform_test(record_layer_test record_layer_test) # rfc3779 add_executable(rfc3779 rfc3779.c) target_link_libraries(rfc3779 ${OPENSSL_TEST_LIBS}) -add_test(rfc3779 rfc3779) +add_platform_test(rfc3779 rfc3779) # rfc5280time add_executable(rfc5280time rfc5280time.c) target_link_libraries(rfc5280time ${OPENSSL_TEST_LIBS}) -add_test(rfc5280time rfc5280time) +add_platform_test(rfc5280time rfc5280time) if(SMALL_TIME_T) set_property(TEST rfc5280time PROPERTY WILL_FAIL TRUE) endif() @@ -596,17 +604,17 @@ endif() # rmd_test add_executable(rmd_test rmd_test.c) target_link_libraries(rmd_test ${OPENSSL_TEST_LIBS}) -add_test(rmd_test rmd_test) +add_platform_test(rmd_test rmd_test) # rsa_padding_test add_executable(rsa_padding_test rsa_padding_test.c) target_link_libraries(rsa_padding_test ${OPENSSL_TEST_LIBS}) -add_test(rsa_padding_test rsa_padding_test) +add_platform_test(rsa_padding_test rsa_padding_test) # rsa_test add_executable(rsa_test rsa_test.c) target_link_libraries(rsa_test ${OPENSSL_TEST_LIBS}) -add_test(rsa_test rsa_test) +add_platform_test(rsa_test rsa_test) # server.c @@ -623,7 +631,7 @@ set_tests_properties(servertest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR # sha_test add_executable(sha_test sha_test.c) target_link_libraries(sha_test ${OPENSSL_TEST_LIBS}) -add_test(sha_test sha_test) +add_platform_test(sha_test sha_test) # shutdowntest set(SHUTDOWNTEST_SRC shutdowntest.c) @@ -647,11 +655,11 @@ if(NOT CMAKE_SYSTEM_NAME MATCHES "WindowsStore") endif() set_source_files_properties(signertest.c PROPERTIES COMPILE_FLAGS - -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") + -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") add_executable(signertest ${SIGNERTEST_SRC}) target_link_libraries(signertest ${LIBTLS_TEST_LIBS}) target_include_directories(signertest BEFORE PUBLIC ../tls) - add_test(signertest signertest) + add_platform_test(signertest signertest) endif() # sm2crypttest @@ -661,39 +669,39 @@ endif() # sm3test add_executable(sm3test sm3test.c) target_link_libraries(sm3test ${OPENSSL_TEST_LIBS}) -add_test(sm3test sm3test) +add_platform_test(sm3test sm3test) # sm4test add_executable(sm4test sm4test.c) target_link_libraries(sm4test ${OPENSSL_TEST_LIBS}) -add_test(sm4test sm4test) +add_platform_test(sm4test sm4test) # ssl_get_shared_ciphers add_executable(ssl_get_shared_ciphers ssl_get_shared_ciphers.c) set_source_files_properties(ssl_get_shared_ciphers.c PROPERTIES COMPILE_FLAGS -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") target_link_libraries(ssl_get_shared_ciphers ${OPENSSL_TEST_LIBS}) -add_test(ssl_get_shared_ciphers ssl_get_shared_ciphers) +add_platform_test(ssl_get_shared_ciphers ssl_get_shared_ciphers) # ssl_methods add_executable(ssl_methods ssl_methods.c) target_link_libraries(ssl_methods ${OPENSSL_TEST_LIBS}) -add_test(ssl_methods ssl_methods) +add_platform_test(ssl_methods ssl_methods) # ssl_set_alpn_protos add_executable(ssl_set_alpn_protos ssl_set_alpn_protos.c) target_link_libraries(ssl_set_alpn_protos ${OPENSSL_TEST_LIBS}) -add_test(ssl_set_alpn_protos ssl_set_alpn_protos) +add_platform_test(ssl_set_alpn_protos ssl_set_alpn_protos) # ssl_verify_param add_executable(ssl_verify_param ssl_verify_param.c) target_link_libraries(ssl_verify_param ${OPENSSL_TEST_LIBS}) -add_test(ssl_verify_param ssl_verify_param) +add_platform_test(ssl_verify_param ssl_verify_param) # ssl_versions add_executable(ssl_versions ssl_versions.c) target_link_libraries(ssl_versions ${OPENSSL_TEST_LIBS}) -add_test(ssl_versions ssl_versions) +add_platform_test(ssl_versions ssl_versions) # ssltest add_executable(ssltest ssltest.c) @@ -732,17 +740,17 @@ set_tests_properties(testrsa PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # timingsafe add_executable(timingsafe timingsafe.c) target_link_libraries(timingsafe ${OPENSSL_TEST_LIBS}) -add_test(timingsafe timingsafe) +add_platform_test(timingsafe timingsafe) # tlsexttest add_executable(tlsexttest tlsexttest.c) target_link_libraries(tlsexttest ${OPENSSL_TEST_LIBS}) -add_test(tlsexttest tlsexttest) +add_platform_test(tlsexttest tlsexttest) # tlslegacytest add_executable(tlslegacytest tlslegacytest.c) target_link_libraries(tlslegacytest ${OPENSSL_TEST_LIBS}) -add_test(tlslegacytest tlslegacytest) +add_platform_test(tlslegacytest tlslegacytest) # tlstest if(NOT CMAKE_SYSTEM_NAME MATCHES "WindowsStore") @@ -767,72 +775,72 @@ endif() # tls_ext_alpn add_executable(tls_ext_alpn tls_ext_alpn.c) target_link_libraries(tls_ext_alpn ${OPENSSL_TEST_LIBS}) -add_test(tls_ext_alpn tls_ext_alpn) +add_platform_test(tls_ext_alpn tls_ext_alpn) # tls_prf add_executable(tls_prf tls_prf.c) target_link_libraries(tls_prf ${OPENSSL_TEST_LIBS}) -add_test(tls_prf tls_prf) +add_platform_test(tls_prf tls_prf) # utf8test add_executable(utf8test utf8test.c) target_link_libraries(utf8test ${OPENSSL_TEST_LIBS}) -add_test(utf8test utf8test) +add_platform_test(utf8test utf8test) # valid_handshakes_terminate add_executable(valid_handshakes_terminate valid_handshakes_terminate.c) target_link_libraries(valid_handshakes_terminate ${OPENSSL_TEST_LIBS}) -add_test(valid_handshakes_terminate valid_handshakes_terminate) +add_platform_test(valid_handshakes_terminate valid_handshakes_terminate) # verifytest add_executable(verifytest verifytest.c) target_link_libraries(verifytest ${LIBTLS_TEST_LIBS}) -add_test(verifytest verifytest) +add_platform_test(verifytest verifytest) # whirlpool_test add_executable(whirlpool_test whirlpool_test.c) target_link_libraries(whirlpool_test ${OPENSSL_TEST_LIBS}) -add_test(whirlpool_test whirlpool_test) +add_platform_test(whirlpool_test whirlpool_test) # x25519test add_executable(x25519test x25519test.c) target_link_libraries(x25519test ${OPENSSL_TEST_LIBS}) -add_test(x25519test x25519test) +add_platform_test(x25519test x25519test) # x509attribute add_executable(x509attribute x509attribute.c) target_link_libraries(x509attribute ${OPENSSL_TEST_LIBS}) -add_test(x509attribute x509attribute) +add_platform_test(x509attribute x509attribute) # x509_algor add_executable(x509_algor x509_algor.c) target_link_libraries(x509_algor ${OPENSSL_TEST_LIBS}) -add_test(x509_algor x509_algor) +add_platform_test(x509_algor x509_algor) # x509_asn1 add_executable(x509_asn1 x509_asn1.c) target_link_libraries(x509_asn1 ${OPENSSL_TEST_LIBS}) -add_test(x509_asn1 x509_asn1) +add_platform_test(x509_asn1 x509_asn1) # x509_extensions_test add_executable(x509_extensions_test x509_extensions_test.c) target_link_libraries(x509_extensions_test ${OPENSSL_TEST_LIBS}) -add_test(x509_extensions_test x509_extensions_test) +add_platform_test(x509_extensions_test x509_extensions_test) # x509_info add_executable(x509_info x509_info.c) target_link_libraries(x509_info ${OPENSSL_TEST_LIBS}) -add_test(x509_info x509_info) +add_platform_test(x509_info x509_info) # x509name add_executable(x509name x509name.c) target_link_libraries(x509name ${OPENSSL_TEST_LIBS}) -add_test(x509name x509name) +add_platform_test(x509name x509name) # x509req_ext add_executable(x509req_ext x509req_ext.c) target_link_libraries(x509req_ext ${OPENSSL_TEST_LIBS}) -add_test(x509req_ext x509req_ext) +add_platform_test(x509req_ext x509req_ext) add_custom_command(TARGET x25519test POST_BUILD COMMAND "${CMAKE_COMMAND}" -E copy From 34f7223fa4a88f4af2eb494f55252a5de3a46534 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 18:18:54 +0300 Subject: [PATCH 0733/1283] fix aeadtest changed the aeadtest.sh to search to .js file as well. added preload-file link flag to enable access to TEST_SOURCE_DIR --- tests/CMakeLists.txt | 3 +++ tests/aeadtest.sh | 2 ++ 2 files changed, 5 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 3a7420c455..cd0051486e 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -33,6 +33,9 @@ endfunction() # aeadtest add_executable(aeadtest aeadtest.c) target_link_libraries(aeadtest ${OPENSSL_TEST_LIBS}) +if(EMSCRIPTEN) + set_target_properties(aeadtest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") +endif() if(NOT WIN32) add_test(NAME aeadtest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/aeadtest.sh) set_tests_properties(aeadtest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") diff --git a/tests/aeadtest.sh b/tests/aeadtest.sh index 9f59595afe..212e354c7f 100755 --- a/tests/aeadtest.sh +++ b/tests/aeadtest.sh @@ -3,6 +3,8 @@ set -e TEST=./aeadtest if [ -e ./aeadtest.exe ]; then TEST=./aeadtest.exe +elif [ -e ./aeadtest.js ]; then + TEST="node ./aeadtest.js" fi $TEST aead $srcdir/aeadtests.txt $TEST aes-128-gcm $srcdir/aes_128_gcm_tests.txt From 66ef92de0e7cf40c712809848006c256f5e372e4 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 18:31:22 +0300 Subject: [PATCH 0734/1283] disable arc4randomforktest because Emscripten lacks fork support --- tests/CMakeLists.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index cd0051486e..5788805a0a 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -62,7 +62,8 @@ add_platform_test(apitest apitest) # arc4randomforktest # Windows/mingw does not have fork, but Cygwin does. -if(NOT (WIN32 OR (CMAKE_SYSTEM_NAME MATCHES "MINGW"))) +# Emscripten does not have fork. +if(NOT (WIN32 OR (CMAKE_SYSTEM_NAME MATCHES "MINGW") OR EMSCRIPTEN)) add_executable(arc4randomforktest arc4randomforktest.c) target_link_libraries(arc4randomforktest ${OPENSSL_TEST_LIBS}) add_test(arc4randomforktest ${CMAKE_CURRENT_SOURCE_DIR}/arc4randomforktest.sh) From 50b726ce3798345511a8a06129f7aab1d7d9a567 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 18:33:38 +0300 Subject: [PATCH 0735/1283] fix apitest added preload-file link flag to enable access to TEST_SOURCE_DIR --- tests/CMakeLists.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 5788805a0a..5c7edbac10 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -58,6 +58,9 @@ add_executable(apitest apitest.c) target_link_libraries(apitest ${OPENSSL_TEST_LIBS}) set_source_files_properties(apitest.c PROPERTIES COMPILE_FLAGS -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") +if(EMSCRIPTEN) + set_target_properties(apitest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") +endif() add_platform_test(apitest apitest) # arc4randomforktest From 3d9c9cf5b0f7867fdcc04ca928e15b44c3ccb243 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 18:45:50 +0300 Subject: [PATCH 0736/1283] fix bn_unit bn_unit uses more memory than Emscripten default initial heap size. ALLOW_MEMORY_GROWTH linker option is passed to fix the OOM error --- tests/CMakeLists.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 5c7edbac10..f52a17b1e4 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -252,6 +252,7 @@ add_platform_test(bn_to_string bn_to_string) # bn_unit add_executable(bn_unit bn_unit.c) target_link_libraries(bn_unit ${OPENSSL_TEST_LIBS}) +set_target_properties(bn_unit PROPERTIES LINK_FLAGS "-sALLOW_MEMORY_GROWTH") add_platform_test(bn_unit bn_unit) # bn_word From 61fb99c80bba70080b48689560b0dc1fe1c5f01f Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 18:50:44 +0300 Subject: [PATCH 0737/1283] fix cttest added preload-file link flag to enable access to TEST_SOURCE_DIR --- tests/CMakeLists.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index f52a17b1e4..a0d0606886 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -323,6 +323,9 @@ add_executable(cttest cttest.c) target_link_libraries(cttest ${OPENSSL_TEST_LIBS}) set_source_files_properties(cttest.c PROPERTIES COMPILE_FLAGS -DCTPATH=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") +if(EMSCRIPTEN) + set_target_properties(cttest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") +endif() add_platform_test(cttest cttest) # destest From caa700b1ca6f1031412cf625d211b80887e56a24 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 18:54:28 +0300 Subject: [PATCH 0738/1283] fix evptest added preload-file link flag to enable access to TEST_SOURCE_DIR --- tests/CMakeLists.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index a0d0606886..56a60f4f87 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -405,6 +405,9 @@ add_platform_test(evp_pkey_cleanup evp_pkey_cleanup) # evptest add_executable(evptest evptest.c) target_link_libraries(evptest ${OPENSSL_TEST_LIBS}) +if(EMSCRIPTEN) + set_target_properties(evptest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") +endif() add_platform_test(evptest evptest ${CMAKE_CURRENT_SOURCE_DIR}/evptests.txt) # evp_test From f149fbd99114127e06f97a9babd13ee1f520630b Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 18:58:21 +0300 Subject: [PATCH 0739/1283] fix keypairtest added preload-file link flag to enable access to TEST_SOURCE_DIR --- tests/CMakeLists.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 56a60f4f87..67d15f1678 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -488,6 +488,9 @@ add_platform_test(key_schedule key_schedule) add_executable(keypairtest keypairtest.c) target_link_libraries(keypairtest ${LIBTLS_TEST_LIBS}) target_include_directories(keypairtest BEFORE PUBLIC ../tls) +if(EMSCRIPTEN) + set_target_properties(keypairtest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") +endif() add_platform_test(keypairtest keypairtest ${CMAKE_CURRENT_SOURCE_DIR}/ca-root-rsa.pem ${CMAKE_CURRENT_SOURCE_DIR}/server1-rsa.pem From 7d35c4c3f1447c6b6adf817e130eefd1e5ff96ec Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 19:01:06 +0300 Subject: [PATCH 0740/1283] fix policy added preload-file link flag to enable access to TEST_SOURCE_DIR --- tests/CMakeLists.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 67d15f1678..82e5ad3273 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -556,6 +556,9 @@ add_executable(policy policy.c) set_source_files_properties(policy.c PROPERTIES COMPILE_FLAGS -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") target_link_libraries(policy ${OPENSSL_TEST_LIBS}) +if(EMSCRIPTEN) + set_target_properties(policy PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") +endif() add_platform_test(policy policy) # pq_test From 46bcf38a5841ab32ce9a87ff9ef3df86bcaf8cab Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 19:05:02 +0300 Subject: [PATCH 0741/1283] fix pq_test changed the pq_test.sh to search to .js file as well --- tests/pq_test.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/pq_test.sh b/tests/pq_test.sh index ab87bc7f19..eab6f3cb25 100755 --- a/tests/pq_test.sh +++ b/tests/pq_test.sh @@ -3,5 +3,7 @@ set -e TEST=./pq_test if [ -e ./pq_test.exe ]; then TEST=./pq_test.exe +elif [ -e ./pq_test.js ]; then + TEST="node ./pq_test.js" fi $TEST | diff -b $srcdir/pq_expected.txt - From e257aa8b4849e292ebef10c9afccc380e93b152f Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 19:09:42 +0300 Subject: [PATCH 0742/1283] fix quictest changed the quictest.sh to search to .js file as well. added preload-file link flag to enable access to TEST_SOURCE_DIR --- tests/CMakeLists.txt | 3 +++ tests/quictest.sh | 2 ++ 2 files changed, 5 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 82e5ad3273..ead7af94eb 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -576,6 +576,9 @@ set_tests_properties(pq_test PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") set(QUICTEST_SRC quictest.c) add_executable(quictest ${QUICTEST_SRC}) target_link_libraries(quictest ${OPENSSL_TEST_LIBS}) +if(EMSCRIPTEN) + set_target_properties(quictest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") +endif() if(NOT MSVC) add_test(NAME quictest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/quictest.sh) else() diff --git a/tests/quictest.sh b/tests/quictest.sh index 018417962a..23561adb8d 100755 --- a/tests/quictest.sh +++ b/tests/quictest.sh @@ -4,6 +4,8 @@ set -e quictest_bin=./quictest if [ -e ./quictest.exe ]; then quictest_bin=./quictest.exe +elif [ -e ./quictest.js ]; then + quictest_bin="node ./quictest.js" fi if [ -z $srcdir ]; then From d34880c232f1a62a153f9ef1b78747d5721f51c3 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 19:14:17 +0300 Subject: [PATCH 0743/1283] fix servertest changed the servertest.sh to search to .js file as well. added preload-file link flag to enable access to TEST_SOURCE_DIR --- tests/CMakeLists.txt | 3 +++ tests/servertest.sh | 2 ++ 2 files changed, 5 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index ead7af94eb..0da7022d79 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -644,6 +644,9 @@ add_platform_test(rsa_test rsa_test) # servertest add_executable(servertest servertest.c) target_link_libraries(servertest ${OPENSSL_TEST_LIBS}) +if(EMSCRIPTEN) + set_target_properties(servertest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") +endif() if(NOT MSVC) add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.sh) else() diff --git a/tests/servertest.sh b/tests/servertest.sh index d6497bdc4b..1662332032 100755 --- a/tests/servertest.sh +++ b/tests/servertest.sh @@ -4,6 +4,8 @@ set -e servertest_bin=./servertest if [ -e ./servertest.exe ]; then servertest_bin=./servertest.exe +elif [ -e ./servertest.js ]; then + servertest_bin="node ./servertest.js" fi if [ -z $srcdir ]; then From 08664de74c39da767736a35480f9e4dc8af54131 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 19:18:51 +0300 Subject: [PATCH 0744/1283] fix shutdowntest changed the shutdowntest.sh to search to .js file as well. added preload-file link flag to enable access to TEST_SOURCE_DIR --- tests/CMakeLists.txt | 3 +++ tests/shutdowntest.sh | 2 ++ 2 files changed, 5 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 0da7022d79..12d4308880 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -663,6 +663,9 @@ add_platform_test(sha_test sha_test) set(SHUTDOWNTEST_SRC shutdowntest.c) add_executable(shutdowntest ${SHUTDOWNTEST_SRC}) target_link_libraries(shutdowntest ${OPENSSL_TEST_LIBS}) +if(EMSCRIPTEN) + set_target_properties(shutdowntest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") +endif() if(NOT MSVC) add_test(NAME shutdowntest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/shutdowntest.sh) else() diff --git a/tests/shutdowntest.sh b/tests/shutdowntest.sh index d4aec1c87a..d3ae472da6 100755 --- a/tests/shutdowntest.sh +++ b/tests/shutdowntest.sh @@ -4,6 +4,8 @@ set -e shutdowntest_bin=./shutdowntest if [ -e ./shutdowntest.exe ]; then shutdowntest_bin=./shutdowntest.exe +elif [ -e ./shutdowntest.js ]; then + shutdowntest_bin="node ./shutdowntest.js" fi if [ -z $srcdir ]; then From 24ed53e196036f544d59271ca1aa3dbec3548717 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 19:29:28 +0300 Subject: [PATCH 0745/1283] fix ssl_get_shared_ciphers added preload-file link flag to enable access to TEST_SOURCE_DIR --- tests/CMakeLists.txt | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 12d4308880..8755bf8f3e 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -674,7 +674,8 @@ endif() set_tests_properties(shutdowntest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # signertest -if(NOT CMAKE_SYSTEM_NAME MATCHES "WindowsStore") +# Emscripten does not support socketpair syscall. +if(NOT (CMAKE_SYSTEM_NAME MATCHES "WindowsStore" OR EMSCRIPTEN)) set(SIGNERTEST_SRC signertest.c) check_function_exists(pipe2 HAVE_PIPE2) if(HAVE_PIPE2) @@ -710,6 +711,9 @@ add_executable(ssl_get_shared_ciphers ssl_get_shared_ciphers.c) set_source_files_properties(ssl_get_shared_ciphers.c PROPERTIES COMPILE_FLAGS -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") target_link_libraries(ssl_get_shared_ciphers ${OPENSSL_TEST_LIBS}) +if(EMSCRIPTEN) + set_target_properties(ssl_get_shared_ciphers PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") +endif() add_platform_test(ssl_get_shared_ciphers ssl_get_shared_ciphers) # ssl_methods From eab5ace757bba8f5491e1a6c1381875c4aeebb07 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 19:52:59 +0300 Subject: [PATCH 0746/1283] fix ssltest changed the ssltest.sh to search to .js file as well. added preload-file link flag to enable access to TEST_SOURCE_DIR --- tests/CMakeLists.txt | 3 +++ tests/ssltest.sh | 8 +++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 8755bf8f3e..1005dfd49f 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -739,6 +739,9 @@ add_platform_test(ssl_versions ssl_versions) # ssltest add_executable(ssltest ssltest.c) target_link_libraries(ssltest ${OPENSSL_TEST_LIBS}) +if(EMSCRIPTEN) + set_target_properties(ssltest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") +endif() if(NOT MSVC) add_test(NAME ssltest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssltest.sh) else() diff --git a/tests/ssltest.sh b/tests/ssltest.sh index 22a8936671..29ea0b0859 100755 --- a/tests/ssltest.sh +++ b/tests/ssltest.sh @@ -4,17 +4,23 @@ set -e ssltest_bin=./ssltest if [ -e ./ssltest.exe ]; then ssltest_bin=./ssltest.exe +elif [ -e ./ssltest.js ]; then + ssltest_bin="node ./ssltest.js" fi if [ -d ../apps/openssl ]; then openssl_bin=../apps/openssl/openssl if [ -e ../apps/openssl/openssl.exe ]; then openssl_bin=../apps/openssl/openssl.exe + elif [ -e ../apps/openssl/openssl.js ]; then + openssl_bin="node ../apps/openssl/openssl.js" fi else openssl_bin=../apps/openssl if [ -e ../apps/openssl.exe ]; then openssl_bin=../apps/openssl.exe + elif [ -e ../apps/openssl.js ]; then + openssl_bin="node ../apps/openssl.js" fi fi @@ -24,4 +30,4 @@ fi $srcdir/testssl $srcdir/server1-rsa.pem $srcdir/server1-rsa-chain.pem \ $srcdir/ca-root-rsa.pem \ - $ssltest_bin $openssl_bin + "$ssltest_bin" "$openssl_bin" From bf429449fb7eb34065d0722f45d3c633fe947878 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 20:50:20 +0300 Subject: [PATCH 0747/1283] disable testdsa testdsa doesn't have an executable instead it uses openssl executable which access various files for IO. adding such files to --preload-file is infeasible. --- tests/CMakeLists.txt | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 1005dfd49f..1ed0396196 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -750,12 +750,16 @@ endif() set_tests_properties(ssltest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # testdsa -if(NOT MSVC) - add_test(NAME testdsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testdsa.sh) -else() - add_test(NAME testdsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testdsa.bat $) +# testdsa doesn't have an executable instead it uses openssl executable which access various files for IO. +# adding such files to --preload-file is infeasible. +if(NOT EMSCRIPTEN) + if(NOT MSVC) + add_test(NAME testdsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testdsa.sh) + else() + add_test(NAME testdsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testdsa.bat $) + endif() + set_tests_properties(testdsa PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") endif() -set_tests_properties(testdsa PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # testenc if(NOT MSVC) From d70a51a32aa8e1dc5934471570aa1970cf76cea7 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 20:53:48 +0300 Subject: [PATCH 0748/1283] disable testenc testenc doesn't have an executable instead it uses openssl executable which access various files for IO. adding such files to --preload-file is infeasible. --- tests/CMakeLists.txt | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 1ed0396196..c560aab08e 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -762,12 +762,16 @@ if(NOT EMSCRIPTEN) endif() # testenc -if(NOT MSVC) - add_test(NAME testenc COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testenc.sh) -else() - add_test(NAME testenc COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testenc.bat $) +# testenc doesn't have an executable instead it uses openssl executable which access various files for IO. +# adding such files to --preload-file is infeasible. +if(NOT EMSCRIPTEN) + if(NOT MSVC) + add_test(NAME testenc COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testenc.sh) + else() + add_test(NAME testenc COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testenc.bat $) + endif() + set_tests_properties(testenc PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") endif() -set_tests_properties(testenc PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # testrsa if(NOT MSVC) From 56007f827a37601b249a354ee3bb24745ea78a9b Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 20:59:12 +0300 Subject: [PATCH 0749/1283] disable testrsa testrsa doesn't have an executable instead it uses openssl executable which access various files for IO. adding such files to --preload-file is infeasible. --- tests/CMakeLists.txt | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index c560aab08e..e0e7404537 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -774,12 +774,16 @@ if(NOT EMSCRIPTEN) endif() # testrsa -if(NOT MSVC) - add_test(NAME testrsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testrsa.sh) -else() - add_test(NAME testrsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testrsa.bat $) +# testrsa doesn't have an executable instead it uses openssl executable which access various files for IO. +# adding such files to --preload-file is infeasible. +if(NOT EMSCRIPTEN) + if(NOT MSVC) + add_test(NAME testrsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testrsa.sh) + else() + add_test(NAME testrsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testrsa.bat $) + endif() + set_tests_properties(testrsa PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") endif() -set_tests_properties(testrsa PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # timingsafe add_executable(timingsafe timingsafe.c) From 08d0f580b2313aaa73eeca14134647336d707bb9 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 21:08:03 +0300 Subject: [PATCH 0750/1283] disable tlstest tlstest uses socketpair syscall which is not supported by Emscripten --- tests/CMakeLists.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index e0e7404537..b475655e08 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -801,7 +801,8 @@ target_link_libraries(tlslegacytest ${OPENSSL_TEST_LIBS}) add_platform_test(tlslegacytest tlslegacytest) # tlstest -if(NOT CMAKE_SYSTEM_NAME MATCHES "WindowsStore") +# Emscripten does not support socketpair syscall. +if(NOT (CMAKE_SYSTEM_NAME MATCHES "WindowsStore" OR EMSCRIPTEN)) set(TLSTEST_SRC tlstest.c) check_function_exists(pipe2 HAVE_PIPE2) if(HAVE_PIPE2) From 64d11fcf11b70edb48f75f55942e8a4c7856bf7a Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 31 May 2024 21:29:14 +0300 Subject: [PATCH 0751/1283] add initial Emscripten CI workflow --- .github/workflows/emscripten.yml | 68 ++++++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 .github/workflows/emscripten.yml diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml new file mode 100644 index 0000000000..c4e896fae0 --- /dev/null +++ b/.github/workflows/emscripten.yml @@ -0,0 +1,68 @@ +# GitHub Actions workflow to run tests on Linux. +name: "Emscripten" + +on: + push: {} + pull_request: {} + schedule: + - cron: "0 0 * * *" # At 00:00 daily. + +concurrency: + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: true + +jobs: + test: + name: "Emscripten" + runs-on: "ubuntu-latest" + if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} + permissions: + contents: read + steps: + - name: "Checkout repository" + uses: actions/checkout@v4 + + - name: "Setup emsdk" + uses: mymindstorm/setup-emsdk@v14 + with: + version: 3.1.60 + + - name: "Prepare repository" + run: "./autogen.sh" + + - name: "Configure CMake" + run: cmake -Bbuild -DCMAKE_CROSSCOMPILING_EMULATOR=$EMSDK/node/18.20.3_64bit/bin/node -DCMAKE_TOOLCHAIN_FILE=$EMSDK/upstream/emscripten/cmake/Modules/Platform/Emscripten.cmake -DENABLE_ASM=OFF + + - name: "Build" + run: cmake --build build --config Release + + - name: "Test" + run: ctest --test-dir build -C Release --output-on-failure + + # Test ASAN with and without ASM enabled. + test-asan: + name: "ASAN (no-asm)" + runs-on: "ubuntu-latest" + if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} + permissions: + contents: read + steps: + - name: "Checkout repository" + uses: actions/checkout@v4 + + - name: "Setup emsdk" + uses: mymindstorm/setup-emsdk@v14 + with: + version: 3.1.60 + + - name: "Prepare repository" + run: "./autogen.sh" + + - name: "Configure CMake" + run: cmake -Bbuild -DCMAKE_CROSSCOMPILING_EMULATOR=$EMSDK/node/18.20.3_64bit/bin/node -DCMAKE_TOOLCHAIN_FILE=$EMSDK/upstream/emscripten/cmake/Modules/Platform/Emscripten.cmake -DENABLE_ASM=OFF + + - name: "Build" + run: cmake --build build --config Release + + - name: "Test" + run: ctest --test-dir build -C Release --output-on-failure From 165582f970c8466cacc3877aa68c5fea8187f56b Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Sat, 1 Jun 2024 23:20:35 +0300 Subject: [PATCH 0752/1283] wrap bn_unit ALLOW_MEMORY_GROWTH in if(EMSCRIPTEN) --- tests/CMakeLists.txt | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index b475655e08..ae19e3be1d 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -252,7 +252,9 @@ add_platform_test(bn_to_string bn_to_string) # bn_unit add_executable(bn_unit bn_unit.c) target_link_libraries(bn_unit ${OPENSSL_TEST_LIBS}) -set_target_properties(bn_unit PROPERTIES LINK_FLAGS "-sALLOW_MEMORY_GROWTH") +if(EMSCRIPTEN) + set_target_properties(bn_unit PROPERTIES LINK_FLAGS "-sALLOW_MEMORY_GROWTH") +endif() add_platform_test(bn_unit bn_unit) # bn_word From c7a7dbd7007838d6d47d97397313b2791aae71b1 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Tue, 4 Jun 2024 21:22:38 +0300 Subject: [PATCH 0753/1283] use emcmake instead of feeding toolchain file manually --- .github/workflows/emscripten.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml index c4e896fae0..14aefe2cd5 100644 --- a/.github/workflows/emscripten.yml +++ b/.github/workflows/emscripten.yml @@ -31,7 +31,7 @@ jobs: run: "./autogen.sh" - name: "Configure CMake" - run: cmake -Bbuild -DCMAKE_CROSSCOMPILING_EMULATOR=$EMSDK/node/18.20.3_64bit/bin/node -DCMAKE_TOOLCHAIN_FILE=$EMSDK/upstream/emscripten/cmake/Modules/Platform/Emscripten.cmake -DENABLE_ASM=OFF + run: emcmake cmake -Bbuild - name: "Build" run: cmake --build build --config Release @@ -59,7 +59,7 @@ jobs: run: "./autogen.sh" - name: "Configure CMake" - run: cmake -Bbuild -DCMAKE_CROSSCOMPILING_EMULATOR=$EMSDK/node/18.20.3_64bit/bin/node -DCMAKE_TOOLCHAIN_FILE=$EMSDK/upstream/emscripten/cmake/Modules/Platform/Emscripten.cmake -DENABLE_ASM=OFF + run: emcmake cmake -Bbuild - name: "Build" run: cmake --build build --config Release From d661f77deddaad2e121fd0fecf71d7ca417ed466 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 7 Jun 2024 16:06:52 +0300 Subject: [PATCH 0754/1283] simplify explicit_bzero comment --- tests/CMakeLists.txt | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index ae19e3be1d..3a76e92b9a 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -425,8 +425,7 @@ add_platform_test(exdata_test exdata_test) # expirecallback.c # explicit_bzero -# explicit_bzero relies on SA_ONSTACK, which is unavailable on Windows -# explicit_bzero relies on sigsuspend, which is unavailable on Emscripten +# SA_ONSTACK is unavailable on Windows, sigsuspend is unavailable on Emscripten if(NOT (WIN32 OR EMSCRIPTEN)) if(HAVE_MEMMEM) add_executable(explicit_bzero explicit_bzero.c) From 6f37c932dc414c177dc87584bcb81587f80385d2 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 7 Jun 2024 16:45:06 +0300 Subject: [PATCH 0755/1283] fix emscripten.yml workflow fix formatting in some commands. Add missing -fsanitize=address to the ASAN test --- .github/workflows/emscripten.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml index 14aefe2cd5..964c53bda0 100644 --- a/.github/workflows/emscripten.yml +++ b/.github/workflows/emscripten.yml @@ -25,10 +25,10 @@ jobs: - name: "Setup emsdk" uses: mymindstorm/setup-emsdk@v14 with: - version: 3.1.60 + version: "3.1.60" - name: "Prepare repository" - run: "./autogen.sh" + run: ./autogen.sh - name: "Configure CMake" run: emcmake cmake -Bbuild @@ -53,13 +53,16 @@ jobs: - name: "Setup emsdk" uses: mymindstorm/setup-emsdk@v14 with: - version: 3.1.60 + version: "3.1.60" - name: "Prepare repository" - run: "./autogen.sh" + run: ./autogen.sh - name: "Configure CMake" run: emcmake cmake -Bbuild + env: + CFLAGS: "-ggdb -fsanitize=address" + LDFLAGS: "-fsanitize=address" - name: "Build" run: cmake --build build --config Release From 075c0a01e9ced22d3fcf734ef20f62529f395b54 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 7 Jun 2024 18:23:28 +0300 Subject: [PATCH 0756/1283] replace if(EMSCRIPTEN) with prepare_emscripten_test_target function introduce prepare_emscripten_test_target function to setup `--preload-file` and `-sALLOW_MEMORY_GROWTH` linker flags for test targets --- tests/CMakeLists.txt | 67 ++++++++++++++++++++------------------------ 1 file changed, 31 insertions(+), 36 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 3a76e92b9a..ed7b2532b0 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -22,6 +22,13 @@ add_definitions(-D_PATH_SSL_CA_FILE=\"${CMAKE_CURRENT_SOURCE_DIR}/../cert.pem\") file(TO_NATIVE_PATH ${CMAKE_CURRENT_SOURCE_DIR} TEST_SOURCE_DIR) +function(prepare_emscripten_test_target TARGET_NAME) + if(EMSCRIPTEN) + set_target_properties(${TARGET_NAME} PROPERTIES LINK_FLAGS + "-sALLOW_MEMORY_GROWTH --preload-file ${TEST_SOURCE_DIR} ") + endif() +endfunction() + function(add_platform_test TEST_NAME) if (EMSCRIPTEN) add_test(NAME ${TEST_NAME} COMMAND node ${ARGN}) @@ -33,9 +40,7 @@ endfunction() # aeadtest add_executable(aeadtest aeadtest.c) target_link_libraries(aeadtest ${OPENSSL_TEST_LIBS}) -if(EMSCRIPTEN) - set_target_properties(aeadtest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") -endif() +prepare_emscripten_test_target(aeadtest) if(NOT WIN32) add_test(NAME aeadtest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/aeadtest.sh) set_tests_properties(aeadtest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") @@ -58,9 +63,7 @@ add_executable(apitest apitest.c) target_link_libraries(apitest ${OPENSSL_TEST_LIBS}) set_source_files_properties(apitest.c PROPERTIES COMPILE_FLAGS -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") -if(EMSCRIPTEN) - set_target_properties(apitest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") -endif() +prepare_emscripten_test_target(apitest) add_platform_test(apitest apitest) # arc4randomforktest @@ -123,6 +126,7 @@ endif() # asn1x509 add_executable(asn1x509 asn1x509.c) target_link_libraries(asn1x509 ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(asn1x509) add_platform_test(asn1x509 asn1x509) # asn1_string_to_utf8 @@ -153,6 +157,7 @@ add_platform_test(bio_chain bio_chain) # bio_dump add_executable(bio_dump bio_dump.c) target_link_libraries(bio_dump ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(bio_dump) add_platform_test(bio_dump bio_dump) # bio_host @@ -166,6 +171,7 @@ endif() # bio_mem add_executable(bio_mem bio_mem.c) target_link_libraries(bio_mem ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(bio_mem) add_platform_test(bio_mem bio_mem) # bn_add_sub @@ -198,6 +204,7 @@ add_platform_test(bn_gcd bn_gcd) # bn_isqrt add_executable(bn_isqrt bn_isqrt.c) target_link_libraries(bn_isqrt ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(bn_isqrt) add_platform_test(bn_isqrt bn_isqrt) # bn_mod_exp @@ -225,6 +232,7 @@ add_platform_test(bn_mont bn_mont) # bn_primes add_executable(bn_primes bn_primes.c) target_link_libraries(bn_primes ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(bn_primes) add_platform_test(bn_primes bn_primes) # bn_print @@ -235,6 +243,7 @@ add_platform_test(bn_print bn_print) # bn_shift add_executable(bn_shift bn_shift.c) target_link_libraries(bn_shift ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(bn_shift) add_platform_test(bn_shift bn_shift) # bn_test @@ -252,9 +261,7 @@ add_platform_test(bn_to_string bn_to_string) # bn_unit add_executable(bn_unit bn_unit.c) target_link_libraries(bn_unit ${OPENSSL_TEST_LIBS}) -if(EMSCRIPTEN) - set_target_properties(bn_unit PROPERTIES LINK_FLAGS "-sALLOW_MEMORY_GROWTH") -endif() +prepare_emscripten_test_target(bn_unit) add_platform_test(bn_unit bn_unit) # bn_word @@ -303,6 +310,7 @@ add_platform_test(cipherstest cipherstest) # cmstest add_executable(cmstest cmstest.c) target_link_libraries(cmstest ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(cmstest) add_platform_test(cmstest cmstest) # configtest @@ -325,9 +333,7 @@ add_executable(cttest cttest.c) target_link_libraries(cttest ${OPENSSL_TEST_LIBS}) set_source_files_properties(cttest.c PROPERTIES COMPILE_FLAGS -DCTPATH=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") -if(EMSCRIPTEN) - set_target_properties(cttest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") -endif() +prepare_emscripten_test_target(cttest) add_platform_test(cttest cttest) # destest @@ -367,6 +373,7 @@ add_platform_test(ec_asn1_test ec_asn1_test) # ec_point_conversion add_executable(ec_point_conversion ec_point_conversion.c) target_link_libraries(ec_point_conversion ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(ec_point_conversion) add_platform_test(ec_point_conversion ec_point_conversion) # ecdhtest @@ -407,9 +414,7 @@ add_platform_test(evp_pkey_cleanup evp_pkey_cleanup) # evptest add_executable(evptest evptest.c) target_link_libraries(evptest ${OPENSSL_TEST_LIBS}) -if(EMSCRIPTEN) - set_target_properties(evptest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") -endif() +prepare_emscripten_test_target(evptest) add_platform_test(evptest evptest ${CMAKE_CURRENT_SOURCE_DIR}/evptests.txt) # evp_test @@ -489,9 +494,7 @@ add_platform_test(key_schedule key_schedule) add_executable(keypairtest keypairtest.c) target_link_libraries(keypairtest ${LIBTLS_TEST_LIBS}) target_include_directories(keypairtest BEFORE PUBLIC ../tls) -if(EMSCRIPTEN) - set_target_properties(keypairtest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") -endif() +prepare_emscripten_test_target(keypairtest) add_platform_test(keypairtest keypairtest ${CMAKE_CURRENT_SOURCE_DIR}/ca-root-rsa.pem ${CMAKE_CURRENT_SOURCE_DIR}/server1-rsa.pem @@ -500,6 +503,7 @@ add_platform_test(keypairtest keypairtest # lhash_test add_executable(lhash_test lhash_test.c) target_link_libraries(lhash_test ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(lhash_test) add_platform_test(lhash_test lhash_test) # md_test @@ -531,6 +535,7 @@ add_platform_test(optionstest optionstest) # pbkdf2 add_executable(pbkdf2 pbkdf2.c) target_link_libraries(pbkdf2 ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(pbkdf2) add_platform_test(pbkdf2 pbkdf2) # pidwraptest @@ -545,6 +550,7 @@ endif() # pkcs7test add_executable(pkcs7test pkcs7test.c) target_link_libraries(pkcs7test ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(pkcs7test) add_platform_test(pkcs7test pkcs7test) # poly1305test @@ -557,9 +563,7 @@ add_executable(policy policy.c) set_source_files_properties(policy.c PROPERTIES COMPILE_FLAGS -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") target_link_libraries(policy ${OPENSSL_TEST_LIBS}) -if(EMSCRIPTEN) - set_target_properties(policy PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") -endif() +prepare_emscripten_test_target(policy) add_platform_test(policy policy) # pq_test @@ -577,9 +581,7 @@ set_tests_properties(pq_test PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") set(QUICTEST_SRC quictest.c) add_executable(quictest ${QUICTEST_SRC}) target_link_libraries(quictest ${OPENSSL_TEST_LIBS}) -if(EMSCRIPTEN) - set_target_properties(quictest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") -endif() +prepare_emscripten_test_target(quictest) if(NOT MSVC) add_test(NAME quictest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/quictest.sh) else() @@ -645,9 +647,7 @@ add_platform_test(rsa_test rsa_test) # servertest add_executable(servertest servertest.c) target_link_libraries(servertest ${OPENSSL_TEST_LIBS}) -if(EMSCRIPTEN) - set_target_properties(servertest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") -endif() +prepare_emscripten_test_target(servertest) if(NOT MSVC) add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.sh) else() @@ -664,9 +664,7 @@ add_platform_test(sha_test sha_test) set(SHUTDOWNTEST_SRC shutdowntest.c) add_executable(shutdowntest ${SHUTDOWNTEST_SRC}) target_link_libraries(shutdowntest ${OPENSSL_TEST_LIBS}) -if(EMSCRIPTEN) - set_target_properties(shutdowntest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") -endif() +prepare_emscripten_test_target(shutdowntest) if(NOT MSVC) add_test(NAME shutdowntest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/shutdowntest.sh) else() @@ -712,9 +710,7 @@ add_executable(ssl_get_shared_ciphers ssl_get_shared_ciphers.c) set_source_files_properties(ssl_get_shared_ciphers.c PROPERTIES COMPILE_FLAGS -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\") target_link_libraries(ssl_get_shared_ciphers ${OPENSSL_TEST_LIBS}) -if(EMSCRIPTEN) - set_target_properties(ssl_get_shared_ciphers PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") -endif() +prepare_emscripten_test_target(ssl_get_shared_ciphers) add_platform_test(ssl_get_shared_ciphers ssl_get_shared_ciphers) # ssl_methods @@ -740,9 +736,7 @@ add_platform_test(ssl_versions ssl_versions) # ssltest add_executable(ssltest ssltest.c) target_link_libraries(ssltest ${OPENSSL_TEST_LIBS}) -if(EMSCRIPTEN) - set_target_properties(ssltest PROPERTIES LINK_FLAGS "--preload-file ${TEST_SOURCE_DIR}") -endif() +prepare_emscripten_test_target(ssltest) if(NOT MSVC) add_test(NAME ssltest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssltest.sh) else() @@ -799,6 +793,7 @@ add_platform_test(tlsexttest tlsexttest) # tlslegacytest add_executable(tlslegacytest tlslegacytest.c) target_link_libraries(tlslegacytest ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(tlslegacytest) add_platform_test(tlslegacytest tlslegacytest) # tlstest From f788dea498c3a27a39236b8a8fb0e2186ed21cd1 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 7 Jun 2024 18:26:36 +0300 Subject: [PATCH 0757/1283] use -gsource-map instead of -ggdb --- .github/workflows/emscripten.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml index 964c53bda0..506cbee213 100644 --- a/.github/workflows/emscripten.yml +++ b/.github/workflows/emscripten.yml @@ -61,7 +61,7 @@ jobs: - name: "Configure CMake" run: emcmake cmake -Bbuild env: - CFLAGS: "-ggdb -fsanitize=address" + CFLAGS: "-gsource-map -fsanitize=address" LDFLAGS: "-fsanitize=address" - name: "Build" From 30e571fb5fb49ad6ea880dc8813f6d4b1042f0fd Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 7 Jun 2024 19:49:48 +0300 Subject: [PATCH 0758/1283] group testdsa, testenc, and testrsa under a single if(NOT EMSCRIPTEN) --- tests/CMakeLists.txt | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index ed7b2532b0..bee98c6364 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -744,34 +744,26 @@ else() endif() set_tests_properties(ssltest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") -# testdsa -# testdsa doesn't have an executable instead it uses openssl executable which access various files for IO. -# adding such files to --preload-file is infeasible. +# testdsa, testenc, testrsa don't have an executable instead it uses openssl executable which +# access various files for IO. adding such files to --preload-file is infeasible. if(NOT EMSCRIPTEN) + # testdsa if(NOT MSVC) add_test(NAME testdsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testdsa.sh) else() add_test(NAME testdsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testdsa.bat $) endif() set_tests_properties(testdsa PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") -endif() -# testenc -# testenc doesn't have an executable instead it uses openssl executable which access various files for IO. -# adding such files to --preload-file is infeasible. -if(NOT EMSCRIPTEN) + # testenc if(NOT MSVC) add_test(NAME testenc COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testenc.sh) else() add_test(NAME testenc COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testenc.bat $) endif() set_tests_properties(testenc PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") -endif() -# testrsa -# testrsa doesn't have an executable instead it uses openssl executable which access various files for IO. -# adding such files to --preload-file is infeasible. -if(NOT EMSCRIPTEN) + # testrsa if(NOT MSVC) add_test(NAME testrsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testrsa.sh) else() From 1b4bf24d88b2346ca83aaaf061817bd07b882fea Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Fri, 7 Jun 2024 19:56:12 +0300 Subject: [PATCH 0759/1283] call prepare_emscripten_test_target for x509_asn1 to fix an OOM error when built in asan mode, x509_asn1 fails with an Out Of Memory error because of higher memory usage of address sanitizer. This commit sets `-sALLOW_MEMORY_GROWTH` for that target by calling prepare_emscripten_test_target --- tests/CMakeLists.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index bee98c6364..f36e9a109e 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -857,6 +857,7 @@ add_platform_test(x509_algor x509_algor) # x509_asn1 add_executable(x509_asn1 x509_asn1.c) target_link_libraries(x509_asn1 ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(x509_asn1) add_platform_test(x509_asn1 x509_asn1) # x509_extensions_test From 71e574aa67c00ddefc9c59adb1f476af8697f640 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Mon, 10 Jun 2024 21:31:42 +0300 Subject: [PATCH 0760/1283] use compat implementations of strlcpy and strlcat strlcpy and strlcat Emscripten implementations cause ASAN errors. This commit disables strlcpy and strlcat detection and uses the compat implementations instead. --- CMakeLists.txt | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 438e6229a4..c496ad97b5 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -220,14 +220,17 @@ if(HAVE_STRCASECMP) add_definitions(-DHAVE_STRCASECMP) endif() -check_function_exists(strlcat HAVE_STRLCAT) -if(HAVE_STRLCAT) - add_definitions(-DHAVE_STRLCAT) -endif() +# Emscripten's strlcat and strlcpy triggers ASAN errors +if(NOT EMSCRIPTEN) + check_function_exists(strlcat HAVE_STRLCAT) + if(HAVE_STRLCAT) + add_definitions(-DHAVE_STRLCAT) + endif() -check_function_exists(strlcpy HAVE_STRLCPY) -if(HAVE_STRLCPY) - add_definitions(-DHAVE_STRLCPY) + check_function_exists(strlcpy HAVE_STRLCPY) + if(HAVE_STRLCPY) + add_definitions(-DHAVE_STRLCPY) + endif() endif() check_function_exists(strndup HAVE_STRNDUP) From a949ecf49fcb6f9522a87c4e6d1457ce42708760 Mon Sep 17 00:00:00 2001 From: Mostafa Saad Date: Sun, 16 Jun 2024 11:08:38 +0300 Subject: [PATCH 0761/1283] Fix comment in emscripten.yml Co-authored-by: Joshua Sing --- .github/workflows/emscripten.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml index 506cbee213..07f140d212 100644 --- a/.github/workflows/emscripten.yml +++ b/.github/workflows/emscripten.yml @@ -1,4 +1,4 @@ -# GitHub Actions workflow to run tests on Linux. +# GitHub Actions workflow to run for Emscripten. name: "Emscripten" on: From 683f523f8d49fc5b7529a032761ffb1a001e56e1 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 19 Jun 2024 14:04:45 +0200 Subject: [PATCH 0762/1283] grammar tweak --- tests/CMakeLists.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index f36e9a109e..480d893571 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -744,8 +744,8 @@ else() endif() set_tests_properties(ssltest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") -# testdsa, testenc, testrsa don't have an executable instead it uses openssl executable which -# access various files for IO. adding such files to --preload-file is infeasible. +# testdsa, testenc, testrsa don't have an executable instead they use openssl executable which +# access various files for IO. Adding such files to --preload-file is infeasible. if(NOT EMSCRIPTEN) # testdsa if(NOT MSVC) From 809e0668acb325b17611ac256ad81bf97b180038 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 19 Jun 2024 14:05:57 +0200 Subject: [PATCH 0763/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 5c90e8a2f5..acb34fb582 100644 --- a/ChangeLog +++ b/ChangeLog @@ -31,6 +31,7 @@ LibreSSL Portable Release Notes: 4.0.0 - In development * Portable changes + - Added initial Emscripten support in CMake builds - Removed timegm() compatibility layer since all uses were replaced with OPENSSL_timegm(). Cleaned up the corresponding test harness. * Internal improvements From 7f2c181d0174e9d7a1e138fa5238dc546d6ab721 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 19 Jun 2024 06:10:33 -0600 Subject: [PATCH 0764/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index acb34fb582..42e5f8550b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -59,6 +59,9 @@ LibreSSL Portable Release Notes: - Rewrote various BN conversion functions. - Improved certification request internals. - Removed unused DSA methods. + - Improved X.509v3 extension internals. Fixed various bugs and leaks + in X509V3_add1_i2d() and X509V3_get_d2i(). Their implementations + now vaguely resemble code. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security From 968290c69731cd34bfa82debc8e4ab71d2f63006 Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Thu, 20 Jun 2024 21:25:51 +0300 Subject: [PATCH 0765/1283] add Emscripten to compatible operating systems list --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index b4fff87c4d..725df185ee 100644 --- a/README.md +++ b/README.md @@ -44,6 +44,7 @@ At the time of this writing, LibreSSL is known to build and work on: * Solaris 11 and later * Mac OS X (tested with 10.8 and later) * AIX (5.3 and later) +* Emscripten (3.1.44 and later) LibreSSL also supports the following Windows environments: From c231e3bc82370637c0bd17300b7c6fc66bd0b2fd Mon Sep 17 00:00:00 2001 From: MoustaphaSaad Date: Thu, 20 Jun 2024 21:27:12 +0300 Subject: [PATCH 0766/1283] add note about using emcmake with Emscripten in specific systems section --- README.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/README.md b/README.md index 725df185ee..598188cc27 100644 --- a/README.md +++ b/README.md @@ -159,6 +159,18 @@ LibreSSL builds against relatively recent versions of [MinGW-w64](https://www.mi confused with the original mingw.org project. MinGW-w64 3.2 or later should work. See [README.mingw.md](README.mingw.md) for more information. +### Emscripten + +When configuring LibreSSL for use with Emscripten, make sure to prepend +`emcmake` to your `cmake` configuration command. Once configured, you can +proceed with your usual `cmake` commands. For example: + +```sh +emcmake cmake . -Bbuild +cmake --build build --config Release +ctest --test-dir build -C Release --output-on-failure +``` + # Using LibreSSL ## CMake From 79329e9dcf72a521dd4d66323dee05a28fbeb348 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 22 Jun 2024 14:22:58 -0600 Subject: [PATCH 0767/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 42e5f8550b..5226197b0c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -62,6 +62,7 @@ LibreSSL Portable Release Notes: - Improved X.509v3 extension internals. Fixed various bugs and leaks in X509V3_add1_i2d() and X509V3_get_d2i(). Their implementations now vaguely resemble code. + - Rewrote BN_bn2mpi() using CBB. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security From c5ff2daef0a196d85a13747a861bfa75b8f0f588 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 24 Jun 2024 00:46:12 -0600 Subject: [PATCH 0768/1283] Link err_local.h to build --- crypto/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 08c632dcad..e2e4e39c4c 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -565,6 +565,7 @@ libcrypto_la_SOURCES += engine/engine_stubs.c libcrypto_la_SOURCES += err/err.c libcrypto_la_SOURCES += err/err_all.c libcrypto_la_SOURCES += err/err_prn.c +noinst_HEADERS += err/err_local.h # evp libcrypto_la_SOURCES += evp/bio_b64.c From 62e28ea7ff214b1156e6bbac5085a5357ae6bab2 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 24 Jun 2024 00:47:28 -0600 Subject: [PATCH 0769/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 5226197b0c..1d39d6604a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -63,6 +63,7 @@ LibreSSL Portable Release Notes: in X509V3_add1_i2d() and X509V3_get_d2i(). Their implementations now vaguely resemble code. - Rewrote BN_bn2mpi() using CBB. + - Made most error string tables const. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security From b0897535272740fd8d1f5d0ec0b8030d53dbcca2 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 25 Jun 2024 13:46:41 -0600 Subject: [PATCH 0770/1283] Update ChangeLog --- ChangeLog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index 1d39d6604a..42b2c59e42 100644 --- a/ChangeLog +++ b/ChangeLog @@ -98,6 +98,10 @@ LibreSSL Portable Release Notes: to zero, which could lead to a crash due to accessing a zero sized allocation. - Fixed i2d_ASN1_OBJECT() with an output buffer pointing to NULL. + - Implemented RSA key exchange in constant time. This is done by + decrypting with RSA_NO_PADDING and checking the padding in libssl + in constant time. This is possible because the pre-master secret + is of known length based on the size of the RSA key. 3.9.0 - Development release From 48b357c67feffdd152ad12b0606176ccb08e3eb3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 25 Jun 2024 14:02:18 -0600 Subject: [PATCH 0771/1283] Need to pass crypto/err to -I --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 5ec9eb8f10..bd1a142ef5 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -826,6 +826,7 @@ target_include_directories(crypto_obj ec ecdh ecdsa + err evp hidden hmac diff --git a/crypto/Makefile.am b/crypto/Makefile.am index e2e4e39c4c..357e669f11 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -11,6 +11,7 @@ AM_CPPFLAGS += -I$(top_srcdir)/crypto/dsa AM_CPPFLAGS += -I$(top_srcdir)/crypto/ec AM_CPPFLAGS += -I$(top_srcdir)/crypto/ecdh AM_CPPFLAGS += -I$(top_srcdir)/crypto/ecdsa +AM_CPPFLAGS += -I$(top_srcdir)/crypto/err AM_CPPFLAGS += -I$(top_srcdir)/crypto/evp AM_CPPFLAGS += -I$(top_srcdir)/crypto/hmac AM_CPPFLAGS += -I$(top_srcdir)/crypto/lhash From 57a4289e8d9d6dbc46b668546f9d51cc8e6645ea Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 25 Jun 2024 14:08:20 -0600 Subject: [PATCH 0772/1283] reach from ssl into crypto for crypto_internal.h --- ssl/CMakeLists.txt | 1 + ssl/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 9be9e99858..e2eeab5ecf 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -65,6 +65,7 @@ target_include_directories(ssl_obj PRIVATE . hidden + ../crypto ../crypto/bio ../include/compat PUBLIC diff --git a/ssl/Makefile.am b/ssl/Makefile.am index dca98e2181..a7a7d72338 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -2,6 +2,7 @@ include $(top_srcdir)/Makefile.am.common -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk +AM_CPPFLAGS += -I$(top_srcdir)/crypto AM_CPPFLAGS += -I$(top_srcdir)/crypto/bio noinst_LTLIBRARIES = libbs.la From 56d32d01f0a6b48a5c0bdad29e251d005ae02897 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 28 Jun 2024 09:36:56 -0600 Subject: [PATCH 0773/1283] Update ChangeLog --- ChangeLog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index 42b2c59e42..da7de62382 100644 --- a/ChangeLog +++ b/ChangeLog @@ -64,6 +64,7 @@ LibreSSL Portable Release Notes: now vaguely resemble code. - Rewrote BN_bn2mpi() using CBB. - Made most error string tables const. + - Removed handling for SSLv2 client hello messages. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security @@ -102,6 +103,9 @@ LibreSSL Portable Release Notes: decrypting with RSA_NO_PADDING and checking the padding in libssl in constant time. This is possible because the pre-master secret is of known length based on the size of the RSA key. + - Rewrote SSL_select_next_proto() using CBS, also fixing a buffer + overread that wasn't reachable when used as intended from an + ALPN callback. 3.9.0 - Development release From 050b6de79ecc25691569e2c383195a7adceaa359 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 8 Jul 2024 00:52:31 -0600 Subject: [PATCH 0774/1283] spkac.c is no more --- apps/openssl/CMakeLists.txt | 1 - apps/openssl/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/apps/openssl/CMakeLists.txt b/apps/openssl/CMakeLists.txt index f2dcf97c6a..bca60e1444 100644 --- a/apps/openssl/CMakeLists.txt +++ b/apps/openssl/CMakeLists.txt @@ -42,7 +42,6 @@ set( sess_id.c smime.c speed.c - spkac.c ts.c verify.c version.c diff --git a/apps/openssl/Makefile.am b/apps/openssl/Makefile.am index 2567ef0407..810408d517 100644 --- a/apps/openssl/Makefile.am +++ b/apps/openssl/Makefile.am @@ -58,7 +58,6 @@ openssl_SOURCES += s_time.c openssl_SOURCES += sess_id.c openssl_SOURCES += smime.c openssl_SOURCES += speed.c -openssl_SOURCES += spkac.c openssl_SOURCES += ts.c openssl_SOURCES += verify.c openssl_SOURCES += version.c From c4ec5db72db4ec4cb622ff0c85b6514b48cb7f9e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 8 Jul 2024 00:57:00 -0600 Subject: [PATCH 0775/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index da7de62382..2c02fd0320 100644 --- a/ChangeLog +++ b/ChangeLog @@ -82,6 +82,7 @@ LibreSSL Portable Release Notes: - Removed typdefs for COMP_CTX, COMP_METHOD, X509_CRL_METHOD, STORE, STORE_METHOD, and SSL_AEAD_CTX. - i2d_ASN1_OBJECT() now returns -1 on error like most other i2d_*. + - SPKAC support was removed from openssl(1) * Bug fixes - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match their documentation. They always set an RFC 5280 conformant time. From 6367ad16dd7a96997fd412ccb8f0797837eaabbd Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 9 Jul 2024 09:27:01 -0600 Subject: [PATCH 0776/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 2c02fd0320..1d43d2fc54 100644 --- a/ChangeLog +++ b/ChangeLog @@ -107,6 +107,8 @@ LibreSSL Portable Release Notes: - Rewrote SSL_select_next_proto() using CBS, also fixing a buffer overread that wasn't reachable when used as intended from an ALPN callback. + - Avoid pushing a spurious error onto the error stack in + ssl_sigalg_select(). 3.9.0 - Development release From b26d6bfcbdcfc372feb5c0b3fadab143933d51d9 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 9 Jul 2024 15:41:08 -0600 Subject: [PATCH 0777/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 1d43d2fc54..07924c60fc 100644 --- a/ChangeLog +++ b/ChangeLog @@ -83,6 +83,7 @@ LibreSSL Portable Release Notes: STORE_METHOD, and SSL_AEAD_CTX. - i2d_ASN1_OBJECT() now returns -1 on error like most other i2d_*. - SPKAC support was removed from openssl(1) + - Added TLS1-PRF support to the EVP interface. * Bug fixes - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match their documentation. They always set an RFC 5280 conformant time. From 1e162d446b4e0882060e2e00afaaaeae6e4ca10c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 9 Jul 2024 15:46:36 -0600 Subject: [PATCH 0778/1283] Add tls1_prf.c to build --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index bd1a142ef5..b882dbe78c 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -485,6 +485,7 @@ set( evp/pmeth_gn.c evp/pmeth_lib.c hkdf/hkdf.c + hkdf/tls1_prf.c hmac/hm_ameth.c hmac/hm_pmeth.c hmac/hmac.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 357e669f11..3a463efda9 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -687,6 +687,7 @@ noinst_HEADERS += idea/idea_local.h # kdf libcrypto_la_SOURCES += kdf/hkdf_evp.c libcrypto_la_SOURCES += kdf/kdf_err.c +libcrypto_la_SOURCES += kdf/tls1_prf.c # lhash libcrypto_la_SOURCES += lhash/lhash.c From 3d895bd51bf79afaaa168d076c65a71086582b60 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 9 Jul 2024 15:52:53 -0600 Subject: [PATCH 0779/1283] tls1_prf is in kdf/, not in hkdf/ --- crypto/CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index b882dbe78c..5ee20ffa27 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -485,13 +485,13 @@ set( evp/pmeth_gn.c evp/pmeth_lib.c hkdf/hkdf.c - hkdf/tls1_prf.c hmac/hm_ameth.c hmac/hm_pmeth.c hmac/hmac.c idea/idea.c kdf/hkdf_evp.c kdf/kdf_err.c + kdf/tls1_prf.c lhash/lhash.c md4/md4.c md5/md5.c From 3b5f0177ff2c3976863c520bb164d68fdde39ec0 Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni Date: Sat, 13 Jul 2024 14:32:29 +0200 Subject: [PATCH 0780/1283] include/CMakeLists.txt: error out when architecture is not supported Since commit b98c56fd5e86fa76eb55a98a2266a923f64f705c ("stop exposing hidden defines in public opensslconf.h"), only a subset of CPU architectures is supported by libressl. However, when a build is attempted for an unsupported architecture, it doesn't fail with a clear error message at configure time, but it fails with a weird error at build time: crypto/../include/openssl/rc4.h:75:9: error: unknown type name 'RC4_INT' In order to help users, let's bail out nicely at configure time with a good error message when the CPU architecture is not supported. Signed-off-by: Thomas Petazzoni --- include/CMakeLists.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt index 9d015cd5ea..59f5b62adc 100644 --- a/include/CMakeLists.txt +++ b/include/CMakeLists.txt @@ -38,5 +38,7 @@ elseif(HOST_SPARC64) file(READ arch/sparc64/opensslconf.h OPENSSLCONF) elseif(HOST_X86_64) file(READ arch/amd64/opensslconf.h OPENSSLCONF) +else() + message(FATAL_ERROR "Architecture not supported") endif() file(WRITE ${CMAKE_BINARY_DIR}/include/openssl/opensslconf.h "${OPENSSLCONF}") From 40d85d8623e8995e101431352488785a4d9b2a7f Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 13 Jul 2024 09:49:06 -0600 Subject: [PATCH 0781/1283] Update ChangeLog --- ChangeLog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index 07924c60fc..fbd0822a97 100644 --- a/ChangeLog +++ b/ChangeLog @@ -65,6 +65,8 @@ LibreSSL Portable Release Notes: - Rewrote BN_bn2mpi() using CBB. - Made most error string tables const. - Removed handling for SSLv2 client hello messages. + - Improvements in the openssl(1) speed app's signal handler. + - Added support for TLS PRF in the EVP KDF API. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security @@ -84,6 +86,8 @@ LibreSSL Portable Release Notes: - i2d_ASN1_OBJECT() now returns -1 on error like most other i2d_*. - SPKAC support was removed from openssl(1) - Added TLS1-PRF support to the EVP interface. + - Cleaned up various X509v3_* extension API. + - Unified the X.509v3 extension methods. * Bug fixes - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match their documentation. They always set an RFC 5280 conformant time. From 2eb32c2e9b9a687d70e454b2d05e54ca913f8014 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 13 Jul 2024 10:29:30 -0600 Subject: [PATCH 0782/1283] speed.c is likely broken on Windows, so add a hack --- patches/speed.c.patch | 41 +++++++++++++++++++++++++++++------------ 1 file changed, 29 insertions(+), 12 deletions(-) diff --git a/patches/speed.c.patch b/patches/speed.c.patch index 4b129f8718..1d6d021221 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -1,6 +1,6 @@ ---- apps/openssl/speed.c.orig Fri Jul 28 06:04:45 2023 -+++ apps/openssl/speed.c Fri Jul 28 06:09:00 2023 -@@ -161,7 +161,16 @@ static void +--- apps/openssl/speed.c.orig Sat Jul 13 10:21:42 2024 ++++ apps/openssl/speed.c Sat Jul 13 10:27:25 2024 +@@ -161,7 +161,16 @@ pkey_print_message(const char *str, const char *str2, long num, int bits, int sec); static void print_result(int alg, int run_no, int count, double time_used); @@ -17,17 +17,20 @@ #define ALGOR_NUM 32 #define SIZE_NUM 5 -@@ -431,7 +440,9 @@ speed_main(int argc, char **argv) +@@ -430,9 +439,11 @@ const EVP_CIPHER *evp_cipher = NULL; const EVP_MD *evp_md = NULL; int decrypt = 0; +#ifndef _WIN32 int multi = 0; +- const char *errstr = NULL; + struct sigaction sa; +#endif - const char *errstr = NULL; ++ const char *errstr = NULL; if (pledge("stdio proc", NULL) == -1) { -@@ -506,6 +517,7 @@ speed_main(int argc, char **argv) + perror("pledge"); +@@ -506,6 +517,7 @@ decrypt = 1; j--; /* Otherwise, -decrypt gets confused with an * algorithm. */ @@ -35,7 +38,7 @@ } else if (argc > 0 && strcmp(*argv, "-multi") == 0) { argc--; argv++; -@@ -520,6 +532,7 @@ speed_main(int argc, char **argv) +@@ -520,6 +532,7 @@ } j--; /* Otherwise, -multi gets confused with an * algorithm. */ @@ -43,7 +46,7 @@ } else if (argc > 0 && strcmp(*argv, "-unaligned") == 0) { argc--; argv++; -@@ -855,7 +868,9 @@ speed_main(int argc, char **argv) +@@ -851,7 +864,9 @@ BIO_printf(bio_err, "-evp e use EVP e.\n"); BIO_printf(bio_err, "-decrypt time decryption instead of encryption (only EVP).\n"); BIO_printf(bio_err, "-mr produce machine readable output.\n"); @@ -53,7 +56,7 @@ BIO_printf(bio_err, "-unaligned n use buffers with offset n from proper alignment.\n"); goto end; } -@@ -864,8 +879,10 @@ speed_main(int argc, char **argv) +@@ -860,8 +875,10 @@ j++; } @@ -64,7 +67,21 @@ if (j == 0) { for (i = 0; i < ALGOR_NUM; i++) { -@@ -1742,7 +1759,9 @@ speed_main(int argc, char **argv) +@@ -933,11 +950,13 @@ + #define COND(c) (run && count<0x7fffffff) + #define COUNT(d) (count) + ++#ifndef _WIN32 + memset(&sa, 0, sizeof(sa)); + sigemptyset(&sa.sa_mask); + sa.sa_flags = SA_RESTART; + sa.sa_handler = sig_done; + sigaction(SIGALRM, &sa, NULL); ++#endif + + #ifndef OPENSSL_NO_MD4 + if (doit[D_MD4]) { +@@ -1743,7 +1762,9 @@ ecdh_doit[j] = 0; } } @@ -74,7 +91,7 @@ if (!mr) { fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION)); fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON)); -@@ -1898,11 +1917,15 @@ pkey_print_message(const char *str, const char *str2, +@@ -1899,11 +1920,15 @@ static void print_result(int alg, int run_no, int count, double time_used) { @@ -90,7 +107,7 @@ static char * sstrsep(char **string, const char *delim) { -@@ -2109,4 +2132,5 @@ do_multi(int multi) +@@ -2104,4 +2129,5 @@ free(fds); return 1; } From 9a4c02fdb6f2f7376c6c54119eccd366597a69d6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 13 Jul 2024 11:05:24 -0600 Subject: [PATCH 0783/1283] Simplify speed.c diff --- patches/speed.c.patch | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/patches/speed.c.patch b/patches/speed.c.patch index 1d6d021221..c29ef4d12a 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -1,4 +1,4 @@ ---- apps/openssl/speed.c.orig Sat Jul 13 10:21:42 2024 +--- apps/openssl/speed.c.orig Sat Jul 13 11:02:51 2024 +++ apps/openssl/speed.c Sat Jul 13 10:27:25 2024 @@ -161,7 +161,16 @@ pkey_print_message(const char *str, const char *str2, @@ -17,19 +17,17 @@ #define ALGOR_NUM 32 #define SIZE_NUM 5 -@@ -430,9 +439,11 @@ +@@ -430,8 +439,10 @@ const EVP_CIPHER *evp_cipher = NULL; const EVP_MD *evp_md = NULL; int decrypt = 0; +#ifndef _WIN32 int multi = 0; -- const char *errstr = NULL; struct sigaction sa; +#endif -+ const char *errstr = NULL; + const char *errstr = NULL; if (pledge("stdio proc", NULL) == -1) { - perror("pledge"); @@ -506,6 +517,7 @@ decrypt = 1; j--; /* Otherwise, -decrypt gets confused with an From 60d65be44a70c98329cf100e1805e3e9d8708101 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 13 Jul 2024 12:35:19 -0600 Subject: [PATCH 0784/1283] ssl2.h and ssl23.h are gone --- update.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/update.sh b/update.sh index 415c15a8fe..514da89359 100755 --- a/update.sh +++ b/update.sh @@ -140,7 +140,7 @@ copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h camellia/camellia.h curve25519/curve25519.h ct/ct.h kdf/kdf.h" -copy_hdrs $libssl_src "srtp.h ssl.h ssl2.h ssl3.h ssl23.h tls1.h dtls1.h" +copy_hdrs $libssl_src "srtp.h ssl.h ssl3.h tls1.h dtls1.h" # override upstream opensslv.h if a local version exists if [ -f patches/opensslv.h ]; then From b36b2247add5450748cd78c5a92359fa3babe45a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 13 Jul 2024 12:36:05 -0600 Subject: [PATCH 0785/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index fbd0822a97..c03ff15ebf 100644 --- a/ChangeLog +++ b/ChangeLog @@ -88,6 +88,7 @@ LibreSSL Portable Release Notes: - Added TLS1-PRF support to the EVP interface. - Cleaned up various X509v3_* extension API. - Unified the X.509v3 extension methods. + - Removed ssl2.h and ssl23.h. * Bug fixes - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match their documentation. They always set an RFC 5280 conformant time. From c8ca89425c255790a538c2e7a2520e69454c79ee Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 14 Jul 2024 08:34:15 -0600 Subject: [PATCH 0786/1283] lhash_local.h was removed --- crypto/Makefile.am | 1 - 1 file changed, 1 deletion(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 3a463efda9..6e1e975d45 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -691,7 +691,6 @@ libcrypto_la_SOURCES += kdf/tls1_prf.c # lhash libcrypto_la_SOURCES += lhash/lhash.c -noinst_HEADERS += lhash/lhash_local.h # md4 libcrypto_la_SOURCES += md4/md4.c From 6f4668b7e3277f63a3b373bba739749cf77f4346 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 18 Jul 2024 11:55:58 -0600 Subject: [PATCH 0787/1283] Update ChangeLog --- ChangeLog | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index c03ff15ebf..5966145c14 100644 --- a/ChangeLog +++ b/ChangeLog @@ -66,6 +66,8 @@ LibreSSL Portable Release Notes: - Made most error string tables const. - Removed handling for SSLv2 client hello messages. - Improvements in the openssl(1) speed app's signal handler. + - Cleaned up various X509v3_* extension API. + - Unified the X.509v3 extension methods. - Added support for TLS PRF in the EVP KDF API. * Documentation improvements - Removed documentation of no longer existing API. @@ -86,9 +88,8 @@ LibreSSL Portable Release Notes: - i2d_ASN1_OBJECT() now returns -1 on error like most other i2d_*. - SPKAC support was removed from openssl(1) - Added TLS1-PRF support to the EVP interface. - - Cleaned up various X509v3_* extension API. - - Unified the X.509v3 extension methods. - Removed ssl2.h and ssl23.h. + - Support for attributes in EVP_PKEYs was removed. * Bug fixes - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match their documentation. They always set an RFC 5280 conformant time. From 6f7da782ec4ce17162b3c27d2b3d3e2faf208a97 Mon Sep 17 00:00:00 2001 From: datadiode Date: Fri, 19 Jul 2024 09:35:20 +0200 Subject: [PATCH 0788/1283] tests/compat/pipe2.c: Add create_issue_1069_sentinels() and call it from socketpair() to gain evidence whether issue #1069 is fixed --- tests/compat/pipe2.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/tests/compat/pipe2.c b/tests/compat/pipe2.c index 7600783d3c..c27a858de9 100644 --- a/tests/compat/pipe2.c +++ b/tests/compat/pipe2.c @@ -35,6 +35,22 @@ static int setfl(int fd, int flag) return rc; } +/* + * Have open() temporarily use up file descriptors until reaching beyond the + * allocated sockets, then leak the ones conflicting with any of the latter. + */ +static void create_issue_1069_sentinels(int socket_vector[2]) +{ + int fd = open("CONIN$", O_RDONLY); + if (fd == -1 || fd > socket_vector[0] && fd > socket_vector[1]) { + return; + } + create_issue_1069_sentinels(socket_vector); + if (fd != socket_vector[0] && fd != socket_vector[1]) { + close(fd); + } +} + int socketpair(int domain, int type, int protocol, int socket_vector[2]) { if (domain != AF_UNIX || !(type & SOCK_STREAM) || protocol != PF_UNSPEC) @@ -85,6 +101,9 @@ int socketpair(int domain, int type, int protocol, int socket_vector[2]) goto err; closesocket(listener); + + create_issue_1069_sentinels(socket_vector); + return 0; err: From e6c7de3f03c51fbdcf5ad88bf12fe9e128521f0d Mon Sep 17 00:00:00 2001 From: OPNA2608 Date: Fri, 19 Jul 2024 11:41:46 +0200 Subject: [PATCH 0789/1283] CMakeLists.txt: Fix HOST variable for ppc64 The code here defined HOST_PPC64, but the rest of the build system expects HOST_POWERPC64. --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index c496ad97b5..670aa9a1a0 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -373,7 +373,7 @@ elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "mips") elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "powerpc") set(HOST_POWERPC true) elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "ppc64") - set(HOST_PPC64 true) + set(HOST_POWERPC64 true) elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "riscv64") set(HOST_RISCV64 true) elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "sparc64") From 9c5c0c848f7e9b77bafe8f4a608b0fadb0e34798 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 20 Jul 2024 20:40:35 +0200 Subject: [PATCH 0790/1283] reenable clienttest --- tests/CMakeLists.txt | 6 +++--- tests/Makefile.am | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 480d893571..d81d01202c 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -303,9 +303,9 @@ target_link_libraries(cipherstest ${OPENSSL_TEST_LIBS}) add_platform_test(cipherstest cipherstest) ## clienttest -#add_executable(clienttest clienttest.c) -#target_link_libraries(clienttest ${OPENSSL_TEST_LIBS}) -#add_platform_test(clienttest clienttest) +add_executable(clienttest clienttest.c) +target_link_libraries(clienttest ${OPENSSL_TEST_LIBS}) +add_platform_test(clienttest clienttest) # cmstest add_executable(cmstest cmstest.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index 76ed83aa34..190e4ebdc9 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -297,9 +297,9 @@ check_PROGRAMS += cipherstest cipherstest_SOURCES = cipherstest.c ## clienttest -#TESTS += clienttest -#check_PROGRAMS += clienttest -#clienttest_SOURCES = clienttest.c +TESTS += clienttest +check_PROGRAMS += clienttest +clienttest_SOURCES = clienttest.c # cmstest TESTS += cmstest From 4911bd3b06d5f8efd544227a6d5393a9eed72e1b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 21 Jul 2024 08:05:11 -0600 Subject: [PATCH 0791/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 5966145c14..76709b3cd1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -69,6 +69,7 @@ LibreSSL Portable Release Notes: - Cleaned up various X509v3_* extension API. - Unified the X.509v3 extension methods. - Added support for TLS PRF in the EVP KDF API. + - Cleaned up cipher handling in SSL_SESSION. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security From a94f45b44d5e19f0d0f025594cb9a0aa9ac1e6a3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 23 Jul 2024 15:14:52 -0600 Subject: [PATCH 0792/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 76709b3cd1..20d185c118 100644 --- a/ChangeLog +++ b/ChangeLog @@ -70,6 +70,7 @@ LibreSSL Portable Release Notes: - Unified the X.509v3 extension methods. - Added support for TLS PRF in the EVP KDF API. - Cleaned up cipher handling in SSL_SESSION. + - Removed get_cipher from SSL_METHOD. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security From becbdfbfc36dde9cfc2d509918d44cd4f1b207e6 Mon Sep 17 00:00:00 2001 From: rfl890 <87506407+rfl890@users.noreply.github.com> Date: Fri, 2 Aug 2024 15:10:26 +0500 Subject: [PATCH 0793/1283] Update CMakeLists.txt --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 670aa9a1a0..342d4e817e 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -398,7 +398,7 @@ if(ENABLE_ASM) elseif(MSVC AND (CMAKE_GENERATOR MATCHES "Win64" OR CMAKE_GENERATOR_PLATFORM STREQUAL "x64")) set(HOST_ASM_MASM_X86_64 true) ENABLE_LANGUAGE(ASM_MASM) - elseif(MINGW AND CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64") + elseif(MINGW AND HOST_X86_64) set(HOST_ASM_MINGW64_X86_64 true) endif() endif() From 15451aff6bb61c9a7c8552c84109f3fc6daa242d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 2 Aug 2024 04:54:22 -0600 Subject: [PATCH 0794/1283] ex_data is now implemented in crypto_ex_data.c --- crypto/CMakeLists.txt | 2 +- crypto/Makefile.am | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 5ee20ffa27..7d4ff70c7f 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -221,9 +221,9 @@ set( ${CRYPTO_SRC} cpt_err.c cryptlib.c + crypto_ex_data.c crypto_init.c cversion.c - ex_data.c malloc-wrapper.c mem_clr.c mem_dbg.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 6e1e975d45..cb463fbe25 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -203,6 +203,7 @@ endif libcrypto_la_SOURCES += cpt_err.c libcrypto_la_SOURCES += cryptlib.c +libcrypto_la_SOURCES += crypto_ex_data.c libcrypto_la_SOURCES += crypto_init.c if !HOST_WIN libcrypto_la_SOURCES += crypto_lock.c @@ -210,7 +211,6 @@ else libcrypto_la_SOURCES += compat/crypto_lock_win.c endif libcrypto_la_SOURCES += cversion.c -libcrypto_la_SOURCES += ex_data.c libcrypto_la_SOURCES += malloc-wrapper.c libcrypto_la_SOURCES += mem_clr.c libcrypto_la_SOURCES += mem_dbg.c From 73ba2f055709f60f33dbc1548020edb3b9174048 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 2 Aug 2024 04:54:42 -0600 Subject: [PATCH 0795/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 20d185c118..860896507a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -71,6 +71,9 @@ LibreSSL Portable Release Notes: - Added support for TLS PRF in the EVP KDF API. - Cleaned up cipher handling in SSL_SESSION. - Removed get_cipher from SSL_METHOD. + - Rewrote CRYPTO_EX_DATA from scratch. The only intentional change of + behavior is that there is now a hard limit on the number of indexes + that can be allocated. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security From 161984f56f2953ebedc1a97056e4fd9cb938d672 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 2 Aug 2024 07:32:01 -0600 Subject: [PATCH 0796/1283] Use check_symbol_exists() rather than check_function_exists() --- tests/CMakeLists.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index d81d01202c..f79f69e28d 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -676,7 +676,7 @@ set_tests_properties(shutdowntest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_D # Emscripten does not support socketpair syscall. if(NOT (CMAKE_SYSTEM_NAME MATCHES "WindowsStore" OR EMSCRIPTEN)) set(SIGNERTEST_SRC signertest.c) - check_function_exists(pipe2 HAVE_PIPE2) + check_symbol_exists(pipe2 "fcntl.h unistd.h" HAVE_PIPE2) if(HAVE_PIPE2) add_definitions(-DHAVE_PIPE2) else() @@ -792,7 +792,7 @@ add_platform_test(tlslegacytest tlslegacytest) # Emscripten does not support socketpair syscall. if(NOT (CMAKE_SYSTEM_NAME MATCHES "WindowsStore" OR EMSCRIPTEN)) set(TLSTEST_SRC tlstest.c) - check_function_exists(pipe2 HAVE_PIPE2) + check_symbol_exists(pipe2 "fcntl.h unistd.h" HAVE_PIPE2) if(HAVE_PIPE2) add_definitions(-DHAVE_PIPE2) else() From c05b84c11a5d2a412016c21fc51b4cf6f61f34cf Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 2 Aug 2024 08:43:47 -0600 Subject: [PATCH 0797/1283] Silly ChangeLog entry to trigger CI --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 860896507a..29bce3a92d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,6 +34,7 @@ LibreSSL Portable Release Notes: - Added initial Emscripten support in CMake builds - Removed timegm() compatibility layer since all uses were replaced with OPENSSL_timegm(). Cleaned up the corresponding test harness. + - Fixed pipe2 detection to use check_symbol_exists() * Internal improvements - Cleaned up parts of the conf directory. Simplified some logic, fixed memory leaks. From cd0ae0ef32d308a4704006b4514e2d065ed8df3c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 2 Aug 2024 09:08:05 -0600 Subject: [PATCH 0798/1283] Update ChangeLog --- ChangeLog | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 29bce3a92d..123009930f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,7 +34,6 @@ LibreSSL Portable Release Notes: - Added initial Emscripten support in CMake builds - Removed timegm() compatibility layer since all uses were replaced with OPENSSL_timegm(). Cleaned up the corresponding test harness. - - Fixed pipe2 detection to use check_symbol_exists() * Internal improvements - Cleaned up parts of the conf directory. Simplified some logic, fixed memory leaks. @@ -80,6 +79,9 @@ LibreSSL Portable Release Notes: * Testing and proactive security - Switched the remaining tests to new certs. * Compatibility changes + - Protocol parsing in libtls was changed. The no longer supported + TLSv1.1 and TLSv1.0 protocols are now completely ignored and no + longer enable or disable TLSv1.2 in surprising ways. - The one-step hashing functions, MD4(), MD5(), RIPEMD160(), SHA1(), all SHA-2, and HMAC() no longer support returning a static buffer. Callers must pass in a correctly sized buffer. From 50e2e2ff63b1754e5f11c57e608c524e48cadd03 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 2 Aug 2024 10:39:30 -0600 Subject: [PATCH 0799/1283] Tweak previous ChangeLog entry --- ChangeLog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 123009930f..17f4c2b120 100644 --- a/ChangeLog +++ b/ChangeLog @@ -80,8 +80,8 @@ LibreSSL Portable Release Notes: - Switched the remaining tests to new certs. * Compatibility changes - Protocol parsing in libtls was changed. The no longer supported - TLSv1.1 and TLSv1.0 protocols are now completely ignored and no - longer enable or disable TLSv1.2 in surprising ways. + TLSv1.1 and TLSv1.0 protocols are completely ignored and no longer + enable or disable TLSv1.2 in surprising ways. - The one-step hashing functions, MD4(), MD5(), RIPEMD160(), SHA1(), all SHA-2, and HMAC() no longer support returning a static buffer. Callers must pass in a correctly sized buffer. From 695bdfc4b63939241be6d81116e1f4a567f9a0e7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 2 Aug 2024 23:59:10 -0600 Subject: [PATCH 0800/1283] update ChangeLog --- ChangeLog | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 17f4c2b120..6297ab83f2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -79,9 +79,9 @@ LibreSSL Portable Release Notes: * Testing and proactive security - Switched the remaining tests to new certs. * Compatibility changes - - Protocol parsing in libtls was changed. The no longer supported - TLSv1.1 and TLSv1.0 protocols are completely ignored and no longer - enable or disable TLSv1.2 in surprising ways. + - Protocol parsing in libtls was changed. The unsupported TLSv1.1 + and TLSv1.0 protocols are ignored and no longer enable or disable + TLSv1.2 in surprising ways. - The one-step hashing functions, MD4(), MD5(), RIPEMD160(), SHA1(), all SHA-2, and HMAC() no longer support returning a static buffer. Callers must pass in a correctly sized buffer. @@ -98,6 +98,7 @@ LibreSSL Portable Release Notes: - Added TLS1-PRF support to the EVP interface. - Removed ssl2.h and ssl23.h. - Support for attributes in EVP_PKEYs was removed. + - Added SSL_CTX_set1_cert_store() * Bug fixes - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match their documentation. They always set an RFC 5280 conformant time. From 5eb1c40e180de2db1781df890997f15a9affab22 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 2 Aug 2024 23:59:19 -0600 Subject: [PATCH 0801/1283] regen patches --- patches/crypto_namespace.h.patch | 6 +++--- patches/openssl.c.patch | 6 +++--- patches/ssl_namespace.h.patch | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/patches/crypto_namespace.h.patch b/patches/crypto_namespace.h.patch index c18f0daa5a..400030f353 100644 --- a/patches/crypto_namespace.h.patch +++ b/patches/crypto_namespace.h.patch @@ -1,5 +1,5 @@ ---- crypto/hidden/crypto_namespace.h.orig 2024-04-09 10:12:22.320737957 +0200 -+++ crypto/hidden/crypto_namespace.h 2024-04-11 09:09:31.163350515 +0200 +--- crypto/hidden/crypto_namespace.h.orig Fri Aug 2 23:52:55 2024 ++++ crypto/hidden/crypto_namespace.h Fri Aug 2 23:53:17 2024 @@ -24,6 +24,12 @@ * external calls use the latter name. */ @@ -13,7 +13,7 @@ #ifdef LIBRESSL_NAMESPACE #ifdef LIBRESSL_CRYPTO_NAMESPACE # define LCRYPTO_UNUSED(x) __attribute__((deprecated)) \ -@@ -43,5 +49,6 @@ +@@ -47,5 +53,6 @@ # define LCRYPTO_ALIAS1(pre,x) # define LCRYPTO_ALIAS(x) asm("") #endif diff --git a/patches/openssl.c.patch b/patches/openssl.c.patch index 15afb78b6a..4e0887c39e 100644 --- a/patches/openssl.c.patch +++ b/patches/openssl.c.patch @@ -1,6 +1,6 @@ ---- apps/openssl/openssl.c.orig Mon Mar 4 13:39:56 2024 -+++ apps/openssl/openssl.c Mon Mar 4 13:40:15 2024 -@@ -348,7 +348,9 @@ +--- apps/openssl/openssl.c.orig Fri Aug 2 23:52:59 2024 ++++ apps/openssl/openssl.c Fri Aug 2 23:53:17 2024 +@@ -347,7 +347,9 @@ BIO *bio_err = NULL; static void openssl_startup(void) { diff --git a/patches/ssl_namespace.h.patch b/patches/ssl_namespace.h.patch index 758f8dcd2a..eb9c7a2dc2 100644 --- a/patches/ssl_namespace.h.patch +++ b/patches/ssl_namespace.h.patch @@ -1,5 +1,5 @@ ---- openbsd/src/lib/libssl/hidden/ssl_namespace.h 2023-03-15 11:41:52.481641800 -0600 -+++ ssl/hidden/ssl_namespace.h 2023-03-15 17:28:04.685309300 -0600 +--- ssl/hidden/ssl_namespace.h.orig Fri Aug 2 23:52:55 2024 ++++ ssl/hidden/ssl_namespace.h Fri Aug 2 23:53:17 2024 @@ -23,6 +23,11 @@ * and we alias that to the normal name. */ @@ -12,7 +12,7 @@ #ifdef LIBRESSL_NAMESPACE #define LSSL_UNUSED(x) typeof(x) x __attribute__((deprecated)) #define LSSL_USED(x) __attribute__((visibility("hidden"))) \ -@@ -33,5 +38,6 @@ +@@ -37,5 +42,6 @@ #define LSSL_USED(x) #define LSSL_ALIAS(x) asm("") #endif From 41ea3c73ea9f5e7931d55593917bc93245bfc8b8 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 3 Aug 2024 00:00:33 -0600 Subject: [PATCH 0802/1283] regen man links --- man/links | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/man/links b/man/links index c07d534954..ce27e18d90 100644 --- a/man/links +++ b/man/links @@ -992,6 +992,8 @@ EVP_PKEY_CTX_set_hkdf_md.3,EVP_PKEY_CTX_add1_hkdf_info.3 EVP_PKEY_CTX_set_hkdf_md.3,EVP_PKEY_CTX_hkdf_mode.3 EVP_PKEY_CTX_set_hkdf_md.3,EVP_PKEY_CTX_set1_hkdf_key.3 EVP_PKEY_CTX_set_hkdf_md.3,EVP_PKEY_CTX_set1_hkdf_salt.3 +EVP_PKEY_CTX_set_tls1_prf_md.3,EVP_PKEY_CTX_add1_tls1_prf_seed.3 +EVP_PKEY_CTX_set_tls1_prf_md.3,EVP_PKEY_CTX_set1_tls1_prf_secret.3 EVP_PKEY_add1_attr.3,EVP_PKEY_add1_attr_by_NID.3 EVP_PKEY_add1_attr.3,EVP_PKEY_add1_attr_by_OBJ.3 EVP_PKEY_add1_attr.3,EVP_PKEY_add1_attr_by_txt.3 @@ -1651,6 +1653,7 @@ SSL_CIPHER_get_name.3,SSL_CIPHER_get_auth_nid.3 SSL_CIPHER_get_name.3,SSL_CIPHER_get_bits.3 SSL_CIPHER_get_name.3,SSL_CIPHER_get_cipher_nid.3 SSL_CIPHER_get_name.3,SSL_CIPHER_get_digest_nid.3 +SSL_CIPHER_get_name.3,SSL_CIPHER_get_handshake_digest.3 SSL_CIPHER_get_name.3,SSL_CIPHER_get_id.3 SSL_CIPHER_get_name.3,SSL_CIPHER_get_kx_nid.3 SSL_CIPHER_get_name.3,SSL_CIPHER_get_version.3 @@ -1739,6 +1742,7 @@ SSL_CTX_set_alpn_select_cb.3,SSL_get0_alpn_selected.3 SSL_CTX_set_alpn_select_cb.3,SSL_select_next_proto.3 SSL_CTX_set_alpn_select_cb.3,SSL_set_alpn_protos.3 SSL_CTX_set_cert_store.3,SSL_CTX_get_cert_store.3 +SSL_CTX_set_cert_store.3,SSL_CTX_set1_cert_store.3 SSL_CTX_set_cipher_list.3,SSL_set_cipher_list.3 SSL_CTX_set_client_CA_list.3,SSL_CTX_add_client_CA.3 SSL_CTX_set_client_CA_list.3,SSL_add_client_CA.3 From 16286ceb3b5322ef6e45eaccfe02836e7dcbf050 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 6 Aug 2024 04:20:04 -0600 Subject: [PATCH 0803/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 6297ab83f2..0859d51c89 100644 --- a/ChangeLog +++ b/ChangeLog @@ -74,6 +74,7 @@ LibreSSL Portable Release Notes: - Rewrote CRYPTO_EX_DATA from scratch. The only intentional change of behavior is that there is now a hard limit on the number of indexes that can be allocated. + - Removed bogus connect() call from netcat. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security From 5c978c4e07aaa4a7857b95d95d534dcba9598bd1 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Wed, 7 Aug 2024 18:31:32 +0200 Subject: [PATCH 0804/1283] cmake: replace `CMAKE_SYSTEM_PROCESSOR` with `HOST_*` Follow-up to e99a7dd931065e4b3535cb3e2e8bee8c3db0afaf #1075 --- CMakeLists.txt | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 342d4e817e..048f6cfe71 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -384,16 +384,15 @@ endif() if(ENABLE_ASM) if(CMAKE_C_COMPILER_ABI STREQUAL "ELF") - if(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|amd64)") + if(HOST_X86_64) set(HOST_ASM_ELF_X86_64 true) - elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm" AND - NOT CMAKE_SYSTEM_PROCESSOR MATCHES "arm64") + elseif(HOST_ARM) set(HOST_ASM_ELF_ARMV4 true) - elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND CMAKE_SYSTEM_PROCESSOR MATCHES "i386") + elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND HOST_I386) set(HOST_ASM_ELF_X86_64 true) endif() add_definitions(-DHAVE_GNU_STACK) - elseif(APPLE AND CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64") + elseif(APPLE AND HOST_X86_64) set(HOST_ASM_MACOSX_X86_64 true) elseif(MSVC AND (CMAKE_GENERATOR MATCHES "Win64" OR CMAKE_GENERATOR_PLATFORM STREQUAL "x64")) set(HOST_ASM_MASM_X86_64 true) From 087a9d4c57d30589885d7ca33d2c6c9fa2de4221 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 10 Aug 2024 00:44:03 -0600 Subject: [PATCH 0805/1283] ui_compat.h was removed --- update.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/update.sh b/update.sh index 514da89359..4fc0c5719c 100755 --- a/update.sh +++ b/update.sh @@ -135,7 +135,7 @@ copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h bio/bio.h cast/cast.h cmac/cmac.h cms/cms.h conf/conf_api.h des/des.h dh/dh.h dsa/dsa.h engine/engine.h ui/ui.h pkcs12/pkcs12.h ts/ts.h md4/md4.h ripemd/ripemd.h whrlpool/whrlpool.h idea/idea.h - rc2/rc2.h rc4/rc4.h ui/ui_compat.h txt_db/txt_db.h + rc2/rc2.h rc4/rc4.h txt_db/txt_db.h sm3/sm3.h sm4/sm4.h chacha/chacha.h evp/evp.h poly1305/poly1305.h camellia/camellia.h curve25519/curve25519.h ct/ct.h kdf/kdf.h" From d20cd80068fd1a82c1335bee4bc982f2f5541b90 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 10 Aug 2024 00:44:34 -0600 Subject: [PATCH 0806/1283] Update ChangeLog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 0859d51c89..5de9b642ae 100644 --- a/ChangeLog +++ b/ChangeLog @@ -97,7 +97,7 @@ LibreSSL Portable Release Notes: - i2d_ASN1_OBJECT() now returns -1 on error like most other i2d_*. - SPKAC support was removed from openssl(1) - Added TLS1-PRF support to the EVP interface. - - Removed ssl2.h and ssl23.h. + - Removed ssl2.h, ssl23.h, and ui_compat.h. - Support for attributes in EVP_PKEYs was removed. - Added SSL_CTX_set1_cert_store() * Bug fixes From 2a907257f95af20d7d94d1a8e3889a4df8d5a126 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 6 Aug 2024 15:10:18 +0200 Subject: [PATCH 0807/1283] Need to copy over crypto_arch.h --- update.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/update.sh b/update.sh index 4fc0c5719c..cbf01c96e0 100755 --- a/update.sh +++ b/update.sh @@ -170,6 +170,8 @@ for i in $libcrypto_src/arch/*; do arch=`basename $i` mkdir -p include/arch/$arch $CP $libcrypto_src/arch/$arch/opensslconf.h include/arch/$arch/ + mkdir -p crypto/arch/$arch + $CP $libcrypto_src/arch/$arch/crypto_arch.h crypto/arch/$arch/ done for i in $libcrypto_src/bn/arch/*; do @@ -333,7 +335,7 @@ done echo "copying libssl source" rm -f ssl/*.c ssl/*.h touch ssl/empty.c -for i in `awk '/SOURCES|HEADERS/ { print $3 }' ssl/Makefile.am` ; do +for i in `awk '/SOURCES|HEADERS/ { if ($3 !~ /.*crypto_arch.*/) print $3 }' ssl/Makefile.am` ; do dir=`dirname $i` mkdir -p ssl/$dir $CP $libssl_src/$i ssl/$i From aa83ac48e48bb3977413e87a366e216615b0afbf Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 6 Aug 2024 14:55:33 +0200 Subject: [PATCH 0808/1283] Initial cut for crypto_arch.h --- crypto/CMakeLists.txt | 30 ++++++++++-------------------- crypto/Makefile.am | 21 ++++++++++++++++++++- crypto/Makefile.am.elf-x86_64 | 5 ----- crypto/Makefile.am.macosx-x86_64 | 5 ----- crypto/Makefile.am.masm-x86_64 | 5 ----- crypto/Makefile.am.mingw64-x86_64 | 5 ----- 6 files changed, 30 insertions(+), 41 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 7d4ff70c7f..44923604b1 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -57,11 +57,6 @@ if(HOST_ASM_ELF_X86_64) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) add_definitions(-DVPAES_ASM) - add_definitions(-DHAVE_AES_CBC_ENCRYPT_INTERNAL) - add_definitions(-DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL) - add_definitions(-DHAVE_AES_SET_DECRYPT_KEY_INTERNAL) - add_definitions(-DHAVE_AES_ENCRYPT_INTERNAL) - add_definitions(-DHAVE_AES_DECRYPT_INTERNAL) add_definitions(-DOPENSSL_IA32_SSE2) add_definitions(-DOPENSSL_BN_ASM_MONT) add_definitions(-DOPENSSL_BN_ASM_MONT5) @@ -111,11 +106,6 @@ if(HOST_ASM_MACOSX_X86_64) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) add_definitions(-DVPAES_ASM) - add_definitions(-DHAVE_AES_CBC_ENCRYPT_INTERNAL) - add_definitions(-DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL) - add_definitions(-DHAVE_AES_SET_DECRYPT_KEY_INTERNAL) - add_definitions(-DHAVE_AES_ENCRYPT_INTERNAL) - add_definitions(-DHAVE_AES_DECRYPT_INTERNAL) add_definitions(-DOPENSSL_IA32_SSE2) add_definitions(-DOPENSSL_BN_ASM_MONT) add_definitions(-DOPENSSL_BN_ASM_MONT5) @@ -154,11 +144,6 @@ if(HOST_ASM_MASM_X86_64) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) add_definitions(-DVPAES_ASM) - add_definitions(-DHAVE_AES_CBC_ENCRYPT_INTERNAL) - add_definitions(-DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL) - add_definitions(-DHAVE_AES_SET_DECRYPT_KEY_INTERNAL) - add_definitions(-DHAVE_AES_ENCRYPT_INTERNAL) - add_definitions(-DHAVE_AES_DECRYPT_INTERNAL) add_definitions(-DOPENSSL_IA32_SSE2) #add_definitions(-DOPENSSL_BN_ASM_MONT) #add_definitions(-DOPENSSL_BN_ASM_MONT5) @@ -196,11 +181,6 @@ if(HOST_ASM_MINGW64_X86_64) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) add_definitions(-DVPAES_ASM) - add_definitions(-DHAVE_AES_CBC_ENCRYPT_INTERNAL) - add_definitions(-DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL) - add_definitions(-DHAVE_AES_SET_DECRYPT_KEY_INTERNAL) - add_definitions(-DHAVE_AES_ENCRYPT_INTERNAL) - add_definitions(-DHAVE_AES_DECRYPT_INTERNAL) add_definitions(-DOPENSSL_IA32_SSE2) #add_definitions(-DOPENSSL_BN_ASM_MONT) #add_definitions(-DOPENSSL_BN_ASM_MONT5) @@ -845,24 +825,34 @@ target_include_directories(crypto_obj ${CMAKE_BINARY_DIR}/include) if(HOST_AARCH64) + target_include_directories(crypto_obj PRIVATE arch/aarch64/) target_include_directories(crypto_obj PRIVATE bn/arch/aarch64/) elseif(HOST_ARM) + target_include_directories(crypto_obj PRIVATE arch/arm/) target_include_directories(crypto_obj PRIVATE bn/arch/arm/) elseif(HOST_I386) + target_include_directories(crypto_obj PRIVATE arch/i386/) target_include_directories(crypto_obj PRIVATE bn/arch/i386/) elseif(HOST_MIPS64) + target_include_directories(crypto_obj PRIVATE arch/mips64) target_include_directories(crypto_obj PRIVATE bn/arch/mips64) elseif(HOST_MIPS) + # XXX - can this go away? the directory doesn't exist... target_include_directories(crypto_obj PRIVATE bn/arch/mips) elseif(HOST_POWERPC) + target_include_directories(crypto_obj PRIVATE arch/powerpc) target_include_directories(crypto_obj PRIVATE bn/arch/powerpc) elseif(HOST_POWERPC64) + target_include_directories(crypto_obj PRIVATE arch/powerpc64) target_include_directories(crypto_obj PRIVATE bn/arch/powerpc64) elseif(HOST_RISCV64) + target_include_directories(crypto_obj PRIVATE arch/riscv64) target_include_directories(crypto_obj PRIVATE bn/arch/riscv64) elseif(HOST_SPARC64) + target_include_directories(crypto_obj PRIVATE arch/sparc64) target_include_directories(crypto_obj PRIVATE bn/arch/sparc64) elseif(HOST_X86_64) + target_include_directories(crypto_obj PRIVATE arch/amd64) target_include_directories(crypto_obj PRIVATE bn/arch/amd64) endif() diff --git a/crypto/Makefile.am b/crypto/Makefile.am index cb463fbe25..4ca8d5f951 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -359,55 +359,74 @@ noinst_HEADERS += bn/bn_prime.h noinst_HEADERS += bn/s2n_bignum.h noinst_HEADERS += bn/s2n_bignum_internal.h -# bn/arch +# arch, bn/arch if HOST_AARCH64 +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/aarch64/ libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/aarch64/ endif +noinst_HEADERS += arch/aarch64/crypto_arch.h noinst_HEADERS += bn/arch/aarch64/bn_arch.h if HOST_ARM +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/arm/ libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/arm/ endif +noinst_HEADERS += arch/arm/crypto_arch.h noinst_HEADERS += bn/arch/arm/bn_arch.h if HOST_I386 +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/i386/ libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/i386/ endif +noinst_HEADERS += arch/i386/crypto_arch.h noinst_HEADERS += bn/arch/i386/bn_arch.h +# XXX - do we still need this? if HOST_MIPS libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/mips/ endif noinst_HEADERS += bn/arch/mips/bn_arch.h if HOST_MIPS64 +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips64/ libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/mips64/ endif +noinst_HEADERS += arch/mips64/crypto_arch.h noinst_HEADERS += bn/arch/mips64/bn_arch.h if HOST_POWERPC +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/powerpc/ libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/powerpc/ endif +noinst_HEADERS += arch/powerpc/crypto_arch.h noinst_HEADERS += bn/arch/powerpc/bn_arch.h if HOST_POWERPC64 +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/powerpc64/ libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/powerpc64/ endif +noinst_HEADERS += arch/powerpc64/crypto_arch.h noinst_HEADERS += bn/arch/powerpc64/bn_arch.h if HOST_RISCV64 +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/riscv64/ libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/riscv64/ endif +noinst_HEADERS += arch/riscv64/crypto_arch.h noinst_HEADERS += bn/arch/riscv64/bn_arch.h if HOST_SPARC64 +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/sparc64/ libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/sparc64/ endif +noinst_HEADERS += arch/sparc64/crypto_arch.h noinst_HEADERS += bn/arch/sparc64/bn_arch.h if HOST_X86_64 +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/amd64/ libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/amd64/ endif +noinst_HEADERS += arch/amd64/crypto_arch.h noinst_HEADERS += bn/arch/amd64/bn_arch.h # buffer diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index 6933a11d08..990475e04c 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -33,11 +33,6 @@ if HOST_ASM_ELF_X86_64 libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM libcrypto_la_CPPFLAGS += -DVPAES_ASM -libcrypto_la_CPPFLAGS += -DHAVE_AES_CBC_ENCRYPT_INTERNAL -libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL -libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_DECRYPT_KEY_INTERNAL -libcrypto_la_CPPFLAGS += -DHAVE_AES_ENCRYPT_INTERNAL -libcrypto_la_CPPFLAGS += -DHAVE_AES_DECRYPT_INTERNAL libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index 10205672c5..c380003068 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -33,11 +33,6 @@ if HOST_ASM_MACOSX_X86_64 libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM libcrypto_la_CPPFLAGS += -DVPAES_ASM -libcrypto_la_CPPFLAGS += -DHAVE_AES_CBC_ENCRYPT_INTERNAL -libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL -libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_DECRYPT_KEY_INTERNAL -libcrypto_la_CPPFLAGS += -DHAVE_AES_ENCRYPT_INTERNAL -libcrypto_la_CPPFLAGS += -DHAVE_AES_DECRYPT_INTERNAL libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index 7da3cc242f..437638c1ea 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -20,11 +20,6 @@ if HOST_ASM_MASM_X86_64 libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM libcrypto_la_CPPFLAGS += -DVPAES_ASM -libcrypto_la_CPPFLAGS += -DHAVE_AES_CBC_ENCRYPT_INTERNAL -libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL -libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_DECRYPT_KEY_INTERNAL -libcrypto_la_CPPFLAGS += -DHAVE_AES_ENCRYPT_INTERNAL -libcrypto_la_CPPFLAGS += -DHAVE_AES_DECRYPT_INTERNAL libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index 7d0d3f7939..2d41c37abf 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -21,11 +21,6 @@ libcrypto_la_CPPFLAGS += -Dendbr32=endbr64 libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM libcrypto_la_CPPFLAGS += -DVPAES_ASM -libcrypto_la_CPPFLAGS += -DHAVE_AES_CBC_ENCRYPT_INTERNAL -libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_ENCRYPT_KEY_INTERNAL -libcrypto_la_CPPFLAGS += -DHAVE_AES_SET_DECRYPT_KEY_INTERNAL -libcrypto_la_CPPFLAGS += -DHAVE_AES_ENCRYPT_INTERNAL -libcrypto_la_CPPFLAGS += -DHAVE_AES_DECRYPT_INTERNAL libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 #libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT #libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 From ec3abe7b9b733500911fdf4d056ce6181c74da6b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 6 Aug 2024 15:56:40 +0200 Subject: [PATCH 0809/1283] And adapt libssl --- ssl/CMakeLists.txt | 22 ++++++++++++++++++++ ssl/Makefile.am | 50 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 72 insertions(+) diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index e2eeab5ecf..76f45707ac 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -104,6 +104,28 @@ target_include_directories( $ ) +if(HOST_AARCH64) + target_include_directories(ssl_obj PRIVATE ../crypto/arch/aarch64/) +elseif(HOST_ARM) + target_include_directories(ssl_obj PRIVATE ../crypto/arch/arm/) +elseif(HOST_I386) + target_include_directories(ssl_obj PRIVATE ../crypto/arch/i386/) +elseif(HOST_MIPS64) + target_include_directories(ssl_obj PRIVATE ../crypto/arch/mips64) +elseif(HOST_MIPS) + # XXX - can this go away? the directory doesn't exist... +elseif(HOST_POWERPC) + target_include_directories(ssl_obj PRIVATE ../crypto/arch/powerpc) +elseif(HOST_POWERPC64) + target_include_directories(ssl_obj PRIVATE ../crypto/arch/powerpc64) +elseif(HOST_RISCV64) + target_include_directories(ssl_obj PRIVATE ../crypto/arch/riscv64) +elseif(HOST_SPARC64) + target_include_directories(ssl_obj PRIVATE ../crypto/arch/sparc64) +elseif(HOST_X86_64) + target_include_directories(ssl_obj PRIVATE ../crypto/arch/amd64) +endif() + install( TARGETS ssl EXPORT SSL-target diff --git a/ssl/Makefile.am b/ssl/Makefile.am index a7a7d72338..f9a66a3f63 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -114,3 +114,53 @@ noinst_HEADERS += tls12_internal.h noinst_HEADERS += tls13_internal.h noinst_HEADERS += tls13_handshake.h noinst_HEADERS += tls13_record.h + +# arch +if HOST_AARCH64 +libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/aarch64/ +endif +noinst_HEADERS += $(top_srcdir)/crypto/arch/aarch64/crypto_arch.h + +if HOST_ARM +libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/arm/ +endif +noinst_HEADERS += $(top_srcdir)/crypto/arch/arm/crypto_arch.h + +if HOST_I386 +libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/i386/ +endif +noinst_HEADERS += $(top_srcdir)/crypto/arch/i386/crypto_arch.h + +# XXX - do we still need this? +if HOST_MIPS +endif + +if HOST_MIPS64 +libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips64/ +endif +noinst_HEADERS += $(top_srcdir)/crypto/arch/mips64/crypto_arch.h + +if HOST_POWERPC +libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/powerpc/ +endif +noinst_HEADERS += $(top_srcdir)/crypto/arch/powerpc/crypto_arch.h + +if HOST_POWERPC64 +libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/powerpc64/ +endif +noinst_HEADERS += $(top_srcdir)/crypto/arch/powerpc64/crypto_arch.h + +if HOST_RISCV64 +libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/riscv64/ +endif +noinst_HEADERS += $(top_srcdir)/crypto/arch/riscv64/crypto_arch.h + +if HOST_SPARC64 +libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/sparc64/ +endif +noinst_HEADERS += $(top_srcdir)/crypto/arch/sparc64/crypto_arch.h + +if HOST_X86_64 +libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/amd64/ +endif +noinst_HEADERS += $(top_srcdir)/crypto/arch/amd64/crypto_arch.h From dc710c5f64c377ea47477e6d4d251b7a7bf22a78 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 6 Aug 2024 16:46:10 +0200 Subject: [PATCH 0810/1283] ... and tests --- tests/CMakeLists.txt | 22 ++++++++++++++++++++++ tests/Makefile.am | 41 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 63 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index f79f69e28d..e930236a5d 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -18,6 +18,28 @@ include_directories( ../include/compat ) +if(HOST_AARCH64) + include_directories(../crypto/arch/aarch64/) +elseif(HOST_ARM) + include_directories(../crypto/arch/arm/) +elseif(HOST_I386) + include_directories(../crypto/arch/i386/) +elseif(HOST_MIPS64) + include_directories(../crypto/arch/mips64) +elseif(HOST_MIPS) + # XXX - can this go away? the directory doesn't exist... +elseif(HOST_POWERPC) + include_directories(../crypto/arch/powerpc) +elseif(HOST_POWERPC64) + include_directories(../crypto/arch/powerpc64) +elseif(HOST_RISCV64) + include_directories(../crypto/arch/riscv64) +elseif(HOST_SPARC64) + include_directories(../crypto/arch/sparc64) +elseif(HOST_X86_64) + include_directories(../crypto/arch/amd64) +endif() + add_definitions(-D_PATH_SSL_CA_FILE=\"${CMAKE_CURRENT_SOURCE_DIR}/../cert.pem\") file(TO_NATIVE_PATH ${CMAKE_CURRENT_SOURCE_DIR} TEST_SOURCE_DIR) diff --git a/tests/Makefile.am b/tests/Makefile.am index 190e4ebdc9..5388126c7f 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -19,6 +19,47 @@ AM_CPPFLAGS += -I $(top_srcdir)/apps/openssl AM_CPPFLAGS += -I $(top_srcdir)/apps/openssl/compat AM_CPPFLAGS += -D_PATH_SSL_CA_FILE=\"$(top_srcdir)/cert.pem\" +# arch +if HOST_AARCH64 +AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/aarch64/ +endif + +if HOST_ARM +AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/arm/ +endif + +if HOST_I386 +AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/i386/ +endif + +# XXX - do we still need this? +if HOST_MIPS +endif + +if HOST_MIPS64 +AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips64/ +endif + +if HOST_POWERPC +AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/powerpc/ +endif + +if HOST_POWERPC64 +AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/powerpc64/ +endif + +if HOST_RISCV64 +AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/riscv64/ +endif + +if HOST_SPARC64 +AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/sparc64/ +endif + +if HOST_X86_64 +AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/amd64/ +endif + noinst_LTLIBRARIES = libtest.la libtest_la_LIBADD = $(libcrypto_la_objects) libtest_la_LIBADD += $(libcompat_la_objects) From 008aabb326a6adc3e3429d4cbb074a65581cea2f Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 11 Aug 2024 15:45:34 +0200 Subject: [PATCH 0811/1283] Disable mips32 in CI for now OpenBSD has long dropped support for this architecture. If someone wants to revive the port, they are more than welcome to file a PR that reenables them. discussed with jsing --- .github/workflows/linux.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 5c85d4b025..0c9a699255 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -23,7 +23,7 @@ jobs: fail-fast: false matrix: os: ["ubuntu-20.04", "ubuntu-22.04", "ubuntu-24.04"] - arch: ["native", "arm32", "arm64", "mingw32", "mingw64", "mips32", "mips64"] + arch: ["native", "arm32", "arm64", "mingw32", "mingw64", "mips64"] compiler: ["gcc"] include: - os: "ubuntu-20.04" From 5a6539b24832c71078805f0c2aa12031c0531f91 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 12 Aug 2024 10:20:25 -0600 Subject: [PATCH 0812/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 5de9b642ae..2ff1bd333c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,6 +34,7 @@ LibreSSL Portable Release Notes: - Added initial Emscripten support in CMake builds - Removed timegm() compatibility layer since all uses were replaced with OPENSSL_timegm(). Cleaned up the corresponding test harness. + - The mips32 platform is no longer actively supported. * Internal improvements - Cleaned up parts of the conf directory. Simplified some logic, fixed memory leaks. @@ -75,6 +76,8 @@ LibreSSL Portable Release Notes: behavior is that there is now a hard limit on the number of indexes that can be allocated. - Removed bogus connect() call from netcat. + * New features + - Added CRLfile option to the cms command of openssl(1). * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security From 8a513629a8505594161e855f0f566c5cb80e3f37 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 12 Aug 2024 10:25:06 -0600 Subject: [PATCH 0813/1283] Tweak ChangeLog --- ChangeLog | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 2ff1bd333c..c4f554e89d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -77,7 +77,8 @@ LibreSSL Portable Release Notes: that can be allocated. - Removed bogus connect() call from netcat. * New features - - Added CRLfile option to the cms command of openssl(1). + - Added CRLfile option to the cms command of openssl(1) to specify + additional CRLs for use during verification. * Documentation improvements - Removed documentation of no longer existing API. * Testing and proactive security From a95f950acf5c8abb3ea1a704409daf2639d9dc81 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 13 Aug 2024 01:32:01 -0600 Subject: [PATCH 0814/1283] Tweak ChangeLog --- ChangeLog | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index c4f554e89d..61e6e50a85 100644 --- a/ChangeLog +++ b/ChangeLog @@ -31,7 +31,7 @@ LibreSSL Portable Release Notes: 4.0.0 - In development * Portable changes - - Added initial Emscripten support in CMake builds + - Added initial Emscripten support in CMake builds. - Removed timegm() compatibility layer since all uses were replaced with OPENSSL_timegm(). Cleaned up the corresponding test harness. - The mips32 platform is no longer actively supported. @@ -99,11 +99,12 @@ LibreSSL Portable Release Notes: - Removed typdefs for COMP_CTX, COMP_METHOD, X509_CRL_METHOD, STORE, STORE_METHOD, and SSL_AEAD_CTX. - i2d_ASN1_OBJECT() now returns -1 on error like most other i2d_*. - - SPKAC support was removed from openssl(1) + - SPKAC support was removed from openssl(1). - Added TLS1-PRF support to the EVP interface. - Removed ssl2.h, ssl23.h, and ui_compat.h. - Support for attributes in EVP_PKEYs was removed. - - Added SSL_CTX_set1_cert_store() + - SSL_CTX_set1_cert_store() and SSL_CIPHER_get_handshake_digest() + were added to libssl. * Bug fixes - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match their documentation. They always set an RFC 5280 conformant time. From bc71357cbe2afb1fdf33519b3c4cf6a8d8fc13fb Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 17 Aug 2024 03:31:49 -0600 Subject: [PATCH 0815/1283] Regen netcat patch --- patches/netcat.c.patch | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/patches/netcat.c.patch b/patches/netcat.c.patch index 9c3a45080e..319aca67bb 100644 --- a/patches/netcat.c.patch +++ b/patches/netcat.c.patch @@ -1,5 +1,5 @@ ---- apps/nc/netcat.c.orig Tue Aug 15 15:17:28 2023 -+++ apps/nc/netcat.c Tue Aug 15 15:17:54 2023 +--- apps/nc/netcat.c.orig Sat Aug 17 03:21:05 2024 ++++ apps/nc/netcat.c Sat Aug 17 03:28:50 2024 @@ -93,9 +93,13 @@ int zflag; /* Port Scan Flag */ int Dflag; /* sodebug */ int Iflag; /* TCP receive buffer size */ @@ -53,7 +53,7 @@ /* Cruft to make sure options are clean, and used properly. */ if (argc == 1 && family == AF_UNIX) { -@@ -927,7 +937,10 @@ remote_connect(const char *host, const char *port, str +@@ -923,7 +933,10 @@ remote_connect(const char *host, const char *port, str char *ipaddr) { struct addrinfo *res, *res0; @@ -65,7 +65,7 @@ if ((error = getaddrinfo(host, port, &hints, &res0))) errx(1, "getaddrinfo for host \"%s\" port %s: %s", host, -@@ -942,8 +955,10 @@ remote_connect(const char *host, const char *port, str +@@ -938,8 +951,10 @@ remote_connect(const char *host, const char *port, str if (sflag || pflag) { struct addrinfo ahints, *ares; @@ -76,7 +76,7 @@ memset(&ahints, 0, sizeof(struct addrinfo)); ahints.ai_family = res->ai_family; ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM; -@@ -1035,7 +1050,10 @@ int +@@ -1031,7 +1046,10 @@ int local_listen(const char *host, const char *port, struct addrinfo hints) { struct addrinfo *res, *res0; @@ -88,7 +88,7 @@ int error; /* Allow nodename to be null. */ -@@ -1056,9 +1074,11 @@ local_listen(const char *host, const char *port, struc +@@ -1052,9 +1070,11 @@ local_listen(const char *host, const char *port, struc res->ai_protocol)) == -1) continue; @@ -100,7 +100,7 @@ set_common_sockopts(s, res->ai_family); -@@ -1563,11 +1583,13 @@ set_common_sockopts(int s, int af) +@@ -1559,11 +1579,13 @@ set_common_sockopts(int s, int af) { int x = 1; @@ -114,7 +114,7 @@ if (Dflag) { if (setsockopt(s, SOL_SOCKET, SO_DEBUG, &x, sizeof(x)) == -1) -@@ -1578,9 +1600,16 @@ set_common_sockopts(int s, int af) +@@ -1574,9 +1596,16 @@ set_common_sockopts(int s, int af) IP_TOS, &Tflag, sizeof(Tflag)) == -1) err(1, "set IP ToS"); @@ -131,7 +131,7 @@ } if (Iflag) { if (setsockopt(s, SOL_SOCKET, SO_RCVBUF, -@@ -1604,13 +1633,17 @@ set_common_sockopts(int s, int af) +@@ -1600,13 +1629,17 @@ set_common_sockopts(int s, int af) } if (minttl != -1) { @@ -150,7 +150,7 @@ } } -@@ -1835,15 +1868,19 @@ help(void) +@@ -1831,15 +1864,19 @@ help(void) \t-P proxyuser\tUsername for proxy authentication\n\ \t-p port\t Specify local port for remote connects\n\ \t-R CAfile CA bundle\n\ From 3b545a08d6c14d67b6d1bead1e963391571b5182 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 17 Aug 2024 06:43:59 -0600 Subject: [PATCH 0816/1283] regen man links --- man/links | 9 --------- 1 file changed, 9 deletions(-) diff --git a/man/links b/man/links index ce27e18d90..eeda4a687e 100644 --- a/man/links +++ b/man/links @@ -2230,14 +2230,6 @@ X509_STORE_set1_param.3,X509_STORE_set_purpose.3 X509_STORE_set1_param.3,X509_STORE_set_trust.3 X509_STORE_set_verify_cb_func.3,X509_STORE_get_verify_cb.3 X509_STORE_set_verify_cb_func.3,X509_STORE_set_verify_cb.3 -X509_TRUST_set.3,X509_TRUST_add.3 -X509_TRUST_set.3,X509_TRUST_cleanup.3 -X509_TRUST_set.3,X509_TRUST_get0.3 -X509_TRUST_set.3,X509_TRUST_get0_name.3 -X509_TRUST_set.3,X509_TRUST_get_by_id.3 -X509_TRUST_set.3,X509_TRUST_get_count.3 -X509_TRUST_set.3,X509_TRUST_get_flags.3 -X509_TRUST_set.3,X509_TRUST_get_trust.3 X509_VERIFY_PARAM_new.3,X509_VERIFY_PARAM_add0_table.3 X509_VERIFY_PARAM_new.3,X509_VERIFY_PARAM_free.3 X509_VERIFY_PARAM_new.3,X509_VERIFY_PARAM_get0.3 @@ -2273,7 +2265,6 @@ X509_check_host.3,X509_check_email.3 X509_check_host.3,X509_check_ip.3 X509_check_host.3,X509_check_ip_asc.3 X509_check_private_key.3,X509_REQ_check_private_key.3 -X509_check_trust.3,X509_TRUST_set_default.3 X509_cmp.3,X509_CRL_cmp.3 X509_cmp.3,X509_CRL_match.3 X509_cmp.3,X509_NAME_cmp.3 From 1ff9793deee907efcbd4769fe99e133a9608a5f6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 2 Aug 2024 22:18:05 +0200 Subject: [PATCH 0817/1283] Switch to check_symbol_exists() in simplest cases There are a few exceptions. Some require _GNU_SOURCE, some are in the weird strings.h header, some are probably too new to be found in the standard locations. Fixes #1077 --- CMakeLists.txt | 39 ++++++++++++++++++++++----------------- apps/nc/CMakeLists.txt | 2 +- 2 files changed, 23 insertions(+), 18 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 048f6cfe71..a7574afd9d 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -200,21 +200,23 @@ else() set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall") endif() +# XXX - needs _GNU_SOURCE on linux check_function_exists(asprintf HAVE_ASPRINTF) if(HAVE_ASPRINTF) add_definitions(-DHAVE_ASPRINTF) endif() -check_function_exists(getopt HAVE_GETOPT) +check_symbol_exists(getopt "unistd.h" HAVE_GETOPT) if(HAVE_GETOPT) add_definitions(-DHAVE_GETOPT) endif() -check_function_exists(reallocarray HAVE_REALLOCARRAY) +check_symbol_exists(reallocarray "stdlib.h" HAVE_REALLOCARRAY) if(HAVE_REALLOCARRAY) add_definitions(-DHAVE_REALLOCARRAY) endif() +# XXX strcasecmp() is in strings.h which isn't available everywhere check_function_exists(strcasecmp HAVE_STRCASECMP) if(HAVE_STRCASECMP) add_definitions(-DHAVE_STRCASECMP) @@ -222,18 +224,18 @@ endif() # Emscripten's strlcat and strlcpy triggers ASAN errors if(NOT EMSCRIPTEN) - check_function_exists(strlcat HAVE_STRLCAT) + check_symbol_exists(strlcat "string.h" HAVE_STRLCAT) if(HAVE_STRLCAT) add_definitions(-DHAVE_STRLCAT) endif() - check_function_exists(strlcpy HAVE_STRLCPY) + check_symbol_exists(strlcpy "string.h" HAVE_STRLCPY) if(HAVE_STRLCPY) add_definitions(-DHAVE_STRLCPY) endif() endif() -check_function_exists(strndup HAVE_STRNDUP) +check_symbol_exists(strndup "string.h" HAVE_STRNDUP) if(HAVE_STRNDUP) add_definitions(-DHAVE_STRNDUP) endif() @@ -242,62 +244,64 @@ if(WIN32) set(HAVE_STRNLEN true) add_definitions(-DHAVE_STRNLEN) else() - check_function_exists(strnlen HAVE_STRNLEN) + check_symbol_exists(strnlen "string.h" HAVE_STRNLEN) if(HAVE_STRNLEN) add_definitions(-DHAVE_STRNLEN) endif() endif() -check_function_exists(strsep HAVE_STRSEP) +check_symbol_exists(strsep "string.h" HAVE_STRSEP) if(HAVE_STRSEP) add_definitions(-DHAVE_STRSEP) endif() -check_function_exists(strtonum HAVE_STRTONUM) +check_symbol_exists(strtonum "stdlib.h" HAVE_STRTONUM) if(HAVE_STRTONUM) add_definitions(-DHAVE_STRTONUM) endif() -check_function_exists(arc4random_buf HAVE_ARC4RANDOM_BUF) +check_symbol_exists(arc4random_buf "stdlib.h" HAVE_ARC4RANDOM_BUF) if(HAVE_ARC4RANDOM_BUF) add_definitions(-DHAVE_ARC4RANDOM_BUF) endif() -check_function_exists(arc4random_uniform HAVE_ARC4RANDOM_UNIFORM) +check_symbol_exists(arc4random_uniform "stdlib.h" HAVE_ARC4RANDOM_UNIFORM) if(HAVE_ARC4RANDOM_UNIFORM) add_definitions(-DHAVE_ARC4RANDOM_UNIFORM) endif() -check_function_exists(explicit_bzero HAVE_EXPLICIT_BZERO) +check_symbol_exists(explicit_bzero "string.h" HAVE_EXPLICIT_BZERO) if(HAVE_EXPLICIT_BZERO) add_definitions(-DHAVE_EXPLICIT_BZERO) endif() -check_function_exists(getauxval HAVE_GETAUXVAL) +check_symbol_exists(getauxval "sys/auxv.h" HAVE_GETAUXVAL) if(HAVE_GETAUXVAL) add_definitions(-DHAVE_GETAUXVAL) endif() +# XXX macos fails to find getentropy with check_symbol_exists() check_function_exists(getentropy HAVE_GETENTROPY) if(HAVE_GETENTROPY) add_definitions(-DHAVE_GETENTROPY) endif() -check_symbol_exists(getpagesize unistd.h HAVE_GETPAGESIZE) +check_symbol_exists(getpagesize "unistd.h" HAVE_GETPAGESIZE) if(HAVE_GETPAGESIZE) add_definitions(-DHAVE_GETPAGESIZE) endif() -check_function_exists(getprogname HAVE_GETPROGNAME) +check_symbol_exists(getprogname "stdlib.h" HAVE_GETPROGNAME) if(HAVE_GETPROGNAME) add_definitions(-DHAVE_GETPROGNAME) endif() -check_function_exists(syslog_r HAVE_SYSLOG_R) +check_symbol_exists(syslog_r "syslog.h stdarg.h" HAVE_SYSLOG_R) if(HAVE_SYSLOG_R) add_definitions(-DHAVE_SYSLOG_R) endif() +# XXX - needs _GNU_SOURCE on linux check_function_exists(syslog HAVE_SYSLOG) if(HAVE_SYSLOG) add_definitions(-DHAVE_SYSLOG) @@ -308,16 +312,17 @@ if(HAVE_TIMESPECSUB) add_definitions(-DHAVE_TIMESPECSUB) endif() -check_function_exists(timingsafe_bcmp HAVE_TIMINGSAFE_BCMP) +check_symbol_exists(timingsafe_bcmp "string.h" HAVE_TIMINGSAFE_BCMP) if(HAVE_TIMINGSAFE_BCMP) add_definitions(-DHAVE_TIMINGSAFE_BCMP) endif() -check_function_exists(timingsafe_memcmp HAVE_TIMINGSAFE_MEMCMP) +check_symbol_exists(timingsafe_memcmp "string.h" HAVE_TIMINGSAFE_MEMCMP) if(HAVE_TIMINGSAFE_MEMCMP) add_definitions(-DHAVE_TIMINGSAFE_MEMCMP) endif() +# XXX - needs _GNU_SOURCE on linux check_function_exists(memmem HAVE_MEMMEM) if(HAVE_MEMMEM) add_definitions(-DHAVE_MEMMEM) diff --git a/apps/nc/CMakeLists.txt b/apps/nc/CMakeLists.txt index 7bbdb025f0..d5f7813dba 100644 --- a/apps/nc/CMakeLists.txt +++ b/apps/nc/CMakeLists.txt @@ -22,7 +22,7 @@ else() set(NC_SRC ${NC_SRC} compat/accept4.c) endif() -check_function_exists(readpassphrase HAVE_READPASSPHRASE) +check_symbol_exists(readpassphrase "readpassphrase.h" HAVE_READPASSPHRASE) if(HAVE_READPASSPHRASE) add_definitions(-DHAVE_READPASSPHRASE) else() From 9a8d1ec81730b6aface3670b1c96375dca5af424 Mon Sep 17 00:00:00 2001 From: Yang Kun <91833768+ikspress@users.noreply.github.com> Date: Wed, 21 Aug 2024 21:58:47 +0800 Subject: [PATCH 0818/1283] Append version to dll on CMake --- crypto/CMakeLists.txt | 8 +++----- ssl/CMakeLists.txt | 8 +++----- tls/CMakeLists.txt | 8 +++----- 3 files changed, 9 insertions(+), 15 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 44923604b1..9599a70103 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -860,15 +860,13 @@ add_library(crypto $ $ emp export_symbol(crypto ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym) target_link_libraries(crypto ${PLATFORM_LIBS}) -if (WIN32) - set(CRYPTO_POSTFIX -${CRYPTO_MAJOR_VERSION} PARENT_SCOPE) -endif() set_target_properties(crypto PROPERTIES - OUTPUT_NAME crypto${CRYPTO_POSTFIX} - ARCHIVE_OUTPUT_NAME crypto${CRYPTO_POSTFIX} + OUTPUT_NAME crypto + ARCHIVE_OUTPUT_NAME crypto EXPORT_NAME Crypto VERSION ${CRYPTO_VERSION} SOVERSION ${CRYPTO_MAJOR_VERSION} + DLL_NAME_WITH_SOVERSION TRUE ) target_include_directories( diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 76f45707ac..414fe077db 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -86,15 +86,13 @@ endif() export_symbol(ssl ${CMAKE_CURRENT_SOURCE_DIR}/ssl.sym) target_link_libraries(ssl crypto ${PLATFORM_LIBS}) -if (WIN32) - set(SSL_POSTFIX -${SSL_MAJOR_VERSION} PARENT_SCOPE) -endif() set_target_properties(ssl PROPERTIES - OUTPUT_NAME ssl${SSL_POSTFIX} - ARCHIVE_OUTPUT_NAME ssl${SSL_POSTFIX} + OUTPUT_NAME ssl + ARCHIVE_OUTPUT_NAME ssl EXPORT_NAME SSL VERSION ${SSL_VERSION} SOVERSION ${SSL_MAJOR_VERSION} + DLL_NAME_WITH_SOVERSION TRUE ) target_include_directories( diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 919b1fa7bb..e584dcbdee 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -58,15 +58,13 @@ endif() export_symbol(tls ${CMAKE_CURRENT_BINARY_DIR}/tls.sym) target_link_libraries(tls ${OPENSSL_LIBS}) -if (WIN32) - set(TLS_POSTFIX -${TLS_MAJOR_VERSION} PARENT_SCOPE) -endif() set_target_properties(tls PROPERTIES - OUTPUT_NAME tls${TLS_POSTFIX} - ARCHIVE_OUTPUT_NAME tls${TLS_POSTFIX} + OUTPUT_NAME tls + ARCHIVE_OUTPUT_NAME tls EXPORT_NAME TLS VERSION ${TLS_VERSION} SOVERSION ${TLS_MAJOR_VERSION} + DLL_NAME_WITH_SOVERSION TRUE ) target_include_directories( From d718a2681595453de246de4cbf75522377675ddb Mon Sep 17 00:00:00 2001 From: Yang Kun <91833768+ikspress@users.noreply.github.com> Date: Wed, 21 Aug 2024 22:45:24 +0800 Subject: [PATCH 0819/1283] Fix includedir on CMake --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 048f6cfe71..93189f7aac 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -512,7 +512,7 @@ if(ENABLE_LIBRESSL_INSTALL) set(prefix ${CMAKE_INSTALL_PREFIX}) set(exec_prefix \${prefix}) set(libdir \${exec_prefix}/${CMAKE_INSTALL_LIBDIR}) - set(includedir \${prefix}/include) + set(includedir \${prefix}/${CMAKE_INSTALL_INCLUDEDIR}) if(PLATFORM_LIBS) string(REGEX REPLACE ";" " -l" PLATFORM_LDADD ";${PLATFORM_LIBS}") endif() From 14e8325c5ac53ad30cda03a9d635301b6bd55860 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Mon, 26 Aug 2024 04:04:39 +1000 Subject: [PATCH 0820/1283] ci: update actions --- .github/workflows/cifuzz.yml | 2 +- .github/workflows/cmake_config.yml | 2 +- .github/workflows/fedora-rawhide.yml | 2 +- .github/workflows/release.yml | 14 +++++--------- 4 files changed, 8 insertions(+), 12 deletions(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 966d92a0fc..b93ea0e722 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -26,7 +26,7 @@ jobs: dry-run: false language: c++ - name: Upload Crash - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v4 if: failure() && steps.build.outcome == 'success' with: name: artifacts diff --git a/.github/workflows/cmake_config.yml b/.github/workflows/cmake_config.yml index be9f114f51..931a26e8e6 100644 --- a/.github/workflows/cmake_config.yml +++ b/.github/workflows/cmake_config.yml @@ -37,7 +37,7 @@ jobs: if: runner.os == 'macOS' run: brew install automake libtool - - uses: actions/checkout@main + - uses: actions/checkout@v4 - name: Prepare source tree for build (Windows) if: runner.os == 'Windows' diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index ec3c63d66b..4758d2f52b 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -23,7 +23,7 @@ jobs: container: image: fedora:rawhide steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - name: Install dependencies run: | dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c2e94b8af1..8fe051ec08 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -29,7 +29,7 @@ jobs: - name: "Create GitHub release" id: create_release - uses: softprops/action-gh-release@v1 + uses: softprops/action-gh-release@v2 with: body_path: "${{ github.workspace }}/release-changelog.txt" @@ -72,14 +72,10 @@ jobs: run: cmake --install build --config Release - shell: pwsh - run: Compress-Archive -Path local\* local.zip + run: Compress-Archive -Path local\* "libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip" - name: "Upload release artifact" - uses: actions/upload-release-asset@v1 - env: - GITHUB_TOKEN: "${{ github.token }}" + uses: softprops/action-gh-release@v2 with: - upload_url: "${{ needs.release.outputs.upload_url }}" - asset_path: "local.zip" - asset_name: "libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip" - asset_content_type: "application/zip" + files: | + libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip From 0bc57801b89423cdad3fb42afb20d145f776473e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 25 Aug 2024 13:35:18 -0600 Subject: [PATCH 0821/1283] Update ChangeLog --- ChangeLog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index 61e6e50a85..1810c2574e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -105,6 +105,10 @@ LibreSSL Portable Release Notes: - Support for attributes in EVP_PKEYs was removed. - SSL_CTX_set1_cert_store() and SSL_CIPHER_get_handshake_digest() were added to libssl. + - The completely broken UI_UTIL password API was removed. + - The OpenSSL pkcs12 command PKCS12_create() no longer supports + setting the Microsoft-specific Local Key Set and Cryptographic + Service Provider attributes. * Bug fixes - Made ASN1_TIME_set_string() and ASN1_TIME_set_string_X509() match their documentation. They always set an RFC 5280 conformant time. From f27e8fb7f65b0910849e51e949bfb11d4e3c8f40 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 25 Aug 2024 15:01:22 -0600 Subject: [PATCH 0822/1283] ChangeLog: fix grammar --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 1810c2574e..cd402053bd 100644 --- a/ChangeLog +++ b/ChangeLog @@ -106,7 +106,7 @@ LibreSSL Portable Release Notes: - SSL_CTX_set1_cert_store() and SSL_CIPHER_get_handshake_digest() were added to libssl. - The completely broken UI_UTIL password API was removed. - - The OpenSSL pkcs12 command PKCS12_create() no longer supports + - The OpenSSL pkcs12 command and PKCS12_create() no longer support setting the Microsoft-specific Local Key Set and Cryptographic Service Provider attributes. * Bug fixes From 6d21506b1b9baccefc461e3d4d5a35e11046a926 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 26 Aug 2024 18:54:20 -0600 Subject: [PATCH 0823/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index cd402053bd..7764b3998e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -76,6 +76,8 @@ LibreSSL Portable Release Notes: behavior is that there is now a hard limit on the number of indexes that can be allocated. - Removed bogus connect() call from netcat. + - Uses of atoi() and strtol() in libcrypto were replaced with + strtonum(). * New features - Added CRLfile option to the cms command of openssl(1) to specify additional CRLs for use during verification. From 8276b75db44582920f509ddb4b05924be7bc8c1a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 28 Aug 2024 11:05:00 -0600 Subject: [PATCH 0824/1283] Link x509_siginfo.c to the build --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 44923604b1..38b94fa6d7 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -621,6 +621,7 @@ set( x509/x509_r2x.c x509/x509_req.c x509/x509_set.c + x509/x509_siginfo.c x509/x509_skey.c x509/x509_trs.c x509/x509_txt.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 4ca8d5f951..7b4620678c 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -922,6 +922,7 @@ libcrypto_la_SOURCES += x509/x509_purp.c libcrypto_la_SOURCES += x509/x509_r2x.c libcrypto_la_SOURCES += x509/x509_req.c libcrypto_la_SOURCES += x509/x509_set.c +libcrypto_la_SOURCES += x509/x509_siginfo.c libcrypto_la_SOURCES += x509/x509_skey.c libcrypto_la_SOURCES += x509/x509_trs.c libcrypto_la_SOURCES += x509/x509_txt.c From c43335ee1d21534100bbb1a1616b088d6fe8fd33 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 29 Aug 2024 12:19:01 -0600 Subject: [PATCH 0825/1283] Remove evp_pkey_check --- .gitignore | 1 - tests/CMakeLists.txt | 5 ----- tests/Makefile.am | 5 ----- 3 files changed, 11 deletions(-) diff --git a/.gitignore b/.gitignore index 4f4cf890ad..cc132b5be4 100644 --- a/.gitignore +++ b/.gitignore @@ -109,7 +109,6 @@ tests/ctlog.conf tests/*.crt tests/ec_point_conversion* tests/ecc_cdh* -tests/evp_pkey_check* tests/evp_pkey_cleanup* tests/explicit_bzero* tests/freenull* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index e930236a5d..61de671736 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -423,11 +423,6 @@ add_executable(evp_ecx_test evp_ecx_test.c) target_link_libraries(evp_ecx_test ${OPENSSL_TEST_LIBS}) add_platform_test(evp_ecx_test evp_ecx_test) -# evp_pkey_check -add_executable(evp_pkey_check evp_pkey_check.c) -target_link_libraries(evp_pkey_check ${OPENSSL_TEST_LIBS}) -add_platform_test(evp_pkey_check evp_pkey_check) - # evp_pkey_cleanup add_executable(evp_pkey_cleanup evp_pkey_cleanup.c) target_link_libraries(evp_pkey_cleanup ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 5388126c7f..a1b89b7df1 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -435,11 +435,6 @@ TESTS += evp_ecx_test check_PROGRAMS += evp_ecx_test evp_ecx_test_SOURCES = evp_ecx_test.c -# evp_pkey_check -TESTS += evp_pkey_check -check_PROGRAMS += evp_pkey_check -evp_pkey_check_SOURCES = evp_pkey_check.c - # evp_pkey_cleanup TESTS += evp_pkey_cleanup check_PROGRAMS += evp_pkey_cleanup From 5ffea18590c0bf585aac237626171a9b0233251c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 29 Aug 2024 12:27:46 -0600 Subject: [PATCH 0826/1283] Update man links --- man/links | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/man/links b/man/links index eeda4a687e..10ce20507a 100644 --- a/man/links +++ b/man/links @@ -994,14 +994,6 @@ EVP_PKEY_CTX_set_hkdf_md.3,EVP_PKEY_CTX_set1_hkdf_key.3 EVP_PKEY_CTX_set_hkdf_md.3,EVP_PKEY_CTX_set1_hkdf_salt.3 EVP_PKEY_CTX_set_tls1_prf_md.3,EVP_PKEY_CTX_add1_tls1_prf_seed.3 EVP_PKEY_CTX_set_tls1_prf_md.3,EVP_PKEY_CTX_set1_tls1_prf_secret.3 -EVP_PKEY_add1_attr.3,EVP_PKEY_add1_attr_by_NID.3 -EVP_PKEY_add1_attr.3,EVP_PKEY_add1_attr_by_OBJ.3 -EVP_PKEY_add1_attr.3,EVP_PKEY_add1_attr_by_txt.3 -EVP_PKEY_add1_attr.3,EVP_PKEY_delete_attr.3 -EVP_PKEY_add1_attr.3,EVP_PKEY_get_attr.3 -EVP_PKEY_add1_attr.3,EVP_PKEY_get_attr_by_NID.3 -EVP_PKEY_add1_attr.3,EVP_PKEY_get_attr_by_OBJ.3 -EVP_PKEY_add1_attr.3,EVP_PKEY_get_attr_count.3 EVP_PKEY_asn1_get_count.3,EVP_PKEY_asn1_find.3 EVP_PKEY_asn1_get_count.3,EVP_PKEY_asn1_find_str.3 EVP_PKEY_asn1_get_count.3,EVP_PKEY_asn1_get0.3 @@ -1951,7 +1943,6 @@ TS_REQ_new.3,TS_STATUS_INFO_free.3 TS_REQ_new.3,TS_STATUS_INFO_new.3 TS_REQ_new.3,TS_TST_INFO_free.3 TS_REQ_new.3,TS_TST_INFO_new.3 -UI_UTIL_read_pw.3,UI_UTIL_read_pw_string.3 UI_create_method.3,UI_destroy_method.3 UI_create_method.3,UI_method_get_closer.3 UI_create_method.3,UI_method_get_flusher.3 @@ -2138,9 +2129,7 @@ X509_REQ_add1_attr.3,X509_REQ_get_attr_by_OBJ.3 X509_REQ_add1_attr.3,X509_REQ_get_attr_count.3 X509_REQ_add_extensions.3,X509_REQ_add_extensions_nid.3 X509_REQ_add_extensions.3,X509_REQ_extension_nid.3 -X509_REQ_add_extensions.3,X509_REQ_get_extension_nids.3 X509_REQ_add_extensions.3,X509_REQ_get_extensions.3 -X509_REQ_add_extensions.3,X509_REQ_set_extension_nids.3 X509_REQ_new.3,X509_REQ_INFO_free.3 X509_REQ_new.3,X509_REQ_INFO_new.3 X509_REQ_new.3,X509_REQ_dup.3 @@ -2304,6 +2293,7 @@ X509_get0_signature.3,X509_CRL_get_signature_nid.3 X509_get0_signature.3,X509_REQ_get0_signature.3 X509_get0_signature.3,X509_REQ_get_signature_nid.3 X509_get0_signature.3,X509_get0_tbs_sigalg.3 +X509_get0_signature.3,X509_get_signature_info.3 X509_get0_signature.3,X509_get_signature_nid.3 X509_get0_signature.3,X509_get_signature_type.3 X509_get1_email.3,X509_email_free.3 From 64f8aa37017145dc2af27db20ce6b8b0fb2b214c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 Aug 2024 05:33:35 -0600 Subject: [PATCH 0827/1283] Adjust for whirlpool removal --- crypto/CMakeLists.txt | 2 -- crypto/Makefile.am | 5 ----- tests/CMakeLists.txt | 5 ----- tests/Makefile.am | 5 ----- update.sh | 4 ++-- 5 files changed, 2 insertions(+), 19 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 38b94fa6d7..8500d329d1 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -456,7 +456,6 @@ set( evp/m_sha3.c evp/m_sigver.c evp/m_sm3.c - evp/m_wp.c evp/p_legacy.c evp/p_lib.c evp/p_sign.c @@ -580,7 +579,6 @@ set( ui/ui_lib.c ui/ui_null.c ui/ui_util.c - whrlpool/whirlpool.c x509/by_dir.c x509/by_file.c x509/by_mem.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 7b4620678c..05a2246c68 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -623,7 +623,6 @@ libcrypto_la_SOURCES += evp/m_sha1.c libcrypto_la_SOURCES += evp/m_sha3.c libcrypto_la_SOURCES += evp/m_sigver.c libcrypto_la_SOURCES += evp/m_sm3.c -libcrypto_la_SOURCES += evp/m_wp.c libcrypto_la_SOURCES += evp/p_legacy.c libcrypto_la_SOURCES += evp/p_lib.c libcrypto_la_SOURCES += evp/p_sign.c @@ -685,7 +684,6 @@ noinst_HEADERS += hidden/openssl/stack.h noinst_HEADERS += hidden/openssl/ts.h noinst_HEADERS += hidden/openssl/txt_db.h noinst_HEADERS += hidden/openssl/ui.h -noinst_HEADERS += hidden/openssl/whrlpool.h noinst_HEADERS += hidden/openssl/x509.h noinst_HEADERS += hidden/openssl/x509_vfy.h noinst_HEADERS += hidden/openssl/x509v3.h @@ -878,9 +876,6 @@ endif libcrypto_la_SOURCES += ui/ui_util.c noinst_HEADERS += ui/ui_local.h -# whrlpool -libcrypto_la_SOURCES += whrlpool/whirlpool.c - # x509 libcrypto_la_SOURCES += x509/by_dir.c libcrypto_la_SOURCES += x509/by_file.c diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 61de671736..8f647b1c16 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -851,11 +851,6 @@ add_executable(verifytest verifytest.c) target_link_libraries(verifytest ${LIBTLS_TEST_LIBS}) add_platform_test(verifytest verifytest) -# whirlpool_test -add_executable(whirlpool_test whirlpool_test.c) -target_link_libraries(whirlpool_test ${OPENSSL_TEST_LIBS}) -add_platform_test(whirlpool_test whirlpool_test) - # x25519test add_executable(x25519test x25519test.c) target_link_libraries(x25519test ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index a1b89b7df1..604fdab6f1 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -831,11 +831,6 @@ TESTS += verifytest check_PROGRAMS += verifytest verifytest_SOURCES = verifytest.c -# whirlpool -TESTS += whirlpool_test -check_PROGRAMS += whirlpool_test -whirlpool_test_SOURCES = whirlpool_test.c - # x25519test TESTS += x25519test check_PROGRAMS += x25519test diff --git a/update.sh b/update.sh index cbf01c96e0..2948e0fa88 100755 --- a/update.sh +++ b/update.sh @@ -132,9 +132,9 @@ copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h hkdf/hkdf.h hmac/hmac.h rand/rand.h md5/md5.h x509/x509v3.h conf/conf.h ocsp/ocsp.h aes/aes.h modes/modes.h asn1/asn1t.h bf/blowfish.h - bio/bio.h cast/cast.h cmac/cmac.h cms/cms.h conf/conf_api.h des/des.h dh/dh.h + bio/bio.h cast/cast.h cmac/cmac.h cms/cms.h des/des.h dh/dh.h dsa/dsa.h engine/engine.h ui/ui.h pkcs12/pkcs12.h ts/ts.h - md4/md4.h ripemd/ripemd.h whrlpool/whrlpool.h idea/idea.h + md4/md4.h ripemd/ripemd.h idea/idea.h rc2/rc2.h rc4/rc4.h txt_db/txt_db.h sm3/sm3.h sm4/sm4.h chacha/chacha.h evp/evp.h poly1305/poly1305.h camellia/camellia.h curve25519/curve25519.h From b68767302eeba9b2a3ef03d521a45bab7b5dc937 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 Aug 2024 05:45:48 -0600 Subject: [PATCH 0828/1283] conf_api.h was removed, conf_local.h was added --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 8500d329d1..d54525f41a 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -800,6 +800,7 @@ target_include_directories(crypto_obj bio bn bytestring + conf dh dsa curve25519 diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 05a2246c68..616063ee4d 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -5,6 +5,7 @@ AM_CPPFLAGS += -I$(top_srcdir)/crypto/asn1 AM_CPPFLAGS += -I$(top_srcdir)/crypto/bio AM_CPPFLAGS += -I$(top_srcdir)/crypto/bn AM_CPPFLAGS += -I$(top_srcdir)/crypto/bytestring +AM_CPPFLAGS += -I$(top_srcdir)/crypto/conf AM_CPPFLAGS += -I$(top_srcdir)/crypto/curve25519 AM_CPPFLAGS += -I$(top_srcdir)/crypto/dh AM_CPPFLAGS += -I$(top_srcdir)/crypto/dsa @@ -481,6 +482,7 @@ libcrypto_la_SOURCES += conf/conf_mall.c libcrypto_la_SOURCES += conf/conf_mod.c libcrypto_la_SOURCES += conf/conf_sap.c noinst_HEADERS += conf/conf_def.h +noinst_HEADERS += conf/conf_local.h # ct libcrypto_la_SOURCES += ct/ct_b64.c @@ -647,7 +649,6 @@ noinst_HEADERS += hidden/openssl/chacha.h noinst_HEADERS += hidden/openssl/cmac.h noinst_HEADERS += hidden/openssl/cms.h noinst_HEADERS += hidden/openssl/conf.h -noinst_HEADERS += hidden/openssl/conf_api.h noinst_HEADERS += hidden/openssl/crypto.h noinst_HEADERS += hidden/openssl/ct.h noinst_HEADERS += hidden/openssl/curve25519.h From 4535cc0d81a72bdad1e168956663f7ffa54e6e25 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 Aug 2024 05:47:12 -0600 Subject: [PATCH 0829/1283] ui_util.c was removed --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index d54525f41a..0cf45128d0 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -578,7 +578,6 @@ set( ui/ui_err.c ui/ui_lib.c ui/ui_null.c - ui/ui_util.c x509/by_dir.c x509/by_file.c x509/by_mem.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 616063ee4d..4ae9bb1ec4 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -874,7 +874,6 @@ endif if HOST_WIN libcrypto_la_SOURCES += ui/ui_openssl_win.c endif -libcrypto_la_SOURCES += ui/ui_util.c noinst_HEADERS += ui/ui_local.h # x509 From 9a1decca2546bc1db6cb70fbb912e7c748db3dd7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 Aug 2024 05:48:40 -0600 Subject: [PATCH 0830/1283] enc_read.c is gone --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 0cf45128d0..651303fb82 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -368,7 +368,6 @@ set( des/ecb3_enc.c des/ecb_enc.c des/ede_cbcm_enc.c - des/enc_read.c des/fcrypt.c des/fcrypt_b.c des/ofb64ede.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 4ae9bb1ec4..5d8db16350 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -513,7 +513,6 @@ libcrypto_la_SOURCES += des/des_enc.c libcrypto_la_SOURCES += des/ecb3_enc.c libcrypto_la_SOURCES += des/ecb_enc.c libcrypto_la_SOURCES += des/ede_cbcm_enc.c -libcrypto_la_SOURCES += des/enc_read.c libcrypto_la_SOURCES += des/fcrypt.c libcrypto_la_SOURCES += des/fcrypt_b.c EXTRA_libcrypto_la_SOURCES += des/ncbc_enc.c From 4c19031d1e47f2b002a212e8c988c0fe37a65572 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 Aug 2024 09:12:08 -0600 Subject: [PATCH 0831/1283] Update man links --- man/links | 3 --- 1 file changed, 3 deletions(-) diff --git a/man/links b/man/links index 10ce20507a..32204e2c89 100644 --- a/man/links +++ b/man/links @@ -791,8 +791,6 @@ ERR_load_strings.3,ERR_PACK.3 ERR_load_strings.3,ERR_get_next_error_library.3 ERR_print_errors.3,ERR_print_errors_cb.3 ERR_print_errors.3,ERR_print_errors_fp.3 -ERR_put_error.3,ERR_add_error_data.3 -ERR_put_error.3,ERR_add_error_vdata.3 ERR_remove_state.3,ERR_remove_thread_state.3 ERR_set_mark.3,ERR_pop_to_mark.3 ESS_SIGNING_CERT_new.3,ESS_CERT_ID_free.3 @@ -1205,7 +1203,6 @@ HMAC.3,HMAC_CTX_new.3 HMAC.3,HMAC_CTX_reset.3 HMAC.3,HMAC_CTX_set_flags.3 HMAC.3,HMAC_Final.3 -HMAC.3,HMAC_Init.3 HMAC.3,HMAC_Init_ex.3 HMAC.3,HMAC_Update.3 HMAC.3,HMAC_size.3 From cde0e9c182057c3d8c582c429302579712736c27 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 Aug 2024 09:33:43 -0600 Subject: [PATCH 0832/1283] Be better at grep... --- crypto/Makefile.am | 1 - 1 file changed, 1 deletion(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 5d8db16350..807bf54906 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -515,7 +515,6 @@ libcrypto_la_SOURCES += des/ecb_enc.c libcrypto_la_SOURCES += des/ede_cbcm_enc.c libcrypto_la_SOURCES += des/fcrypt.c libcrypto_la_SOURCES += des/fcrypt_b.c -EXTRA_libcrypto_la_SOURCES += des/ncbc_enc.c libcrypto_la_SOURCES += des/ofb64ede.c libcrypto_la_SOURCES += des/ofb64enc.c libcrypto_la_SOURCES += des/ofb_enc.c From de89d89ae35e8de059d0a7ff1768823ba7ef646c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 Aug 2024 09:41:02 -0600 Subject: [PATCH 0833/1283] DES met jsing. And it never looked quite the same again. --- crypto/CMakeLists.txt | 22 ++++------------------ crypto/Makefile.am | 23 ++++------------------- 2 files changed, 8 insertions(+), 37 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 651303fb82..bf5c4a6c81 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -359,25 +359,11 @@ set( ct/ct_x509v3.c curve25519/curve25519-generic.c curve25519/curve25519.c - des/cbc_cksm.c - des/cbc_enc.c - des/cfb64ede.c - des/cfb64enc.c - des/cfb_enc.c + des/des.c + des/des_cksum.c des/des_enc.c - des/ecb3_enc.c - des/ecb_enc.c - des/ede_cbcm_enc.c - des/fcrypt.c - des/fcrypt_b.c - des/ofb64ede.c - des/ofb64enc.c - des/ofb_enc.c - des/pcbc_enc.c - des/qud_cksm.c - des/set_key.c - des/str2key.c - des/xcbc_enc.c + des/des_fcrypt.c + des/des_key.c dh/dh_ameth.c dh/dh_asn1.c dh/dh_check.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 807bf54906..cd6fe29811 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -504,27 +504,12 @@ noinst_HEADERS += curve25519/curve25519_internal.h # des -libcrypto_la_SOURCES += des/cbc_cksm.c -libcrypto_la_SOURCES += des/cbc_enc.c -libcrypto_la_SOURCES += des/cfb64ede.c -libcrypto_la_SOURCES += des/cfb64enc.c -libcrypto_la_SOURCES += des/cfb_enc.c +libcrypto_la_SOURCES += des/des.c +libcrypto_la_SOURCES += des/des_cksum.c libcrypto_la_SOURCES += des/des_enc.c -libcrypto_la_SOURCES += des/ecb3_enc.c -libcrypto_la_SOURCES += des/ecb_enc.c -libcrypto_la_SOURCES += des/ede_cbcm_enc.c -libcrypto_la_SOURCES += des/fcrypt.c -libcrypto_la_SOURCES += des/fcrypt_b.c -libcrypto_la_SOURCES += des/ofb64ede.c -libcrypto_la_SOURCES += des/ofb64enc.c -libcrypto_la_SOURCES += des/ofb_enc.c -libcrypto_la_SOURCES += des/pcbc_enc.c -libcrypto_la_SOURCES += des/qud_cksm.c -libcrypto_la_SOURCES += des/set_key.c -libcrypto_la_SOURCES += des/str2key.c -libcrypto_la_SOURCES += des/xcbc_enc.c +libcrypto_la_SOURCES += des/des_fcrypt.c +libcrypto_la_SOURCES += des/des_key.c noinst_HEADERS += des/des_local.h -noinst_HEADERS += des/spr.h # dh libcrypto_la_SOURCES += dh/dh_ameth.c From b8a6e780213ebac9fcb0ceb2c187e4a9ab82d0e3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 1 Sep 2024 02:43:00 -0600 Subject: [PATCH 0834/1283] Update ChangeLog --- ChangeLog | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 7764b3998e..da37c44174 100644 --- a/ChangeLog +++ b/ChangeLog @@ -89,14 +89,25 @@ LibreSSL Portable Release Notes: - Protocol parsing in libtls was changed. The unsupported TLSv1.1 and TLSv1.0 protocols are ignored and no longer enable or disable TLSv1.2 in surprising ways. + - The dangerous EVP_PKEY*_check(3) family of functions was removed. + The openssl(1) pkey and pkeyparam commands no longer support the + -check and -pubcheck flags. - The one-step hashing functions, MD4(), MD5(), RIPEMD160(), SHA1(), all SHA-2, and HMAC() no longer support returning a static buffer. Callers must pass in a correctly sized buffer. + - Support for Whirlpool was removed. Applications still using this + should honor OPENSSL_NO_WHIRLPOOL. - Removed workaround for F5 middle boxes. - Removed the useless pem2.h, a public header that was added since - it was too hard to add a prototype to one file. + it was too hard to add a single prototype to one file. + - Removed conf_api.h and the public API therein. + - Numerous conf and attribute functions were removed. Some unused + types were removed, others were made opaque. - Only specified versions can be set on certs, CRLs and CSRs. - - Prepared X509_REQ_{get,set}_extension_nids() for removal. + - Removed the deprecated HMAC_Init() function. + - Removed OPENSSL_load_builtin_modules(). + - Removed X509_REQ_{get,set}_extension_nids(). + - X509_check_trust() and was removed, X509_VAL was made opaque. - Removed unused PEM_USER and PEM_CTX types from pem.h. - Removed typdefs for COMP_CTX, COMP_METHOD, X509_CRL_METHOD, STORE, STORE_METHOD, and SSL_AEAD_CTX. From f4d556064641fa0e1cadc7b60a0ec8541b9ea5b6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 9 Sep 2024 00:04:22 -0600 Subject: [PATCH 0835/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index da37c44174..ad137b8d66 100644 --- a/ChangeLog +++ b/ChangeLog @@ -148,6 +148,7 @@ LibreSSL Portable Release Notes: ALPN callback. - Avoid pushing a spurious error onto the error stack in ssl_sigalg_select(). + - Made fatal alerts fatal in QUIC. 3.9.0 - Development release From 1e2e50eece1768a154cee87b9135efbafbb0a8ad Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 9 Sep 2024 00:07:18 -0600 Subject: [PATCH 0836/1283] Update man links --- man/links | 8 -------- 1 file changed, 8 deletions(-) diff --git a/man/links b/man/links index 32204e2c89..5cbcef8d37 100644 --- a/man/links +++ b/man/links @@ -2343,14 +2343,6 @@ X509_sign.3,X509_REQ_verify.3 X509_sign.3,X509_sign_ctx.3 X509_sign.3,X509_verify.3 X509_signature_dump.3,X509_signature_print.3 -X509at_add1_attr.3,X509at_add1_attr_by_NID.3 -X509at_add1_attr.3,X509at_add1_attr_by_OBJ.3 -X509at_add1_attr.3,X509at_add1_attr_by_txt.3 -X509at_add1_attr.3,X509at_delete_attr.3 -X509at_get_attr.3,X509at_get0_data_by_OBJ.3 -X509at_get_attr.3,X509at_get_attr_by_NID.3 -X509at_get_attr.3,X509at_get_attr_by_OBJ.3 -X509at_get_attr.3,X509at_get_attr_count.3 X509v3_addr_add_inherit.3,X509v3_addr_add_prefix.3 X509v3_addr_add_inherit.3,X509v3_addr_add_range.3 X509v3_addr_add_inherit.3,X509v3_addr_canonize.3 From 663f6cf6111fa74564182b895e154874af1c7649 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 12 Sep 2024 08:21:26 +0200 Subject: [PATCH 0837/1283] Clean up and expand ChangeLog --- ChangeLog | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index ad137b8d66..81b4f7b552 100644 --- a/ChangeLog +++ b/ChangeLog @@ -69,7 +69,6 @@ LibreSSL Portable Release Notes: - Improvements in the openssl(1) speed app's signal handler. - Cleaned up various X509v3_* extension API. - Unified the X.509v3 extension methods. - - Added support for TLS PRF in the EVP KDF API. - Cleaned up cipher handling in SSL_SESSION. - Removed get_cipher from SSL_METHOD. - Rewrote CRYPTO_EX_DATA from scratch. The only intentional change of @@ -78,11 +77,18 @@ LibreSSL Portable Release Notes: - Removed bogus connect() call from netcat. - Uses of atoi() and strtol() in libcrypto were replaced with strtonum(). + - Introduced crypto_arch.h which will contain the architecture + dependent code and defines rather than the public opensslconf.h. + - OPENSSL_cpu_caps() is now architecture independent. + - Reorganized the DES implementation to use fewer files and removed + optimizations for ancient processors and compilers. * New features - Added CRLfile option to the cms command of openssl(1) to specify additional CRLs for use during verification. * Documentation improvements - Removed documentation of no longer existing API. + - Unified the description of the obsolete ENGINE parameter that + needs to remain in many functions and should always be NULL. * Testing and proactive security - Switched the remaining tests to new certs. * Compatibility changes @@ -101,21 +107,22 @@ LibreSSL Portable Release Notes: - Removed the useless pem2.h, a public header that was added since it was too hard to add a single prototype to one file. - Removed conf_api.h and the public API therein. + - Removed ssl2.h, ssl23.h and ui_compat.h. - Numerous conf and attribute functions were removed. Some unused types were removed, others were made opaque. - - Only specified versions can be set on certs, CRLs and CSRs. - Removed the deprecated HMAC_Init() function. - Removed OPENSSL_load_builtin_modules(). - Removed X509_REQ_{get,set}_extension_nids(). - X509_check_trust() and was removed, X509_VAL was made opaque. + - Only specified versions can be set on certs, CRLs and CSRs. - Removed unused PEM_USER and PEM_CTX types from pem.h. - Removed typdefs for COMP_CTX, COMP_METHOD, X509_CRL_METHOD, STORE, STORE_METHOD, and SSL_AEAD_CTX. - i2d_ASN1_OBJECT() now returns -1 on error like most other i2d_*. - SPKAC support was removed from openssl(1). - Added TLS1-PRF support to the EVP interface. - - Removed ssl2.h, ssl23.h, and ui_compat.h. - Support for attributes in EVP_PKEYs was removed. + - The X509at_* API is no longer public. - SSL_CTX_set1_cert_store() and SSL_CIPHER_get_handshake_digest() were added to libssl. - The completely broken UI_UTIL password API was removed. From 5feccf86658d09b917c005bfb43191dd38f38c83 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 1 Oct 2024 03:23:09 -0500 Subject: [PATCH 0838/1283] bump minimum CMake version for DLL_NAME_WITH_SOVERSION --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 048f6cfe71..387e9195e7 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1,4 +1,4 @@ -cmake_minimum_required (VERSION 3.16.4) +cmake_minimum_required (VERSION 3.27) if(MSVC) cmake_policy(SET CMP0091 NEW) endif() From 5b8d17bcc3dd353e8a08b650f950adc620a7f7b7 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 1 Oct 2024 03:23:43 -0500 Subject: [PATCH 0839/1283] properly specify define for shared libraries --- .github/workflows/windows.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 6aca153976..c4c7d72bed 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -50,7 +50,7 @@ jobs: - name: "Configure CMake" shell: cmd - run: cmake -Bbuild -G "${{ matrix.generator }}" -A ${{ matrix.arch }} DBUILD_SHARED_LIBS=${{ matrix.shared }} -DCMAKE_INSTALL_PREFIX=../local + run: cmake -Bbuild -G "${{ matrix.generator }}" -A ${{ matrix.arch }} -D BUILD_SHARED_LIBS=${{ matrix.shared }} -D CMAKE_INSTALL_PREFIX=../local - name: "Build" shell: cmd From 415eb81ec3e3c2425668db7abde9153228d9f1de Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 2 Oct 2024 04:41:23 +0200 Subject: [PATCH 0840/1283] Revert "bump minimum CMake version for DLL_NAME_WITH_SOVERSION" This reverts commit 5feccf86658d09b917c005bfb43191dd38f38c83. --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 4f05c3bad4..62caadcf6c 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1,4 +1,4 @@ -cmake_minimum_required (VERSION 3.27) +cmake_minimum_required (VERSION 3.16.4) if(MSVC) cmake_policy(SET CMP0091 NEW) endif() From 6a20a5841cb70424c2ebfa936047ef6ea3567b52 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 2 Oct 2024 04:44:37 +0200 Subject: [PATCH 0841/1283] Only use DLL_NAME_WITH_SOVERSION for cmake >= 3.27 Suggested by Viktor Szakats in #1084 --- crypto/CMakeLists.txt | 4 +++- ssl/CMakeLists.txt | 4 +++- tls/CMakeLists.txt | 4 +++- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index c4f1af5906..59939cbe67 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -850,7 +850,9 @@ set_target_properties(crypto PROPERTIES EXPORT_NAME Crypto VERSION ${CRYPTO_VERSION} SOVERSION ${CRYPTO_MAJOR_VERSION} - DLL_NAME_WITH_SOVERSION TRUE + if(NOT CMAKE_VERSION VERSION_LESS 3.27.0) + DLL_NAME_WITH_SOVERSION TRUE + endif() ) target_include_directories( diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 414fe077db..f5288a963e 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -92,7 +92,9 @@ set_target_properties(ssl PROPERTIES EXPORT_NAME SSL VERSION ${SSL_VERSION} SOVERSION ${SSL_MAJOR_VERSION} - DLL_NAME_WITH_SOVERSION TRUE + if(NOT CMAKE_VERSION VERSION_LESS 3.27.0) + DLL_NAME_WITH_SOVERSION TRUE + endif() ) target_include_directories( diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index e584dcbdee..406fe125dc 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -64,7 +64,9 @@ set_target_properties(tls PROPERTIES EXPORT_NAME TLS VERSION ${TLS_VERSION} SOVERSION ${TLS_MAJOR_VERSION} - DLL_NAME_WITH_SOVERSION TRUE + if(NOT CMAKE_VERSION VERSION_LESS 3.27.0) + DLL_NAME_WITH_SOVERSION TRUE + endif() ) target_include_directories( From 59f21d486f3d493a0ae81b7c22569576cf4267ad Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 2 Oct 2024 05:35:50 +0200 Subject: [PATCH 0842/1283] Fix syslog_r detection --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 62caadcf6c..d2c96f1252 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -296,7 +296,7 @@ if(HAVE_GETPROGNAME) add_definitions(-DHAVE_GETPROGNAME) endif() -check_symbol_exists(syslog_r "syslog.h stdarg.h" HAVE_SYSLOG_R) +check_symbol_exists(syslog_r "syslog.h" "stdarg.h" HAVE_SYSLOG_R) if(HAVE_SYSLOG_R) add_definitions(-DHAVE_SYSLOG_R) endif() From 69c26f31f2b95034358c3c3896db5c617c5783e1 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 2 Oct 2024 12:35:23 +0200 Subject: [PATCH 0843/1283] fix syslog_r and pipe2 detection --- CMakeLists.txt | 2 +- tests/CMakeLists.txt | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index d2c96f1252..2b6294b9f4 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -296,7 +296,7 @@ if(HAVE_GETPROGNAME) add_definitions(-DHAVE_GETPROGNAME) endif() -check_symbol_exists(syslog_r "syslog.h" "stdarg.h" HAVE_SYSLOG_R) +check_symbol_exists(syslog_r "syslog.h;stdarg.h" HAVE_SYSLOG_R) if(HAVE_SYSLOG_R) add_definitions(-DHAVE_SYSLOG_R) endif() diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 8f647b1c16..845c23fd20 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -693,7 +693,7 @@ set_tests_properties(shutdowntest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_D # Emscripten does not support socketpair syscall. if(NOT (CMAKE_SYSTEM_NAME MATCHES "WindowsStore" OR EMSCRIPTEN)) set(SIGNERTEST_SRC signertest.c) - check_symbol_exists(pipe2 "fcntl.h unistd.h" HAVE_PIPE2) + check_symbol_exists(pipe2 "fcntl.h;unistd.h" HAVE_PIPE2) if(HAVE_PIPE2) add_definitions(-DHAVE_PIPE2) else() @@ -809,7 +809,7 @@ add_platform_test(tlslegacytest tlslegacytest) # Emscripten does not support socketpair syscall. if(NOT (CMAKE_SYSTEM_NAME MATCHES "WindowsStore" OR EMSCRIPTEN)) set(TLSTEST_SRC tlstest.c) - check_symbol_exists(pipe2 "fcntl.h unistd.h" HAVE_PIPE2) + check_symbol_exists(pipe2 "fcntl.h;unistd.h" HAVE_PIPE2) if(HAVE_PIPE2) add_definitions(-DHAVE_PIPE2) else() From 47681bf795e5cc71dd6024429d78c1b687ac45a3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 2 Oct 2024 13:00:09 +0200 Subject: [PATCH 0844/1283] Pull if() statement out of argument list Pointed out by @vszakats in #1100 --- crypto/CMakeLists.txt | 6 +++--- ssl/CMakeLists.txt | 6 +++--- tls/CMakeLists.txt | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 59939cbe67..03d3c2424c 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -850,10 +850,10 @@ set_target_properties(crypto PROPERTIES EXPORT_NAME Crypto VERSION ${CRYPTO_VERSION} SOVERSION ${CRYPTO_MAJOR_VERSION} - if(NOT CMAKE_VERSION VERSION_LESS 3.27.0) - DLL_NAME_WITH_SOVERSION TRUE - endif() ) +if(NOT CMAKE_VERSION VERSION_LESS 3.27.0) + set_target_properties(crypto PROPERTIES DLL_NAME_WITH_SOVERSION TRUE) +endif() target_include_directories( crypto diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index f5288a963e..cf62ff4f43 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -92,10 +92,10 @@ set_target_properties(ssl PROPERTIES EXPORT_NAME SSL VERSION ${SSL_VERSION} SOVERSION ${SSL_MAJOR_VERSION} - if(NOT CMAKE_VERSION VERSION_LESS 3.27.0) - DLL_NAME_WITH_SOVERSION TRUE - endif() ) +if(NOT CMAKE_VERSION VERSION_LESS 3.27.0) + set_target_properties(ssl PROPERTIES DLL_NAME_WITH_SOVERSION TRUE) +endif() target_include_directories( ssl diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 406fe125dc..c81bbb0028 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -64,10 +64,10 @@ set_target_properties(tls PROPERTIES EXPORT_NAME TLS VERSION ${TLS_VERSION} SOVERSION ${TLS_MAJOR_VERSION} - if(NOT CMAKE_VERSION VERSION_LESS 3.27.0) - DLL_NAME_WITH_SOVERSION TRUE - endif() ) +if(NOT CMAKE_VERSION VERSION_LESS 3.27.0) + set_target_properties(tls PROPERTIES DLL_NAME_WITH_SOVERSION TRUE) +endif() target_include_directories( tls From 3467d6f282146d6e84d5d840d532fa6ec4536d64 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 2 Aug 2024 21:54:08 +0200 Subject: [PATCH 0845/1283] Attempt to fix 2038 problem with MSVC --- crypto/compat/posix_win.c | 4 +++- include/compat/sys/time.h | 9 +++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index bb3e653408..bed8c841fc 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -9,6 +9,8 @@ #define NO_REDEF_POSIX_FUNCTIONS +#include + #include #include @@ -306,7 +308,7 @@ int gettimeofday(struct timeval * tp, struct timezone * tzp) time = ((uint64_t)file_time.dwLowDateTime); time += ((uint64_t)file_time.dwHighDateTime) << 32; - tp->tv_sec = (long)((time - EPOCH) / 10000000L); + tp->tv_sec = (long long)((time - EPOCH) / 10000000L); tp->tv_usec = (long)(system_time.wMilliseconds * 1000); return 0; } diff --git a/include/compat/sys/time.h b/include/compat/sys/time.h index 76428c190d..2448969862 100644 --- a/include/compat/sys/time.h +++ b/include/compat/sys/time.h @@ -8,6 +8,15 @@ #ifdef _MSC_VER #include + +#define timeval libressl_timeval +#define gettimeofday libressl_gettimeofday + +struct timeval { + long long tv_sec; + long tv_usec; +}; + int gettimeofday(struct timeval *tp, void *tzp); #else #include_next From 0eceb61cc0a86238a2cc74b172ea790156153cf3 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 6 Oct 2024 18:50:51 -0500 Subject: [PATCH 0846/1283] for poll timeout -1, set loop time more reasonably Otherwise it sets looptime to -1, which was skipped by select() and caused 100% cpu busy looping. --- apps/openssl/compat/poll_win.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/openssl/compat/poll_win.c b/apps/openssl/compat/poll_win.c index c9422b9103..83191e57ad 100644 --- a/apps/openssl/compat/poll_win.c +++ b/apps/openssl/compat/poll_win.c @@ -248,9 +248,9 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms) timespent_ms = 0; wait_rc = WAIT_FAILED; - if (timeout_ms < 0) + looptime_ms = (timeout_ms > 100 || timeout_ms == -1) ? 100 : timeout_ms; + if (timeout_ms == -1) timeout_ms = INFINITE; - looptime_ms = timeout_ms > 100 ? 100 : timeout_ms; do { struct timeval tv; From 64f15ec5893c518af2435798297ec4b8c1709afb Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 6 Oct 2024 18:52:46 -0500 Subject: [PATCH 0847/1283] use TIMEVAL typedef with select() This prevents the compatibility struct timeval definition in sys/time.h from potentially getting used with select() here. https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-select --- apps/openssl/compat/poll_win.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/openssl/compat/poll_win.c b/apps/openssl/compat/poll_win.c index 83191e57ad..30f6b6071a 100644 --- a/apps/openssl/compat/poll_win.c +++ b/apps/openssl/compat/poll_win.c @@ -253,7 +253,7 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms) timeout_ms = INFINITE; do { - struct timeval tv; + TIMEVAL tv; tv.tv_sec = 0; tv.tv_usec = looptime_ms * 1000; int handle_signaled = 0; From bd9978373f2811446a725df41f09398d7d751af9 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 8 Oct 2024 04:47:26 -0500 Subject: [PATCH 0848/1283] don't override language property for ASM files as C As of CMake 3.20, this causes the files to be built _as_ C, instead of just with a C compiler. This also properly specifies the languages in the project call. --- CMakeLists.txt | 2 +- crypto/CMakeLists.txt | 4 ---- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 2b6294b9f4..9c3d0d4d00 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -3,7 +3,7 @@ if(MSVC) cmake_policy(SET CMP0091 NEW) endif() -project (LibreSSL C ASM) +project(LibreSSL LANGUAGES C ASM) include(CheckFunctionExists) include(CheckSymbolExists) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 03d3c2424c..5140a7a46f 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -19,7 +19,6 @@ if(HOST_ASM_ELF_ARMV4) add_definitions(-DSHA256_ASM) add_definitions(-DSHA512_ASM) add_definitions(-DOPENSSL_CPUID_OBJ) - set_property(SOURCE ${ASM_ARMV4_ELF_SRC} PROPERTY LANGUAGE C) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_ARMV4_ELF_SRC}) endif() @@ -69,7 +68,6 @@ if(HOST_ASM_ELF_X86_64) add_definitions(-DWHIRLPOOL_ASM) add_definitions(-DOPENSSL_CPUID_OBJ) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_ELF_SRC}) - set_property(SOURCE ${ASM_X86_64_ELF_SRC} PROPERTY LANGUAGE C) endif() if(HOST_ASM_MACOSX_X86_64) @@ -118,7 +116,6 @@ if(HOST_ASM_MACOSX_X86_64) add_definitions(-DWHIRLPOOL_ASM) add_definitions(-DOPENSSL_CPUID_OBJ) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MACOSX_SRC}) - set_property(SOURCE ${ASM_X86_64_MACOSX_SRC} PROPERTY LANGUAGE C) set_property(SOURCE ${ASM_X86_64_MACOSX_SRC} PROPERTY XCODE_EXPLICIT_FILE_TYPE "sourcecode.asm") endif() @@ -193,7 +190,6 @@ if(HOST_ASM_MINGW64_X86_64) add_definitions(-DWHIRLPOOL_ASM) add_definitions(-DOPENSSL_CPUID_OBJ) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MINGW64_SRC}) - set_property(SOURCE ${ASM_X86_64_MINGW64_SRC} PROPERTY LANGUAGE C) endif() set( From f5cc7b3deaa72e398fead9a0023c6eeb2bc2673d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 8 Oct 2024 13:11:11 +0200 Subject: [PATCH 0849/1283] Link err_test to build --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 845c23fd20..6f23de5e18 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -418,6 +418,11 @@ add_executable(ed25519test ed25519test.c) target_link_libraries(ed25519test ${OPENSSL_TEST_LIBS}) add_platform_test(ed25519test ed25519test) +# err_test +add_executable(err_test err_test.c) +target_link_libraries(err_test ${OPENSSL_TEST_LIBS}) +add_platform_test(err_test err_test) + # evp_ecx_test add_executable(evp_ecx_test evp_ecx_test.c) target_link_libraries(evp_ecx_test ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 604fdab6f1..5f3b10271d 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -430,6 +430,11 @@ TESTS += ed25519test check_PROGRAMS += ed25519test ed25519test_SOURCES = ed25519test.c +# err_test +TESTS += err_test +check_PROGRAMS += err_test +err_test_SOURCES = err_test.c + # evp_ecx_test TESTS += evp_ecx_test check_PROGRAMS += evp_ecx_test From 5c23c6bf3d5022a0fedb9efaf78d3ea95f9784ae Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 11 Oct 2024 03:34:55 -0600 Subject: [PATCH 0850/1283] Start ChangeLog for 4.1 --- ChangeLog | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 81b4f7b552..0f39a9db7c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,7 +28,12 @@ history is also available from Git. LibreSSL Portable Release Notes: -4.0.0 - In development +4.1.0 - In development + * Internal improvements + - Cleaned up the error implementation. + - Many bug fixes and simplification in the EC ASN.1 code. + +4.0.0 - To be released soon... * Portable changes - Added initial Emscripten support in CMake builds. From 3bdeded5e25f8607b0af13dd33042bd5832b7c3e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 11 Oct 2024 11:50:18 +0200 Subject: [PATCH 0851/1283] CI: bump macos-12 to 15 https://github.com/actions/runner-images/issues/10721 --- .github/workflows/macos.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index d5dd3eb365..ac29bc08d0 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -21,7 +21,7 @@ jobs: strategy: fail-fast: false matrix: - os: ["macos-14", "macos-13", "macos-12"] + os: ["macos-15", "macos-14", "macos-13"] arch: ["arm64", "x86_64"] steps: - name: "Install required packages" From e8602bf84074c6356fe9edcd61028cecfda78bdc Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 11 Oct 2024 22:49:35 -0600 Subject: [PATCH 0852/1283] ChangeLog: fix typo --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 0f39a9db7c..d98b7a0de2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -31,7 +31,7 @@ LibreSSL Portable Release Notes: 4.1.0 - In development * Internal improvements - Cleaned up the error implementation. - - Many bug fixes and simplification in the EC ASN.1 code. + - Many bug fixes and simplifications in the EC ASN.1 code. 4.0.0 - To be released soon... From 3f9003232431b0c0fd5222efc6edcd8084746191 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 12 Oct 2024 11:55:08 -0600 Subject: [PATCH 0853/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index d98b7a0de2..f9b5401121 100644 --- a/ChangeLog +++ b/ChangeLog @@ -32,6 +32,9 @@ LibreSSL Portable Release Notes: * Internal improvements - Cleaned up the error implementation. - Many bug fixes and simplifications in the EC ASN.1 code. + * Compatibility changes + - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). + It has no effect since LibreSSL doesn't call atexit(). 4.0.0 - To be released soon... From 91658ff373e03e10fdcd789173361f4270ef4f57 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 15 Oct 2024 08:44:14 +0200 Subject: [PATCH 0854/1283] Fix CMake build on FreeBSD FreeBSD's libc has a stub implementation of pthread_once() that returns ENOSYS and doesn't seem to call the init routine. You need to link with pthread for this to work. This PR does this and fixes regress failures for CMake builds on this platform. This likely never worked. --- CMakeLists.txt | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index 9c3d0d4d00..204cb1bbaa 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -89,6 +89,10 @@ if(CMAKE_SYSTEM_NAME MATCHES "Linux") set(PLATFORM_LIBS ${PLATFORM_LIBS} pthread) endif() +if(CMAKE_SYSTEM_NAME MATCHES "FreeBSD") + set(PLATFORM_LIBS ${PLATFORM_LIBS} pthread) +endif() + if(WIN32) set(BUILD_NC false) if(MINGW) From 9f84dc8042ede3b981c5acde1d3e93b5e63f7f1d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 14 Oct 2024 12:43:03 -0600 Subject: [PATCH 0855/1283] Update ChangeLog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index f9b5401121..0f302ce611 100644 --- a/ChangeLog +++ b/ChangeLog @@ -36,7 +36,7 @@ LibreSSL Portable Release Notes: - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). -4.0.0 - To be released soon... +4.0.0 - Stable release * Portable changes - Added initial Emscripten support in CMake builds. From a6a5a95ab0283f9d3c75293a292bcaabe98a6aa1 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 15 Oct 2024 01:27:30 -0600 Subject: [PATCH 0856/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 0f302ce611..82d00068ec 100644 --- a/ChangeLog +++ b/ChangeLog @@ -29,6 +29,8 @@ history is also available from Git. LibreSSL Portable Release Notes: 4.1.0 - In development + * Portable changes + - Fixed CMake builds on FreeBSD. * Internal improvements - Cleaned up the error implementation. - Many bug fixes and simplifications in the EC ASN.1 code. From e783bc7eb5eca0ba1c6b3d19d934a7ef3abfd5af Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 15 Oct 2024 09:33:37 +0200 Subject: [PATCH 0857/1283] Merge ChangeLogs for 3.9.2, 3.9.1, and 3.8.4 --- ChangeLog | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/ChangeLog b/ChangeLog index 82d00068ec..ce28ed4166 100644 --- a/ChangeLog +++ b/ChangeLog @@ -167,6 +167,19 @@ LibreSSL Portable Release Notes: ssl_sigalg_select(). - Made fatal alerts fatal in QUIC. +3.9.2 - Stable release + + * Bugfixes + - OpenBSD 7.5 errata 003. A missing bounds check could lead to a crash + due to dereferencing a zero-sized allocation. + +3.9.1 - Stable release + + * Portable changes + - Updated tests with expiring certificates + - CET-related build fixes for Windows and macOS targets + - update libtls linker script to include libssl and libcrypto again + 3.9.0 - Development release * Portable changes @@ -244,6 +257,13 @@ LibreSSL Portable Release Notes: stack. - Made in-place decryption work for EVP_chacha20_poly1305(). +3.8.4 - Stable release + + * Portable changes + - Updated tests with expiring certificates + - CET-related build fixes for Windows and macOS targets + - update libtls linker script to include libssl and libcrypto again + 3.8.3 - Stable release * Portable changes From 3f178dcf18fb371bcccb4cd2cb0dddd5acc6c6f0 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Tue, 15 Oct 2024 18:54:14 +1100 Subject: [PATCH 0858/1283] ci: add freebsd workflow --- .github/workflows/freebsd.yml | 71 +++++++++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 .github/workflows/freebsd.yml diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml new file mode 100644 index 0000000000..0aa64d8d33 --- /dev/null +++ b/.github/workflows/freebsd.yml @@ -0,0 +1,71 @@ +# GitHub Actions workflow to run tests on a FreeBSD VM. +name: "FreeBSD" + +on: + workflow_dispatch: + schedule: + - cron: "0 0 * * *" # At 00:00 daily. + +concurrency: + group: "${{ github.workflow }}-${{ github.event.number || github.ref }}" + cancel-in-progress: true + +env: + FREEBSD_VERSION: "14.1" + +jobs: + autoconf: + name: "autoconf" + runs-on: ubuntu-latest + if: github.repository_owner == 'libressl' || github.event_name != 'schedule' + permissions: + contents: read + steps: + - name: "Checkout repository" + uses: actions/checkout@v4 + + - name: "Setup" + run: | + sudo apt-get update + sudo apt-get install -y automake autoconf libtool + ./autogen.sh + + - name: "Build on VM" + uses: vmactions/freebsd-vm@v1 + with: + release: "${{ env.FREEBSD_VERSION }}" + copyback: false + prepare: | + pkg install -y autoconf automake libtool + run: | + ./configure + make -j2 check || (cat tests/test-suite.log && exit 1) + + cmake: + name: "cmake" + runs-on: ubuntu-latest + if: github.repository_owner == 'libressl' || github.event_name != 'schedule' + permissions: + contents: read + steps: + - name: "Checkout repository" + uses: actions/checkout@v4 + + - name: "Setup" + run: | + sudo apt-get update + sudo apt-get install -y automake autoconf libtool + ./autogen.sh + + - name: "Build on VM" + uses: vmactions/freebsd-vm@v1 + with: + release: "${{ env.FREEBSD_VERSION }}" + copyback: false + prepare: | + pkg install -y cmake ninja + run: | + export CTEST_OUTPUT_ON_FAILURE=1 + cmake -G Ninja -B build + ninja -C build + ninja -C build test From 16c2e3cd60aaf8e639ada5912e5329e2d51df792 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 15 Oct 2024 14:19:52 +0200 Subject: [PATCH 0859/1283] Make gettimeofday() definition match the prototype Should fix #1111 --- crypto/compat/posix_win.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index bed8c841fc..1fbfce1667 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -291,7 +291,7 @@ uid_t getuid(void) #ifdef _MSC_VER struct timezone; -int gettimeofday(struct timeval * tp, struct timezone * tzp) +int gettimeofday(struct timeval *tp, void *tzp) { /* * Note: some broken versions only have 8 trailing zero's, the correct From f6dd688c7ba31c40ebeb6ca4a0ad9a0cbb0617b5 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 13 Oct 2024 23:51:17 -0500 Subject: [PATCH 0860/1283] sync Changelog from stable branch --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index ce28ed4166..0eb281085b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -29,6 +29,7 @@ history is also available from Git. LibreSSL Portable Release Notes: 4.1.0 - In development + * Portable changes - Fixed CMake builds on FreeBSD. * Internal improvements @@ -45,6 +46,7 @@ LibreSSL Portable Release Notes: - Removed timegm() compatibility layer since all uses were replaced with OPENSSL_timegm(). Cleaned up the corresponding test harness. - The mips32 platform is no longer actively supported. + - Fixed Windows support for dates beyond 2038. * Internal improvements - Cleaned up parts of the conf directory. Simplified some logic, fixed memory leaks. From 9065b293e3c6b52516d3b1ae0ea46de8b7c70bf8 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 18 Oct 2024 12:58:47 +0200 Subject: [PATCH 0861/1283] ec_cvt.c hit the attic --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 5140a7a46f..15538943b3 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -382,7 +382,6 @@ set( ec/ec_asn1.c ec/ec_check.c ec/ec_curve.c - ec/ec_cvt.c ec/ec_err.c ec/ec_key.c ec/ec_kmeth.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index cd6fe29811..02204bdd33 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -540,7 +540,6 @@ libcrypto_la_SOURCES += ec/ec_ameth.c libcrypto_la_SOURCES += ec/ec_asn1.c libcrypto_la_SOURCES += ec/ec_check.c libcrypto_la_SOURCES += ec/ec_curve.c -libcrypto_la_SOURCES += ec/ec_cvt.c libcrypto_la_SOURCES += ec/ec_err.c libcrypto_la_SOURCES += ec/ec_key.c libcrypto_la_SOURCES += ec/ec_kmeth.c From 67a3b7dfa208f4eb28d192e157e429d0da278575 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 18 Oct 2024 13:04:57 +0200 Subject: [PATCH 0862/1283] conf_mall.c is no more --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 15538943b3..ad47f3dbbd 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -340,7 +340,6 @@ set( conf/conf_def.c conf/conf_err.c conf/conf_lib.c - conf/conf_mall.c conf/conf_mod.c conf/conf_sap.c ct/ct_b64.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 02204bdd33..a3888617f9 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -478,7 +478,6 @@ libcrypto_la_SOURCES += conf/conf_api.c libcrypto_la_SOURCES += conf/conf_def.c libcrypto_la_SOURCES += conf/conf_err.c libcrypto_la_SOURCES += conf/conf_lib.c -libcrypto_la_SOURCES += conf/conf_mall.c libcrypto_la_SOURCES += conf/conf_mod.c libcrypto_la_SOURCES += conf/conf_sap.c noinst_HEADERS += conf/conf_def.h From 697cb112639e1fbaab5f544a077b606984db851a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 17 Oct 2024 10:33:47 -0600 Subject: [PATCH 0863/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 0eb281085b..b3728fcab8 100644 --- a/ChangeLog +++ b/ChangeLog @@ -35,6 +35,7 @@ LibreSSL Portable Release Notes: * Internal improvements - Cleaned up the error implementation. - Many bug fixes and simplifications in the EC ASN.1 code. + - Reworked CPU capabilities detection. * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). From 696c490c0af0f62a68093abb5ed973fabf47f114 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 18 Oct 2024 09:13:27 -0600 Subject: [PATCH 0864/1283] Hook up crypto_cpu_caps_init() --- crypto/CMakeLists.txt | 12 ++++-------- crypto/Makefile.am | 4 ++++ crypto/Makefile.am.elf-x86_64 | 2 -- crypto/Makefile.am.macosx-x86_64 | 2 -- crypto/Makefile.am.masm-x86_64 | 2 -- crypto/Makefile.am.mingw64-x86_64 | 2 -- update.sh | 5 ++++- 7 files changed, 12 insertions(+), 17 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index ad47f3dbbd..0e3f3f0d44 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -38,7 +38,6 @@ if(HOST_ASM_ELF_X86_64) sha/sha1-elf-x86_64.S sha/sha256-elf-x86_64.S sha/sha512-elf-x86_64.S - cpuid-elf-x86_64.S bn/arch/amd64/bignum_add.S bn/arch/amd64/bignum_cmadd.S @@ -66,7 +65,6 @@ if(HOST_ASM_ELF_X86_64) add_definitions(-DSHA256_ASM) add_definitions(-DSHA512_ASM) add_definitions(-DWHIRLPOOL_ASM) - add_definitions(-DOPENSSL_CPUID_OBJ) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_ELF_SRC}) endif() @@ -86,7 +84,6 @@ if(HOST_ASM_MACOSX_X86_64) sha/sha1-macosx-x86_64.S sha/sha256-macosx-x86_64.S sha/sha512-macosx-x86_64.S - cpuid-macosx-x86_64.S bn/arch/amd64/bignum_add.S bn/arch/amd64/bignum_cmadd.S @@ -114,7 +111,6 @@ if(HOST_ASM_MACOSX_X86_64) add_definitions(-DSHA256_ASM) add_definitions(-DSHA512_ASM) add_definitions(-DWHIRLPOOL_ASM) - add_definitions(-DOPENSSL_CPUID_OBJ) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MACOSX_SRC}) set_property(SOURCE ${ASM_X86_64_MACOSX_SRC} PROPERTY XCODE_EXPLICIT_FILE_TYPE "sourcecode.asm") endif() @@ -135,7 +131,6 @@ if(HOST_ASM_MASM_X86_64) sha/sha1-masm-x86_64.S sha/sha256-masm-x86_64.S sha/sha512-masm-x86_64.S - cpuid-masm-x86_64.S ) add_definitions(-Dendbr64=) add_definitions(-DAES_ASM) @@ -151,7 +146,6 @@ if(HOST_ASM_MASM_X86_64) add_definitions(-DSHA256_ASM) add_definitions(-DSHA512_ASM) add_definitions(-DWHIRLPOOL_ASM) - add_definitions(-DOPENSSL_CPUID_OBJ) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MASM_SRC}) set_property(SOURCE ${ASM_X86_64_MASM_SRC} PROPERTY LANGUAGE ASM_MASM) endif() @@ -172,7 +166,6 @@ if(HOST_ASM_MINGW64_X86_64) sha/sha1-mingw64-x86_64.S sha/sha256-mingw64-x86_64.S sha/sha512-mingw64-x86_64.S - cpuid-mingw64-x86_64.S ) add_definitions(-Dendbr32=endbr64) add_definitions(-DAES_ASM) @@ -188,10 +181,13 @@ if(HOST_ASM_MINGW64_X86_64) add_definitions(-DSHA256_ASM) add_definitions(-DSHA512_ASM) add_definitions(-DWHIRLPOOL_ASM) - add_definitions(-DOPENSSL_CPUID_OBJ) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MINGW64_SRC}) endif() +if(HOST_X86_64) + set(CRYPTO_SRC ${CRYPTO_SRC} arch/amd64/crypto_cpu_caps.c) +endif() + set( CRYPTO_SRC ${CRYPTO_SRC} diff --git a/crypto/Makefile.am b/crypto/Makefile.am index a3888617f9..70365096e5 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -202,6 +202,10 @@ endif endif endif +if HOST_X86_64 +libcrypto_la_SOURCES += arch/amd64/crypto_cpu_caps.c +endif + libcrypto_la_SOURCES += cpt_err.c libcrypto_la_SOURCES += cryptlib.c libcrypto_la_SOURCES += crypto_ex_data.c diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index 990475e04c..c00ce026d3 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -12,7 +12,6 @@ ASM_X86_64_ELF += rc4/rc4-elf-x86_64.S ASM_X86_64_ELF += sha/sha1-elf-x86_64.S ASM_X86_64_ELF += sha/sha256-elf-x86_64.S ASM_X86_64_ELF += sha/sha512-elf-x86_64.S -ASM_X86_64_ELF += cpuid-elf-x86_64.S ASM_X86_64_ELF += bn/arch/amd64/bignum_add.S ASM_X86_64_ELF += bn/arch/amd64/bignum_cmadd.S @@ -43,6 +42,5 @@ libcrypto_la_CPPFLAGS += -DSHA1_ASM libcrypto_la_CPPFLAGS += -DSHA256_ASM libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM -libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ libcrypto_la_SOURCES += $(ASM_X86_64_ELF) endif diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index c380003068..cd88b95832 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -12,7 +12,6 @@ ASM_X86_64_MACOSX += rc4/rc4-macosx-x86_64.S ASM_X86_64_MACOSX += sha/sha1-macosx-x86_64.S ASM_X86_64_MACOSX += sha/sha256-macosx-x86_64.S ASM_X86_64_MACOSX += sha/sha512-macosx-x86_64.S -ASM_X86_64_MACOSX += cpuid-macosx-x86_64.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_add.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_cmadd.S @@ -43,6 +42,5 @@ libcrypto_la_CPPFLAGS += -DSHA1_ASM libcrypto_la_CPPFLAGS += -DSHA256_ASM libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM -libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ libcrypto_la_SOURCES += $(ASM_X86_64_MACOSX) endif diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index 437638c1ea..9ecccde837 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -12,7 +12,6 @@ ASM_X86_64_MASM += rc4/rc4-masm-x86_64.S ASM_X86_64_MASM += sha/sha1-masm-x86_64.S ASM_X86_64_MASM += sha/sha256-masm-x86_64.S ASM_X86_64_MASM += sha/sha512-masm-x86_64.S -ASM_X86_64_MASM += cpuid-masm-x86_64.S EXTRA_DIST += $(ASM_X86_64_MASM) @@ -30,6 +29,5 @@ libcrypto_la_CPPFLAGS += -DSHA1_ASM libcrypto_la_CPPFLAGS += -DSHA256_ASM libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM -libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ libcrypto_la_SOURCES += $(ASM_X86_64_MASM) endif diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index 2d41c37abf..c2464ab416 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -12,7 +12,6 @@ ASM_X86_64_MINGW64 += rc4/rc4-mingw64-x86_64.S ASM_X86_64_MINGW64 += sha/sha1-mingw64-x86_64.S ASM_X86_64_MINGW64 += sha/sha256-mingw64-x86_64.S ASM_X86_64_MINGW64 += sha/sha512-mingw64-x86_64.S -ASM_X86_64_MINGW64 += cpuid-mingw64-x86_64.S EXTRA_DIST += $(ASM_X86_64_MINGW64) @@ -31,6 +30,5 @@ libcrypto_la_CPPFLAGS += -DSHA1_ASM libcrypto_la_CPPFLAGS += -DSHA256_ASM libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM -libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ libcrypto_la_SOURCES += $(ASM_X86_64_MINGW64) endif diff --git a/update.sh b/update.sh index 2948e0fa88..8fdae9de8a 100755 --- a/update.sh +++ b/update.sh @@ -172,6 +172,10 @@ for i in $libcrypto_src/arch/*; do $CP $libcrypto_src/arch/$arch/opensslconf.h include/arch/$arch/ mkdir -p crypto/arch/$arch $CP $libcrypto_src/arch/$arch/crypto_arch.h crypto/arch/$arch/ + crypto_cpu_caps=$libcrypto_src/arch/$arch/crypto_cpu_caps.c + if [ -f "$crypto_cpu_caps" ]; then + $CP "$crypto_cpu_caps" crypto/arch/$arch/ + fi done for i in $libcrypto_src/bn/arch/*; do @@ -282,7 +286,6 @@ for abi in elf macosx masm mingw64; do gen_asm_stdout $abi sha/asm/sha1-x86_64.pl sha/sha1-$abi-x86_64.S gen_asm $abi sha/asm/sha512-x86_64.pl sha/sha256-$abi-x86_64.S gen_asm $abi sha/asm/sha512-x86_64.pl sha/sha512-$abi-x86_64.S - gen_asm $abi x86_64cpuid.pl cpuid-$abi-x86_64.S done # copy libtls source From 27ec5b142ac5650f0e990da130405dd22cf3e137 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 18 Oct 2024 17:41:20 +0200 Subject: [PATCH 0865/1283] disable cpu caps on windows for now --- patches/patch-amd64-crypto-cpu-caps.c.patch | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 patches/patch-amd64-crypto-cpu-caps.c.patch diff --git a/patches/patch-amd64-crypto-cpu-caps.c.patch b/patches/patch-amd64-crypto-cpu-caps.c.patch new file mode 100644 index 0000000000..f7cb4c9235 --- /dev/null +++ b/patches/patch-amd64-crypto-cpu-caps.c.patch @@ -0,0 +1,20 @@ +--- crypto/arch/amd64/crypto_cpu_caps.c.orig Fri Oct 18 17:35:20 2024 ++++ crypto/arch/amd64/crypto_cpu_caps.c Fri Oct 18 17:39:13 2024 +@@ -33,7 +33,7 @@ cpuid(uint32_t eax, uint32_t *out_eax, uint32_t *out_e + { + uint32_t ebx = 0, ecx = 0, edx = 0; + +-#ifndef OPENSSL_NO_ASM ++#if defined(__GNUC__) && !defined(OPENSSL_NO_ASM) + __asm__ ("cpuid": "+a"(eax), "+b"(ebx), "+c"(ecx), "+d"(edx)); + #else + eax = 0; +@@ -54,7 +54,7 @@ xgetbv(uint32_t ecx, uint32_t *out_eax, uint32_t *out_ + { + uint32_t eax = 0, edx = 0; + +-#ifndef OPENSSL_NO_ASM ++#if defined(__GNUC__) && !defined(OPENSSL_NO_ASM) + __asm__ ("xgetbv": "+a"(eax), "+c"(ecx), "+d"(edx)); + #endif + From cca1d39f2830337ed285fe079df315eedc38cbef Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 18 Oct 2024 10:44:55 -0600 Subject: [PATCH 0866/1283] Also disable cpu caps on windows i386 --- patches/patch-i386-crypto-cpu-caps.c.patch | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 patches/patch-i386-crypto-cpu-caps.c.patch diff --git a/patches/patch-i386-crypto-cpu-caps.c.patch b/patches/patch-i386-crypto-cpu-caps.c.patch new file mode 100644 index 0000000000..c85e33c744 --- /dev/null +++ b/patches/patch-i386-crypto-cpu-caps.c.patch @@ -0,0 +1,20 @@ +--- crypto/arch/i386/crypto_cpu_caps.c.orig Fri Oct 18 17:35:20 2024 ++++ crypto/arch/i386/crypto_cpu_caps.c Fri Oct 18 17:39:13 2024 +@@ -33,7 +33,7 @@ cpuid(uint32_t eax, uint32_t *out_eax, uint32_t *out_e + { + uint32_t ebx = 0, ecx = 0, edx = 0; + +-#ifndef OPENSSL_NO_ASM ++#if defined(__GNUC__) && !defined(OPENSSL_NO_ASM) + __asm__ ("cpuid": "+a"(eax), "+b"(ebx), "+c"(ecx), "+d"(edx)); + #else + eax = 0; +@@ -54,7 +54,7 @@ xgetbv(uint32_t ecx, uint32_t *out_eax, uint32_t *out_ + { + uint32_t eax = 0, edx = 0; + +-#ifndef OPENSSL_NO_ASM ++#if defined(__GNUC__) && !defined(OPENSSL_NO_ASM) + __asm__ ("xgetbv": "+a"(eax), "+c"(ecx), "+d"(edx)); + #endif + From 9256f9f939cb7afcb679d6625621be39ea636ec0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 18 Oct 2024 10:51:36 -0600 Subject: [PATCH 0867/1283] Hook i386 crypto_cpu_caps to build --- crypto/CMakeLists.txt | 2 ++ crypto/Makefile.am | 3 +++ 2 files changed, 5 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 0e3f3f0d44..2b9b06ec06 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -186,6 +186,8 @@ endif() if(HOST_X86_64) set(CRYPTO_SRC ${CRYPTO_SRC} arch/amd64/crypto_cpu_caps.c) +if(HOST_I386) + set(CRYPTO_SRC ${CRYPTO_SRC} arch/i386/crypto_cpu_caps.c) endif() set( diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 70365096e5..0dc981be52 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -205,6 +205,9 @@ endif if HOST_X86_64 libcrypto_la_SOURCES += arch/amd64/crypto_cpu_caps.c endif +if HOST_I386 +libcrypto_la_SOURCES += arch/i386/crypto_cpu_caps.c +endif libcrypto_la_SOURCES += cpt_err.c libcrypto_la_SOURCES += cryptlib.c From d418a560628d5f1eaf32e5bb21f8b34dae4cccd8 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 18 Oct 2024 11:01:51 -0600 Subject: [PATCH 0868/1283] Fix conditional nesting --- crypto/CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 2b9b06ec06..38d0de9510 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -186,7 +186,7 @@ endif() if(HOST_X86_64) set(CRYPTO_SRC ${CRYPTO_SRC} arch/amd64/crypto_cpu_caps.c) -if(HOST_I386) +elseif(HOST_I386) set(CRYPTO_SRC ${CRYPTO_SRC} arch/i386/crypto_cpu_caps.c) endif() From d2a5af6464dd91856d6dd427e59c61994ba64019 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 18 Oct 2024 13:40:30 -0600 Subject: [PATCH 0869/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index b3728fcab8..5785858afb 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,6 +39,8 @@ LibreSSL Portable Release Notes: * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). + - Elliptic curve parameters are only accepted if they encode a + builtin curve. 4.0.0 - Stable release From 7c4cb4473bee8345122ce3591b711a06be4ed06c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 18 Oct 2024 15:13:31 -0600 Subject: [PATCH 0870/1283] Remove -DWHIRLPOOL_ASM --- crypto/CMakeLists.txt | 4 ---- crypto/Makefile.am.elf-x86_64 | 1 - crypto/Makefile.am.macosx-x86_64 | 1 - crypto/Makefile.am.masm-x86_64 | 1 - crypto/Makefile.am.mingw64-x86_64 | 1 - 5 files changed, 8 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 38d0de9510..3b88fbe560 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -64,7 +64,6 @@ if(HOST_ASM_ELF_X86_64) add_definitions(-DSHA1_ASM) add_definitions(-DSHA256_ASM) add_definitions(-DSHA512_ASM) - add_definitions(-DWHIRLPOOL_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_ELF_SRC}) endif() @@ -110,7 +109,6 @@ if(HOST_ASM_MACOSX_X86_64) add_definitions(-DSHA1_ASM) add_definitions(-DSHA256_ASM) add_definitions(-DSHA512_ASM) - add_definitions(-DWHIRLPOOL_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MACOSX_SRC}) set_property(SOURCE ${ASM_X86_64_MACOSX_SRC} PROPERTY XCODE_EXPLICIT_FILE_TYPE "sourcecode.asm") endif() @@ -145,7 +143,6 @@ if(HOST_ASM_MASM_X86_64) add_definitions(-DSHA1_ASM) add_definitions(-DSHA256_ASM) add_definitions(-DSHA512_ASM) - add_definitions(-DWHIRLPOOL_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MASM_SRC}) set_property(SOURCE ${ASM_X86_64_MASM_SRC} PROPERTY LANGUAGE ASM_MASM) endif() @@ -180,7 +177,6 @@ if(HOST_ASM_MINGW64_X86_64) add_definitions(-DSHA1_ASM) add_definitions(-DSHA256_ASM) add_definitions(-DSHA512_ASM) - add_definitions(-DWHIRLPOOL_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MINGW64_SRC}) endif() diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index c00ce026d3..739fd3feee 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -41,6 +41,5 @@ libcrypto_la_CPPFLAGS += -DRSA_ASM libcrypto_la_CPPFLAGS += -DSHA1_ASM libcrypto_la_CPPFLAGS += -DSHA256_ASM libcrypto_la_CPPFLAGS += -DSHA512_ASM -libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM libcrypto_la_SOURCES += $(ASM_X86_64_ELF) endif diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index cd88b95832..1095bcadac 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -41,6 +41,5 @@ libcrypto_la_CPPFLAGS += -DRSA_ASM libcrypto_la_CPPFLAGS += -DSHA1_ASM libcrypto_la_CPPFLAGS += -DSHA256_ASM libcrypto_la_CPPFLAGS += -DSHA512_ASM -libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM libcrypto_la_SOURCES += $(ASM_X86_64_MACOSX) endif diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index 9ecccde837..fefe2bd388 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -28,6 +28,5 @@ libcrypto_la_CPPFLAGS += -DRSA_ASM libcrypto_la_CPPFLAGS += -DSHA1_ASM libcrypto_la_CPPFLAGS += -DSHA256_ASM libcrypto_la_CPPFLAGS += -DSHA512_ASM -libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM libcrypto_la_SOURCES += $(ASM_X86_64_MASM) endif diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index c2464ab416..1470d4aebc 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -29,6 +29,5 @@ libcrypto_la_CPPFLAGS += -DRSA_ASM libcrypto_la_CPPFLAGS += -DSHA1_ASM libcrypto_la_CPPFLAGS += -DSHA256_ASM libcrypto_la_CPPFLAGS += -DSHA512_ASM -libcrypto_la_CPPFLAGS += -DWHIRLPOOL_ASM libcrypto_la_SOURCES += $(ASM_X86_64_MINGW64) endif From 202386e26064972a583858f37520b9a80329ee57 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 19 Oct 2024 04:07:53 -0600 Subject: [PATCH 0871/1283] ec_check.c was removed --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 3b88fbe560..7844989f7a 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -373,7 +373,6 @@ set( dsa/dsa_prn.c ec/ec_ameth.c ec/ec_asn1.c - ec/ec_check.c ec/ec_curve.c ec/ec_err.c ec/ec_key.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 0dc981be52..f05ab59a79 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -544,7 +544,6 @@ noinst_HEADERS += dsa/dsa_local.h # ec libcrypto_la_SOURCES += ec/ec_ameth.c libcrypto_la_SOURCES += ec/ec_asn1.c -libcrypto_la_SOURCES += ec/ec_check.c libcrypto_la_SOURCES += ec/ec_curve.c libcrypto_la_SOURCES += ec/ec_err.c libcrypto_la_SOURCES += ec/ec_key.c From b91394493ce17310d3b7e60904c60b3852d3a808 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 22 Oct 2024 19:41:30 -0600 Subject: [PATCH 0872/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 5785858afb..2263ea028c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -35,6 +35,7 @@ LibreSSL Portable Release Notes: * Internal improvements - Cleaned up the error implementation. - Many bug fixes and simplifications in the EC ASN.1 code. + - Polished EC_POINT_{oct2point,point2oct}() internals - Reworked CPU capabilities detection. * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). From 4c6b98dd9798b029546360445f4ec0f7a416f10a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 23 Oct 2024 09:09:07 -0600 Subject: [PATCH 0873/1283] Tweak changelog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 2263ea028c..32ae449ded 100644 --- a/ChangeLog +++ b/ChangeLog @@ -41,7 +41,7 @@ LibreSSL Portable Release Notes: - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). - Elliptic curve parameters are only accepted if they encode a - builtin curve. + built-in curve. 4.0.0 - Stable release From 4a2adf24c532fa4e7c188156a6f77ea620d73593 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 24 Oct 2024 08:57:44 -0600 Subject: [PATCH 0874/1283] Missing . --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 32ae449ded..94231e4c8b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -35,7 +35,7 @@ LibreSSL Portable Release Notes: * Internal improvements - Cleaned up the error implementation. - Many bug fixes and simplifications in the EC ASN.1 code. - - Polished EC_POINT_{oct2point,point2oct}() internals + - Polished EC_POINT_{oct2point,point2oct}() internals. - Reworked CPU capabilities detection. * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). From eb6aaeb8c4a6809c9c3d95f149b92d957aaf8736 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 26 Oct 2024 13:19:22 -0600 Subject: [PATCH 0875/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 94231e4c8b..d5d9d9b648 100644 --- a/ChangeLog +++ b/ChangeLog @@ -35,6 +35,7 @@ LibreSSL Portable Release Notes: * Internal improvements - Cleaned up the error implementation. - Many bug fixes and simplifications in the EC ASN.1 code. + - Corrected several DER encoding bugs for EC keys and parameters. - Polished EC_POINT_{oct2point,point2oct}() internals. - Reworked CPU capabilities detection. * Compatibility changes From d219952fac6cd6aac20fa3c2c07573f4aa136fd1 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 28 Oct 2024 22:49:57 -0600 Subject: [PATCH 0876/1283] Tweak ChangeLog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index d5d9d9b648..014bbe8722 100644 --- a/ChangeLog +++ b/ChangeLog @@ -35,7 +35,7 @@ LibreSSL Portable Release Notes: * Internal improvements - Cleaned up the error implementation. - Many bug fixes and simplifications in the EC ASN.1 code. - - Corrected several DER encoding bugs for EC keys and parameters. + - Corrected DER encoding for EC keys and parameters. - Polished EC_POINT_{oct2point,point2oct}() internals. - Reworked CPU capabilities detection. * Compatibility changes From f9df014f5991e243d28ab903e403d0d68aaeb3c6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 29 Oct 2024 00:51:41 -0600 Subject: [PATCH 0877/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 014bbe8722..ba3a44533c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -38,6 +38,7 @@ LibreSSL Portable Release Notes: - Corrected DER encoding for EC keys and parameters. - Polished EC_POINT_{oct2point,point2oct}() internals. - Reworked CPU capabilities detection. + - Plugged a leak in eckey_compute_pubkey(). * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). From 4f20970ac6c0dc089b7d2a69b22afcb065fb4ff7 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Tue, 29 Oct 2024 15:27:34 +0100 Subject: [PATCH 0878/1283] cmake: use `CMAKE_INSTALL_SYSCONFDIR` Replace `${CMAKE_INSTALL_PREFIX}/etc` with `${CMAKE_INSTALL_SYSCONFDIR}`. It makes the install step honor the `--prefix` option. Fixes #1118 --- CMakeLists.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 204cb1bbaa..0173bf854a 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -449,10 +449,10 @@ if(OPENSSLDIR STREQUAL "") if(WIN32) set(OPENSSLDIR "C:/Windows/libressl/ssl") else() - set(OPENSSLDIR "${CMAKE_INSTALL_PREFIX}/etc/ssl") + set(OPENSSLDIR "${CMAKE_INSTALL_SYSCONFDIR}/ssl") endif() - set(CONF_DIR "${CMAKE_INSTALL_PREFIX}/etc/ssl") + set(CONF_DIR "${CMAKE_INSTALL_SYSCONFDIR}/ssl") else() set(CONF_DIR "${OPENSSLDIR}") endif() From 3eea7a68377d35c7a37074de380ac4d4638afbe6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 29 Oct 2024 09:46:31 -0600 Subject: [PATCH 0879/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index ba3a44533c..7285f57a2b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -32,6 +32,7 @@ LibreSSL Portable Release Notes: * Portable changes - Fixed CMake builds on FreeBSD. + - Fixed the --prefix option for cmake --install. * Internal improvements - Cleaned up the error implementation. - Many bug fixes and simplifications in the EC ASN.1 code. From b478250379a0627ad8914c765307260fb97e6bec Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 30 Oct 2024 13:00:31 -0600 Subject: [PATCH 0880/1283] +ec_convert.c -ec_print.c --- crypto/CMakeLists.txt | 2 +- crypto/Makefile.am | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 7844989f7a..5afd54f4e2 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -373,6 +373,7 @@ set( dsa/dsa_prn.c ec/ec_ameth.c ec/ec_asn1.c + ec/ec_convert.c ec/ec_curve.c ec/ec_err.c ec/ec_key.c @@ -381,7 +382,6 @@ set( ec/ec_mult.c ec/ec_oct.c ec/ec_pmeth.c - ec/ec_print.c ec/eck_prn.c ec/ecp_mont.c ec/ecp_oct.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index f05ab59a79..57030a8271 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -544,6 +544,7 @@ noinst_HEADERS += dsa/dsa_local.h # ec libcrypto_la_SOURCES += ec/ec_ameth.c libcrypto_la_SOURCES += ec/ec_asn1.c +libcrypto_la_SOURCES += ec/ec_convert.c libcrypto_la_SOURCES += ec/ec_curve.c libcrypto_la_SOURCES += ec/ec_err.c libcrypto_la_SOURCES += ec/ec_key.c @@ -552,7 +553,6 @@ libcrypto_la_SOURCES += ec/ec_lib.c libcrypto_la_SOURCES += ec/ec_mult.c libcrypto_la_SOURCES += ec/ec_oct.c libcrypto_la_SOURCES += ec/ec_pmeth.c -libcrypto_la_SOURCES += ec/ec_print.c libcrypto_la_SOURCES += ec/eck_prn.c libcrypto_la_SOURCES += ec/ecp_mont.c libcrypto_la_SOURCES += ec/ecp_oct.c From 2f680db530996204949edcf3f14c3c7569c1a21f Mon Sep 17 00:00:00 2001 From: Jonas 'Sortie' Termansen Date: Sat, 2 Nov 2024 13:43:17 +0100 Subject: [PATCH 0881/1283] Assume unknown operating systems use ELF. There's a lot of new Unix-like operating systems out that that might port LibreSSL (my Sortix is among them) and they all use ELF. If the operating system doesn't use ELF or isn't an Unix, it doesn't have a chance at working out of this box anyway, and this change makes LibreSSL work on a generic and sufficiently featured POSIX system. --- configure.ac | 4 ---- m4/check-os-options.m4 | 3 ++- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/configure.ac b/configure.ac index 87a80cc02d..51e096bd90 100644 --- a/configure.ac +++ b/configure.ac @@ -32,10 +32,6 @@ LT_INIT([pic-only]) CHECK_OS_OPTIONS -if test "$HOST_OS" = "unsupported"; then - AC_MSG_ERROR([unsupported platform: $host_os]) -fi - CHECK_C_HARDENING_OPTIONS DISABLE_AS_EXECUTABLE_STACK diff --git a/m4/check-os-options.m4 b/m4/check-os-options.m4 index 91c30214cb..1f0b7e4730 100644 --- a/m4/check-os-options.m4 +++ b/m4/check-os-options.m4 @@ -132,7 +132,8 @@ char buf[1]; getentropy(buf, 1); AC_SUBST([PLATFORM_LDADD], ['-ldl -lmd -lnsl -lsocket']) ;; *) - HOST_OS=unsupported + HOST_OS=$host_os + HOST_ABI=elf ;; esac From c46bc4cf868fbe3d17a4d5d73d15a5b35b0ff026 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 2 Nov 2024 07:03:33 -0600 Subject: [PATCH 0882/1283] Update ChangeLog --- ChangeLog | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 7285f57a2b..ba36c91e3a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,12 +39,14 @@ LibreSSL Portable Release Notes: - Corrected DER encoding for EC keys and parameters. - Polished EC_POINT_{oct2point,point2oct}() internals. - Reworked CPU capabilities detection. - - Plugged a leak in eckey_compute_pubkey(). + - Improved the code setting EC points via compressed coordinates. * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). - Elliptic curve parameters are only accepted if they encode a built-in curve. + * Bug fixes + - Plugged a leak in eckey_compute_pubkey(). 4.0.0 - Stable release From 4db5917a6d51dfa71d446e1de5e51a5ca089a109 Mon Sep 17 00:00:00 2001 From: Jonas 'Sortie' Termansen Date: Sat, 2 Nov 2024 14:13:17 +0100 Subject: [PATCH 0883/1283] Warn on unsupported operating systems --- configure.ac | 4 ++++ m4/check-os-options.m4 | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index 51e096bd90..864a4ad8fc 100644 --- a/configure.ac +++ b/configure.ac @@ -159,3 +159,7 @@ AM_CONDITIONAL([ENABLE_LIBTLS_ONLY], [test "x$enable_libtls_only" = xyes]) AC_REQUIRE_AUX_FILE([tap-driver.sh]) AC_OUTPUT + +if test "$HOST_OS" = "unsupported"; then + AC_MSG_WARN([unsupported platform: $host_os]) +fi diff --git a/m4/check-os-options.m4 b/m4/check-os-options.m4 index 1f0b7e4730..2ef42937fa 100644 --- a/m4/check-os-options.m4 +++ b/m4/check-os-options.m4 @@ -132,7 +132,7 @@ char buf[1]; getentropy(buf, 1); AC_SUBST([PLATFORM_LDADD], ['-ldl -lmd -lnsl -lsocket']) ;; *) - HOST_OS=$host_os + HOST_OS=unsupported HOST_ABI=elf ;; esac From 9b6c55006a93faf6192d6581056429b35650b73c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 2 Nov 2024 16:23:13 +0100 Subject: [PATCH 0884/1283] Try to fix Emscripten ASAN OOM for ec_asn1_test --- tests/CMakeLists.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 6f23de5e18..568d474d64 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -390,6 +390,7 @@ add_platform_test(ecc_cdh ecc_cdh) # ec_asn1_test add_executable(ec_asn1_test ec_asn1_test.c) target_link_libraries(ec_asn1_test ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(ec_asn1_test) add_platform_test(ec_asn1_test ec_asn1_test) # ec_point_conversion From 66f0dba5fe32bf7fe598f9152924a1f43fa21533 Mon Sep 17 00:00:00 2001 From: Jonas 'Sortie' Termansen Date: Sat, 2 Nov 2024 21:48:40 +0100 Subject: [PATCH 0885/1283] Print uid_t portably with PRIu64. --- patches/tls_config.c.patch | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 patches/tls_config.c.patch diff --git a/patches/tls_config.c.patch b/patches/tls_config.c.patch new file mode 100644 index 0000000000..38c667f508 --- /dev/null +++ b/patches/tls_config.c.patch @@ -0,0 +1,21 @@ +--- tls/tls_config.c.orig 2024-11-02 21:19:47.090322191 +0100 ++++ tls/tls_config.c 2024-11-02 21:38:22.527071689 +0100 +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -742,8 +743,8 @@ + + if (sb.st_uid != getuid()) { + tls_config_set_errorx(config, TLS_ERROR_UNKNOWN, +- "session file has incorrect owner (uid %u != %u)", +- sb.st_uid, getuid()); ++ "session file has incorrect owner (uid %" PRIu64" != %" PRIu64 ")", ++ (uint64_t)sb.st_uid, (uint64_t)getuid()); + return (-1); + } + mugo = sb.st_mode & (S_IRWXU|S_IRWXG|S_IRWXO); From 5805f96b0650abfe0d60eb19da9b080a456e215a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 3 Nov 2024 08:55:11 +0100 Subject: [PATCH 0886/1283] Simplify patch and use %llu --- patches/tls_config.c.patch | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/patches/tls_config.c.patch b/patches/tls_config.c.patch index 38c667f508..1342a60962 100644 --- a/patches/tls_config.c.patch +++ b/patches/tls_config.c.patch @@ -1,21 +1,15 @@ +uid_t can be 64-bit + --- tls/tls_config.c.orig 2024-11-02 21:19:47.090322191 +0100 +++ tls/tls_config.c 2024-11-02 21:38:22.527071689 +0100 -@@ -20,6 +20,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -742,8 +743,8 @@ +@@ -742,8 +742,8 @@ if (sb.st_uid != getuid()) { tls_config_set_errorx(config, TLS_ERROR_UNKNOWN, - "session file has incorrect owner (uid %u != %u)", - sb.st_uid, getuid()); -+ "session file has incorrect owner (uid %" PRIu64" != %" PRIu64 ")", -+ (uint64_t)sb.st_uid, (uint64_t)getuid()); ++ "session file has incorrect owner (uid %llu != %llu)", ++ (unsigned long long)sb.st_uid, (unsigned long long)getuid()); return (-1); } mugo = sb.st_mode & (S_IRWXU|S_IRWXG|S_IRWXO); From 13a2874cc62ebbc87208f0034e938c0e70d1b9a3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 2 Nov 2024 09:53:17 -0600 Subject: [PATCH 0887/1283] -ec{,p}_oct.c --- crypto/CMakeLists.txt | 2 -- crypto/Makefile.am | 2 -- 2 files changed, 4 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 5afd54f4e2..b5b62ed5df 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -380,11 +380,9 @@ set( ec/ec_kmeth.c ec/ec_lib.c ec/ec_mult.c - ec/ec_oct.c ec/ec_pmeth.c ec/eck_prn.c ec/ecp_mont.c - ec/ecp_oct.c ec/ecp_smpl.c ec/ecx_methods.c ecdh/ecdh.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 57030a8271..b7aa4c5ba5 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -551,11 +551,9 @@ libcrypto_la_SOURCES += ec/ec_key.c libcrypto_la_SOURCES += ec/ec_kmeth.c libcrypto_la_SOURCES += ec/ec_lib.c libcrypto_la_SOURCES += ec/ec_mult.c -libcrypto_la_SOURCES += ec/ec_oct.c libcrypto_la_SOURCES += ec/ec_pmeth.c libcrypto_la_SOURCES += ec/eck_prn.c libcrypto_la_SOURCES += ec/ecp_mont.c -libcrypto_la_SOURCES += ec/ecp_oct.c libcrypto_la_SOURCES += ec/ecp_smpl.c libcrypto_la_SOURCES += ec/ecx_methods.c noinst_HEADERS += ec/ec_local.h From 13842ed91ed25c4cb535fe94f0e01ec93e017413 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 5 Nov 2024 02:00:46 -0700 Subject: [PATCH 0888/1283] tweak changelog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index ba36c91e3a..1a64821a49 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,7 +39,7 @@ LibreSSL Portable Release Notes: - Corrected DER encoding for EC keys and parameters. - Polished EC_POINT_{oct2point,point2oct}() internals. - Reworked CPU capabilities detection. - - Improved the code setting EC points via compressed coordinates. + - Improved the code setting compressed coordinates for EC points. * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). From b29d115ad24299042326c358da7444dd1699e36e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 5 Nov 2024 02:39:30 -0700 Subject: [PATCH 0889/1283] cryptlib.h is now crypto_local.h --- crypto/Makefile.am | 1 - 1 file changed, 1 deletion(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index b7aa4c5ba5..b4e8bd8986 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -225,7 +225,6 @@ libcrypto_la_SOURCES += mem_dbg.c libcrypto_la_SOURCES += o_fips.c noinst_HEADERS += arm_arch.h noinst_HEADERS += constant_time.h -noinst_HEADERS += cryptlib.h noinst_HEADERS += crypto_internal.h noinst_HEADERS += crypto_local.h noinst_HEADERS += x86_arch.h From 1a3e756a757da607621949b43f97fb79b6fb31ae Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 5 Nov 2024 04:27:16 -0700 Subject: [PATCH 0890/1283] adapt to my upstream churn --- crypto/CMakeLists.txt | 8 ++------ crypto/Makefile.am | 8 ++------ 2 files changed, 4 insertions(+), 12 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index b5b62ed5df..5168e7980f 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -189,15 +189,11 @@ endif() set( CRYPTO_SRC ${CRYPTO_SRC} - cpt_err.c - cryptlib.c + crypto_err.c crypto_ex_data.c crypto_init.c - cversion.c + crypto_legacy.c malloc-wrapper.c - mem_clr.c - mem_dbg.c - o_fips.c aes/aes.c aes/aes_core.c aes/aes_ige.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index b4e8bd8986..2f61f7df72 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -209,20 +209,16 @@ if HOST_I386 libcrypto_la_SOURCES += arch/i386/crypto_cpu_caps.c endif -libcrypto_la_SOURCES += cpt_err.c -libcrypto_la_SOURCES += cryptlib.c +libcrypto_la_SOURCES += crypto_err.c libcrypto_la_SOURCES += crypto_ex_data.c libcrypto_la_SOURCES += crypto_init.c +libcrypto_la_SOURCES += crypto_legacy.c if !HOST_WIN libcrypto_la_SOURCES += crypto_lock.c else libcrypto_la_SOURCES += compat/crypto_lock_win.c endif -libcrypto_la_SOURCES += cversion.c libcrypto_la_SOURCES += malloc-wrapper.c -libcrypto_la_SOURCES += mem_clr.c -libcrypto_la_SOURCES += mem_dbg.c -libcrypto_la_SOURCES += o_fips.c noinst_HEADERS += arm_arch.h noinst_HEADERS += constant_time.h noinst_HEADERS += crypto_internal.h From 3ade76d86b1bcea9d53307511597d2a17b43239b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 5 Nov 2024 21:15:42 -0700 Subject: [PATCH 0891/1283] malloc-wrapper -> crypto_memory --- crypto/CMakeLists.txt | 2 +- crypto/Makefile.am | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 5168e7980f..a2b06d3cb2 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -193,7 +193,7 @@ set( crypto_ex_data.c crypto_init.c crypto_legacy.c - malloc-wrapper.c + crypto_memory.c aes/aes.c aes/aes_core.c aes/aes_ige.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 2f61f7df72..f601ec9dc1 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -218,7 +218,7 @@ libcrypto_la_SOURCES += crypto_lock.c else libcrypto_la_SOURCES += compat/crypto_lock_win.c endif -libcrypto_la_SOURCES += malloc-wrapper.c +libcrypto_la_SOURCES += crypto_memory.c noinst_HEADERS += arm_arch.h noinst_HEADERS += constant_time.h noinst_HEADERS += crypto_internal.h From 52b1623c6b4fee563f01ce91d76e2df23ed090c1 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 8 Nov 2024 09:22:29 -0700 Subject: [PATCH 0892/1283] Hook up new aarch64 feature detection --- crypto/CMakeLists.txt | 4 +- crypto/Makefile.am | 3 ++ patches/patch-aarch64-crypto-cpu-caps.c.patch | 39 +++++++++++++++++++ 3 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 patches/patch-aarch64-crypto-cpu-caps.c.patch diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index a2b06d3cb2..cf850367d0 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -180,7 +180,9 @@ if(HOST_ASM_MINGW64_X86_64) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MINGW64_SRC}) endif() -if(HOST_X86_64) +if(HOST_AARCH64) + set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps.c) +elseif(HOST_X86_64) set(CRYPTO_SRC ${CRYPTO_SRC} arch/amd64/crypto_cpu_caps.c) elseif(HOST_I386) set(CRYPTO_SRC ${CRYPTO_SRC} arch/i386/crypto_cpu_caps.c) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index f601ec9dc1..9df0a2e9c4 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -202,6 +202,9 @@ endif endif endif +if HOST_AARCH64 +libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps.c +endif if HOST_X86_64 libcrypto_la_SOURCES += arch/amd64/crypto_cpu_caps.c endif diff --git a/patches/patch-aarch64-crypto-cpu-caps.c.patch b/patches/patch-aarch64-crypto-cpu-caps.c.patch new file mode 100644 index 0000000000..2a1006e196 --- /dev/null +++ b/patches/patch-aarch64-crypto-cpu-caps.c.patch @@ -0,0 +1,39 @@ +Disable feature detection until we find a more portable way. + +--- crypto/arch/aarch64/crypto_cpu_caps.c Fri Nov 8 09:23:31 2024 +--- crypto/arch/aarch64/crypto_cpu_caps.c Fri Nov 8 09:02:47 2024 +@@ -16,9 +16,12 @@ + */ + + #include ++ ++#if defined(__OpenBSD__) + #include + + #include ++#endif + + #include + #include +@@ -66,6 +69,7 @@ + return caps; + } + ++#if defined(__OpenBSD__) + static int + read_isar0(uint64_t *isar0) + { +@@ -83,6 +87,13 @@ + + return 1; + } ++#else ++static int ++read_isar0(uint64_t *isar0) ++{ ++ return 0; ++} ++#endif + + void + crypto_cpu_caps_init(void) From 19eef52c711d6ae2d600177bec25d659e371a703 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 8 Nov 2024 09:23:07 -0700 Subject: [PATCH 0893/1283] Disable sha256 assembly --- crypto/CMakeLists.txt | 8 -------- crypto/Makefile.am.elf-x86_64 | 2 -- crypto/Makefile.am.macosx-x86_64 | 2 -- crypto/Makefile.am.masm-x86_64 | 2 -- crypto/Makefile.am.mingw64-x86_64 | 2 -- update.sh | 1 - 6 files changed, 17 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index cf850367d0..86421d0a3d 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -36,7 +36,6 @@ if(HOST_ASM_ELF_X86_64) modes/ghash-elf-x86_64.S rc4/rc4-elf-x86_64.S sha/sha1-elf-x86_64.S - sha/sha256-elf-x86_64.S sha/sha512-elf-x86_64.S bn/arch/amd64/bignum_add.S @@ -62,7 +61,6 @@ if(HOST_ASM_ELF_X86_64) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) add_definitions(-DSHA1_ASM) - add_definitions(-DSHA256_ASM) add_definitions(-DSHA512_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_ELF_SRC}) endif() @@ -81,7 +79,6 @@ if(HOST_ASM_MACOSX_X86_64) modes/ghash-macosx-x86_64.S rc4/rc4-macosx-x86_64.S sha/sha1-macosx-x86_64.S - sha/sha256-macosx-x86_64.S sha/sha512-macosx-x86_64.S bn/arch/amd64/bignum_add.S @@ -107,7 +104,6 @@ if(HOST_ASM_MACOSX_X86_64) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) add_definitions(-DSHA1_ASM) - add_definitions(-DSHA256_ASM) add_definitions(-DSHA512_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MACOSX_SRC}) set_property(SOURCE ${ASM_X86_64_MACOSX_SRC} PROPERTY XCODE_EXPLICIT_FILE_TYPE "sourcecode.asm") @@ -127,7 +123,6 @@ if(HOST_ASM_MASM_X86_64) modes/ghash-masm-x86_64.S rc4/rc4-masm-x86_64.S sha/sha1-masm-x86_64.S - sha/sha256-masm-x86_64.S sha/sha512-masm-x86_64.S ) add_definitions(-Dendbr64=) @@ -141,7 +136,6 @@ if(HOST_ASM_MASM_X86_64) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) add_definitions(-DSHA1_ASM) - add_definitions(-DSHA256_ASM) add_definitions(-DSHA512_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MASM_SRC}) set_property(SOURCE ${ASM_X86_64_MASM_SRC} PROPERTY LANGUAGE ASM_MASM) @@ -161,7 +155,6 @@ if(HOST_ASM_MINGW64_X86_64) modes/ghash-mingw64-x86_64.S rc4/rc4-mingw64-x86_64.S sha/sha1-mingw64-x86_64.S - sha/sha256-mingw64-x86_64.S sha/sha512-mingw64-x86_64.S ) add_definitions(-Dendbr32=endbr64) @@ -175,7 +168,6 @@ if(HOST_ASM_MINGW64_X86_64) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) add_definitions(-DSHA1_ASM) - add_definitions(-DSHA256_ASM) add_definitions(-DSHA512_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MINGW64_SRC}) endif() diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index 739fd3feee..bb50016525 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -10,7 +10,6 @@ ASM_X86_64_ELF += md5/md5-elf-x86_64.S ASM_X86_64_ELF += modes/ghash-elf-x86_64.S ASM_X86_64_ELF += rc4/rc4-elf-x86_64.S ASM_X86_64_ELF += sha/sha1-elf-x86_64.S -ASM_X86_64_ELF += sha/sha256-elf-x86_64.S ASM_X86_64_ELF += sha/sha512-elf-x86_64.S ASM_X86_64_ELF += bn/arch/amd64/bignum_add.S @@ -39,7 +38,6 @@ libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM libcrypto_la_CPPFLAGS += -DSHA1_ASM -libcrypto_la_CPPFLAGS += -DSHA256_ASM libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_SOURCES += $(ASM_X86_64_ELF) endif diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index 1095bcadac..3682a2fe99 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -10,7 +10,6 @@ ASM_X86_64_MACOSX += md5/md5-macosx-x86_64.S ASM_X86_64_MACOSX += modes/ghash-macosx-x86_64.S ASM_X86_64_MACOSX += rc4/rc4-macosx-x86_64.S ASM_X86_64_MACOSX += sha/sha1-macosx-x86_64.S -ASM_X86_64_MACOSX += sha/sha256-macosx-x86_64.S ASM_X86_64_MACOSX += sha/sha512-macosx-x86_64.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_add.S @@ -39,7 +38,6 @@ libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM libcrypto_la_CPPFLAGS += -DSHA1_ASM -libcrypto_la_CPPFLAGS += -DSHA256_ASM libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_SOURCES += $(ASM_X86_64_MACOSX) endif diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index fefe2bd388..f7e21e1c2a 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -10,7 +10,6 @@ ASM_X86_64_MASM += md5/md5-masm-x86_64.S ASM_X86_64_MASM += modes/ghash-masm-x86_64.S ASM_X86_64_MASM += rc4/rc4-masm-x86_64.S ASM_X86_64_MASM += sha/sha1-masm-x86_64.S -ASM_X86_64_MASM += sha/sha256-masm-x86_64.S ASM_X86_64_MASM += sha/sha512-masm-x86_64.S EXTRA_DIST += $(ASM_X86_64_MASM) @@ -26,7 +25,6 @@ libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM libcrypto_la_CPPFLAGS += -DSHA1_ASM -libcrypto_la_CPPFLAGS += -DSHA256_ASM libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_SOURCES += $(ASM_X86_64_MASM) endif diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index 1470d4aebc..61b5660463 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -10,7 +10,6 @@ ASM_X86_64_MINGW64 += md5/md5-mingw64-x86_64.S ASM_X86_64_MINGW64 += modes/ghash-mingw64-x86_64.S ASM_X86_64_MINGW64 += rc4/rc4-mingw64-x86_64.S ASM_X86_64_MINGW64 += sha/sha1-mingw64-x86_64.S -ASM_X86_64_MINGW64 += sha/sha256-mingw64-x86_64.S ASM_X86_64_MINGW64 += sha/sha512-mingw64-x86_64.S EXTRA_DIST += $(ASM_X86_64_MINGW64) @@ -27,7 +26,6 @@ libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM libcrypto_la_CPPFLAGS += -DSHA1_ASM -libcrypto_la_CPPFLAGS += -DSHA256_ASM libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_SOURCES += $(ASM_X86_64_MINGW64) endif diff --git a/update.sh b/update.sh index 8fdae9de8a..896c1e7156 100755 --- a/update.sh +++ b/update.sh @@ -284,7 +284,6 @@ for abi in elf macosx masm mingw64; do gen_asm_stdout $abi modes/asm/ghash-x86_64.pl modes/ghash-$abi-x86_64.S gen_asm_stdout $abi rc4/asm/rc4-x86_64.pl rc4/rc4-$abi-x86_64.S gen_asm_stdout $abi sha/asm/sha1-x86_64.pl sha/sha1-$abi-x86_64.S - gen_asm $abi sha/asm/sha512-x86_64.pl sha/sha256-$abi-x86_64.S gen_asm $abi sha/asm/sha512-x86_64.pl sha/sha512-$abi-x86_64.S done From 6719dbb2e0ed69ff1cba8797c66be6b74819ca98 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 8 Nov 2024 10:06:01 -0700 Subject: [PATCH 0894/1283] Teach windows some more about __attribute__ --- patches/opensslfeatures.h.patch | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/patches/opensslfeatures.h.patch b/patches/opensslfeatures.h.patch index 618de7374c..591ecf324e 100644 --- a/patches/opensslfeatures.h.patch +++ b/patches/opensslfeatures.h.patch @@ -14,3 +14,14 @@ #define OPENSSL_THREADS #define OPENSSL_NO_BUF_FREELISTS +--- tests/crypto_test.c.orig Fri Nov 8 10:03:18 2024 ++++ tests/crypto_test.c Fri Nov 8 10:03:47 2024 +@@ -19,6 +19,8 @@ + #include + #include + ++#include ++ + #include "crypto_internal.h" + + static int From 597c1da5efbca133753730651bd5136661acdfc3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 9 Nov 2024 11:52:12 -0700 Subject: [PATCH 0895/1283] Update ChangeLog --- ChangeLog | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 1a64821a49..1c011681f2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -38,8 +38,10 @@ LibreSSL Portable Release Notes: - Many bug fixes and simplifications in the EC ASN.1 code. - Corrected DER encoding for EC keys and parameters. - Polished EC_POINT_{oct2point,point2oct}() internals. - - Reworked CPU capabilities detection. + - Reworked CPU capabilities detection for amd64 and aarch64. - Improved the code setting compressed coordinates for EC points. + - Added new SHA-256 assembly implementation for amd64. + - Rewrote BN_bn2binpad() and its lebin siblings. * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). From a59cc93264b67ebc786cf3985c55b640a7ab7fa4 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 12 Nov 2024 04:30:50 -0700 Subject: [PATCH 0896/1283] ecp_{smpl,mont}.c -> ecp_methods.c --- crypto/CMakeLists.txt | 3 +-- crypto/Makefile.am | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 86421d0a3d..acb5a71bd1 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -372,8 +372,7 @@ set( ec/ec_mult.c ec/ec_pmeth.c ec/eck_prn.c - ec/ecp_mont.c - ec/ecp_smpl.c + ec/ecp_methods.c ec/ecx_methods.c ecdh/ecdh.c ecdsa/ecdsa.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 9df0a2e9c4..7da1e1aac7 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -551,8 +551,7 @@ libcrypto_la_SOURCES += ec/ec_lib.c libcrypto_la_SOURCES += ec/ec_mult.c libcrypto_la_SOURCES += ec/ec_pmeth.c libcrypto_la_SOURCES += ec/eck_prn.c -libcrypto_la_SOURCES += ec/ecp_mont.c -libcrypto_la_SOURCES += ec/ecp_smpl.c +libcrypto_la_SOURCES += ec/ecp_methods.c libcrypto_la_SOURCES += ec/ecx_methods.c noinst_HEADERS += ec/ec_local.h From 1996dbc07d129cf2b1d32be384a131b9e6fa5373 Mon Sep 17 00:00:00 2001 From: Don Olmstead Date: Wed, 13 Nov 2024 12:05:09 -0800 Subject: [PATCH 0897/1283] Disable additional MSVC warnings Append additional MSVC warnings to `MSVC_DISABLED_WARNINGS_LIST`. Disable warnings for specific files using `COMPILE_OPTIONS`. --- CMakeLists.txt | 6 +++++- crypto/CMakeLists.txt | 12 +++++++++++- ssl/CMakeLists.txt | 8 +++++++- 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 0173bf854a..ebd8260af5 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -162,17 +162,21 @@ if(MSVC) set(MSVC_DISABLED_WARNINGS_LIST "C4018" # 'expression' : signed/unsigned mismatch "C4057" # 'operator' : 'identifier1' indirection to - # slightly different base types from 'identifier2' + # slightly different base types from 'identifier2' "C4100" # 'identifier' : unreferenced formal parameter "C4127" # conditional expression is constant + "C4132" # 'object' : const object should be initialized "C4146" # unary minus operator applied to unsigned type, # result still unsigned + "C4206" # nonstandard extension used : translation unit is empty "C4244" # 'argument' : conversion from 'type1' to 'type2', # possible loss of data "C4245" # 'conversion' : conversion from 'type1' to 'type2', # signed/unsigned mismatch "C4267" # 'var' : conversion from 'size_t' to 'type', # possible loss of data + "C4295" # 'array' : array is too small to include a terminating + # null character "C4389" # 'operator' : signed/unsigned mismatch "C4706" # assignment within conditional expression "C4996" # The POSIX name for this item is deprecated. diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index acb5a71bd1..6c26528fcb 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -814,6 +814,17 @@ elseif(HOST_X86_64) target_include_directories(crypto_obj PRIVATE bn/arch/amd64) endif() +if(MSVC) + # "C4701" - Potentially uninitialized local variable 'name' used + set_source_files_properties(bn/bn_convert.c pem/pem_lib.c PROPERTIES + COMPILE_OPTIONS /wd4701 + ) + # "C4702" - unreachable code + set_source_files_properties(pkcs7/pk7_doit.c PROPERTIES + COMPILE_OPTIONS /wd4702 + ) +endif() + add_library(crypto $ $ empty.c) export_symbol(crypto ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym) @@ -867,4 +878,3 @@ if(BUILD_SHARED_LIBS) add_library(crypto-static STATIC $) target_link_libraries(crypto-static ${PLATFORM_LIBS}) endif() - diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index cf62ff4f43..bdcfbb22cf 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -72,6 +72,13 @@ target_include_directories(ssl_obj ../include ${CMAKE_BINARY_DIR}/include) +if(MSVC) + # "C4702" - unreachable code + set_source_files_properties(d1_pkt.c s3_cbc.c PROPERTIES + COMPILE_OPTIONS /wd4702 + ) +endif() + add_library(bs_obj OBJECT ${BS_SRC}) target_include_directories(bs_obj PRIVATE @@ -157,4 +164,3 @@ if(BUILD_SHARED_LIBS) add_library(ssl-static STATIC $) target_link_libraries(ssl-static crypto-static ${PLATFORM_LIBS}) endif() - From 17395e688213294221d7e98940dd5afe2a0470fd Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 16 Nov 2024 03:39:30 -0700 Subject: [PATCH 0898/1283] The stuff in ec_kmeth was relocated --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 6c26528fcb..31a0d6261c 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -367,7 +367,6 @@ set( ec/ec_curve.c ec/ec_err.c ec/ec_key.c - ec/ec_kmeth.c ec/ec_lib.c ec/ec_mult.c ec/ec_pmeth.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 7da1e1aac7..0d86eed957 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -546,7 +546,6 @@ libcrypto_la_SOURCES += ec/ec_convert.c libcrypto_la_SOURCES += ec/ec_curve.c libcrypto_la_SOURCES += ec/ec_err.c libcrypto_la_SOURCES += ec/ec_key.c -libcrypto_la_SOURCES += ec/ec_kmeth.c libcrypto_la_SOURCES += ec/ec_lib.c libcrypto_la_SOURCES += ec/ec_mult.c libcrypto_la_SOURCES += ec/ec_pmeth.c From c94f43184cdbbd6fee53e1603356cc218f8ff663 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 16 Nov 2024 04:37:00 -0700 Subject: [PATCH 0899/1283] update man links --- man/links | 1 - 1 file changed, 1 deletion(-) diff --git a/man/links b/man/links index 5cbcef8d37..617bb0744a 100644 --- a/man/links +++ b/man/links @@ -1054,7 +1054,6 @@ EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_verifyctx.3 EVP_PKEY_new.3,EVP_PKEY_free.3 EVP_PKEY_new.3,EVP_PKEY_get_raw_private_key.3 EVP_PKEY_new.3,EVP_PKEY_get_raw_public_key.3 -EVP_PKEY_new.3,EVP_PKEY_new_CMAC_key.3 EVP_PKEY_new.3,EVP_PKEY_new_mac_key.3 EVP_PKEY_new.3,EVP_PKEY_new_raw_private_key.3 EVP_PKEY_new.3,EVP_PKEY_new_raw_public_key.3 From 8de367893bf8198d0959d4fabed9847b90209ae0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 16 Nov 2024 08:20:29 -0700 Subject: [PATCH 0900/1283] Disable sha512 perlasm --- crypto/CMakeLists.txt | 8 -------- crypto/Makefile.am.elf-x86_64 | 2 -- crypto/Makefile.am.macosx-x86_64 | 2 -- crypto/Makefile.am.masm-x86_64 | 2 -- crypto/Makefile.am.mingw64-x86_64 | 2 -- update.sh | 1 - 6 files changed, 17 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 31a0d6261c..b2817162d8 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -36,7 +36,6 @@ if(HOST_ASM_ELF_X86_64) modes/ghash-elf-x86_64.S rc4/rc4-elf-x86_64.S sha/sha1-elf-x86_64.S - sha/sha512-elf-x86_64.S bn/arch/amd64/bignum_add.S bn/arch/amd64/bignum_cmadd.S @@ -61,7 +60,6 @@ if(HOST_ASM_ELF_X86_64) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) add_definitions(-DSHA1_ASM) - add_definitions(-DSHA512_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_ELF_SRC}) endif() @@ -79,7 +77,6 @@ if(HOST_ASM_MACOSX_X86_64) modes/ghash-macosx-x86_64.S rc4/rc4-macosx-x86_64.S sha/sha1-macosx-x86_64.S - sha/sha512-macosx-x86_64.S bn/arch/amd64/bignum_add.S bn/arch/amd64/bignum_cmadd.S @@ -104,7 +101,6 @@ if(HOST_ASM_MACOSX_X86_64) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) add_definitions(-DSHA1_ASM) - add_definitions(-DSHA512_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MACOSX_SRC}) set_property(SOURCE ${ASM_X86_64_MACOSX_SRC} PROPERTY XCODE_EXPLICIT_FILE_TYPE "sourcecode.asm") endif() @@ -123,7 +119,6 @@ if(HOST_ASM_MASM_X86_64) modes/ghash-masm-x86_64.S rc4/rc4-masm-x86_64.S sha/sha1-masm-x86_64.S - sha/sha512-masm-x86_64.S ) add_definitions(-Dendbr64=) add_definitions(-DAES_ASM) @@ -136,7 +131,6 @@ if(HOST_ASM_MASM_X86_64) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) add_definitions(-DSHA1_ASM) - add_definitions(-DSHA512_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MASM_SRC}) set_property(SOURCE ${ASM_X86_64_MASM_SRC} PROPERTY LANGUAGE ASM_MASM) endif() @@ -155,7 +149,6 @@ if(HOST_ASM_MINGW64_X86_64) modes/ghash-mingw64-x86_64.S rc4/rc4-mingw64-x86_64.S sha/sha1-mingw64-x86_64.S - sha/sha512-mingw64-x86_64.S ) add_definitions(-Dendbr32=endbr64) add_definitions(-DAES_ASM) @@ -168,7 +161,6 @@ if(HOST_ASM_MINGW64_X86_64) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) add_definitions(-DSHA1_ASM) - add_definitions(-DSHA512_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MINGW64_SRC}) endif() diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index bb50016525..a89a55bd2d 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -10,7 +10,6 @@ ASM_X86_64_ELF += md5/md5-elf-x86_64.S ASM_X86_64_ELF += modes/ghash-elf-x86_64.S ASM_X86_64_ELF += rc4/rc4-elf-x86_64.S ASM_X86_64_ELF += sha/sha1-elf-x86_64.S -ASM_X86_64_ELF += sha/sha512-elf-x86_64.S ASM_X86_64_ELF += bn/arch/amd64/bignum_add.S ASM_X86_64_ELF += bn/arch/amd64/bignum_cmadd.S @@ -38,6 +37,5 @@ libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM libcrypto_la_CPPFLAGS += -DSHA1_ASM -libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_SOURCES += $(ASM_X86_64_ELF) endif diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index 3682a2fe99..4050b4733b 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -10,7 +10,6 @@ ASM_X86_64_MACOSX += md5/md5-macosx-x86_64.S ASM_X86_64_MACOSX += modes/ghash-macosx-x86_64.S ASM_X86_64_MACOSX += rc4/rc4-macosx-x86_64.S ASM_X86_64_MACOSX += sha/sha1-macosx-x86_64.S -ASM_X86_64_MACOSX += sha/sha512-macosx-x86_64.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_add.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_cmadd.S @@ -38,6 +37,5 @@ libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM libcrypto_la_CPPFLAGS += -DSHA1_ASM -libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_SOURCES += $(ASM_X86_64_MACOSX) endif diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index f7e21e1c2a..c4b35b2488 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -10,7 +10,6 @@ ASM_X86_64_MASM += md5/md5-masm-x86_64.S ASM_X86_64_MASM += modes/ghash-masm-x86_64.S ASM_X86_64_MASM += rc4/rc4-masm-x86_64.S ASM_X86_64_MASM += sha/sha1-masm-x86_64.S -ASM_X86_64_MASM += sha/sha512-masm-x86_64.S EXTRA_DIST += $(ASM_X86_64_MASM) @@ -25,6 +24,5 @@ libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM libcrypto_la_CPPFLAGS += -DSHA1_ASM -libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_SOURCES += $(ASM_X86_64_MASM) endif diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index 61b5660463..744d7c0119 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -10,7 +10,6 @@ ASM_X86_64_MINGW64 += md5/md5-mingw64-x86_64.S ASM_X86_64_MINGW64 += modes/ghash-mingw64-x86_64.S ASM_X86_64_MINGW64 += rc4/rc4-mingw64-x86_64.S ASM_X86_64_MINGW64 += sha/sha1-mingw64-x86_64.S -ASM_X86_64_MINGW64 += sha/sha512-mingw64-x86_64.S EXTRA_DIST += $(ASM_X86_64_MINGW64) @@ -26,6 +25,5 @@ libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM libcrypto_la_CPPFLAGS += -DSHA1_ASM -libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_SOURCES += $(ASM_X86_64_MINGW64) endif diff --git a/update.sh b/update.sh index 896c1e7156..e1d9e86113 100755 --- a/update.sh +++ b/update.sh @@ -284,7 +284,6 @@ for abi in elf macosx masm mingw64; do gen_asm_stdout $abi modes/asm/ghash-x86_64.pl modes/ghash-$abi-x86_64.S gen_asm_stdout $abi rc4/asm/rc4-x86_64.pl rc4/rc4-$abi-x86_64.S gen_asm_stdout $abi sha/asm/sha1-x86_64.pl sha/sha1-$abi-x86_64.S - gen_asm $abi sha/asm/sha512-x86_64.pl sha/sha512-$abi-x86_64.S done # copy libtls source From c25fc02d9858328d173b58fd9a04cb01fda1df38 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 22 Nov 2024 10:01:27 -0700 Subject: [PATCH 0901/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 1c011681f2..1847b24ad8 100644 --- a/ChangeLog +++ b/ChangeLog @@ -38,6 +38,7 @@ LibreSSL Portable Release Notes: - Many bug fixes and simplifications in the EC ASN.1 code. - Corrected DER encoding for EC keys and parameters. - Polished EC_POINT_{oct2point,point2oct}() internals. + - Rewrote the wNAF code for fast ECDSA verification. - Reworked CPU capabilities detection for amd64 and aarch64. - Improved the code setting compressed coordinates for EC points. - Added new SHA-256 assembly implementation for amd64. From 0d1912afd5c50633c2248e6302018b08cdb52422 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 23 Nov 2024 13:16:24 -0700 Subject: [PATCH 0902/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 1847b24ad8..f32316324b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -50,6 +50,8 @@ LibreSSL Portable Release Notes: built-in curve. * Bug fixes - Plugged a leak in eckey_compute_pubkey(). + * Testing and proactive security + - Improved regress coverage of the EC code. 4.0.0 - Stable release From d58e3559c224e9ca94d337a1ff465ea190691f69 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 23 Nov 2024 13:32:04 -0700 Subject: [PATCH 0903/1283] Attempt to fix windows --- include/compat/endian.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/include/compat/endian.h b/include/compat/endian.h index 5376c1a17e..2e4c8f74ae 100644 --- a/include/compat/endian.h +++ b/include/compat/endian.h @@ -101,6 +101,8 @@ #endif #define htobe64(x) ntohll((x)) +#define htole64(x) (x) +#define le64toh(x) (x) #endif /* _WIN32 && !HAVE_ENDIAN_H */ #ifdef __linux__ @@ -151,6 +153,8 @@ #define htole32(x) LE_32(x) #define htobe32(x) BE_32(x) #define be64toh(x) BE_64(x) +#define le64toh(x) LE_64(x) +#define htole64(x) LE_64(x) #define htobe64(x) BE_64(x) #endif From a6d8cddefe8949a71bae391f9ec31f56f3df7841 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 24 Nov 2024 09:18:24 -0700 Subject: [PATCH 0904/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index f32316324b..09103a29fa 100644 --- a/ChangeLog +++ b/ChangeLog @@ -48,6 +48,9 @@ LibreSSL Portable Release Notes: It has no effect since LibreSSL doesn't call atexit(). - Elliptic curve parameters are only accepted if they encode a built-in curve. + - All elliptic curves over fields with less than 224 bits and a + few more were removed from the built-in curves. This includes + all WTLS curves and P-192. * Bug fixes - Plugged a leak in eckey_compute_pubkey(). * Testing and proactive security From b06265cf55d748d20d01c0eb27eba2ebbc4deb1f Mon Sep 17 00:00:00 2001 From: Cole Blakley Date: Fri, 29 Nov 2024 17:33:33 -0700 Subject: [PATCH 0905/1283] Added CMake hint when searching for LibreSSL directory on macOS --- FindLibreSSL.cmake | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/FindLibreSSL.cmake b/FindLibreSSL.cmake index 6bdc069d36..67793710df 100644 --- a/FindLibreSSL.cmake +++ b/FindLibreSSL.cmake @@ -81,6 +81,11 @@ if (WIN32) "${_programfiles}/LibreSSL" ) unset(_programfiles) +elseif(APPLE) + # Homebrew installs LibreSSL here + set(_LIBRESSL_ROOT_PATHS + "/usr/local/opt/libressl" + ) else() set(_LIBRESSL_ROOT_PATHS "/usr/local/" From 694d8698545178cc26701ebfe1c113e2db237ab5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 4 Dec 2024 20:06:10 -0700 Subject: [PATCH 0906/1283] Disable sha1 assembly on amd64 --- crypto/CMakeLists.txt | 8 -------- crypto/Makefile.am.elf-x86_64 | 2 -- crypto/Makefile.am.macosx-x86_64 | 2 -- crypto/Makefile.am.masm-x86_64 | 2 -- crypto/Makefile.am.mingw64-x86_64 | 2 -- update.sh | 1 - 6 files changed, 17 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index b2817162d8..f9ac149701 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -35,7 +35,6 @@ if(HOST_ASM_ELF_X86_64) md5/md5-elf-x86_64.S modes/ghash-elf-x86_64.S rc4/rc4-elf-x86_64.S - sha/sha1-elf-x86_64.S bn/arch/amd64/bignum_add.S bn/arch/amd64/bignum_cmadd.S @@ -59,7 +58,6 @@ if(HOST_ASM_ELF_X86_64) add_definitions(-DMD5_ASM) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) - add_definitions(-DSHA1_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_ELF_SRC}) endif() @@ -76,7 +74,6 @@ if(HOST_ASM_MACOSX_X86_64) md5/md5-macosx-x86_64.S modes/ghash-macosx-x86_64.S rc4/rc4-macosx-x86_64.S - sha/sha1-macosx-x86_64.S bn/arch/amd64/bignum_add.S bn/arch/amd64/bignum_cmadd.S @@ -100,7 +97,6 @@ if(HOST_ASM_MACOSX_X86_64) add_definitions(-DMD5_ASM) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) - add_definitions(-DSHA1_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MACOSX_SRC}) set_property(SOURCE ${ASM_X86_64_MACOSX_SRC} PROPERTY XCODE_EXPLICIT_FILE_TYPE "sourcecode.asm") endif() @@ -118,7 +114,6 @@ if(HOST_ASM_MASM_X86_64) md5/md5-masm-x86_64.S modes/ghash-masm-x86_64.S rc4/rc4-masm-x86_64.S - sha/sha1-masm-x86_64.S ) add_definitions(-Dendbr64=) add_definitions(-DAES_ASM) @@ -130,7 +125,6 @@ if(HOST_ASM_MASM_X86_64) add_definitions(-DMD5_ASM) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) - add_definitions(-DSHA1_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MASM_SRC}) set_property(SOURCE ${ASM_X86_64_MASM_SRC} PROPERTY LANGUAGE ASM_MASM) endif() @@ -148,7 +142,6 @@ if(HOST_ASM_MINGW64_X86_64) md5/md5-mingw64-x86_64.S modes/ghash-mingw64-x86_64.S rc4/rc4-mingw64-x86_64.S - sha/sha1-mingw64-x86_64.S ) add_definitions(-Dendbr32=endbr64) add_definitions(-DAES_ASM) @@ -160,7 +153,6 @@ if(HOST_ASM_MINGW64_X86_64) add_definitions(-DMD5_ASM) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) - add_definitions(-DSHA1_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MINGW64_SRC}) endif() diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index a89a55bd2d..6feeb91f2c 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -9,7 +9,6 @@ ASM_X86_64_ELF += bn/mont5-elf-x86_64.S ASM_X86_64_ELF += md5/md5-elf-x86_64.S ASM_X86_64_ELF += modes/ghash-elf-x86_64.S ASM_X86_64_ELF += rc4/rc4-elf-x86_64.S -ASM_X86_64_ELF += sha/sha1-elf-x86_64.S ASM_X86_64_ELF += bn/arch/amd64/bignum_add.S ASM_X86_64_ELF += bn/arch/amd64/bignum_cmadd.S @@ -36,6 +35,5 @@ libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM -libcrypto_la_CPPFLAGS += -DSHA1_ASM libcrypto_la_SOURCES += $(ASM_X86_64_ELF) endif diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index 4050b4733b..d9df49a986 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -9,7 +9,6 @@ ASM_X86_64_MACOSX += bn/mont5-macosx-x86_64.S ASM_X86_64_MACOSX += md5/md5-macosx-x86_64.S ASM_X86_64_MACOSX += modes/ghash-macosx-x86_64.S ASM_X86_64_MACOSX += rc4/rc4-macosx-x86_64.S -ASM_X86_64_MACOSX += sha/sha1-macosx-x86_64.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_add.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_cmadd.S @@ -36,6 +35,5 @@ libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM -libcrypto_la_CPPFLAGS += -DSHA1_ASM libcrypto_la_SOURCES += $(ASM_X86_64_MACOSX) endif diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index c4b35b2488..90641a7294 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -9,7 +9,6 @@ ASM_X86_64_MASM += bn/mont5-masm-x86_64.S ASM_X86_64_MASM += md5/md5-masm-x86_64.S ASM_X86_64_MASM += modes/ghash-masm-x86_64.S ASM_X86_64_MASM += rc4/rc4-masm-x86_64.S -ASM_X86_64_MASM += sha/sha1-masm-x86_64.S EXTRA_DIST += $(ASM_X86_64_MASM) @@ -23,6 +22,5 @@ libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM -libcrypto_la_CPPFLAGS += -DSHA1_ASM libcrypto_la_SOURCES += $(ASM_X86_64_MASM) endif diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index 744d7c0119..ec40b9e4b1 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -9,7 +9,6 @@ ASM_X86_64_MINGW64 += aes/aesni-mingw64-x86_64.S ASM_X86_64_MINGW64 += md5/md5-mingw64-x86_64.S ASM_X86_64_MINGW64 += modes/ghash-mingw64-x86_64.S ASM_X86_64_MINGW64 += rc4/rc4-mingw64-x86_64.S -ASM_X86_64_MINGW64 += sha/sha1-mingw64-x86_64.S EXTRA_DIST += $(ASM_X86_64_MINGW64) @@ -24,6 +23,5 @@ libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM -libcrypto_la_CPPFLAGS += -DSHA1_ASM libcrypto_la_SOURCES += $(ASM_X86_64_MINGW64) endif diff --git a/update.sh b/update.sh index e1d9e86113..729c65aefd 100755 --- a/update.sh +++ b/update.sh @@ -283,7 +283,6 @@ for abi in elf macosx masm mingw64; do gen_asm_stdout $abi md5/asm/md5-x86_64.pl md5/md5-$abi-x86_64.S gen_asm_stdout $abi modes/asm/ghash-x86_64.pl modes/ghash-$abi-x86_64.S gen_asm_stdout $abi rc4/asm/rc4-x86_64.pl rc4/rc4-$abi-x86_64.S - gen_asm_stdout $abi sha/asm/sha1-x86_64.pl sha/sha1-$abi-x86_64.S done # copy libtls source From 63798cd425cff553c6e024a1f23e90deb2416c48 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 6 Dec 2024 10:38:10 -0700 Subject: [PATCH 0907/1283] Update man links --- man/links | 38 ++------------------------------------ 1 file changed, 2 insertions(+), 36 deletions(-) diff --git a/man/links b/man/links index 617bb0744a..c94e88b4cf 100644 --- a/man/links +++ b/man/links @@ -997,19 +997,6 @@ EVP_PKEY_asn1_get_count.3,EVP_PKEY_asn1_find_str.3 EVP_PKEY_asn1_get_count.3,EVP_PKEY_asn1_get0.3 EVP_PKEY_asn1_get_count.3,EVP_PKEY_asn1_get0_info.3 EVP_PKEY_asn1_get_count.3,EVP_PKEY_get0_asn1.3 -EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_copy.3 -EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_free.3 -EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_check.3 -EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_ctrl.3 -EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_free.3 -EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_param.3 -EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_param_check.3 -EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_private.3 -EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_public.3 -EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_public_check.3 -EVP_PKEY_asn1_new.3,EVP_PKEY_asn1_set_security_bits.3 -EVP_PKEY_check.3,EVP_PKEY_param_check.3 -EVP_PKEY_check.3,EVP_PKEY_public_check.3 EVP_PKEY_cmp.3,EVP_PKEY_cmp_parameters.3 EVP_PKEY_cmp.3,EVP_PKEY_copy_parameters.3 EVP_PKEY_cmp.3,EVP_PKEY_missing_parameters.3 @@ -1020,37 +1007,16 @@ EVP_PKEY_derive.3,EVP_PKEY_derive_set_peer.3 EVP_PKEY_encrypt.3,EVP_PKEY_encrypt_init.3 EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_app_data.3 EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_cb.3 +EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_data.3 EVP_PKEY_keygen.3,EVP_PKEY_CTX_get_keygen_info.3 EVP_PKEY_keygen.3,EVP_PKEY_CTX_set0_keygen_info.3 EVP_PKEY_keygen.3,EVP_PKEY_CTX_set_app_data.3 EVP_PKEY_keygen.3,EVP_PKEY_CTX_set_cb.3 +EVP_PKEY_keygen.3,EVP_PKEY_CTX_set_data.3 EVP_PKEY_keygen.3,EVP_PKEY_gen_cb.3 EVP_PKEY_keygen.3,EVP_PKEY_keygen_init.3 EVP_PKEY_keygen.3,EVP_PKEY_paramgen.3 EVP_PKEY_keygen.3,EVP_PKEY_paramgen_init.3 -EVP_PKEY_meth_new.3,EVP_PKEY_CTX_get_data.3 -EVP_PKEY_meth_new.3,EVP_PKEY_CTX_set_data.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_add0.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_copy.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_find.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_free.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_check.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_cleanup.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_copy.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_ctrl.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_decrypt.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_derive.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_encrypt.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_init.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_keygen.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_param_check.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_paramgen.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_public_check.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_sign.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_signctx.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_verify.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_verify_recover.3 -EVP_PKEY_meth_new.3,EVP_PKEY_meth_set_verifyctx.3 EVP_PKEY_new.3,EVP_PKEY_free.3 EVP_PKEY_new.3,EVP_PKEY_get_raw_private_key.3 EVP_PKEY_new.3,EVP_PKEY_get_raw_public_key.3 From 218dc42e04f1d8b8b9c067f4ecfc729d12ebf505 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 8 Dec 2024 04:21:35 -0700 Subject: [PATCH 0908/1283] Update man links --- man/links | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/man/links b/man/links index c94e88b4cf..3c69a3d973 100644 --- a/man/links +++ b/man/links @@ -1478,6 +1478,12 @@ RAND_load_file.3,RAND_file_name.3 RAND_load_file.3,RAND_write_file.3 RAND_set_rand_method.3,RAND_SSLeay.3 RAND_set_rand_method.3,RAND_get_rand_method.3 +RC2_encrypt.3,RC2_cbc_encrypt.3 +RC2_encrypt.3,RC2_cfb64_encrypt.3 +RC2_encrypt.3,RC2_decrypt.3 +RC2_encrypt.3,RC2_ecb_encrypt.3 +RC2_encrypt.3,RC2_ofb64_encrypt.3 +RC2_encrypt.3,RC2_set_key.3 RC4.3,RC4_set_key.3 RIPEMD160.3,RIPEMD160_Final.3 RIPEMD160.3,RIPEMD160_Init.3 From 393106f71d00436423213513cbad331d25b2da08 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 10 Dec 2024 05:47:31 -0700 Subject: [PATCH 0909/1283] Update ChangeLog --- ChangeLog | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 09103a29fa..85d570c711 100644 --- a/ChangeLog +++ b/ChangeLog @@ -41,7 +41,9 @@ LibreSSL Portable Release Notes: - Rewrote the wNAF code for fast ECDSA verification. - Reworked CPU capabilities detection for amd64 and aarch64. - Improved the code setting compressed coordinates for EC points. - - Added new SHA-256 assembly implementation for amd64. + - New SHA-1, SHA-256 and SHA-512 assembly implementations for amd64. + These make use of the SHA-NI instruction if it is available and + replace the perl-generated assembly optimized for museum pieces. - Rewrote BN_bn2binpad() and its lebin siblings. * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). From 915f39dc8cd812dcc4961672506d8c3f6b841dea Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 10 Dec 2024 05:47:31 -0700 Subject: [PATCH 0910/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 85d570c711..b953b99b0e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -53,6 +53,9 @@ LibreSSL Portable Release Notes: - All elliptic curves over fields with less than 224 bits and a few more were removed from the built-in curves. This includes all WTLS curves and P-192. + * New features + - libtls has a new tls_peer_cert_common_name() API call to retrieve + the peer's common name without having to inspect the PEM. * Bug fixes - Plugged a leak in eckey_compute_pubkey(). * Testing and proactive security From 7b5be5b0e5dc238d95303d5efbae9620ad85834b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 12 Dec 2024 03:42:54 -0700 Subject: [PATCH 0911/1283] Tweak ChangeLog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index b953b99b0e..50f0fcf2de 100644 --- a/ChangeLog +++ b/ChangeLog @@ -39,8 +39,8 @@ LibreSSL Portable Release Notes: - Corrected DER encoding for EC keys and parameters. - Polished EC_POINT_{oct2point,point2oct}() internals. - Rewrote the wNAF code for fast ECDSA verification. - - Reworked CPU capabilities detection for amd64 and aarch64. - Improved the code setting compressed coordinates for EC points. + - Reworked CPU capabilities detection for amd64 and aarch64. - New SHA-1, SHA-256 and SHA-512 assembly implementations for amd64. These make use of the SHA-NI instruction if it is available and replace the perl-generated assembly optimized for museum pieces. From 08207128cece13bd849c4c2206ab0b2a8338e790 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 14 Dec 2024 13:49:05 -0700 Subject: [PATCH 0912/1283] Link mlkem to build --- crypto/CMakeLists.txt | 3 +++ crypto/Makefile.am | 6 ++++++ update.sh | 3 ++- 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index f9ac149701..7b3439df29 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -416,6 +416,8 @@ set( lhash/lhash.c md4/md4.c md5/md5.c + mlkem/mlkem768.c + mlkem/mlkem1024.c modes/cbc128.c modes/ccm128.c modes/cfb128.c @@ -753,6 +755,7 @@ target_include_directories(crypto_obj hidden hmac lhash + mlkem modes ocsp pkcs12 diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 0d86eed957..06fde297b3 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -16,6 +16,7 @@ AM_CPPFLAGS += -I$(top_srcdir)/crypto/err AM_CPPFLAGS += -I$(top_srcdir)/crypto/evp AM_CPPFLAGS += -I$(top_srcdir)/crypto/hmac AM_CPPFLAGS += -I$(top_srcdir)/crypto/lhash +AM_CPPFLAGS += -I$(top_srcdir)/crypto/mlkem AM_CPPFLAGS += -I$(top_srcdir)/crypto/modes AM_CPPFLAGS += -I$(top_srcdir)/crypto/ocsp AM_CPPFLAGS += -I$(top_srcdir)/crypto/pkcs12 @@ -697,6 +698,11 @@ libcrypto_la_SOURCES += md4/md4.c # md5 libcrypto_la_SOURCES += md5/md5.c +# mlkem +libcrypto_la_SOURCES += mlkem/mlkem768.c +libcrypto_la_SOURCES += mlkem/mlkem1024.c +noinst_HEADERS += mlkem/mlkem_internal.h + # modes libcrypto_la_SOURCES += modes/cbc128.c libcrypto_la_SOURCES += modes/ccm128.c diff --git a/update.sh b/update.sh index 729c65aefd..e1b91f805a 100755 --- a/update.sh +++ b/update.sh @@ -127,10 +127,11 @@ copy_hdrs() { copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h ossl_typ.h err/err.h crypto.h comp/comp.h x509/x509.h buffer/buffer.h + bytestring/bytestring.h objects/objects.h asn1/asn1.h asn1/posix_time.h bn/bn.h ec/ec.h ecdsa/ecdsa.h ecdh/ecdh.h rsa/rsa.h sha/sha.h x509/x509_vfy.h pkcs7/pkcs7.h pem/pem.h hkdf/hkdf.h hmac/hmac.h rand/rand.h md5/md5.h - x509/x509v3.h conf/conf.h ocsp/ocsp.h + x509/x509v3.h conf/conf.h mlkem/mlkem.h ocsp/ocsp.h aes/aes.h modes/modes.h asn1/asn1t.h bf/blowfish.h bio/bio.h cast/cast.h cmac/cmac.h cms/cms.h des/des.h dh/dh.h dsa/dsa.h engine/engine.h ui/ui.h pkcs12/pkcs12.h ts/ts.h From 74cd742cf561c2c24a0d0ad3a0e7d55779649e87 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 14 Dec 2024 13:52:30 -0700 Subject: [PATCH 0913/1283] Update speed patch --- patches/speed.c.patch | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/patches/speed.c.patch b/patches/speed.c.patch index c29ef4d12a..8c79e0b587 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -1,6 +1,6 @@ ---- apps/openssl/speed.c.orig Sat Jul 13 11:02:51 2024 -+++ apps/openssl/speed.c Sat Jul 13 10:27:25 2024 -@@ -161,7 +161,16 @@ +--- apps/openssl/speed.c.orig Sat Dec 14 13:45:20 2024 ++++ apps/openssl/speed.c Sat Dec 14 13:46:47 2024 +@@ -161,7 +161,16 @@ static void pkey_print_message(const char *str, const char *str2, long num, int bits, int sec); static void print_result(int alg, int run_no, int count, double time_used); @@ -17,7 +17,7 @@ #define ALGOR_NUM 32 #define SIZE_NUM 5 -@@ -430,8 +439,10 @@ +@@ -424,8 +433,10 @@ speed_main(int argc, char **argv) const EVP_CIPHER *evp_cipher = NULL; const EVP_MD *evp_md = NULL; int decrypt = 0; @@ -28,7 +28,7 @@ const char *errstr = NULL; if (pledge("stdio proc", NULL) == -1) { -@@ -506,6 +517,7 @@ +@@ -500,6 +511,7 @@ speed_main(int argc, char **argv) decrypt = 1; j--; /* Otherwise, -decrypt gets confused with an * algorithm. */ @@ -36,7 +36,7 @@ } else if (argc > 0 && strcmp(*argv, "-multi") == 0) { argc--; argv++; -@@ -520,6 +532,7 @@ +@@ -514,6 +526,7 @@ speed_main(int argc, char **argv) } j--; /* Otherwise, -multi gets confused with an * algorithm. */ @@ -44,7 +44,7 @@ } else if (argc > 0 && strcmp(*argv, "-unaligned") == 0) { argc--; argv++; -@@ -851,7 +864,9 @@ +@@ -837,7 +850,9 @@ speed_main(int argc, char **argv) BIO_printf(bio_err, "-evp e use EVP e.\n"); BIO_printf(bio_err, "-decrypt time decryption instead of encryption (only EVP).\n"); BIO_printf(bio_err, "-mr produce machine readable output.\n"); @@ -54,7 +54,7 @@ BIO_printf(bio_err, "-unaligned n use buffers with offset n from proper alignment.\n"); goto end; } -@@ -860,8 +875,10 @@ +@@ -846,8 +861,10 @@ speed_main(int argc, char **argv) j++; } @@ -65,7 +65,7 @@ if (j == 0) { for (i = 0; i < ALGOR_NUM; i++) { -@@ -933,11 +950,13 @@ +@@ -919,11 +936,13 @@ speed_main(int argc, char **argv) #define COND(c) (run && count<0x7fffffff) #define COUNT(d) (count) @@ -79,7 +79,7 @@ #ifndef OPENSSL_NO_MD4 if (doit[D_MD4]) { -@@ -1743,7 +1762,9 @@ +@@ -1729,7 +1748,9 @@ speed_main(int argc, char **argv) ecdh_doit[j] = 0; } } @@ -89,7 +89,7 @@ if (!mr) { fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION)); fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON)); -@@ -1899,11 +1920,15 @@ +@@ -1885,11 +1906,15 @@ pkey_print_message(const char *str, const char *str2, static void print_result(int alg, int run_no, int count, double time_used) { @@ -105,7 +105,7 @@ static char * sstrsep(char **string, const char *delim) { -@@ -2104,4 +2129,5 @@ +@@ -2090,4 +2115,5 @@ do_multi(int multi) free(fds); return 1; } From b6334af20e996432fb91313637a9d78317144e58 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 14 Dec 2024 13:53:08 -0700 Subject: [PATCH 0914/1283] Updat man links --- man/links | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/man/links b/man/links index 3c69a3d973..fb44071602 100644 --- a/man/links +++ b/man/links @@ -936,13 +936,6 @@ EVP_EncryptInit.3,EVP_idea_cfb.3 EVP_EncryptInit.3,EVP_idea_cfb64.3 EVP_EncryptInit.3,EVP_idea_ecb.3 EVP_EncryptInit.3,EVP_idea_ofb.3 -EVP_EncryptInit.3,EVP_rc2_40_cbc.3 -EVP_EncryptInit.3,EVP_rc2_64_cbc.3 -EVP_EncryptInit.3,EVP_rc2_cbc.3 -EVP_EncryptInit.3,EVP_rc2_cfb.3 -EVP_EncryptInit.3,EVP_rc2_cfb64.3 -EVP_EncryptInit.3,EVP_rc2_ecb.3 -EVP_EncryptInit.3,EVP_rc2_ofb.3 EVP_MD_CTX_ctrl.3,EVP_MD_CTX_clear_flags.3 EVP_MD_CTX_ctrl.3,EVP_MD_CTX_md_data.3 EVP_MD_CTX_ctrl.3,EVP_MD_CTX_pkey_ctx.3 @@ -1140,6 +1133,12 @@ EVP_des_cbc.3,EVP_des_ede_ecb.3 EVP_des_cbc.3,EVP_des_ede_ofb.3 EVP_des_cbc.3,EVP_des_ofb.3 EVP_des_cbc.3,EVP_desx_cbc.3 +EVP_rc2_cbc.3,EVP_rc2_40_cbc.3 +EVP_rc2_cbc.3,EVP_rc2_64_cbc.3 +EVP_rc2_cbc.3,EVP_rc2_cfb.3 +EVP_rc2_cbc.3,EVP_rc2_cfb64.3 +EVP_rc2_cbc.3,EVP_rc2_ecb.3 +EVP_rc2_cbc.3,EVP_rc2_ofb.3 EVP_rc4.3,EVP_rc4_40.3 EVP_rc4.3,EVP_rc4_hmac_md5.3 EVP_sha1.3,EVP_md4.3 @@ -2735,6 +2734,7 @@ tls_conn_version.3,tls_conn_cipher_strength.3 tls_conn_version.3,tls_conn_servername.3 tls_conn_version.3,tls_conn_session_resumed.3 tls_conn_version.3,tls_peer_cert_chain_pem.3 +tls_conn_version.3,tls_peer_cert_common_name.3 tls_conn_version.3,tls_peer_cert_contains_name.3 tls_conn_version.3,tls_peer_cert_hash.3 tls_conn_version.3,tls_peer_cert_issuer.3 From b96ad7e8ab1339aed3d329532b4040d75418f0ca Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 14 Dec 2024 13:57:38 -0700 Subject: [PATCH 0915/1283] Also install test headers --- update.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/update.sh b/update.sh index e1b91f805a..fa8375fb04 100755 --- a/update.sh +++ b/update.sh @@ -347,7 +347,7 @@ $GREP '^[A-Za-z0-9_]' < $libssl_src/Symbols.list > ssl/ssl.sym # copy libcrypto tests echo "copying tests" touch tests/empty.c -for i in `find $libcrypto_regress -name '*.c'`; do +for i in `find $libcrypto_regress -name '*.[ch]'`; do $CP "$i" tests done $CP $libcrypto_regress/evp/evptests.txt tests From af9fe76e41149af313f82d94a54a36bc79c667c3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 14 Dec 2024 13:57:45 -0700 Subject: [PATCH 0916/1283] Regen crypto-cpu-caps.c patches --- patches/patch-aarch64-crypto-cpu-caps.c.patch | 8 ++++---- patches/patch-amd64-crypto-cpu-caps.c.patch | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/patches/patch-aarch64-crypto-cpu-caps.c.patch b/patches/patch-aarch64-crypto-cpu-caps.c.patch index 2a1006e196..dcfbdc09b9 100644 --- a/patches/patch-aarch64-crypto-cpu-caps.c.patch +++ b/patches/patch-aarch64-crypto-cpu-caps.c.patch @@ -1,7 +1,7 @@ Disable feature detection until we find a more portable way. ---- crypto/arch/aarch64/crypto_cpu_caps.c Fri Nov 8 09:23:31 2024 ---- crypto/arch/aarch64/crypto_cpu_caps.c Fri Nov 8 09:02:47 2024 +--- crypto/arch/aarch64/crypto_cpu_caps.c.orig Sat Dec 14 13:45:16 2024 ++++ crypto/arch/aarch64/crypto_cpu_caps.c Sat Dec 14 13:54:06 2024 @@ -16,9 +16,12 @@ */ @@ -15,7 +15,7 @@ Disable feature detection until we find a more portable way. #include #include -@@ -66,6 +69,7 @@ +@@ -67,6 +70,7 @@ parse_isar0(uint64_t isar0) return caps; } @@ -23,7 +23,7 @@ Disable feature detection until we find a more portable way. static int read_isar0(uint64_t *isar0) { -@@ -83,6 +87,13 @@ +@@ -84,6 +88,13 @@ read_isar0(uint64_t *isar0) return 1; } diff --git a/patches/patch-amd64-crypto-cpu-caps.c.patch b/patches/patch-amd64-crypto-cpu-caps.c.patch index f7cb4c9235..5fd7524d2d 100644 --- a/patches/patch-amd64-crypto-cpu-caps.c.patch +++ b/patches/patch-amd64-crypto-cpu-caps.c.patch @@ -1,6 +1,6 @@ ---- crypto/arch/amd64/crypto_cpu_caps.c.orig Fri Oct 18 17:35:20 2024 -+++ crypto/arch/amd64/crypto_cpu_caps.c Fri Oct 18 17:39:13 2024 -@@ -33,7 +33,7 @@ cpuid(uint32_t eax, uint32_t *out_eax, uint32_t *out_e +--- crypto/arch/amd64/crypto_cpu_caps.c.orig Sat Dec 14 13:45:16 2024 ++++ crypto/arch/amd64/crypto_cpu_caps.c Sat Dec 14 13:54:06 2024 +@@ -37,7 +37,7 @@ cpuid(uint32_t eax, uint32_t *out_eax, uint32_t *out_e { uint32_t ebx = 0, ecx = 0, edx = 0; @@ -9,7 +9,7 @@ __asm__ ("cpuid": "+a"(eax), "+b"(ebx), "+c"(ecx), "+d"(edx)); #else eax = 0; -@@ -54,7 +54,7 @@ xgetbv(uint32_t ecx, uint32_t *out_eax, uint32_t *out_ +@@ -58,7 +58,7 @@ xgetbv(uint32_t ecx, uint32_t *out_eax, uint32_t *out_ { uint32_t eax = 0, edx = 0; From a27f602bd8d5e9c2a14740a5303b9c87aeb712fd Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 14 Dec 2024 14:16:42 -0700 Subject: [PATCH 0917/1283] Fix CTASSERT() once and for all --- patches/opensslfeatures.h.patch | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/patches/opensslfeatures.h.patch b/patches/opensslfeatures.h.patch index 591ecf324e..f5a1f875db 100644 --- a/patches/opensslfeatures.h.patch +++ b/patches/opensslfeatures.h.patch @@ -14,14 +14,14 @@ #define OPENSSL_THREADS #define OPENSSL_NO_BUF_FREELISTS ---- tests/crypto_test.c.orig Fri Nov 8 10:03:18 2024 -+++ tests/crypto_test.c Fri Nov 8 10:03:47 2024 -@@ -19,6 +19,8 @@ - #include - #include +--- crypto/crypto_internal.h.orig Sat Dec 14 14:15:39 2024 ++++ crypto/crypto_internal.h Sat Dec 14 14:15:52 2024 +@@ -15,6 +15,8 @@ + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ +#include + - #include "crypto_internal.h" - - static int + #include + #include + #include From a6cc8cca47ca55a78d92dfa4c7eded5b4d212d80 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sun, 15 Dec 2024 18:18:32 +0900 Subject: [PATCH 0918/1283] Hook ML-KEM related tests This patch adds ML-KEM related tests. --- .gitignore | 3 ++ tests/CMakeLists.txt | 68 ++++++++++++++++++++++++ tests/Makefile.am | 79 ++++++++++++++++++++++++++++ tests/mlkem1024_decap_tests.sh | 12 +++++ tests/mlkem1024_encap_tests.sh | 12 +++++ tests/mlkem1024_iteration_test.sh | 12 +++++ tests/mlkem1024_keygen_tests.sh | 12 +++++ tests/mlkem1024_nist_decap_tests.sh | 12 +++++ tests/mlkem1024_nist_keygen_tests.sh | 12 +++++ tests/mlkem768_decap_tests.sh | 12 +++++ tests/mlkem768_encap_tests.sh | 12 +++++ tests/mlkem768_keygen_tests.sh | 12 +++++ tests/mlkem768_nist_decap_tests.sh | 12 +++++ tests/mlkem768_nist_keygen_tests.sh | 12 +++++ update.sh | 1 + 15 files changed, 283 insertions(+) create mode 100755 tests/mlkem1024_decap_tests.sh create mode 100755 tests/mlkem1024_encap_tests.sh create mode 100755 tests/mlkem1024_iteration_test.sh create mode 100755 tests/mlkem1024_keygen_tests.sh create mode 100755 tests/mlkem1024_nist_decap_tests.sh create mode 100755 tests/mlkem1024_nist_keygen_tests.sh create mode 100755 tests/mlkem768_decap_tests.sh create mode 100755 tests/mlkem768_encap_tests.sh create mode 100755 tests/mlkem768_keygen_tests.sh create mode 100755 tests/mlkem768_nist_decap_tests.sh create mode 100755 tests/mlkem768_nist_keygen_tests.sh diff --git a/.gitignore b/.gitignore index cc132b5be4..3c823869c6 100644 --- a/.gitignore +++ b/.gitignore @@ -115,6 +115,9 @@ tests/freenull* tests/gost2814789t* tests/key_schedule* tests/lhash_test* +tests/mlkem*.c +tests/mlkem*.h +tests/mlkem*.txt tests/mont* tests/policy* tests/rfc3779* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 568d474d64..ba521ad55b 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -8,7 +8,9 @@ include_directories( ../crypto/bn ../crypto/curve25519 ../crypto/evp + ../crypto/mlkem ../crypto/modes + ../crypto/sha ../crypto/x509 ../ssl ../apps/openssl @@ -534,6 +536,72 @@ add_executable(md_test md_test.c) target_link_libraries(md_test ${OPENSSL_TEST_LIBS}) add_platform_test(md_test md_test) +# mlkem1024_decap_tests +add_executable(mlkem1024_decap_tests mlkem1024_decap_tests.c mlkem_tests_util.c) +target_link_libraries(mlkem1024_decap_tests ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(mlkem1024_decap_tests) +add_platform_test(mlkem1024_decap_tests mlkem1024_decap_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem1024_decap_tests.txt) + +# mlkem1024_encap_tests +add_executable(mlkem1024_encap_tests mlkem1024_encap_tests.c mlkem_tests_util.c) +target_link_libraries(mlkem1024_encap_tests ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(mlkem1024_encap_tests) +add_platform_test(mlkem1024_encap_tests mlkem1024_encap_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem1024_encap_tests.txt) + +# mlkem1024_keygen_tests +add_executable(mlkem1024_keygen_tests mlkem1024_keygen_tests.c mlkem_tests_util.c) +target_link_libraries(mlkem1024_keygen_tests ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(mlkem1024_keygen_tests) +add_platform_test(mlkem1024_keygen_tests mlkem1024_keygen_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem1024_keygen_tests.txt) + +# mlkem1024_nist_decap_tests +add_executable(mlkem1024_nist_decap_tests mlkem1024_nist_decap_tests.c mlkem_tests_util.c) +target_link_libraries(mlkem1024_nist_decap_tests ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(mlkem1024_nist_decap_tests) +add_platform_test(mlkem1024_nist_decap_tests mlkem1024_nist_decap_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem1024_nist_decap_tests.txt) + +# mlkem1024_nist_keygen_tests +add_executable(mlkem1024_nist_keygen_tests mlkem1024_nist_keygen_tests.c mlkem_tests_util.c) +target_link_libraries(mlkem1024_nist_keygen_tests ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(mlkem1024_nist_keygen_tests) +add_platform_test(mlkem1024_nist_keygen_tests mlkem1024_nist_keygen_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem1024_nist_keygen_tests.txt) + +# mlkem768_decap_tests +add_executable(mlkem768_decap_tests mlkem768_decap_tests.c mlkem_tests_util.c) +target_link_libraries(mlkem768_decap_tests ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(mlkem768_decap_tests) +add_platform_test(mlkem768_decap_tests mlkem768_decap_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem768_decap_tests.txt) + +# mlkem768_encap_tests +add_executable(mlkem768_encap_tests mlkem768_encap_tests.c mlkem_tests_util.c) +target_link_libraries(mlkem768_encap_tests ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(mlkem768_encap_tests) +add_platform_test(mlkem768_encap_tests mlkem768_encap_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem768_encap_tests.txt) + +# mlkem768_iteration_test +add_executable(mlkem768_iteration_test mlkem768_iteration_test.c mlkem_tests_util.c) +target_link_libraries(mlkem768_iteration_test ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(mlkem768_iteration_test) +add_platform_test(mlkem768_iteration_test mlkem768_iteration_test) + +# mlkem768_keygen_tests +add_executable(mlkem768_keygen_tests mlkem768_keygen_tests.c mlkem_tests_util.c) +target_link_libraries(mlkem768_keygen_tests ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(mlkem768_keygen_tests) +add_platform_test(mlkem768_keygen_tests mlkem768_keygen_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem768_keygen_tests.txt) + +# mlkem768_nist_decap_tests +add_executable(mlkem768_nist_decap_tests mlkem768_nist_decap_tests.c mlkem_tests_util.c) +target_link_libraries(mlkem768_nist_decap_tests ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(mlkem768_nist_decap_tests) +add_platform_test(mlkem768_nist_decap_tests mlkem768_nist_decap_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem768_nist_decap_tests.txt) + +# mlkem768_nist_keygen_tests +add_executable(mlkem768_nist_keygen_tests mlkem768_nist_keygen_tests.c mlkem_tests_util.c) +target_link_libraries(mlkem768_nist_keygen_tests ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(mlkem768_nist_keygen_tests) +add_platform_test(mlkem768_nist_keygen_tests mlkem768_nist_keygen_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem768_nist_keygen_tests.txt) + # objectstest add_executable(objectstest objectstest.c) target_link_libraries(objectstest ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 5f3b10271d..36cbb9ad14 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -12,7 +12,9 @@ AM_CPPFLAGS += -I $(top_srcdir)/crypto/bio AM_CPPFLAGS += -I $(top_srcdir)/crypto/bn AM_CPPFLAGS += -I $(top_srcdir)/crypto/curve25519 AM_CPPFLAGS += -I $(top_srcdir)/crypto/evp +AM_CPPFLAGS += -I $(top_srcdir)/crypto/mlkem AM_CPPFLAGS += -I $(top_srcdir)/crypto/modes +AM_CPPFLAGS += -I $(top_srcdir)/crypto/sha AM_CPPFLAGS += -I $(top_srcdir)/crypto/x509 AM_CPPFLAGS += -I $(top_srcdir)/ssl AM_CPPFLAGS += -I $(top_srcdir)/apps/openssl @@ -542,6 +544,83 @@ TESTS += md_test check_PROGRAMS += md_test md_test_SOURCES = md_test.c +noinst_HEADERS += mlkem_tests_util.h + +# mlkem1024_decap_tests +TESTS += mlkem1024_decap_tests.sh +check_PROGRAMS += mlkem1024_decap_tests +mlkem1024_decap_tests_SOURCES = mlkem1024_decap_tests.c mlkem_tests_util.c +EXTRA_DIST += mlkem1024_decap_tests.sh +EXTRA_DIST += mlkem1024_decap_tests.txt + +# mlkem1024_encap_tests +TESTS += mlkem1024_encap_tests.sh +check_PROGRAMS += mlkem1024_encap_tests +mlkem1024_encap_tests_SOURCES = mlkem1024_encap_tests.c mlkem_tests_util.c +EXTRA_DIST += mlkem1024_encap_tests.sh +EXTRA_DIST += mlkem1024_encap_tests.txt + +# mlkem1024_keygen_tests +TESTS += mlkem1024_keygen_tests.sh +check_PROGRAMS += mlkem1024_keygen_tests +mlkem1024_keygen_tests_SOURCES = mlkem1024_keygen_tests.c mlkem_tests_util.c +EXTRA_DIST += mlkem1024_keygen_tests.sh +EXTRA_DIST += mlkem1024_keygen_tests.txt + +# mlkem1024_nist_decap_tests +TESTS += mlkem1024_nist_decap_tests.sh +check_PROGRAMS += mlkem1024_nist_decap_tests +mlkem1024_nist_decap_tests_SOURCES = mlkem1024_nist_decap_tests.c mlkem_tests_util.c +EXTRA_DIST += mlkem1024_nist_decap_tests.sh +EXTRA_DIST += mlkem1024_nist_decap_tests.txt + +# mlkem1024_nist_keygen_tests +TESTS += mlkem1024_nist_keygen_tests.sh +check_PROGRAMS += mlkem1024_nist_keygen_tests +mlkem1024_nist_keygen_tests_SOURCES = mlkem1024_nist_keygen_tests.c mlkem_tests_util.c +EXTRA_DIST += mlkem1024_nist_keygen_tests.sh +EXTRA_DIST += mlkem1024_nist_keygen_tests.txt + +# mlkem768_decap_tests +TESTS += mlkem768_decap_tests.sh +check_PROGRAMS += mlkem768_decap_tests +mlkem768_decap_tests_SOURCES = mlkem768_decap_tests.c mlkem_tests_util.c +EXTRA_DIST += mlkem768_decap_tests.sh +EXTRA_DIST += mlkem768_decap_tests.txt + +# mlkem768_encap_tests +TESTS += mlkem768_encap_tests.sh +check_PROGRAMS += mlkem768_encap_tests +mlkem768_encap_tests_SOURCES = mlkem768_encap_tests.c mlkem_tests_util.c +EXTRA_DIST += mlkem768_encap_tests.sh +EXTRA_DIST += mlkem768_encap_tests.txt + +# mlkem768_iteration_test +TESTS += mlkem768_iteration_test +check_PROGRAMS += mlkem768_iteration_test +mlkem768_iteration_test_SOURCES = mlkem768_iteration_test.c mlkem_tests_util.c + +# mlkem768_keygen_tests +TESTS += mlkem768_keygen_tests.sh +check_PROGRAMS += mlkem768_keygen_tests +mlkem768_keygen_tests_SOURCES = mlkem768_keygen_tests.c mlkem_tests_util.c +EXTRA_DIST += mlkem768_keygen_tests.sh +EXTRA_DIST += mlkem768_keygen_tests.txt + +# mlkem768_nist_decap_tests +TESTS += mlkem768_nist_decap_tests.sh +check_PROGRAMS += mlkem768_nist_decap_tests +mlkem768_nist_decap_tests_SOURCES = mlkem768_nist_decap_tests.c mlkem_tests_util.c +EXTRA_DIST += mlkem768_nist_decap_tests.sh +EXTRA_DIST += mlkem768_nist_decap_tests.txt + +# mlkem768_nist_keygen_tests +TESTS += mlkem768_nist_keygen_tests.sh +check_PROGRAMS += mlkem768_nist_keygen_tests +mlkem768_nist_keygen_tests_SOURCES = mlkem768_nist_keygen_tests.c mlkem_tests_util.c +EXTRA_DIST += mlkem768_nist_keygen_tests.sh +EXTRA_DIST += mlkem768_nist_keygen_tests.txt + # objectstest TESTS += objectstest check_PROGRAMS += objectstest diff --git a/tests/mlkem1024_decap_tests.sh b/tests/mlkem1024_decap_tests.sh new file mode 100755 index 0000000000..95efa48eb0 --- /dev/null +++ b/tests/mlkem1024_decap_tests.sh @@ -0,0 +1,12 @@ +#!/bin/sh +set -e +TEST=./mlkem1024_decap_tests +if [ -e ./mlkem1024_decap_tests.exe ]; then + TEST=./mlkem1024_decap_tests.exe +fi + +if [ -z $srcdir ]; then + srcdir=. +fi + +$TEST $srcdir/mlkem1024_decap_tests.txt diff --git a/tests/mlkem1024_encap_tests.sh b/tests/mlkem1024_encap_tests.sh new file mode 100755 index 0000000000..9f4f2b1586 --- /dev/null +++ b/tests/mlkem1024_encap_tests.sh @@ -0,0 +1,12 @@ +#!/bin/sh +set -e +TEST=./mlkem1024_encap_tests +if [ -e ./mlkem1024_encap_tests.exe ]; then + TEST=./mlkem1024_encap_tests.exe +fi + +if [ -z $srcdir ]; then + srcdir=. +fi + +$TEST $srcdir/mlkem1024_encap_tests.txt diff --git a/tests/mlkem1024_iteration_test.sh b/tests/mlkem1024_iteration_test.sh new file mode 100755 index 0000000000..95efa48eb0 --- /dev/null +++ b/tests/mlkem1024_iteration_test.sh @@ -0,0 +1,12 @@ +#!/bin/sh +set -e +TEST=./mlkem1024_decap_tests +if [ -e ./mlkem1024_decap_tests.exe ]; then + TEST=./mlkem1024_decap_tests.exe +fi + +if [ -z $srcdir ]; then + srcdir=. +fi + +$TEST $srcdir/mlkem1024_decap_tests.txt diff --git a/tests/mlkem1024_keygen_tests.sh b/tests/mlkem1024_keygen_tests.sh new file mode 100755 index 0000000000..5287cf2d8e --- /dev/null +++ b/tests/mlkem1024_keygen_tests.sh @@ -0,0 +1,12 @@ +#!/bin/sh +set -e +TEST=./mlkem1024_keygen_tests +if [ -e ./mlkem1024_keygen_tests.exe ]; then + TEST=./mlkem1024_keygen_tests.exe +fi + +if [ -z $srcdir ]; then + srcdir=. +fi + +$TEST $srcdir/mlkem1024_keygen_tests.txt diff --git a/tests/mlkem1024_nist_decap_tests.sh b/tests/mlkem1024_nist_decap_tests.sh new file mode 100755 index 0000000000..58bfc4eb16 --- /dev/null +++ b/tests/mlkem1024_nist_decap_tests.sh @@ -0,0 +1,12 @@ +#!/bin/sh +set -e +TEST=./mlkem1024_nist_decap_tests +if [ -e ./mlkem1024_nist_decap_tests.exe ]; then + TEST=./mlkem1024_nist_decap_tests.exe +fi + +if [ -z $srcdir ]; then + srcdir=. +fi + +$TEST $srcdir/mlkem1024_nist_decap_tests.txt diff --git a/tests/mlkem1024_nist_keygen_tests.sh b/tests/mlkem1024_nist_keygen_tests.sh new file mode 100755 index 0000000000..643109c35b --- /dev/null +++ b/tests/mlkem1024_nist_keygen_tests.sh @@ -0,0 +1,12 @@ +#!/bin/sh +set -e +TEST=./mlkem1024_nist_keygen_tests +if [ -e ./mlkem1024_nist_keygen_tests.exe ]; then + TEST=./mlkem1024_nist_keygen_tests.exe +fi + +if [ -z $srcdir ]; then + srcdir=. +fi + +$TEST $srcdir/mlkem1024_nist_keygen_tests.txt diff --git a/tests/mlkem768_decap_tests.sh b/tests/mlkem768_decap_tests.sh new file mode 100755 index 0000000000..af11da3af8 --- /dev/null +++ b/tests/mlkem768_decap_tests.sh @@ -0,0 +1,12 @@ +#!/bin/sh +set -e +TEST=./mlkem768_decap_tests +if [ -e ./mlkem768_decap_tests.exe ]; then + TEST=./mlkem768_decap_tests.exe +fi + +if [ -z $srcdir ]; then + srcdir=. +fi + +$TEST $srcdir/mlkem768_decap_tests.txt diff --git a/tests/mlkem768_encap_tests.sh b/tests/mlkem768_encap_tests.sh new file mode 100755 index 0000000000..ee5c9799f6 --- /dev/null +++ b/tests/mlkem768_encap_tests.sh @@ -0,0 +1,12 @@ +#!/bin/sh +set -e +TEST=./mlkem768_encap_tests +if [ -e ./mlkem768_encap_tests.exe ]; then + TEST=./mlkem768_encap_tests.exe +fi + +if [ -z $srcdir ]; then + srcdir=. +fi + +$TEST $srcdir/mlkem768_encap_tests.txt diff --git a/tests/mlkem768_keygen_tests.sh b/tests/mlkem768_keygen_tests.sh new file mode 100755 index 0000000000..0c847097f2 --- /dev/null +++ b/tests/mlkem768_keygen_tests.sh @@ -0,0 +1,12 @@ +#!/bin/sh +set -e +TEST=./mlkem768_keygen_tests +if [ -e ./mlkem768_keygen_tests.exe ]; then + TEST=./mlkem768_keygen_tests.exe +fi + +if [ -z $srcdir ]; then + srcdir=. +fi + +$TEST $srcdir/mlkem768_keygen_tests.txt diff --git a/tests/mlkem768_nist_decap_tests.sh b/tests/mlkem768_nist_decap_tests.sh new file mode 100755 index 0000000000..42bdedc58f --- /dev/null +++ b/tests/mlkem768_nist_decap_tests.sh @@ -0,0 +1,12 @@ +#!/bin/sh +set -e +TEST=./mlkem768_nist_decap_tests +if [ -e ./mlkem768_nist_decap_tests.exe ]; then + TEST=./mlkem768_nist_decap_tests.exe +fi + +if [ -z $srcdir ]; then + srcdir=. +fi + +$TEST $srcdir/mlkem768_nist_decap_tests.txt diff --git a/tests/mlkem768_nist_keygen_tests.sh b/tests/mlkem768_nist_keygen_tests.sh new file mode 100755 index 0000000000..0c847097f2 --- /dev/null +++ b/tests/mlkem768_nist_keygen_tests.sh @@ -0,0 +1,12 @@ +#!/bin/sh +set -e +TEST=./mlkem768_keygen_tests +if [ -e ./mlkem768_keygen_tests.exe ]; then + TEST=./mlkem768_keygen_tests.exe +fi + +if [ -z $srcdir ]; then + srcdir=. +fi + +$TEST $srcdir/mlkem768_keygen_tests.txt diff --git a/update.sh b/update.sh index fa8375fb04..11a244db2c 100755 --- a/update.sh +++ b/update.sh @@ -355,6 +355,7 @@ $CP $libcrypto_regress/aead/*.txt tests $CP $libcrypto_regress/ct/ctlog.conf tests $CP $libcrypto_regress/ct/*.crt tests $CP $libcrypto_regress/x509/policy/*.pem tests +$CP $libcrypto_regress/mlkem/*.txt tests # generate libcrypto freenull.c awk -f $libcrypto_regress/free/freenull.awk \ From e8658eb57e4089b3a60e556ba2f518238cfdf896 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 17 Dec 2024 01:01:23 -0700 Subject: [PATCH 0919/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 50f0fcf2de..e6b1dbbc41 100644 --- a/ChangeLog +++ b/ChangeLog @@ -56,6 +56,7 @@ LibreSSL Portable Release Notes: * New features - libtls has a new tls_peer_cert_common_name() API call to retrieve the peer's common name without having to inspect the PEM. + - Imported ML-KEM 768 and 1024 from BoringSSL with matching API. * Bug fixes - Plugged a leak in eckey_compute_pubkey(). * Testing and proactive security From f46d437e5149fced7b0c71a4c40a1b2fbb78dc90 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 17 Dec 2024 10:18:16 +0100 Subject: [PATCH 0920/1283] Some fixes for ML-KEM tests - Run the 1024 iteration test as well as unit tests. - Remove unused test script with unexpected contents. Follow-on to #1127 --- tests/CMakeLists.txt | 12 ++++++++++++ tests/Makefile.am | 10 ++++++++++ tests/mlkem1024_iteration_test.sh | 12 ------------ 3 files changed, 22 insertions(+), 12 deletions(-) delete mode 100755 tests/mlkem1024_iteration_test.sh diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index ba521ad55b..8b079f41b3 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -548,6 +548,12 @@ target_link_libraries(mlkem1024_encap_tests ${OPENSSL_TEST_LIBS}) prepare_emscripten_test_target(mlkem1024_encap_tests) add_platform_test(mlkem1024_encap_tests mlkem1024_encap_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem1024_encap_tests.txt) +# mlkem1024_iteration_test +add_executable(mlkem1024_iteration_test mlkem1024_iteration_test.c mlkem_tests_util.c) +target_link_libraries(mlkem1024_iteration_test ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(mlkem1024_iteration_test) +add_platform_test(mlkem1024_iteration_test mlkem1024_iteration_test) + # mlkem1024_keygen_tests add_executable(mlkem1024_keygen_tests mlkem1024_keygen_tests.c mlkem_tests_util.c) target_link_libraries(mlkem1024_keygen_tests ${OPENSSL_TEST_LIBS}) @@ -602,6 +608,12 @@ target_link_libraries(mlkem768_nist_keygen_tests ${OPENSSL_TEST_LIBS}) prepare_emscripten_test_target(mlkem768_nist_keygen_tests) add_platform_test(mlkem768_nist_keygen_tests mlkem768_nist_keygen_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem768_nist_keygen_tests.txt) +# mlkem_unittest +add_executable(mlkem_unittest mlkem_unittest.c mlkem_tests_util.c) +target_link_libraries(mlkem_unittest ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(mlkem_unittest) +add_platform_test(mlkem_unittest mlkem_unittest) + # objectstest add_executable(objectstest objectstest.c) target_link_libraries(objectstest ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 36cbb9ad14..6cb2d3fd42 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -560,6 +560,11 @@ mlkem1024_encap_tests_SOURCES = mlkem1024_encap_tests.c mlkem_tests_util.c EXTRA_DIST += mlkem1024_encap_tests.sh EXTRA_DIST += mlkem1024_encap_tests.txt +# mlkem1024_iteration_test +TESTS += mlkem1024_iteration_test +check_PROGRAMS += mlkem1024_iteration_test +mlkem1024_iteration_test_SOURCES = mlkem1024_iteration_test.c mlkem_tests_util.c + # mlkem1024_keygen_tests TESTS += mlkem1024_keygen_tests.sh check_PROGRAMS += mlkem1024_keygen_tests @@ -621,6 +626,11 @@ mlkem768_nist_keygen_tests_SOURCES = mlkem768_nist_keygen_tests.c mlkem_tests_ut EXTRA_DIST += mlkem768_nist_keygen_tests.sh EXTRA_DIST += mlkem768_nist_keygen_tests.txt +# mlkem_unittest +TESTS += mlkem_unittest +check_PROGRAMS += mlkem_unittest +mlkem_unittest_SOURCES = mlkem_unittest.c mlkem_tests_util.c + # objectstest TESTS += objectstest check_PROGRAMS += objectstest diff --git a/tests/mlkem1024_iteration_test.sh b/tests/mlkem1024_iteration_test.sh deleted file mode 100755 index 95efa48eb0..0000000000 --- a/tests/mlkem1024_iteration_test.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh -set -e -TEST=./mlkem1024_decap_tests -if [ -e ./mlkem1024_decap_tests.exe ]; then - TEST=./mlkem1024_decap_tests.exe -fi - -if [ -z $srcdir ]; then - srcdir=. -fi - -$TEST $srcdir/mlkem1024_decap_tests.txt From 3e6153a55211a2590052664ba1b4093aaa97fc83 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Tue, 17 Dec 2024 18:31:06 +0900 Subject: [PATCH 0921/1283] unset CC only for mingw and arm32 Since `scripts/test` always unset "CC", the github action for "clang" in Linux does not use clang unintentionally. This patch unset CC only for mingw{32,64} and arm32. --- .github/workflows/linux.yml | 3 +++ scripts/test | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 0c9a699255..af7dfabeab 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -32,6 +32,9 @@ jobs: - os: "ubuntu-22.04" arch: "native" compiler: "clang" + - os: "ubuntu-24.04" + arch: "native" + compiler: "clang" steps: - name: "Checkout repository" uses: actions/checkout@v4 diff --git a/scripts/test b/scripts/test index e389728702..abfa038d77 100755 --- a/scripts/test +++ b/scripts/test @@ -2,7 +2,10 @@ set -e set -x -unset CC +if [ "$ARCH" = "mingw32" ] || [ "$ARCH" = "mingw64" ] || [ "$ARCH" = "arm32" ]; then + unset CC +fi + ENABLE_ASM="${ENABLE_ASM:=ON}" if type apt-get >/dev/null 2>&1; then From 9ed5c54fed283b05fe0a89f47fbfcc302372ad42 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Wed, 18 Dec 2024 09:24:28 +0900 Subject: [PATCH 0922/1283] update style --- scripts/test | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/test b/scripts/test index abfa038d77..e3044b06da 100755 --- a/scripts/test +++ b/scripts/test @@ -2,7 +2,7 @@ set -e set -x -if [ "$ARCH" = "mingw32" ] || [ "$ARCH" = "mingw64" ] || [ "$ARCH" = "arm32" ]; then +if [ "$ARCH" = "mingw32" -o "$ARCH" = "mingw64" -o "$ARCH" = "arm32" ]; then unset CC fi From 12031e4e9a1f46ae41d936e2f1a5261a95cb85f8 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Wed, 18 Dec 2024 09:38:35 +0900 Subject: [PATCH 0923/1283] Move ARCH check --- scripts/test | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/scripts/test b/scripts/test index e3044b06da..1fb02ebaf9 100755 --- a/scripts/test +++ b/scripts/test @@ -2,6 +2,10 @@ set -e set -x +if [ "$ARCH" = "" ]; then + ARCH=`uname -m` +fi + if [ "$ARCH" = "mingw32" -o "$ARCH" = "mingw64" -o "$ARCH" = "arm32" ]; then unset CC fi @@ -18,10 +22,6 @@ fi VERSION=`cat VERSION` -if [ "$ARCH" = "" ]; then - ARCH=`uname -m` -fi - # test macOS if [ `uname` = "Darwin" ]; then # test autotools From bf808ea0fc581f58ec4aabd9d7f24d3a5275bc7a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 19 Dec 2024 20:24:33 +0100 Subject: [PATCH 0924/1283] Provide getdelim and getline compat shims These are portable implementations from NetBSD that are needed on Windows and perhaps some other platforms with the new versions of the mlkem tests. --- .gitignore | 4 +++ CMakeLists.txt | 10 ++++++ crypto/CMakeLists.txt | 8 +++++ crypto/Makefile.am | 8 +++++ crypto/compat/getdelim.c | 78 ++++++++++++++++++++++++++++++++++++++++ crypto/compat/getline.c | 40 +++++++++++++++++++++ include/compat/stdio.h | 12 +++++++ m4/check-libc.m4 | 4 ++- 8 files changed, 163 insertions(+), 1 deletion(-) create mode 100644 crypto/compat/getdelim.c create mode 100644 crypto/compat/getline.c diff --git a/.gitignore b/.gitignore index 3c823869c6..18f99c1160 100644 --- a/.gitignore +++ b/.gitignore @@ -237,10 +237,14 @@ include/openssl/*.h /crypto/* !/crypto/Makefile.am.* +!/crypto/compat/ +/crypto/compat/* !/crypto/compat/arc4random.h !/crypto/compat/b_win.c !/crypto/compat/explicit_bzero_win.c !/crypto/compat/freezero.c +!/crypto/compat/getdelim.c +!/crypto/compat/getline.c !/crypto/compat/getpagesize.c !/crypto/compat/posix_win.c !/crypto/compat/bsd_asprintf.c diff --git a/CMakeLists.txt b/CMakeLists.txt index ebd8260af5..437570b9f3 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -214,6 +214,16 @@ if(HAVE_ASPRINTF) add_definitions(-DHAVE_ASPRINTF) endif() +check_symbol_exists(getdelim "stdio.h" HAVE_GETDELIM) +if(HAVE_GETDELIM) + add_definitions(-DHAVE_GETDELIM) +endif() + +check_symbol_exists(getline "stdio.h" HAVE_GETLINE) +if(HAVE_GETLINE) + add_definitions(-DHAVE_GETLINE) +endif() + check_symbol_exists(getopt "unistd.h" HAVE_GETOPT) if(HAVE_GETOPT) add_definitions(-DHAVE_GETOPT) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 7b3439df29..92a10baed5 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -607,6 +607,14 @@ if(NOT HAVE_FREEZERO) set(COMPAT_SRC ${COMPAT_SRC} compat/freezero.c) endif() +if(NOT HAVE_GETDELIM) + set(COMPAT_SRC ${COMPAT_SRC} compat/getdelim.c) +endif() + +if(NOT HAVE_GETLINE) + set(COMPAT_SRC ${COMPAT_SRC} compat/getline.c) +endif() + if(NOT HAVE_GETOPT) set(COMPAT_SRC ${COMPAT_SRC} compat/getopt_long.c) endif() diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 06fde297b3..31fcffdf16 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -134,6 +134,14 @@ if !HAVE_FREEZERO libcompat_la_SOURCES += compat/freezero.c endif +if !HAVE_GETDELIM +libcompat_la_SOURCES += compat/getdelim.c +endif + +if !HAVE_GETLINE +libcompat_la_SOURCES += compat/getline.c +endif + if !HAVE_GETPAGESIZE libcompat_la_SOURCES += compat/getpagesize.c endif diff --git a/crypto/compat/getdelim.c b/crypto/compat/getdelim.c new file mode 100644 index 0000000000..caec3f2005 --- /dev/null +++ b/crypto/compat/getdelim.c @@ -0,0 +1,78 @@ +/*- + * Copyright (c) 2011 The NetBSD Foundation, Inc. + * All rights reserved. + * + * This code is derived from software contributed to The NetBSD Foundation + * by Christos Zoulas. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS + * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS + * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +#include +#include + +#ifndef HAVE_GETDELIM + +ssize_t +getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp) +{ + char *ptr, *eptr; + + + if (*buf == NULL || *bufsiz == 0) { + *bufsiz = BUFSIZ; + if ((*buf = malloc(*bufsiz)) == NULL) + return -1; + } + + for (ptr = *buf, eptr = *buf + *bufsiz;;) { + int c = fgetc(fp); + if (c == -1) { + if (feof(fp)) { + ssize_t diff = (ssize_t)(ptr - *buf); + if (diff != 0) { + *ptr = '\0'; + return diff; + } + } + return -1; + } + *ptr++ = c; + if (c == delimiter) { + *ptr = '\0'; + return ptr - *buf; + } + if (ptr + 2 >= eptr) { + char *nbuf; + size_t nbufsiz = *bufsiz * 2; + ssize_t d = ptr - *buf; + if ((nbuf = realloc(*buf, nbufsiz)) == NULL) + return -1; + *buf = nbuf; + *bufsiz = nbufsiz; + eptr = nbuf + nbufsiz; + ptr = nbuf + d; + } + } +} + +#endif /* HAVE_GETDELIM */ diff --git a/crypto/compat/getline.c b/crypto/compat/getline.c new file mode 100644 index 0000000000..e6ecde02bb --- /dev/null +++ b/crypto/compat/getline.c @@ -0,0 +1,40 @@ +/*- + * Copyright (c) 2011 The NetBSD Foundation, Inc. + * All rights reserved. + * + * This code is derived from software contributed to The NetBSD Foundation + * by Christos Zoulas. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS + * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS + * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +#include + +#ifndef HAVE_GETLINE + +ssize_t +getline(char **buf, size_t *bufsiz, FILE *fp) +{ + return getdelim(buf, bufsiz, '\n', fp); +} + +#endif /* HAVE_GETLINE */ diff --git a/include/compat/stdio.h b/include/compat/stdio.h index 2af8f3eea7..2ccdeeb68e 100644 --- a/include/compat/stdio.h +++ b/include/compat/stdio.h @@ -18,6 +18,18 @@ #include_next #endif +#ifndef HAVE_GETDELIM +#include +#define getdelim libressl_getdelim +ssize_t getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp); +#endif + +#ifndef HAVE_GETLINE +#include +#define getline libressl_getline +ssize_t getline(char **buf, size_t *bufsiz, FILE *fp); +#endif + #ifndef HAVE_ASPRINTF #include #define vasprintf libressl_vasprintf diff --git a/m4/check-libc.m4 b/m4/check-libc.m4 index 40df15bc49..8cb849b0a0 100644 --- a/m4/check-libc.m4 +++ b/m4/check-libc.m4 @@ -7,7 +7,7 @@ AC_CHECK_HEADERS([netinet/ip.h], [], [], ]) AC_HEADER_RESOLV # Check for general libc functions -AC_CHECK_FUNCS([asprintf freezero memmem]) +AC_CHECK_FUNCS([asprintf freezero getdelim getline memmem]) AC_CHECK_FUNCS([readpassphrase reallocarray recallocarray]) AC_CHECK_FUNCS([strcasecmp strlcat strlcpy strndup strnlen strsep strtonum]) AC_CHECK_FUNCS([timegm _mkgmtime timespecsub]) @@ -24,6 +24,8 @@ AC_CACHE_CHECK([for getpagesize], ac_cv_func_getpagesize, [ ]) AM_CONDITIONAL([HAVE_ASPRINTF], [test "x$ac_cv_func_asprintf" = xyes]) AM_CONDITIONAL([HAVE_FREEZERO], [test "x$ac_cv_func_freezero" = xyes]) +AM_CONDITIONAL([HAVE_GETDELIM], [test "x$ac_cv_func_getdelim" = xyes]) +AM_CONDITIONAL([HAVE_GETLINE], [test "x$ac_cv_func_getline" = xyes]) AM_CONDITIONAL([HAVE_GETPAGESIZE], [test "x$ac_cv_func_getpagesize" = xyes]) AM_CONDITIONAL([HAVE_GETOPT], [test "x$ac_cv_func_getopt" = xyes]) AM_CONDITIONAL([HAVE_MEMMEM], [test "x$ac_cv_func_memmem" = xyes]) From 3378e9772667155263acfbfda99ee5152458d631 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 19 Dec 2024 18:58:48 -0700 Subject: [PATCH 0925/1283] Remove mlkem and bytestring from public visibility for now --- crypto/Makefile.am | 1 + tests/CMakeLists.txt | 1 + tests/Makefile.am | 1 + update.sh | 3 +-- 4 files changed, 4 insertions(+), 2 deletions(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 31fcffdf16..990582f830 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -709,6 +709,7 @@ libcrypto_la_SOURCES += md5/md5.c # mlkem libcrypto_la_SOURCES += mlkem/mlkem768.c libcrypto_la_SOURCES += mlkem/mlkem1024.c +noinst_HEADERS += mlkem/mlkem.h noinst_HEADERS += mlkem/mlkem_internal.h # modes diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 8b079f41b3..2639ee6964 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -6,6 +6,7 @@ include_directories( ../crypto/asn1 ../crypto/bio ../crypto/bn + ../crypto/bytestring ../crypto/curve25519 ../crypto/evp ../crypto/mlkem diff --git a/tests/Makefile.am b/tests/Makefile.am index 6cb2d3fd42..e5d3bec35d 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -10,6 +10,7 @@ AM_CPPFLAGS += -I $(top_srcdir)/crypto/ AM_CPPFLAGS += -I $(top_srcdir)/crypto/asn1 AM_CPPFLAGS += -I $(top_srcdir)/crypto/bio AM_CPPFLAGS += -I $(top_srcdir)/crypto/bn +AM_CPPFLAGS += -I $(top_srcdir)/crypto/bytestring AM_CPPFLAGS += -I $(top_srcdir)/crypto/curve25519 AM_CPPFLAGS += -I $(top_srcdir)/crypto/evp AM_CPPFLAGS += -I $(top_srcdir)/crypto/mlkem diff --git a/update.sh b/update.sh index 11a244db2c..164f68f1dc 100755 --- a/update.sh +++ b/update.sh @@ -127,11 +127,10 @@ copy_hdrs() { copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h ossl_typ.h err/err.h crypto.h comp/comp.h x509/x509.h buffer/buffer.h - bytestring/bytestring.h objects/objects.h asn1/asn1.h asn1/posix_time.h bn/bn.h ec/ec.h ecdsa/ecdsa.h ecdh/ecdh.h rsa/rsa.h sha/sha.h x509/x509_vfy.h pkcs7/pkcs7.h pem/pem.h hkdf/hkdf.h hmac/hmac.h rand/rand.h md5/md5.h - x509/x509v3.h conf/conf.h mlkem/mlkem.h ocsp/ocsp.h + x509/x509v3.h conf/conf.h ocsp/ocsp.h aes/aes.h modes/modes.h asn1/asn1t.h bf/blowfish.h bio/bio.h cast/cast.h cmac/cmac.h cms/cms.h des/des.h dh/dh.h dsa/dsa.h engine/engine.h ui/ui.h pkcs12/pkcs12.h ts/ts.h From 100511900d8b6d1bf44f12f2b8c4fd9c15eb2a54 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 20 Dec 2024 02:56:34 -0700 Subject: [PATCH 0926/1283] fix .gitignore for mlkem and pick up hidden header --- .gitignore | 4 +--- crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 18f99c1160..28c9edf5cc 100644 --- a/.gitignore +++ b/.gitignore @@ -115,9 +115,7 @@ tests/freenull* tests/gost2814789t* tests/key_schedule* tests/lhash_test* -tests/mlkem*.c -tests/mlkem*.h -tests/mlkem*.txt +tests/mlkem* tests/mont* tests/policy* tests/rfc3779* diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 990582f830..438da8bbf3 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -655,6 +655,7 @@ noinst_HEADERS += hidden/openssl/idea.h noinst_HEADERS += hidden/openssl/lhash.h noinst_HEADERS += hidden/openssl/md4.h noinst_HEADERS += hidden/openssl/md5.h +noinst_HEADERS += hidden/openssl/mlkem.h noinst_HEADERS += hidden/openssl/modes.h noinst_HEADERS += hidden/openssl/objects.h noinst_HEADERS += hidden/openssl/ocsp.h From 5626ce43e30e936e870c123b4ac80e469de4d9b9 Mon Sep 17 00:00:00 2001 From: Cameron Lowell Palmer Date: Fri, 20 Dec 2024 06:52:34 -0600 Subject: [PATCH 0927/1283] Add in missing endianess functions for Apple targets --- include/compat/endian.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/compat/endian.h b/include/compat/endian.h index 2e4c8f74ae..af3664da4c 100644 --- a/include/compat/endian.h +++ b/include/compat/endian.h @@ -62,7 +62,7 @@ #endif #endif -#if defined(__APPLE__) && !defined(HAVE_ENDIAN_H) +#if defined(__APPLE__) #include #define be16toh(x) OSSwapBigToHostInt16((x)) #define htobe16(x) OSSwapHostToBigInt16((x)) @@ -74,7 +74,7 @@ #define htobe64(x) OSSwapHostToBigInt64(x) #define le64toh(x) OSSwapLittleToHostInt64(x) #define be64toh(x) OSSwapBigToHostInt64(x) -#endif /* __APPLE__ && !HAVE_ENDIAN_H */ +#endif /* __APPLE__ */ #if defined(_WIN32) && !defined(HAVE_ENDIAN_H) #include From 3de45b06b8a7df0f146ab8fc5cc4eeffa4825160 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 24 Dec 2024 13:16:12 -0700 Subject: [PATCH 0928/1283] update man links --- man/links | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/man/links b/man/links index fb44071602..91945717ef 100644 --- a/man/links +++ b/man/links @@ -1056,41 +1056,39 @@ EVP_VerifyInit.3,EVP_VerifyFinal.3 EVP_VerifyInit.3,EVP_VerifyInit_ex.3 EVP_VerifyInit.3,EVP_VerifyUpdate.3 EVP_aes_128_cbc.3,EVP_aes_128_cbc_hmac_sha1.3 -EVP_aes_128_cbc.3,EVP_aes_128_ccm.3 EVP_aes_128_cbc.3,EVP_aes_128_cfb.3 EVP_aes_128_cbc.3,EVP_aes_128_cfb1.3 EVP_aes_128_cbc.3,EVP_aes_128_cfb128.3 EVP_aes_128_cbc.3,EVP_aes_128_cfb8.3 EVP_aes_128_cbc.3,EVP_aes_128_ctr.3 EVP_aes_128_cbc.3,EVP_aes_128_ecb.3 -EVP_aes_128_cbc.3,EVP_aes_128_gcm.3 EVP_aes_128_cbc.3,EVP_aes_128_ofb.3 EVP_aes_128_cbc.3,EVP_aes_128_wrap.3 EVP_aes_128_cbc.3,EVP_aes_128_xts.3 EVP_aes_128_cbc.3,EVP_aes_192_cbc.3 -EVP_aes_128_cbc.3,EVP_aes_192_ccm.3 EVP_aes_128_cbc.3,EVP_aes_192_cfb.3 EVP_aes_128_cbc.3,EVP_aes_192_cfb1.3 EVP_aes_128_cbc.3,EVP_aes_192_cfb128.3 EVP_aes_128_cbc.3,EVP_aes_192_cfb8.3 EVP_aes_128_cbc.3,EVP_aes_192_ctr.3 EVP_aes_128_cbc.3,EVP_aes_192_ecb.3 -EVP_aes_128_cbc.3,EVP_aes_192_gcm.3 EVP_aes_128_cbc.3,EVP_aes_192_ofb.3 EVP_aes_128_cbc.3,EVP_aes_192_wrap.3 EVP_aes_128_cbc.3,EVP_aes_256_cbc.3 EVP_aes_128_cbc.3,EVP_aes_256_cbc_hmac_sha1.3 -EVP_aes_128_cbc.3,EVP_aes_256_ccm.3 EVP_aes_128_cbc.3,EVP_aes_256_cfb.3 EVP_aes_128_cbc.3,EVP_aes_256_cfb1.3 EVP_aes_128_cbc.3,EVP_aes_256_cfb128.3 EVP_aes_128_cbc.3,EVP_aes_256_cfb8.3 EVP_aes_128_cbc.3,EVP_aes_256_ctr.3 EVP_aes_128_cbc.3,EVP_aes_256_ecb.3 -EVP_aes_128_cbc.3,EVP_aes_256_gcm.3 EVP_aes_128_cbc.3,EVP_aes_256_ofb.3 EVP_aes_128_cbc.3,EVP_aes_256_wrap.3 EVP_aes_128_cbc.3,EVP_aes_256_xts.3 +EVP_aes_128_ccm.3,EVP_aes_192_ccm.3 +EVP_aes_128_ccm.3,EVP_aes_256_ccm.3 +EVP_aes_128_gcm.3,EVP_aes_192_gcm.3 +EVP_aes_128_gcm.3,EVP_aes_256_gcm.3 EVP_camellia_128_cbc.3,EVP_camellia_128_cfb.3 EVP_camellia_128_cbc.3,EVP_camellia_128_cfb1.3 EVP_camellia_128_cbc.3,EVP_camellia_128_cfb128.3 @@ -1973,6 +1971,7 @@ X509V3_get_d2i.3,X509_add1_ext_i2d.3 X509V3_get_d2i.3,X509_get0_extensions.3 X509V3_get_d2i.3,X509_get0_uids.3 X509V3_get_d2i.3,X509_get_ext_d2i.3 +X509V3_parse_list.3,X509V3_conf_free.3 X509_ALGOR_dup.3,X509_ALGOR_cmp.3 X509_ALGOR_dup.3,X509_ALGOR_free.3 X509_ALGOR_dup.3,X509_ALGOR_get0.3 @@ -2786,6 +2785,7 @@ tls_read.3,tls_close.3 tls_read.3,tls_error.3 tls_read.3,tls_handshake.3 tls_read.3,tls_write.3 +v2i_ASN1_BIT_STRING.3,i2v_ASN1_BIT_STRING.3 x509_verify.3,x509_verify_ctx_chain.3 x509_verify.3,x509_verify_ctx_error_depth.3 x509_verify.3,x509_verify_ctx_error_string.3 From 4e0552995fa2a9864157a7b2a62462363e8c10bd Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 26 Dec 2024 00:28:23 -0700 Subject: [PATCH 0929/1283] Adjust the ML-KEM tests to recent reorganization --- .gitignore | 1 + tests/CMakeLists.txt | 86 +++++---------------------- tests/Makefile.am | 88 +++++----------------------- tests/mlkem1024_decap_tests.sh | 12 ---- tests/mlkem1024_encap_tests.sh | 12 ---- tests/mlkem1024_keygen_tests.sh | 12 ---- tests/mlkem1024_nist_decap_tests.sh | 12 ---- tests/mlkem1024_nist_keygen_tests.sh | 12 ---- tests/mlkem768_decap_tests.sh | 12 ---- tests/mlkem768_encap_tests.sh | 12 ---- tests/mlkem768_keygen_tests.sh | 12 ---- tests/mlkem768_nist_decap_tests.sh | 12 ---- tests/mlkem768_nist_keygen_tests.sh | 12 ---- tests/mlkem_tests.sh | 22 +++++++ 14 files changed, 53 insertions(+), 264 deletions(-) delete mode 100755 tests/mlkem1024_decap_tests.sh delete mode 100755 tests/mlkem1024_encap_tests.sh delete mode 100755 tests/mlkem1024_keygen_tests.sh delete mode 100755 tests/mlkem1024_nist_decap_tests.sh delete mode 100755 tests/mlkem1024_nist_keygen_tests.sh delete mode 100755 tests/mlkem768_decap_tests.sh delete mode 100755 tests/mlkem768_encap_tests.sh delete mode 100755 tests/mlkem768_keygen_tests.sh delete mode 100755 tests/mlkem768_nist_decap_tests.sh delete mode 100755 tests/mlkem768_nist_keygen_tests.sh create mode 100755 tests/mlkem_tests.sh diff --git a/.gitignore b/.gitignore index 28c9edf5cc..58172a13d8 100644 --- a/.gitignore +++ b/.gitignore @@ -117,6 +117,7 @@ tests/key_schedule* tests/lhash_test* tests/mlkem* tests/mont* +tests/parse* tests/policy* tests/rfc3779* tests/rfc5280time* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 2639ee6964..ba8444e7fd 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -537,77 +537,21 @@ add_executable(md_test md_test.c) target_link_libraries(md_test ${OPENSSL_TEST_LIBS}) add_platform_test(md_test md_test) -# mlkem1024_decap_tests -add_executable(mlkem1024_decap_tests mlkem1024_decap_tests.c mlkem_tests_util.c) -target_link_libraries(mlkem1024_decap_tests ${OPENSSL_TEST_LIBS}) -prepare_emscripten_test_target(mlkem1024_decap_tests) -add_platform_test(mlkem1024_decap_tests mlkem1024_decap_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem1024_decap_tests.txt) - -# mlkem1024_encap_tests -add_executable(mlkem1024_encap_tests mlkem1024_encap_tests.c mlkem_tests_util.c) -target_link_libraries(mlkem1024_encap_tests ${OPENSSL_TEST_LIBS}) -prepare_emscripten_test_target(mlkem1024_encap_tests) -add_platform_test(mlkem1024_encap_tests mlkem1024_encap_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem1024_encap_tests.txt) - -# mlkem1024_iteration_test -add_executable(mlkem1024_iteration_test mlkem1024_iteration_test.c mlkem_tests_util.c) -target_link_libraries(mlkem1024_iteration_test ${OPENSSL_TEST_LIBS}) -prepare_emscripten_test_target(mlkem1024_iteration_test) -add_platform_test(mlkem1024_iteration_test mlkem1024_iteration_test) - -# mlkem1024_keygen_tests -add_executable(mlkem1024_keygen_tests mlkem1024_keygen_tests.c mlkem_tests_util.c) -target_link_libraries(mlkem1024_keygen_tests ${OPENSSL_TEST_LIBS}) -prepare_emscripten_test_target(mlkem1024_keygen_tests) -add_platform_test(mlkem1024_keygen_tests mlkem1024_keygen_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem1024_keygen_tests.txt) - -# mlkem1024_nist_decap_tests -add_executable(mlkem1024_nist_decap_tests mlkem1024_nist_decap_tests.c mlkem_tests_util.c) -target_link_libraries(mlkem1024_nist_decap_tests ${OPENSSL_TEST_LIBS}) -prepare_emscripten_test_target(mlkem1024_nist_decap_tests) -add_platform_test(mlkem1024_nist_decap_tests mlkem1024_nist_decap_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem1024_nist_decap_tests.txt) - -# mlkem1024_nist_keygen_tests -add_executable(mlkem1024_nist_keygen_tests mlkem1024_nist_keygen_tests.c mlkem_tests_util.c) -target_link_libraries(mlkem1024_nist_keygen_tests ${OPENSSL_TEST_LIBS}) -prepare_emscripten_test_target(mlkem1024_nist_keygen_tests) -add_platform_test(mlkem1024_nist_keygen_tests mlkem1024_nist_keygen_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem1024_nist_keygen_tests.txt) - -# mlkem768_decap_tests -add_executable(mlkem768_decap_tests mlkem768_decap_tests.c mlkem_tests_util.c) -target_link_libraries(mlkem768_decap_tests ${OPENSSL_TEST_LIBS}) -prepare_emscripten_test_target(mlkem768_decap_tests) -add_platform_test(mlkem768_decap_tests mlkem768_decap_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem768_decap_tests.txt) - -# mlkem768_encap_tests -add_executable(mlkem768_encap_tests mlkem768_encap_tests.c mlkem_tests_util.c) -target_link_libraries(mlkem768_encap_tests ${OPENSSL_TEST_LIBS}) -prepare_emscripten_test_target(mlkem768_encap_tests) -add_platform_test(mlkem768_encap_tests mlkem768_encap_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem768_encap_tests.txt) - -# mlkem768_iteration_test -add_executable(mlkem768_iteration_test mlkem768_iteration_test.c mlkem_tests_util.c) -target_link_libraries(mlkem768_iteration_test ${OPENSSL_TEST_LIBS}) -prepare_emscripten_test_target(mlkem768_iteration_test) -add_platform_test(mlkem768_iteration_test mlkem768_iteration_test) - -# mlkem768_keygen_tests -add_executable(mlkem768_keygen_tests mlkem768_keygen_tests.c mlkem_tests_util.c) -target_link_libraries(mlkem768_keygen_tests ${OPENSSL_TEST_LIBS}) -prepare_emscripten_test_target(mlkem768_keygen_tests) -add_platform_test(mlkem768_keygen_tests mlkem768_keygen_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem768_keygen_tests.txt) - -# mlkem768_nist_decap_tests -add_executable(mlkem768_nist_decap_tests mlkem768_nist_decap_tests.c mlkem_tests_util.c) -target_link_libraries(mlkem768_nist_decap_tests ${OPENSSL_TEST_LIBS}) -prepare_emscripten_test_target(mlkem768_nist_decap_tests) -add_platform_test(mlkem768_nist_decap_tests mlkem768_nist_decap_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem768_nist_decap_tests.txt) - -# mlkem768_nist_keygen_tests -add_executable(mlkem768_nist_keygen_tests mlkem768_nist_keygen_tests.c mlkem_tests_util.c) -target_link_libraries(mlkem768_nist_keygen_tests ${OPENSSL_TEST_LIBS}) -prepare_emscripten_test_target(mlkem768_nist_keygen_tests) -add_platform_test(mlkem768_nist_keygen_tests mlkem768_nist_keygen_tests ${CMAKE_CURRENT_SOURCE_DIR}/mlkem768_nist_keygen_tests.txt) +# mlkem_tests +add_executable(mlkem_tests mlkem_tests.c mlkem_tests_util.c parse_test_file.c) +target_link_libraries(mlkem_tests ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(mlkem_tests) +if(NOT WIN32) + add_test(NAME mlkem_tests COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/mlkem_tests.sh) + set_tests_properties(mlkem_tests PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") +endif() +# XXX - add tests for Windows + +# mlkem_iteration_tests +add_executable(mlkem_iteration_tests mlkem_iteration_tests.c mlkem_tests_util.c) +target_link_libraries(mlkem_iteration_tests ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(mlkem_iteration_tests) +add_platform_test(mlkem_iteration_tests mlkem_iteration_tests) # mlkem_unittest add_executable(mlkem_unittest mlkem_unittest.c mlkem_tests_util.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index e5d3bec35d..55f0b70691 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -546,86 +546,28 @@ check_PROGRAMS += md_test md_test_SOURCES = md_test.c noinst_HEADERS += mlkem_tests_util.h +noinst_HEADERS += parse_test_file.h -# mlkem1024_decap_tests -TESTS += mlkem1024_decap_tests.sh -check_PROGRAMS += mlkem1024_decap_tests -mlkem1024_decap_tests_SOURCES = mlkem1024_decap_tests.c mlkem_tests_util.c -EXTRA_DIST += mlkem1024_decap_tests.sh +# mlkem_tests +TESTS += mlkem_tests.sh +check_PROGRAMS += mlkem_tests +mlkem_tests_SOURCES = mlkem_tests.c mlkem_tests_util.c parse_test_file.c +EXTRA_DIST += mlkem_tests.sh +EXTRA_DIST += mlkem768_decap_tests.txt +EXTRA_DIST += mlkem768_encap_tests.txt +EXTRA_DIST += mlkem768_keygen_tests.txt +EXTRA_DIST += mlkem768_nist_decap_tests.txt +EXTRA_DIST += mlkem768_nist_keygen_tests.txt EXTRA_DIST += mlkem1024_decap_tests.txt - -# mlkem1024_encap_tests -TESTS += mlkem1024_encap_tests.sh -check_PROGRAMS += mlkem1024_encap_tests -mlkem1024_encap_tests_SOURCES = mlkem1024_encap_tests.c mlkem_tests_util.c -EXTRA_DIST += mlkem1024_encap_tests.sh EXTRA_DIST += mlkem1024_encap_tests.txt - -# mlkem1024_iteration_test -TESTS += mlkem1024_iteration_test -check_PROGRAMS += mlkem1024_iteration_test -mlkem1024_iteration_test_SOURCES = mlkem1024_iteration_test.c mlkem_tests_util.c - -# mlkem1024_keygen_tests -TESTS += mlkem1024_keygen_tests.sh -check_PROGRAMS += mlkem1024_keygen_tests -mlkem1024_keygen_tests_SOURCES = mlkem1024_keygen_tests.c mlkem_tests_util.c -EXTRA_DIST += mlkem1024_keygen_tests.sh EXTRA_DIST += mlkem1024_keygen_tests.txt - -# mlkem1024_nist_decap_tests -TESTS += mlkem1024_nist_decap_tests.sh -check_PROGRAMS += mlkem1024_nist_decap_tests -mlkem1024_nist_decap_tests_SOURCES = mlkem1024_nist_decap_tests.c mlkem_tests_util.c -EXTRA_DIST += mlkem1024_nist_decap_tests.sh EXTRA_DIST += mlkem1024_nist_decap_tests.txt - -# mlkem1024_nist_keygen_tests -TESTS += mlkem1024_nist_keygen_tests.sh -check_PROGRAMS += mlkem1024_nist_keygen_tests -mlkem1024_nist_keygen_tests_SOURCES = mlkem1024_nist_keygen_tests.c mlkem_tests_util.c -EXTRA_DIST += mlkem1024_nist_keygen_tests.sh EXTRA_DIST += mlkem1024_nist_keygen_tests.txt -# mlkem768_decap_tests -TESTS += mlkem768_decap_tests.sh -check_PROGRAMS += mlkem768_decap_tests -mlkem768_decap_tests_SOURCES = mlkem768_decap_tests.c mlkem_tests_util.c -EXTRA_DIST += mlkem768_decap_tests.sh -EXTRA_DIST += mlkem768_decap_tests.txt - -# mlkem768_encap_tests -TESTS += mlkem768_encap_tests.sh -check_PROGRAMS += mlkem768_encap_tests -mlkem768_encap_tests_SOURCES = mlkem768_encap_tests.c mlkem_tests_util.c -EXTRA_DIST += mlkem768_encap_tests.sh -EXTRA_DIST += mlkem768_encap_tests.txt - -# mlkem768_iteration_test -TESTS += mlkem768_iteration_test -check_PROGRAMS += mlkem768_iteration_test -mlkem768_iteration_test_SOURCES = mlkem768_iteration_test.c mlkem_tests_util.c - -# mlkem768_keygen_tests -TESTS += mlkem768_keygen_tests.sh -check_PROGRAMS += mlkem768_keygen_tests -mlkem768_keygen_tests_SOURCES = mlkem768_keygen_tests.c mlkem_tests_util.c -EXTRA_DIST += mlkem768_keygen_tests.sh -EXTRA_DIST += mlkem768_keygen_tests.txt - -# mlkem768_nist_decap_tests -TESTS += mlkem768_nist_decap_tests.sh -check_PROGRAMS += mlkem768_nist_decap_tests -mlkem768_nist_decap_tests_SOURCES = mlkem768_nist_decap_tests.c mlkem_tests_util.c -EXTRA_DIST += mlkem768_nist_decap_tests.sh -EXTRA_DIST += mlkem768_nist_decap_tests.txt - -# mlkem768_nist_keygen_tests -TESTS += mlkem768_nist_keygen_tests.sh -check_PROGRAMS += mlkem768_nist_keygen_tests -mlkem768_nist_keygen_tests_SOURCES = mlkem768_nist_keygen_tests.c mlkem_tests_util.c -EXTRA_DIST += mlkem768_nist_keygen_tests.sh -EXTRA_DIST += mlkem768_nist_keygen_tests.txt +# mlkem_iteration_tests +TESTS += mlkem_iteration_tests +check_PROGRAMS += mlkem_iteration_tests +mlkem_iteration_tests_SOURCES = mlkem_iteration_tests.c mlkem_tests_util.c # mlkem_unittest TESTS += mlkem_unittest diff --git a/tests/mlkem1024_decap_tests.sh b/tests/mlkem1024_decap_tests.sh deleted file mode 100755 index 95efa48eb0..0000000000 --- a/tests/mlkem1024_decap_tests.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh -set -e -TEST=./mlkem1024_decap_tests -if [ -e ./mlkem1024_decap_tests.exe ]; then - TEST=./mlkem1024_decap_tests.exe -fi - -if [ -z $srcdir ]; then - srcdir=. -fi - -$TEST $srcdir/mlkem1024_decap_tests.txt diff --git a/tests/mlkem1024_encap_tests.sh b/tests/mlkem1024_encap_tests.sh deleted file mode 100755 index 9f4f2b1586..0000000000 --- a/tests/mlkem1024_encap_tests.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh -set -e -TEST=./mlkem1024_encap_tests -if [ -e ./mlkem1024_encap_tests.exe ]; then - TEST=./mlkem1024_encap_tests.exe -fi - -if [ -z $srcdir ]; then - srcdir=. -fi - -$TEST $srcdir/mlkem1024_encap_tests.txt diff --git a/tests/mlkem1024_keygen_tests.sh b/tests/mlkem1024_keygen_tests.sh deleted file mode 100755 index 5287cf2d8e..0000000000 --- a/tests/mlkem1024_keygen_tests.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh -set -e -TEST=./mlkem1024_keygen_tests -if [ -e ./mlkem1024_keygen_tests.exe ]; then - TEST=./mlkem1024_keygen_tests.exe -fi - -if [ -z $srcdir ]; then - srcdir=. -fi - -$TEST $srcdir/mlkem1024_keygen_tests.txt diff --git a/tests/mlkem1024_nist_decap_tests.sh b/tests/mlkem1024_nist_decap_tests.sh deleted file mode 100755 index 58bfc4eb16..0000000000 --- a/tests/mlkem1024_nist_decap_tests.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh -set -e -TEST=./mlkem1024_nist_decap_tests -if [ -e ./mlkem1024_nist_decap_tests.exe ]; then - TEST=./mlkem1024_nist_decap_tests.exe -fi - -if [ -z $srcdir ]; then - srcdir=. -fi - -$TEST $srcdir/mlkem1024_nist_decap_tests.txt diff --git a/tests/mlkem1024_nist_keygen_tests.sh b/tests/mlkem1024_nist_keygen_tests.sh deleted file mode 100755 index 643109c35b..0000000000 --- a/tests/mlkem1024_nist_keygen_tests.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh -set -e -TEST=./mlkem1024_nist_keygen_tests -if [ -e ./mlkem1024_nist_keygen_tests.exe ]; then - TEST=./mlkem1024_nist_keygen_tests.exe -fi - -if [ -z $srcdir ]; then - srcdir=. -fi - -$TEST $srcdir/mlkem1024_nist_keygen_tests.txt diff --git a/tests/mlkem768_decap_tests.sh b/tests/mlkem768_decap_tests.sh deleted file mode 100755 index af11da3af8..0000000000 --- a/tests/mlkem768_decap_tests.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh -set -e -TEST=./mlkem768_decap_tests -if [ -e ./mlkem768_decap_tests.exe ]; then - TEST=./mlkem768_decap_tests.exe -fi - -if [ -z $srcdir ]; then - srcdir=. -fi - -$TEST $srcdir/mlkem768_decap_tests.txt diff --git a/tests/mlkem768_encap_tests.sh b/tests/mlkem768_encap_tests.sh deleted file mode 100755 index ee5c9799f6..0000000000 --- a/tests/mlkem768_encap_tests.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh -set -e -TEST=./mlkem768_encap_tests -if [ -e ./mlkem768_encap_tests.exe ]; then - TEST=./mlkem768_encap_tests.exe -fi - -if [ -z $srcdir ]; then - srcdir=. -fi - -$TEST $srcdir/mlkem768_encap_tests.txt diff --git a/tests/mlkem768_keygen_tests.sh b/tests/mlkem768_keygen_tests.sh deleted file mode 100755 index 0c847097f2..0000000000 --- a/tests/mlkem768_keygen_tests.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh -set -e -TEST=./mlkem768_keygen_tests -if [ -e ./mlkem768_keygen_tests.exe ]; then - TEST=./mlkem768_keygen_tests.exe -fi - -if [ -z $srcdir ]; then - srcdir=. -fi - -$TEST $srcdir/mlkem768_keygen_tests.txt diff --git a/tests/mlkem768_nist_decap_tests.sh b/tests/mlkem768_nist_decap_tests.sh deleted file mode 100755 index 42bdedc58f..0000000000 --- a/tests/mlkem768_nist_decap_tests.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh -set -e -TEST=./mlkem768_nist_decap_tests -if [ -e ./mlkem768_nist_decap_tests.exe ]; then - TEST=./mlkem768_nist_decap_tests.exe -fi - -if [ -z $srcdir ]; then - srcdir=. -fi - -$TEST $srcdir/mlkem768_nist_decap_tests.txt diff --git a/tests/mlkem768_nist_keygen_tests.sh b/tests/mlkem768_nist_keygen_tests.sh deleted file mode 100755 index 0c847097f2..0000000000 --- a/tests/mlkem768_nist_keygen_tests.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh -set -e -TEST=./mlkem768_keygen_tests -if [ -e ./mlkem768_keygen_tests.exe ]; then - TEST=./mlkem768_keygen_tests.exe -fi - -if [ -z $srcdir ]; then - srcdir=. -fi - -$TEST $srcdir/mlkem768_keygen_tests.txt diff --git a/tests/mlkem_tests.sh b/tests/mlkem_tests.sh new file mode 100755 index 0000000000..aaad199110 --- /dev/null +++ b/tests/mlkem_tests.sh @@ -0,0 +1,22 @@ +#!/bin/sh +set -e + +TEST=./mlkem_tests +if [ -e ./mlkem_tests.exe ]; then + TEST=./mlkem_tests.exe +fi + +if [ -z $srcdir ]; then + srcdir=. +fi + +$TEST mlkem768_decap_tests $srcdir/mlkem768_decap_tests.txt +$TEST mlkem768_encap_tests $srcdir/mlkem768_encap_tests.txt +$TEST mlkem768_keygen_tests $srcdir/mlkem768_keygen_tests.txt +$TEST mlkem768_nist_decap_tests $srcdir/mlkem768_nist_decap_tests.txt +$TEST mlkem768_nist_keygen_tests $srcdir/mlkem768_nist_keygen_tests.txt +$TEST mlkem1024_decap_tests $srcdir/mlkem1024_decap_tests.txt +$TEST mlkem1024_encap_tests $srcdir/mlkem1024_encap_tests.txt +$TEST mlkem1024_keygen_tests $srcdir/mlkem1024_keygen_tests.txt +$TEST mlkem1024_nist_decap_tests $srcdir/mlkem1024_nist_decap_tests.txt +$TEST mlkem1024_nist_keygen_tests $srcdir/mlkem1024_nist_keygen_tests.txt From c9e2499e24898a7eb918a77ec17b96ac53ea4eaa Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 26 Dec 2024 01:14:17 -0700 Subject: [PATCH 0930/1283] tb, you should know by now that windows has no __attribute__ --- patches/opensslfeatures.h.patch | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/patches/opensslfeatures.h.patch b/patches/opensslfeatures.h.patch index f5a1f875db..77df5dc5a9 100644 --- a/patches/opensslfeatures.h.patch +++ b/patches/opensslfeatures.h.patch @@ -25,3 +25,14 @@ #include #include #include +--- tests/parse_test_file.h.orig Thu Dec 26 01:13:00 2024 ++++ tests/parse_test_file.h Thu Dec 26 01:13:27 2024 +@@ -22,6 +22,8 @@ + #include + #include + ++#include ++ + #include "bytestring.h" + + #if defined(__cplusplus) From 6debfc0a84262849e1303ae1b4fd2ea25476460a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 26 Dec 2024 01:50:59 -0700 Subject: [PATCH 0931/1283] try to appease emscripten --- tests/mlkem_tests.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/mlkem_tests.sh b/tests/mlkem_tests.sh index aaad199110..2a9856ec23 100755 --- a/tests/mlkem_tests.sh +++ b/tests/mlkem_tests.sh @@ -4,6 +4,8 @@ set -e TEST=./mlkem_tests if [ -e ./mlkem_tests.exe ]; then TEST=./mlkem_tests.exe +elif [ -e ./mlkem_tests.js ]; then + TEST="node ./mlkem_tests.js" fi if [ -z $srcdir ]; then From feb5a0da1e50a9dca1678d02e16704ed9516853c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 27 Dec 2024 10:46:15 -0700 Subject: [PATCH 0932/1283] Update man links --- man/links | 2 ++ 1 file changed, 2 insertions(+) diff --git a/man/links b/man/links index 91945717ef..1c85c0c2f2 100644 --- a/man/links +++ b/man/links @@ -2352,6 +2352,8 @@ X509v3_get_ext_by_NID.3,X509v3_get_ext.3 X509v3_get_ext_by_NID.3,X509v3_get_ext_by_OBJ.3 X509v3_get_ext_by_NID.3,X509v3_get_ext_by_critical.3 X509v3_get_ext_by_NID.3,X509v3_get_ext_count.3 +a2i_ipadd.3,a2i_IPADDRESS.3 +a2i_ipadd.3,a2i_IPADDRESS_NC.3 bn_dump.3,bn_add_words.3 bn_dump.3,bn_div_words.3 bn_dump.3,bn_expand.3 From 8dad5fe3b9ed8f3e5fb468a98c8459769862bb35 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 2 Jan 2025 08:11:30 -0700 Subject: [PATCH 0933/1283] Update for speed.c and .h churn --- apps/openssl/Makefile.am | 5 ----- patches/openssl.c.patch | 6 +++--- patches/speed.c.patch | 27 ++++++++++++++------------- 3 files changed, 17 insertions(+), 21 deletions(-) diff --git a/apps/openssl/Makefile.am b/apps/openssl/Makefile.am index 810408d517..ee1b65b2bb 100644 --- a/apps/openssl/Makefile.am +++ b/apps/openssl/Makefile.am @@ -88,11 +88,6 @@ endif endif noinst_HEADERS = apps.h -noinst_HEADERS += progs.h -noinst_HEADERS += s_apps.h -noinst_HEADERS += testdsa.h -noinst_HEADERS += testrsa.h -noinst_HEADERS += timeouts.h EXTRA_DIST = CMakeLists.txt diff --git a/patches/openssl.c.patch b/patches/openssl.c.patch index 4e0887c39e..5ba5ac6664 100644 --- a/patches/openssl.c.patch +++ b/patches/openssl.c.patch @@ -1,6 +1,6 @@ ---- apps/openssl/openssl.c.orig Fri Aug 2 23:52:59 2024 -+++ apps/openssl/openssl.c Fri Aug 2 23:53:17 2024 -@@ -347,7 +347,9 @@ BIO *bio_err = NULL; +--- apps/openssl/openssl.c.orig Thu Jan 2 08:27:54 2025 ++++ apps/openssl/openssl.c Thu Jan 2 08:28:04 2025 +@@ -344,7 +344,9 @@ BIO *bio_err = NULL; static void openssl_startup(void) { diff --git a/patches/speed.c.patch b/patches/speed.c.patch index 8c79e0b587..e1f1698154 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -1,6 +1,6 @@ ---- apps/openssl/speed.c.orig Sat Dec 14 13:45:20 2024 -+++ apps/openssl/speed.c Sat Dec 14 13:46:47 2024 -@@ -161,7 +161,16 @@ static void +--- apps/openssl/speed.c.orig Thu Jan 2 08:04:28 2025 ++++ apps/openssl/speed.c Thu Jan 2 08:04:38 2025 +@@ -158,7 +158,16 @@ static void pkey_print_message(const char *str, const char *str2, long num, int bits, int sec); static void print_result(int alg, int run_no, int count, double time_used); @@ -17,7 +17,7 @@ #define ALGOR_NUM 32 #define SIZE_NUM 5 -@@ -424,8 +433,10 @@ speed_main(int argc, char **argv) +@@ -1129,8 +1138,10 @@ speed_main(int argc, char **argv) const EVP_CIPHER *evp_cipher = NULL; const EVP_MD *evp_md = NULL; int decrypt = 0; @@ -28,7 +28,7 @@ const char *errstr = NULL; if (pledge("stdio proc", NULL) == -1) { -@@ -500,6 +511,7 @@ speed_main(int argc, char **argv) +@@ -1205,6 +1216,7 @@ speed_main(int argc, char **argv) decrypt = 1; j--; /* Otherwise, -decrypt gets confused with an * algorithm. */ @@ -36,7 +36,7 @@ } else if (argc > 0 && strcmp(*argv, "-multi") == 0) { argc--; argv++; -@@ -514,6 +526,7 @@ speed_main(int argc, char **argv) +@@ -1219,6 +1231,7 @@ speed_main(int argc, char **argv) } j--; /* Otherwise, -multi gets confused with an * algorithm. */ @@ -44,7 +44,7 @@ } else if (argc > 0 && strcmp(*argv, "-unaligned") == 0) { argc--; argv++; -@@ -837,7 +850,9 @@ speed_main(int argc, char **argv) +@@ -1542,7 +1555,9 @@ speed_main(int argc, char **argv) BIO_printf(bio_err, "-evp e use EVP e.\n"); BIO_printf(bio_err, "-decrypt time decryption instead of encryption (only EVP).\n"); BIO_printf(bio_err, "-mr produce machine readable output.\n"); @@ -54,7 +54,7 @@ BIO_printf(bio_err, "-unaligned n use buffers with offset n from proper alignment.\n"); goto end; } -@@ -846,8 +861,10 @@ speed_main(int argc, char **argv) +@@ -1551,8 +1566,10 @@ speed_main(int argc, char **argv) j++; } @@ -65,7 +65,7 @@ if (j == 0) { for (i = 0; i < ALGOR_NUM; i++) { -@@ -919,11 +936,13 @@ speed_main(int argc, char **argv) +@@ -1624,11 +1641,13 @@ speed_main(int argc, char **argv) #define COND(c) (run && count<0x7fffffff) #define COUNT(d) (count) @@ -79,7 +79,7 @@ #ifndef OPENSSL_NO_MD4 if (doit[D_MD4]) { -@@ -1729,7 +1748,9 @@ speed_main(int argc, char **argv) +@@ -2434,7 +2453,9 @@ speed_main(int argc, char **argv) ecdh_doit[j] = 0; } } @@ -89,7 +89,7 @@ if (!mr) { fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION)); fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON)); -@@ -1885,11 +1906,15 @@ pkey_print_message(const char *str, const char *str2, +@@ -2590,11 +2611,15 @@ pkey_print_message(const char *str, const char *str2, static void print_result(int alg, int run_no, int count, double time_used) { @@ -105,9 +105,10 @@ static char * sstrsep(char **string, const char *delim) { -@@ -2090,4 +2115,5 @@ do_multi(int multi) +@@ -2795,5 +2820,6 @@ do_multi(int multi) free(fds); return 1; } +#endif - #endif + + #endif /* OPENSSL_NO_SPEED */ From 13207b6890d5cccc8a3401e9784c4799d2174896 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 4 Jan 2025 12:35:17 -0700 Subject: [PATCH 0934/1283] link rsa_method_test to build --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index ba8444e7fd..f4fd85dd6c 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -680,6 +680,11 @@ add_executable(rmd_test rmd_test.c) target_link_libraries(rmd_test ${OPENSSL_TEST_LIBS}) add_platform_test(rmd_test rmd_test) +# rsa_method_test +add_executable(rsa_method_test rsa_method_test.c) +target_link_libraries(rsa_method_test ${OPENSSL_TEST_LIBS}) +add_platform_test(rsa_method_test rsa_method_test) + # rsa_padding_test add_executable(rsa_padding_test rsa_padding_test.c) target_link_libraries(rsa_padding_test ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 55f0b70691..eeac7e19fd 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -710,6 +710,11 @@ TESTS += rmd_test check_PROGRAMS += rmd_test rmd_test_SOURCES = rmd_test.c +# rsa_method_test +TESTS += rsa_method_test +check_PROGRAMS += rsa_method_test +rsa_method_test_SOURCES = rsa_method_test.c + # rsa_padding_test TESTS += rsa_padding_test check_PROGRAMS += rsa_padding_test From 27f16a6d174fdaefc0202c99690c9eef44229b99 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 5 Jan 2025 09:41:27 -0700 Subject: [PATCH 0935/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index e6b1dbbc41..a80e25fc4e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -53,6 +53,8 @@ LibreSSL Portable Release Notes: - All elliptic curves over fields with less than 224 bits and a few more were removed from the built-in curves. This includes all WTLS curves and P-192. + - It is no longer necessary to set RSA_FLAG_SIGN_VER to use the + sign and verify handlers set with RSA_meth_set_{sign,verify}. * New features - libtls has a new tls_peer_cert_common_name() API call to retrieve the peer's common name without having to inspect the PEM. From 015ca8c41fd31d15ed7565d594822fc9f6069f46 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 6 Jan 2025 08:52:54 -0700 Subject: [PATCH 0936/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index a80e25fc4e..7156c8e90d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -45,6 +45,7 @@ LibreSSL Portable Release Notes: These make use of the SHA-NI instruction if it is available and replace the perl-generated assembly optimized for museum pieces. - Rewrote BN_bn2binpad() and its lebin siblings. + - The BIGNUMs in EC_GROUP and EC_POINT are now heap allocated. * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). From d502ec96ed7ced5b2bd908966ca02db7c4850541 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 7 Jan 2025 13:30:39 -0700 Subject: [PATCH 0937/1283] Update Changelog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 7156c8e90d..9a87ce5fb0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -46,6 +46,7 @@ LibreSSL Portable Release Notes: replace the perl-generated assembly optimized for museum pieces. - Rewrote BN_bn2binpad() and its lebin siblings. - The BIGNUMs in EC_GROUP and EC_POINT are now heap allocated. + - Rewrote TS_ASN1_INTEGER_print_bio(). * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). From 255f3158b432d5f01e7b00cbe823126db0db9455 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 9 Jan 2025 14:34:44 +0100 Subject: [PATCH 0938/1283] What happens on ubuntu-24.04? Actions have been issuing annoying warnings about ubuntu-24.04 becoming the default for ubuntu-latest for some definition of "soon". Let's see if we care. --- .github/workflows/android.yml | 2 +- .github/workflows/cifuzz.yml | 2 +- .github/workflows/cmake_config.yml | 2 +- .github/workflows/coverity.yml | 2 +- .github/workflows/emscripten.yml | 4 ++-- .github/workflows/fedora-rawhide.yml | 2 +- .github/workflows/freebsd.yml | 4 ++-- .github/workflows/linux.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/rust-openssl.yml | 2 +- .github/workflows/solaris.yml | 2 +- 11 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index d095d6d29d..7bc59c53ab 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -10,7 +10,7 @@ concurrency: jobs: test: name: "Test ${{ matrix.name }}" - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 permissions: contents: read strategy: diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index b93ea0e722..f994f99d10 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -9,7 +9,7 @@ concurrency: jobs: Fuzzing: - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - name: Build Fuzzers id: build diff --git a/.github/workflows/cmake_config.yml b/.github/workflows/cmake_config.yml index 931a26e8e6..f22622ccef 100644 --- a/.github/workflows/cmake_config.yml +++ b/.github/workflows/cmake_config.yml @@ -13,7 +13,7 @@ jobs: shell: bash strategy: matrix: - os: [windows-latest, macos-latest, ubuntu-latest] + os: [windows-latest, macos-latest, ubuntu-24.04] runs-on: ${{ matrix.os }} continue-on-error: false name: ${{ matrix.os }} diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 112678fd0d..8d0ad114fa 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -13,7 +13,7 @@ concurrency: jobs: scan: name: "Scan" - runs-on: "ubuntu-latest" + runs-on: "ubuntu-24.04" if: github.repository_owner == 'libressl' # Prevent running on forks permissions: contents: read diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml index 07f140d212..013480fa4e 100644 --- a/.github/workflows/emscripten.yml +++ b/.github/workflows/emscripten.yml @@ -14,7 +14,7 @@ concurrency: jobs: test: name: "Emscripten" - runs-on: "ubuntu-latest" + runs-on: "ubuntu-24.04" if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} permissions: contents: read @@ -42,7 +42,7 @@ jobs: # Test ASAN with and without ASM enabled. test-asan: name: "ASAN (no-asm)" - runs-on: "ubuntu-latest" + runs-on: "ubuntu-24.04" if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} permissions: contents: read diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index 4758d2f52b..0fbd993cf0 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -18,7 +18,7 @@ jobs: matrix: cc: [ gcc, clang ] name: ${{ matrix.cc }} - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} container: image: fedora:rawhide diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index 0aa64d8d33..850dbe2cc6 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -16,7 +16,7 @@ env: jobs: autoconf: name: "autoconf" - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 if: github.repository_owner == 'libressl' || github.event_name != 'schedule' permissions: contents: read @@ -43,7 +43,7 @@ jobs: cmake: name: "cmake" - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 if: github.repository_owner == 'libressl' || github.event_name != 'schedule' permissions: contents: read diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index af7dfabeab..23fa255577 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -48,7 +48,7 @@ jobs: # Test ASAN with and without ASM enabled. test-asan: name: "ASAN (${{ matrix.asm == 'ON' && 'asm' || 'no-asm' }})" - runs-on: "ubuntu-latest" + runs-on: "ubuntu-24.04" if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} permissions: contents: read diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8fe051ec08..c13592044f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,7 +15,7 @@ permissions: jobs: release: name: "Release" - runs-on: "ubuntu-latest" + runs-on: "ubuntu-24.04" outputs: upload_url: "${{ steps.create_release.outputs.upload_url }}" steps: diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index b707c4beb6..4ff41c00fb 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -13,7 +13,7 @@ concurrency: jobs: test: name: "Test" - runs-on: "ubuntu-latest" + runs-on: "ubuntu-24.04" if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} permissions: contents: read diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index f68a2aaf10..902e4887b6 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -13,7 +13,7 @@ concurrency: jobs: test: name: "Solaris" - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} permissions: contents: read From 7a9c5f18b56850ab53d76740d0a3710a7907746b Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Sat, 11 Jan 2025 20:25:23 +1100 Subject: [PATCH 0939/1283] ci: improve cmake config workflow --- .github/workflows/cmake-config.yml | 98 ++++++++++++++++++++++++++++++ .github/workflows/cmake_config.yml | 89 --------------------------- .gitignore | 1 + 3 files changed, 99 insertions(+), 89 deletions(-) create mode 100644 .github/workflows/cmake-config.yml delete mode 100644 .github/workflows/cmake_config.yml diff --git a/.github/workflows/cmake-config.yml b/.github/workflows/cmake-config.yml new file mode 100644 index 0000000000..3858773126 --- /dev/null +++ b/.github/workflows/cmake-config.yml @@ -0,0 +1,98 @@ +# GitHub Actions workflow to test CMake config. +name: "CMake Config" + +on: + push: {} + pull_request: {} + +concurrency: + group: "${{ github.workflow }}-${{ github.event.number || github.ref }}" + cancel-in-progress: true + +jobs: + check: + name: "Check (${{ matrix.os }})" + runs-on: "${{ matrix.os }}" + strategy: + fail-fast: true + matrix: + os: [ "windows-2022", "macos-14", "ubuntu-24.04" ] + defaults: + run: + shell: "bash" + permissions: + contents: read + steps: + - name: "Checkout repository" + uses: actions/checkout@v4 + + - name: "Setup Windows dependencies" + if: runner.os == 'Windows' + uses: msys2/setup-msys2@v2 + with: + update: true + install: >- + autoconf + automake + diffutils + libtool + gcc + git + patch + perl + + - name: "Setup macOS dependencies" + if: runner.os == 'macOS' + run: brew install automake libtool + + - name: "Prepare source tree for build (Windows)" + if: runner.os == 'Windows' + shell: "msys2 {0}" + run: ./autogen.sh + + - name: "Prepare source tree for build (Unix)" + if: runner.os != 'Windows' + run: ./autogen.sh + + - name: "Configure" + run: | + cmake -S . \ + -B build \ + -D CMAKE_BUILD_TYPE=Release \ + -D CMAKE_INSTALL_PREFIX=$GITHUB_WORKSPACE/../local + + - name: "Build" + run: cmake --build build --config Release --verbose + + - name: "Install" + run: cmake --install build --config Release + + - name: "Consume from the build directory - Configure" + run: | + cmake -S tests/cmake \ + -B consumer-build \ + -D CMAKE_BUILD_TYPE=Release \ + -D LibreSSL_DIR=$GITHUB_WORKSPACE/build + + - name: "Consume from the build directory - Build" + run: cmake --build consumer-build --config Release --verbose + + - name: "Consume from the install directory (CMAKE_PREFIX_PATH) - Configure" + run: | + cmake -S tests/cmake \ + -B consumer-install-prefix \ + -D CMAKE_BUILD_TYPE=Release \ + -D CMAKE_PREFIX_PATH=$GITHUB_WORKSPACE/../local + + - name: "Consume from the install directory (CMAKE_PREFIX_PATH) - Build" + run: cmake --build consumer-install-prefix --config Release --verbose + + - name: "Consume from the install directory (LibreSSL_DIR) - Configure" + run: | + cmake -S tests/cmake \ + -B consumer-install-dir \ + -D CMAKE_BUILD_TYPE=Release \ + -D LibreSSL_DIR=$GITHUB_WORKSPACE/../local/lib/cmake/LibreSSL + + - name: "Consume from the install directory (LibreSSL_DIR) - Build" + run: cmake --build consumer-install-dir --config Release --verbose diff --git a/.github/workflows/cmake_config.yml b/.github/workflows/cmake_config.yml deleted file mode 100644 index f22622ccef..0000000000 --- a/.github/workflows/cmake_config.yml +++ /dev/null @@ -1,89 +0,0 @@ -name: cmake_config - -on: [push, pull_request] - -concurrency: - group: "${{ github.workflow }}-${{ github.event.number || github.ref }}" - cancel-in-progress: true - -jobs: - cmake-check: - defaults: - run: - shell: bash - strategy: - matrix: - os: [windows-latest, macos-latest, ubuntu-24.04] - runs-on: ${{ matrix.os }} - continue-on-error: false - name: ${{ matrix.os }} - steps: - - name: Setup Windows dependencies - if: runner.os == 'Windows' - uses: msys2/setup-msys2@v2 - with: - update: true - install: >- - autoconf - automake - diffutils - libtool - gcc - git - patch - perl - - - name: Setup macOS dependencies - if: runner.os == 'macOS' - run: brew install automake libtool - - - uses: actions/checkout@v4 - - - name: Prepare source tree for build (Windows) - if: runner.os == 'Windows' - run: ./autogen.sh - shell: msys2 {0} - - - name: Prepare source tree for build (Unix) - if: runner.os != 'Windows' - run: ./autogen.sh - - - name: Configure - run: | - cmake -S . \ - -B build \ - -D CMAKE_BUILD_TYPE=Release \ - -D CMAKE_INSTALL_PREFIX=$GITHUB_WORKSPACE/../local - - - name: Build - run: cmake --build build --config Release --verbose - - - name: Install - run: cmake --install build --config Release - - - name: Consume from the build directory - Configure - run: | - cmake -S tests/cmake \ - -B consumer-build \ - -D CMAKE_BUILD_TYPE=Release \ - -D LibreSSL_DIR=$GITHUB_WORKSPACE/build - - name: Consume from the build directory - Build - run: cmake --build consumer-build --config Release --verbose - - - name: Consume from the install directory (CMAKE_PREFIX_PATH) - Configure - run: | - cmake -S tests/cmake \ - -B consumer-install-prefix \ - -D CMAKE_BUILD_TYPE=Release \ - -D CMAKE_PREFIX_PATH=$GITHUB_WORKSPACE/../local - - name: Consume from the install directory (CMAKE_PREFIX_PATH) - Build - run: cmake --build consumer-install-prefix --config Release --verbose - - - name: Consume from the install directory (LibreSSL_DIR) - Configure - run: | - cmake -S tests/cmake \ - -B consumer-install-dir \ - -D CMAKE_BUILD_TYPE=Release \ - -D LibreSSL_DIR=$GITHUB_WORKSPACE/../local/lib/cmake/LibreSSL - - name: Consume from the install directory (LibreSSL_DIR) - Build - run: cmake --build consumer-install-dir --config Release --verbose diff --git a/.gitignore b/.gitignore index 58172a13d8..9a562e70c1 100644 --- a/.gitignore +++ b/.gitignore @@ -39,6 +39,7 @@ Makefile.in # CMake stuff build +cmake-build-debug/ # Libtool stuff .libs From b8e4965e549c0c081c99ad6498174b0064c24448 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Sat, 11 Jan 2025 23:00:48 +1100 Subject: [PATCH 0940/1283] ci: change cmake workflow name to match others --- .github/workflows/cmake-config.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cmake-config.yml b/.github/workflows/cmake-config.yml index 3858773126..0988102b9f 100644 --- a/.github/workflows/cmake-config.yml +++ b/.github/workflows/cmake-config.yml @@ -1,5 +1,5 @@ -# GitHub Actions workflow to test CMake config. -name: "CMake Config" +# GitHub Actions workflow to check CMake config. +name: "CMake Check" on: push: {} @@ -11,7 +11,7 @@ concurrency: jobs: check: - name: "Check (${{ matrix.os }})" + name: "${{ matrix.os }}" runs-on: "${{ matrix.os }}" strategy: fail-fast: true From 33b33896d3b6001b1f6e551c6b45db24e5ec10a5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 11 Jan 2025 10:31:25 -0700 Subject: [PATCH 0941/1283] Update ChangeLog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 9a87ce5fb0..b194b02ffe 100644 --- a/ChangeLog +++ b/ChangeLog @@ -60,7 +60,7 @@ LibreSSL Portable Release Notes: * New features - libtls has a new tls_peer_cert_common_name() API call to retrieve the peer's common name without having to inspect the PEM. - - Imported ML-KEM 768 and 1024 from BoringSSL with matching API. + - Imported ML-KEM 768 and 1024 from BoringSSL. * Bug fixes - Plugged a leak in eckey_compute_pubkey(). * Testing and proactive security From c0b685916253b714ab26ea9faed4081e230f25dd Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 11 Jan 2025 16:36:05 -0700 Subject: [PATCH 0942/1283] Zap doubled word --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index b194b02ffe..4f10a1fd26 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,7 @@ Because this project is maintained both in the OpenBSD tree using CVS and in Git, it can be confusing following all of the changes. -Most of the libssl and libcrypto source code is is here in OpenBSD CVS: +Most of the libssl and libcrypto source code is here in OpenBSD CVS: https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/ From bb38a294f6032de2a5a710d3b6497eccf9fd6ab0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 19 Jan 2025 01:36:31 -0700 Subject: [PATCH 0943/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 4f10a1fd26..c77b7adb76 100644 --- a/ChangeLog +++ b/ChangeLog @@ -47,6 +47,7 @@ LibreSSL Portable Release Notes: - Rewrote BN_bn2binpad() and its lebin siblings. - The BIGNUMs in EC_GROUP and EC_POINT are now heap allocated. - Rewrote TS_ASN1_INTEGER_print_bio(). + - Improved bit counter handling in MD5. * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). @@ -63,6 +64,8 @@ LibreSSL Portable Release Notes: - Imported ML-KEM 768 and 1024 from BoringSSL. * Bug fixes - Plugged a leak in eckey_compute_pubkey(). + - Again allow the magic values -1, -2 and -3 for the salt length + of an RSA-PSS key in the EVP_PKEY_CTX_ctrl_str() interface. * Testing and proactive security - Improved regress coverage of the EC code. From d8830e43581a0cc7286a1f3d47df17d26ca38f9c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 19 Jan 2025 03:37:07 -0700 Subject: [PATCH 0944/1283] update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index c77b7adb76..f9439c050a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -58,6 +58,8 @@ LibreSSL Portable Release Notes: all WTLS curves and P-192. - It is no longer necessary to set RSA_FLAG_SIGN_VER to use the sign and verify handlers set with RSA_meth_set_{sign,verify}. + - Removed the -C option to generate "C code" from the openssl(1) + dh, dhparam, dsaparam, ecparam, and x509 subcommands. * New features - libtls has a new tls_peer_cert_common_name() API call to retrieve the peer's common name without having to inspect the PEM. From 055b96d6317c040c9010df2ed914443851513e32 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 21 Jan 2025 09:21:26 -0700 Subject: [PATCH 0945/1283] update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index f9439c050a..d9b7c1b50d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -48,6 +48,7 @@ LibreSSL Portable Release Notes: - The BIGNUMs in EC_GROUP and EC_POINT are now heap allocated. - Rewrote TS_ASN1_INTEGER_print_bio(). - Improved bit counter handling in MD5. + - Simplified and cleaned up the BN_RECP_CTX internals. * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). From 49aacfca015ccfc767dd4dbfe38cf7e88a354391 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 22 Jan 2025 09:47:09 -0700 Subject: [PATCH 0946/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index d9b7c1b50d..13fa7d0f7f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -49,6 +49,7 @@ LibreSSL Portable Release Notes: - Rewrote TS_ASN1_INTEGER_print_bio(). - Improved bit counter handling in MD5. - Simplified and cleaned up the BN_RECP_CTX internals. + - Improved SM4 to match other symmetric ciphers more closely. * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). From 7428e5554cf44e9606dc72ba65671da5e127fd22 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 22 Jan 2025 20:22:39 +0100 Subject: [PATCH 0947/1283] Disable MD5 ASM --- crypto/CMakeLists.txt | 8 -------- crypto/Makefile.am.elf-x86_64 | 2 -- crypto/Makefile.am.macosx-x86_64 | 2 -- crypto/Makefile.am.masm-x86_64 | 2 -- crypto/Makefile.am.mingw64-x86_64 | 2 -- update.sh | 1 - 6 files changed, 17 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 92a10baed5..c677c3a146 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -32,7 +32,6 @@ if(HOST_ASM_ELF_X86_64) bn/modexp512-elf-x86_64.S bn/mont-elf-x86_64.S bn/mont5-elf-x86_64.S - md5/md5-elf-x86_64.S modes/ghash-elf-x86_64.S rc4/rc4-elf-x86_64.S @@ -55,7 +54,6 @@ if(HOST_ASM_ELF_X86_64) add_definitions(-DOPENSSL_IA32_SSE2) add_definitions(-DOPENSSL_BN_ASM_MONT) add_definitions(-DOPENSSL_BN_ASM_MONT5) - add_definitions(-DMD5_ASM) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_ELF_SRC}) @@ -71,7 +69,6 @@ if(HOST_ASM_MACOSX_X86_64) bn/modexp512-macosx-x86_64.S bn/mont-macosx-x86_64.S bn/mont5-macosx-x86_64.S - md5/md5-macosx-x86_64.S modes/ghash-macosx-x86_64.S rc4/rc4-macosx-x86_64.S @@ -94,7 +91,6 @@ if(HOST_ASM_MACOSX_X86_64) add_definitions(-DOPENSSL_IA32_SSE2) add_definitions(-DOPENSSL_BN_ASM_MONT) add_definitions(-DOPENSSL_BN_ASM_MONT5) - add_definitions(-DMD5_ASM) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MACOSX_SRC}) @@ -111,7 +107,6 @@ if(HOST_ASM_MASM_X86_64) #bn/modexp512-masm-x86_64.S #bn/mont-masm-x86_64.S #bn/mont5-masm-x86_64.S - md5/md5-masm-x86_64.S modes/ghash-masm-x86_64.S rc4/rc4-masm-x86_64.S ) @@ -122,7 +117,6 @@ if(HOST_ASM_MASM_X86_64) add_definitions(-DOPENSSL_IA32_SSE2) #add_definitions(-DOPENSSL_BN_ASM_MONT) #add_definitions(-DOPENSSL_BN_ASM_MONT5) - add_definitions(-DMD5_ASM) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MASM_SRC}) @@ -139,7 +133,6 @@ if(HOST_ASM_MINGW64_X86_64) #bn/modexp512-mingw64-x86_64.S #bn/mont-mingw64-x86_64.S #bn/mont5-mingw64-x86_64.S - md5/md5-mingw64-x86_64.S modes/ghash-mingw64-x86_64.S rc4/rc4-mingw64-x86_64.S ) @@ -150,7 +143,6 @@ if(HOST_ASM_MINGW64_X86_64) add_definitions(-DOPENSSL_IA32_SSE2) #add_definitions(-DOPENSSL_BN_ASM_MONT) #add_definitions(-DOPENSSL_BN_ASM_MONT5) - add_definitions(-DMD5_ASM) add_definitions(-DGHASH_ASM) add_definitions(-DRSA_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MINGW64_SRC}) diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index 6feeb91f2c..c62662c792 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -6,7 +6,6 @@ ASM_X86_64_ELF += aes/aesni-elf-x86_64.S ASM_X86_64_ELF += bn/modexp512-elf-x86_64.S ASM_X86_64_ELF += bn/mont-elf-x86_64.S ASM_X86_64_ELF += bn/mont5-elf-x86_64.S -ASM_X86_64_ELF += md5/md5-elf-x86_64.S ASM_X86_64_ELF += modes/ghash-elf-x86_64.S ASM_X86_64_ELF += rc4/rc4-elf-x86_64.S @@ -32,7 +31,6 @@ libcrypto_la_CPPFLAGS += -DVPAES_ASM libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 -libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM libcrypto_la_SOURCES += $(ASM_X86_64_ELF) diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index d9df49a986..010e3be826 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -6,7 +6,6 @@ ASM_X86_64_MACOSX += aes/aesni-macosx-x86_64.S ASM_X86_64_MACOSX += bn/modexp512-macosx-x86_64.S ASM_X86_64_MACOSX += bn/mont-macosx-x86_64.S ASM_X86_64_MACOSX += bn/mont5-macosx-x86_64.S -ASM_X86_64_MACOSX += md5/md5-macosx-x86_64.S ASM_X86_64_MACOSX += modes/ghash-macosx-x86_64.S ASM_X86_64_MACOSX += rc4/rc4-macosx-x86_64.S @@ -32,7 +31,6 @@ libcrypto_la_CPPFLAGS += -DVPAES_ASM libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 -libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM libcrypto_la_SOURCES += $(ASM_X86_64_MACOSX) diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index 90641a7294..2ef7e1b638 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -6,7 +6,6 @@ ASM_X86_64_MASM += aes/aesni-masm-x86_64.S ASM_X86_64_MASM += bn/modexp512-masm-x86_64.S ASM_X86_64_MASM += bn/mont-masm-x86_64.S ASM_X86_64_MASM += bn/mont5-masm-x86_64.S -ASM_X86_64_MASM += md5/md5-masm-x86_64.S ASM_X86_64_MASM += modes/ghash-masm-x86_64.S ASM_X86_64_MASM += rc4/rc4-masm-x86_64.S @@ -19,7 +18,6 @@ libcrypto_la_CPPFLAGS += -DVPAES_ASM libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 -libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM libcrypto_la_SOURCES += $(ASM_X86_64_MASM) diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index ec40b9e4b1..8e39e9f745 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -6,7 +6,6 @@ ASM_X86_64_MINGW64 += aes/aesni-mingw64-x86_64.S #ASM_X86_64_MINGW64 += bn/modexp512-mingw64-x86_64.S #ASM_X86_64_MINGW64 += bn/mont-mingw64-x86_64.S #ASM_X86_64_MINGW64 += bn/mont5-mingw64-x86_64.S -ASM_X86_64_MINGW64 += md5/md5-mingw64-x86_64.S ASM_X86_64_MINGW64 += modes/ghash-mingw64-x86_64.S ASM_X86_64_MINGW64 += rc4/rc4-mingw64-x86_64.S @@ -20,7 +19,6 @@ libcrypto_la_CPPFLAGS += -DVPAES_ASM libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 #libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT #libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 -libcrypto_la_CPPFLAGS += -DMD5_ASM libcrypto_la_CPPFLAGS += -DGHASH_ASM libcrypto_la_CPPFLAGS += -DRSA_ASM libcrypto_la_SOURCES += $(ASM_X86_64_MINGW64) diff --git a/update.sh b/update.sh index 164f68f1dc..9636ee7e97 100755 --- a/update.sh +++ b/update.sh @@ -280,7 +280,6 @@ for abi in elf macosx masm mingw64; do gen_asm_stdout $abi bn/asm/modexp512-x86_64.pl bn/modexp512-$abi-x86_64.S gen_asm_stdout $abi bn/asm/x86_64-mont.pl bn/mont-$abi-x86_64.S gen_asm_stdout $abi bn/asm/x86_64-mont5.pl bn/mont5-$abi-x86_64.S - gen_asm_stdout $abi md5/asm/md5-x86_64.pl md5/md5-$abi-x86_64.S gen_asm_stdout $abi modes/asm/ghash-x86_64.pl modes/ghash-$abi-x86_64.S gen_asm_stdout $abi rc4/asm/rc4-x86_64.pl rc4/rc4-$abi-x86_64.S done From 63b31651802015069b531ccae1269e680e233a9d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 25 Jan 2025 08:39:20 -0700 Subject: [PATCH 0948/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 13fa7d0f7f..e7b9cf0088 100644 --- a/ChangeLog +++ b/ChangeLog @@ -44,6 +44,7 @@ LibreSSL Portable Release Notes: - New SHA-1, SHA-256 and SHA-512 assembly implementations for amd64. These make use of the SHA-NI instruction if it is available and replace the perl-generated assembly optimized for museum pieces. + - New simplified, readable MD5 implementation for amd64. - Rewrote BN_bn2binpad() and its lebin siblings. - The BIGNUMs in EC_GROUP and EC_POINT are now heap allocated. - Rewrote TS_ASN1_INTEGER_print_bio(). From 7e58cd8d51dbc517d562d11f256a8102fb04e748 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 25 Jan 2025 12:40:01 -0700 Subject: [PATCH 0949/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index e7b9cf0088..f1f4ecbde2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -63,6 +63,7 @@ LibreSSL Portable Release Notes: sign and verify handlers set with RSA_meth_set_{sign,verify}. - Removed the -C option to generate "C code" from the openssl(1) dh, dhparam, dsaparam, ecparam, and x509 subcommands. + - Removed #error in headers when OPENSSL_NO_* is defined. * New features - libtls has a new tls_peer_cert_common_name() API call to retrieve the peer's common name without having to inspect the PEM. From 5bbae88080d65f9e81ef31c28e356f202d3cb03a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 3 Feb 2025 21:59:49 +0100 Subject: [PATCH 0950/1283] Link renegotiation test to build --- .gitignore | 1 + tests/CMakeLists.txt | 12 ++++++++++++ tests/Makefile.am | 6 ++++++ tests/renegotiation_test.bat | 14 ++++++++++++++ tests/renegotiation_test.sh | 15 +++++++++++++++ 5 files changed, 48 insertions(+) create mode 100644 tests/renegotiation_test.bat create mode 100755 tests/renegotiation_test.sh diff --git a/.gitignore b/.gitignore index 9a562e70c1..aedfede24c 100644 --- a/.gitignore +++ b/.gitignore @@ -120,6 +120,7 @@ tests/mlkem* tests/mont* tests/parse* tests/policy* +tests/renegotiation_test* tests/rfc3779* tests/rfc5280time* tests/ssl_get_shared_ciphers* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index f4fd85dd6c..fde5406d7d 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -662,6 +662,18 @@ add_executable(record_layer_test record_layer_test.c) target_link_libraries(record_layer_test ${OPENSSL_TEST_LIBS}) add_platform_test(record_layer_test record_layer_test) +# renegotiation_test +set(RENEGOTIATION_TEST_SRC renegotiation_test.c) +add_executable(renegotiation_test ${RENEGOTIATION_TEST_SRC}) +target_link_libraries(renegotiation_test ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(renegotiation_test) +if(NOT MSVC) + add_test(NAME renegotiation_test COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/renegotiation_test.sh) +else() + add_test(NAME renegotiation_test COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/renegotiation_test.bat $) +endif() +set_tests_properties(renegotiation_test PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") + # rfc3779 add_executable(rfc3779 rfc3779.c) target_link_libraries(rfc3779 ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index eeac7e19fd..f3414f6508 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -688,6 +688,12 @@ TESTS += record_layer_test check_PROGRAMS += record_layer_test record_layer_test_SOURCES = record_layer_test.c +# renegotiation_test +TESTS += renegotiation_test.sh +check_PROGRAMS += renegotiation_test +renegotiation_test_SOURCES = renegotiation_test.c +EXTRA_DIST += renegotiation_test.sh renegotiation_test.bat + # rfc3779 TESTS += rfc3779 rfc3779_CPPFLAGS = $(AM_CPPFLAGS) diff --git a/tests/renegotiation_test.bat b/tests/renegotiation_test.bat new file mode 100644 index 0000000000..00860463cf --- /dev/null +++ b/tests/renegotiation_test.bat @@ -0,0 +1,14 @@ +@echo off +setlocal enabledelayedexpansion +REM renegotiation_test.bat + +set renegotiation_test_bin=%1 +set renegotiation_test_bin=%renegotiation_test_bin:/=\% +if not exist %renegotiation_test_bin% exit /b 1 + +%renegotiation_test_bin% %srcdir%\server1-rsa.pem %srcdir%\server1-rsa-chain.pem %srcdir%\ca-root-rsa.pem +if !errorlevel! neq 0 ( + exit /b 1 +) + +endlocal diff --git a/tests/renegotiation_test.sh b/tests/renegotiation_test.sh new file mode 100755 index 0000000000..bbf27c83c2 --- /dev/null +++ b/tests/renegotiation_test.sh @@ -0,0 +1,15 @@ +#!/bin/sh +set -e + +renegotiation_test_bin=./renegotiation_test +if [ -e ./renegotiation_test.exe ]; then + renegotiation_test_bin=./renegotiation_test.exe +elif [ -e ./renegotiation_test.js ]; then + renegotiation_test_bin="node ./renegotiation_test.js" +fi + +if [ -z $srcdir ]; then + srcdir=. +fi + +$renegotiation_test_bin $srcdir/server1-rsa.pem $srcdir/server1-rsa-chain.pem $srcdir/ca-root-rsa.pem From 1912261290c90bb2f7895986e7ac4d12e8226202 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 26 Jan 2025 13:47:50 -0700 Subject: [PATCH 0951/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index f1f4ecbde2..5ab671c337 100644 --- a/ChangeLog +++ b/ChangeLog @@ -51,6 +51,7 @@ LibreSSL Portable Release Notes: - Improved bit counter handling in MD5. - Simplified and cleaned up the BN_RECP_CTX internals. - Improved SM4 to match other symmetric ciphers more closely. + - Rewrote X509_NAME_oneline() and X509_NAME_print() using CBS/CBB. * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). From a7cdf136c5b06b60524c30a90fe92553ea38e6af Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 8 Feb 2025 10:19:49 -0700 Subject: [PATCH 0952/1283] Update ChangeLog --- ChangeLog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index 5ab671c337..ee3921133c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -52,11 +52,15 @@ LibreSSL Portable Release Notes: - Simplified and cleaned up the BN_RECP_CTX internals. - Improved SM4 to match other symmetric ciphers more closely. - Rewrote X509_NAME_oneline() and X509_NAME_print() using CBS/CBB. + - CRLs are now cached in the issuer cache like certificates. * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). - Elliptic curve parameters are only accepted if they encode a built-in curve. + - EC_METHOD is no longer public and the API exposing it has been + removed. This includes EC_GROUP_new(), EC_GFp_mont_method(), + EC_GROUP_get_method_of() and EC_METHOD_get_field_type(). - All elliptic curves over fields with less than 224 bits and a few more were removed from the built-in curves. This includes all WTLS curves and P-192. From cd24a5022fde422cbb99990d1c63fbe6aac7a9e3 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Wed, 12 Feb 2025 04:54:47 +1100 Subject: [PATCH 0953/1283] ci: remove use of ubuntu-20.04 runner image --- .github/workflows/linux.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 23fa255577..d57e3bca80 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -22,13 +22,10 @@ jobs: strategy: fail-fast: false matrix: - os: ["ubuntu-20.04", "ubuntu-22.04", "ubuntu-24.04"] + os: ["ubuntu-22.04", "ubuntu-24.04"] arch: ["native", "arm32", "arm64", "mingw32", "mingw64", "mips64"] compiler: ["gcc"] include: - - os: "ubuntu-20.04" - arch: "native" - compiler: "clang" - os: "ubuntu-22.04" arch: "native" compiler: "clang" From 90624c3b5e720d7185b68d225cd83da5cd7bafd7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 13 Feb 2025 16:11:59 -0700 Subject: [PATCH 0954/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index ee3921133c..355c3735ba 100644 --- a/ChangeLog +++ b/ChangeLog @@ -53,6 +53,8 @@ LibreSSL Portable Release Notes: - Improved SM4 to match other symmetric ciphers more closely. - Rewrote X509_NAME_oneline() and X509_NAME_print() using CBS/CBB. - CRLs are now cached in the issuer cache like certificates. + - Replaced combinations of BN_MONT_CTX_new/set with an internal + BN_MONT_CTX_create(). * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). From 01f74a0b4faf738605dece7ad826891effe0492a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 14 Feb 2025 05:11:33 -0700 Subject: [PATCH 0955/1283] Garbage collect SHA*ASM --- crypto/CMakeLists.txt | 3 --- crypto/Makefile.am.elf-arm | 3 --- crypto/Makefile.am.elf-mips | 3 --- crypto/Makefile.am.elf-mips64 | 3 --- 4 files changed, 12 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index c677c3a146..e642b01513 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -15,9 +15,6 @@ if(HOST_ASM_ELF_ARMV4) add_definitions(-DAES_ASM) add_definitions(-DOPENSSL_BN_ASM_MONT) add_definitions(-DGHASH_ASM) - add_definitions(-DSHA1_ASM) - add_definitions(-DSHA256_ASM) - add_definitions(-DSHA512_ASM) add_definitions(-DOPENSSL_CPUID_OBJ) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_ARMV4_ELF_SRC}) endif() diff --git a/crypto/Makefile.am.elf-arm b/crypto/Makefile.am.elf-arm index 4f88994d4f..6a9fa50485 100644 --- a/crypto/Makefile.am.elf-arm +++ b/crypto/Makefile.am.elf-arm @@ -13,9 +13,6 @@ if HOST_ASM_ELF_ARM libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DGHASH_ASM -libcrypto_la_CPPFLAGS += -DSHA1_ASM -libcrypto_la_CPPFLAGS += -DSHA256_ASM -libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ libcrypto_la_SOURCES += $(ASM_ARM_ELF) endif diff --git a/crypto/Makefile.am.elf-mips b/crypto/Makefile.am.elf-mips index ea0a730477..f7a44f20eb 100644 --- a/crypto/Makefile.am.elf-mips +++ b/crypto/Makefile.am.elf-mips @@ -10,8 +10,5 @@ EXTRA_DIST += $(ASM_MIPS_ELF) if HOST_ASM_ELF_MIPS libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT -libcrypto_la_CPPFLAGS += -DSHA1_ASM -libcrypto_la_CPPFLAGS += -DSHA256_ASM -libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_SOURCES += $(ASM_MIPS_ELF) endif diff --git a/crypto/Makefile.am.elf-mips64 b/crypto/Makefile.am.elf-mips64 index 8f851f37df..7d90bc0725 100644 --- a/crypto/Makefile.am.elf-mips64 +++ b/crypto/Makefile.am.elf-mips64 @@ -10,8 +10,5 @@ EXTRA_DIST += $(ASM_MIPS64_ELF) if HOST_ASM_ELF_MIPS64 libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT -libcrypto_la_CPPFLAGS += -DSHA1_ASM -libcrypto_la_CPPFLAGS += -DSHA256_ASM -libcrypto_la_CPPFLAGS += -DSHA512_ASM libcrypto_la_SOURCES += $(ASM_MIPS64_ELF) endif From a504575cb2aa8eb46ec77d4d6f7b0e189792e6f5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 14 Feb 2025 06:04:46 -0700 Subject: [PATCH 0956/1283] disable sha-asm on amd64 --- patches/crypto_arch.h.patch | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 patches/crypto_arch.h.patch diff --git a/patches/crypto_arch.h.patch b/patches/crypto_arch.h.patch new file mode 100644 index 0000000000..0c8766b4f8 --- /dev/null +++ b/patches/crypto_arch.h.patch @@ -0,0 +1,18 @@ +--- crypto/arch/amd64/crypto_arch.h.orig Fri Feb 14 06:00:43 2025 ++++ crypto/arch/amd64/crypto_arch.h Fri Feb 14 06:01:13 2025 +@@ -40,6 +40,7 @@ extern uint64_t crypto_cpu_caps_amd64; + #define HAVE_RC4_INTERNAL + #define HAVE_RC4_SET_KEY_INTERNAL + ++#if 0 + #define HAVE_SHA1_BLOCK_DATA_ORDER + #define HAVE_SHA1_BLOCK_GENERIC + +@@ -48,6 +49,7 @@ extern uint64_t crypto_cpu_caps_amd64; + + #define HAVE_SHA512_BLOCK_DATA_ORDER + #define HAVE_SHA512_BLOCK_GENERIC ++#endif + + #endif + From 6abe6be6c688a519aa5c4271b79a528d62c0a81d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 26 Feb 2025 04:18:23 -0700 Subject: [PATCH 0957/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 355c3735ba..81bc7b0c30 100644 --- a/ChangeLog +++ b/ChangeLog @@ -55,6 +55,9 @@ LibreSSL Portable Release Notes: - CRLs are now cached in the issuer cache like certificates. - Replaced combinations of BN_MONT_CTX_new/set with an internal BN_MONT_CTX_create(). + - Replaced BN_bn2hex() reimplementation in openssl(1) ca with + a poper API call. + - Fixed integer overflows due to signed shift in obj_dat.c. * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). From 849dbabf1543925a07ea003004e33a3af1684af6 Mon Sep 17 00:00:00 2001 From: Yang Kun <193369907+omikrun@users.noreply.github.com> Date: Tue, 4 Mar 2025 21:49:58 +0800 Subject: [PATCH 0958/1283] Fixes tests --- tests/CMakeLists.txt | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index fde5406d7d..fb0d16c715 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -568,7 +568,7 @@ add_platform_test(objectstest objectstest) if(ENABLE_EXTRATESTS) add_executable(ocsp_test ocsp_test.c) target_link_libraries(ocsp_test ${OPENSSL_TEST_LIBS}) - if(NOT MSVC) + if(NOT WIN32) add_test(NAME ocsptest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ocsptest.sh) else() add_test(NAME ocsptest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ocsptest.bat $) @@ -617,7 +617,7 @@ add_platform_test(policy policy) # pq_test add_executable(pq_test pq_test.c) target_link_libraries(pq_test ${OPENSSL_TEST_LIBS}) -if(NOT MSVC) +if(NOT WIN32) add_test(NAME pq_test COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/pq_test.sh) else() add_test(NAME pq_test COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/pq_test.bat @@ -630,7 +630,7 @@ set(QUICTEST_SRC quictest.c) add_executable(quictest ${QUICTEST_SRC}) target_link_libraries(quictest ${OPENSSL_TEST_LIBS}) prepare_emscripten_test_target(quictest) -if(NOT MSVC) +if(NOT WIN32) add_test(NAME quictest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/quictest.sh) else() add_test(NAME quictest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/quictest.bat $) @@ -713,7 +713,7 @@ add_platform_test(rsa_test rsa_test) add_executable(servertest servertest.c) target_link_libraries(servertest ${OPENSSL_TEST_LIBS}) prepare_emscripten_test_target(servertest) -if(NOT MSVC) +if(NOT WIN32) add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.sh) else() add_test(NAME servertest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/servertest.bat $) @@ -730,7 +730,7 @@ set(SHUTDOWNTEST_SRC shutdowntest.c) add_executable(shutdowntest ${SHUTDOWNTEST_SRC}) target_link_libraries(shutdowntest ${OPENSSL_TEST_LIBS}) prepare_emscripten_test_target(shutdowntest) -if(NOT MSVC) +if(NOT WIN32) add_test(NAME shutdowntest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/shutdowntest.sh) else() add_test(NAME shutdowntest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/shutdowntest.bat $) @@ -802,7 +802,7 @@ add_platform_test(ssl_versions ssl_versions) add_executable(ssltest ssltest.c) target_link_libraries(ssltest ${OPENSSL_TEST_LIBS}) prepare_emscripten_test_target(ssltest) -if(NOT MSVC) +if(NOT WIN32) add_test(NAME ssltest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssltest.sh) else() add_test(NAME ssltest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssltest.bat $ $) @@ -813,7 +813,7 @@ set_tests_properties(ssltest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # access various files for IO. Adding such files to --preload-file is infeasible. if(NOT EMSCRIPTEN) # testdsa - if(NOT MSVC) + if(NOT WIN32) add_test(NAME testdsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testdsa.sh) else() add_test(NAME testdsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testdsa.bat $) @@ -821,7 +821,7 @@ if(NOT EMSCRIPTEN) set_tests_properties(testdsa PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # testenc - if(NOT MSVC) + if(NOT WIN32) add_test(NAME testenc COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testenc.sh) else() add_test(NAME testenc COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testenc.bat $) @@ -829,7 +829,7 @@ if(NOT EMSCRIPTEN) set_tests_properties(testenc PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # testrsa - if(NOT MSVC) + if(NOT WIN32) add_test(NAME testrsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testrsa.sh) else() add_test(NAME testrsa COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/testrsa.bat $) @@ -866,7 +866,7 @@ if(NOT (CMAKE_SYSTEM_NAME MATCHES "WindowsStore" OR EMSCRIPTEN)) add_executable(tlstest ${TLSTEST_SRC}) target_link_libraries(tlstest ${LIBTLS_TEST_LIBS}) - if(NOT MSVC) + if(NOT WIN32) add_test(NAME tlstest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/tlstest.sh) else() add_test(NAME tlstest COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/tlstest.bat $) From ba862f26de792c4d8fde335a832103e77f8b2976 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 4 Mar 2025 07:22:29 -0700 Subject: [PATCH 0959/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 81bc7b0c30..3f654fa0ca 100644 --- a/ChangeLog +++ b/ChangeLog @@ -33,6 +33,7 @@ LibreSSL Portable Release Notes: * Portable changes - Fixed CMake builds on FreeBSD. - Fixed the --prefix option for cmake --install. + - Fixed tests for MinGW due to missing sh(1). * Internal improvements - Cleaned up the error implementation. - Many bug fixes and simplifications in the EC ASN.1 code. From c2fd12604f63b999a93962633a5a1f1af256cd42 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 7 Mar 2025 09:22:16 -0700 Subject: [PATCH 0960/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 3f654fa0ca..114a9ee914 100644 --- a/ChangeLog +++ b/ChangeLog @@ -45,6 +45,9 @@ LibreSSL Portable Release Notes: - New SHA-1, SHA-256 and SHA-512 assembly implementations for amd64. These make use of the SHA-NI instruction if it is available and replace the perl-generated assembly optimized for museum pieces. + These are not yet enabled in libressl-portable. + - New SHA-256 assembly implementation for aarch64 making use of the + ARM Cryptographic Extension (CE). Not yet enabled in portable. - New simplified, readable MD5 implementation for amd64. - Rewrote BN_bn2binpad() and its lebin siblings. - The BIGNUMs in EC_GROUP and EC_POINT are now heap allocated. From dcea629832b17bf47e238d71440a38f34cca10ad Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 7 Mar 2025 09:39:51 -0700 Subject: [PATCH 0961/1283] Disable SHA-256 asm for aarch64 --- patches/crypto_arch.h.patch | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/patches/crypto_arch.h.patch b/patches/crypto_arch.h.patch index 0c8766b4f8..6aa88917ee 100644 --- a/patches/crypto_arch.h.patch +++ b/patches/crypto_arch.h.patch @@ -16,3 +16,16 @@ #endif +--- crypto/arch/aarch64/crypto_arch.h.orig Fri Mar 7 09:38:13 2025 ++++ crypto/arch/aarch64/crypto_arch.h Fri Mar 7 09:38:22 2025 +@@ -33,8 +33,10 @@ extern uint64_t crypto_cpu_caps_aarch64; + #define CRYPTO_CPU_CAPS_AARCH64_SHA512 (1ULL << 4) + #define CRYPTO_CPU_CAPS_AARCH64_SHA3 (1ULL << 5) + ++#if 0 + #ifndef OPENSSL_NO_ASM + #define HAVE_SHA256_BLOCK_DATA_ORDER ++#endif + #endif + + #endif From 98f393f2fde555206eeb51a4b4242493a58bd94d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 9 Mar 2025 11:12:19 -0600 Subject: [PATCH 0962/1283] Fix -I lines for ec_asn1_test --- tests/CMakeLists.txt | 1 + tests/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index fb0d16c715..fa694cd935 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -8,6 +8,7 @@ include_directories( ../crypto/bn ../crypto/bytestring ../crypto/curve25519 + ../crypto/ec ../crypto/evp ../crypto/mlkem ../crypto/modes diff --git a/tests/Makefile.am b/tests/Makefile.am index f3414f6508..eea4a71061 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -12,6 +12,7 @@ AM_CPPFLAGS += -I $(top_srcdir)/crypto/bio AM_CPPFLAGS += -I $(top_srcdir)/crypto/bn AM_CPPFLAGS += -I $(top_srcdir)/crypto/bytestring AM_CPPFLAGS += -I $(top_srcdir)/crypto/curve25519 +AM_CPPFLAGS += -I $(top_srcdir)/crypto/ec AM_CPPFLAGS += -I $(top_srcdir)/crypto/evp AM_CPPFLAGS += -I $(top_srcdir)/crypto/mlkem AM_CPPFLAGS += -I $(top_srcdir)/crypto/modes From 6036e7ee86d21a7b7257ace02fa5c747aab000ea Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 9 Mar 2025 11:12:19 -0600 Subject: [PATCH 0963/1283] Update man links --- man/links | 26 +++++++------------------- 1 file changed, 7 insertions(+), 19 deletions(-) diff --git a/man/links b/man/links index 1c85c0c2f2..b1dbf82aa0 100644 --- a/man/links +++ b/man/links @@ -514,12 +514,6 @@ CONF_modules_free.3,CONF_modules_finish.3 CONF_modules_free.3,CONF_modules_unload.3 CONF_modules_load_file.3,CONF_modules_load.3 CONF_modules_load_file.3,X509_get_default_cert_area.3 -CRYPTO_get_mem_functions.3,CRYPTO_MEM_LEAK_CB.3 -CRYPTO_get_mem_functions.3,CRYPTO_mem_ctrl.3 -CRYPTO_get_mem_functions.3,CRYPTO_mem_leaks.3 -CRYPTO_get_mem_functions.3,CRYPTO_mem_leaks_cb.3 -CRYPTO_get_mem_functions.3,CRYPTO_mem_leaks_fp.3 -CRYPTO_get_mem_functions.3,CRYPTO_set_mem_functions.3 CRYPTO_lock.3,CRYPTO_add.3 CRYPTO_lock.3,CRYPTO_r_lock.3 CRYPTO_lock.3,CRYPTO_r_unlock.3 @@ -532,6 +526,11 @@ CRYPTO_set_ex_data.3,CRYPTO_free_ex_data.3 CRYPTO_set_ex_data.3,CRYPTO_get_ex_data.3 CRYPTO_set_ex_data.3,CRYPTO_get_ex_new_index.3 CRYPTO_set_ex_data.3,CRYPTO_new_ex_data.3 +CRYPTO_set_mem_functions.3,CRYPTO_MEM_LEAK_CB.3 +CRYPTO_set_mem_functions.3,CRYPTO_mem_ctrl.3 +CRYPTO_set_mem_functions.3,CRYPTO_mem_leaks.3 +CRYPTO_set_mem_functions.3,CRYPTO_mem_leaks_cb.3 +CRYPTO_set_mem_functions.3,CRYPTO_mem_leaks_fp.3 ChaCha.3,CRYPTO_chacha_20.3 ChaCha.3,CRYPTO_hchacha_20.3 ChaCha.3,CRYPTO_xchacha_20.3 @@ -645,8 +644,6 @@ ECDSA_SIG_new.3,ECDSA_size.3 ECDSA_SIG_new.3,ECDSA_verify.3 ECDSA_SIG_new.3,d2i_ECDSA_SIG.3 ECDSA_SIG_new.3,i2d_ECDSA_SIG.3 -EC_GFp_simple_method.3,EC_GFp_mont_method.3 -EC_GFp_simple_method.3,EC_METHOD_get_field_type.3 EC_GROUP_copy.3,EC_GROUP_check.3 EC_GROUP_copy.3,EC_GROUP_check_discriminant.3 EC_GROUP_copy.3,EC_GROUP_cmp.3 @@ -661,7 +658,6 @@ EC_GROUP_copy.3,EC_GROUP_get_degree.3 EC_GROUP_copy.3,EC_GROUP_get_order.3 EC_GROUP_copy.3,EC_GROUP_get_point_conversion_form.3 EC_GROUP_copy.3,EC_GROUP_get_seed_len.3 -EC_GROUP_copy.3,EC_GROUP_method_of.3 EC_GROUP_copy.3,EC_GROUP_order_bits.3 EC_GROUP_copy.3,EC_GROUP_set_asn1_flag.3 EC_GROUP_copy.3,EC_GROUP_set_curve_name.3 @@ -721,8 +717,6 @@ EC_KEY_new.3,EC_KEY_set_private_key.3 EC_KEY_new.3,EC_KEY_set_public_key.3 EC_KEY_new.3,EC_KEY_set_public_key_affine_coordinates.3 EC_KEY_new.3,EC_KEY_up_ref.3 -EC_POINT_add.3,EC_GROUP_have_precompute_mult.3 -EC_POINT_add.3,EC_GROUP_precompute_mult.3 EC_POINT_add.3,EC_POINT_cmp.3 EC_POINT_add.3,EC_POINT_dbl.3 EC_POINT_add.3,EC_POINT_invert.3 @@ -730,23 +724,18 @@ EC_POINT_add.3,EC_POINT_is_at_infinity.3 EC_POINT_add.3,EC_POINT_is_on_curve.3 EC_POINT_add.3,EC_POINT_make_affine.3 EC_POINT_add.3,EC_POINT_mul.3 -EC_POINT_add.3,EC_POINTs_make_affine.3 -EC_POINT_add.3,EC_POINTs_mul.3 EC_POINT_new.3,EC_POINT_bn2point.3 EC_POINT_new.3,EC_POINT_clear_free.3 EC_POINT_new.3,EC_POINT_copy.3 EC_POINT_new.3,EC_POINT_dup.3 EC_POINT_new.3,EC_POINT_free.3 -EC_POINT_new.3,EC_POINT_get_Jprojective_coordinates_GFp.3 EC_POINT_new.3,EC_POINT_get_affine_coordinates.3 EC_POINT_new.3,EC_POINT_get_affine_coordinates_GFp.3 EC_POINT_new.3,EC_POINT_hex2point.3 -EC_POINT_new.3,EC_POINT_method_of.3 EC_POINT_new.3,EC_POINT_oct2point.3 EC_POINT_new.3,EC_POINT_point2bn.3 EC_POINT_new.3,EC_POINT_point2hex.3 EC_POINT_new.3,EC_POINT_point2oct.3 -EC_POINT_new.3,EC_POINT_set_Jprojective_coordinates_GFp.3 EC_POINT_new.3,EC_POINT_set_affine_coordinates.3 EC_POINT_new.3,EC_POINT_set_affine_coordinates_GFp.3 EC_POINT_new.3,EC_POINT_set_compressed_coordinates.3 @@ -1958,6 +1947,7 @@ X25519.3,ED25519_sign.3 X25519.3,ED25519_verify.3 X25519.3,X25519_keypair.3 X509V3_EXT_get_nid.3,X509V3_EXT_get.3 +X509V3_EXT_print.3,X509V3_EXT_print_fp.3 X509V3_get_d2i.3,X509V3_EXT_d2i.3 X509V3_get_d2i.3,X509V3_EXT_i2d.3 X509V3_get_d2i.3,X509V3_add1_i2d.3 @@ -2012,6 +2002,7 @@ X509_EXTENSION_set_object.3,X509_EXTENSION_get_object.3 X509_EXTENSION_set_object.3,X509_EXTENSION_new.3 X509_EXTENSION_set_object.3,X509_EXTENSION_set_critical.3 X509_EXTENSION_set_object.3,X509_EXTENSION_set_data.3 +X509_EXTENSION_set_object.3,X509_supported_extension.3 X509_INFO_new.3,X509_INFO_free.3 X509_LOOKUP_hash_dir.3,X509_LOOKUP_file.3 X509_LOOKUP_hash_dir.3,X509_LOOKUP_mem.3 @@ -2049,17 +2040,14 @@ X509_NAME_hash.3,X509_subject_name_hash.3 X509_NAME_hash.3,X509_subject_name_hash_old.3 X509_NAME_new.3,X509_NAME_free.3 X509_NAME_print_ex.3,X509_NAME_oneline.3 -X509_NAME_print_ex.3,X509_NAME_print.3 X509_NAME_print_ex.3,X509_NAME_print_ex_fp.3 X509_OBJECT_get0_X509.3,X509_OBJECT_free.3 -X509_OBJECT_get0_X509.3,X509_OBJECT_free_contents.3 X509_OBJECT_get0_X509.3,X509_OBJECT_get0_X509_CRL.3 X509_OBJECT_get0_X509.3,X509_OBJECT_get_type.3 X509_OBJECT_get0_X509.3,X509_OBJECT_idx_by_subject.3 X509_OBJECT_get0_X509.3,X509_OBJECT_new.3 X509_OBJECT_get0_X509.3,X509_OBJECT_retrieve_by_subject.3 X509_OBJECT_get0_X509.3,X509_OBJECT_retrieve_match.3 -X509_OBJECT_get0_X509.3,X509_OBJECT_up_ref_count.3 X509_PKEY_new.3,X509_PKEY_free.3 X509_PUBKEY_new.3,X509_PUBKEY_free.3 X509_PUBKEY_new.3,X509_PUBKEY_get.3 From ccc254e9a415f1ef73ddc682ec510e7dd03b815d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 9 Mar 2025 11:31:39 -0600 Subject: [PATCH 0964/1283] Fix UI_OpenSSL for Windows --- crypto/compat/ui_openssl_win.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/crypto/compat/ui_openssl_win.c b/crypto/compat/ui_openssl_win.c index 09705e48d9..4ae2c5dbc6 100644 --- a/crypto/compat/ui_openssl_win.c +++ b/crypto/compat/ui_openssl_win.c @@ -146,7 +146,7 @@ static int echo_console(UI *ui); static int noecho_console(UI *ui); static int close_console(UI *ui); -static UI_METHOD ui_openssl = { +static const UI_METHOD ui_openssl = { .name = "OpenSSL default user interface", .ui_open_session = open_console, .ui_write_string = write_string, @@ -155,7 +155,7 @@ static UI_METHOD ui_openssl = { }; /* The method with all the built-in thingies */ -UI_METHOD * +const UI_METHOD * UI_OpenSSL(void) { return &ui_openssl; From 8a536f8311efa472f0db53f9dddd3d5e59fb6dcf Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 11 Mar 2025 11:57:54 -0600 Subject: [PATCH 0965/1283] Update ChangeLog --- ChangeLog | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 114a9ee914..fb57ec753b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -78,10 +78,21 @@ LibreSSL Portable Release Notes: - Removed the -C option to generate "C code" from the openssl(1) dh, dhparam, dsaparam, ecparam, and x509 subcommands. - Removed #error in headers when OPENSSL_NO_* is defined. + - EC_METHOD is no longer public and all public API directly using + it was removed. This includes EC_GROUP_new(), EC_GFp_mont_method() + EC_{GROUP,POINT}_method_of() and EC_METHOD_get_field_type(). + - The precomputation stubs for EC_GROUP were removed. + - The API setting Jacobian projective coordinates for a point was + removed as were EC_POINTs_{mul,make_affine}(). + - CRYPTO_set_mem_functions() now matches OpenSSL 1.1 and + CRYPTO_set_mem_ex_functions() was removed. + - X509_NAME_print() and X509_OBJECT_up_ref_count() are no longer public. + - const corrected UI_OpenSSL() and BN_MONT_CTX_copy(). + - Support OPENSSL_NO_FILENAMES. * New features - libtls has a new tls_peer_cert_common_name() API call to retrieve the peer's common name without having to inspect the PEM. - - Imported ML-KEM 768 and 1024 from BoringSSL. + - Imported ML-KEM 768 and 1024 from BoringSSL (not yet public API). * Bug fixes - Plugged a leak in eckey_compute_pubkey(). - Again allow the magic values -1, -2 and -3 for the salt length From 8d3e8a1f3cb05d968b7bda605b9fe8ad606cba12 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 13 Mar 2025 05:51:23 -0500 Subject: [PATCH 0966/1283] rebase aarch64 crypto_arch.h patch --- patches/crypto_arch.h.patch | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/patches/crypto_arch.h.patch b/patches/crypto_arch.h.patch index 6aa88917ee..6c889e5899 100644 --- a/patches/crypto_arch.h.patch +++ b/patches/crypto_arch.h.patch @@ -16,15 +16,18 @@ #endif ---- crypto/arch/aarch64/crypto_arch.h.orig Fri Mar 7 09:38:13 2025 -+++ crypto/arch/aarch64/crypto_arch.h Fri Mar 7 09:38:22 2025 -@@ -33,8 +33,10 @@ extern uint64_t crypto_cpu_caps_aarch64; +--- crypto/arch/aarch64/crypto_arch.h.orig Thu Mar 13 05:42:37 2025 ++++ crypto/arch/aarch64/crypto_arch.h Thu Mar 13 05:47:39 2025 +@@ -33,11 +33,13 @@ #define CRYPTO_CPU_CAPS_AARCH64_SHA512 (1ULL << 4) #define CRYPTO_CPU_CAPS_AARCH64_SHA3 (1ULL << 5) +#if 0 #ifndef OPENSSL_NO_ASM + #define HAVE_SHA256_BLOCK_DATA_ORDER + #define HAVE_SHA512_BLOCK_DATA_ORDER + +#endif #endif From 917db9a8b79e3e4a55e315e65a7aa9451c050c07 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 11 Feb 2025 11:05:37 -0700 Subject: [PATCH 0967/1283] Update ChangeLog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index fb57ec753b..eccb261934 100644 --- a/ChangeLog +++ b/ChangeLog @@ -69,7 +69,7 @@ LibreSSL Portable Release Notes: built-in curve. - EC_METHOD is no longer public and the API exposing it has been removed. This includes EC_GROUP_new(), EC_GFp_mont_method(), - EC_GROUP_get_method_of() and EC_METHOD_get_field_type(). + EC_GROUP_method_of() and EC_METHOD_get_field_type(). - All elliptic curves over fields with less than 224 bits and a few more were removed from the built-in curves. This includes all WTLS curves and P-192. From 681944a75c608a1379e7bab68f6901b5988056e7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 15 Mar 2025 04:02:10 -0600 Subject: [PATCH 0968/1283] hook x509_name_test to build --- .gitignore | 1 + tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 3 files changed, 11 insertions(+) diff --git a/.gitignore b/.gitignore index aedfede24c..14917f9f77 100644 --- a/.gitignore +++ b/.gitignore @@ -144,6 +144,7 @@ tests/x509_algor* tests/x509_asn1* tests/x509_extensions_test* tests/x509_info* +tests/x509_name_test* tests/x509attribute* tests/x509name* tests/x509req_ext* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index fa694cd935..8d6fa9d913 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -931,6 +931,11 @@ add_executable(x509_info x509_info.c) target_link_libraries(x509_info ${OPENSSL_TEST_LIBS}) add_platform_test(x509_info x509_info) +# x509_name_test +add_executable(x509_name_test x509_name_test.c) +target_link_libraries(x509_name_test ${OPENSSL_TEST_LIBS}) +add_platform_test(x509_name_test x509_name_test) + # x509name add_executable(x509name x509name.c) target_link_libraries(x509name ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index eea4a71061..8153fc921e 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -910,6 +910,11 @@ TESTS += x509_info check_PROGRAMS += x509_info x509_info_SOURCES = x509_info.c +# x509_name_test +TESTS += x509_name_test +check_PROGRAMS += x509_name_test +x509_name_test_SOURCES = x509_name_test.c + # x509name TESTS += x509name check_PROGRAMS += x509name From 97e1c7d1f651fff98f7624ff4ba53eac58febc07 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 19 Mar 2025 12:21:05 -0600 Subject: [PATCH 0969/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index eccb261934..a697383b4a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -89,6 +89,7 @@ LibreSSL Portable Release Notes: - X509_NAME_print() and X509_OBJECT_up_ref_count() are no longer public. - const corrected UI_OpenSSL() and BN_MONT_CTX_copy(). - Support OPENSSL_NO_FILENAMES. + - Support SSL_OP_NO_RENEGOTIATION and SSL_OP_ALLOW_CLIENT_RENEGOTIATION. * New features - libtls has a new tls_peer_cert_common_name() API call to retrieve the peer's common name without having to inspect the PEM. From 730988166ec0df6f1f371b0e2c615495dc9113a5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 26 Mar 2025 02:57:37 -0600 Subject: [PATCH 0970/1283] Update ChangeLog --- ChangeLog | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index a697383b4a..02f448c5f5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -46,8 +46,9 @@ LibreSSL Portable Release Notes: These make use of the SHA-NI instruction if it is available and replace the perl-generated assembly optimized for museum pieces. These are not yet enabled in libressl-portable. - - New SHA-256 assembly implementation for aarch64 making use of the - ARM Cryptographic Extension (CE). Not yet enabled in portable. + - New SHA-256 and SHA-512 assembly implementations for aarch64 + making use of the ARM Cryptographic Extension (CE). Not yet + enabled in libressl-portable. - New simplified, readable MD5 implementation for amd64. - Rewrote BN_bn2binpad() and its lebin siblings. - The BIGNUMs in EC_GROUP and EC_POINT are now heap allocated. From 16db162e6c571138f0bb2f87bf225ba46baef1bb Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 31 Mar 2025 20:26:55 -0600 Subject: [PATCH 0971/1283] add gawk to fedora-rawhide workflow --- .github/workflows/fedora-rawhide.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index 0fbd993cf0..dff4b6a54e 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -26,7 +26,7 @@ jobs: - uses: actions/checkout@v4 - name: Install dependencies run: | - dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch + dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk - name: Pull upstream source run: | ./update.sh From 441cacf1b7f5b855278fcf01e35b0f65f2db76fb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mustafa=20G=C3=B6k=C3=A7e?= <48911620+mustafa-gokce@users.noreply.github.com> Date: Mon, 7 Apr 2025 13:30:02 +0300 Subject: [PATCH 0972/1283] Fix no pointer sign warning on C++ compilers --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 437570b9f3..ea0e7e5606 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -131,7 +131,7 @@ add_definitions(-D__END_HIDDEN_DECLS=) set(CMAKE_POSITION_INDEPENDENT_CODE true) if (CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang") - add_definitions(-Wno-pointer-sign) + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-pointer-sign") endif() if(WIN32) From 031c2f1722f9af10299de3d22ff3c1467d541241 Mon Sep 17 00:00:00 2001 From: "Ivan A. Melnikov" Date: Thu, 10 Apr 2025 17:09:19 +0400 Subject: [PATCH 0973/1283] Basic loongarch64 support Just wire things up to make the project buildable on LoongArch64. opensslconf.h is taken form riscv64 folder as is, and is the same as on some other 64 bit architectures. Refs: https://github.com/libressl/portable/issues/1123 Signed-off-by: Ivan A. Melnikov --- CMakeLists.txt | 2 + configure.ac | 21 ++-- crypto/CMakeLists.txt | 3 + crypto/Makefile.am | 7 ++ crypto/arch/loongarch64/crypto_arch.h | 21 ++++ crypto/bn/arch/loongarch64/bn_arch.h | 23 ++++ include/CMakeLists.txt | 2 + include/arch/loongarch64/opensslconf.h | 154 +++++++++++++++++++++++++ include/openssl/Makefile.am.tpl | 3 + ssl/CMakeLists.txt | 2 + ssl/Makefile.am | 5 + tests/CMakeLists.txt | 2 + tests/Makefile.am | 4 + 13 files changed, 239 insertions(+), 10 deletions(-) create mode 100644 crypto/arch/loongarch64/crypto_arch.h create mode 100644 crypto/bn/arch/loongarch64/bn_arch.h create mode 100644 include/arch/loongarch64/opensslconf.h diff --git a/CMakeLists.txt b/CMakeLists.txt index 437570b9f3..3673922f03 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -389,6 +389,8 @@ elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|amd64|AMD64)") elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(i[3-6]86|[xX]86)") set(ENABLE_ASM false) set(HOST_I386 true) +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "loongarch64") + set(HOST_LOONGARCH64 true) elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "mips64") set(HOST_MIPS64 true) elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "mips") diff --git a/configure.ac b/configure.ac index 864a4ad8fc..7a88f27a66 100644 --- a/configure.ac +++ b/configure.ac @@ -86,16 +86,17 @@ AS_CASE([$host_cpu], ) AM_CONDITIONAL([HOST_CPU_IS_INTEL], [test "x$HOSTARCH" = "xintel"]) -AM_CONDITIONAL([HOST_AARCH64], [test "$host_cpu" = "aarch64"]) -AM_CONDITIONAL([HOST_ARM], [test "$host_cpu" = "arm"]) -AM_CONDITIONAL([HOST_I386], [test "$host_cpu" = "i386"]) -AM_CONDITIONAL([HOST_MIPS], [test "$host_cpu" = "mips"]) -AM_CONDITIONAL([HOST_MIPS64], [test "$host_cpu" = "mips64"]) -AM_CONDITIONAL([HOST_POWERPC], [test "$host_cpu" = "powerpc"]) -AM_CONDITIONAL([HOST_POWERPC64], [test "$host_cpu" = "ppc64"]) -AM_CONDITIONAL([HOST_RISCV64], [test "$host_cpu" = "riscv64"]) -AM_CONDITIONAL([HOST_SPARC64], [test "$host_cpu" = "sparc64"]) -AM_CONDITIONAL([HOST_X86_64], [test "$host_cpu" = "x86_64"]) +AM_CONDITIONAL([HOST_AARCH64], [test "$host_cpu" = "aarch64"]) +AM_CONDITIONAL([HOST_ARM], [test "$host_cpu" = "arm"]) +AM_CONDITIONAL([HOST_I386], [test "$host_cpu" = "i386"]) +AM_CONDITIONAL([HOST_LOONGARCH64], [test "$host_cpu" = "loongarch64"]) +AM_CONDITIONAL([HOST_MIPS], [test "$host_cpu" = "mips"]) +AM_CONDITIONAL([HOST_MIPS64], [test "$host_cpu" = "mips64"]) +AM_CONDITIONAL([HOST_POWERPC], [test "$host_cpu" = "powerpc"]) +AM_CONDITIONAL([HOST_POWERPC64], [test "$host_cpu" = "ppc64"]) +AM_CONDITIONAL([HOST_RISCV64], [test "$host_cpu" = "riscv64"]) +AM_CONDITIONAL([HOST_SPARC64], [test "$host_cpu" = "sparc64"]) +AM_CONDITIONAL([HOST_X86_64], [test "$host_cpu" = "x86_64"]) AC_MSG_CHECKING([if .gnu.warning accepts long strings]) AC_LINK_IFELSE([AC_LANG_SOURCE([[ diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index e642b01513..a714059b96 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -774,6 +774,9 @@ elseif(HOST_ARM) elseif(HOST_I386) target_include_directories(crypto_obj PRIVATE arch/i386/) target_include_directories(crypto_obj PRIVATE bn/arch/i386/) +elseif(HOST_LOONGARCH64) + target_include_directories(crypto_obj PRIVATE arch/loongarch64) + target_include_directories(crypto_obj PRIVATE bn/arch/loongarch64) elseif(HOST_MIPS64) target_include_directories(crypto_obj PRIVATE arch/mips64) target_include_directories(crypto_obj PRIVATE bn/arch/mips64) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 438da8bbf3..09524946f4 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -396,6 +396,13 @@ endif noinst_HEADERS += arch/i386/crypto_arch.h noinst_HEADERS += bn/arch/i386/bn_arch.h +if HOST_LOONGARCH64 +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/loongarch64/ +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/loongarch64/ +endif +noinst_HEADERS += arch/loongarch64/crypto_arch.h +noinst_HEADERS += bn/arch/loongarch64/bn_arch.h + # XXX - do we still need this? if HOST_MIPS libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/mips/ diff --git a/crypto/arch/loongarch64/crypto_arch.h b/crypto/arch/loongarch64/crypto_arch.h new file mode 100644 index 0000000000..a3dd98d0ce --- /dev/null +++ b/crypto/arch/loongarch64/crypto_arch.h @@ -0,0 +1,21 @@ +/* $OpenBSD: crypto_arch.h,v 1.1 2024/08/11 13:02:39 jsing Exp $ */ +/* + * Copyright (c) 2024 Joel Sing + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef HEADER_CRYPTO_ARCH_H +#define HEADER_CRYPTO_ARCH_H + +#endif diff --git a/crypto/bn/arch/loongarch64/bn_arch.h b/crypto/bn/arch/loongarch64/bn_arch.h new file mode 100644 index 0000000000..672ac12028 --- /dev/null +++ b/crypto/bn/arch/loongarch64/bn_arch.h @@ -0,0 +1,23 @@ +/* $OpenBSD: bn_arch.h,v 1.7 2023/07/09 10:37:32 jsing Exp $ */ +/* + * Copyright (c) 2023 Joel Sing + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#include + +#ifndef HEADER_BN_ARCH_H +#define HEADER_BN_ARCH_H + +#endif diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt index 59f5b62adc..11ab7c2d58 100644 --- a/include/CMakeLists.txt +++ b/include/CMakeLists.txt @@ -24,6 +24,8 @@ elseif(HOST_ARM) file(READ arch/arm/opensslconf.h OPENSSLCONF) elseif(HOST_I386) file(READ arch/i386/opensslconf.h OPENSSLCONF) +elseif(HOST_LOONGARCH64) + file(READ arch/loongarch64/opensslconf.h OPENSSLCONF) elseif(HOST_MIPS) file(READ arch/mips/opensslconf.h OPENSSLCONF) elseif(HOST_MIPS64) diff --git a/include/arch/loongarch64/opensslconf.h b/include/arch/loongarch64/opensslconf.h new file mode 100644 index 0000000000..731b06aecc --- /dev/null +++ b/include/arch/loongarch64/opensslconf.h @@ -0,0 +1,154 @@ +#include +/* crypto/opensslconf.h.in */ + +#if defined(HEADER_CRYPTO_LOCAL_H) && !defined(OPENSSLDIR) +#define OPENSSLDIR "/etc/ssl" +#endif + +#undef OPENSSL_EXPORT_VAR_AS_FUNCTION + +#ifndef OPENSSL_FILE +#ifdef OPENSSL_NO_FILENAMES +#define OPENSSL_FILE "" +#define OPENSSL_LINE 0 +#else +#define OPENSSL_FILE __FILE__ +#define OPENSSL_LINE __LINE__ +#endif +#endif + +#if defined(HEADER_IDEA_H) && !defined(IDEA_INT) +#define IDEA_INT unsigned int +#endif + +#if defined(HEADER_MD2_H) && !defined(MD2_INT) +#define MD2_INT unsigned int +#endif + +#if defined(HEADER_RC2_H) && !defined(RC2_INT) +/* I need to put in a mod for the alpha - eay */ +#define RC2_INT unsigned int +#endif + +#if defined(HEADER_RC4_H) +#if !defined(RC4_INT) +/* using int types make the structure larger but make the code faster + * on most boxes I have tested - up to %20 faster. */ +/* + * I don't know what does "most" mean, but declaring "int" is a must on: + * - Intel P6 because partial register stalls are very expensive; + * - elder Alpha because it lacks byte load/store instructions; + */ +#define RC4_INT unsigned int +#endif +#if !defined(RC4_CHUNK) +/* + * This enables code handling data aligned at natural CPU word + * boundary. See crypto/rc4/rc4_enc.c for further details. + */ +#define RC4_CHUNK unsigned long +#endif +#endif + +#if (defined(HEADER_NEW_DES_H) || defined(HEADER_DES_H)) && !defined(DES_LONG) +/* If this is set to 'unsigned int' on a DEC Alpha, this gives about a + * %20 speed up (longs are 8 bytes, int's are 4). */ +#ifndef DES_LONG +#define DES_LONG unsigned int +#endif +#endif + +#if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H) +#define CONFIG_HEADER_BN_H +#undef BN_LLONG + +/* Should we define BN_DIV2W here? */ + +/* Only one for the following should be defined */ +/* The prime number generation stuff may not work when + * EIGHT_BIT but I don't care since I've only used this mode + * for debugging the bignum libraries */ +#define SIXTY_FOUR_BIT_LONG +#undef SIXTY_FOUR_BIT +#undef THIRTY_TWO_BIT +#undef SIXTEEN_BIT +#undef EIGHT_BIT +#endif + +#if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H) +#define CONFIG_HEADER_BF_LOCL_H +#undef BF_PTR +#endif /* HEADER_BF_LOCL_H */ + +#if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H) +#define CONFIG_HEADER_DES_LOCL_H +#ifndef DES_DEFAULT_OPTIONS +/* the following is tweaked from a config script, that is why it is a + * protected undef/define */ +#ifndef DES_PTR +#undef DES_PTR +#endif + +/* This helps C compiler generate the correct code for multiple functional + * units. It reduces register dependencies at the expense of 2 more + * registers */ +#ifndef DES_RISC1 +#undef DES_RISC1 +#endif + +#ifndef DES_RISC2 +#undef DES_RISC2 +#endif + +#if defined(DES_RISC1) && defined(DES_RISC2) +YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!! +#endif + +/* Unroll the inner loop, this sometimes helps, sometimes hinders. + * Very much CPU dependent */ +#ifndef DES_UNROLL +#define DES_UNROLL +#endif + +/* These default values were supplied by + * Peter Gutman + * They are only used if nothing else has been defined */ +#if !defined(DES_PTR) && !defined(DES_RISC1) && !defined(DES_RISC2) && !defined(DES_UNROLL) +/* Special defines which change the way the code is built depending on the + CPU and OS. For SGI machines you can use _MIPS_SZLONG (32 or 64) to find + even newer MIPS CPU's, but at the moment one size fits all for + optimization options. Older Sparc's work better with only UNROLL, but + there's no way to tell at compile time what it is you're running on */ + +#if defined( sun ) /* Newer Sparc's */ +# define DES_PTR +# define DES_RISC1 +# define DES_UNROLL +#elif defined( __ultrix ) /* Older MIPS */ +# define DES_PTR +# define DES_RISC2 +# define DES_UNROLL +#elif defined( __osf1__ ) /* Alpha */ +# define DES_PTR +# define DES_RISC2 +#elif defined ( _AIX ) /* RS6000 */ + /* Unknown */ +#elif defined( __hpux ) /* HP-PA */ + /* Unknown */ +#elif defined( __aux ) /* 68K */ + /* Unknown */ +#elif defined( __dgux ) /* 88K (but P6 in latest boxes) */ +# define DES_UNROLL +#elif defined( __sgi ) /* Newer MIPS */ +# define DES_PTR +# define DES_RISC2 +# define DES_UNROLL +#elif defined(i386) || defined(__i386__) /* x86 boxes, should be gcc */ +# define DES_PTR +# define DES_RISC1 +# define DES_UNROLL +#endif /* Systems-specific speed defines */ +#endif + +#endif /* DES_DEFAULT_OPTIONS */ +#endif /* HEADER_DES_LOCL_H */ diff --git a/include/openssl/Makefile.am.tpl b/include/openssl/Makefile.am.tpl index 303d0b9eb8..4bbbd60004 100644 --- a/include/openssl/Makefile.am.tpl +++ b/include/openssl/Makefile.am.tpl @@ -17,6 +17,9 @@ endif if HOST_I386 -cp $(top_srcdir)/include/arch/i386/opensslconf.h opensslconf.h endif +if HOST_LOONGARCH64 + -cp $(top_srcdir)/include/arch/loongarch64/opensslconf.h opensslconf.h +endif if HOST_MIPS -cp $(top_srcdir)/include/arch/mips/opensslconf.h opensslconf.h endif diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index bdcfbb22cf..5baa5bc185 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -117,6 +117,8 @@ elseif(HOST_ARM) target_include_directories(ssl_obj PRIVATE ../crypto/arch/arm/) elseif(HOST_I386) target_include_directories(ssl_obj PRIVATE ../crypto/arch/i386/) +elseif(HOST_LOONGARCH64) + target_include_directories(ssl_obj PRIVATE ../crypto/arch/loongarch64) elseif(HOST_MIPS64) target_include_directories(ssl_obj PRIVATE ../crypto/arch/mips64) elseif(HOST_MIPS) diff --git a/ssl/Makefile.am b/ssl/Makefile.am index f9a66a3f63..8beb65afcc 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -131,6 +131,11 @@ libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/i386/ endif noinst_HEADERS += $(top_srcdir)/crypto/arch/i386/crypto_arch.h +if HOST_LOONGARCH64 +libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/loongarch64/ +endif +noinst_HEADERS += $(top_srcdir)/crypto/arch/loongarch64/crypto_arch.h + # XXX - do we still need this? if HOST_MIPS endif diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 8d6fa9d913..f38486cfd6 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -30,6 +30,8 @@ elseif(HOST_I386) include_directories(../crypto/arch/i386/) elseif(HOST_MIPS64) include_directories(../crypto/arch/mips64) +elseif(HOST_LOONGARCH64) + include_directories(../crypto/arch/loongarch64) elseif(HOST_MIPS) # XXX - can this go away? the directory doesn't exist... elseif(HOST_POWERPC) diff --git a/tests/Makefile.am b/tests/Makefile.am index 8153fc921e..217f445d63 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -36,6 +36,10 @@ if HOST_I386 AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/i386/ endif +if HOST_LOONGARCH64 +AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/loongarch64/ +endif + # XXX - do we still need this? if HOST_MIPS endif From f625098f8b64b917b239afd72d1317139bef1e3b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 11 Apr 2025 17:58:21 +0200 Subject: [PATCH 0974/1283] Tweak Changelog --- ChangeLog | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/ChangeLog b/ChangeLog index 02f448c5f5..0504395aec 100644 --- a/ChangeLog +++ b/ChangeLog @@ -63,6 +63,10 @@ LibreSSL Portable Release Notes: - Replaced BN_bn2hex() reimplementation in openssl(1) ca with a poper API call. - Fixed integer overflows due to signed shift in obj_dat.c. + - Fixed a few memory leaks in legacy code. + - Improved some X509_VERIFY_PARAM internals and avoid an out of + bounds read from public API. + - Imported ML-KEM 768 and 1024 from BoringSSL (not yet public API). * Compatibility changes - Added an OPENSSL_INIT_NO_ATEXIT flag for OPENSSL_init_crypto(). It has no effect since LibreSSL doesn't call atexit(). @@ -71,6 +75,9 @@ LibreSSL Portable Release Notes: - EC_METHOD is no longer public and the API exposing it has been removed. This includes EC_GROUP_new(), EC_GFp_mont_method(), EC_GROUP_method_of() and EC_METHOD_get_field_type(). + - The precomputation stubs for EC_GROUP were removed. + - The API setting Jacobian projective coordinates for a point was + removed as were EC_POINTs_{mul,make_affine}(). - All elliptic curves over fields with less than 224 bits and a few more were removed from the built-in curves. This includes all WTLS curves and P-192. @@ -79,26 +86,24 @@ LibreSSL Portable Release Notes: - Removed the -C option to generate "C code" from the openssl(1) dh, dhparam, dsaparam, ecparam, and x509 subcommands. - Removed #error in headers when OPENSSL_NO_* is defined. - - EC_METHOD is no longer public and all public API directly using - it was removed. This includes EC_GROUP_new(), EC_GFp_mont_method() - EC_{GROUP,POINT}_method_of() and EC_METHOD_get_field_type(). - - The precomputation stubs for EC_GROUP were removed. - - The API setting Jacobian projective coordinates for a point was - removed as were EC_POINTs_{mul,make_affine}(). - CRYPTO_set_mem_functions() now matches OpenSSL 1.1 and CRYPTO_set_mem_ex_functions() was removed. - - X509_NAME_print() and X509_OBJECT_up_ref_count() are no longer public. + - The tls_session_secret_cb_fn type now matches OpenSSL 1.1. + - Unexport X509_NAME_print() and X509_OBJECT_up_ref_count(). - const corrected UI_OpenSSL() and BN_MONT_CTX_copy(). - Support OPENSSL_NO_FILENAMES. - Support SSL_OP_NO_RENEGOTIATION and SSL_OP_ALLOW_CLIENT_RENEGOTIATION. + - Export PKCS12_key_gen_uni() again. * New features - libtls has a new tls_peer_cert_common_name() API call to retrieve the peer's common name without having to inspect the PEM. - - Imported ML-KEM 768 and 1024 from BoringSSL (not yet public API). * Bug fixes - Plugged a leak in eckey_compute_pubkey(). - Again allow the magic values -1, -2 and -3 for the salt length of an RSA-PSS key in the EVP_PKEY_CTX_ctrl_str() interface. + * Documentation + - The remaining undocumented public EVP API is now documented. + Reorganization of existing documentation for clarity and accuracy. * Testing and proactive security - Improved regress coverage of the EC code. From 583199bf59cd92f40043f6179e79780fd52e2cb0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 12 Apr 2025 15:00:56 +0200 Subject: [PATCH 0975/1283] Add ChangeLog entry for loongarch64 + a review nit --- ChangeLog | 1 + tests/CMakeLists.txt | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 0504395aec..d9c4421b8c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -31,6 +31,7 @@ LibreSSL Portable Release Notes: 4.1.0 - In development * Portable changes + - Added initial experimental support for loongarch64. - Fixed CMake builds on FreeBSD. - Fixed the --prefix option for cmake --install. - Fixed tests for MinGW due to missing sh(1). diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index f38486cfd6..72e36d4472 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -28,10 +28,10 @@ elseif(HOST_ARM) include_directories(../crypto/arch/arm/) elseif(HOST_I386) include_directories(../crypto/arch/i386/) -elseif(HOST_MIPS64) - include_directories(../crypto/arch/mips64) elseif(HOST_LOONGARCH64) include_directories(../crypto/arch/loongarch64) +elseif(HOST_MIPS64) + include_directories(../crypto/arch/mips64) elseif(HOST_MIPS) # XXX - can this go away? the directory doesn't exist... elseif(HOST_POWERPC) From 24a8faec9a0931aff6fa38757a73f01e6144ee27 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Sat, 12 Apr 2025 22:27:01 +1000 Subject: [PATCH 0976/1283] ci: test on loongarch64 --- .github/workflows/linux.yml | 2 +- scripts/test | 15 +++++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index d57e3bca80..bc3c692779 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -23,7 +23,7 @@ jobs: fail-fast: false matrix: os: ["ubuntu-22.04", "ubuntu-24.04"] - arch: ["native", "arm32", "arm64", "mingw32", "mingw64", "mips64"] + arch: ["native", "arm32", "arm64", "loong64", "mingw32", "mingw64", "mips64"] compiler: ["gcc"] include: - os: "ubuntu-22.04" diff --git a/scripts/test b/scripts/test index 1fb02ebaf9..473d689132 100755 --- a/scripts/test +++ b/scripts/test @@ -132,6 +132,21 @@ elif [ "$ARCH" = "arm32" -o "$ARCH" = "arm64" ]; then file apps/openssl/.libs/openssl +elif [ "$ARCH" = "loong64" ]; then + sudo apt install -y qemu-user-static binfmt-support g++-14-loongarch64-linux-gnu + sudo ln -sf /usr/loongarch64-linux-gnu/lib/ld-linux-loongarch-lp64d.so.1 /lib + + CC=loongarch64-linux-gnu-gcc-14 + CXX=loongarch64-linux-gnu++-14 + AR=loongarch64-linux-gnu-ar + STRIP=loongarch64-linux-gnu-strip-14 + RANLIB=loongarch64-linux-gnu-ranlib + + ./configure --host=loongarch64-linux-gnu + LD_LIBRARY_PATH=/usr/loongarch64-linux-gnu/lib make -j 4 check + + file apps/openssl/openssl + elif [ "$ARCH" = "mips32" -o "$ARCH" = "mips64" ]; then sudo apt-get install -y qemu-user-static binfmt-support From f4cc344689038ef1c5a3280aa5bf9754fe751ba3 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Sat, 12 Apr 2025 23:12:57 +1000 Subject: [PATCH 0977/1283] scripts/test: change from g++-14 to g++ --- scripts/test | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/scripts/test b/scripts/test index 473d689132..e25a57ab21 100755 --- a/scripts/test +++ b/scripts/test @@ -133,13 +133,13 @@ elif [ "$ARCH" = "arm32" -o "$ARCH" = "arm64" ]; then file apps/openssl/.libs/openssl elif [ "$ARCH" = "loong64" ]; then - sudo apt install -y qemu-user-static binfmt-support g++-14-loongarch64-linux-gnu + sudo apt install -y qemu-user-static binfmt-support g++-loongarch64-linux-gnu sudo ln -sf /usr/loongarch64-linux-gnu/lib/ld-linux-loongarch-lp64d.so.1 /lib - CC=loongarch64-linux-gnu-gcc-14 - CXX=loongarch64-linux-gnu++-14 + CC=loongarch64-linux-gnu-gcc + CXX=loongarch64-linux-gnu++ AR=loongarch64-linux-gnu-ar - STRIP=loongarch64-linux-gnu-strip-14 + STRIP=loongarch64-linux-gnu-strip RANLIB=loongarch64-linux-gnu-ranlib ./configure --host=loongarch64-linux-gnu From a71747c235e1044a6463909a8916a91eaec1b32c Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Sat, 12 Apr 2025 23:41:15 +1000 Subject: [PATCH 0978/1283] scripts/test: revert to using g++-14 It seems `g++-loongarch64-linux-gnu` does not exist in the Ubuntu universe repositories. It also fails using the ubuntu Docker image locally (with the universe repo added). `g++-14-loongarch-linux-gnu` exists on both Ubuntu 22.04 and 24.04, however ideally we want to use whatever works on the most platforms. --- scripts/test | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/scripts/test b/scripts/test index e25a57ab21..473d689132 100755 --- a/scripts/test +++ b/scripts/test @@ -133,13 +133,13 @@ elif [ "$ARCH" = "arm32" -o "$ARCH" = "arm64" ]; then file apps/openssl/.libs/openssl elif [ "$ARCH" = "loong64" ]; then - sudo apt install -y qemu-user-static binfmt-support g++-loongarch64-linux-gnu + sudo apt install -y qemu-user-static binfmt-support g++-14-loongarch64-linux-gnu sudo ln -sf /usr/loongarch64-linux-gnu/lib/ld-linux-loongarch-lp64d.so.1 /lib - CC=loongarch64-linux-gnu-gcc - CXX=loongarch64-linux-gnu++ + CC=loongarch64-linux-gnu-gcc-14 + CXX=loongarch64-linux-gnu++-14 AR=loongarch64-linux-gnu-ar - STRIP=loongarch64-linux-gnu-strip + STRIP=loongarch64-linux-gnu-strip-14 RANLIB=loongarch64-linux-gnu-ranlib ./configure --host=loongarch64-linux-gnu From 736426b53fd6c4bf6b1e1edff90e7dd0835fdfcf Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Sat, 12 Apr 2025 23:55:48 +1000 Subject: [PATCH 0979/1283] ci: add universe apt repository for loong64 runs --- .github/workflows/linux.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index bc3c692779..bce596b1fa 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -36,6 +36,10 @@ jobs: - name: "Checkout repository" uses: actions/checkout@v4 + - name: "Add universe repository" + if: matrix.arch == 'loong64' + run: sudo add-apt-repository universe + - name: "Run tests" run: ./scripts/test env: From 1cee3363decb5c59299e437ebcd400e2f7d8e318 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Sun, 13 Apr 2025 00:38:28 +1000 Subject: [PATCH 0980/1283] ci: only test loong64 on ubuntu-24.04 Versions of Ubuntu prior to 24.04 do not have the g++{,-14}-loongarch64-linux-gnu package. --- .github/workflows/linux.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index bce596b1fa..6fa3f531fd 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -23,7 +23,7 @@ jobs: fail-fast: false matrix: os: ["ubuntu-22.04", "ubuntu-24.04"] - arch: ["native", "arm32", "arm64", "loong64", "mingw32", "mingw64", "mips64"] + arch: ["native", "arm32", "arm64", "mingw32", "mingw64", "mips64"] compiler: ["gcc"] include: - os: "ubuntu-22.04" @@ -32,14 +32,13 @@ jobs: - os: "ubuntu-24.04" arch: "native" compiler: "clang" + - os: "ubuntu-24.04" # loong64 + arch: "loong64" + compiler: "gcc" steps: - name: "Checkout repository" uses: actions/checkout@v4 - - name: "Add universe repository" - if: matrix.arch == 'loong64' - run: sudo add-apt-repository universe - - name: "Run tests" run: ./scripts/test env: From a516251595b6451806372d5f7d08deb581a4824c Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Sun, 13 Apr 2025 00:59:35 +1000 Subject: [PATCH 0981/1283] ci: print test suite log on failure --- .github/workflows/linux.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 6fa3f531fd..fd0650e222 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -40,7 +40,7 @@ jobs: uses: actions/checkout@v4 - name: "Run tests" - run: ./scripts/test + run: ./scripts/test || cat tests/test-suite.log env: ARCH: "${{ matrix.arch }}" CC: "${{ matrix.compiler }}" From 090f7892f7f7280f69289dc5e99ab5ed64908269 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Sun, 13 Apr 2025 01:09:48 +1000 Subject: [PATCH 0982/1283] scripts/test: use lib64 for loongarch64 --- .github/workflows/linux.yml | 2 +- scripts/test | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index fd0650e222..88dd15e996 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -40,7 +40,7 @@ jobs: uses: actions/checkout@v4 - name: "Run tests" - run: ./scripts/test || cat tests/test-suite.log + run: ./scripts/test || (status=$?; cat tests/test-suite.log; exit $status) env: ARCH: "${{ matrix.arch }}" CC: "${{ matrix.compiler }}" diff --git a/scripts/test b/scripts/test index 473d689132..a93fe90f77 100755 --- a/scripts/test +++ b/scripts/test @@ -134,7 +134,7 @@ elif [ "$ARCH" = "arm32" -o "$ARCH" = "arm64" ]; then elif [ "$ARCH" = "loong64" ]; then sudo apt install -y qemu-user-static binfmt-support g++-14-loongarch64-linux-gnu - sudo ln -sf /usr/loongarch64-linux-gnu/lib/ld-linux-loongarch-lp64d.so.1 /lib + sudo ln -sf /usr/loongarch64-linux-gnu/lib64/ld-linux-loongarch-lp64d.so.1 /lib64 CC=loongarch64-linux-gnu-gcc-14 CXX=loongarch64-linux-gnu++-14 From 033df1bf19cb374f8537315d38579039a7ab36f9 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 12 Apr 2025 17:13:26 +0200 Subject: [PATCH 0983/1283] Switch to add_compile_options --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 771b2bb6f3..e22a6aeeee 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -131,7 +131,7 @@ add_definitions(-D__END_HIDDEN_DECLS=) set(CMAKE_POSITION_INDEPENDENT_CODE true) if (CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang") - set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-pointer-sign") + add_compile_options(-Wno-pointer-sign) endif() if(WIN32) From 2a63bda5238e4e1d86684f4147e04541bbe75a54 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 12 Apr 2025 17:21:01 +0200 Subject: [PATCH 0984/1283] Drop -fno-common --- CMakeLists.txt | 4 ---- 1 file changed, 4 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index e22a6aeeee..8437e02e4a 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -72,10 +72,6 @@ endforeach() set(BUILD_NC true) -if(CMAKE_SYSTEM_NAME MATCHES "Darwin") - add_definitions(-fno-common) -endif() - if(CMAKE_SYSTEM_NAME MATCHES "OpenBSD") add_definitions(-DHAVE_ATTRIBUTE__BOUNDED__) add_definitions(-DHAVE_ATTRIBUTE__DEAD__) From 1087da12fc815a84592454980cdcd5d34b07285b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 11 Apr 2025 18:31:04 +0200 Subject: [PATCH 0985/1283] Sync opensslconf.h, add crypto_arch.h for mips This was easy enough to make compile. As long as it doesn't get in the way, I think we can keep this. Fixes #1110 --- .github/workflows/linux.yml | 2 +- .gitignore | 2 ++ crypto/CMakeLists.txt | 2 +- crypto/Makefile.am | 3 ++- crypto/arch/mips/crypto_arch.h | 21 +++++++++++++++++++++ include/arch/mips/opensslconf.h | 22 +++++++++++----------- ssl/CMakeLists.txt | 2 +- ssl/Makefile.am | 3 ++- tests/CMakeLists.txt | 2 +- tests/Makefile.am | 2 +- 10 files changed, 43 insertions(+), 18 deletions(-) create mode 100644 crypto/arch/mips/crypto_arch.h diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 88dd15e996..8334ae6d3e 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -23,7 +23,7 @@ jobs: fail-fast: false matrix: os: ["ubuntu-22.04", "ubuntu-24.04"] - arch: ["native", "arm32", "arm64", "mingw32", "mingw64", "mips64"] + arch: ["native", "arm32", "arm64", "mingw32", "mingw64", "mips32", "mips64"] compiler: ["gcc"] include: - os: "ubuntu-22.04" diff --git a/.gitignore b/.gitignore index 14917f9f77..7aff24fa47 100644 --- a/.gitignore +++ b/.gitignore @@ -239,6 +239,8 @@ include/openssl/*.h /crypto/* !/crypto/Makefile.am.* +!/crypto/arch/ +!/crypto/arch/mips/* !/crypto/compat/ /crypto/compat/* !/crypto/compat/arc4random.h diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index a714059b96..64bccd8a2a 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -781,7 +781,7 @@ elseif(HOST_MIPS64) target_include_directories(crypto_obj PRIVATE arch/mips64) target_include_directories(crypto_obj PRIVATE bn/arch/mips64) elseif(HOST_MIPS) - # XXX - can this go away? the directory doesn't exist... + target_include_directories(crypto_obj PRIVATE arch/mips) target_include_directories(crypto_obj PRIVATE bn/arch/mips) elseif(HOST_POWERPC) target_include_directories(crypto_obj PRIVATE arch/powerpc) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 09524946f4..d1c5b76d19 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -403,10 +403,11 @@ endif noinst_HEADERS += arch/loongarch64/crypto_arch.h noinst_HEADERS += bn/arch/loongarch64/bn_arch.h -# XXX - do we still need this? if HOST_MIPS +libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips/ libcrypto_la_CPPFLAGS += -I$(top_srcdir)/crypto/bn/arch/mips/ endif +noinst_HEADERS += arch/mips/crypto_arch.h noinst_HEADERS += bn/arch/mips/bn_arch.h if HOST_MIPS64 diff --git a/crypto/arch/mips/crypto_arch.h b/crypto/arch/mips/crypto_arch.h new file mode 100644 index 0000000000..274879c5e3 --- /dev/null +++ b/crypto/arch/mips/crypto_arch.h @@ -0,0 +1,21 @@ +/* $OpenBSD$ */ +/* + * Copyright (c) 2024 Joel Sing + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef HEADER_CRYPTO_ARCH_H +#define HEADER_CRYPTO_ARCH_H + +#endif diff --git a/include/arch/mips/opensslconf.h b/include/arch/mips/opensslconf.h index f17d3d2803..a5d26b6fdc 100644 --- a/include/arch/mips/opensslconf.h +++ b/include/arch/mips/opensslconf.h @@ -1,15 +1,22 @@ #include /* crypto/opensslconf.h.in */ -#if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR) +#if defined(HEADER_CRYPTO_LOCAL_H) && !defined(OPENSSLDIR) #define OPENSSLDIR "/etc/ssl" #endif -#undef OPENSSL_UNISTD -#define OPENSSL_UNISTD - #undef OPENSSL_EXPORT_VAR_AS_FUNCTION +#ifndef OPENSSL_FILE +#ifdef OPENSSL_NO_FILENAMES +#define OPENSSL_FILE "" +#define OPENSSL_LINE 0 +#else +#define OPENSSL_FILE __FILE__ +#define OPENSSL_LINE __LINE__ +#endif +#endif + #if defined(HEADER_IDEA_H) && !defined(IDEA_INT) #define IDEA_INT unsigned int #endif @@ -68,13 +75,6 @@ #undef EIGHT_BIT #endif -#if defined(HEADER_RC4_LOCL_H) && !defined(CONFIG_HEADER_RC4_LOCL_H) -#define CONFIG_HEADER_RC4_LOCL_H -/* if this is defined data[i] is used instead of *data, this is a %20 - * speedup on x86 */ -#define RC4_INDEX -#endif - #if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H) #define CONFIG_HEADER_BF_LOCL_H #undef BF_PTR diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 5baa5bc185..cd7e335361 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -122,7 +122,7 @@ elseif(HOST_LOONGARCH64) elseif(HOST_MIPS64) target_include_directories(ssl_obj PRIVATE ../crypto/arch/mips64) elseif(HOST_MIPS) - # XXX - can this go away? the directory doesn't exist... + target_include_directories(ssl_obj PRIVATE ../crypto/arch/mips) elseif(HOST_POWERPC) target_include_directories(ssl_obj PRIVATE ../crypto/arch/powerpc) elseif(HOST_POWERPC64) diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 8beb65afcc..2c84bff1a3 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -136,9 +136,10 @@ libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/loongarch64/ endif noinst_HEADERS += $(top_srcdir)/crypto/arch/loongarch64/crypto_arch.h -# XXX - do we still need this? if HOST_MIPS +libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips/ endif +noinst_HEADERS += $(top_srcdir)/crypto/arch/mips/crypto_arch.h if HOST_MIPS64 libssl_la_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips64/ diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 72e36d4472..d7cc499e1a 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -33,7 +33,7 @@ elseif(HOST_LOONGARCH64) elseif(HOST_MIPS64) include_directories(../crypto/arch/mips64) elseif(HOST_MIPS) - # XXX - can this go away? the directory doesn't exist... + include_directories(../crypto/arch/mips) elseif(HOST_POWERPC) include_directories(../crypto/arch/powerpc) elseif(HOST_POWERPC64) diff --git a/tests/Makefile.am b/tests/Makefile.am index 217f445d63..b58de219f2 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -40,8 +40,8 @@ if HOST_LOONGARCH64 AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/loongarch64/ endif -# XXX - do we still need this? if HOST_MIPS +AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/mips/ endif if HOST_MIPS64 From 73779a46bf49c4f53cc4b81993135a7408a01963 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 12 Apr 2025 18:20:53 +0200 Subject: [PATCH 0986/1283] Update ChangeLog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index d9c4421b8c..52aa44d03a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -32,6 +32,7 @@ LibreSSL Portable Release Notes: * Portable changes - Added initial experimental support for loongarch64. + - Fixed compilation for mips32 and reenable CI. - Fixed CMake builds on FreeBSD. - Fixed the --prefix option for cmake --install. - Fixed tests for MinGW due to missing sh(1). From 2c5e2c60d92a0741b6035e3dbc7d9ec6cee7ac9f Mon Sep 17 00:00:00 2001 From: datadiode Date: Wed, 17 Jul 2024 10:40:05 +0200 Subject: [PATCH 0987/1283] Issue #1069 - Make file descriptors created through posix_open() distinguishable from sockets by having them take odd values only --- crypto/compat/posix_win.c | 54 +++++++++------------------------------ 1 file changed, 12 insertions(+), 42 deletions(-) diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index 1fbfce1667..3e7d227295 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -43,6 +43,16 @@ posix_fopen(const char *path, const char *mode) return fopen(path, mode); } +static int +oddify_fd(int fd) +{ + if (fd & 1) /* also catches an eventual -1 from using up all descriptors */ + return fd; + int clone = oddify_fd(dup(fd)); + close(fd); + return clone; +} + int posix_open(const char *path, ...) { @@ -62,7 +72,7 @@ posix_open(const char *path, ...) flags |= O_NOINHERIT; } flags &= ~O_NONBLOCK; - return open(path, flags, mode); + return oddify_fd(open(path, flags, mode)); } char * @@ -150,50 +160,10 @@ wsa_errno(int err) return -1; } -/* - * Employ a similar trick to cpython (pycore_fileutils.h) where the CRT report - * handler is disabled while checking if a descriptor is a socket or a file - */ -#if defined _MSC_VER && _MSC_VER >= 1900 - -#include -#include - -static void noop_handler(const wchar_t *expression, const wchar_t *function, - const wchar_t *file, unsigned int line, uintptr_t pReserved) -{ - return; -} - -#define BEGIN_SUPPRESS_IPH \ - const int old_report_mode = _CrtSetReportMode(_CRT_ASSERT, 0); \ - const _invalid_parameter_handler old_handler = _set_thread_local_invalid_parameter_handler(noop_handler) -#define END_SUPPRESS_IPH \ - (void)old_report_mode; /* Silence warning in release mode when _CrtSetReportMode compiles to void. */ \ - _CrtSetReportMode(_CRT_ASSERT, old_report_mode); \ - _set_thread_local_invalid_parameter_handler(old_handler) - -#else - -#define BEGIN_SUPPRESS_IPH -#define END_SUPPRESS_IPH - -#endif - static int is_socket(int fd) { - intptr_t hd; - - BEGIN_SUPPRESS_IPH; - hd = _get_osfhandle(fd); - END_SUPPRESS_IPH; - - if (hd == (intptr_t)INVALID_HANDLE_VALUE) { - return 1; /* fd is not file descriptor */ - } - - return 0; + return (fd & 1) == 0; /* daringly assumes that any valid socket is even */ } int From ec123956230a44603196fd68725e03a9ecf36df3 Mon Sep 17 00:00:00 2001 From: datadiode Date: Tue, 15 Oct 2024 18:16:19 +0200 Subject: [PATCH 0988/1283] Don't break std* file descriptors (inspired by the other is_socket() which lives in poll_win.c) --- crypto/compat/posix_win.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index 3e7d227295..9409af5875 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -163,6 +163,9 @@ wsa_errno(int err) static int is_socket(int fd) { + /* Border case: Don't break std* file descriptors */ + if (fd < 3) + return 0; return (fd & 1) == 0; /* daringly assumes that any valid socket is even */ } From 78b86a2af698d771a4db5286a4222c92d074a6da Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sat, 12 Apr 2025 16:59:51 -0500 Subject: [PATCH 0989/1283] switch to using high bit for fd detection of file/socket --- crypto/compat/posix_win.c | 47 +++++++++++++++++++++------------------ include/compat/sys/stat.h | 8 +++++++ 2 files changed, 33 insertions(+), 22 deletions(-) diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index 9409af5875..ea229c9103 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -22,6 +22,20 @@ #include #include +#include + +static int +is_socket(int fd) +{ + return (fd & 0x80000000) == 0; +} + +static int +get_real_fd(int fd) +{ + return (fd & 0x7fffffff); +} + void posix_perror(const char *s) { @@ -43,14 +57,10 @@ posix_fopen(const char *path, const char *mode) return fopen(path, mode); } -static int -oddify_fd(int fd) +int +posix_fstat(int fd, struct stat *statbuf) { - if (fd & 1) /* also catches an eventual -1 from using up all descriptors */ - return fd; - int clone = oddify_fd(dup(fd)); - close(fd); - return clone; + return fstat(get_real_fd(fd), statbuf); } int @@ -72,7 +82,11 @@ posix_open(const char *path, ...) flags |= O_NOINHERIT; } flags &= ~O_NONBLOCK; - return oddify_fd(open(path, flags, mode)); + + const int fh = open(path, flags, mode); + + // Set high bit to mark file descriptor as a file handle + return fh + 0x80000000; } char * @@ -160,15 +174,6 @@ wsa_errno(int err) return -1; } -static int -is_socket(int fd) -{ - /* Border case: Don't break std* file descriptors */ - if (fd < 3) - return 0; - return (fd & 1) == 0; /* daringly assumes that any valid socket is even */ -} - int posix_connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen) { @@ -182,14 +187,13 @@ int posix_close(int fd) { int rc; - if (is_socket(fd)) { if ((rc = closesocket(fd)) == SOCKET_ERROR) { int err = WSAGetLastError(); rc = wsa_errno(err); } } else { - rc = close(fd); + rc = close(get_real_fd(fd)); } return rc; } @@ -198,14 +202,13 @@ ssize_t posix_read(int fd, void *buf, size_t count) { ssize_t rc; - if (is_socket(fd)) { if ((rc = recv(fd, buf, count, 0)) == SOCKET_ERROR) { int err = WSAGetLastError(); rc = wsa_errno(err); } } else { - rc = read(fd, buf, count); + rc = read(get_real_fd(fd), buf, count); } return rc; } @@ -219,7 +222,7 @@ posix_write(int fd, const void *buf, size_t count) rc = wsa_errno(WSAGetLastError()); } } else { - rc = write(fd, buf, count); + rc = write(get_real_fd(fd), buf, count); } return rc; } diff --git a/include/compat/sys/stat.h b/include/compat/sys/stat.h index b88da1d565..aa15c9a6b6 100644 --- a/include/compat/sys/stat.h +++ b/include/compat/sys/stat.h @@ -118,4 +118,12 @@ #endif +#ifdef _WIN32 +int posix_fstat(int fd, struct stat *statbuf); + +#ifndef NO_REDEF_POSIX_FUNCTIONS +#define fstat(fd, statbuf) posix_fstat(fd, statbuf) +#endif +#endif + #endif From 06297aa3cee4591b50dc7cc51353a5fca1e3ae13 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 16 Apr 2025 03:59:46 -0500 Subject: [PATCH 0990/1283] reapply special case for std file descriptors --- crypto/compat/posix_win.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index ea229c9103..246f89157a 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -27,6 +27,11 @@ static int is_socket(int fd) { + // Border case: Don't break std* file descriptors + if (fd < 3) + return 0; + + // All locally-allocated file descriptors will have the high bit set return (fd & 0x80000000) == 0; } From 9ba4b33d668230aa0c453f5c225dc93ccc007985 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 16 Apr 2025 04:26:34 -0500 Subject: [PATCH 0991/1283] change prefix for fstat --- crypto/compat/posix_win.c | 2 +- include/compat/sys/stat.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index 246f89157a..572e5275f8 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -63,7 +63,7 @@ posix_fopen(const char *path, const char *mode) } int -posix_fstat(int fd, struct stat *statbuf) +libressl_fstat(int fd, struct stat *statbuf) { return fstat(get_real_fd(fd), statbuf); } diff --git a/include/compat/sys/stat.h b/include/compat/sys/stat.h index aa15c9a6b6..57aa5215ab 100644 --- a/include/compat/sys/stat.h +++ b/include/compat/sys/stat.h @@ -119,10 +119,10 @@ #endif #ifdef _WIN32 -int posix_fstat(int fd, struct stat *statbuf); +int libressl_fstat(int fd, struct stat *statbuf); #ifndef NO_REDEF_POSIX_FUNCTIONS -#define fstat(fd, statbuf) posix_fstat(fd, statbuf) +#define fstat(fd, statbuf) libressl_fstat(fd, statbuf) #endif #endif From 7be98b5cfe42eec03758ad1c97b267182098674f Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 18 Apr 2025 08:05:28 +0200 Subject: [PATCH 0992/1283] Tweak ChangeLog --- ChangeLog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 52aa44d03a..a5bf928b8a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -65,7 +65,6 @@ LibreSSL Portable Release Notes: - Replaced BN_bn2hex() reimplementation in openssl(1) ca with a poper API call. - Fixed integer overflows due to signed shift in obj_dat.c. - - Fixed a few memory leaks in legacy code. - Improved some X509_VERIFY_PARAM internals and avoid an out of bounds read from public API. - Imported ML-KEM 768 and 1024 from BoringSSL (not yet public API). @@ -103,9 +102,10 @@ LibreSSL Portable Release Notes: - Plugged a leak in eckey_compute_pubkey(). - Again allow the magic values -1, -2 and -3 for the salt length of an RSA-PSS key in the EVP_PKEY_CTX_ctrl_str() interface. + - Fixed a few memory leaks in legacy code. * Documentation - The remaining undocumented public EVP API is now documented. - Reorganization of existing documentation for clarity and accuracy. + - Reorganization of existing documentation for clarity and accuracy. * Testing and proactive security - Improved regress coverage of the EC code. From 3aeba58a29031a56e9332df6e075332e0e9a6c16 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 18 Apr 2025 08:15:46 +0200 Subject: [PATCH 0993/1283] Typo in ChangeLog; from jsg --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index a5bf928b8a..8c87e06580 100644 --- a/ChangeLog +++ b/ChangeLog @@ -63,7 +63,7 @@ LibreSSL Portable Release Notes: - Replaced combinations of BN_MONT_CTX_new/set with an internal BN_MONT_CTX_create(). - Replaced BN_bn2hex() reimplementation in openssl(1) ca with - a poper API call. + a proper API call. - Fixed integer overflows due to signed shift in obj_dat.c. - Improved some X509_VERIFY_PARAM internals and avoid an out of bounds read from public API. From c6f69dd37a92517ecc3717373d662e69b30b1d4d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 29 Apr 2025 05:52:09 -0600 Subject: [PATCH 0994/1283] Remove no longer needed modes_local patch Fixes #1153 --- patches/modes_local.h.patch | 18 ------------------ 1 file changed, 18 deletions(-) delete mode 100644 patches/modes_local.h.patch diff --git a/patches/modes_local.h.patch b/patches/modes_local.h.patch deleted file mode 100644 index 1ff799b99d..0000000000 --- a/patches/modes_local.h.patch +++ /dev/null @@ -1,18 +0,0 @@ ---- crypto/modes/modes_local.h.orig Sat Jul 8 14:03:53 2023 -+++ crypto/modes/modes_local.h Sat Jul 8 14:10:56 2023 -@@ -45,6 +45,7 @@ - asm ("bswapl %0" \ - : "+r"(ret)); ret; }) - # elif (defined(__arm__) || defined(__arm)) && !defined(__STRICT_ALIGNMENT) -+# if (__ARM_ARCH >= 6) - # define BSWAP8(x) ({ u32 lo=(u64)(x)>>32,hi=(x); \ - asm ("rev %0,%0; rev %1,%1" \ - : "+r"(hi),"+r"(lo)); \ -@@ -53,6 +54,7 @@ - asm ("rev %0,%1" \ - : "=r"(ret) : "r"((u32)(x))); \ - ret; }) -+# endif - # endif - #endif - #endif From 1ae319a56cb119206ba73b2f1fc25ebb9e2b2a7c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 30 Apr 2025 08:15:11 +0200 Subject: [PATCH 0995/1283] Initial ChangeLog for 4.2.0 --- ChangeLog | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 8c87e06580..c27d3bcbb3 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,7 +28,26 @@ history is also available from Git. LibreSSL Portable Release Notes: -4.1.0 - In development +4.2.0 - In development + + * Portable changes + * Internal improvements + - Cleaned up code implementing block cipher modes of operation. + Includes untangling a horrible #ifdef mess and removing a few + instances of undefined behavior. + - Removed assembly implementations of AES using bit slicing (BS-AES) + and vector permutation (VP-AES). + - Removed OPENSSL_SMALL_FOOTPRINT and OPENSSL_FIPSAPI + * Compatibility changes + - Removed the -msie_hack option from the openssl(1) ca subcommand. + * New features + * Bug fixes + * Documentation + - Rewrote most of the EC documentation from scratch to be at least + somewhat accurate and intelligible. + * Testing and proactive security + +4.1.0 - Stable release * Portable changes - Added initial experimental support for loongarch64. From a2dfbc3d84444673db6fd5fed04d72480b0b8d61 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 2 May 2025 18:53:57 -0600 Subject: [PATCH 0996/1283] missing period --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index c27d3bcbb3..8fa6cdb0e4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -37,7 +37,7 @@ LibreSSL Portable Release Notes: instances of undefined behavior. - Removed assembly implementations of AES using bit slicing (BS-AES) and vector permutation (VP-AES). - - Removed OPENSSL_SMALL_FOOTPRINT and OPENSSL_FIPSAPI + - Removed OPENSSL_SMALL_FOOTPRINT and OPENSSL_FIPSAPI. * Compatibility changes - Removed the -msie_hack option from the openssl(1) ca subcommand. * New features From 4a0f052243f9780b12eee0e2bb08879013afcc32 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 4 May 2025 07:50:20 +0200 Subject: [PATCH 0997/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 8fa6cdb0e4..c6b3cfe0ef 100644 --- a/ChangeLog +++ b/ChangeLog @@ -40,6 +40,8 @@ LibreSSL Portable Release Notes: - Removed OPENSSL_SMALL_FOOTPRINT and OPENSSL_FIPSAPI. * Compatibility changes - Removed the -msie_hack option from the openssl(1) ca subcommand. + - Removed parameters of the 239-bit prime curves from X9.62, H.5.2: + prime239v1, prime239v2, prime239v3. * New features * Bug fixes * Documentation From dbce13a80f82840d79b65dee5fe6d2ce7608e97f Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sun, 4 May 2025 20:46:51 +0900 Subject: [PATCH 0998/1283] rewrite pq_test to perform internal checks This change prepares for the patch at https://marc.info/?l=openbsd-tech&m=174634767904894&w=2 by removing the need for pq_expected.txt, pq_test.sh, and pq_test.bat. The test now performs internal output and priority verification in code, simplifying the test infrastructure across platforms. Update CMakeLists.txt and Makefile.am accordingly. --- tests/CMakeLists.txt | 8 +------- tests/Makefile.am | 4 +--- tests/pq_test.bat | 15 --------------- tests/pq_test.sh | 9 --------- update.sh | 1 - 5 files changed, 2 insertions(+), 35 deletions(-) delete mode 100644 tests/pq_test.bat delete mode 100755 tests/pq_test.sh diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index d7cc499e1a..417e0938c0 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -620,13 +620,7 @@ add_platform_test(policy policy) # pq_test add_executable(pq_test pq_test.c) target_link_libraries(pq_test ${OPENSSL_TEST_LIBS}) -if(NOT WIN32) - add_test(NAME pq_test COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/pq_test.sh) -else() - add_test(NAME pq_test COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/pq_test.bat - $) -endif() -set_tests_properties(pq_test PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") +add_platform_test(pq_test pq_test) # quictest set(QUICTEST_SRC quictest.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index b58de219f2..23f85577ab 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -656,11 +656,9 @@ EXTRA_DIST += policy_root2.pem EXTRA_DIST += policy_root_cross_inhibit_mapping.pem # pq_test -TESTS += pq_test.sh +TESTS += pq_test check_PROGRAMS += pq_test pq_test_SOURCES = pq_test.c -EXTRA_DIST += pq_test.sh pq_test.bat -EXTRA_DIST += pq_expected.txt # quictest TESTS += quictest.sh diff --git a/tests/pq_test.bat b/tests/pq_test.bat deleted file mode 100644 index 084f06d558..0000000000 --- a/tests/pq_test.bat +++ /dev/null @@ -1,15 +0,0 @@ -@echo off -setlocal enabledelayedexpansion -REM pq_test.bat - -set pq_test_bin=%1 -set pq_test_bin=%pq_test_bin:/=\% -if not exist %pq_test_bin% exit /b 1 - -set pq_output=pq_output.txt -if exist %pq_output% del %pq_output% - -%pq_test_bin% > %pq_output% -fc /b %pq_output% %srcdir%\pq_expected.txt - -endlocal diff --git a/tests/pq_test.sh b/tests/pq_test.sh deleted file mode 100755 index eab6f3cb25..0000000000 --- a/tests/pq_test.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/sh -set -e -TEST=./pq_test -if [ -e ./pq_test.exe ]; then - TEST=./pq_test.exe -elif [ -e ./pq_test.js ]; then - TEST="node ./pq_test.js" -fi -$TEST | diff -b $srcdir/pq_expected.txt - diff --git a/update.sh b/update.sh index 9636ee7e97..eec551c70d 100755 --- a/update.sh +++ b/update.sh @@ -376,7 +376,6 @@ done $CP $libssl_regress/unit/tests.h tests $CP $libssl_regress/certs/*.pem tests $CP $libssl_regress/certs/*.crl tests -$CP $libssl_regress/pqueue/expected.txt tests/pq_expected.txt # copy libtls tests for i in `find $libtls_regress -name '*.c'`; do From 636ace5115026b2216edf25785c216d0937c896b Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sun, 4 May 2025 21:44:30 +0900 Subject: [PATCH 0999/1283] .gitignore: ignore crypto/arch/* except for mips and loongarch64 The arch/ directory is regenerated by autogen.sh and should generally be ignored. Only the mips and loongarch64 subdirectories are tracked in the portable tree because they are not supported by OpenBSD natively, but there has been interest in using LibreSSL on these architectures. --- .gitignore | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 7aff24fa47..b3aa8a53f7 100644 --- a/.gitignore +++ b/.gitignore @@ -238,9 +238,10 @@ include/openssl/*.h !/apps/openssl/certhash_win.c /crypto/* +/crypto/arch/ !/crypto/Makefile.am.* -!/crypto/arch/ !/crypto/arch/mips/* +!/crypto/arch/loongarch64/* !/crypto/compat/ /crypto/compat/* !/crypto/compat/arc4random.h From c8fe0c3f96440cfeb1f15acab9bb90fbb27a9995 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sun, 4 May 2025 22:28:44 +0900 Subject: [PATCH 1000/1283] Move /crypto/arch/ --- .gitignore | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index b3aa8a53f7..fa052760db 100644 --- a/.gitignore +++ b/.gitignore @@ -238,8 +238,8 @@ include/openssl/*.h !/apps/openssl/certhash_win.c /crypto/* -/crypto/arch/ !/crypto/Makefile.am.* +/crypto/arch/ !/crypto/arch/mips/* !/crypto/arch/loongarch64/* !/crypto/compat/ From 0ae0935d694a2f0eebd02fafcf181e6be81b6871 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Mon, 5 May 2025 09:53:14 +0900 Subject: [PATCH 1001/1283] Remove x509name test in preparation for merge into x509_name_test.c This change cleans up the old test infrastructure in preparation for consolidating the x509name.c test logic into x509_name_test.c. Update CMakeLists.txt and Makefile.am accordingly. --- tests/CMakeLists.txt | 5 ----- tests/Makefile.am | 5 ----- 2 files changed, 10 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 417e0938c0..8493614753 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -932,11 +932,6 @@ add_executable(x509_name_test x509_name_test.c) target_link_libraries(x509_name_test ${OPENSSL_TEST_LIBS}) add_platform_test(x509_name_test x509_name_test) -# x509name -add_executable(x509name x509name.c) -target_link_libraries(x509name ${OPENSSL_TEST_LIBS}) -add_platform_test(x509name x509name) - # x509req_ext add_executable(x509req_ext x509req_ext.c) target_link_libraries(x509req_ext ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 23f85577ab..350841f878 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -917,11 +917,6 @@ TESTS += x509_name_test check_PROGRAMS += x509_name_test x509_name_test_SOURCES = x509_name_test.c -# x509name -TESTS += x509name -check_PROGRAMS += x509name -x509name_SOURCES = x509name.c - # x509req_ext TESTS += x509req_ext check_PROGRAMS += x509req_ext From 9b9bdfdbbb32918ccfe179386fda4cdbfa31763f Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 10 May 2025 21:24:24 +0200 Subject: [PATCH 1002/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index c6b3cfe0ef..6985403595 100644 --- a/ChangeLog +++ b/ChangeLog @@ -42,6 +42,9 @@ LibreSSL Portable Release Notes: - Removed the -msie_hack option from the openssl(1) ca subcommand. - Removed parameters of the 239-bit prime curves from X9.62, H.5.2: prime239v1, prime239v2, prime239v3. + - Increased default MAC salt length used by PKCS12_set_mac(3) to 16 + per recommendation of NIST SP 800-132. + - Of the old *err() only PEMerr(), RSAerr(), and SSLerr() remain. * New features * Bug fixes * Documentation From bc15cfdcc15790670e7195115192b966dac82b42 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 10 May 2025 13:42:25 -0600 Subject: [PATCH 1003/1283] Update man links --- man/links | 84 +++++++++++++++++++++++++------------------------------ 1 file changed, 38 insertions(+), 46 deletions(-) diff --git a/man/links b/man/links index b1dbf82aa0..f2983294b7 100644 --- a/man/links +++ b/man/links @@ -185,9 +185,7 @@ BIO_ctrl.3,BIO_set_info_callback.3 BIO_ctrl.3,BIO_tell.3 BIO_ctrl.3,BIO_wpending.3 BIO_ctrl.3,bio_info_cb.3 -BIO_dump.3,BIO_dump_fp.3 BIO_dump.3,BIO_dump_indent.3 -BIO_dump.3,BIO_dump_indent_fp.3 BIO_dup_chain.3,BIO_dup_state.3 BIO_f_buffer.3,BIO_get_buffer_num_lines.3 BIO_f_buffer.3,BIO_set_buffer_read_data.3 @@ -644,37 +642,33 @@ ECDSA_SIG_new.3,ECDSA_size.3 ECDSA_SIG_new.3,ECDSA_verify.3 ECDSA_SIG_new.3,d2i_ECDSA_SIG.3 ECDSA_SIG_new.3,i2d_ECDSA_SIG.3 -EC_GROUP_copy.3,EC_GROUP_check.3 -EC_GROUP_copy.3,EC_GROUP_check_discriminant.3 -EC_GROUP_copy.3,EC_GROUP_cmp.3 -EC_GROUP_copy.3,EC_GROUP_dup.3 -EC_GROUP_copy.3,EC_GROUP_get0_generator.3 -EC_GROUP_copy.3,EC_GROUP_get0_seed.3 -EC_GROUP_copy.3,EC_GROUP_get_asn1_flag.3 -EC_GROUP_copy.3,EC_GROUP_get_basis_type.3 -EC_GROUP_copy.3,EC_GROUP_get_cofactor.3 -EC_GROUP_copy.3,EC_GROUP_get_curve_name.3 -EC_GROUP_copy.3,EC_GROUP_get_degree.3 -EC_GROUP_copy.3,EC_GROUP_get_order.3 -EC_GROUP_copy.3,EC_GROUP_get_point_conversion_form.3 -EC_GROUP_copy.3,EC_GROUP_get_seed_len.3 -EC_GROUP_copy.3,EC_GROUP_order_bits.3 -EC_GROUP_copy.3,EC_GROUP_set_asn1_flag.3 -EC_GROUP_copy.3,EC_GROUP_set_curve_name.3 -EC_GROUP_copy.3,EC_GROUP_set_generator.3 -EC_GROUP_copy.3,EC_GROUP_set_point_conversion_form.3 -EC_GROUP_copy.3,EC_GROUP_set_seed.3 -EC_GROUP_new.3,EC_GROUP_clear_free.3 -EC_GROUP_new.3,EC_GROUP_free.3 -EC_GROUP_new.3,EC_GROUP_get_curve.3 -EC_GROUP_new.3,EC_GROUP_get_curve_GFp.3 -EC_GROUP_new.3,EC_GROUP_new_by_curve_name.3 -EC_GROUP_new.3,EC_GROUP_new_curve_GFp.3 -EC_GROUP_new.3,EC_GROUP_set_curve.3 -EC_GROUP_new.3,EC_GROUP_set_curve_GFp.3 -EC_GROUP_new.3,EC_curve_nid2nist.3 -EC_GROUP_new.3,EC_curve_nist2nid.3 -EC_GROUP_new.3,EC_get_builtin_curves.3 +EC_GROUP_check.3,EC_GROUP_check_discriminant.3 +EC_GROUP_get_curve_name.3,EC_GROUP_get0_seed.3 +EC_GROUP_get_curve_name.3,EC_GROUP_get_asn1_flag.3 +EC_GROUP_get_curve_name.3,EC_GROUP_get_basis_type.3 +EC_GROUP_get_curve_name.3,EC_GROUP_get_point_conversion_form.3 +EC_GROUP_get_curve_name.3,EC_GROUP_get_seed_len.3 +EC_GROUP_get_curve_name.3,EC_GROUP_set_asn1_flag.3 +EC_GROUP_get_curve_name.3,EC_GROUP_set_curve_name.3 +EC_GROUP_get_curve_name.3,EC_GROUP_set_point_conversion_form.3 +EC_GROUP_get_curve_name.3,EC_GROUP_set_seed.3 +EC_GROUP_new_by_curve_name.3,EC_GROUP_cmp.3 +EC_GROUP_new_by_curve_name.3,EC_GROUP_dup.3 +EC_GROUP_new_by_curve_name.3,EC_GROUP_free.3 +EC_GROUP_new_by_curve_name.3,EC_curve_nid2nist.3 +EC_GROUP_new_by_curve_name.3,EC_curve_nist2nid.3 +EC_GROUP_new_by_curve_name.3,EC_get_builtin_curves.3 +EC_GROUP_new_curve_GFp.3,EC_GROUP_clear_free.3 +EC_GROUP_new_curve_GFp.3,EC_GROUP_get0_generator.3 +EC_GROUP_new_curve_GFp.3,EC_GROUP_get_cofactor.3 +EC_GROUP_new_curve_GFp.3,EC_GROUP_get_curve.3 +EC_GROUP_new_curve_GFp.3,EC_GROUP_get_curve_GFp.3 +EC_GROUP_new_curve_GFp.3,EC_GROUP_get_degree.3 +EC_GROUP_new_curve_GFp.3,EC_GROUP_get_order.3 +EC_GROUP_new_curve_GFp.3,EC_GROUP_order_bits.3 +EC_GROUP_new_curve_GFp.3,EC_GROUP_set_curve.3 +EC_GROUP_new_curve_GFp.3,EC_GROUP_set_curve_GFp.3 +EC_GROUP_new_curve_GFp.3,EC_GROUP_set_generator.3 EC_KEY_METHOD_new.3,EC_KEY_METHOD_free.3 EC_KEY_METHOD_new.3,EC_KEY_METHOD_get_compute_key.3 EC_KEY_METHOD_new.3,EC_KEY_METHOD_get_init.3 @@ -724,23 +718,21 @@ EC_POINT_add.3,EC_POINT_is_at_infinity.3 EC_POINT_add.3,EC_POINT_is_on_curve.3 EC_POINT_add.3,EC_POINT_make_affine.3 EC_POINT_add.3,EC_POINT_mul.3 -EC_POINT_new.3,EC_POINT_bn2point.3 +EC_POINT_get_affine_coordinates.3,EC_POINT_get_affine_coordinates_GFp.3 +EC_POINT_get_affine_coordinates.3,EC_POINT_set_affine_coordinates.3 +EC_POINT_get_affine_coordinates.3,EC_POINT_set_affine_coordinates_GFp.3 +EC_POINT_get_affine_coordinates.3,EC_POINT_set_compressed_coordinates.3 +EC_POINT_get_affine_coordinates.3,EC_POINT_set_compressed_coordinates_GFp.3 +EC_POINT_get_affine_coordinates.3,EC_POINT_set_to_infinity.3 EC_POINT_new.3,EC_POINT_clear_free.3 EC_POINT_new.3,EC_POINT_copy.3 EC_POINT_new.3,EC_POINT_dup.3 EC_POINT_new.3,EC_POINT_free.3 -EC_POINT_new.3,EC_POINT_get_affine_coordinates.3 -EC_POINT_new.3,EC_POINT_get_affine_coordinates_GFp.3 -EC_POINT_new.3,EC_POINT_hex2point.3 -EC_POINT_new.3,EC_POINT_oct2point.3 -EC_POINT_new.3,EC_POINT_point2bn.3 -EC_POINT_new.3,EC_POINT_point2hex.3 -EC_POINT_new.3,EC_POINT_point2oct.3 -EC_POINT_new.3,EC_POINT_set_affine_coordinates.3 -EC_POINT_new.3,EC_POINT_set_affine_coordinates_GFp.3 -EC_POINT_new.3,EC_POINT_set_compressed_coordinates.3 -EC_POINT_new.3,EC_POINT_set_compressed_coordinates_GFp.3 -EC_POINT_new.3,EC_POINT_set_to_infinity.3 +EC_POINT_point2oct.3,EC_POINT_bn2point.3 +EC_POINT_point2oct.3,EC_POINT_hex2point.3 +EC_POINT_point2oct.3,EC_POINT_oct2point.3 +EC_POINT_point2oct.3,EC_POINT_point2bn.3 +EC_POINT_point2oct.3,EC_POINT_point2hex.3 ENGINE_new.3,ENGINE_by_id.3 ENGINE_new.3,ENGINE_cleanup.3 ENGINE_new.3,ENGINE_ctrl_cmd.3 From 364fc5b9b9745b071d61afd79b1629d29484695e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 10 May 2025 21:56:05 +0200 Subject: [PATCH 1004/1283] Include "err_local.h" rather than --- crypto/compat/b_win.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/crypto/compat/b_win.c b/crypto/compat/b_win.c index e261cd2c42..72898d68ff 100644 --- a/crypto/compat/b_win.c +++ b/crypto/compat/b_win.c @@ -8,7 +8,8 @@ #include #include -#include + +#include "err_local.h" int BIO_sock_init(void) From 8f6cbc8987d415c4f5817588973ad9bb178b153b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 10 May 2025 21:56:33 +0200 Subject: [PATCH 1005/1283] b_win.c: whitespace nit --- crypto/compat/b_win.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/compat/b_win.c b/crypto/compat/b_win.c index 72898d68ff..45af8397ad 100644 --- a/crypto/compat/b_win.c +++ b/crypto/compat/b_win.c @@ -30,7 +30,7 @@ BIO_sock_init(void) } wsa_init_done = 1; } - return (1); + return (1); } void From de38c5b179d213a6a4d7574f9b6e6746da6de6d4 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 18 May 2025 18:01:45 +0900 Subject: [PATCH 1006/1283] experiment with removing BIO_s_log in advance of upstream removal --- crypto/CMakeLists.txt | 4 ++-- crypto/Makefile.am | 5 ----- 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 64bccd8a2a..b898296b5f 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -570,17 +570,17 @@ set( set(COMPAT_SRC empty.c) +set(CRYPTO_UNEXPORT ${CRYPTO_UNEXPORT} BIO_s_log) + if(UNIX) set(CRYPTO_SRC ${CRYPTO_SRC} crypto_lock.c) set(CRYPTO_SRC ${CRYPTO_SRC} bio/b_posix.c) - set(CRYPTO_SRC ${CRYPTO_SRC} bio/bss_log.c) set(CRYPTO_SRC ${CRYPTO_SRC} ui/ui_openssl.c) endif() if(WIN32) set(CRYPTO_SRC ${CRYPTO_SRC} compat/crypto_lock_win.c) set(CRYPTO_SRC ${CRYPTO_SRC} bio/b_win.c) - set(CRYPTO_UNEXPORT ${CRYPTO_UNEXPORT} BIO_s_log) set(CRYPTO_SRC ${CRYPTO_SRC} ui/ui_openssl_win.c) endif() diff --git a/crypto/Makefile.am b/crypto/Makefile.am index d1c5b76d19..b8628f0fef 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -51,10 +51,8 @@ crypto_portable.sym: crypto.sym Makefile -echo "generating crypto_portable.sym ..." -cp $(top_srcdir)/crypto/crypto.sym crypto_portable.sym -chmod u+w crypto_portable.sym -if HOST_WIN -grep -v BIO_s_log crypto_portable.sym > crypto_portable.sym.tmp -mv crypto_portable.sym.tmp crypto_portable.sym -endif libcrypto_la_objects.mk: Makefile @echo "libcrypto_la_objects= $(libcrypto_la_OBJECTS)" \ @@ -334,9 +332,6 @@ libcrypto_la_SOURCES += bio/bss_conn.c libcrypto_la_SOURCES += bio/bss_dgram.c libcrypto_la_SOURCES += bio/bss_fd.c libcrypto_la_SOURCES += bio/bss_file.c -if !HOST_WIN -libcrypto_la_SOURCES += bio/bss_log.c -endif libcrypto_la_SOURCES += bio/bss_mem.c libcrypto_la_SOURCES += bio/bss_null.c libcrypto_la_SOURCES += bio/bss_sock.c From 15bc02adc578c0c1f5afd1fbd9c96bbcfa388ad7 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 18 May 2025 20:45:36 +0900 Subject: [PATCH 1007/1283] fix gitignore brokenness in crypto /crypto/* masks too much and breaks the exclusion function. The docs for gitignore state that if a parent directory is ignored, negating a pattern with a ! prefix has no effect since it is not possible to reinclude a file if the parent director is excluded. https://git-scm.com/docs/gitignore This just is more explicit, which catches files added out of tree more readily. Also delete the long-removed libtls-standalone references --- .gitignore | 112 ++++++++++++++++++++++++++++----------- crypto/compat/.gitignore | 31 +++++++++++ 2 files changed, 113 insertions(+), 30 deletions(-) create mode 100644 crypto/compat/.gitignore diff --git a/.gitignore b/.gitignore index fa052760db..7f8b3f4091 100644 --- a/.gitignore +++ b/.gitignore @@ -237,36 +237,88 @@ include/openssl/*.h !/apps/openssl/apps_win.c !/apps/openssl/certhash_win.c -/crypto/* -!/crypto/Makefile.am.* -/crypto/arch/ -!/crypto/arch/mips/* -!/crypto/arch/loongarch64/* -!/crypto/compat/ -/crypto/compat/* -!/crypto/compat/arc4random.h -!/crypto/compat/b_win.c -!/crypto/compat/explicit_bzero_win.c -!/crypto/compat/freezero.c -!/crypto/compat/getdelim.c -!/crypto/compat/getline.c -!/crypto/compat/getpagesize.c -!/crypto/compat/posix_win.c -!/crypto/compat/bsd_asprintf.c -!/crypto/compat/ui_openssl_win.c -!/crypto/compat/crypto_lock_win.c -!/crypto/CMakeLists.txt - -!/libtls-standalone/compat/Makefile.am -/libtls-standalone/include/*.h -/libtls-standalone/src/*.c -/libtls-standalone/src/*.h -/libtls-standalone/src -/libtls-standalone/tests/test -/libtls-standalone/compat -/libtls-standalone/VERSION -/libtls-standalone/m4 -/libtls-standalone/man +/crypto/*.c +/crypto/*.h +/crypto/aes/ +/crypto/arch/aarch64/ +/crypto/arch/alpha/ +/crypto/arch/amd64/ +/crypto/arch/arm/ +/crypto/arch/hppa/ +/crypto/arch/i386/ +/crypto/arch/m88k/ +/crypto/arch/mips64/ +/crypto/arch/powerpc/ +/crypto/arch/powerpc64/ +/crypto/arch/riscv64/ +/crypto/arch/sh/ +/crypto/arch/sparc64/ +/crypto/asn1/ +/crypto/bf/ +/crypto/bio/ +/crypto/bn/*.c +/crypto/bn/*.h +/crypto/bn/arch/aarch64/ +/crypto/bn/arch/alpha/ +/crypto/bn/arch/amd64/ +/crypto/bn/arch/arm/ +/crypto/bn/arch/hppa/ +/crypto/bn/arch/i386/ +/crypto/bn/arch/m88k/ +/crypto/bn/arch/mips64/ +/crypto/bn/arch/powerpc/ +/crypto/bn/arch/powerpc64/ +/crypto/bn/arch/riscv64/ +/crypto/bn/arch/sh/ +/crypto/bn/arch/sparc64/ +/crypto/buffer/ +/crypto/bytestring/ +/crypto/camellia/ +/crypto/cast/ +/crypto/chacha/ +/crypto/cmac/ +/crypto/cms/ +/crypto/conf/ +/crypto/ct/ +/crypto/curve25519/ +/crypto/des/ +/crypto/dh/ +/crypto/dsa/ +/crypto/ec/ +/crypto/ecdh/ +/crypto/ecdsa/ +/crypto/engine/ +/crypto/err/ +/crypto/evp/ +/crypto/hidden/ +/crypto/hkdf/ +/crypto/hmac/ +/crypto/idea/ +/crypto/kdf/ +/crypto/lhash/ +/crypto/md4/ +/crypto/md5/ +/crypto/mlkem/ +/crypto/modes/ +/crypto/objects/ +/crypto/ocsp/ +/crypto/pem/ +/crypto/pkcs12/ +/crypto/pkcs7/ +/crypto/poly1305/ +/crypto/rand/ +/crypto/rc2/ +/crypto/rc4/ +/crypto/ripemd/ +/crypto/rsa/ +/crypto/sha/ +/crypto/sm3/ +/crypto/sm4/ +/crypto/stack/ +/crypto/ts/ +/crypto/txt_db/ +/crypto/ui/ +/crypto/x509/ openbsd/ diff --git a/crypto/compat/.gitignore b/crypto/compat/.gitignore new file mode 100644 index 0000000000..7f050493ca --- /dev/null +++ b/crypto/compat/.gitignore @@ -0,0 +1,31 @@ +arc4random.c +arc4random_aix.h +arc4random_freebsd.h +arc4random_hpux.h +arc4random_linux.h +arc4random_netbsd.h +arc4random_osx.h +arc4random_solaris.h +arc4random_uniform.c +arc4random_win.h +chacha_private.h +explicit_bzero.c +getentropy_aix.c +getentropy_freebsd.c +getentropy_hpux.c +getentropy_linux.c +getentropy_netbsd.c +getentropy_osx.c +getentropy_solaris.c +getentropy_win.c +reallocarray.c +recallocarray.c +strcasecmp.c +strlcat.c +strlcpy.c +strndup.c +strnlen.c +strsep.c +strtonum.c +timingsafe_bcmp.c +timingsafe_memcmp.c From 0341e8da9f01714d005c5c6eef6faa6e5df3e362 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 18 May 2025 20:44:21 +0900 Subject: [PATCH 1008/1283] remove tmp files left behind during masm generation --- update.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/update.sh b/update.sh index eec551c70d..07403b0c0c 100755 --- a/update.sh +++ b/update.sh @@ -210,6 +210,7 @@ gen_asm_stdout() { EOF if [ $1 = "masm" ]; then fixup_masm crypto/$3.tmp crypto/$3 + rm crypto/$3.tmp else $MV crypto/$3.tmp crypto/$3 fi @@ -238,6 +239,7 @@ gen_asm() { EOF if [ $1 = "masm" ]; then fixup_masm crypto/$3.tmp crypto/$3 + rm crypto/$3.tmp else $MV crypto/$3.tmp crypto/$3 fi From 5e98a097cf7fd4469c1281583b2456b08de60f73 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 19 May 2025 06:19:10 +0900 Subject: [PATCH 1009/1283] ignore only upstream files --- .gitignore | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 7f8b3f4091..9516e76e59 100644 --- a/.gitignore +++ b/.gitignore @@ -240,7 +240,8 @@ include/openssl/*.h /crypto/*.c /crypto/*.h /crypto/aes/ -/crypto/arch/aarch64/ +/crypto/arch/aarch64/crypto_arch.h +/crypto/arch/aarch64/crypto_cpu_caps.c /crypto/arch/alpha/ /crypto/arch/amd64/ /crypto/arch/arm/ From 57af1184805d44d48c1f6df7e13f1f823dceb6f4 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 18 May 2025 20:02:27 +0900 Subject: [PATCH 1010/1283] create noop and apple cpu_caps checks for aarch64 --- crypto/CMakeLists.txt | 8 ++- crypto/Makefile.am | 9 +++ crypto/arch/aarch64/crypto_cpu_caps_apple.c | 60 +++++++++++++++++++ crypto/arch/aarch64/crypto_cpu_caps_none.c | 26 ++++++++ patches/patch-aarch64-crypto-cpu-caps.c.patch | 39 ------------ 5 files changed, 102 insertions(+), 40 deletions(-) create mode 100644 crypto/arch/aarch64/crypto_cpu_caps_apple.c create mode 100644 crypto/arch/aarch64/crypto_cpu_caps_none.c delete mode 100644 patches/patch-aarch64-crypto-cpu-caps.c.patch diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index b898296b5f..184fbf6b1a 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -146,7 +146,13 @@ if(HOST_ASM_MINGW64_X86_64) endif() if(HOST_AARCH64) - set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps.c) + if(APPLE) + set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_apple.c) + elseif(CMAKE_SYSTEM_NAME STREQUAL "OpenBSD") + set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps.c) + else() + set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_none.c) + endif() elseif(HOST_X86_64) set(CRYPTO_SRC ${CRYPTO_SRC} arch/amd64/crypto_cpu_caps.c) elseif(HOST_I386) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index b8628f0fef..bbce59a4d8 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -210,8 +210,17 @@ endif endif if HOST_AARCH64 +if HOST_DARWIN +libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_apple.c +else +if HOST_OPENBSD libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps.c +else +libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_none.c +endif endif +endif + if HOST_X86_64 libcrypto_la_SOURCES += arch/amd64/crypto_cpu_caps.c endif diff --git a/crypto/arch/aarch64/crypto_cpu_caps_apple.c b/crypto/arch/aarch64/crypto_cpu_caps_apple.c new file mode 100644 index 0000000000..1dd91b20a8 --- /dev/null +++ b/crypto/arch/aarch64/crypto_cpu_caps_apple.c @@ -0,0 +1,60 @@ +/* $OpenBSD: crypto_cpu_caps.c,v 1.2 2024/11/12 13:52:31 jsing Exp $ */ +/* + * Copyright (c) 2025 Brent Cook + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#include + +#include "crypto_arch.h" + +/* Machine dependent CPU capabilities. */ +uint64_t crypto_cpu_caps_aarch64; + +static uint64_t +check_cpu_cap(const char *cap_name, uint64_t cap_flag) +{ + int has_cap = 0; + size_t len = sizeof(has_cap); + + sysctlbyname(cap_name, &has_cap, &len, NULL, 0); + + return has_cap ? cap_flag : 0; +} + +void +crypto_cpu_caps_init(void) +{ + crypto_cpu_caps_aarch64 = 0; + + /* from https://developer.apple.com/documentation/kernel/1387446-sysctlbyname/determining_instruction_set_characteristics#3918855 */ + + crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_AES", + CRYPTO_CPU_CAPS_AARCH64_AES); + + crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_PMULL", + CRYPTO_CPU_CAPS_AARCH64_PMULL); + + crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_SHA1", + CRYPTO_CPU_CAPS_AARCH64_SHA1); + + crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_SHA256", + CRYPTO_CPU_CAPS_AARCH64_SHA2); + + crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_SHA512", + CRYPTO_CPU_CAPS_AARCH64_SHA512); + + crypto_cpu_caps_aarch64 |= check_cpu_cap("hw.optional.arm.FEAT_SHA3", + CRYPTO_CPU_CAPS_AARCH64_SHA3); +} diff --git a/crypto/arch/aarch64/crypto_cpu_caps_none.c b/crypto/arch/aarch64/crypto_cpu_caps_none.c new file mode 100644 index 0000000000..dcd96b7ef3 --- /dev/null +++ b/crypto/arch/aarch64/crypto_cpu_caps_none.c @@ -0,0 +1,26 @@ +/* + * Copyright (c) 2025 Brent Cook + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#include "crypto_arch.h" + +/* Machine dependent CPU capabilities. */ +uint64_t crypto_cpu_caps_aarch64; + +void +crypto_cpu_caps_init(void) +{ + crypto_cpu_caps_aarch64 = 0; +} diff --git a/patches/patch-aarch64-crypto-cpu-caps.c.patch b/patches/patch-aarch64-crypto-cpu-caps.c.patch deleted file mode 100644 index dcfbdc09b9..0000000000 --- a/patches/patch-aarch64-crypto-cpu-caps.c.patch +++ /dev/null @@ -1,39 +0,0 @@ -Disable feature detection until we find a more portable way. - ---- crypto/arch/aarch64/crypto_cpu_caps.c.orig Sat Dec 14 13:45:16 2024 -+++ crypto/arch/aarch64/crypto_cpu_caps.c Sat Dec 14 13:54:06 2024 -@@ -16,9 +16,12 @@ - */ - - #include -+ -+#if defined(__OpenBSD__) - #include - - #include -+#endif - - #include - #include -@@ -67,6 +70,7 @@ parse_isar0(uint64_t isar0) - return caps; - } - -+#if defined(__OpenBSD__) - static int - read_isar0(uint64_t *isar0) - { -@@ -84,6 +88,13 @@ read_isar0(uint64_t *isar0) - - return 1; - } -+#else -+static int -+read_isar0(uint64_t *isar0) -+{ -+ return 0; -+} -+#endif - - void - crypto_cpu_caps_init(void) From b905935b885023c203f24a9cdfbebde1ab965b0b Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 18 May 2025 14:14:50 -0500 Subject: [PATCH 1011/1283] add linux aarc64 cpu_caps --- crypto/CMakeLists.txt | 2 + crypto/Makefile.am | 4 ++ crypto/arch/aarch64/crypto_cpu_caps_linux.c | 62 +++++++++++++++++++++ 3 files changed, 68 insertions(+) create mode 100644 crypto/arch/aarch64/crypto_cpu_caps_linux.c diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 184fbf6b1a..dff4993398 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -148,6 +148,8 @@ endif() if(HOST_AARCH64) if(APPLE) set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_apple.c) + elseif(LINUX) + set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_linux.c) elseif(CMAKE_SYSTEM_NAME STREQUAL "OpenBSD") set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps.c) else() diff --git a/crypto/Makefile.am b/crypto/Makefile.am index bbce59a4d8..0d130d8562 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -213,6 +213,9 @@ if HOST_AARCH64 if HOST_DARWIN libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_apple.c else +if HOST_LINUX +libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_linux.c +else if HOST_OPENBSD libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps.c else @@ -220,6 +223,7 @@ libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_none.c endif endif endif +endif if HOST_X86_64 libcrypto_la_SOURCES += arch/amd64/crypto_cpu_caps.c diff --git a/crypto/arch/aarch64/crypto_cpu_caps_linux.c b/crypto/arch/aarch64/crypto_cpu_caps_linux.c new file mode 100644 index 0000000000..ae28120bb8 --- /dev/null +++ b/crypto/arch/aarch64/crypto_cpu_caps_linux.c @@ -0,0 +1,62 @@ +/* $OpenBSD: crypto_cpu_caps.c,v 1.2 2024/11/12 13:52:31 jsing Exp $ */ +/* + * Copyright (c) 2025 Brent Cook + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#include + +/* from arch/arm64/include/uapi/asm/hwcap.h */ +#define HWCAP_AES (1 << 3) +#define HWCAP_PMULL (1 << 4) +#define HWCAP_SHA1 (1 << 5) +#define HWCAP_SHA2 (1 << 6) +#define HWCAP_CRC32 (1 << 7) +#define HWCAP_SHA3 (1 << 17) +#define HWCAP_SHA512 (1 << 21) + +#include "crypto_arch.h" + +/* Machine dependent CPU capabilities. */ +uint64_t crypto_cpu_caps_aarch64; + +static uint64_t +check_cpu_cap(unsigned long hwcap, uint64_t cap_flag) +{ + return (getauxval(AT_HWCAP) & hwcap) ? cap_flag : 0; +} + +void +crypto_cpu_caps_init(void) +{ + crypto_cpu_caps_aarch64 = 0; + + crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_AES, + CRYPTO_CPU_CAPS_AARCH64_AES); + + crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_PMULL, + CRYPTO_CPU_CAPS_AARCH64_PMULL); + + crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_SHA1, + CRYPTO_CPU_CAPS_AARCH64_SHA1); + + crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_SHA2, + CRYPTO_CPU_CAPS_AARCH64_SHA2); + + crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_SHA512, + CRYPTO_CPU_CAPS_AARCH64_SHA512); + + crypto_cpu_caps_aarch64 |= check_cpu_cap(HWCAP_SHA3, + CRYPTO_CPU_CAPS_AARCH64_SHA3); +} From 570b0b73c7ebd2506a1fd4b890a76d8588a342a6 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 19 May 2025 06:19:25 +0900 Subject: [PATCH 1012/1283] add windows aarch64 cpu_caps --- crypto/CMakeLists.txt | 2 ++ crypto/arch/aarch64/crypto_cpu_caps_windows.c | 36 +++++++++++++++++++ 2 files changed, 38 insertions(+) create mode 100644 crypto/arch/aarch64/crypto_cpu_caps_windows.c diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index dff4993398..1c6436c1ed 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -152,6 +152,8 @@ if(HOST_AARCH64) set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_linux.c) elseif(CMAKE_SYSTEM_NAME STREQUAL "OpenBSD") set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps.c) + elseif(WIN32) + set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_windows.c) else() set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_none.c) endif() diff --git a/crypto/arch/aarch64/crypto_cpu_caps_windows.c b/crypto/arch/aarch64/crypto_cpu_caps_windows.c new file mode 100644 index 0000000000..e7cddedfc1 --- /dev/null +++ b/crypto/arch/aarch64/crypto_cpu_caps_windows.c @@ -0,0 +1,36 @@ +/* $OpenBSD: crypto_cpu_caps.c,v 1.2 2024/11/12 13:52:31 jsing Exp $ */ +/* + * Copyright (c) 2025 Brent Cook + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#include + +#include "crypto_arch.h" + +/* Machine dependent CPU capabilities. */ +uint64_t crypto_cpu_caps_aarch64; + +void +crypto_cpu_caps_init(void) +{ + crypto_cpu_caps_aarch64 = 0; + + if (IsProcessorFeaturePresent(PF_ARM_V8_CRYPTO_INSTRUCTIONS_AVAILABLE)) { + crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_AES; + crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_PMULL; + crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_SHA1; + crypto_cpu_caps_aarch64 |= CRYPTO_CPU_CAPS_AARCH64_SHA2; + } +} From 2a3e1b6df73d2cc267b9d38c697597e659d762f5 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 19 May 2025 14:23:10 +0900 Subject: [PATCH 1013/1283] rename cpu_caps apple to darwin --- crypto/CMakeLists.txt | 2 +- crypto/Makefile.am | 2 +- .../{crypto_cpu_caps_apple.c => crypto_cpu_caps_darwin.c} | 0 3 files changed, 2 insertions(+), 2 deletions(-) rename crypto/arch/aarch64/{crypto_cpu_caps_apple.c => crypto_cpu_caps_darwin.c} (100%) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 1c6436c1ed..cee92efdde 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -147,7 +147,7 @@ endif() if(HOST_AARCH64) if(APPLE) - set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_apple.c) + set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_darwin.c) elseif(LINUX) set(CRYPTO_SRC ${CRYPTO_SRC} arch/aarch64/crypto_cpu_caps_linux.c) elseif(CMAKE_SYSTEM_NAME STREQUAL "OpenBSD") diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 0d130d8562..25e6363e48 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -211,7 +211,7 @@ endif if HOST_AARCH64 if HOST_DARWIN -libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_apple.c +libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_darwin.c else if HOST_LINUX libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_linux.c diff --git a/crypto/arch/aarch64/crypto_cpu_caps_apple.c b/crypto/arch/aarch64/crypto_cpu_caps_darwin.c similarity index 100% rename from crypto/arch/aarch64/crypto_cpu_caps_apple.c rename to crypto/arch/aarch64/crypto_cpu_caps_darwin.c From 48d4157f99c00a1180db5298385d396ef840adda Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 19 May 2025 14:25:30 +0900 Subject: [PATCH 1014/1283] trim some whitespace for hpux checks --- m4/check-os-options.m4 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/m4/check-os-options.m4 b/m4/check-os-options.m4 index 2ef42937fa..b9f10c7562 100644 --- a/m4/check-os-options.m4 +++ b/m4/check-os-options.m4 @@ -74,14 +74,14 @@ char buf[1]; getentropy(buf, 1); ;; *hpux*) HOST_OS=hpux; - if test "`echo $host_os | cut -c 1-4`" = "ia64" ; then - if test "`echo $CC | cut -d ' ' -f 1`" = "gcc" ; then + if test "echo $host_os | cut -c 1-4" = "ia64" ; then + if test "echo $CC | cut -d ' ' -f 1" = "gcc" ; then CFLAGS="$CFLAGS -mlp64" else CFLAGS="+DD64" fi fi - if ! test "`echo $CC | cut -d ' ' -f 1`" = "gcc" ; then + if ! test "echo $CC | cut -d ' ' -f 1" = "gcc" ; then CFLAGS="-g -O2 +Otype_safety=off $CFLAGS $USER_CFLAGS" fi CPPFLAGS="$CPPFLAGS -D_XOPEN_SOURCE=600 -D__STRICT_ALIGNMENT" From 40a14f39891530ef09466a07a209d0e59b4762dd Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 19 May 2025 14:27:36 +0900 Subject: [PATCH 1015/1283] ignore more build artifacts --- .gitignore | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 9516e76e59..ba3495f66a 100644 --- a/.gitignore +++ b/.gitignore @@ -38,7 +38,7 @@ Makefile Makefile.in # CMake stuff -build +build* cmake-build-debug/ # Libtool stuff @@ -204,6 +204,7 @@ ssl/VERSION tls/VERSION libtls-standalone/VERSION +crypto/*.mk ssl/hidden ssl/*.c ssl/*.h From 95fea99949550d5d07ad5c03921e374f070a110e Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Thu, 22 May 2025 09:34:52 +0900 Subject: [PATCH 1016/1283] update.sh: stop generating vpaes and bsaes x86_64 assembly Remove generation of vpaes and bsaes assembly sources from update.sh, as these are removed from source tree. See: https://github.com/openbsd/src/commit/824f363240372afd9c86bea543128d656b531c16 --- update.sh | 2 -- 1 file changed, 2 deletions(-) diff --git a/update.sh b/update.sh index 07403b0c0c..941a67912a 100755 --- a/update.sh +++ b/update.sh @@ -276,8 +276,6 @@ for abi in elf macosx masm mingw64; do echo generating x86_64 ASM source for $abi gen_asm_stdout $abi aes/asm/aes-x86_64.pl aes/aes-$abi-x86_64.S - gen_asm_stdout $abi aes/asm/vpaes-x86_64.pl aes/vpaes-$abi-x86_64.S - gen_asm_stdout $abi aes/asm/bsaes-x86_64.pl aes/bsaes-$abi-x86_64.S gen_asm_stdout $abi aes/asm/aesni-x86_64.pl aes/aesni-$abi-x86_64.S gen_asm_stdout $abi bn/asm/modexp512-x86_64.pl bn/modexp512-$abi-x86_64.S gen_asm_stdout $abi bn/asm/x86_64-mont.pl bn/mont-$abi-x86_64.S From 7885f9bfc6abda7a04dda1da4f4bf0da78d500ad Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Thu, 22 May 2025 09:47:56 +0900 Subject: [PATCH 1017/1283] update CMake and Makefile --- crypto/CMakeLists.txt | 8 -------- crypto/Makefile.am.elf-x86_64 | 2 -- crypto/Makefile.am.macosx-x86_64 | 2 -- crypto/Makefile.am.masm-x86_64 | 2 -- crypto/Makefile.am.mingw64-x86_64 | 2 -- 5 files changed, 16 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index cee92efdde..4f3f338f31 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -23,8 +23,6 @@ if(HOST_ASM_ELF_X86_64) set( ASM_X86_64_ELF_SRC aes/aes-elf-x86_64.S - aes/bsaes-elf-x86_64.S - aes/vpaes-elf-x86_64.S aes/aesni-elf-x86_64.S bn/modexp512-elf-x86_64.S bn/mont-elf-x86_64.S @@ -60,8 +58,6 @@ if(HOST_ASM_MACOSX_X86_64) set( ASM_X86_64_MACOSX_SRC aes/aes-macosx-x86_64.S - aes/bsaes-macosx-x86_64.S - aes/vpaes-macosx-x86_64.S aes/aesni-macosx-x86_64.S bn/modexp512-macosx-x86_64.S bn/mont-macosx-x86_64.S @@ -98,8 +94,6 @@ if(HOST_ASM_MASM_X86_64) set( ASM_X86_64_MASM_SRC aes/aes-masm-x86_64.S - aes/bsaes-masm-x86_64.S - aes/vpaes-masm-x86_64.S aes/aesni-masm-x86_64.S #bn/modexp512-masm-x86_64.S #bn/mont-masm-x86_64.S @@ -124,8 +118,6 @@ if(HOST_ASM_MINGW64_X86_64) set( ASM_X86_64_MINGW64_SRC aes/aes-mingw64-x86_64.S - aes/bsaes-mingw64-x86_64.S - aes/vpaes-mingw64-x86_64.S aes/aesni-mingw64-x86_64.S #bn/modexp512-mingw64-x86_64.S #bn/mont-mingw64-x86_64.S diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index c62662c792..c85ede8eaf 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -1,7 +1,5 @@ ASM_X86_64_ELF = aes/aes-elf-x86_64.S -ASM_X86_64_ELF += aes/bsaes-elf-x86_64.S -ASM_X86_64_ELF += aes/vpaes-elf-x86_64.S ASM_X86_64_ELF += aes/aesni-elf-x86_64.S ASM_X86_64_ELF += bn/modexp512-elf-x86_64.S ASM_X86_64_ELF += bn/mont-elf-x86_64.S diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index 010e3be826..b8bc8939b3 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -1,7 +1,5 @@ ASM_X86_64_MACOSX = aes/aes-macosx-x86_64.S -ASM_X86_64_MACOSX += aes/bsaes-macosx-x86_64.S -ASM_X86_64_MACOSX += aes/vpaes-macosx-x86_64.S ASM_X86_64_MACOSX += aes/aesni-macosx-x86_64.S ASM_X86_64_MACOSX += bn/modexp512-macosx-x86_64.S ASM_X86_64_MACOSX += bn/mont-macosx-x86_64.S diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index 2ef7e1b638..a9225bea64 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -1,7 +1,5 @@ ASM_X86_64_MASM = aes/aes-masm-x86_64.S -ASM_X86_64_MASM += aes/bsaes-masm-x86_64.S -ASM_X86_64_MASM += aes/vpaes-masm-x86_64.S ASM_X86_64_MASM += aes/aesni-masm-x86_64.S ASM_X86_64_MASM += bn/modexp512-masm-x86_64.S ASM_X86_64_MASM += bn/mont-masm-x86_64.S diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index 8e39e9f745..72b767f966 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -1,7 +1,5 @@ ASM_X86_64_MINGW64 = aes/aes-mingw64-x86_64.S -ASM_X86_64_MINGW64 += aes/bsaes-mingw64-x86_64.S -ASM_X86_64_MINGW64 += aes/vpaes-mingw64-x86_64.S ASM_X86_64_MINGW64 += aes/aesni-mingw64-x86_64.S #ASM_X86_64_MINGW64 += bn/modexp512-mingw64-x86_64.S #ASM_X86_64_MINGW64 += bn/mont-mingw64-x86_64.S From 5011fa2a0a08dd764a5f3fc6dca3069b40f27b75 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 24 May 2025 21:24:26 -0600 Subject: [PATCH 1018/1283] remove arm perlasm tendrils --- CMakeLists.txt | 2 -- configure.ac | 2 -- crypto/CMakeLists.txt | 19 ------------------- crypto/Makefile.am | 4 ---- crypto/Makefile.am.elf-arm | 18 ------------------ update.sh | 11 ----------- 6 files changed, 56 deletions(-) delete mode 100644 crypto/Makefile.am.elf-arm diff --git a/CMakeLists.txt b/CMakeLists.txt index 8437e02e4a..c2a3e93aaf 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -407,8 +407,6 @@ if(ENABLE_ASM) if(CMAKE_C_COMPILER_ABI STREQUAL "ELF") if(HOST_X86_64) set(HOST_ASM_ELF_X86_64 true) - elseif(HOST_ARM) - set(HOST_ASM_ELF_ARMV4 true) elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND HOST_I386) set(HOST_ASM_ELF_X86_64 true) endif() diff --git a/configure.ac b/configure.ac index 7a88f27a66..fad8406359 100644 --- a/configure.ac +++ b/configure.ac @@ -114,8 +114,6 @@ AC_ARG_ENABLE([asm], AS_HELP_STRING([--disable-asm], [Disable assembly])) AM_CONDITIONAL([OPENSSL_NO_ASM], [test "x$enable_asm" = "xno"]) # Conditionally enable assembly by default -AM_CONDITIONAL([HOST_ASM_ELF_ARM], - [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "arm" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_ELF_MIPS], [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "mips" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_ELF_MIPS64], diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 4f3f338f31..d949bcdf12 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -1,24 +1,5 @@ add_definitions(-DLIBRESSL_CRYPTO_INTERNAL) -if(HOST_ASM_ELF_ARMV4) - set( - ASM_ARMV4_ELF_SRC - aes/aes-elf-armv4.S - bn/mont-elf-armv4.S - sha/sha1-elf-armv4.S - sha/sha512-elf-armv4.S - sha/sha256-elf-armv4.S - modes/ghash-elf-armv4.S - armv4cpuid.S - armcap.c - ) - add_definitions(-DAES_ASM) - add_definitions(-DOPENSSL_BN_ASM_MONT) - add_definitions(-DGHASH_ASM) - add_definitions(-DOPENSSL_CPUID_OBJ) - set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_ARMV4_ELF_SRC}) -endif() - if(HOST_ASM_ELF_X86_64) set( ASM_X86_64_ELF_SRC diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 25e6363e48..df5560e6af 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -185,7 +185,6 @@ include Makefile.am.arc4random libcrypto_la_SOURCES = EXTRA_libcrypto_la_SOURCES = -include Makefile.am.elf-arm include Makefile.am.elf-mips include Makefile.am.elf-mips64 include Makefile.am.elf-x86_64 @@ -193,7 +192,6 @@ include Makefile.am.macosx-x86_64 include Makefile.am.masm-x86_64 include Makefile.am.mingw64-x86_64 -if !HOST_ASM_ELF_ARM if !HOST_ASM_ELF_MIPS if !HOST_ASM_ELF_MIPS64 if !HOST_ASM_ELF_X86_64 @@ -207,7 +205,6 @@ endif endif endif endif -endif if HOST_AARCH64 if HOST_DARWIN @@ -242,7 +239,6 @@ else libcrypto_la_SOURCES += compat/crypto_lock_win.c endif libcrypto_la_SOURCES += crypto_memory.c -noinst_HEADERS += arm_arch.h noinst_HEADERS += constant_time.h noinst_HEADERS += crypto_internal.h noinst_HEADERS += crypto_local.h diff --git a/crypto/Makefile.am.elf-arm b/crypto/Makefile.am.elf-arm deleted file mode 100644 index 6a9fa50485..0000000000 --- a/crypto/Makefile.am.elf-arm +++ /dev/null @@ -1,18 +0,0 @@ -ASM_ARM_ELF = aes/aes-elf-armv4.S -ASM_ARM_ELF += bn/mont-elf-armv4.S -ASM_ARM_ELF += sha/sha1-elf-armv4.S -ASM_ARM_ELF += sha/sha512-elf-armv4.S -ASM_ARM_ELF += sha/sha256-elf-armv4.S -ASM_ARM_ELF += modes/ghash-elf-armv4.S -ASM_ARM_ELF += armv4cpuid.S -ASM_ARM_ELF += armcap.c - -EXTRA_DIST += $(ASM_ARM_ELF) - -if HOST_ASM_ELF_ARM -libcrypto_la_CPPFLAGS += -DAES_ASM -libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT -libcrypto_la_CPPFLAGS += -DGHASH_ASM -libcrypto_la_CPPFLAGS += -DOPENSSL_CPUID_OBJ -libcrypto_la_SOURCES += $(ASM_ARM_ELF) -endif diff --git a/update.sh b/update.sh index 941a67912a..f29cdeb699 100755 --- a/update.sh +++ b/update.sh @@ -261,17 +261,6 @@ gen_asm_mips 64 sha sha1-mips sha1-mips64 gen_asm_mips 64 sha sha512-mips sha256-mips64 gen_asm_mips 64 sha sha512-mips sha512-mips64 -echo generating arm ASM source for elf -gen_asm_stdout elf aes/asm/aes-armv4.pl aes/aes-elf-armv4.S -gen_asm_stdout elf bn/asm/armv4-mont.pl bn/mont-elf-armv4.S -gen_asm_stdout elf sha/asm/sha1-armv4-large.pl sha/sha1-elf-armv4.S -gen_asm_stdout elf sha/asm/sha256-armv4.pl sha/sha256-elf-armv4.S -gen_asm_stdout elf sha/asm/sha512-armv4.pl sha/sha512-elf-armv4.S -gen_asm_stdout elf modes/asm/ghash-armv4.pl modes/ghash-elf-armv4.S -$CP $libcrypto_src/arch/arm/armv4cpuid.S crypto -$CP $libcrypto_src/arch/arm/armcap.c crypto -$CP $libcrypto_src/arch/arm/arm_arch.h crypto - for abi in elf macosx masm mingw64; do echo generating x86_64 ASM source for $abi From fbdc64358eac93c769b4dcf9fa070b225f65a095 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 02:32:57 -0600 Subject: [PATCH 1019/1283] Update .gitignore --- .gitignore | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index ba3495f66a..18d42dcb04 100644 --- a/.gitignore +++ b/.gitignore @@ -133,6 +133,7 @@ tests/tls_ext_alpn* tests/tls_prf* tests/*test tests/tests.h +tests/test.h tests/*test.c tests/pbkdf2* tests/*.pem @@ -153,7 +154,7 @@ tests/x509req_ext* tests/client.c tests/init_pledge.c tests/server.c -tests/util.c +tests/*util.c tests/valid_handshakes_terminate* tests/handshake_table* From 360c36c195a3f2f86638be01777529b89014b353 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 03:19:12 -0600 Subject: [PATCH 1020/1283] regen speed.c patch --- patches/speed.c.patch | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/patches/speed.c.patch b/patches/speed.c.patch index e1f1698154..32e42b42d3 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -1,6 +1,6 @@ ---- apps/openssl/speed.c.orig Thu Jan 2 08:04:28 2025 -+++ apps/openssl/speed.c Thu Jan 2 08:04:38 2025 -@@ -158,7 +158,16 @@ static void +--- apps/openssl/speed.c.orig Sat May 31 03:18:05 2025 ++++ apps/openssl/speed.c Sat May 31 03:18:17 2025 +@@ -154,7 +154,16 @@ static void pkey_print_message(const char *str, const char *str2, long num, int bits, int sec); static void print_result(int alg, int run_no, int count, double time_used); @@ -15,9 +15,9 @@ +#define alarm(seconds) speed_alarm((seconds)) +#endif - #define ALGOR_NUM 32 + #define ALGOR_NUM 31 #define SIZE_NUM 5 -@@ -1129,8 +1138,10 @@ speed_main(int argc, char **argv) +@@ -1087,8 +1096,10 @@ speed_main(int argc, char **argv) const EVP_CIPHER *evp_cipher = NULL; const EVP_MD *evp_md = NULL; int decrypt = 0; @@ -28,7 +28,7 @@ const char *errstr = NULL; if (pledge("stdio proc", NULL) == -1) { -@@ -1205,6 +1216,7 @@ speed_main(int argc, char **argv) +@@ -1163,6 +1174,7 @@ speed_main(int argc, char **argv) decrypt = 1; j--; /* Otherwise, -decrypt gets confused with an * algorithm. */ @@ -36,7 +36,7 @@ } else if (argc > 0 && strcmp(*argv, "-multi") == 0) { argc--; argv++; -@@ -1219,6 +1231,7 @@ speed_main(int argc, char **argv) +@@ -1177,6 +1189,7 @@ speed_main(int argc, char **argv) } j--; /* Otherwise, -multi gets confused with an * algorithm. */ @@ -44,7 +44,7 @@ } else if (argc > 0 && strcmp(*argv, "-unaligned") == 0) { argc--; argv++; -@@ -1542,7 +1555,9 @@ speed_main(int argc, char **argv) +@@ -1491,7 +1504,9 @@ speed_main(int argc, char **argv) BIO_printf(bio_err, "-evp e use EVP e.\n"); BIO_printf(bio_err, "-decrypt time decryption instead of encryption (only EVP).\n"); BIO_printf(bio_err, "-mr produce machine readable output.\n"); @@ -54,7 +54,7 @@ BIO_printf(bio_err, "-unaligned n use buffers with offset n from proper alignment.\n"); goto end; } -@@ -1551,8 +1566,10 @@ speed_main(int argc, char **argv) +@@ -1500,8 +1515,10 @@ speed_main(int argc, char **argv) j++; } @@ -65,7 +65,7 @@ if (j == 0) { for (i = 0; i < ALGOR_NUM; i++) { -@@ -1624,11 +1641,13 @@ speed_main(int argc, char **argv) +@@ -1573,11 +1590,13 @@ speed_main(int argc, char **argv) #define COND(c) (run && count<0x7fffffff) #define COUNT(d) (count) @@ -79,7 +79,7 @@ #ifndef OPENSSL_NO_MD4 if (doit[D_MD4]) { -@@ -2434,7 +2453,9 @@ speed_main(int argc, char **argv) +@@ -2370,7 +2389,9 @@ speed_main(int argc, char **argv) ecdh_doit[j] = 0; } } @@ -89,7 +89,7 @@ if (!mr) { fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION)); fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON)); -@@ -2590,11 +2611,15 @@ pkey_print_message(const char *str, const char *str2, +@@ -2526,11 +2547,15 @@ pkey_print_message(const char *str, const char *str2, static void print_result(int alg, int run_no, int count, double time_used) { @@ -105,7 +105,7 @@ static char * sstrsep(char **string, const char *delim) { -@@ -2795,5 +2820,6 @@ do_multi(int multi) +@@ -2731,5 +2756,6 @@ do_multi(int multi) free(fds); return 1; } From ab4755f9919cfa3b224d513fe220e99d378f765e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 03:21:46 -0600 Subject: [PATCH 1021/1283] regen openssl.c patch --- patches/openssl.c.patch | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/patches/openssl.c.patch b/patches/openssl.c.patch index 5ba5ac6664..60ea9a77c8 100644 --- a/patches/openssl.c.patch +++ b/patches/openssl.c.patch @@ -1,6 +1,6 @@ ---- apps/openssl/openssl.c.orig Thu Jan 2 08:27:54 2025 -+++ apps/openssl/openssl.c Thu Jan 2 08:28:04 2025 -@@ -344,7 +344,9 @@ BIO *bio_err = NULL; +--- apps/openssl/openssl.c.orig Sat May 31 03:18:05 2025 ++++ apps/openssl/openssl.c Sat May 31 03:18:17 2025 +@@ -341,7 +341,9 @@ BIO *bio_err = NULL; static void openssl_startup(void) { From 3ce80037a09f15aa89bc686f5f3776d133df3dd7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 03:22:38 -0600 Subject: [PATCH 1022/1283] regen netcat.c patch --- patches/netcat.c.patch | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/patches/netcat.c.patch b/patches/netcat.c.patch index 319aca67bb..3faca6af2e 100644 --- a/patches/netcat.c.patch +++ b/patches/netcat.c.patch @@ -1,5 +1,5 @@ ---- apps/nc/netcat.c.orig Sat Aug 17 03:21:05 2024 -+++ apps/nc/netcat.c Sat Aug 17 03:28:50 2024 +--- apps/nc/netcat.c.orig Sat May 31 03:18:05 2025 ++++ apps/nc/netcat.c Sat May 31 03:18:17 2025 @@ -93,9 +93,13 @@ int zflag; /* Port Scan Flag */ int Dflag; /* sodebug */ int Iflag; /* TCP receive buffer size */ @@ -14,7 +14,7 @@ int usetls; /* use TLS */ const char *Cflag; /* Public cert file */ -@@ -268,12 +272,14 @@ main(int argc, char *argv[]) +@@ -270,12 +274,14 @@ main(int argc, char *argv[]) case 'u': uflag = 1; break; @@ -29,7 +29,7 @@ case 'v': vflag = 1; break; -@@ -320,9 +326,11 @@ main(int argc, char *argv[]) +@@ -322,9 +328,11 @@ main(int argc, char *argv[]) case 'o': oflag = optarg; break; @@ -41,7 +41,7 @@ case 'T': errstr = NULL; errno = 0; -@@ -346,9 +354,11 @@ main(int argc, char *argv[]) +@@ -348,9 +356,11 @@ main(int argc, char *argv[]) argc -= optind; argv += optind; @@ -53,7 +53,7 @@ /* Cruft to make sure options are clean, and used properly. */ if (argc == 1 && family == AF_UNIX) { -@@ -923,7 +933,10 @@ remote_connect(const char *host, const char *port, str +@@ -925,7 +935,10 @@ remote_connect(const char *host, const char *port, str char *ipaddr) { struct addrinfo *res, *res0; @@ -65,7 +65,7 @@ if ((error = getaddrinfo(host, port, &hints, &res0))) errx(1, "getaddrinfo for host \"%s\" port %s: %s", host, -@@ -938,8 +951,10 @@ remote_connect(const char *host, const char *port, str +@@ -940,8 +953,10 @@ remote_connect(const char *host, const char *port, str if (sflag || pflag) { struct addrinfo ahints, *ares; @@ -76,7 +76,7 @@ memset(&ahints, 0, sizeof(struct addrinfo)); ahints.ai_family = res->ai_family; ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM; -@@ -1031,7 +1046,10 @@ int +@@ -1033,7 +1048,10 @@ int local_listen(const char *host, const char *port, struct addrinfo hints) { struct addrinfo *res, *res0; @@ -88,7 +88,7 @@ int error; /* Allow nodename to be null. */ -@@ -1052,9 +1070,11 @@ local_listen(const char *host, const char *port, struc +@@ -1054,9 +1072,11 @@ local_listen(const char *host, const char *port, struc res->ai_protocol)) == -1) continue; @@ -100,7 +100,7 @@ set_common_sockopts(s, res->ai_family); -@@ -1559,11 +1579,13 @@ set_common_sockopts(int s, int af) +@@ -1561,11 +1581,13 @@ set_common_sockopts(int s, int af) { int x = 1; @@ -114,7 +114,7 @@ if (Dflag) { if (setsockopt(s, SOL_SOCKET, SO_DEBUG, &x, sizeof(x)) == -1) -@@ -1574,9 +1596,16 @@ set_common_sockopts(int s, int af) +@@ -1576,9 +1598,16 @@ set_common_sockopts(int s, int af) IP_TOS, &Tflag, sizeof(Tflag)) == -1) err(1, "set IP ToS"); @@ -131,7 +131,7 @@ } if (Iflag) { if (setsockopt(s, SOL_SOCKET, SO_RCVBUF, -@@ -1600,13 +1629,17 @@ set_common_sockopts(int s, int af) +@@ -1602,13 +1631,17 @@ set_common_sockopts(int s, int af) } if (minttl != -1) { @@ -150,7 +150,7 @@ } } -@@ -1831,15 +1864,19 @@ help(void) +@@ -1835,15 +1868,19 @@ help(void) \t-P proxyuser\tUsername for proxy authentication\n\ \t-p port\t Specify local port for remote connects\n\ \t-R CAfile CA bundle\n\ @@ -175,4 +175,4 @@ + "\t-v Verbose\n\ \t-W recvlimit Terminate after receiving a number of packets\n\ \t-w timeout Timeout for connects and final net reads\n\ - \t-X proto Proxy protocol: \"4\", \"5\" (SOCKS) or \"connect\"\n\ + \t-X proto Proxy protocol: \"4\", \"4A\", \"5\" (SOCKS) or \"connect\"\n\ From 13602069adfe50f069ab704d64af99822a6b6530 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 03:28:07 -0600 Subject: [PATCH 1023/1283] There's only one rc2.c file now --- crypto/CMakeLists.txt | 6 +----- crypto/Makefile.am | 6 +----- 2 files changed, 2 insertions(+), 10 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index d949bcdf12..f0cd08daaf 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -447,11 +447,7 @@ set( rand/rand_err.c rand/rand_lib.c rand/randfile.c - rc2/rc2_cbc.c - rc2/rc2_ecb.c - rc2/rc2_skey.c - rc2/rc2cfb64.c - rc2/rc2ofb64.c + rc2/rc2.c rc4/rc4.c ripemd/ripemd.c rsa/rsa_ameth.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index df5560e6af..460ed3f38f 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -804,11 +804,7 @@ libcrypto_la_SOURCES += rand/rand_lib.c libcrypto_la_SOURCES += rand/randfile.c # rc2 -libcrypto_la_SOURCES += rc2/rc2_cbc.c -libcrypto_la_SOURCES += rc2/rc2_ecb.c -libcrypto_la_SOURCES += rc2/rc2_skey.c -libcrypto_la_SOURCES += rc2/rc2cfb64.c -libcrypto_la_SOURCES += rc2/rc2ofb64.c +libcrypto_la_SOURCES += rc2/rc2.c noinst_HEADERS += rc2/rc2_local.h # rc4 From ad6c7f0a49836fc4fbdd3a73960746051b573495 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 03:30:30 -0600 Subject: [PATCH 1024/1283] aes_ige.c was merged into aes.c --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index f0cd08daaf..ea44d72569 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -146,7 +146,6 @@ set( crypto_memory.c aes/aes.c aes/aes_core.c - aes/aes_ige.c asn1/a_bitstr.c asn1/a_enum.c asn1/a_int.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 460ed3f38f..31eec90f39 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -247,7 +247,6 @@ noinst_HEADERS += x86_arch.h # aes libcrypto_la_SOURCES += aes/aes.c libcrypto_la_SOURCES += aes/aes_core.c -libcrypto_la_SOURCES += aes/aes_ige.c noinst_HEADERS += aes/aes_local.h # asn1 From adff7f6528bb7e9f47d6293799095f7a79dd6bf7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 03:33:22 -0600 Subject: [PATCH 1025/1283] link ec_field.c and ec_hp_methods.c to build --- crypto/CMakeLists.txt | 2 ++ crypto/Makefile.am | 3 +++ 2 files changed, 5 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index ea44d72569..c05979713d 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -321,11 +321,13 @@ set( ec/ec_convert.c ec/ec_curve.c ec/ec_err.c + ec/ec_field.c ec/ec_key.c ec/ec_lib.c ec/ec_mult.c ec/ec_pmeth.c ec/eck_prn.c + ec/ecp_hp_methods.c ec/ecp_methods.c ec/ecx_methods.c ecdh/ecdh.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 31eec90f39..f4d80079ae 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -565,13 +565,16 @@ libcrypto_la_SOURCES += ec/ec_asn1.c libcrypto_la_SOURCES += ec/ec_convert.c libcrypto_la_SOURCES += ec/ec_curve.c libcrypto_la_SOURCES += ec/ec_err.c +libcrypto_la_SOURCES += ec/ec_field.c libcrypto_la_SOURCES += ec/ec_key.c libcrypto_la_SOURCES += ec/ec_lib.c libcrypto_la_SOURCES += ec/ec_mult.c libcrypto_la_SOURCES += ec/ec_pmeth.c libcrypto_la_SOURCES += ec/eck_prn.c +libcrypto_la_SOURCES += ec/ecp_hp_methods.c libcrypto_la_SOURCES += ec/ecp_methods.c libcrypto_la_SOURCES += ec/ecx_methods.c +noinst_HEADERS += ec/ec_internal.h noinst_HEADERS += ec/ec_local.h # ecdh From 0a5a42dc5e69768a293fd4c4957cb406b2bcab1f Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 03:35:33 -0600 Subject: [PATCH 1026/1283] link bn_add_sub.c to build --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index c05979713d..f0c968706e 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -227,6 +227,7 @@ set( bio/bss_null.c bio/bss_sock.c bn/bn_add.c + bn/bn_add_sub.c bn/bn_bpsw.c bn/bn_const.c bn/bn_convert.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index f4d80079ae..483328894e 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -347,6 +347,7 @@ noinst_HEADERS += bio/bio_local.h # bn libcrypto_la_SOURCES += bn/bn_add.c +libcrypto_la_SOURCES += bn/bn_add_sub.c libcrypto_la_SOURCES += bn/bn_bpsw.c libcrypto_la_SOURCES += bn/bn_const.c libcrypto_la_SOURCES += bn/bn_convert.c From e1866b0fc66383cd5f79e1d6a896c23f47cff239 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 04:03:31 -0600 Subject: [PATCH 1027/1283] link bn_mod_words.c to build --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index f0c968706e..ac2927260f 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -241,6 +241,7 @@ set( bn/bn_lib.c bn/bn_mod.c bn/bn_mod_sqrt.c + bn/bn_mod_words.c bn/bn_mont.c bn/bn_mul.c bn/bn_prime.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 483328894e..5a3f49698f 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -361,6 +361,7 @@ libcrypto_la_SOURCES += bn/bn_kron.c libcrypto_la_SOURCES += bn/bn_lib.c libcrypto_la_SOURCES += bn/bn_mod.c libcrypto_la_SOURCES += bn/bn_mod_sqrt.c +libcrypto_la_SOURCES += bn/bn_mod_words.c libcrypto_la_SOURCES += bn/bn_mont.c libcrypto_la_SOURCES += bn/bn_mul.c libcrypto_la_SOURCES += bn/bn_prime.c From 6b82af8052c6c2201767ea0c3bb936bd5818bf47 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 03:51:08 -0600 Subject: [PATCH 1028/1283] link tests that need it against test helpers --- tests/CMakeLists.txt | 7 +++++-- tests/Makefile.am | 8 ++++++-- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 8493614753..861d8b22a0 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -65,6 +65,9 @@ function(add_platform_test TEST_NAME) endif() endfunction() +# XXX - should probably be in their own static lib +set(TEST_HELPER_SRC test.c test_util.c) + # aeadtest add_executable(aeadtest aeadtest.c) target_link_libraries(aeadtest ${OPENSSL_TEST_LIBS}) @@ -536,7 +539,7 @@ prepare_emscripten_test_target(lhash_test) add_platform_test(lhash_test lhash_test) # md_test -add_executable(md_test md_test.c) +add_executable(md_test md_test.c ${TEST_HELPER_SRC}) target_link_libraries(md_test ${OPENSSL_TEST_LIBS}) add_platform_test(md_test md_test) @@ -718,7 +721,7 @@ endif() set_tests_properties(servertest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # sha_test -add_executable(sha_test sha_test.c) +add_executable(sha_test sha_test.c ${TEST_HELPER_SRC}) target_link_libraries(sha_test ${OPENSSL_TEST_LIBS}) add_platform_test(sha_test sha_test) diff --git a/tests/Makefile.am b/tests/Makefile.am index 350841f878..31a1be2e25 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -68,6 +68,10 @@ if HOST_X86_64 AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/amd64/ endif +# XXX - should probably be in their own static lib +TEST_HELPER_SRC = test.c test_util.c +noinst_HEADER = test.h + noinst_LTLIBRARIES = libtest.la libtest_la_LIBADD = $(libcrypto_la_objects) libtest_la_LIBADD += $(libcompat_la_objects) @@ -548,7 +552,7 @@ lhash_test_SOURCES = lhash_test.c # md_test TESTS += md_test check_PROGRAMS += md_test -md_test_SOURCES = md_test.c +md_test_SOURCES = md_test.c $(TEST_HELPER_SRC) noinst_HEADERS += mlkem_tests_util.h noinst_HEADERS += parse_test_file.h @@ -745,7 +749,7 @@ EXTRA_DIST += servertest.sh servertest.bat # sha_test TESTS += sha_test check_PROGRAMS += sha_test -sha_test_SOURCES = sha_test.c +sha_test_SOURCES = sha_test.c $(TEST_HELPER_SRC) # shutdowntest TESTS += shutdowntest.sh From 2f407aa2f3f94d8178914bca5afaac8eb5d54096 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 04:16:06 -0600 Subject: [PATCH 1029/1283] Include tests for automake builds --- tests/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/Makefile.am b/tests/Makefile.am index 31a1be2e25..5582dd193c 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -19,6 +19,7 @@ AM_CPPFLAGS += -I $(top_srcdir)/crypto/modes AM_CPPFLAGS += -I $(top_srcdir)/crypto/sha AM_CPPFLAGS += -I $(top_srcdir)/crypto/x509 AM_CPPFLAGS += -I $(top_srcdir)/ssl +AM_CPPFLAGS += -I $(top_srcdir)/tests AM_CPPFLAGS += -I $(top_srcdir)/apps/openssl AM_CPPFLAGS += -I $(top_srcdir)/apps/openssl/compat AM_CPPFLAGS += -D_PATH_SSL_CA_FILE=\"$(top_srcdir)/cert.pem\" From 3110f572954ecfd040d6c929a8010d94cdba24f0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 04:31:23 -0600 Subject: [PATCH 1030/1283] Fix typos plus some automake appeasing --- tests/Makefile.am | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/tests/Makefile.am b/tests/Makefile.am index 5582dd193c..ca60b2454c 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -69,10 +69,6 @@ if HOST_X86_64 AM_CPPFLAGS += -I$(top_srcdir)/crypto/arch/amd64/ endif -# XXX - should probably be in their own static lib -TEST_HELPER_SRC = test.c test_util.c -noinst_HEADER = test.h - noinst_LTLIBRARIES = libtest.la libtest_la_LIBADD = $(libcrypto_la_objects) libtest_la_LIBADD += $(libcompat_la_objects) @@ -91,6 +87,11 @@ check_PROGRAMS = EXTRA_DIST = CMakeLists.txt DISTCLEANFILES = pidwraptest.txt +# XXX - should probably be in their own static lib +TEST_HELPER_SRC = test.c test_util.c +noinst_HEADERS = test.h +EXTRA_DIST += $(TEST_HELPER_SRC) + # aeadtest TESTS += aeadtest.sh check_PROGRAMS += aeadtest From bdcf92deeadac79caad8c07e91c7a6735c7dcf2b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 04:37:17 -0600 Subject: [PATCH 1031/1283] only define noinst_HEADERS once --- tests/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/Makefile.am b/tests/Makefile.am index ca60b2454c..3aa955439f 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -344,7 +344,7 @@ chachatest_SOURCES = chachatest.c TESTS += cipher_list check_PROGRAMS += cipher_list cipher_list_SOURCES = cipher_list.c -noinst_HEADERS = tests.h +noinst_HEADERS += tests.h # cipherstest TESTS += cipherstest From cb5eff72d41a5bf6938923006779d0f66de207a3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 04:49:20 -0600 Subject: [PATCH 1032/1283] Windows still doesn't understand __attribute__ --- patches/opensslfeatures.h.patch | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/patches/opensslfeatures.h.patch b/patches/opensslfeatures.h.patch index 77df5dc5a9..f496ebc38e 100644 --- a/patches/opensslfeatures.h.patch +++ b/patches/opensslfeatures.h.patch @@ -36,3 +36,14 @@ #include "bytestring.h" #if defined(__cplusplus) +--- tests/test.h.orig Sat May 31 04:48:09 2025 ++++ tests/test.h Sat May 31 04:48:31 2025 +@@ -18,6 +18,8 @@ + #ifndef HEADER_TEST_H + #define HEADER_TEST_H + ++#include ++ + #include + + struct test; From e17b8834d2eb9ed65707844930ab88140602fe8a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 06:03:46 -0600 Subject: [PATCH 1033/1283] Update ChangeLog --- ChangeLog | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/ChangeLog b/ChangeLog index 6985403595..4efca3a49b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -38,19 +38,36 @@ LibreSSL Portable Release Notes: - Removed assembly implementations of AES using bit slicing (BS-AES) and vector permutation (VP-AES). - Removed OPENSSL_SMALL_FOOTPRINT and OPENSSL_FIPSAPI. + - Lots of cleanup and removal of code with undefined behavior in + the block cipher modes of operation implementations. + - Implemented constant time EC field element operations to allow + implementing elliptic curve operations without bignum arithmetic. + - Implemented an EC method using homogeneous projective coordinates. + This allows exception-free elliptic curve arithmetic in constant + time. + - Started cleaning up the openssl speed implementation. + - The last SIGILL-based CPU capability detection was removed. + Instead, capabilities are now detected using a constructor on + library load, which improves the incomplete coverage by calls + to OPENSSL_init_crypto() on various entry points. * Compatibility changes - Removed the -msie_hack option from the openssl(1) ca subcommand. - Removed parameters of the 239-bit prime curves from X9.62, H.5.2: prime239v1, prime239v2, prime239v3. - Increased default MAC salt length used by PKCS12_set_mac(3) to 16 per recommendation of NIST SP 800-132. + - Encrypted PKCS#8 key files now use a default password-based key + derivation function that is acceptable in the present millenium. - Of the old *err() only PEMerr(), RSAerr(), and SSLerr() remain. * New features * Bug fixes + - Avoid pointer arithmetic on NULL for memory BIOs. * Documentation - Rewrote most of the EC documentation from scratch to be at least somewhat accurate and intelligible. * Testing and proactive security + - Added a testing framework that will help deduplicating lots of + ad-hoc code in the regression tests. 4.1.0 - Stable release From c10badd1afda980da5808ead12ab4d6ac8fa898c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 06:08:12 -0600 Subject: [PATCH 1034/1283] regen patch --- patches/opensslfeatures.h.patch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/patches/opensslfeatures.h.patch b/patches/opensslfeatures.h.patch index f496ebc38e..d370b32859 100644 --- a/patches/opensslfeatures.h.patch +++ b/patches/opensslfeatures.h.patch @@ -44,6 +44,6 @@ +#include + + #include #include - struct test; From 7b7adb7d709c19ef2acc8f3b14699dbdf364aa1c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 06:19:43 -0600 Subject: [PATCH 1035/1283] Disable md_test and sha_test on Windows for now --- tests/CMakeLists.txt | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 861d8b22a0..fd0d9cd102 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -539,9 +539,12 @@ prepare_emscripten_test_target(lhash_test) add_platform_test(lhash_test lhash_test) # md_test -add_executable(md_test md_test.c ${TEST_HELPER_SRC}) -target_link_libraries(md_test ${OPENSSL_TEST_LIBS}) -add_platform_test(md_test md_test) +# XXX - ftruncate and mkstemp missing from Windows +if(NOT WIN32) + add_executable(md_test md_test.c ${TEST_HELPER_SRC}) + target_link_libraries(md_test ${OPENSSL_TEST_LIBS}) + add_platform_test(md_test md_test) +endif() # mlkem_tests add_executable(mlkem_tests mlkem_tests.c mlkem_tests_util.c parse_test_file.c) @@ -721,9 +724,12 @@ endif() set_tests_properties(servertest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # sha_test -add_executable(sha_test sha_test.c ${TEST_HELPER_SRC}) -target_link_libraries(sha_test ${OPENSSL_TEST_LIBS}) -add_platform_test(sha_test sha_test) +# XXX - ftruncate and mkstemp missing from Windows +if(NOT WIN32) + add_executable(sha_test sha_test.c ${TEST_HELPER_SRC}) + target_link_libraries(sha_test ${OPENSSL_TEST_LIBS}) + add_platform_test(sha_test sha_test) +endif() # shutdowntest set(SHUTDOWNTEST_SRC shutdowntest.c) From 40be99b5c25389098ed45bca837a5973c68e10cd Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 31 May 2025 15:07:51 +0200 Subject: [PATCH 1036/1283] Update Windows CI runner to 2025 Fixes #1172 Change-Id: I6a6a6964447afd42de3911d945671e44f0329d41 --- .github/workflows/windows.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index c4c7d72bed..7494a21ca2 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -21,14 +21,15 @@ jobs: strategy: fail-fast: false matrix: - os: ["windows-2022", "windows-2019"] + os: ["windows-2022", "windows-2025"] arch: ["ARM64", "x64", "Win32"] shared: ["ON", "OFF"] include: - os: "windows-2022" generator: "Visual Studio 17 2022" - - os: "windows-2019" - generator: "Visual Studio 16 2019" + - os: "windows-2025" + # XXX - use appropriate value + generator: "Visual Studio 17 2022" steps: - name: "Checkout repository" uses: actions/checkout@v4 From 30598098a5df3059332327fa0c2bb5877740ac5d Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 1 Jun 2025 05:06:16 +0700 Subject: [PATCH 1037/1283] explicitly copy COPYING file in this project from LICENSE file in CVS tree --- .gitignore | 1 - COPYING | 133 +++++++++++++++++++++++++++++++++++++++++++++++++++++ update.sh | 2 - 3 files changed, 133 insertions(+), 3 deletions(-) create mode 100644 COPYING diff --git a/.gitignore b/.gitignore index ba3495f66a..746332f36f 100644 --- a/.gitignore +++ b/.gitignore @@ -173,7 +173,6 @@ autom4te.cache # Libtool adds these, at least sometimes INSTALL -/COPYING !m4/check*.m4 m4/l* diff --git a/COPYING b/COPYING new file mode 100644 index 0000000000..c41ff4d1ca --- /dev/null +++ b/COPYING @@ -0,0 +1,133 @@ + + LibreSSL files are retained under the copyright of the authors. New + additions are ISC licensed as per OpenBSD's normal licensing policy, + or are placed in the public domain. + + The OpenSSL code is distributed under the terms of the original OpenSSL + licenses which follow: + + LICENSE ISSUES + ============== + + The OpenSSL toolkit stays under a dual license, i.e. both the conditions of + the OpenSSL License and the original SSLeay license apply to the toolkit. + See below for the actual license texts. In case of any license issues + related to OpenSSL please contact openssl-core@openssl.org. + + OpenSSL License + --------------- + +/* ==================================================================== + * Copyright (c) 1998-2011 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ + + Original SSLeay License + ----------------------- + +/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) + * All rights reserved. + * + * This package is an SSL implementation written + * by Eric Young (eay@cryptsoft.com). + * The implementation was written so as to conform with Netscapes SSL. + * + * This library is free for commercial and non-commercial use as long as + * the following conditions are aheared to. The following conditions + * apply to all code found in this distribution, be it the RC4, RSA, + * lhash, DES, etc., code; not just the SSL code. The SSL documentation + * included with this distribution is covered by the same copyright terms + * except that the holder is Tim Hudson (tjh@cryptsoft.com). + * + * Copyright remains Eric Young's, and as such any Copyright notices in + * the code are not to be removed. + * If this package is used in a product, Eric Young should be given attribution + * as the author of the parts of the library used. + * This can be in the form of a textual message at program startup or + * in documentation (online or textual) provided with the package. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * "This product includes cryptographic software written by + * Eric Young (eay@cryptsoft.com)" + * The word 'cryptographic' can be left out if the rouines from the library + * being used are not cryptographic related :-). + * 4. If you include any Windows specific code (or a derivative thereof) from + * the apps directory (application code) you must include an acknowledgement: + * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" + * + * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * The licence and distribution terms for any publically available version or + * derivative of this code cannot be changed. i.e. this code cannot simply be + * copied and put under another distribution licence + * [including the GNU Public Licence.] + */ + diff --git a/update.sh b/update.sh index 941a67912a..f53058eba4 100755 --- a/update.sh +++ b/update.sh @@ -83,8 +83,6 @@ if [ -x /opt/csw/bin/ggrep ]; then GREP='/opt/csw/bin/ggrep' fi -$CP $libssl_src/LICENSE COPYING - $CP $libcrypto_src/opensslfeatures.h include/openssl $CP $libssl_src/pqueue.h include From c51665d429359402cf77be8511db3d5d7b3964e2 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 1 Jun 2025 08:11:22 +0700 Subject: [PATCH 1038/1283] add copyright headers to Cmake files based on original committer and date --- CMakeLists.txt | 16 ++++++++++++++++ apps/CMakeLists.txt | 15 +++++++++++++++ apps/nc/CMakeLists.txt | 15 +++++++++++++++ apps/ocspcheck/CMakeLists.txt | 15 +++++++++++++++ apps/openssl/CMakeLists.txt | 15 +++++++++++++++ cmake_export_symbol.cmake | 15 +++++++++++++++ cmake_uninstall.cmake.in | 15 +++++++++++++++ crypto/CMakeLists.txt | 15 +++++++++++++++ include/CMakeLists.txt | 15 +++++++++++++++ man/CMakeLists.txt | 15 +++++++++++++++ ssl/CMakeLists.txt | 15 +++++++++++++++ tests/CMakeLists.txt | 15 +++++++++++++++ tests/cmake/CMakeLists.txt | 15 +++++++++++++++ tls/CMakeLists.txt | 15 +++++++++++++++ 14 files changed, 211 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index 8437e02e4a..a5956be15c 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1,4 +1,20 @@ +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + cmake_minimum_required (VERSION 3.16.4) + if(MSVC) cmake_policy(SET CMP0091 NEW) endif() diff --git a/apps/CMakeLists.txt b/apps/CMakeLists.txt index 08a5a41e0f..f52f37ddcf 100644 --- a/apps/CMakeLists.txt +++ b/apps/CMakeLists.txt @@ -1,3 +1,18 @@ +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + add_subdirectory(ocspcheck) add_subdirectory(openssl) add_subdirectory(nc) diff --git a/apps/nc/CMakeLists.txt b/apps/nc/CMakeLists.txt index d5f7813dba..b1eed1b0ba 100644 --- a/apps/nc/CMakeLists.txt +++ b/apps/nc/CMakeLists.txt @@ -1,3 +1,18 @@ +# +# Copyright (c) 2016 Kinichiro Inoguchi +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + if(BUILD_NC) set( diff --git a/apps/ocspcheck/CMakeLists.txt b/apps/ocspcheck/CMakeLists.txt index 778e837629..ed2ec1b49c 100644 --- a/apps/ocspcheck/CMakeLists.txt +++ b/apps/ocspcheck/CMakeLists.txt @@ -1,3 +1,18 @@ +# +# Copyright (c) 2017 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set( OCSPCHECK_SRC http.c diff --git a/apps/openssl/CMakeLists.txt b/apps/openssl/CMakeLists.txt index bca60e1444..3040d01b2c 100644 --- a/apps/openssl/CMakeLists.txt +++ b/apps/openssl/CMakeLists.txt @@ -1,3 +1,18 @@ +# +# Copyright (c) 2016 Kinichiro Inoguchi +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set( OPENSSL_SRC apps.c diff --git a/cmake_export_symbol.cmake b/cmake_export_symbol.cmake index 088300191c..9fe61f2c83 100644 --- a/cmake_export_symbol.cmake +++ b/cmake_export_symbol.cmake @@ -1,3 +1,18 @@ +# +# Copyright (c) 2017 Kinichiro Inoguchi +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + macro(export_symbol TARGET SYMBOLS_PATH) set(FLAG "") diff --git a/cmake_uninstall.cmake.in b/cmake_uninstall.cmake.in index bb8055d818..2887382e26 100644 --- a/cmake_uninstall.cmake.in +++ b/cmake_uninstall.cmake.in @@ -1,3 +1,18 @@ +# +# Copyright (c) 2016 Kinichiro Inoguchi +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + if(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt") message(FATAL_ERROR "Cannot find install manifest: @CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt") endif(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt") diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 4f3f338f31..832aea99d8 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -1,3 +1,18 @@ +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + add_definitions(-DLIBRESSL_CRYPTO_INTERNAL) if(HOST_ASM_ELF_ARMV4) diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt index 11ab7c2d58..04160afe0a 100644 --- a/include/CMakeLists.txt +++ b/include/CMakeLists.txt @@ -1,3 +1,18 @@ +# +# Copyright (c) 2016 Jeff Davey +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + if(ENABLE_LIBRESSL_INSTALL) install(DIRECTORY . DESTINATION ${CMAKE_INSTALL_INCLUDEDIR} diff --git a/man/CMakeLists.txt b/man/CMakeLists.txt index 462a831612..c2ac7af37c 100644 --- a/man/CMakeLists.txt +++ b/man/CMakeLists.txt @@ -1,3 +1,18 @@ +# +# Copyright (c) 2016 Jeff Davey +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + if(ENABLE_LIBRESSL_INSTALL) install(DIRECTORY . DESTINATION ${CMAKE_INSTALL_MANDIR}/man3 diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index cd7e335361..49a7dc4d10 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -1,3 +1,18 @@ +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set( SSL_SRC bio_ssl.c diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 8493614753..6b0035c7b0 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -1,3 +1,18 @@ +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + add_definitions(-DLIBRESSL_CRYPTO_INTERNAL) include_directories( diff --git a/tests/cmake/CMakeLists.txt b/tests/cmake/CMakeLists.txt index 956fbfd12f..c3b7c4f3fc 100644 --- a/tests/cmake/CMakeLists.txt +++ b/tests/cmake/CMakeLists.txt @@ -1,3 +1,18 @@ +# +# Copyright (c) 2023 Pierre Wendling +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + cmake_minimum_required(VERSION 3.5) project(LibreSSL_Consumer LANGUAGES C) diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index c81bbb0028..59c77db8ba 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -1,3 +1,18 @@ +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set( TLS_SRC tls.c From 340037f69a425d87aedc8c793e821a4946660938 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 1 Jun 2025 08:20:41 +0700 Subject: [PATCH 1039/1283] add autotools build copyright headers --- Makefile.am | 15 +++++++++++++++ Makefile.am.common | 15 +++++++++++++++ apps/nc/Makefile.am | 15 +++++++++++++++ apps/ocspcheck/Makefile.am | 15 +++++++++++++++ apps/openssl/Makefile.am | 15 +++++++++++++++ configure.ac | 1 + crypto/Makefile.am | 15 +++++++++++++++ include/Makefile.am | 15 +++++++++++++++ m4/check-libc.m4 | 15 +++++++++++++++ m4/check-os-options.m4 | 15 +++++++++++++++ m4/disable-compiler-warnings.m4 | 15 +++++++++++++++ ssl/Makefile.am | 15 +++++++++++++++ tests/Makefile.am | 15 +++++++++++++++ tls/Makefile.am | 15 +++++++++++++++ 14 files changed, 196 insertions(+) diff --git a/Makefile.am b/Makefile.am index 3f62cd9697..eca5a278ed 100644 --- a/Makefile.am +++ b/Makefile.am @@ -1,3 +1,18 @@ +# +# Copyright (c) 2014 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + SUBDIRS = include crypto ssl tls apps man if ENABLE_TESTS SUBDIRS += tests diff --git a/Makefile.am.common b/Makefile.am.common index 5405704b23..4257cf8b05 100644 --- a/Makefile.am.common +++ b/Makefile.am.common @@ -1,3 +1,18 @@ +# +# Copyright (c) 2014 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + AM_CFLAGS = AM_CPPFLAGS = -I$(top_srcdir)/include AM_CPPFLAGS += -I$(abs_top_builddir)/include diff --git a/apps/nc/Makefile.am b/apps/nc/Makefile.am index aba306ed3b..a3911a2af1 100644 --- a/apps/nc/Makefile.am +++ b/apps/nc/Makefile.am @@ -1,3 +1,18 @@ +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + include $(top_srcdir)/Makefile.am.common -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk diff --git a/apps/ocspcheck/Makefile.am b/apps/ocspcheck/Makefile.am index e6f3c5436b..554bd5c171 100644 --- a/apps/ocspcheck/Makefile.am +++ b/apps/ocspcheck/Makefile.am @@ -1,3 +1,18 @@ +# +# Copyright (c) 2017 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + include $(top_srcdir)/Makefile.am.common -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk diff --git a/apps/openssl/Makefile.am b/apps/openssl/Makefile.am index ee1b65b2bb..40804c506d 100644 --- a/apps/openssl/Makefile.am +++ b/apps/openssl/Makefile.am @@ -1,3 +1,18 @@ +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + include $(top_srcdir)/Makefile.am.common -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk diff --git a/configure.ac b/configure.ac index 7a88f27a66..e446563f84 100644 --- a/configure.ac +++ b/configure.ac @@ -1,3 +1,4 @@ +# # Copyright (c) 2014-2015 Brent Cook # # Permission to use, copy, modify, and distribute this software for any diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 25e6363e48..14f61a9e40 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -1,3 +1,18 @@ +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + include $(top_srcdir)/Makefile.am.common AM_CPPFLAGS += -DLIBRESSL_CRYPTO_INTERNAL diff --git a/include/Makefile.am b/include/Makefile.am index feaaa605e3..ff4c6e38a0 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -1,3 +1,18 @@ +# +# Copyright (c) 2014 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + include $(top_srcdir)/Makefile.am.common EXTRA_DIST = CMakeLists.txt diff --git a/m4/check-libc.m4 b/m4/check-libc.m4 index 8cb849b0a0..45f38b314b 100644 --- a/m4/check-libc.m4 +++ b/m4/check-libc.m4 @@ -1,3 +1,18 @@ +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + AC_DEFUN([CHECK_LIBC_COMPAT], [ # Check for libc headers AC_CHECK_HEADERS([endian.h machine/endian.h err.h readpassphrase.h]) diff --git a/m4/check-os-options.m4 b/m4/check-os-options.m4 index b9f10c7562..d5b258275d 100644 --- a/m4/check-os-options.m4 +++ b/m4/check-os-options.m4 @@ -1,3 +1,18 @@ +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + AC_DEFUN([CHECK_OS_OPTIONS], [ CFLAGS="$CFLAGS -Wall -std=gnu99 -fno-strict-aliasing" diff --git a/m4/disable-compiler-warnings.m4 b/m4/disable-compiler-warnings.m4 index 2792722111..0b6c704599 100644 --- a/m4/disable-compiler-warnings.m4 +++ b/m4/disable-compiler-warnings.m4 @@ -1,3 +1,18 @@ +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + AC_DEFUN([DISABLE_COMPILER_WARNINGS], [ # Clang throws a lot of warnings when it does not understand a flag. Disable # this warning for now so other warnings are visible. diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 2c84bff1a3..504a4eac80 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -1,3 +1,18 @@ +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + include $(top_srcdir)/Makefile.am.common -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk diff --git a/tests/Makefile.am b/tests/Makefile.am index 350841f878..850c7bfc28 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -1,3 +1,18 @@ +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + include $(top_srcdir)/Makefile.am.common -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk diff --git a/tls/Makefile.am b/tls/Makefile.am index 22f3222a71..7746c59676 100644 --- a/tls/Makefile.am +++ b/tls/Makefile.am @@ -1,3 +1,18 @@ +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + include $(top_srcdir)/Makefile.am.common -include $(abs_top_builddir)/crypto/libcrypto_la_objects.mk From 5d9229b16966f8135de4d78ecdefd4230f8e3383 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sun, 1 Jun 2025 17:24:24 +0300 Subject: [PATCH 1040/1283] adjust incorrect commit years Co-authored-by: Theo Buehler --- CMakeLists.txt | 2 +- apps/CMakeLists.txt | 2 +- crypto/CMakeLists.txt | 2 +- crypto/Makefile.am | 2 +- m4/check-libc.m4 | 2 +- m4/check-os-options.m4 | 2 +- m4/disable-compiler-warnings.m4 | 2 +- man/CMakeLists.txt | 2 +- ssl/CMakeLists.txt | 2 +- ssl/Makefile.am | 2 +- tls/CMakeLists.txt | 2 +- tls/Makefile.am | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index a5956be15c..30175273cb 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1,5 +1,5 @@ # -# Copyright (c) 2015 Brent Cook +# Copyright (c) 2014 Brent Cook # # Permission to use, copy, modify, and distribute this software for any # purpose with or without fee is hereby granted, provided that the above diff --git a/apps/CMakeLists.txt b/apps/CMakeLists.txt index f52f37ddcf..754990ae08 100644 --- a/apps/CMakeLists.txt +++ b/apps/CMakeLists.txt @@ -1,5 +1,5 @@ # -# Copyright (c) 2015 Brent Cook +# Copyright (c) 2014 Brent Cook # # Permission to use, copy, modify, and distribute this software for any # purpose with or without fee is hereby granted, provided that the above diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 832aea99d8..d244967f5a 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -1,5 +1,5 @@ # -# Copyright (c) 2015 Brent Cook +# Copyright (c) 2014 Brent Cook # # Permission to use, copy, modify, and distribute this software for any # purpose with or without fee is hereby granted, provided that the above diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 14f61a9e40..239c8c315e 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -1,5 +1,5 @@ # -# Copyright (c) 2015 Brent Cook +# Copyright (c) 2014 Brent Cook # # Permission to use, copy, modify, and distribute this software for any # purpose with or without fee is hereby granted, provided that the above diff --git a/m4/check-libc.m4 b/m4/check-libc.m4 index 45f38b314b..dadf0da278 100644 --- a/m4/check-libc.m4 +++ b/m4/check-libc.m4 @@ -1,5 +1,5 @@ # -# Copyright (c) 2015 Brent Cook +# Copyright (c) 2014 Brent Cook # # Permission to use, copy, modify, and distribute this software for any # purpose with or without fee is hereby granted, provided that the above diff --git a/m4/check-os-options.m4 b/m4/check-os-options.m4 index d5b258275d..fd63d772a2 100644 --- a/m4/check-os-options.m4 +++ b/m4/check-os-options.m4 @@ -1,5 +1,5 @@ # -# Copyright (c) 2015 Brent Cook +# Copyright (c) 2014 Brent Cook # # Permission to use, copy, modify, and distribute this software for any # purpose with or without fee is hereby granted, provided that the above diff --git a/m4/disable-compiler-warnings.m4 b/m4/disable-compiler-warnings.m4 index 0b6c704599..052e8ab0a3 100644 --- a/m4/disable-compiler-warnings.m4 +++ b/m4/disable-compiler-warnings.m4 @@ -1,5 +1,5 @@ # -# Copyright (c) 2015 Brent Cook +# Copyright (c) 2014 Brent Cook # # Permission to use, copy, modify, and distribute this software for any # purpose with or without fee is hereby granted, provided that the above diff --git a/man/CMakeLists.txt b/man/CMakeLists.txt index c2ac7af37c..8f1121e017 100644 --- a/man/CMakeLists.txt +++ b/man/CMakeLists.txt @@ -1,5 +1,5 @@ # -# Copyright (c) 2016 Jeff Davey +# Copyright (c) 2015 Jeff Davey # # Permission to use, copy, modify, and distribute this software for any # purpose with or without fee is hereby granted, provided that the above diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 49a7dc4d10..637e0f0b40 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -1,5 +1,5 @@ # -# Copyright (c) 2015 Brent Cook +# Copyright (c) 2014 Brent Cook # # Permission to use, copy, modify, and distribute this software for any # purpose with or without fee is hereby granted, provided that the above diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 504a4eac80..9dd4a77e84 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -1,5 +1,5 @@ # -# Copyright (c) 2015 Brent Cook +# Copyright (c) 2014 Brent Cook # # Permission to use, copy, modify, and distribute this software for any # purpose with or without fee is hereby granted, provided that the above diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 59c77db8ba..6475245189 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -1,5 +1,5 @@ # -# Copyright (c) 2015 Brent Cook +# Copyright (c) 2014 Brent Cook # # Permission to use, copy, modify, and distribute this software for any # purpose with or without fee is hereby granted, provided that the above diff --git a/tls/Makefile.am b/tls/Makefile.am index 7746c59676..44d0e245c0 100644 --- a/tls/Makefile.am +++ b/tls/Makefile.am @@ -1,5 +1,5 @@ # -# Copyright (c) 2015 Brent Cook +# Copyright (c) 2014 Brent Cook # # Permission to use, copy, modify, and distribute this software for any # purpose with or without fee is hereby granted, provided that the above From 43ee348d0f2422448f1d461f6993b18bdd09a972 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 2 Jun 2025 08:07:50 +0700 Subject: [PATCH 1041/1283] add top-level script copyright notices --- check-release.sh | 15 +++++++++++++++ dist.sh | 15 +++++++++++++++ gen-coverage-report.sh | 15 +++++++++++++++ libcrypto.pc.in | 15 +++++++++++++++ libssl.pc.in | 15 +++++++++++++++ libtls.pc.in | 15 +++++++++++++++ update.sh | 15 +++++++++++++++ 7 files changed, 105 insertions(+) diff --git a/check-release.sh b/check-release.sh index c5f9c5f9b8..723a05118c 100755 --- a/check-release.sh +++ b/check-release.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2014 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set -e ver=$1 diff --git a/dist.sh b/dist.sh index e367038188..9c4d35d433 100755 --- a/dist.sh +++ b/dist.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2014 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. +# set -e rm -f man/*.[35] include/openssl/*.h diff --git a/gen-coverage-report.sh b/gen-coverage-report.sh index b11f3f9de5..6453ecbf19 100755 --- a/gen-coverage-report.sh +++ b/gen-coverage-report.sh @@ -1,3 +1,18 @@ +# +# Copyright (c) 2014 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. +# #!/bin/sh VERSION=$(cat VERSION) diff --git a/libcrypto.pc.in b/libcrypto.pc.in index 11d7ef033b..c11fbd309e 100644 --- a/libcrypto.pc.in +++ b/libcrypto.pc.in @@ -1,3 +1,18 @@ +# +# Copyright (c) 2014 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. +# #libcrypto pkg-config source file prefix=@prefix@ diff --git a/libssl.pc.in b/libssl.pc.in index 512ec1cbef..9d0d641bb1 100644 --- a/libssl.pc.in +++ b/libssl.pc.in @@ -1,3 +1,18 @@ +# +# Copyright (c) 2014 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. +# #libssl pkg-config source file prefix=@prefix@ diff --git a/libtls.pc.in b/libtls.pc.in index 3c49391ab0..19c813469e 100644 --- a/libtls.pc.in +++ b/libtls.pc.in @@ -1,3 +1,18 @@ +# +# Copyright (c) 2014 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. +# #libtls pkg-config source file prefix=@prefix@ diff --git a/update.sh b/update.sh index f53058eba4..499bad1a4e 100755 --- a/update.sh +++ b/update.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2014 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set -e openbsd_branch=`cat OPENBSD_BRANCH` From 23a3d0ea9b842af6571f349a316e6f833e9273de Mon Sep 17 00:00:00 2001 From: cierny Date: Mon, 2 Jun 2025 16:15:41 -0700 Subject: [PATCH 1042/1283] Use relative paths in linking step --- crypto/Makefile.am | 6 +++--- ssl/Makefile.am | 2 +- tls/Makefile.am | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 5a3f49698f..1c67489cb3 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -56,13 +56,13 @@ crypto_portable.sym: crypto.sym Makefile libcrypto_la_objects.mk: Makefile @echo "libcrypto_la_objects= $(libcrypto_la_OBJECTS)" \ - | sed 's/ */ $$\(abs_top_builddir\)\/crypto\//g' \ + | sed 's/ */ $$\(top_srcdir\)\/crypto\//g' \ > libcrypto_la_objects.mk @echo "libcompat_la_objects= $(libcompat_la_OBJECTS)" \ - | sed 's/compat\// $$\(abs_top_builddir\)\/crypto\/&/g' \ + | sed 's/compat\// $$\(top_srcdir\)\/crypto\/&/g' \ >> libcrypto_la_objects.mk @echo "libcompatnoopt_la_objects= $(libcompatnoopt_la_OBJECTS)" \ - | sed 's/compat\// $$\(abs_top_builddir\)\/crypto\/&/g' \ + | sed 's/compat\// $$\(top_srcdir\)\/crypto\/&/g' \ >> libcrypto_la_objects.mk libcrypto_la_LDFLAGS = -version-info @LIBCRYPTO_VERSION@ -no-undefined -export-symbols crypto_portable.sym diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 2c84bff1a3..f10b3259cb 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -26,7 +26,7 @@ EXTRA_libssl_la_DEPENDENCIES = libssl_la_objects.mk libssl_la_objects.mk: Makefile @echo "libssl_la_objects= $(libssl_la_OBJECTS)" \ - | sed 's/ */ $$\(abs_top_builddir\)\/ssl\//g' \ + | sed 's/ */ $$\(top_srcdir\)\/ssl\//g' \ > libssl_la_objects.mk .PHONY: remove_bs_objects diff --git a/tls/Makefile.am b/tls/Makefile.am index 22f3222a71..eceddf8296 100644 --- a/tls/Makefile.am +++ b/tls/Makefile.am @@ -16,7 +16,7 @@ EXTRA_libtls_la_DEPENDENCIES = libtls_la_objects.mk libtls_la_objects.mk: Makefile @echo "libtls_la_objects= $(libtls_la_OBJECTS)" \ - | sed -e 's/ *$$//' -e 's/ */ $$\(abs_top_builddir\)\/tls\//g' \ + | sed -e 's/ *$$//' -e 's/ */ $$\(top_srcdir\)\/tls\//g' \ > libtls_la_objects.mk libtls_la_LDFLAGS = -version-info @LIBTLS_VERSION@ -no-undefined -export-symbols $(top_srcdir)/tls/tls.sym From e95c54d54c215dceda5f43266a07d1296cea4ab8 Mon Sep 17 00:00:00 2001 From: cierny Date: Mon, 2 Jun 2025 18:42:46 -0700 Subject: [PATCH 1043/1283] Switch to top_builddir --- crypto/Makefile.am | 6 +++--- ssl/Makefile.am | 2 +- tls/Makefile.am | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 1c67489cb3..0142e1f037 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -56,13 +56,13 @@ crypto_portable.sym: crypto.sym Makefile libcrypto_la_objects.mk: Makefile @echo "libcrypto_la_objects= $(libcrypto_la_OBJECTS)" \ - | sed 's/ */ $$\(top_srcdir\)\/crypto\//g' \ + | sed 's/ */ $$\(top_builddir\)\/crypto\//g' \ > libcrypto_la_objects.mk @echo "libcompat_la_objects= $(libcompat_la_OBJECTS)" \ - | sed 's/compat\// $$\(top_srcdir\)\/crypto\/&/g' \ + | sed 's/compat\// $$\(top_builddir\)\/crypto\/&/g' \ >> libcrypto_la_objects.mk @echo "libcompatnoopt_la_objects= $(libcompatnoopt_la_OBJECTS)" \ - | sed 's/compat\// $$\(top_srcdir\)\/crypto\/&/g' \ + | sed 's/compat\// $$\(top_builddir\)\/crypto\/&/g' \ >> libcrypto_la_objects.mk libcrypto_la_LDFLAGS = -version-info @LIBCRYPTO_VERSION@ -no-undefined -export-symbols crypto_portable.sym diff --git a/ssl/Makefile.am b/ssl/Makefile.am index f10b3259cb..4031dde6ef 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -26,7 +26,7 @@ EXTRA_libssl_la_DEPENDENCIES = libssl_la_objects.mk libssl_la_objects.mk: Makefile @echo "libssl_la_objects= $(libssl_la_OBJECTS)" \ - | sed 's/ */ $$\(top_srcdir\)\/ssl\//g' \ + | sed 's/ */ $$\(top_builddir\)\/ssl\//g' \ > libssl_la_objects.mk .PHONY: remove_bs_objects diff --git a/tls/Makefile.am b/tls/Makefile.am index eceddf8296..7c435793d6 100644 --- a/tls/Makefile.am +++ b/tls/Makefile.am @@ -16,7 +16,7 @@ EXTRA_libtls_la_DEPENDENCIES = libtls_la_objects.mk libtls_la_objects.mk: Makefile @echo "libtls_la_objects= $(libtls_la_OBJECTS)" \ - | sed -e 's/ *$$//' -e 's/ */ $$\(top_srcdir\)\/tls\//g' \ + | sed -e 's/ *$$//' -e 's/ */ $$\(top_builddir\)\/tls\//g' \ > libtls_la_objects.mk libtls_la_LDFLAGS = -version-info @LIBTLS_VERSION@ -no-undefined -export-symbols $(top_srcdir)/tls/tls.sym From 2ac96ebd12b5a6d1db9d28b82ec52ed8abdb28a5 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 3 Jun 2025 13:38:34 +0700 Subject: [PATCH 1044/1283] add copyright headers to test shell scripts --- tests/aeadtest.sh | 15 +++++++++++++++ tests/arc4randomforktest.sh | 15 +++++++++++++++ tests/dtlstest.sh | 15 +++++++++++++++ tests/evptest.sh | 15 +++++++++++++++ tests/keypairtest.sh | 15 +++++++++++++++ tests/mlkem_tests.sh | 15 +++++++++++++++ tests/ocsptest.sh | 15 +++++++++++++++ tests/pidwraptest.sh | 15 +++++++++++++++ tests/quictest.sh | 15 +++++++++++++++ tests/renegotiation_test.sh | 15 +++++++++++++++ tests/servertest.sh | 15 +++++++++++++++ tests/shutdowntest.sh | 15 +++++++++++++++ tests/ssltest.sh | 15 +++++++++++++++ tests/testdsa.sh | 16 ++++++++++++++-- tests/testenc.sh | 15 ++++++++++++++- tests/testrsa.sh | 16 ++++++++++++++-- tests/tlstest.sh | 15 +++++++++++++++ 17 files changed, 252 insertions(+), 5 deletions(-) diff --git a/tests/aeadtest.sh b/tests/aeadtest.sh index 212e354c7f..bb09df2dbf 100755 --- a/tests/aeadtest.sh +++ b/tests/aeadtest.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2014 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set -e TEST=./aeadtest if [ -e ./aeadtest.exe ]; then diff --git a/tests/arc4randomforktest.sh b/tests/arc4randomforktest.sh index fe03068411..bbe76415a5 100755 --- a/tests/arc4randomforktest.sh +++ b/tests/arc4randomforktest.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2014 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set -e ./arc4randomforktest ./arc4randomforktest -b diff --git a/tests/dtlstest.sh b/tests/dtlstest.sh index 8f9b229d92..f0b71610d1 100755 --- a/tests/dtlstest.sh +++ b/tests/dtlstest.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2021 Kinichiro Inoguchi +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set -e dtlstest_bin=./dtlstest diff --git a/tests/evptest.sh b/tests/evptest.sh index ba44d75153..ddd744543b 100755 --- a/tests/evptest.sh +++ b/tests/evptest.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2014 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set -e TEST=./evptest if [ -e ./evptest.exe ]; then diff --git a/tests/keypairtest.sh b/tests/keypairtest.sh index 8bb7d9f6ae..f2c20c4fee 100755 --- a/tests/keypairtest.sh +++ b/tests/keypairtest.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2018 Kinichiro Inoguchi +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set -e TEST=./keypairtest if [ -e ./keypairtest.exe ]; then diff --git a/tests/mlkem_tests.sh b/tests/mlkem_tests.sh index 2a9856ec23..cbc0f0b342 100755 --- a/tests/mlkem_tests.sh +++ b/tests/mlkem_tests.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2024 Theo Buehler +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set -e TEST=./mlkem_tests diff --git a/tests/ocsptest.sh b/tests/ocsptest.sh index a1c266de82..71c975e4e3 100755 --- a/tests/ocsptest.sh +++ b/tests/ocsptest.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2016 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set -e TEST=./ocsp_test if [ -e ./ocsp_test.exe ]; then diff --git a/tests/pidwraptest.sh b/tests/pidwraptest.sh index 04fb5c45bf..d5a2f71acf 100755 --- a/tests/pidwraptest.sh +++ b/tests/pidwraptest.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2014 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + ./pidwraptest > pidwraptest.txt while read a b; do diff --git a/tests/quictest.sh b/tests/quictest.sh index 23561adb8d..407a66be43 100755 --- a/tests/quictest.sh +++ b/tests/quictest.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2022 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set -e quictest_bin=./quictest diff --git a/tests/renegotiation_test.sh b/tests/renegotiation_test.sh index bbf27c83c2..8d963a2a38 100755 --- a/tests/renegotiation_test.sh +++ b/tests/renegotiation_test.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2025 Theo Buehler +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set -e renegotiation_test_bin=./renegotiation_test diff --git a/tests/servertest.sh b/tests/servertest.sh index 1662332032..4770e4b486 100755 --- a/tests/servertest.sh +++ b/tests/servertest.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2017 Kinichiro Inoguchi +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set -e servertest_bin=./servertest diff --git a/tests/shutdowntest.sh b/tests/shutdowntest.sh index d3ae472da6..b3c98dafe6 100755 --- a/tests/shutdowntest.sh +++ b/tests/shutdowntest.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2024 Theo Buehler +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set -e shutdowntest_bin=./shutdowntest diff --git a/tests/ssltest.sh b/tests/ssltest.sh index 29ea0b0859..4ec48847ab 100755 --- a/tests/ssltest.sh +++ b/tests/ssltest.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2014 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set -e ssltest_bin=./ssltest diff --git a/tests/testdsa.sh b/tests/testdsa.sh index 7ecb8efb4a..230a1f8948 100755 --- a/tests/testdsa.sh +++ b/tests/testdsa.sh @@ -1,6 +1,18 @@ #!/bin/sh -# $OpenBSD: testdsa.sh,v 1.1 2014/08/26 17:50:07 jsing Exp $ - +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. #Test DSA certificate generation of openssl diff --git a/tests/testenc.sh b/tests/testenc.sh index 63bce34de7..418e48d3e2 100755 --- a/tests/testenc.sh +++ b/tests/testenc.sh @@ -1,5 +1,18 @@ #!/bin/sh -# $OpenBSD: testenc.sh,v 1.1 2014/08/26 17:50:07 jsing Exp $ +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. test=p if [ -d ../apps/openssl ]; then diff --git a/tests/testrsa.sh b/tests/testrsa.sh index e64499935e..afbc61068e 100755 --- a/tests/testrsa.sh +++ b/tests/testrsa.sh @@ -1,6 +1,18 @@ #!/bin/sh -# $OpenBSD: testrsa.sh,v 1.1 2014/08/26 17:50:07 jsing Exp $ - +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. #Test RSA certificate generation of openssl diff --git a/tests/tlstest.sh b/tests/tlstest.sh index 4024007bae..4a5aff613b 100755 --- a/tests/tlstest.sh +++ b/tests/tlstest.sh @@ -1,4 +1,19 @@ #!/bin/sh +# +# Copyright (c) 2015 Brent Cook +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + set -e tlstest_bin=./tlstest From a3f6f8a09f4a83ecb0875653804c346fccb76811 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 3 Jun 2025 16:08:47 +0700 Subject: [PATCH 1045/1283] add copyright headers to test batch files --- tests/ocsptest.bat | 15 ++++++++++++++- tests/quictest.bat | 15 ++++++++++++++- tests/renegotiation_test.bat | 15 ++++++++++++++- tests/servertest.bat | 15 ++++++++++++++- tests/shutdowntest.bat | 15 ++++++++++++++- tests/ssltest.bat | 15 ++++++++++++++- tests/testdsa.bat | 18 +++++++++++++++--- tests/testenc.bat | 15 ++++++++++++++- tests/testrsa.bat | 18 +++++++++++++++--- tests/testssl.bat | 15 ++++++++++++++- tests/tlstest.bat | 15 ++++++++++++++- 11 files changed, 156 insertions(+), 15 deletions(-) diff --git a/tests/ocsptest.bat b/tests/ocsptest.bat index 2b6b66b34f..8d44ee0421 100644 --- a/tests/ocsptest.bat +++ b/tests/ocsptest.bat @@ -1,6 +1,19 @@ @echo off setlocal enabledelayedexpansion -REM ocspocsp_test_bin.bat + +:: Copyright (c) 2016 Kinichiro Inoguchi +:: +:: Permission to use, copy, modify, and distribute this software for any +:: purpose with or without fee is hereby granted, provided that the above +:: copyright notice and this permission notice appear in all copies. +:: +:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. set ocsp_test_bin=%1 set ocsp_test_bin=%ocsp_test_bin:/=\% diff --git a/tests/quictest.bat b/tests/quictest.bat index 645fc2f2f1..be731c893c 100644 --- a/tests/quictest.bat +++ b/tests/quictest.bat @@ -1,6 +1,19 @@ @echo off setlocal enabledelayedexpansion -REM quictest.bat + +:: Copyright (c) 2022 Brent Cook +:: +:: Permission to use, copy, modify, and distribute this software for any +:: purpose with or without fee is hereby granted, provided that the above +:: copyright notice and this permission notice appear in all copies. +:: +:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. set quictest_bin=%1 set quictest_bin=%quictest_bin:/=\% diff --git a/tests/renegotiation_test.bat b/tests/renegotiation_test.bat index 00860463cf..6691a39eca 100644 --- a/tests/renegotiation_test.bat +++ b/tests/renegotiation_test.bat @@ -1,6 +1,19 @@ @echo off setlocal enabledelayedexpansion -REM renegotiation_test.bat + +:: Copyright (c) 2025 Theo Beuhler +:: +:: Permission to use, copy, modify, and distribute this software for any +:: purpose with or without fee is hereby granted, provided that the above +:: copyright notice and this permission notice appear in all copies. +:: +:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. set renegotiation_test_bin=%1 set renegotiation_test_bin=%renegotiation_test_bin:/=\% diff --git a/tests/servertest.bat b/tests/servertest.bat index c0bfaa4548..d72d8de90b 100644 --- a/tests/servertest.bat +++ b/tests/servertest.bat @@ -1,6 +1,19 @@ @echo off setlocal enabledelayedexpansion -REM servertest.bat + +:: Copyright (c) 2017 Kinichiro Inoguchi +:: +:: Permission to use, copy, modify, and distribute this software for any +:: purpose with or without fee is hereby granted, provided that the above +:: copyright notice and this permission notice appear in all copies. +:: +:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. set servertest_bin=%1 set servertest_bin=%servertest_bin:/=\% diff --git a/tests/shutdowntest.bat b/tests/shutdowntest.bat index f087dbb435..d722fa01dc 100644 --- a/tests/shutdowntest.bat +++ b/tests/shutdowntest.bat @@ -1,6 +1,19 @@ @echo off setlocal enabledelayedexpansion -REM shutdowntest.bat + +:: Copyright (c) 2024 Theo Beuhler +:: +:: Permission to use, copy, modify, and distribute this software for any +:: purpose with or without fee is hereby granted, provided that the above +:: copyright notice and this permission notice appear in all copies. +:: +:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. set shutdowntest_bin=%1 set shutdowntest_bin=%shutdowntest_bin:/=\% diff --git a/tests/ssltest.bat b/tests/ssltest.bat index 5dda6bcd95..17f912f017 100644 --- a/tests/ssltest.bat +++ b/tests/ssltest.bat @@ -1,6 +1,19 @@ @echo off setlocal enabledelayedexpansion -REM ssltest.bat + +:: Copyright (c) 2016 Kinichiro Inoguchi +:: +:: Permission to use, copy, modify, and distribute this software for any +:: purpose with or without fee is hereby granted, provided that the above +:: copyright notice and this permission notice appear in all copies. +:: +:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. set ssltest_bin=%1 set ssltest_bin=%ssltest_bin:/=\% diff --git a/tests/testdsa.bat b/tests/testdsa.bat index 898ded86f7..df5330572e 100644 --- a/tests/testdsa.bat +++ b/tests/testdsa.bat @@ -1,9 +1,21 @@ @echo off setlocal enabledelayedexpansion -REM testdsa.bat - -REM # Test DSA certificate generation of openssl +:: Copyright (c) 2016 Kinichiro Inoguchi +:: +:: Permission to use, copy, modify, and distribute this software for any +:: purpose with or without fee is hereby granted, provided that the above +:: copyright notice and this permission notice appear in all copies. +:: +:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + +:: Test DSA certificate generation of openssl set openssl_bin=%1 set openssl_bin=%openssl_bin:/=\% diff --git a/tests/testenc.bat b/tests/testenc.bat index 84f48f2a3f..fa14620937 100644 --- a/tests/testenc.bat +++ b/tests/testenc.bat @@ -1,6 +1,19 @@ @echo off setlocal enabledelayedexpansion -REM testenc.bat + +:: Copyright (c) 2016 Kinichiro Inoguchi +:: +:: Permission to use, copy, modify, and distribute this software for any +:: purpose with or without fee is hereby granted, provided that the above +:: copyright notice and this permission notice appear in all copies. +:: +:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. set test=P diff --git a/tests/testrsa.bat b/tests/testrsa.bat index 59c3b5d43e..af59aadc76 100644 --- a/tests/testrsa.bat +++ b/tests/testrsa.bat @@ -1,9 +1,21 @@ @echo off setlocal enabledelayedexpansion -REM testrsa.bat - -REM # Test RSA certificate generation of openssl +:: Copyright (c) 2016 Kinichiro Inoguchi +:: +:: Permission to use, copy, modify, and distribute this software for any +:: purpose with or without fee is hereby granted, provided that the above +:: copyright notice and this permission notice appear in all copies. +:: +:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + +:: Test RSA certificate generation of openssl set openssl_bin=%1 set openssl_bin=%openssl_bin:/=\% diff --git a/tests/testssl.bat b/tests/testssl.bat index c4e62861fc..35a789a781 100644 --- a/tests/testssl.bat +++ b/tests/testssl.bat @@ -1,6 +1,19 @@ @echo on setlocal enabledelayedexpansion -REM testssl.bat + +:: Copyright (c) 2016 Kinichiro Inoguchi +:: +:: Permission to use, copy, modify, and distribute this software for any +:: purpose with or without fee is hereby granted, provided that the above +:: copyright notice and this permission notice appear in all copies. +:: +:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. set key=%1 set cert=%2 diff --git a/tests/tlstest.bat b/tests/tlstest.bat index 5f5f6a6e13..204201b51c 100644 --- a/tests/tlstest.bat +++ b/tests/tlstest.bat @@ -1,6 +1,19 @@ @echo off setlocal enabledelayedexpansion -REM tlstest.bat + +:: Copyright (c) 2017 Brent Cook +:: +:: Permission to use, copy, modify, and distribute this software for any +:: purpose with or without fee is hereby granted, provided that the above +:: copyright notice and this permission notice appear in all copies. +:: +:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. set tlstest_bin=%1 set tlstest_bin=%tlstest_bin:/=\% From bad9c1b83ae53aaf358eba4bab1b0bbc700d075b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 5 Jun 2025 00:10:38 +0200 Subject: [PATCH 1046/1283] Remove md2 leftovers --- include/arch/loongarch64/opensslconf.h | 4 ---- include/arch/mips/opensslconf.h | 4 ---- 2 files changed, 8 deletions(-) diff --git a/include/arch/loongarch64/opensslconf.h b/include/arch/loongarch64/opensslconf.h index 731b06aecc..9a01867ef5 100644 --- a/include/arch/loongarch64/opensslconf.h +++ b/include/arch/loongarch64/opensslconf.h @@ -21,10 +21,6 @@ #define IDEA_INT unsigned int #endif -#if defined(HEADER_MD2_H) && !defined(MD2_INT) -#define MD2_INT unsigned int -#endif - #if defined(HEADER_RC2_H) && !defined(RC2_INT) /* I need to put in a mod for the alpha - eay */ #define RC2_INT unsigned int diff --git a/include/arch/mips/opensslconf.h b/include/arch/mips/opensslconf.h index a5d26b6fdc..a081a45dd7 100644 --- a/include/arch/mips/opensslconf.h +++ b/include/arch/mips/opensslconf.h @@ -21,10 +21,6 @@ #define IDEA_INT unsigned int #endif -#if defined(HEADER_MD2_H) && !defined(MD2_INT) -#define MD2_INT unsigned int -#endif - #if defined(HEADER_RC2_H) && !defined(RC2_INT) /* I need to put in a mod for the alpha - eay */ #define RC2_INT unsigned int From dd7ad9c30bffa62c6ef063685d2c1646a37728f6 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 5 Jun 2025 08:39:51 +0200 Subject: [PATCH 1047/1283] sync opensslconf.h: only HEADER_DES_H remains Change-Id: I6a6a6964d1f15bb620559cb4eaa57d323fe5e6f0 --- include/arch/loongarch64/opensslconf.h | 2 +- include/arch/mips/opensslconf.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/include/arch/loongarch64/opensslconf.h b/include/arch/loongarch64/opensslconf.h index 9a01867ef5..02ef2b73a1 100644 --- a/include/arch/loongarch64/opensslconf.h +++ b/include/arch/loongarch64/opensslconf.h @@ -46,7 +46,7 @@ #endif #endif -#if (defined(HEADER_NEW_DES_H) || defined(HEADER_DES_H)) && !defined(DES_LONG) +#if defined(HEADER_DES_H) && !defined(DES_LONG) /* If this is set to 'unsigned int' on a DEC Alpha, this gives about a * %20 speed up (longs are 8 bytes, int's are 4). */ #ifndef DES_LONG diff --git a/include/arch/mips/opensslconf.h b/include/arch/mips/opensslconf.h index a081a45dd7..4fb2f080e6 100644 --- a/include/arch/mips/opensslconf.h +++ b/include/arch/mips/opensslconf.h @@ -46,7 +46,7 @@ #endif #endif -#if (defined(HEADER_NEW_DES_H) || defined(HEADER_DES_H)) && !defined(DES_LONG) +#if defined(HEADER_DES_H) && !defined(DES_LONG) /* If this is set to 'unsigned int' on a DEC Alpha, this gives about a * %20 speed up (longs are 8 bytes, int's are 4). */ #ifndef DES_LONG From aeadd0ae85f34167112bc76de58b49e645972218 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 4 Jun 2025 17:53:34 +0700 Subject: [PATCH 1048/1283] adjust CMAKE_SYSTEM_PROCESSOR on Windows builds Match CMAKE_GENERATOR_PLATFORM so that cross-builds work properly. Otherwise, we're just targeting the build system anyway. --- CMakeLists.txt | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 400f29e7ef..cdae646021 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -387,6 +387,14 @@ if(APPLE AND (NOT CMAKE_OSX_ARCHITECTURES STREQUAL "")) set(CMAKE_SYSTEM_PROCESSOR "${CMAKE_OSX_ARCHITECTURES}") endif() +# CMAKE_SYSTEM_PROCESSOR is not consistently set to the target architecture. +# https://cmake.org/cmake/help/latest/variable/CMAKE_SYSTEM_PROCESSOR.html +if (WIN32 AND (NOT CMAKE_GENERATOR_PLATFORM STREQUAL "")) + message("CMAKE_SYSTEM_PROCESSOR: ${CMAKE_SYSTEM_PROCESSOR}") + message("CMAKE_GENERATOR_PLATFORM: ${CMAKE_GENERATOR_PLATFORM}") + set(CMAKE_SYSTEM_PROCESSOR "${CMAKE_GENERATOR_PLATFORM}") +endif() + if(CMAKE_SYSTEM_PROCESSOR MATCHES "(aarch64|arm64|ARM64)") set(HOST_AARCH64 true) if(WIN32) @@ -396,9 +404,9 @@ elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm") set(HOST_ARM true) elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND CMAKE_SYSTEM_PROCESSOR MATCHES "i386") set(HOST_X86_64 true) -elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|amd64|AMD64)") +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|x64|amd64|AMD64)") set(HOST_X86_64 true) -elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(i[3-6]86|[xX]86)") +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(i[3-6]86|[xX]86|Win32)") set(ENABLE_ASM false) set(HOST_I386 true) elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "loongarch64") From 1df6b52b250f04cd322bf7a79e2105f9ed890802 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 5 Jun 2025 15:19:32 +0700 Subject: [PATCH 1049/1283] should be no need to force disabling asm anymore --- CMakeLists.txt | 3 --- 1 file changed, 3 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index cdae646021..182cf960f2 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -397,9 +397,6 @@ endif() if(CMAKE_SYSTEM_PROCESSOR MATCHES "(aarch64|arm64|ARM64)") set(HOST_AARCH64 true) - if(WIN32) - set(ENABLE_ASM false) - endif() elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm") set(HOST_ARM true) elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND CMAKE_SYSTEM_PROCESSOR MATCHES "i386") From fde752e948367230a8d92f491d4c85b03c9dcb82 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 5 Jun 2025 11:17:57 +0200 Subject: [PATCH 1050/1283] sync opensslconf.h: remove DES_RISC* logic Change-Id: I6a6a696436b84c468fe7fc86f7f026918c68bf6f --- include/arch/loongarch64/opensslconf.h | 55 -------------------------- include/arch/mips/opensslconf.h | 55 -------------------------- 2 files changed, 110 deletions(-) diff --git a/include/arch/loongarch64/opensslconf.h b/include/arch/loongarch64/opensslconf.h index 02ef2b73a1..540e2a883a 100644 --- a/include/arch/loongarch64/opensslconf.h +++ b/include/arch/loongarch64/opensslconf.h @@ -85,66 +85,11 @@ #undef DES_PTR #endif -/* This helps C compiler generate the correct code for multiple functional - * units. It reduces register dependencies at the expense of 2 more - * registers */ -#ifndef DES_RISC1 -#undef DES_RISC1 -#endif - -#ifndef DES_RISC2 -#undef DES_RISC2 -#endif - -#if defined(DES_RISC1) && defined(DES_RISC2) -YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!! -#endif - /* Unroll the inner loop, this sometimes helps, sometimes hinders. * Very much CPU dependent */ #ifndef DES_UNROLL #define DES_UNROLL #endif -/* These default values were supplied by - * Peter Gutman - * They are only used if nothing else has been defined */ -#if !defined(DES_PTR) && !defined(DES_RISC1) && !defined(DES_RISC2) && !defined(DES_UNROLL) -/* Special defines which change the way the code is built depending on the - CPU and OS. For SGI machines you can use _MIPS_SZLONG (32 or 64) to find - even newer MIPS CPU's, but at the moment one size fits all for - optimization options. Older Sparc's work better with only UNROLL, but - there's no way to tell at compile time what it is you're running on */ - -#if defined( sun ) /* Newer Sparc's */ -# define DES_PTR -# define DES_RISC1 -# define DES_UNROLL -#elif defined( __ultrix ) /* Older MIPS */ -# define DES_PTR -# define DES_RISC2 -# define DES_UNROLL -#elif defined( __osf1__ ) /* Alpha */ -# define DES_PTR -# define DES_RISC2 -#elif defined ( _AIX ) /* RS6000 */ - /* Unknown */ -#elif defined( __hpux ) /* HP-PA */ - /* Unknown */ -#elif defined( __aux ) /* 68K */ - /* Unknown */ -#elif defined( __dgux ) /* 88K (but P6 in latest boxes) */ -# define DES_UNROLL -#elif defined( __sgi ) /* Newer MIPS */ -# define DES_PTR -# define DES_RISC2 -# define DES_UNROLL -#elif defined(i386) || defined(__i386__) /* x86 boxes, should be gcc */ -# define DES_PTR -# define DES_RISC1 -# define DES_UNROLL -#endif /* Systems-specific speed defines */ -#endif - #endif /* DES_DEFAULT_OPTIONS */ #endif /* HEADER_DES_LOCL_H */ diff --git a/include/arch/mips/opensslconf.h b/include/arch/mips/opensslconf.h index 4fb2f080e6..5c09d6a158 100644 --- a/include/arch/mips/opensslconf.h +++ b/include/arch/mips/opensslconf.h @@ -85,66 +85,11 @@ #undef DES_PTR #endif -/* This helps C compiler generate the correct code for multiple functional - * units. It reduces register dependencies at the expense of 2 more - * registers */ -#ifndef DES_RISC1 -#undef DES_RISC1 -#endif - -#ifndef DES_RISC2 -#undef DES_RISC2 -#endif - -#if defined(DES_RISC1) && defined(DES_RISC2) -YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!! -#endif - /* Unroll the inner loop, this sometimes helps, sometimes hinders. * Very much CPU dependent */ #ifndef DES_UNROLL #define DES_UNROLL #endif -/* These default values were supplied by - * Peter Gutman - * They are only used if nothing else has been defined */ -#if !defined(DES_PTR) && !defined(DES_RISC1) && !defined(DES_RISC2) && !defined(DES_UNROLL) -/* Special defines which change the way the code is built depending on the - CPU and OS. For SGI machines you can use _MIPS_SZLONG (32 or 64) to find - even newer MIPS CPU's, but at the moment one size fits all for - optimization options. Older Sparc's work better with only UNROLL, but - there's no way to tell at compile time what it is you're running on */ - -#if defined( sun ) /* Newer Sparc's */ -# define DES_PTR -# define DES_RISC1 -# define DES_UNROLL -#elif defined( __ultrix ) /* Older MIPS */ -# define DES_PTR -# define DES_RISC2 -# define DES_UNROLL -#elif defined( __osf1__ ) /* Alpha */ -# define DES_PTR -# define DES_RISC2 -#elif defined ( _AIX ) /* RS6000 */ - /* Unknown */ -#elif defined( __hpux ) /* HP-PA */ - /* Unknown */ -#elif defined( __aux ) /* 68K */ - /* Unknown */ -#elif defined( __dgux ) /* 88K (but P6 in latest boxes) */ -# define DES_UNROLL -#elif defined( __sgi ) /* Newer MIPS */ -# define DES_PTR -# define DES_RISC2 -# define DES_UNROLL -#elif defined(i386) || defined(__i386__) /* x86 boxes, should be gcc */ -# define DES_PTR -# define DES_RISC1 -# define DES_UNROLL -#endif /* Systems-specific speed defines */ -#endif - #endif /* DES_DEFAULT_OPTIONS */ #endif /* HEADER_DES_LOCL_H */ From 2a0571ece2167d3ea8ca9a781bd26264f7f9ed5c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 9 Jun 2025 10:54:04 +0200 Subject: [PATCH 1051/1283] Remove DES_PTR --- include/arch/loongarch64/opensslconf.h | 6 ------ include/arch/mips/opensslconf.h | 6 ------ 2 files changed, 12 deletions(-) diff --git a/include/arch/loongarch64/opensslconf.h b/include/arch/loongarch64/opensslconf.h index 540e2a883a..cf94145a1e 100644 --- a/include/arch/loongarch64/opensslconf.h +++ b/include/arch/loongarch64/opensslconf.h @@ -79,12 +79,6 @@ #if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H) #define CONFIG_HEADER_DES_LOCL_H #ifndef DES_DEFAULT_OPTIONS -/* the following is tweaked from a config script, that is why it is a - * protected undef/define */ -#ifndef DES_PTR -#undef DES_PTR -#endif - /* Unroll the inner loop, this sometimes helps, sometimes hinders. * Very much CPU dependent */ #ifndef DES_UNROLL diff --git a/include/arch/mips/opensslconf.h b/include/arch/mips/opensslconf.h index 5c09d6a158..36606f3575 100644 --- a/include/arch/mips/opensslconf.h +++ b/include/arch/mips/opensslconf.h @@ -79,12 +79,6 @@ #if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H) #define CONFIG_HEADER_DES_LOCL_H #ifndef DES_DEFAULT_OPTIONS -/* the following is tweaked from a config script, that is why it is a - * protected undef/define */ -#ifndef DES_PTR -#undef DES_PTR -#endif - /* Unroll the inner loop, this sometimes helps, sometimes hinders. * Very much CPU dependent */ #ifndef DES_UNROLL From fa0d2b1c870cc33591c1136d0ab7018c5852566e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 9 Jun 2025 10:55:25 +0200 Subject: [PATCH 1052/1283] Remove ${MULTIPLE_OF_EIGHT}_BIT* --- include/arch/loongarch64/opensslconf.h | 12 ------------ include/arch/mips/opensslconf.h | 12 ------------ 2 files changed, 24 deletions(-) diff --git a/include/arch/loongarch64/opensslconf.h b/include/arch/loongarch64/opensslconf.h index cf94145a1e..59555fa1df 100644 --- a/include/arch/loongarch64/opensslconf.h +++ b/include/arch/loongarch64/opensslconf.h @@ -57,18 +57,6 @@ #if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H) #define CONFIG_HEADER_BN_H #undef BN_LLONG - -/* Should we define BN_DIV2W here? */ - -/* Only one for the following should be defined */ -/* The prime number generation stuff may not work when - * EIGHT_BIT but I don't care since I've only used this mode - * for debugging the bignum libraries */ -#define SIXTY_FOUR_BIT_LONG -#undef SIXTY_FOUR_BIT -#undef THIRTY_TWO_BIT -#undef SIXTEEN_BIT -#undef EIGHT_BIT #endif #if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H) diff --git a/include/arch/mips/opensslconf.h b/include/arch/mips/opensslconf.h index 36606f3575..576f49b0ec 100644 --- a/include/arch/mips/opensslconf.h +++ b/include/arch/mips/opensslconf.h @@ -57,18 +57,6 @@ #if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H) #define CONFIG_HEADER_BN_H #define BN_LLONG - -/* Should we define BN_DIV2W here? */ - -/* Only one for the following should be defined */ -/* The prime number generation stuff may not work when - * EIGHT_BIT but I don't care since I've only used this mode - * for debugging the bignum libraries */ -#undef SIXTY_FOUR_BIT_LONG -#undef SIXTY_FOUR_BIT -#define THIRTY_TWO_BIT -#undef SIXTEEN_BIT -#undef EIGHT_BIT #endif #if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H) From 5c4a7673b50126c30099eeb12fc2eaa27209f341 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 9 Jun 2025 16:42:25 +0200 Subject: [PATCH 1053/1283] Remove MI constants which now live in other headers --- include/arch/loongarch64/opensslconf.h | 32 -------------------------- include/arch/mips/opensslconf.h | 32 -------------------------- 2 files changed, 64 deletions(-) diff --git a/include/arch/loongarch64/opensslconf.h b/include/arch/loongarch64/opensslconf.h index 59555fa1df..3aaa6bd0b8 100644 --- a/include/arch/loongarch64/opensslconf.h +++ b/include/arch/loongarch64/opensslconf.h @@ -1,9 +1,4 @@ #include -/* crypto/opensslconf.h.in */ - -#if defined(HEADER_CRYPTO_LOCAL_H) && !defined(OPENSSLDIR) -#define OPENSSLDIR "/etc/ssl" -#endif #undef OPENSSL_EXPORT_VAR_AS_FUNCTION @@ -17,26 +12,7 @@ #endif #endif -#if defined(HEADER_IDEA_H) && !defined(IDEA_INT) -#define IDEA_INT unsigned int -#endif - -#if defined(HEADER_RC2_H) && !defined(RC2_INT) -/* I need to put in a mod for the alpha - eay */ -#define RC2_INT unsigned int -#endif - #if defined(HEADER_RC4_H) -#if !defined(RC4_INT) -/* using int types make the structure larger but make the code faster - * on most boxes I have tested - up to %20 faster. */ -/* - * I don't know what does "most" mean, but declaring "int" is a must on: - * - Intel P6 because partial register stalls are very expensive; - * - elder Alpha because it lacks byte load/store instructions; - */ -#define RC4_INT unsigned int -#endif #if !defined(RC4_CHUNK) /* * This enables code handling data aligned at natural CPU word @@ -46,14 +22,6 @@ #endif #endif -#if defined(HEADER_DES_H) && !defined(DES_LONG) -/* If this is set to 'unsigned int' on a DEC Alpha, this gives about a - * %20 speed up (longs are 8 bytes, int's are 4). */ -#ifndef DES_LONG -#define DES_LONG unsigned int -#endif -#endif - #if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H) #define CONFIG_HEADER_BN_H #undef BN_LLONG diff --git a/include/arch/mips/opensslconf.h b/include/arch/mips/opensslconf.h index 576f49b0ec..ee2111390a 100644 --- a/include/arch/mips/opensslconf.h +++ b/include/arch/mips/opensslconf.h @@ -1,9 +1,4 @@ #include -/* crypto/opensslconf.h.in */ - -#if defined(HEADER_CRYPTO_LOCAL_H) && !defined(OPENSSLDIR) -#define OPENSSLDIR "/etc/ssl" -#endif #undef OPENSSL_EXPORT_VAR_AS_FUNCTION @@ -17,26 +12,7 @@ #endif #endif -#if defined(HEADER_IDEA_H) && !defined(IDEA_INT) -#define IDEA_INT unsigned int -#endif - -#if defined(HEADER_RC2_H) && !defined(RC2_INT) -/* I need to put in a mod for the alpha - eay */ -#define RC2_INT unsigned int -#endif - #if defined(HEADER_RC4_H) -#if !defined(RC4_INT) -/* using int types make the structure larger but make the code faster - * on most boxes I have tested - up to %20 faster. */ -/* - * I don't know what does "most" mean, but declaring "int" is a must on: - * - Intel P6 because partial register stalls are very expensive; - * - elder Alpha because it lacks byte load/store instructions; - */ -#define RC4_INT unsigned int -#endif #if !defined(RC4_CHUNK) /* * This enables code handling data aligned at natural CPU word @@ -46,14 +22,6 @@ #endif #endif -#if defined(HEADER_DES_H) && !defined(DES_LONG) -/* If this is set to 'unsigned int' on a DEC Alpha, this gives about a - * %20 speed up (longs are 8 bytes, int's are 4). */ -#ifndef DES_LONG -#define DES_LONG unsigned int -#endif -#endif - #if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H) #define CONFIG_HEADER_BN_H #define BN_LLONG From 167c18a522915bbb34c0e41c6bfac507a0b4ccd9 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 9 Jun 2025 09:22:53 -0600 Subject: [PATCH 1054/1283] Update man links --- man/links | 6 ------ 1 file changed, 6 deletions(-) diff --git a/man/links b/man/links index f2983294b7..c26dda39c7 100644 --- a/man/links +++ b/man/links @@ -1174,11 +1174,6 @@ MD5.3,MD5_Update.3 NAME_CONSTRAINTS_new.3,GENERAL_SUBTREE_free.3 NAME_CONSTRAINTS_new.3,GENERAL_SUBTREE_new.3 NAME_CONSTRAINTS_new.3,NAME_CONSTRAINTS_free.3 -OBJ_NAME_add.3,OBJ_NAME_cleanup.3 -OBJ_NAME_add.3,OBJ_NAME_get.3 -OBJ_NAME_add.3,OBJ_NAME_init.3 -OBJ_NAME_add.3,OBJ_NAME_new_index.3 -OBJ_NAME_add.3,OBJ_NAME_remove.3 OBJ_create.3,OBJ_add_object.3 OBJ_create.3,OBJ_cleanup.3 OBJ_create.3,OBJ_create_objects.3 @@ -1263,7 +1258,6 @@ OPENSSL_VERSION_NUMBER.3,SSLeay.3 OPENSSL_VERSION_NUMBER.3,SSLeay_version.3 OPENSSL_config.3,OPENSSL_no_config.3 OPENSSL_init_crypto.3,OPENSSL_init.3 -OPENSSL_load_builtin_modules.3,ASN1_add_oid_module.3 OPENSSL_malloc.3,CRYPTO_free.3 OPENSSL_malloc.3,CRYPTO_malloc.3 OPENSSL_malloc.3,CRYPTO_strdup.3 From 392481066bf04765b6a648c9514b67c2035a34e7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 10 Jun 2025 15:15:39 +0200 Subject: [PATCH 1055/1283] Garbage collect BF_PTR Change-Id: I6a6a6964f3ff8920845f29bc620ef51d94c3f5f4 --- include/arch/loongarch64/opensslconf.h | 5 ----- include/arch/mips/opensslconf.h | 5 ----- 2 files changed, 10 deletions(-) diff --git a/include/arch/loongarch64/opensslconf.h b/include/arch/loongarch64/opensslconf.h index 3aaa6bd0b8..49cdf69a38 100644 --- a/include/arch/loongarch64/opensslconf.h +++ b/include/arch/loongarch64/opensslconf.h @@ -27,11 +27,6 @@ #undef BN_LLONG #endif -#if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H) -#define CONFIG_HEADER_BF_LOCL_H -#undef BF_PTR -#endif /* HEADER_BF_LOCL_H */ - #if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H) #define CONFIG_HEADER_DES_LOCL_H #ifndef DES_DEFAULT_OPTIONS diff --git a/include/arch/mips/opensslconf.h b/include/arch/mips/opensslconf.h index ee2111390a..639b15e8f4 100644 --- a/include/arch/mips/opensslconf.h +++ b/include/arch/mips/opensslconf.h @@ -27,11 +27,6 @@ #define BN_LLONG #endif -#if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H) -#define CONFIG_HEADER_BF_LOCL_H -#undef BF_PTR -#endif /* HEADER_BF_LOCL_H */ - #if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H) #define CONFIG_HEADER_DES_LOCL_H #ifndef DES_DEFAULT_OPTIONS From 0170130fc5726a4c1bdb760e23e62516e9d22f3c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 13 Jun 2025 07:28:50 +0200 Subject: [PATCH 1056/1283] Replace wget -c -N with wget -nv https://github.com/rpki-client/rpki-client-portable/commit/54a687e045ea381466f8c7628ba64fd79a0bfdec --- .github/workflows/coverity.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 8d0ad114fa..ae43398357 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -31,7 +31,7 @@ jobs: PROJECT: "libressl-portable%2Fportable" COVERITY_SCAN_TOKEN: "${{ secrets.COVERITY_SCAN_TOKEN }}" run: | - wget -c -N https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$PROJECT" -O coverity_tool.tar.gz + wget -nv https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$PROJECT" -O coverity_tool.tar.gz mkdir coverity_tool tar xzf coverity_tool.tar.gz --strip 1 -C coverity_tool From 4c0fb1c6cdb53074c3f24dac2506a5c220e711cf Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 16 Jun 2025 10:42:01 -0600 Subject: [PATCH 1057/1283] regen patches --- patches/crypto_arch.h.patch | 8 ++++---- patches/patch-i386-crypto-cpu-caps.c.patch | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/patches/crypto_arch.h.patch b/patches/crypto_arch.h.patch index 6c889e5899..b13ffabf43 100644 --- a/patches/crypto_arch.h.patch +++ b/patches/crypto_arch.h.patch @@ -1,6 +1,6 @@ ---- crypto/arch/amd64/crypto_arch.h.orig Fri Feb 14 06:00:43 2025 -+++ crypto/arch/amd64/crypto_arch.h Fri Feb 14 06:01:13 2025 -@@ -40,6 +40,7 @@ extern uint64_t crypto_cpu_caps_amd64; +--- crypto/arch/amd64/crypto_arch.h.orig Mon Jun 16 10:38:27 2025 ++++ crypto/arch/amd64/crypto_arch.h Mon Jun 16 10:38:39 2025 +@@ -41,6 +41,7 @@ extern uint64_t crypto_cpu_caps_amd64; #define HAVE_RC4_INTERNAL #define HAVE_RC4_SET_KEY_INTERNAL @@ -8,7 +8,7 @@ #define HAVE_SHA1_BLOCK_DATA_ORDER #define HAVE_SHA1_BLOCK_GENERIC -@@ -48,6 +49,7 @@ extern uint64_t crypto_cpu_caps_amd64; +@@ -49,6 +50,7 @@ extern uint64_t crypto_cpu_caps_amd64; #define HAVE_SHA512_BLOCK_DATA_ORDER #define HAVE_SHA512_BLOCK_GENERIC diff --git a/patches/patch-i386-crypto-cpu-caps.c.patch b/patches/patch-i386-crypto-cpu-caps.c.patch index c85e33c744..0642582f72 100644 --- a/patches/patch-i386-crypto-cpu-caps.c.patch +++ b/patches/patch-i386-crypto-cpu-caps.c.patch @@ -1,6 +1,6 @@ ---- crypto/arch/i386/crypto_cpu_caps.c.orig Fri Oct 18 17:35:20 2024 -+++ crypto/arch/i386/crypto_cpu_caps.c Fri Oct 18 17:39:13 2024 -@@ -33,7 +33,7 @@ cpuid(uint32_t eax, uint32_t *out_eax, uint32_t *out_e +--- crypto/arch/i386/crypto_cpu_caps.c.orig Mon Jun 16 10:38:27 2025 ++++ crypto/arch/i386/crypto_cpu_caps.c Mon Jun 16 10:38:39 2025 +@@ -37,7 +37,7 @@ cpuid(uint32_t eax, uint32_t *out_eax, uint32_t *out_e { uint32_t ebx = 0, ecx = 0, edx = 0; @@ -9,7 +9,7 @@ __asm__ ("cpuid": "+a"(eax), "+b"(ebx), "+c"(ecx), "+d"(edx)); #else eax = 0; -@@ -54,7 +54,7 @@ xgetbv(uint32_t ecx, uint32_t *out_eax, uint32_t *out_ +@@ -58,7 +58,7 @@ xgetbv(uint32_t ecx, uint32_t *out_eax, uint32_t *out_ { uint32_t eax = 0, edx = 0; From 86376ca6610921d4707bf9d2132705b14d8e1e25 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 16 Jun 2025 11:04:51 -0600 Subject: [PATCH 1058/1283] link aes_{amd64,i386}.c to build --- crypto/CMakeLists.txt | 2 ++ crypto/Makefile.am | 2 ++ 2 files changed, 4 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 271a5d6283..f6fb7d3f69 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -147,8 +147,10 @@ if(HOST_AARCH64) endif() elseif(HOST_X86_64) set(CRYPTO_SRC ${CRYPTO_SRC} arch/amd64/crypto_cpu_caps.c) + set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c) elseif(HOST_I386) set(CRYPTO_SRC ${CRYPTO_SRC} arch/i386/crypto_cpu_caps.c) + set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_i386.c) endif() set( diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 0e5a916f6a..395d528118 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -239,9 +239,11 @@ endif if HOST_X86_64 libcrypto_la_SOURCES += arch/amd64/crypto_cpu_caps.c +libcrypto_la_SOURCES += aes/aes_amd64.c endif if HOST_I386 libcrypto_la_SOURCES += arch/i386/crypto_cpu_caps.c +libcrypto_la_SOURCES += aes/aes_i386.c endif libcrypto_la_SOURCES += crypto_err.c From a64e99ae2562f8294e0910ce2b72aa17249bd1aa Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 16 Jun 2025 11:51:10 -0600 Subject: [PATCH 1059/1283] Sprinkle some #ifdef --- patches/aes_amd64.c.patch | 55 +++++++++++++++++++++++++++++++++++++++ patches/aes_i386.c.patch | 55 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 110 insertions(+) create mode 100644 patches/aes_amd64.c.patch create mode 100644 patches/aes_i386.c.patch diff --git a/patches/aes_amd64.c.patch b/patches/aes_amd64.c.patch new file mode 100644 index 0000000000..205b71ccd7 --- /dev/null +++ b/patches/aes_amd64.c.patch @@ -0,0 +1,55 @@ +--- crypto/aes/aes_amd64.c.orig Mon Jun 16 11:48:01 2025 ++++ crypto/aes/aes_amd64.c Mon Jun 16 11:51:51 2025 +@@ -45,6 +45,7 @@ void aesni_decrypt(const unsigned char *in, unsigned c + void aesni_cbc_encrypt(const unsigned char *in, unsigned char *out, + size_t len, const AES_KEY *key, unsigned char *ivec, const int enc); + ++#ifdef HAVE_AES_SET_ENCRYPT_KEY_INTERNAL + int + aes_set_encrypt_key_internal(const unsigned char *userKey, const int bits, + AES_KEY *key) +@@ -54,7 +55,9 @@ aes_set_encrypt_key_internal(const unsigned char *user + + return aes_set_encrypt_key_generic(userKey, bits, key); + } ++#endif + ++#ifdef HAVE_AES_SET_DECRYPT_KEY_INTERNAL + int + aes_set_decrypt_key_internal(const unsigned char *userKey, const int bits, + AES_KEY *key) +@@ -64,7 +67,9 @@ aes_set_decrypt_key_internal(const unsigned char *user + + return aes_set_decrypt_key_generic(userKey, bits, key); + } ++#endif + ++#ifdef HAVE_AES_ENCRYPT_INTERNAL + void + aes_encrypt_internal(const unsigned char *in, unsigned char *out, + const AES_KEY *key) +@@ -76,7 +81,9 @@ aes_encrypt_internal(const unsigned char *in, unsigned + + aes_encrypt_generic(in, out, key); + } ++#endif + ++#ifdef HAVE_AES_DECRYPT_INTERNAL + void + aes_decrypt_internal(const unsigned char *in, unsigned char *out, + const AES_KEY *key) +@@ -88,7 +95,9 @@ aes_decrypt_internal(const unsigned char *in, unsigned + + aes_decrypt_generic(in, out, key); + } ++#endif + ++#ifdef HAVE_AES_CBC_ENCRYPT_INTERNAL + void + aes_cbc_encrypt_internal(const unsigned char *in, unsigned char *out, + size_t len, const AES_KEY *key, unsigned char *ivec, const int enc) +@@ -100,3 +109,4 @@ aes_cbc_encrypt_internal(const unsigned char *in, unsi + + aes_cbc_encrypt_generic(in, out, len, key, ivec, enc); + } ++#endif diff --git a/patches/aes_i386.c.patch b/patches/aes_i386.c.patch new file mode 100644 index 0000000000..a19531348c --- /dev/null +++ b/patches/aes_i386.c.patch @@ -0,0 +1,55 @@ +--- crypto/aes/aes_i386.c.orig Mon Jun 16 11:54:30 2025 ++++ crypto/aes/aes_i386.c Mon Jun 16 11:53:31 2025 +@@ -45,6 +45,7 @@ void aesni_decrypt(const unsigned char *in, unsigned c + void aesni_cbc_encrypt(const unsigned char *in, unsigned char *out, + size_t len, const AES_KEY *key, unsigned char *ivec, const int enc); + ++#ifdef HAVE_AES_SET_ENCRYPT_KEY_INTERNAL + int + aes_set_encrypt_key_internal(const unsigned char *userKey, const int bits, + AES_KEY *key) +@@ -54,7 +55,9 @@ aes_set_encrypt_key_internal(const unsigned char *user + + return aes_set_encrypt_key_generic(userKey, bits, key); + } ++#endif + ++#ifdef HAVE_SET_DECRYPT_KEY_INTERNAL + int + aes_set_decrypt_key_internal(const unsigned char *userKey, const int bits, + AES_KEY *key) +@@ -64,7 +67,9 @@ aes_set_decrypt_key_internal(const unsigned char *user + + return aes_set_decrypt_key_generic(userKey, bits, key); + } ++#endif + ++#ifdef HAVE_AES_ENCRYPT_INTERNAL + void + aes_encrypt_internal(const unsigned char *in, unsigned char *out, + const AES_KEY *key) +@@ -76,7 +81,9 @@ aes_encrypt_internal(const unsigned char *in, unsigned + + aes_encrypt_generic(in, out, key); + } ++#endif + ++#ifdef HAVE_AES_DECRYPT_INTERNAL + void + aes_decrypt_internal(const unsigned char *in, unsigned char *out, + const AES_KEY *key) +@@ -88,7 +95,9 @@ aes_decrypt_internal(const unsigned char *in, unsigned + + aes_decrypt_generic(in, out, key); + } ++#endif + ++#ifdef HAVE_AES_CBC_ENCRYPT_INTERNAL + void + aes_cbc_encrypt_internal(const unsigned char *in, unsigned char *out, + size_t len, const AES_KEY *key, unsigned char *ivec, const int enc) +@@ -100,3 +109,4 @@ aes_cbc_encrypt_internal(const unsigned char *in, unsi + + aes_cbc_encrypt_generic(in, out, len, key, ivec, enc); + } ++#endif From 41ddb5ccbf5ace59f71d8f973a44b5241558c785 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 17 Jun 2025 04:41:05 +0200 Subject: [PATCH 1060/1283] Revert "Sprinkle some #ifdef" This reverts commit a64e99ae2562f8294e0910ce2b72aa17249bd1aa. --- patches/aes_amd64.c.patch | 55 --------------------------------------- patches/aes_i386.c.patch | 55 --------------------------------------- 2 files changed, 110 deletions(-) delete mode 100644 patches/aes_amd64.c.patch delete mode 100644 patches/aes_i386.c.patch diff --git a/patches/aes_amd64.c.patch b/patches/aes_amd64.c.patch deleted file mode 100644 index 205b71ccd7..0000000000 --- a/patches/aes_amd64.c.patch +++ /dev/null @@ -1,55 +0,0 @@ ---- crypto/aes/aes_amd64.c.orig Mon Jun 16 11:48:01 2025 -+++ crypto/aes/aes_amd64.c Mon Jun 16 11:51:51 2025 -@@ -45,6 +45,7 @@ void aesni_decrypt(const unsigned char *in, unsigned c - void aesni_cbc_encrypt(const unsigned char *in, unsigned char *out, - size_t len, const AES_KEY *key, unsigned char *ivec, const int enc); - -+#ifdef HAVE_AES_SET_ENCRYPT_KEY_INTERNAL - int - aes_set_encrypt_key_internal(const unsigned char *userKey, const int bits, - AES_KEY *key) -@@ -54,7 +55,9 @@ aes_set_encrypt_key_internal(const unsigned char *user - - return aes_set_encrypt_key_generic(userKey, bits, key); - } -+#endif - -+#ifdef HAVE_AES_SET_DECRYPT_KEY_INTERNAL - int - aes_set_decrypt_key_internal(const unsigned char *userKey, const int bits, - AES_KEY *key) -@@ -64,7 +67,9 @@ aes_set_decrypt_key_internal(const unsigned char *user - - return aes_set_decrypt_key_generic(userKey, bits, key); - } -+#endif - -+#ifdef HAVE_AES_ENCRYPT_INTERNAL - void - aes_encrypt_internal(const unsigned char *in, unsigned char *out, - const AES_KEY *key) -@@ -76,7 +81,9 @@ aes_encrypt_internal(const unsigned char *in, unsigned - - aes_encrypt_generic(in, out, key); - } -+#endif - -+#ifdef HAVE_AES_DECRYPT_INTERNAL - void - aes_decrypt_internal(const unsigned char *in, unsigned char *out, - const AES_KEY *key) -@@ -88,7 +95,9 @@ aes_decrypt_internal(const unsigned char *in, unsigned - - aes_decrypt_generic(in, out, key); - } -+#endif - -+#ifdef HAVE_AES_CBC_ENCRYPT_INTERNAL - void - aes_cbc_encrypt_internal(const unsigned char *in, unsigned char *out, - size_t len, const AES_KEY *key, unsigned char *ivec, const int enc) -@@ -100,3 +109,4 @@ aes_cbc_encrypt_internal(const unsigned char *in, unsi - - aes_cbc_encrypt_generic(in, out, len, key, ivec, enc); - } -+#endif diff --git a/patches/aes_i386.c.patch b/patches/aes_i386.c.patch deleted file mode 100644 index a19531348c..0000000000 --- a/patches/aes_i386.c.patch +++ /dev/null @@ -1,55 +0,0 @@ ---- crypto/aes/aes_i386.c.orig Mon Jun 16 11:54:30 2025 -+++ crypto/aes/aes_i386.c Mon Jun 16 11:53:31 2025 -@@ -45,6 +45,7 @@ void aesni_decrypt(const unsigned char *in, unsigned c - void aesni_cbc_encrypt(const unsigned char *in, unsigned char *out, - size_t len, const AES_KEY *key, unsigned char *ivec, const int enc); - -+#ifdef HAVE_AES_SET_ENCRYPT_KEY_INTERNAL - int - aes_set_encrypt_key_internal(const unsigned char *userKey, const int bits, - AES_KEY *key) -@@ -54,7 +55,9 @@ aes_set_encrypt_key_internal(const unsigned char *user - - return aes_set_encrypt_key_generic(userKey, bits, key); - } -+#endif - -+#ifdef HAVE_SET_DECRYPT_KEY_INTERNAL - int - aes_set_decrypt_key_internal(const unsigned char *userKey, const int bits, - AES_KEY *key) -@@ -64,7 +67,9 @@ aes_set_decrypt_key_internal(const unsigned char *user - - return aes_set_decrypt_key_generic(userKey, bits, key); - } -+#endif - -+#ifdef HAVE_AES_ENCRYPT_INTERNAL - void - aes_encrypt_internal(const unsigned char *in, unsigned char *out, - const AES_KEY *key) -@@ -76,7 +81,9 @@ aes_encrypt_internal(const unsigned char *in, unsigned - - aes_encrypt_generic(in, out, key); - } -+#endif - -+#ifdef HAVE_AES_DECRYPT_INTERNAL - void - aes_decrypt_internal(const unsigned char *in, unsigned char *out, - const AES_KEY *key) -@@ -88,7 +95,9 @@ aes_decrypt_internal(const unsigned char *in, unsigned - - aes_decrypt_generic(in, out, key); - } -+#endif - -+#ifdef HAVE_AES_CBC_ENCRYPT_INTERNAL - void - aes_cbc_encrypt_internal(const unsigned char *in, unsigned char *out, - size_t len, const AES_KEY *key, unsigned char *ivec, const int enc) -@@ -100,3 +109,4 @@ aes_cbc_encrypt_internal(const unsigned char *in, unsi - - aes_cbc_encrypt_generic(in, out, len, key, ivec, enc); - } -+#endif From e05910b5037bb5e74b813e9cf700f16346964ec3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 17 Jun 2025 04:35:51 +0200 Subject: [PATCH 1061/1283] Only link aes_${arch}.c to asm builds Don't mix C source with ASM source. Add the ASM support C code to CRYPTO_SRC or libcrypto_la_SOURCES as normal, but depending on the HOST_ASM* bits Change-Id: I6a6a69648fc7c2102c96813b70be0d255a345cd3 --- crypto/CMakeLists.txt | 14 ++++++++++---- crypto/Makefile.am | 2 -- crypto/Makefile.am.elf-x86_64 | 4 +++- crypto/Makefile.am.macosx-x86_64 | 4 +++- crypto/Makefile.am.masm-x86_64 | 2 ++ crypto/Makefile.am.mingw64-x86_64 | 2 ++ update.sh | 4 ++++ 7 files changed, 24 insertions(+), 8 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index f6fb7d3f69..277642f201 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -16,6 +16,9 @@ add_definitions(-DLIBRESSL_CRYPTO_INTERNAL) if(HOST_ASM_ELF_X86_64) + set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c) + set(CRYPTO_SRC ${CRYPTO_SRC} bn/arch/amd64/bn_arch.c) + set( ASM_X86_64_ELF_SRC aes/aes-elf-x86_64.S @@ -37,7 +40,6 @@ if(HOST_ASM_ELF_X86_64) bn/arch/amd64/bignum_sqr_8_16_alt.S bn/arch/amd64/bignum_sub.S bn/arch/amd64/word_clz.S - bn/arch/amd64/bn_arch.c ) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) @@ -51,6 +53,9 @@ if(HOST_ASM_ELF_X86_64) endif() if(HOST_ASM_MACOSX_X86_64) + set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c) + set(CRYPTO_SRC ${CRYPTO_SRC} bn/arch/amd64/bn_arch.c) + set( ASM_X86_64_MACOSX_SRC aes/aes-macosx-x86_64.S @@ -72,7 +77,6 @@ if(HOST_ASM_MACOSX_X86_64) bn/arch/amd64/bignum_sqr_8_16_alt.S bn/arch/amd64/bignum_sub.S bn/arch/amd64/word_clz.S - bn/arch/amd64/bn_arch.c ) add_definitions(-DAES_ASM) add_definitions(-DBSAES_ASM) @@ -87,6 +91,8 @@ if(HOST_ASM_MACOSX_X86_64) endif() if(HOST_ASM_MASM_X86_64) + set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c) + set( ASM_X86_64_MASM_SRC aes/aes-masm-x86_64.S @@ -111,6 +117,8 @@ if(HOST_ASM_MASM_X86_64) endif() if(HOST_ASM_MINGW64_X86_64) + set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c) + set( ASM_X86_64_MINGW64_SRC aes/aes-mingw64-x86_64.S @@ -147,10 +155,8 @@ if(HOST_AARCH64) endif() elseif(HOST_X86_64) set(CRYPTO_SRC ${CRYPTO_SRC} arch/amd64/crypto_cpu_caps.c) - set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c) elseif(HOST_I386) set(CRYPTO_SRC ${CRYPTO_SRC} arch/i386/crypto_cpu_caps.c) - set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_i386.c) endif() set( diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 395d528118..0e5a916f6a 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -239,11 +239,9 @@ endif if HOST_X86_64 libcrypto_la_SOURCES += arch/amd64/crypto_cpu_caps.c -libcrypto_la_SOURCES += aes/aes_amd64.c endif if HOST_I386 libcrypto_la_SOURCES += arch/i386/crypto_cpu_caps.c -libcrypto_la_SOURCES += aes/aes_i386.c endif libcrypto_la_SOURCES += crypto_err.c diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index c85ede8eaf..9e4775e1ff 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -18,11 +18,13 @@ ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_4_8_alt.S ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_8_16_alt.S ASM_X86_64_ELF += bn/arch/amd64/bignum_sub.S ASM_X86_64_ELF += bn/arch/amd64/word_clz.S -ASM_X86_64_ELF += bn/arch/amd64/bn_arch.c EXTRA_DIST += $(ASM_X86_64_ELF) if HOST_ASM_ELF_X86_64 +libcrypto_la_SOURCES += aes/aes_amd64.c +libcrypto_la_SOURCES += bn/arch/amd64/bn_arch.c + libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM libcrypto_la_CPPFLAGS += -DVPAES_ASM diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index b8bc8939b3..7a5ad58b78 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -18,11 +18,13 @@ ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_4_8_alt.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_8_16_alt.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sub.S ASM_X86_64_MACOSX += bn/arch/amd64/word_clz.S -ASM_X86_64_MACOSX += bn/arch/amd64/bn_arch.c EXTRA_DIST += $(ASM_X86_64_MACOSX) if HOST_ASM_MACOSX_X86_64 +libcrypto_la_SOURCES += aes/aes_amd64.c +libcrypto_la_SOURCES += bn/arch/amd64/bn_arch.c + libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM libcrypto_la_CPPFLAGS += -DVPAES_ASM diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index a9225bea64..ee46bc412e 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -10,6 +10,8 @@ ASM_X86_64_MASM += rc4/rc4-masm-x86_64.S EXTRA_DIST += $(ASM_X86_64_MASM) if HOST_ASM_MASM_X86_64 +libcrypto_la_SOURCES += aes/aes_amd64.c + libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM libcrypto_la_CPPFLAGS += -DVPAES_ASM diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index 72b767f966..3dafa869b9 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -10,6 +10,8 @@ ASM_X86_64_MINGW64 += rc4/rc4-mingw64-x86_64.S EXTRA_DIST += $(ASM_X86_64_MINGW64) if HOST_ASM_MINGW64_X86_64 +libcrypto_la_SOURCES += aes/aes_amd64.c + libcrypto_la_CPPFLAGS += -Dendbr32=endbr64 libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM diff --git a/update.sh b/update.sh index 98b5ce36c8..2aab899465 100755 --- a/update.sh +++ b/update.sh @@ -179,6 +179,10 @@ for i in `awk '/SOURCES|HEADERS/ { print $3 }' crypto/Makefile.am` ; do fi done +for arch in amd64 i386; do + $CP $libcrypto_src/aes/aes_${arch}.c crypto/aes/ +done + for i in $libcrypto_src/arch/*; do arch=`basename $i` mkdir -p include/arch/$arch From fd25d60a123272e3ad4ea92b402d498dbee9198a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 27 Jun 2025 11:56:20 -0600 Subject: [PATCH 1062/1283] Pass -Icrypto/aes to CPP flags --- crypto/CMakeLists.txt | 1 + crypto/Makefile.am | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 277642f201..7b788fcc12 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -741,6 +741,7 @@ add_library(crypto_obj OBJECT ${CRYPTO_SRC}) target_include_directories(crypto_obj PRIVATE . + aes asn1 bio bn diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 0e5a916f6a..91da021ee8 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -16,6 +16,7 @@ include $(top_srcdir)/Makefile.am.common AM_CPPFLAGS += -DLIBRESSL_CRYPTO_INTERNAL +AM_CPPFLAGS += -I$(top_srcdir)/crypto/aes AM_CPPFLAGS += -I$(top_srcdir)/crypto/asn1 AM_CPPFLAGS += -I$(top_srcdir)/crypto/bio AM_CPPFLAGS += -I$(top_srcdir)/crypto/bn From b6fa15f21bee141c0f439cbf49b2c59fade9ef92 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 27 Jun 2025 12:00:17 -0600 Subject: [PATCH 1063/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 4efca3a49b..1739cfc5d5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -37,6 +37,7 @@ LibreSSL Portable Release Notes: instances of undefined behavior. - Removed assembly implementations of AES using bit slicing (BS-AES) and vector permutation (VP-AES). + - Integrated AES-NI into the AES API. - Removed OPENSSL_SMALL_FOOTPRINT and OPENSSL_FIPSAPI. - Lots of cleanup and removal of code with undefined behavior in the block cipher modes of operation implementations. @@ -60,6 +61,7 @@ LibreSSL Portable Release Notes: derivation function that is acceptable in the present millenium. - Of the old *err() only PEMerr(), RSAerr(), and SSLerr() remain. * New features + - Allow specifying ALPN in nc(1) via -Talpn="http/1.1,http:/1.0". * Bug fixes - Avoid pointer arithmetic on NULL for memory BIOs. * Documentation From 4640288d1c10b20a140fc57f2d4e538d26512365 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 27 Jun 2025 12:40:30 -0600 Subject: [PATCH 1064/1283] regen nc patch --- patches/netcat.c.patch | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/patches/netcat.c.patch b/patches/netcat.c.patch index 3faca6af2e..345a170b56 100644 --- a/patches/netcat.c.patch +++ b/patches/netcat.c.patch @@ -1,5 +1,5 @@ ---- apps/nc/netcat.c.orig Sat May 31 03:18:05 2025 -+++ apps/nc/netcat.c Sat May 31 03:18:17 2025 +--- apps/nc/netcat.c.orig Fri Jun 27 12:39:21 2025 ++++ apps/nc/netcat.c Fri Jun 27 12:39:29 2025 @@ -93,9 +93,13 @@ int zflag; /* Port Scan Flag */ int Dflag; /* sodebug */ int Iflag; /* TCP receive buffer size */ @@ -14,7 +14,7 @@ int usetls; /* use TLS */ const char *Cflag; /* Public cert file */ -@@ -270,12 +274,14 @@ main(int argc, char *argv[]) +@@ -271,12 +275,14 @@ main(int argc, char *argv[]) case 'u': uflag = 1; break; @@ -29,7 +29,7 @@ case 'v': vflag = 1; break; -@@ -322,9 +328,11 @@ main(int argc, char *argv[]) +@@ -323,9 +329,11 @@ main(int argc, char *argv[]) case 'o': oflag = optarg; break; @@ -41,7 +41,7 @@ case 'T': errstr = NULL; errno = 0; -@@ -348,9 +356,11 @@ main(int argc, char *argv[]) +@@ -349,9 +357,11 @@ main(int argc, char *argv[]) argc -= optind; argv += optind; @@ -53,7 +53,7 @@ /* Cruft to make sure options are clean, and used properly. */ if (argc == 1 && family == AF_UNIX) { -@@ -925,7 +935,10 @@ remote_connect(const char *host, const char *port, str +@@ -928,7 +938,10 @@ remote_connect(const char *host, const char *port, str char *ipaddr) { struct addrinfo *res, *res0; @@ -65,7 +65,7 @@ if ((error = getaddrinfo(host, port, &hints, &res0))) errx(1, "getaddrinfo for host \"%s\" port %s: %s", host, -@@ -940,8 +953,10 @@ remote_connect(const char *host, const char *port, str +@@ -943,8 +956,10 @@ remote_connect(const char *host, const char *port, str if (sflag || pflag) { struct addrinfo ahints, *ares; @@ -76,7 +76,7 @@ memset(&ahints, 0, sizeof(struct addrinfo)); ahints.ai_family = res->ai_family; ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM; -@@ -1033,7 +1048,10 @@ int +@@ -1036,7 +1051,10 @@ int local_listen(const char *host, const char *port, struct addrinfo hints) { struct addrinfo *res, *res0; @@ -88,7 +88,7 @@ int error; /* Allow nodename to be null. */ -@@ -1054,9 +1072,11 @@ local_listen(const char *host, const char *port, struc +@@ -1057,9 +1075,11 @@ local_listen(const char *host, const char *port, struc res->ai_protocol)) == -1) continue; @@ -100,7 +100,7 @@ set_common_sockopts(s, res->ai_family); -@@ -1561,11 +1581,13 @@ set_common_sockopts(int s, int af) +@@ -1564,11 +1584,13 @@ set_common_sockopts(int s, int af) { int x = 1; @@ -114,7 +114,7 @@ if (Dflag) { if (setsockopt(s, SOL_SOCKET, SO_DEBUG, &x, sizeof(x)) == -1) -@@ -1576,9 +1598,16 @@ set_common_sockopts(int s, int af) +@@ -1579,9 +1601,16 @@ set_common_sockopts(int s, int af) IP_TOS, &Tflag, sizeof(Tflag)) == -1) err(1, "set IP ToS"); @@ -131,7 +131,7 @@ } if (Iflag) { if (setsockopt(s, SOL_SOCKET, SO_RCVBUF, -@@ -1602,13 +1631,17 @@ set_common_sockopts(int s, int af) +@@ -1605,13 +1634,17 @@ set_common_sockopts(int s, int af) } if (minttl != -1) { @@ -150,7 +150,7 @@ } } -@@ -1835,15 +1868,19 @@ help(void) +@@ -1841,15 +1874,19 @@ help(void) \t-P proxyuser\tUsername for proxy authentication\n\ \t-p port\t Specify local port for remote connects\n\ \t-R CAfile CA bundle\n\ From 0daa8adfe8f6fa2adb6bfe086bc8910c95ee3e9d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 29 Jun 2025 03:55:04 -0600 Subject: [PATCH 1065/1283] Adjust to GCM refactoring --- crypto/CMakeLists.txt | 4 ++++ crypto/Makefile.am.elf-x86_64 | 1 + crypto/Makefile.am.macosx-x86_64 | 1 + crypto/Makefile.am.masm-x86_64 | 1 + crypto/Makefile.am.mingw64-x86_64 | 1 + patches/aarch64_crypto_arch.h.patch | 16 ++++++++++++++ patches/amd64_crypto_arch.h.patch | 18 +++++++++++++++ patches/crypto_arch.h.patch | 34 ----------------------------- update.sh | 1 + 9 files changed, 43 insertions(+), 34 deletions(-) create mode 100644 patches/aarch64_crypto_arch.h.patch create mode 100644 patches/amd64_crypto_arch.h.patch delete mode 100644 patches/crypto_arch.h.patch diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 7b788fcc12..b1ec1b2ca3 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -18,6 +18,7 @@ add_definitions(-DLIBRESSL_CRYPTO_INTERNAL) if(HOST_ASM_ELF_X86_64) set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c) set(CRYPTO_SRC ${CRYPTO_SRC} bn/arch/amd64/bn_arch.c) + set(CRYPTO_SRC ${CRYPTO_SRC} modes/gcm128_amd64.c) set( ASM_X86_64_ELF_SRC @@ -55,6 +56,7 @@ endif() if(HOST_ASM_MACOSX_X86_64) set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c) set(CRYPTO_SRC ${CRYPTO_SRC} bn/arch/amd64/bn_arch.c) + set(CRYPTO_SRC ${CRYPTO_SRC} modes/gcm128_amd64.c) set( ASM_X86_64_MACOSX_SRC @@ -92,6 +94,7 @@ endif() if(HOST_ASM_MASM_X86_64) set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c) + set(CRYPTO_SRC ${CRYPTO_SRC} modes/gcm128_amd64.c) set( ASM_X86_64_MASM_SRC @@ -118,6 +121,7 @@ endif() if(HOST_ASM_MINGW64_X86_64) set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c) + set(CRYPTO_SRC ${CRYPTO_SRC} modes/gcm128_amd64.c) set( ASM_X86_64_MINGW64_SRC diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index 9e4775e1ff..ad49787bb1 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -24,6 +24,7 @@ EXTRA_DIST += $(ASM_X86_64_ELF) if HOST_ASM_ELF_X86_64 libcrypto_la_SOURCES += aes/aes_amd64.c libcrypto_la_SOURCES += bn/arch/amd64/bn_arch.c +libcrypto_la_SOURCES += modes/gcm128_amd64.c libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index 7a5ad58b78..bbccfd64fe 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -24,6 +24,7 @@ EXTRA_DIST += $(ASM_X86_64_MACOSX) if HOST_ASM_MACOSX_X86_64 libcrypto_la_SOURCES += aes/aes_amd64.c libcrypto_la_SOURCES += bn/arch/amd64/bn_arch.c +libcrypto_la_SOURCES += modes/gcm128_amd64.c libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index ee46bc412e..bb94e3aaa6 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -11,6 +11,7 @@ EXTRA_DIST += $(ASM_X86_64_MASM) if HOST_ASM_MASM_X86_64 libcrypto_la_SOURCES += aes/aes_amd64.c +libcrypto_la_SOURCES += modes/gcm128_amd64.c libcrypto_la_CPPFLAGS += -DAES_ASM libcrypto_la_CPPFLAGS += -DBSAES_ASM diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index 3dafa869b9..efe2643ad7 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -11,6 +11,7 @@ EXTRA_DIST += $(ASM_X86_64_MINGW64) if HOST_ASM_MINGW64_X86_64 libcrypto_la_SOURCES += aes/aes_amd64.c +libcrypto_la_SOURCES += modes/gcm128_amd64.c libcrypto_la_CPPFLAGS += -Dendbr32=endbr64 libcrypto_la_CPPFLAGS += -DAES_ASM diff --git a/patches/aarch64_crypto_arch.h.patch b/patches/aarch64_crypto_arch.h.patch new file mode 100644 index 0000000000..e6a8cbfe37 --- /dev/null +++ b/patches/aarch64_crypto_arch.h.patch @@ -0,0 +1,16 @@ +--- crypto/arch/aarch64/crypto_arch.h.orig Sun Jun 29 03:49:56 2025 ++++ crypto/arch/aarch64/crypto_arch.h Sun Jun 29 04:00:13 2025 +@@ -34,11 +34,13 @@ extern uint64_t crypto_cpu_caps_aarch64; + #define CRYPTO_CPU_CAPS_AARCH64_SHA3 (1ULL << 5) + + #ifndef OPENSSL_NO_ASM ++#if 0 + + #define HAVE_SHA1_BLOCK_DATA_ORDER + #define HAVE_SHA256_BLOCK_DATA_ORDER + #define HAVE_SHA512_BLOCK_DATA_ORDER + ++#endif + #endif + + #endif diff --git a/patches/amd64_crypto_arch.h.patch b/patches/amd64_crypto_arch.h.patch new file mode 100644 index 0000000000..64c78dd65c --- /dev/null +++ b/patches/amd64_crypto_arch.h.patch @@ -0,0 +1,18 @@ +--- crypto/arch/amd64/crypto_arch.h.orig Sun Jun 29 03:49:56 2025 ++++ crypto/arch/amd64/crypto_arch.h Sun Jun 29 03:57:10 2025 +@@ -45,6 +45,7 @@ extern uint64_t crypto_cpu_caps_amd64; + #define HAVE_RC4_INTERNAL + #define HAVE_RC4_SET_KEY_INTERNAL + ++#if 0 + #define HAVE_SHA1_BLOCK_DATA_ORDER + #define HAVE_SHA1_BLOCK_GENERIC + +@@ -53,6 +54,7 @@ extern uint64_t crypto_cpu_caps_amd64; + + #define HAVE_SHA512_BLOCK_DATA_ORDER + #define HAVE_SHA512_BLOCK_GENERIC ++#endif + + #endif + diff --git a/patches/crypto_arch.h.patch b/patches/crypto_arch.h.patch deleted file mode 100644 index b13ffabf43..0000000000 --- a/patches/crypto_arch.h.patch +++ /dev/null @@ -1,34 +0,0 @@ ---- crypto/arch/amd64/crypto_arch.h.orig Mon Jun 16 10:38:27 2025 -+++ crypto/arch/amd64/crypto_arch.h Mon Jun 16 10:38:39 2025 -@@ -41,6 +41,7 @@ extern uint64_t crypto_cpu_caps_amd64; - #define HAVE_RC4_INTERNAL - #define HAVE_RC4_SET_KEY_INTERNAL - -+#if 0 - #define HAVE_SHA1_BLOCK_DATA_ORDER - #define HAVE_SHA1_BLOCK_GENERIC - -@@ -49,6 +50,7 @@ extern uint64_t crypto_cpu_caps_amd64; - - #define HAVE_SHA512_BLOCK_DATA_ORDER - #define HAVE_SHA512_BLOCK_GENERIC -+#endif - - #endif - ---- crypto/arch/aarch64/crypto_arch.h.orig Thu Mar 13 05:42:37 2025 -+++ crypto/arch/aarch64/crypto_arch.h Thu Mar 13 05:47:39 2025 -@@ -33,11 +33,13 @@ - #define CRYPTO_CPU_CAPS_AARCH64_SHA512 (1ULL << 4) - #define CRYPTO_CPU_CAPS_AARCH64_SHA3 (1ULL << 5) - -+#if 0 - #ifndef OPENSSL_NO_ASM - - #define HAVE_SHA256_BLOCK_DATA_ORDER - #define HAVE_SHA512_BLOCK_DATA_ORDER - -+#endif - #endif - - #endif diff --git a/update.sh b/update.sh index 2aab899465..e8b05669bd 100755 --- a/update.sh +++ b/update.sh @@ -181,6 +181,7 @@ done for arch in amd64 i386; do $CP $libcrypto_src/aes/aes_${arch}.c crypto/aes/ + $CP $libcrypto_src/modes/gcm128_${arch}.c crypto/modes/ done for i in $libcrypto_src/arch/*; do From f4d8b53546fd0ed0999a9717160b18b488988192 Mon Sep 17 00:00:00 2001 From: Jim B Date: Sun, 6 Jul 2025 09:32:49 -0700 Subject: [PATCH 1066/1283] Limit usage of warning flags to C and C++ `add_compile_options()` adds options to all compilers CMake can invoke, including ASM. The format of this warning flag causes MASM to fail if the option is specified. This limits specifying the warning suppression to just C and C++. --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 182cf960f2..4d46cda437 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -143,7 +143,7 @@ add_definitions(-D__END_HIDDEN_DECLS=) set(CMAKE_POSITION_INDEPENDENT_CODE true) if (CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang") - add_compile_options(-Wno-pointer-sign) + add_compile_options($<$:-Wno-pointer-sign> $<$:-Wno-pointer-sign>) endif() if(WIN32) From 5c205f4be3eed1aa477c208392956a8935d49f2d Mon Sep 17 00:00:00 2001 From: Jim B Date: Sun, 6 Jul 2025 15:48:55 -0700 Subject: [PATCH 1067/1283] Remove applying flag to C++ code --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 4d46cda437..3a035bb0ee 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -143,7 +143,7 @@ add_definitions(-D__END_HIDDEN_DECLS=) set(CMAKE_POSITION_INDEPENDENT_CODE true) if (CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang") - add_compile_options($<$:-Wno-pointer-sign> $<$:-Wno-pointer-sign>) + add_compile_options($<$:-Wno-pointer-sign>) endif() if(WIN32) From 80ec6b9286be337191e614ab5e185545bed0d6a2 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 7 Jul 2025 16:52:33 +0200 Subject: [PATCH 1068/1283] Add missing loongarch64/opensslconf.h Fixes #1183 --- include/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/include/Makefile.am b/include/Makefile.am index ff4c6e38a0..a3e1c19b6c 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -67,6 +67,7 @@ noinst_HEADERS += arch/amd64/opensslconf.h noinst_HEADERS += arch/arm/opensslconf.h noinst_HEADERS += arch/hppa/opensslconf.h noinst_HEADERS += arch/i386/opensslconf.h +noinst_HEADERS += arch/loongarch64/opensslconf.h noinst_HEADERS += arch/m88k/opensslconf.h noinst_HEADERS += arch/mips/opensslconf.h noinst_HEADERS += arch/mips64/opensslconf.h From 54dc5a27b1f22f6e5df198b6fd8f4b798f501081 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 12 Jul 2025 21:58:09 +0200 Subject: [PATCH 1069/1283] x_info.c was removed Change-Id: I6a6a6964f97ec3f04111708ee726de6dd4ea8630 --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index b1ec1b2ca3..8c7635ae8e 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -222,7 +222,6 @@ set( asn1/x_bignum.c asn1/x_crl.c asn1/x_exten.c - asn1/x_info.c asn1/x_long.c asn1/x_name.c asn1/x_pkey.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 91da021ee8..250063fb14 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -315,7 +315,6 @@ libcrypto_la_SOURCES += asn1/x_attrib.c libcrypto_la_SOURCES += asn1/x_bignum.c libcrypto_la_SOURCES += asn1/x_crl.c libcrypto_la_SOURCES += asn1/x_exten.c -libcrypto_la_SOURCES += asn1/x_info.c libcrypto_la_SOURCES += asn1/x_long.c libcrypto_la_SOURCES += asn1/x_name.c libcrypto_la_SOURCES += asn1/x_pkey.c From 0a07d6b66fbf31ed8f586c7734833b097a8cb0b5 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 12 Jul 2025 22:23:22 +0200 Subject: [PATCH 1070/1283] Adjust for x_pkey.c removal Change-Id: I6a6a696458f18874c81e49aa5068a910a51becdb --- crypto/CMakeLists.txt | 1 - crypto/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 8c7635ae8e..047c2287e5 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -224,7 +224,6 @@ set( asn1/x_exten.c asn1/x_long.c asn1/x_name.c - asn1/x_pkey.c asn1/x_pubkey.c asn1/x_req.c asn1/x_sig.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 250063fb14..ad241abcdf 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -317,7 +317,6 @@ libcrypto_la_SOURCES += asn1/x_crl.c libcrypto_la_SOURCES += asn1/x_exten.c libcrypto_la_SOURCES += asn1/x_long.c libcrypto_la_SOURCES += asn1/x_name.c -libcrypto_la_SOURCES += asn1/x_pkey.c libcrypto_la_SOURCES += asn1/x_pubkey.c libcrypto_la_SOURCES += asn1/x_req.c libcrypto_la_SOURCES += asn1/x_sig.c From 18024b9d62d81bb89b056b4b79589836e2616aa1 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 22 Jul 2025 18:40:35 +0200 Subject: [PATCH 1071/1283] Sync BN_LLONG removal from opensslconf.h Change-Id: I6a6a6964e4319a0fb0a0ecf5b4f6ea226beca433 --- include/arch/loongarch64/opensslconf.h | 5 ----- include/arch/mips/opensslconf.h | 5 ----- 2 files changed, 10 deletions(-) diff --git a/include/arch/loongarch64/opensslconf.h b/include/arch/loongarch64/opensslconf.h index 49cdf69a38..67d9728afa 100644 --- a/include/arch/loongarch64/opensslconf.h +++ b/include/arch/loongarch64/opensslconf.h @@ -22,11 +22,6 @@ #endif #endif -#if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H) -#define CONFIG_HEADER_BN_H -#undef BN_LLONG -#endif - #if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H) #define CONFIG_HEADER_DES_LOCL_H #ifndef DES_DEFAULT_OPTIONS diff --git a/include/arch/mips/opensslconf.h b/include/arch/mips/opensslconf.h index 639b15e8f4..d2fdbbbf59 100644 --- a/include/arch/mips/opensslconf.h +++ b/include/arch/mips/opensslconf.h @@ -22,11 +22,6 @@ #endif #endif -#if defined(HEADER_BN_H) && !defined(CONFIG_HEADER_BN_H) -#define CONFIG_HEADER_BN_H -#define BN_LLONG -#endif - #if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H) #define CONFIG_HEADER_DES_LOCL_H #ifndef DES_DEFAULT_OPTIONS From 480c1f8f62dcca7ba502d98dcf90204913641065 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 23 Jul 2025 08:19:02 -0600 Subject: [PATCH 1072/1283] regen amd64 crypto_arch.patch --- patches/amd64_crypto_arch.h.patch | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/patches/amd64_crypto_arch.h.patch b/patches/amd64_crypto_arch.h.patch index 64c78dd65c..b09410088b 100644 --- a/patches/amd64_crypto_arch.h.patch +++ b/patches/amd64_crypto_arch.h.patch @@ -1,6 +1,6 @@ ---- crypto/arch/amd64/crypto_arch.h.orig Sun Jun 29 03:49:56 2025 -+++ crypto/arch/amd64/crypto_arch.h Sun Jun 29 03:57:10 2025 -@@ -45,6 +45,7 @@ extern uint64_t crypto_cpu_caps_amd64; +--- crypto/arch/amd64/crypto_arch.h.orig Wed Jul 23 08:15:02 2025 ++++ crypto/arch/amd64/crypto_arch.h Wed Jul 23 08:15:20 2025 +@@ -47,6 +47,7 @@ extern uint64_t crypto_cpu_caps_amd64; #define HAVE_RC4_INTERNAL #define HAVE_RC4_SET_KEY_INTERNAL @@ -8,7 +8,7 @@ #define HAVE_SHA1_BLOCK_DATA_ORDER #define HAVE_SHA1_BLOCK_GENERIC -@@ -53,6 +54,7 @@ extern uint64_t crypto_cpu_caps_amd64; +@@ -55,6 +56,7 @@ extern uint64_t crypto_cpu_caps_amd64; #define HAVE_SHA512_BLOCK_DATA_ORDER #define HAVE_SHA512_BLOCK_GENERIC From eacd3684b2c76547ce39e8b03f266db9e2bbb223 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 23 Jul 2025 08:23:44 -0600 Subject: [PATCH 1073/1283] Update man links --- man/links | 2 -- 1 file changed, 2 deletions(-) diff --git a/man/links b/man/links index c26dda39c7..37c7b42d88 100644 --- a/man/links +++ b/man/links @@ -1289,7 +1289,6 @@ OpenSSL_add_all_algorithms.3,OpenSSL_add_all_digests.3 OpenSSL_add_all_algorithms.3,SSLeay_add_all_algorithms.3 PEM_ASN1_read.3,PEM_ASN1_read_bio.3 PEM_ASN1_read.3,d2i_of_void.3 -PEM_X509_INFO_read.3,PEM_X509_INFO_read_bio.3 PEM_read.3,PEM_def_callback.3 PEM_read.3,PEM_do_header.3 PEM_read.3,PEM_get_EVP_CIPHER_INFO.3 @@ -2034,7 +2033,6 @@ X509_OBJECT_get0_X509.3,X509_OBJECT_idx_by_subject.3 X509_OBJECT_get0_X509.3,X509_OBJECT_new.3 X509_OBJECT_get0_X509.3,X509_OBJECT_retrieve_by_subject.3 X509_OBJECT_get0_X509.3,X509_OBJECT_retrieve_match.3 -X509_PKEY_new.3,X509_PKEY_free.3 X509_PUBKEY_new.3,X509_PUBKEY_free.3 X509_PUBKEY_new.3,X509_PUBKEY_get.3 X509_PUBKEY_new.3,X509_PUBKEY_get0.3 From df41f5b5c23d32fbcd6b23ec6904e42c44f1b7ef Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 23 Jul 2025 17:03:08 +0200 Subject: [PATCH 1074/1283] Try to fix OOM in Emscripten ASAN --- tests/CMakeLists.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 76b166245f..c497b77398 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -467,6 +467,7 @@ add_platform_test(evptest evptest ${CMAKE_CURRENT_SOURCE_DIR}/evptests.txt) # evp_test add_executable(evp_test evp_test.c) target_link_libraries(evp_test ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(evp_test) add_platform_test(evp_test evp_test) # exdata_test From 7218171381e6ea7c64f34551418dfb160fd74a73 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 27 Jul 2025 15:29:05 +0200 Subject: [PATCH 1075/1283] Sync DES_UNROLL removal from opensslconf.h Change-Id: I6a6a6964d015e92505a3a24785cdc3ea2535ad5e --- include/arch/loongarch64/opensslconf.h | 12 ------------ include/arch/mips/opensslconf.h | 12 ------------ 2 files changed, 24 deletions(-) diff --git a/include/arch/loongarch64/opensslconf.h b/include/arch/loongarch64/opensslconf.h index 67d9728afa..868066c75e 100644 --- a/include/arch/loongarch64/opensslconf.h +++ b/include/arch/loongarch64/opensslconf.h @@ -21,15 +21,3 @@ #define RC4_CHUNK unsigned long #endif #endif - -#if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H) -#define CONFIG_HEADER_DES_LOCL_H -#ifndef DES_DEFAULT_OPTIONS -/* Unroll the inner loop, this sometimes helps, sometimes hinders. - * Very much CPU dependent */ -#ifndef DES_UNROLL -#define DES_UNROLL -#endif - -#endif /* DES_DEFAULT_OPTIONS */ -#endif /* HEADER_DES_LOCL_H */ diff --git a/include/arch/mips/opensslconf.h b/include/arch/mips/opensslconf.h index d2fdbbbf59..dcbe113864 100644 --- a/include/arch/mips/opensslconf.h +++ b/include/arch/mips/opensslconf.h @@ -21,15 +21,3 @@ #undef RC4_CHUNK #endif #endif - -#if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H) -#define CONFIG_HEADER_DES_LOCL_H -#ifndef DES_DEFAULT_OPTIONS -/* Unroll the inner loop, this sometimes helps, sometimes hinders. - * Very much CPU dependent */ -#ifndef DES_UNROLL -#define DES_UNROLL -#endif - -#endif /* DES_DEFAULT_OPTIONS */ -#endif /* HEADER_DES_LOCL_H */ From 5bcf54058d62ca1f197616ee344d05fbb3e34e21 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Wed, 30 Jul 2025 07:11:36 +0900 Subject: [PATCH 1076/1283] CI: Apply EVP const_ptr patch for LibreSSL < 4.2.0 In the GitHub Actions workflow for rust-openssl testing, apply the patch used in OpenBSD ports to support EVP_PKEY_get1_* APIs with const_ptr. This ensures that the build succeeds before the official version bump to libressl420. This is a temporary workaround to keep the tests passing until 4.2.0 release. Fix https://github.com/libressl/portable/issues/1187 --- .github/workflows/rust-openssl.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index 4ff41c00fb..d3b2beee77 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -34,6 +34,10 @@ jobs: - name: "Run rust-openssl tests" run: | cd rust-openssl + + # apply patch - see #1187 + curl -L https://raw.githubusercontent.com/openbsd/ports/refs/heads/master/security/rust-openssl-tests/patches/patch-openssl-sys_src_handwritten_evp_rs | patch -p0 + # instead of erroring use the last supported version ed -s openssl-sys/build/main.rs <<-EOF /_ => version_error/-1 From d580acbc29c8e4a5c2a117ff6cec0fcb6027f8c3 Mon Sep 17 00:00:00 2001 From: Un1q32 Date: Fri, 1 Aug 2025 13:15:43 -0400 Subject: [PATCH 1077/1283] check for resolv.h and arpa/nameser.h --- CMakeLists.txt | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index 3a035bb0ee..17e5a0c0a3 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -378,6 +378,16 @@ if(HAVE_NETINET_IP_H) add_definitions(-DHAVE_NETINET_IP_H) endif() +check_include_files(resolv.h HAVE_RESOLV_H) +if(HAVE_RESOLV_H) + add_definitions(-DHAVE_RESOLV_H) +endif() + +check_include_files(arpa/nameser.h HAVE_ARPA_NAMESER_H) +if(HAVE_ARPA_NAMESER_H) + add_definitions(-DHAVE_ARPA_NAMESER_H) +endif() + # This isn't ready for universal binaries yet, since we do conditional # compilation based on the architecture, but this makes cross compiling for a # single architecture work on macOS at least. From c0ebc3a6943ea7e7b5705f3c9b60f08ef405c408 Mon Sep 17 00:00:00 2001 From: Ilia Shipitsin Date: Fri, 8 Aug 2025 20:49:00 +0200 Subject: [PATCH 1078/1283] CI: introduce ubuntu-24.04 on arm64 reference: https://github.com/actions/partner-runner-images --- .github/workflows/linux.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 8334ae6d3e..de9d8d3e58 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -35,6 +35,13 @@ jobs: - os: "ubuntu-24.04" # loong64 arch: "loong64" compiler: "gcc" + - os: "ubuntu-24.04-arm" + arch: "native" + compiler: "gcc" + - os: "ubuntu-24.04-arm" + arch: "native" + compiler: "clang" + steps: - name: "Checkout repository" uses: actions/checkout@v4 @@ -47,8 +54,8 @@ jobs: # Test ASAN with and without ASM enabled. test-asan: - name: "ASAN (${{ matrix.asm == 'ON' && 'asm' || 'no-asm' }})" - runs-on: "ubuntu-24.04" + name: "${{ matrix.os }} - ASAN (${{ matrix.asm == 'ON' && 'asm' || 'no-asm' }})" + runs-on: "${{ matrix.os }}" if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} permissions: contents: read @@ -56,6 +63,7 @@ jobs: fail-fast: false matrix: asm: [ON, OFF] + os: ["ubuntu-24.04", "ubuntu-24.04-arm"] steps: - name: "Checkout repository" uses: actions/checkout@v4 From 23a96ede97dc74c287eb343627354dd54b4f818e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 15 Aug 2025 23:00:00 +0200 Subject: [PATCH 1079/1283] Mop up RC4_CHUNK - opensslconf.h is now MI Change-Id: I6a6a69646afcda5abaa40e9efb586abb80eeafb5 --- include/arch/loongarch64/opensslconf.h | 10 ---------- include/arch/mips/opensslconf.h | 10 ---------- 2 files changed, 20 deletions(-) diff --git a/include/arch/loongarch64/opensslconf.h b/include/arch/loongarch64/opensslconf.h index 868066c75e..c31bcc01ad 100644 --- a/include/arch/loongarch64/opensslconf.h +++ b/include/arch/loongarch64/opensslconf.h @@ -11,13 +11,3 @@ #define OPENSSL_LINE __LINE__ #endif #endif - -#if defined(HEADER_RC4_H) -#if !defined(RC4_CHUNK) -/* - * This enables code handling data aligned at natural CPU word - * boundary. See crypto/rc4/rc4_enc.c for further details. - */ -#define RC4_CHUNK unsigned long -#endif -#endif diff --git a/include/arch/mips/opensslconf.h b/include/arch/mips/opensslconf.h index dcbe113864..c31bcc01ad 100644 --- a/include/arch/mips/opensslconf.h +++ b/include/arch/mips/opensslconf.h @@ -11,13 +11,3 @@ #define OPENSSL_LINE __LINE__ #endif #endif - -#if defined(HEADER_RC4_H) -#if !defined(RC4_CHUNK) -/* - * This enables code handling data aligned at natural CPU word - * boundary. See crypto/rc4/rc4_enc.c for further details. - */ -#undef RC4_CHUNK -#endif -#endif From aaabed455c90ab8e972bff3a38b42f731ef7099d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 17 Aug 2025 13:13:41 -0600 Subject: [PATCH 1080/1283] Update for MLKEM changes --- crypto/CMakeLists.txt | 4 +++- crypto/Makefile.am | 5 +++-- tests/CMakeLists.txt | 2 +- tests/Makefile.am | 3 ++- update.sh | 2 +- 5 files changed, 10 insertions(+), 6 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 047c2287e5..a8d74cb62b 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -416,8 +416,10 @@ set( lhash/lhash.c md4/md4.c md5/md5.c - mlkem/mlkem768.c + mlkem/mlkem.c mlkem/mlkem1024.c + mlkem/mlkem768.c + mlkem/mlkem_key.c modes/cbc128.c modes/ccm128.c modes/cfb128.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index ad241abcdf..610341a940 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -738,9 +738,10 @@ libcrypto_la_SOURCES += md4/md4.c libcrypto_la_SOURCES += md5/md5.c # mlkem -libcrypto_la_SOURCES += mlkem/mlkem768.c +libcrypto_la_SOURCES += mlkem/mlkem.c libcrypto_la_SOURCES += mlkem/mlkem1024.c -noinst_HEADERS += mlkem/mlkem.h +libcrypto_la_SOURCES += mlkem/mlkem768.c +libcrypto_la_SOURCES += mlkem/mlkem_key.c noinst_HEADERS += mlkem/mlkem_internal.h # modes diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index c497b77398..32fe36aaa4 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -563,7 +563,7 @@ if(NOT WIN32) endif() # mlkem_tests -add_executable(mlkem_tests mlkem_tests.c mlkem_tests_util.c parse_test_file.c) +add_executable(mlkem_tests mlkem_tests.c parse_test_file.c) target_link_libraries(mlkem_tests ${OPENSSL_TEST_LIBS}) prepare_emscripten_test_target(mlkem_tests) if(NOT WIN32) diff --git a/tests/Makefile.am b/tests/Makefile.am index 914b1e512f..2052f0c5c9 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -577,7 +577,7 @@ noinst_HEADERS += parse_test_file.h # mlkem_tests TESTS += mlkem_tests.sh check_PROGRAMS += mlkem_tests -mlkem_tests_SOURCES = mlkem_tests.c mlkem_tests_util.c parse_test_file.c +mlkem_tests_SOURCES = mlkem_tests.c parse_test_file.c EXTRA_DIST += mlkem_tests.sh EXTRA_DIST += mlkem768_decap_tests.txt EXTRA_DIST += mlkem768_encap_tests.txt @@ -589,6 +589,7 @@ EXTRA_DIST += mlkem1024_encap_tests.txt EXTRA_DIST += mlkem1024_keygen_tests.txt EXTRA_DIST += mlkem1024_nist_decap_tests.txt EXTRA_DIST += mlkem1024_nist_keygen_tests.txt +# XXX - add tests for Windows # mlkem_iteration_tests TESTS += mlkem_iteration_tests diff --git a/update.sh b/update.sh index e8b05669bd..761953ac6b 100755 --- a/update.sh +++ b/update.sh @@ -142,7 +142,7 @@ copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h ossl_typ.h err/err.h crypto.h comp/comp.h x509/x509.h buffer/buffer.h objects/objects.h asn1/asn1.h asn1/posix_time.h bn/bn.h ec/ec.h ecdsa/ecdsa.h ecdh/ecdh.h rsa/rsa.h sha/sha.h x509/x509_vfy.h pkcs7/pkcs7.h pem/pem.h - hkdf/hkdf.h hmac/hmac.h rand/rand.h md5/md5.h + hkdf/hkdf.h hmac/hmac.h rand/rand.h md5/md5.h mlkem/mlkem.h x509/x509v3.h conf/conf.h ocsp/ocsp.h aes/aes.h modes/modes.h asn1/asn1t.h bf/blowfish.h bio/bio.h cast/cast.h cmac/cmac.h cms/cms.h des/des.h dh/dh.h From 45e37fba52b44966d95aa06bf1d8d718ad270081 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 17 Aug 2025 13:21:49 -0600 Subject: [PATCH 1081/1283] Fix a leftover "mlkem.h" include --- patches/mlkem_internal.h.patch | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 patches/mlkem_internal.h.patch diff --git a/patches/mlkem_internal.h.patch b/patches/mlkem_internal.h.patch new file mode 100644 index 0000000000..b7cbdcf0a4 --- /dev/null +++ b/patches/mlkem_internal.h.patch @@ -0,0 +1,11 @@ +--- crypto/mlkem/mlkem_internal.h.orig Sun Aug 17 13:20:18 2025 ++++ crypto/mlkem/mlkem_internal.h Sun Aug 17 13:20:37 2025 +@@ -19,7 +19,7 @@ + #define OPENSSL_HEADER_CRYPTO_MLKEM_INTERNAL_H + + #include "bytestring.h" +-#include "mlkem.h" ++#include + + #if defined(__cplusplus) + extern "C" { From 627df1f3d6dd11d90547009b89c6418178a3f1dc Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 17 Aug 2025 13:21:49 -0600 Subject: [PATCH 1082/1283] Ignore ec_arithmetic test --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index c83a56dd27..03f44eb187 100644 --- a/.gitignore +++ b/.gitignore @@ -108,6 +108,7 @@ tests/constraints* tests/crypto_test* tests/ctlog.conf tests/*.crt +tests/ec_arithmetic* tests/ec_point_conversion* tests/ecc_cdh* tests/evp_pkey_cleanup* From d811b09c21fc82ebb0cf7c67a89b10b5cdfbfa13 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 17 Aug 2025 14:20:21 -0600 Subject: [PATCH 1083/1283] link new s2n-bignum assembly to build --- crypto/CMakeLists.txt | 20 ++++++++++++++++++++ crypto/Makefile.am.elf-x86_64 | 10 ++++++++++ crypto/Makefile.am.macosx-x86_64 | 10 ++++++++++ 3 files changed, 40 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index a8d74cb62b..f67d2bde3f 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -33,11 +33,21 @@ if(HOST_ASM_ELF_X86_64) bn/arch/amd64/bignum_add.S bn/arch/amd64/bignum_cmadd.S bn/arch/amd64/bignum_cmul.S + bn/arch/amd64/bignum_modadd.S + bn/arch/amd64/bignum_modsub.S bn/arch/amd64/bignum_mul.S + bn/arch/amd64/bignum_mul_4_8.S bn/arch/amd64/bignum_mul_4_8_alt.S + bn/arch/amd64/bignum_mul_6_12.S + bn/arch/amd64/bignum_mul_6_12_alt.S + bn/arch/amd64/bignum_mul_8_16.S bn/arch/amd64/bignum_mul_8_16_alt.S bn/arch/amd64/bignum_sqr.S + bn/arch/amd64/bignum_sqr_4_8.S bn/arch/amd64/bignum_sqr_4_8_alt.S + bn/arch/amd64/bignum_sqr_6_12.S + bn/arch/amd64/bignum_sqr_6_12_alt.S + bn/arch/amd64/bignum_sqr_8_16.S bn/arch/amd64/bignum_sqr_8_16_alt.S bn/arch/amd64/bignum_sub.S bn/arch/amd64/word_clz.S @@ -71,11 +81,21 @@ if(HOST_ASM_MACOSX_X86_64) bn/arch/amd64/bignum_add.S bn/arch/amd64/bignum_cmadd.S bn/arch/amd64/bignum_cmul.S + bn/arch/amd64/bignum_modadd.S + bn/arch/amd64/bignum_modsub.S bn/arch/amd64/bignum_mul.S + bn/arch/amd64/bignum_mul_4_8.S bn/arch/amd64/bignum_mul_4_8_alt.S + bn/arch/amd64/bignum_mul_6_12.S + bn/arch/amd64/bignum_mul_6_12_alt.S + bn/arch/amd64/bignum_mul_8_16.S bn/arch/amd64/bignum_mul_8_16_alt.S bn/arch/amd64/bignum_sqr.S + bn/arch/amd64/bignum_sqr_4_8.S bn/arch/amd64/bignum_sqr_4_8_alt.S + bn/arch/amd64/bignum_sqr_6_12.S + bn/arch/amd64/bignum_sqr_6_12_alt.S + bn/arch/amd64/bignum_sqr_8_16.S bn/arch/amd64/bignum_sqr_8_16_alt.S bn/arch/amd64/bignum_sub.S bn/arch/amd64/word_clz.S diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index ad49787bb1..df67ad2374 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -10,11 +10,21 @@ ASM_X86_64_ELF += rc4/rc4-elf-x86_64.S ASM_X86_64_ELF += bn/arch/amd64/bignum_add.S ASM_X86_64_ELF += bn/arch/amd64/bignum_cmadd.S ASM_X86_64_ELF += bn/arch/amd64/bignum_cmul.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_modadd.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_modsub.S ASM_X86_64_ELF += bn/arch/amd64/bignum_mul.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_mul_4_8.S ASM_X86_64_ELF += bn/arch/amd64/bignum_mul_4_8_alt.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_mul_6_12.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_mul_6_12_alt.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_mul_8_16.S ASM_X86_64_ELF += bn/arch/amd64/bignum_mul_8_16_alt.S ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_4_8.S ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_4_8_alt.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_6_12.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_6_12_alt.S +ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_8_16.S ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_8_16_alt.S ASM_X86_64_ELF += bn/arch/amd64/bignum_sub.S ASM_X86_64_ELF += bn/arch/amd64/word_clz.S diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index bbccfd64fe..23e27e6d4d 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -10,11 +10,21 @@ ASM_X86_64_MACOSX += rc4/rc4-macosx-x86_64.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_add.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_cmadd.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_cmul.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_modadd.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_modsub.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul_4_8.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul_4_8_alt.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul_6_12.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul_6_12_alt.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul_8_16.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_mul_8_16_alt.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_4_8.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_4_8_alt.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_6_12.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_6_12_alt.S +ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_8_16.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sqr_8_16_alt.S ASM_X86_64_MACOSX += bn/arch/amd64/bignum_sub.S ASM_X86_64_MACOSX += bn/arch/amd64/word_clz.S From 3e43172feea892ca96e69d8f4808cac8b26a8b00 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 18 Aug 2025 10:39:05 +0200 Subject: [PATCH 1084/1283] Run mlkem_tests on Windows There's probably cleaner ways to do it, but shrug. Better than nothing. --- tests/CMakeLists.txt | 6 +++-- tests/Makefile.am | 3 +-- tests/mlkem_tests.bat | 63 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 68 insertions(+), 4 deletions(-) create mode 100644 tests/mlkem_tests.bat diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 32fe36aaa4..55529cdc44 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -566,11 +566,13 @@ endif() add_executable(mlkem_tests mlkem_tests.c parse_test_file.c) target_link_libraries(mlkem_tests ${OPENSSL_TEST_LIBS}) prepare_emscripten_test_target(mlkem_tests) -if(NOT WIN32) +if(NOT MSVC) add_test(NAME mlkem_tests COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/mlkem_tests.sh) set_tests_properties(mlkem_tests PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") +else() + add_test(NAME mlkem_tests COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/mlkem_tests.bat $) endif() -# XXX - add tests for Windows +set_tests_properties(mlkem_tests PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # mlkem_iteration_tests add_executable(mlkem_iteration_tests mlkem_iteration_tests.c mlkem_tests_util.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index 2052f0c5c9..066e02090b 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -578,7 +578,7 @@ noinst_HEADERS += parse_test_file.h TESTS += mlkem_tests.sh check_PROGRAMS += mlkem_tests mlkem_tests_SOURCES = mlkem_tests.c parse_test_file.c -EXTRA_DIST += mlkem_tests.sh +EXTRA_DIST += mlkem_tests.sh mlkem_tests.bat EXTRA_DIST += mlkem768_decap_tests.txt EXTRA_DIST += mlkem768_encap_tests.txt EXTRA_DIST += mlkem768_keygen_tests.txt @@ -589,7 +589,6 @@ EXTRA_DIST += mlkem1024_encap_tests.txt EXTRA_DIST += mlkem1024_keygen_tests.txt EXTRA_DIST += mlkem1024_nist_decap_tests.txt EXTRA_DIST += mlkem1024_nist_keygen_tests.txt -# XXX - add tests for Windows # mlkem_iteration_tests TESTS += mlkem_iteration_tests diff --git a/tests/mlkem_tests.bat b/tests/mlkem_tests.bat new file mode 100644 index 0000000000..618c9e0234 --- /dev/null +++ b/tests/mlkem_tests.bat @@ -0,0 +1,63 @@ +@echo off +setlocal enabledelayedexpansion + +:: Copyright (c) 2025 Theo Beuhler +:: +:: Permission to use, copy, modify, and distribute this software for any +:: purpose with or without fee is hereby granted, provided that the above +:: copyright notice and this permission notice appear in all copies. +:: +:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + +set mlkem_tests_bin=%1 +set mlkem_tests_bin=%mlkem_tests_bin:/=\% +if not exist %mlkem_tests_bin% exit /b 1 + +%mlkem_tests_bin% mlkem768_decap_tests %srcdir%\mlkem768_decap_tests.txt +if !errorlevel! neq 0 ( + exit /b 1 +) +%mlkem_tests_bin% mlkem768_encap_tests %srcdir%\mlkem768_encap_tests.txt +if !errorlevel! neq 0 ( + exit /b 1 +) +%mlkem_tests_bin% mlkem768_keygen_tests %srcdir%\mlkem768_keygen_tests.txt +if !errorlevel! neq 0 ( + exit /b 1 +) +%mlkem_tests_bin% mlkem768_nist_decap_tests %srcdir%\mlkem768_nist_decap_tests.txt +if !errorlevel! neq 0 ( + exit /b 1 +) +%mlkem_tests_bin% mlkem768_nist_keygen_tests %srcdir%\mlkem768_nist_keygen_tests.txt +if !errorlevel! neq 0 ( + exit /b 1 +) +%mlkem_tests_bin% mlkem1024_decap_tests %srcdir%\mlkem1024_decap_tests.txt +if !errorlevel! neq 0 ( + exit /b 1 +) +%mlkem_tests_bin% mlkem1024_encap_tests %srcdir%\mlkem1024_encap_tests.txt +if !errorlevel! neq 0 ( + exit /b 1 +) +%mlkem_tests_bin% mlkem1024_keygen_tests %srcdir%\mlkem1024_keygen_tests.txt +if !errorlevel! neq 0 ( + exit /b 1 +) +%mlkem_tests_bin% mlkem1024_nist_decap_tests %srcdir%\mlkem1024_nist_decap_tests.txt +if !errorlevel! neq 0 ( + exit /b 1 +) +%mlkem_tests_bin% mlkem1024_nist_keygen_tests %srcdir%\mlkem1024_nist_keygen_tests.txt +if !errorlevel! neq 0 ( + exit /b 1 +) + +endlocal From 8c76c282b3130f4967854686d3eaff0c15758d7c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 18 Aug 2025 12:14:06 +0200 Subject: [PATCH 1085/1283] Improve {crypto,ssl}_namespace.h patches This way we should be able to pull them into openbsd. --- patches/crypto_namespace.h.patch | 23 +++++++++++++---------- patches/ssl_namespace.h.patch | 22 +++++++++++++--------- 2 files changed, 26 insertions(+), 19 deletions(-) diff --git a/patches/crypto_namespace.h.patch b/patches/crypto_namespace.h.patch index 400030f353..f45a121547 100644 --- a/patches/crypto_namespace.h.patch +++ b/patches/crypto_namespace.h.patch @@ -1,22 +1,25 @@ ---- crypto/hidden/crypto_namespace.h.orig Fri Aug 2 23:52:55 2024 -+++ crypto/hidden/crypto_namespace.h Fri Aug 2 23:53:17 2024 -@@ -24,6 +24,12 @@ +--- crypto/hidden/crypto_namespace.h.orig Sun Aug 17 13:14:19 2025 ++++ crypto/hidden/crypto_namespace.h Mon Aug 18 04:10:42 2025 +@@ -24,6 +24,10 @@ * external calls use the latter name. */ +#ifdef _MSC_VER -+# define LCRYPTO_UNUSED(x) -+# define LCRYPTO_USED(x) -+# define LCRYPTO_ALIAS1(pre, x) -+# define LCRYPTO_ALIAS(x) -+#else ++#undef LIBRESSL_NAMESPACE ++#endif ++ #ifdef LIBRESSL_NAMESPACE #ifdef LIBRESSL_CRYPTO_NAMESPACE # define LCRYPTO_UNUSED(x) __attribute__((deprecated)) \ -@@ -47,5 +53,6 @@ +@@ -45,7 +49,11 @@ + # define LCRYPTO_UNUSED(x) + # define LCRYPTO_USED(x) # define LCRYPTO_ALIAS1(pre,x) ++#ifdef _MSC_VER ++# define LCRYPTO_ALIAS(x) ++#else # define LCRYPTO_ALIAS(x) asm("") - #endif +#endif /* _MSC_VER */ + #endif #endif /* _LIBCRYPTO_CRYPTO_NAMESPACE_H_ */ diff --git a/patches/ssl_namespace.h.patch b/patches/ssl_namespace.h.patch index eb9c7a2dc2..d7b924a415 100644 --- a/patches/ssl_namespace.h.patch +++ b/patches/ssl_namespace.h.patch @@ -1,21 +1,25 @@ ---- ssl/hidden/ssl_namespace.h.orig Fri Aug 2 23:52:55 2024 -+++ ssl/hidden/ssl_namespace.h Fri Aug 2 23:53:17 2024 -@@ -23,6 +23,11 @@ +--- ssl/hidden/ssl_namespace.h.orig Sun Aug 17 13:14:19 2025 ++++ ssl/hidden/ssl_namespace.h Mon Aug 18 04:11:53 2025 +@@ -23,6 +23,10 @@ * and we alias that to the normal name. */ +#ifdef _MSC_VER -+#define LSSL_UNUSED(x) -+#define LSSL_USED(x) -+#define LSSL_ALIAS(x) -+#else ++#undef LIBRESSL_NAMESPACE ++#endif ++ #ifdef LIBRESSL_NAMESPACE #define LSSL_UNUSED(x) typeof(x) x __attribute__((deprecated)) #define LSSL_USED(x) __attribute__((visibility("hidden"))) \ -@@ -37,5 +42,6 @@ +@@ -35,7 +39,11 @@ + #else + #define LSSL_UNUSED(x) #define LSSL_USED(x) ++#ifdef _MSC_VER ++#define LSSL_ALIAS(x) ++#else #define LSSL_ALIAS(x) asm("") - #endif +#endif /* _MSC_VER */ + #endif #endif /* _LIBSSL_SSL_NAMESPACE_H_ */ From 77be80d6218cac65ca703db9f78b097d6a2c0849 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 18 Aug 2025 19:12:51 +0200 Subject: [PATCH 1086/1283] Remove upstreamed patches --- patches/crypto_namespace.h.patch | 25 ------------------------- patches/ssl_namespace.h.patch | 25 ------------------------- 2 files changed, 50 deletions(-) delete mode 100644 patches/crypto_namespace.h.patch delete mode 100644 patches/ssl_namespace.h.patch diff --git a/patches/crypto_namespace.h.patch b/patches/crypto_namespace.h.patch deleted file mode 100644 index f45a121547..0000000000 --- a/patches/crypto_namespace.h.patch +++ /dev/null @@ -1,25 +0,0 @@ ---- crypto/hidden/crypto_namespace.h.orig Sun Aug 17 13:14:19 2025 -+++ crypto/hidden/crypto_namespace.h Mon Aug 18 04:10:42 2025 -@@ -24,6 +24,10 @@ - * external calls use the latter name. - */ - -+#ifdef _MSC_VER -+#undef LIBRESSL_NAMESPACE -+#endif -+ - #ifdef LIBRESSL_NAMESPACE - #ifdef LIBRESSL_CRYPTO_NAMESPACE - # define LCRYPTO_UNUSED(x) __attribute__((deprecated)) \ -@@ -45,7 +49,11 @@ - # define LCRYPTO_UNUSED(x) - # define LCRYPTO_USED(x) - # define LCRYPTO_ALIAS1(pre,x) -+#ifdef _MSC_VER -+# define LCRYPTO_ALIAS(x) -+#else - # define LCRYPTO_ALIAS(x) asm("") -+#endif /* _MSC_VER */ - #endif - - #endif /* _LIBCRYPTO_CRYPTO_NAMESPACE_H_ */ diff --git a/patches/ssl_namespace.h.patch b/patches/ssl_namespace.h.patch deleted file mode 100644 index d7b924a415..0000000000 --- a/patches/ssl_namespace.h.patch +++ /dev/null @@ -1,25 +0,0 @@ ---- ssl/hidden/ssl_namespace.h.orig Sun Aug 17 13:14:19 2025 -+++ ssl/hidden/ssl_namespace.h Mon Aug 18 04:11:53 2025 -@@ -23,6 +23,10 @@ - * and we alias that to the normal name. - */ - -+#ifdef _MSC_VER -+#undef LIBRESSL_NAMESPACE -+#endif -+ - #ifdef LIBRESSL_NAMESPACE - #define LSSL_UNUSED(x) typeof(x) x __attribute__((deprecated)) - #define LSSL_USED(x) __attribute__((visibility("hidden"))) \ -@@ -35,7 +39,11 @@ - #else - #define LSSL_UNUSED(x) - #define LSSL_USED(x) -+#ifdef _MSC_VER -+#define LSSL_ALIAS(x) -+#else - #define LSSL_ALIAS(x) asm("") -+#endif /* _MSC_VER */ - #endif - - #endif /* _LIBSSL_SSL_NAMESPACE_H_ */ From 2f62a5e2e7d04a7c8bec77a40ecedbf98048a7e0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 24 Aug 2025 23:49:43 -0600 Subject: [PATCH 1087/1283] regen patches --- patches/amd64_crypto_arch.h.patch | 8 ++++---- patches/win32_amd64_bn_arch.h.patch | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/patches/amd64_crypto_arch.h.patch b/patches/amd64_crypto_arch.h.patch index b09410088b..bf44458f97 100644 --- a/patches/amd64_crypto_arch.h.patch +++ b/patches/amd64_crypto_arch.h.patch @@ -1,6 +1,6 @@ ---- crypto/arch/amd64/crypto_arch.h.orig Wed Jul 23 08:15:02 2025 -+++ crypto/arch/amd64/crypto_arch.h Wed Jul 23 08:15:20 2025 -@@ -47,6 +47,7 @@ extern uint64_t crypto_cpu_caps_amd64; +--- crypto/arch/amd64/crypto_arch.h.orig Sun Aug 17 13:14:19 2025 ++++ crypto/arch/amd64/crypto_arch.h Sun Aug 24 23:47:56 2025 +@@ -48,6 +48,7 @@ extern uint64_t crypto_cpu_caps_amd64; #define HAVE_RC4_INTERNAL #define HAVE_RC4_SET_KEY_INTERNAL @@ -8,7 +8,7 @@ #define HAVE_SHA1_BLOCK_DATA_ORDER #define HAVE_SHA1_BLOCK_GENERIC -@@ -55,6 +56,7 @@ extern uint64_t crypto_cpu_caps_amd64; +@@ -56,6 +57,7 @@ extern uint64_t crypto_cpu_caps_amd64; #define HAVE_SHA512_BLOCK_DATA_ORDER #define HAVE_SHA512_BLOCK_GENERIC diff --git a/patches/win32_amd64_bn_arch.h.patch b/patches/win32_amd64_bn_arch.h.patch index b7926e3cb6..baa82f8f00 100644 --- a/patches/win32_amd64_bn_arch.h.patch +++ b/patches/win32_amd64_bn_arch.h.patch @@ -1,8 +1,8 @@ We should consider a OPENSSL_NO_BN_ASM if we can't figure out how to fix BIGNUM on this OS ---- crypto/bn/arch/amd64/bn_arch.h.orig Wed Mar 27 22:17:03 2024 -+++ crypto/bn/arch/amd64/bn_arch.h Wed Mar 27 22:17:31 2024 +--- crypto/bn/arch/amd64/bn_arch.h.orig Sun Aug 17 13:14:19 2025 ++++ crypto/bn/arch/amd64/bn_arch.h Sun Aug 24 23:47:56 2025 @@ -20,8 +20,14 @@ #ifndef HEADER_BN_ARCH_H #define HEADER_BN_ARCH_H @@ -18,7 +18,7 @@ out how to fix BIGNUM on this OS #define HAVE_BN_ADD #define HAVE_BN_ADD_WORDS -@@ -104,6 +110,7 @@ bn_subw(BN_ULONG a, BN_ULONG b, BN_ULONG *out_borrow, +@@ -109,6 +115,7 @@ bn_subw(BN_ULONG a, BN_ULONG b, BN_ULONG *out_borrow, } #endif /* __GNUC__ */ From 4494cd0525db4decd7a3bab7491888a334dec8aa Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 25 Aug 2025 00:02:57 -0600 Subject: [PATCH 1088/1283] Revert "trim some whitespace for hpux checks" This reverts commit 48d4157f99c00a1180db5298385d396ef840adda. because it didn't trim whitespace and doesn't look right. Pointed out by @vszakats in https://github.com/libressl/portable/pull/1165#pullrequestreview-3148582342 --- m4/check-os-options.m4 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/m4/check-os-options.m4 b/m4/check-os-options.m4 index fd63d772a2..99f142e7c3 100644 --- a/m4/check-os-options.m4 +++ b/m4/check-os-options.m4 @@ -89,14 +89,14 @@ char buf[1]; getentropy(buf, 1); ;; *hpux*) HOST_OS=hpux; - if test "echo $host_os | cut -c 1-4" = "ia64" ; then - if test "echo $CC | cut -d ' ' -f 1" = "gcc" ; then + if test "`echo $host_os | cut -c 1-4`" = "ia64" ; then + if test "`echo $CC | cut -d ' ' -f 1`" = "gcc" ; then CFLAGS="$CFLAGS -mlp64" else CFLAGS="+DD64" fi fi - if ! test "echo $CC | cut -d ' ' -f 1" = "gcc" ; then + if ! test "`echo $CC | cut -d ' ' -f 1`" = "gcc" ; then CFLAGS="-g -O2 +Otype_safety=off $CFLAGS $USER_CFLAGS" fi CPPFLAGS="$CPPFLAGS -D_XOPEN_SOURCE=600 -D__STRICT_ALIGNMENT" From e4e25cd2815efbf586a4297ed777e8653367a2b4 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 26 Aug 2025 00:47:10 -0600 Subject: [PATCH 1089/1283] Make opensslconf.h MI again --- include/CMakeLists.txt | 32 +------------------- include/Makefile.am | 16 ---------- include/arch/loongarch64/opensslconf.h | 13 -------- include/arch/mips/opensslconf.h | 13 -------- include/openssl/Makefile.am.tpl | 41 +------------------------- update.sh | 3 +- 6 files changed, 3 insertions(+), 115 deletions(-) delete mode 100644 include/arch/loongarch64/opensslconf.h delete mode 100644 include/arch/mips/opensslconf.h diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt index 04160afe0a..4802d13ad9 100644 --- a/include/CMakeLists.txt +++ b/include/CMakeLists.txt @@ -19,10 +19,7 @@ if(ENABLE_LIBRESSL_INSTALL) PATTERN "CMakeLists.txt" EXCLUDE PATTERN "compat" EXCLUDE PATTERN "pqueue.h" EXCLUDE - PATTERN "Makefile*" EXCLUDE - PATTERN "arch" EXCLUDE) - install(FILES ${CMAKE_BINARY_DIR}/include/openssl/opensslconf.h - DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/openssl") + PATTERN "Makefile*" EXCLUDE) endif(ENABLE_LIBRESSL_INSTALL) file(COPY . @@ -32,30 +29,3 @@ file(COPY . PATTERN "pqueue.h" EXCLUDE PATTERN "Makefile*" EXCLUDE PATTERN "arch" EXCLUDE) - -if(HOST_AARCH64) - file(READ arch/aarch64/opensslconf.h OPENSSLCONF) -elseif(HOST_ARM) - file(READ arch/arm/opensslconf.h OPENSSLCONF) -elseif(HOST_I386) - file(READ arch/i386/opensslconf.h OPENSSLCONF) -elseif(HOST_LOONGARCH64) - file(READ arch/loongarch64/opensslconf.h OPENSSLCONF) -elseif(HOST_MIPS) - file(READ arch/mips/opensslconf.h OPENSSLCONF) -elseif(HOST_MIPS64) - file(READ arch/mips64/opensslconf.h OPENSSLCONF) -elseif(HOST_POWERPC) - file(READ arch/powerpc/opensslconf.h OPENSSLCONF) -elseif(HOST_POWERPC64) - file(READ arch/powerpc64/opensslconf.h OPENSSLCONF) -elseif(HOST_RISCV64) - file(READ arch/riscv64/opensslconf.h OPENSSLCONF) -elseif(HOST_SPARC64) - file(READ arch/sparc64/opensslconf.h OPENSSLCONF) -elseif(HOST_X86_64) - file(READ arch/amd64/opensslconf.h OPENSSLCONF) -else() - message(FATAL_ERROR "Architecture not supported") -endif() -file(WRITE ${CMAKE_BINARY_DIR}/include/openssl/opensslconf.h "${OPENSSLCONF}") diff --git a/include/Makefile.am b/include/Makefile.am index a3e1c19b6c..04c9ea2e08 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -61,20 +61,4 @@ noinst_HEADERS += compat/sys/time.h noinst_HEADERS += compat/sys/types.h noinst_HEADERS += compat/sys/uio.h -noinst_HEADERS += arch/aarch64/opensslconf.h -noinst_HEADERS += arch/alpha/opensslconf.h -noinst_HEADERS += arch/amd64/opensslconf.h -noinst_HEADERS += arch/arm/opensslconf.h -noinst_HEADERS += arch/hppa/opensslconf.h -noinst_HEADERS += arch/i386/opensslconf.h -noinst_HEADERS += arch/loongarch64/opensslconf.h -noinst_HEADERS += arch/m88k/opensslconf.h -noinst_HEADERS += arch/mips/opensslconf.h -noinst_HEADERS += arch/mips64/opensslconf.h -noinst_HEADERS += arch/powerpc/opensslconf.h -noinst_HEADERS += arch/powerpc64/opensslconf.h -noinst_HEADERS += arch/riscv64/opensslconf.h -noinst_HEADERS += arch/sh/opensslconf.h -noinst_HEADERS += arch/sparc64/opensslconf.h - include_HEADERS = tls.h diff --git a/include/arch/loongarch64/opensslconf.h b/include/arch/loongarch64/opensslconf.h deleted file mode 100644 index c31bcc01ad..0000000000 --- a/include/arch/loongarch64/opensslconf.h +++ /dev/null @@ -1,13 +0,0 @@ -#include - -#undef OPENSSL_EXPORT_VAR_AS_FUNCTION - -#ifndef OPENSSL_FILE -#ifdef OPENSSL_NO_FILENAMES -#define OPENSSL_FILE "" -#define OPENSSL_LINE 0 -#else -#define OPENSSL_FILE __FILE__ -#define OPENSSL_LINE __LINE__ -#endif -#endif diff --git a/include/arch/mips/opensslconf.h b/include/arch/mips/opensslconf.h deleted file mode 100644 index c31bcc01ad..0000000000 --- a/include/arch/mips/opensslconf.h +++ /dev/null @@ -1,13 +0,0 @@ -#include - -#undef OPENSSL_EXPORT_VAR_AS_FUNCTION - -#ifndef OPENSSL_FILE -#ifdef OPENSSL_NO_FILENAMES -#define OPENSSL_FILE "" -#define OPENSSL_LINE 0 -#else -#define OPENSSL_FILE __FILE__ -#define OPENSSL_LINE __LINE__ -#endif -#endif diff --git a/include/openssl/Makefile.am.tpl b/include/openssl/Makefile.am.tpl index 4bbbd60004..1bea34d050 100644 --- a/include/openssl/Makefile.am.tpl +++ b/include/openssl/Makefile.am.tpl @@ -3,43 +3,4 @@ include $(top_srcdir)/Makefile.am.common if !ENABLE_LIBTLS_ONLY opensslincludedir=$(includedir)/openssl -BUILT_SOURCES = opensslconf.h -CLEANFILES = opensslconf.h - -opensslconf.h: Makefile - -echo "generating opensslconf.h ..." -if HOST_AARCH64 - -cp $(top_srcdir)/include/arch/aarch64/opensslconf.h opensslconf.h -endif -if HOST_ARM - -cp $(top_srcdir)/include/arch/arm/opensslconf.h opensslconf.h -endif -if HOST_I386 - -cp $(top_srcdir)/include/arch/i386/opensslconf.h opensslconf.h -endif -if HOST_LOONGARCH64 - -cp $(top_srcdir)/include/arch/loongarch64/opensslconf.h opensslconf.h -endif -if HOST_MIPS - -cp $(top_srcdir)/include/arch/mips/opensslconf.h opensslconf.h -endif -if HOST_MIPS64 - -cp $(top_srcdir)/include/arch/mips64/opensslconf.h opensslconf.h -endif -if HOST_POWERPC - -cp $(top_srcdir)/include/arch/powerpc/opensslconf.h opensslconf.h -endif -if HOST_POWERPC64 - -cp $(top_srcdir)/include/arch/powerpc64/opensslconf.h opensslconf.h -endif -if HOST_RISCV64 - -cp $(top_srcdir)/include/arch/riscv64/opensslconf.h opensslconf.h -endif -if HOST_SPARC64 - -cp $(top_srcdir)/include/arch/sparc64/opensslconf.h opensslconf.h -endif -if HOST_X86_64 - -cp $(top_srcdir)/include/arch/amd64/opensslconf.h opensslconf.h -endif - -opensslinclude_HEADERS = opensslconf.h +opensslinclude_HEADERS = diff --git a/update.sh b/update.sh index 761953ac6b..f2b46b7542 100755 --- a/update.sh +++ b/update.sh @@ -98,6 +98,7 @@ if [ -x /opt/csw/bin/ggrep ]; then GREP='/opt/csw/bin/ggrep' fi +$CP $libcrypto_src/opensslconf.h include/openssl $CP $libcrypto_src/opensslfeatures.h include/openssl $CP $libssl_src/pqueue.h include @@ -186,8 +187,6 @@ done for i in $libcrypto_src/arch/*; do arch=`basename $i` - mkdir -p include/arch/$arch - $CP $libcrypto_src/arch/$arch/opensslconf.h include/arch/$arch/ mkdir -p crypto/arch/$arch $CP $libcrypto_src/arch/$arch/crypto_arch.h crypto/arch/$arch/ crypto_cpu_caps=$libcrypto_src/arch/$arch/crypto_cpu_caps.c From cf1a8cf5ba0aa8ff57362c1933318f6b8d9fbd12 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 26 Aug 2025 01:10:14 -0600 Subject: [PATCH 1090/1283] Do not remove opensslconf.h for android --- scripts/test | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/test b/scripts/test index a93fe90f77..a7ce1ea83d 100755 --- a/scripts/test +++ b/scripts/test @@ -191,7 +191,7 @@ elif [ "$ARCH" = "android" ]; then ( build_dir=build-$NAL_$ABI - rm -fr $build_dir include/openssl/opensslconf.h + rm -fr $build_dir mkdir $build_dir cd $build_dir echo "##### cmake -GNinja -DCMAKE_MAKE_PROGRAM=ninja -DANDROID_NDK=$ANDROID_NDK_HOME -DCMAKE_TOOLCHAIN_FILE=$TC_FILE -DANDROID_ABI=$ABI -DANDROID_NATIVE_API_LEVEL=$NAL .." From d7a9ca6d2ffdfd65543c32b6f11a8a106e839d81 Mon Sep 17 00:00:00 2001 From: imorgenstern Date: Thu, 28 Aug 2025 13:42:04 +0200 Subject: [PATCH 1091/1283] Fix inconsistencies in accept4.c MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix inconsistencies in accept4.c. If the underlying accept() fails the shim returns the listening socket s instead of −1. --- apps/nc/compat/accept4.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/nc/compat/accept4.c b/apps/nc/compat/accept4.c index 278198baad..dca42e935e 100644 --- a/apps/nc/compat/accept4.c +++ b/apps/nc/compat/accept4.c @@ -6,10 +6,10 @@ accept4(int s, struct sockaddr *addr, socklen_t *addrlen, int flags) { int rets = accept(s, addr, addrlen); if (rets == -1) - return s; + return rets; if (flags & SOCK_CLOEXEC) { - flags = fcntl(s, F_GETFD); + flags = fcntl(rets, F_GETFD); fcntl(rets, F_SETFD, flags | FD_CLOEXEC); } From 607ae1b8056635de55a2e5ee229fdfec8ba384d9 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 6 Sep 2025 06:05:58 +0200 Subject: [PATCH 1092/1283] adapt to mlkem deduplication --- crypto/CMakeLists.txt | 3 +-- crypto/Makefile.am | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index f67d2bde3f..aacd2a75d2 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -437,8 +437,7 @@ set( md4/md4.c md5/md5.c mlkem/mlkem.c - mlkem/mlkem1024.c - mlkem/mlkem768.c + mlkem/mlkem_internal.c mlkem/mlkem_key.c modes/cbc128.c modes/ccm128.c diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 610341a940..a116996655 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -739,8 +739,7 @@ libcrypto_la_SOURCES += md5/md5.c # mlkem libcrypto_la_SOURCES += mlkem/mlkem.c -libcrypto_la_SOURCES += mlkem/mlkem1024.c -libcrypto_la_SOURCES += mlkem/mlkem768.c +libcrypto_la_SOURCES += mlkem/mlkem_internal.c libcrypto_la_SOURCES += mlkem/mlkem_key.c noinst_HEADERS += mlkem/mlkem_internal.h From 6702db69c4d1dfd37cf7cd3fa5df8b56c63b06d0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 28 Sep 2025 02:10:29 -0600 Subject: [PATCH 1093/1283] Update ChangeLog --- ChangeLog | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/ChangeLog b/ChangeLog index 1739cfc5d5..dd73de86b1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -51,6 +51,12 @@ LibreSSL Portable Release Notes: Instead, capabilities are now detected using a constructor on library load, which improves the incomplete coverage by calls to OPENSSL_init_crypto() on various entry points. + - Rework and simplify AES handling in EVP. In particular, AES-NI + is now handled in the AES internal code and no longer requires + the use of EVP. + - Added a public API for ML-KEM. This is not yet documented in a + manpage and may not be in its final form. This will be used to + support X25519MLKEM768 in libssl. * Compatibility changes - Removed the -msie_hack option from the openssl(1) ca subcommand. - Removed parameters of the 239-bit prime curves from X9.62, H.5.2: @@ -59,17 +65,29 @@ LibreSSL Portable Release Notes: per recommendation of NIST SP 800-132. - Encrypted PKCS#8 key files now use a default password-based key derivation function that is acceptable in the present millenium. + - const corrected EVP_PKEY_get{0,1}_{DH,DSA,EC_KEY,RSA}(). + - X509_CRL_verify() now checks that the AlgorithmIdentifiers in the + signature and the tbsCertList are identical. - Of the old *err() only PEMerr(), RSAerr(), and SSLerr() remain. + - Removed BIO_s_log(), X509_PKEY_{new,free}(), PEM_X509_INFO_read() + and PEM_X509_INFO_write_bio(). + - Re-expose the ASN.1 Boolean template items. + - opensslconf.h is now machine-independent. * New features - Allow specifying ALPN in nc(1) via -Talpn="http/1.1,http:/1.0". * Bug fixes - Avoid pointer arithmetic on NULL for memory BIOs. + - Fix leaks and use-after-frees in PKCS7 attribute handling. * Documentation - Rewrote most of the EC documentation from scratch to be at least somewhat accurate and intelligible. + - Updated documentation for SMIME_{read,write}* to match reality. * Testing and proactive security - Added a testing framework that will help deduplicating lots of ad-hoc code in the regression tests. + - Converted the Wycheproof testing framework to use testvectors_v1. + This in combination with a few new tests significantly increases + regress coverage. 4.1.0 - Stable release From 10a20231f94b74283a78dbba73d1f0ddccff35f4 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 30 Sep 2025 04:48:10 -0600 Subject: [PATCH 1094/1283] Update ChangeLog --- ChangeLog | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ChangeLog b/ChangeLog index dd73de86b1..7ae3628ac6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -78,6 +78,11 @@ LibreSSL Portable Release Notes: * Bug fixes - Avoid pointer arithmetic on NULL for memory BIOs. - Fix leaks and use-after-frees in PKCS7 attribute handling. + - Ensure p and q in RSA private key have a minimum distance of + 2^(bits/2 - 100) as specified in NIST SP 800-56B Revision 2. + * Security fixes + - Fix out-of-bounds read and write, memory leaks and incorrect + error check for CMS enveloped data. * Documentation - Rewrote most of the EC documentation from scratch to be at least somewhat accurate and intelligible. From 3821bc6d3822e38ca4fc05eeaac5416edd11ffda Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 6 Oct 2025 06:45:02 +0200 Subject: [PATCH 1095/1283] Tweak ChangeLog --- ChangeLog | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index 7ae3628ac6..ced6607d4a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -37,15 +37,12 @@ LibreSSL Portable Release Notes: instances of undefined behavior. - Removed assembly implementations of AES using bit slicing (BS-AES) and vector permutation (VP-AES). - - Integrated AES-NI into the AES API. - Removed OPENSSL_SMALL_FOOTPRINT and OPENSSL_FIPSAPI. - - Lots of cleanup and removal of code with undefined behavior in - the block cipher modes of operation implementations. - Implemented constant time EC field element operations to allow - implementing elliptic curve operations without bignum arithmetic. + elliptic curve operations without bignum arithmetic. - Implemented an EC method using homogeneous projective coordinates. - This allows exception-free elliptic curve arithmetic in constant - time. + This will allow exception-free elliptic curve arithmetic in + constant time in future releases. - Started cleaning up the openssl speed implementation. - The last SIGILL-based CPU capability detection was removed. Instead, capabilities are now detected using a constructor on From 2f78b04fd75ae457f8a1297909dd3b6f612bd21f Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 7 Oct 2025 03:48:53 -0500 Subject: [PATCH 1096/1283] add explicit parens for combined logic --- tests/compat/pipe2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/compat/pipe2.c b/tests/compat/pipe2.c index c27a858de9..d7b4062064 100644 --- a/tests/compat/pipe2.c +++ b/tests/compat/pipe2.c @@ -42,7 +42,7 @@ static int setfl(int fd, int flag) static void create_issue_1069_sentinels(int socket_vector[2]) { int fd = open("CONIN$", O_RDONLY); - if (fd == -1 || fd > socket_vector[0] && fd > socket_vector[1]) { + if (fd == -1 || (fd > socket_vector[0] && fd > socket_vector[1])) { return; } create_issue_1069_sentinels(socket_vector); From 659e87fe1cf3348a4e9f1bacfe205316fefd8a51 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 7 Oct 2025 03:49:29 -0500 Subject: [PATCH 1097/1283] move ftruncate to common libcompat for tests --- CMakeLists.txt | 5 +++++ crypto/CMakeLists.txt | 4 ++++ crypto/Makefile.am | 4 ++++ {tls => crypto}/compat/ftruncate.c | 0 m4/check-libc.m4 | 3 ++- tls/CMakeLists.txt | 1 - tls/Makefile.am | 1 - 7 files changed, 15 insertions(+), 3 deletions(-) rename {tls => crypto}/compat/ftruncate.c (100%) diff --git a/CMakeLists.txt b/CMakeLists.txt index 17e5a0c0a3..d73e185904 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -226,6 +226,11 @@ if(HAVE_ASPRINTF) add_definitions(-DHAVE_ASPRINTF) endif() +check_symbol_exists(ftruncate "unistd.h" HAVE_FTRUNCATE) +if(HAVE_FTRUNCATE) + add_definitions(-DHAVE_FTRUNCATE) +endif() + check_symbol_exists(getdelim "stdio.h" HAVE_GETDELIM) if(HAVE_GETDELIM) add_definitions(-DHAVE_GETDELIM) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index aacd2a75d2..137cf7005a 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -624,6 +624,10 @@ if(NOT HAVE_FREEZERO) set(COMPAT_SRC ${COMPAT_SRC} compat/freezero.c) endif() +if(NOT HAVE_FTRUNCATE) + set(COMPAT_SRC ${COMPAT_SRC} compat/ftruncate.c) +endif() + if(NOT HAVE_GETDELIM) set(COMPAT_SRC ${COMPAT_SRC} compat/getdelim.c) endif() diff --git a/crypto/Makefile.am b/crypto/Makefile.am index a116996655..7fea236b7f 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -148,6 +148,10 @@ if !HAVE_FREEZERO libcompat_la_SOURCES += compat/freezero.c endif +if !HAVE_FTRUNCATE +libcompat_la_SOURCES += compat/ftruncate.c +endif + if !HAVE_GETDELIM libcompat_la_SOURCES += compat/getdelim.c endif diff --git a/tls/compat/ftruncate.c b/crypto/compat/ftruncate.c similarity index 100% rename from tls/compat/ftruncate.c rename to crypto/compat/ftruncate.c diff --git a/m4/check-libc.m4 b/m4/check-libc.m4 index dadf0da278..eec3cb3887 100644 --- a/m4/check-libc.m4 +++ b/m4/check-libc.m4 @@ -22,7 +22,7 @@ AC_CHECK_HEADERS([netinet/ip.h], [], [], ]) AC_HEADER_RESOLV # Check for general libc functions -AC_CHECK_FUNCS([asprintf freezero getdelim getline memmem]) +AC_CHECK_FUNCS([asprintf freezero ftruncate getdelim getline memmem]) AC_CHECK_FUNCS([readpassphrase reallocarray recallocarray]) AC_CHECK_FUNCS([strcasecmp strlcat strlcpy strndup strnlen strsep strtonum]) AC_CHECK_FUNCS([timegm _mkgmtime timespecsub]) @@ -39,6 +39,7 @@ AC_CACHE_CHECK([for getpagesize], ac_cv_func_getpagesize, [ ]) AM_CONDITIONAL([HAVE_ASPRINTF], [test "x$ac_cv_func_asprintf" = xyes]) AM_CONDITIONAL([HAVE_FREEZERO], [test "x$ac_cv_func_freezero" = xyes]) +AM_CONDITIONAL([HAVE_FTRUNCATE], [test "x$ac_cv_func_ftruncate" = xyes]) AM_CONDITIONAL([HAVE_GETDELIM], [test "x$ac_cv_func_getdelim" = xyes]) AM_CONDITIONAL([HAVE_GETLINE], [test "x$ac_cv_func_getline" = xyes]) AM_CONDITIONAL([HAVE_GETPAGESIZE], [test "x$ac_cv_func_getpagesize" = xyes]) diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index 6475245189..a1b244ac1f 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -37,7 +37,6 @@ if(WIN32) ${TLS_SRC} ) - set(TLS_COMPAT_SRC ${TLS_COMPAT_SRC} compat/ftruncate.c) set(TLS_COMPAT_SRC ${TLS_COMPAT_SRC} compat/pread.c) set(TLS_COMPAT_SRC ${TLS_COMPAT_SRC} compat/pwrite.c) endif() diff --git a/tls/Makefile.am b/tls/Makefile.am index 2a7b089c6c..03824b4740 100644 --- a/tls/Makefile.am +++ b/tls/Makefile.am @@ -70,7 +70,6 @@ libtls_la_SOURCES += tls_verify.c noinst_HEADERS = tls_internal.h if HOST_WIN -libtls_la_SOURCES += compat/ftruncate.c libtls_la_SOURCES += compat/pread.c libtls_la_SOURCES += compat/pwrite.c endif From 7ed28d2f501a4920b792bee9da3d61814f024a4c Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 7 Oct 2025 05:38:30 -0500 Subject: [PATCH 1098/1283] add mkstemp for msvc builds --- include/compat/unistd.h | 2 ++ tests/CMakeLists.txt | 21 +++++++---------- tests/compat/mkstemp.c | 52 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 63 insertions(+), 12 deletions(-) create mode 100644 tests/compat/mkstemp.c diff --git a/include/compat/unistd.h b/include/compat/unistd.h index 63c07fc3dc..544cb27852 100644 --- a/include/compat/unistd.h +++ b/include/compat/unistd.h @@ -45,6 +45,8 @@ static inline unsigned int sleep(unsigned int seconds) Sleep(seconds * 1000); return seconds; } + +int mkstemp(char *template); #endif int ftruncate(int fd, off_t length); diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 55529cdc44..7f9b93c8ba 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -82,6 +82,9 @@ endfunction() # XXX - should probably be in their own static lib set(TEST_HELPER_SRC test.c test_util.c) +if(WIN32) + set(TEST_HELPER_SRC ${TEST_HELPER_SRC} compat/mkstemp.c) +endif() # aeadtest add_executable(aeadtest aeadtest.c) @@ -555,12 +558,9 @@ prepare_emscripten_test_target(lhash_test) add_platform_test(lhash_test lhash_test) # md_test -# XXX - ftruncate and mkstemp missing from Windows -if(NOT WIN32) - add_executable(md_test md_test.c ${TEST_HELPER_SRC}) - target_link_libraries(md_test ${OPENSSL_TEST_LIBS}) - add_platform_test(md_test md_test) -endif() +add_executable(md_test md_test.c ${TEST_HELPER_SRC}) +target_link_libraries(md_test ${OPENSSL_TEST_LIBS}) +add_platform_test(md_test md_test) # mlkem_tests add_executable(mlkem_tests mlkem_tests.c parse_test_file.c) @@ -742,12 +742,9 @@ endif() set_tests_properties(servertest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # sha_test -# XXX - ftruncate and mkstemp missing from Windows -if(NOT WIN32) - add_executable(sha_test sha_test.c ${TEST_HELPER_SRC}) - target_link_libraries(sha_test ${OPENSSL_TEST_LIBS}) - add_platform_test(sha_test sha_test) -endif() +add_executable(sha_test sha_test.c ${TEST_HELPER_SRC}) +target_link_libraries(sha_test ${OPENSSL_TEST_LIBS}) +add_platform_test(sha_test sha_test) # shutdowntest set(SHUTDOWNTEST_SRC shutdowntest.c) diff --git a/tests/compat/mkstemp.c b/tests/compat/mkstemp.c new file mode 100644 index 0000000000..fe3d15a980 --- /dev/null +++ b/tests/compat/mkstemp.c @@ -0,0 +1,52 @@ +/* +musl as a whole is licensed under the following standard MIT license: + +---------------------------------------------------------------------- +Copyright © 2005-2020 Rich Felker, et al. + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, +TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +---------------------------------------------------------------------- +*/ + +#include +#include +#include +#include +#include +#include +#include + +#include + +int mkstemp(char *template) +{ + int fd; +retry: + if (!_mktemp(template)) return -1; + fd = open(template, O_RDWR | O_CREAT | O_EXCL, 0600); + if (fd >= 0) return fd; + if (errno == EEXIST) { + /* this is safe because mktemp verified + * that we have a valid template string */ + strcpy(template+strlen(template)-6, "XXXXXX"); + goto retry; + } + return -1; +} From beff893335230dff55f6dc10c8c0054fed7752a9 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 7 Oct 2025 09:59:01 -0500 Subject: [PATCH 1099/1283] use relative path for test temp files --- patches/test.c.patch | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 patches/test.c.patch diff --git a/patches/test.c.patch b/patches/test.c.patch new file mode 100644 index 0000000000..7e80e1f1d1 --- /dev/null +++ b/patches/test.c.patch @@ -0,0 +1,11 @@ +--- tests/test.c.orig 2025-10-07 09:57:42.853015505 -0500 ++++ tests/test.c 2025-10-07 09:58:08.872499852 -0500 +@@ -67,7 +67,7 @@ + return t; + + /* Create a temporary file for logging in non-verbose mode */ +- if ((tmp_file = strdup("/tmp/libressl-test.XXXXXXXX")) == NULL) ++ if ((tmp_file = strdup("libressl-test.XXXXXXXX")) == NULL) + err(1, "strdup"); + if ((out_fd = mkstemp(tmp_file)) == -1) + err(1, "mkstemp"); From 6c33fe50f42aedcb5c78d1c67741d1775ce9da83 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Tue, 14 Oct 2025 09:24:01 +0900 Subject: [PATCH 1100/1283] Revert "CI: Apply EVP const_ptr patch for LibreSSL < 4.2.0" This reverts commit 5bcf54058d62ca1f197616ee344d05fbb3e34e21. --- .github/workflows/rust-openssl.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index d3b2beee77..4ff41c00fb 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -34,10 +34,6 @@ jobs: - name: "Run rust-openssl tests" run: | cd rust-openssl - - # apply patch - see #1187 - curl -L https://raw.githubusercontent.com/openbsd/ports/refs/heads/master/security/rust-openssl-tests/patches/patch-openssl-sys_src_handwritten_evp_rs | patch -p0 - # instead of erroring use the last supported version ed -s openssl-sys/build/main.rs <<-EOF /_ => version_error/-1 From be49b81c297811b0d6dc205962ebd36028fb9bdc Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 13 Oct 2025 22:33:29 -0500 Subject: [PATCH 1101/1283] automatically disable assembly on arm32 Darwin --- CMakeLists.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index d73e185904..bede146096 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -414,6 +414,9 @@ if(CMAKE_SYSTEM_PROCESSOR MATCHES "(aarch64|arm64|ARM64)") set(HOST_AARCH64 true) elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm") set(HOST_ARM true) + if(APPLE) + set(ENABLE_ASM false) + endif() elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND CMAKE_SYSTEM_PROCESSOR MATCHES "i386") set(HOST_X86_64 true) elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|x64|amd64|AMD64)") From 93a15738fef400c4f03b02f1384ade88128e2bf0 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 14 Oct 2025 04:41:39 -0500 Subject: [PATCH 1102/1283] sync 4.2.0 changes --- ChangeLog | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index ced6607d4a..ea34610f0d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,9 +28,16 @@ history is also available from Git. LibreSSL Portable Release Notes: -4.2.0 - In development +4.2.0 - Stable release * Portable changes + - Added explicit OpenBSD/ISC license to build system / scripts. + - Fixed compilation on more CPU targets by removing architecture-specific + definitions from header files. + - Fixed builds in deep paths by using relative paths for linking. + - Fixed Windows builds with Clang and CMake. + - Fixed Windows error handling accepting connections with nc. + - Fixed 32-bit ARM builds on Darwin. * Internal improvements - Cleaned up code implementing block cipher modes of operation. Includes untangling a horrible #ifdef mess and removing a few From 75828c797911580e3099aa54873e8b07669cbf69 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 23 Oct 2025 05:32:00 -0500 Subject: [PATCH 1103/1283] add mstemp.c to distribution --- tests/Makefile.am | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/Makefile.am b/tests/Makefile.am index 066e02090b..7ba6c076c5 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -106,6 +106,8 @@ DISTCLEANFILES = pidwraptest.txt TEST_HELPER_SRC = test.c test_util.c noinst_HEADERS = test.h EXTRA_DIST += $(TEST_HELPER_SRC) +# Needed by test helper on MSVC +EXTRA_DIST += compat/mkstemp.c # aeadtest TESTS += aeadtest.sh From dc6cef0335a7b8a734226d77f74ac1560c714646 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 24 Oct 2025 00:03:02 +0200 Subject: [PATCH 1104/1283] Update ChangeLog --- ChangeLog | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/ChangeLog b/ChangeLog index ea34610f0d..584b85e149 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,6 +28,17 @@ history is also available from Git. LibreSSL Portable Release Notes: +4.3.0 - In development + + * Internal improvements + - Remove the unused sequence number from X509_REVOKED. + - Replace a call to atoi() with strtonum() in nc(1) and replace a + misleading use of ntohs() with htons(). + * Bug fixes + - Ensure the group selected by a TLSv1.3 server for a + HelloRetryRequest is not one for which the client has + already sent a key share. + 4.2.0 - Stable release * Portable changes From 1e86f9cf57855d06ecd2383c3ffe9325f57852ea Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 24 Oct 2025 13:49:09 +0200 Subject: [PATCH 1105/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 584b85e149..9ef2bd76bf 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,6 +34,9 @@ LibreSSL Portable Release Notes: - Remove the unused sequence number from X509_REVOKED. - Replace a call to atoi() with strtonum() in nc(1) and replace a misleading use of ntohs() with htons(). + * Compatibility changes + - Expose X509_VERIFY_PARAM_set_hostflags() as a public symbol. + - Provide SSL_SESSION_dup(). * Bug fixes - Ensure the group selected by a TLSv1.3 server for a HelloRetryRequest is not one for which the client has From 4d719d6ce3b0f664191fbe6ab5fd40142d3bdec4 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 24 Oct 2025 07:08:15 -0600 Subject: [PATCH 1106/1283] regen patches --- patches/amd64_crypto_arch.h.patch | 8 ++++---- patches/mlkem_internal.h.patch | 6 +++--- patches/netcat.c.patch | 12 ++++++------ patches/win32_amd64_bn_arch.h.patch | 6 +++--- 4 files changed, 16 insertions(+), 16 deletions(-) diff --git a/patches/amd64_crypto_arch.h.patch b/patches/amd64_crypto_arch.h.patch index bf44458f97..e31f988b1b 100644 --- a/patches/amd64_crypto_arch.h.patch +++ b/patches/amd64_crypto_arch.h.patch @@ -1,6 +1,6 @@ ---- crypto/arch/amd64/crypto_arch.h.orig Sun Aug 17 13:14:19 2025 -+++ crypto/arch/amd64/crypto_arch.h Sun Aug 24 23:47:56 2025 -@@ -48,6 +48,7 @@ extern uint64_t crypto_cpu_caps_amd64; +--- crypto/arch/amd64/crypto_arch.h.orig Fri Oct 24 07:06:10 2025 ++++ crypto/arch/amd64/crypto_arch.h Fri Oct 24 07:06:21 2025 +@@ -53,6 +53,7 @@ extern uint64_t crypto_cpu_caps_amd64; #define HAVE_RC4_INTERNAL #define HAVE_RC4_SET_KEY_INTERNAL @@ -8,7 +8,7 @@ #define HAVE_SHA1_BLOCK_DATA_ORDER #define HAVE_SHA1_BLOCK_GENERIC -@@ -56,6 +57,7 @@ extern uint64_t crypto_cpu_caps_amd64; +@@ -61,6 +62,7 @@ extern uint64_t crypto_cpu_caps_amd64; #define HAVE_SHA512_BLOCK_DATA_ORDER #define HAVE_SHA512_BLOCK_GENERIC diff --git a/patches/mlkem_internal.h.patch b/patches/mlkem_internal.h.patch index b7cbdcf0a4..ee25521020 100644 --- a/patches/mlkem_internal.h.patch +++ b/patches/mlkem_internal.h.patch @@ -1,6 +1,6 @@ ---- crypto/mlkem/mlkem_internal.h.orig Sun Aug 17 13:20:18 2025 -+++ crypto/mlkem/mlkem_internal.h Sun Aug 17 13:20:37 2025 -@@ -19,7 +19,7 @@ +--- crypto/mlkem/mlkem_internal.h.orig Fri Oct 24 07:06:10 2025 ++++ crypto/mlkem/mlkem_internal.h Fri Oct 24 07:06:22 2025 +@@ -20,7 +20,7 @@ #define OPENSSL_HEADER_CRYPTO_MLKEM_INTERNAL_H #include "bytestring.h" diff --git a/patches/netcat.c.patch b/patches/netcat.c.patch index 345a170b56..c6b9f68d39 100644 --- a/patches/netcat.c.patch +++ b/patches/netcat.c.patch @@ -1,5 +1,5 @@ ---- apps/nc/netcat.c.orig Fri Jun 27 12:39:21 2025 -+++ apps/nc/netcat.c Fri Jun 27 12:39:29 2025 +--- apps/nc/netcat.c.orig Fri Oct 24 07:06:13 2025 ++++ apps/nc/netcat.c Fri Oct 24 07:06:22 2025 @@ -93,9 +93,13 @@ int zflag; /* Port Scan Flag */ int Dflag; /* sodebug */ int Iflag; /* TCP receive buffer size */ @@ -100,7 +100,7 @@ set_common_sockopts(s, res->ai_family); -@@ -1564,11 +1584,13 @@ set_common_sockopts(int s, int af) +@@ -1569,11 +1589,13 @@ set_common_sockopts(int s, int af) { int x = 1; @@ -114,7 +114,7 @@ if (Dflag) { if (setsockopt(s, SOL_SOCKET, SO_DEBUG, &x, sizeof(x)) == -1) -@@ -1579,9 +1601,16 @@ set_common_sockopts(int s, int af) +@@ -1584,9 +1606,16 @@ set_common_sockopts(int s, int af) IP_TOS, &Tflag, sizeof(Tflag)) == -1) err(1, "set IP ToS"); @@ -131,7 +131,7 @@ } if (Iflag) { if (setsockopt(s, SOL_SOCKET, SO_RCVBUF, -@@ -1605,13 +1634,17 @@ set_common_sockopts(int s, int af) +@@ -1610,13 +1639,17 @@ set_common_sockopts(int s, int af) } if (minttl != -1) { @@ -150,7 +150,7 @@ } } -@@ -1841,15 +1874,19 @@ help(void) +@@ -1846,15 +1879,19 @@ help(void) \t-P proxyuser\tUsername for proxy authentication\n\ \t-p port\t Specify local port for remote connects\n\ \t-R CAfile CA bundle\n\ diff --git a/patches/win32_amd64_bn_arch.h.patch b/patches/win32_amd64_bn_arch.h.patch index baa82f8f00..a6a5ee9c53 100644 --- a/patches/win32_amd64_bn_arch.h.patch +++ b/patches/win32_amd64_bn_arch.h.patch @@ -1,8 +1,8 @@ We should consider a OPENSSL_NO_BN_ASM if we can't figure out how to fix BIGNUM on this OS ---- crypto/bn/arch/amd64/bn_arch.h.orig Sun Aug 17 13:14:19 2025 -+++ crypto/bn/arch/amd64/bn_arch.h Sun Aug 24 23:47:56 2025 +--- crypto/bn/arch/amd64/bn_arch.h.orig Fri Oct 24 07:06:10 2025 ++++ crypto/bn/arch/amd64/bn_arch.h Fri Oct 24 07:06:22 2025 @@ -20,8 +20,14 @@ #ifndef HEADER_BN_ARCH_H #define HEADER_BN_ARCH_H @@ -18,7 +18,7 @@ out how to fix BIGNUM on this OS #define HAVE_BN_ADD #define HAVE_BN_ADD_WORDS -@@ -109,6 +115,7 @@ bn_subw(BN_ULONG a, BN_ULONG b, BN_ULONG *out_borrow, +@@ -110,6 +116,7 @@ bn_subw(BN_ULONG a, BN_ULONG b, BN_ULONG *out_borrow, } #endif /* __GNUC__ */ From cb3679055ae921339a39c235b5abefa246c47630 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 24 Oct 2025 07:14:56 -0600 Subject: [PATCH 1107/1283] Update man links --- man/links | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/man/links b/man/links index 37c7b42d88..8af55887e7 100644 --- a/man/links +++ b/man/links @@ -1794,6 +1794,7 @@ SSL_SESSION_get_time.3,SSL_get_timeout.3 SSL_SESSION_get_time.3,SSL_set_time.3 SSL_SESSION_get_time.3,SSL_set_timeout.3 SSL_SESSION_has_ticket.3,SSL_SESSION_get_ticket_lifetime_hint.3 +SSL_SESSION_new.3,SSL_SESSION_dup.3 SSL_SESSION_print.3,SSL_SESSION_print_fp.3 SSL_SESSION_set1_id_context.3,SSL_SESSION_get0_id_context.3 SSL_alert_type_string.3,SSL_alert_desc_string.3 @@ -2172,6 +2173,7 @@ X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get0_name.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get0_peername.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get_depth.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get_flags.3 +X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get_hostflags.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_get_time.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set1_email.3 X509_VERIFY_PARAM_set_flags.3,X509_VERIFY_PARAM_set1_host.3 @@ -2326,19 +2328,6 @@ X509v3_get_ext_by_NID.3,X509v3_get_ext_by_critical.3 X509v3_get_ext_by_NID.3,X509v3_get_ext_count.3 a2i_ipadd.3,a2i_IPADDRESS.3 a2i_ipadd.3,a2i_IPADDRESS_NC.3 -bn_dump.3,bn_add_words.3 -bn_dump.3,bn_div_words.3 -bn_dump.3,bn_expand.3 -bn_dump.3,bn_mul_add_words.3 -bn_dump.3,bn_mul_comba4.3 -bn_dump.3,bn_mul_comba8.3 -bn_dump.3,bn_mul_normal.3 -bn_dump.3,bn_mul_words.3 -bn_dump.3,bn_sqr_comba4.3 -bn_dump.3,bn_sqr_comba8.3 -bn_dump.3,bn_sqr_words.3 -bn_dump.3,bn_sub_words.3 -bn_dump.3,bn_wexpand.3 d2i_ASN1_NULL.3,i2d_ASN1_NULL.3 d2i_ASN1_OBJECT.3,OBJ_get0_data.3 d2i_ASN1_OBJECT.3,OBJ_length.3 From d6b6fe95a791a9a79617666416979b7f38a06c2d Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 28 Oct 2025 07:06:00 -0500 Subject: [PATCH 1108/1283] include crypto/arch/aarch64/crypto_cpu_caps_windows.c --- crypto/Makefile.am | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 7fea236b7f..1acf0f4650 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -233,6 +233,9 @@ else if HOST_LINUX libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_linux.c else +if HOST_WIN +libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps_windows.c +else if HOST_OPENBSD libcrypto_la_SOURCES += arch/aarch64/crypto_cpu_caps.c else @@ -241,6 +244,7 @@ endif endif endif endif +endif if HOST_X86_64 libcrypto_la_SOURCES += arch/amd64/crypto_cpu_caps.c From fad962e027842e224d32b31533a61f65cbc13727 Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Wed, 29 Oct 2025 22:06:31 +0100 Subject: [PATCH 1109/1283] cmake: disable ARM64 ASM on Windows ARM64 ASM on Windows generates a lot of `-Wasm-operand-widths` compiler warnings. It also seems to break bignum calculations, resulting in: ``` curl: (35) TLS connect error: error:04FFF077:rsa routines:CRYPTO_internal:wrong signature length ``` and other issues. This option did not cause an issue with MSVC ARM64. The reason for this is that the only ASM code for ARM64 is the bignum implementation (crypto/bn/arch/aarch64) and that ASM code is guarded for `__GNUC__`, meaning gcc and llvm/clang, and never MSVC or clang-cl. Follow-up to 1df6b52b250f04cd322bf7a79e2105f9ed890802 #1177 Fixes #1210 --- CMakeLists.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index bede146096..503ace3cbe 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -412,6 +412,9 @@ endif() if(CMAKE_SYSTEM_PROCESSOR MATCHES "(aarch64|arm64|ARM64)") set(HOST_AARCH64 true) + if(WIN32) + set(ENABLE_ASM false) + endif() elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm") set(HOST_ARM true) if(APPLE) From 934688c728300341f0f929587bc6393a6eddfcf5 Mon Sep 17 00:00:00 2001 From: Doron Behar Date: Wed, 15 Oct 2025 13:43:49 +0300 Subject: [PATCH 1110/1283] cmake: use CMAKE_INSTALL_*DIR variables as are, if absolute These variables can be set to absolute paths, in that case ${prefix} shouldn't be prepended. CMAKE_INSTALL_FULL_*DIR variables could have also been used, but that would hard-code the relativity to the prefix pkg-config variable. See also: https://cmake.org/cmake/help/latest/module/GNUInstallDirs.html --- CMakeLists.txt | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index bede146096..7ab04ab081 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -569,8 +569,16 @@ if(ENABLE_LIBRESSL_INSTALL) # Create pkgconfig files. set(prefix ${CMAKE_INSTALL_PREFIX}) set(exec_prefix \${prefix}) - set(libdir \${exec_prefix}/${CMAKE_INSTALL_LIBDIR}) - set(includedir \${prefix}/${CMAKE_INSTALL_INCLUDEDIR}) + if(IS_ABSOLUTE ${CMAKE_INSTALL_LIBDIR}) + set(libdir ${CMAKE_INSTALL_LIBDIR}) + else() + set(libdir \${exec_prefix}/${CMAKE_INSTALL_LIBDIR}) + endif() + if(IS_ABSOLUTE ${CMAKE_INSTALL_INCLUDEDIR}) + set(includedir ${CMAKE_INSTALL_INCLUDEDIR}) + else() + set(includedir \${prefix}/${CMAKE_INSTALL_INCLUDEDIR}) + endif() if(PLATFORM_LIBS) string(REGEX REPLACE ";" " -l" PLATFORM_LDADD ";${PLATFORM_LIBS}") endif() From ec0e29a34bdf93654cdc7996131f2e49c752dc98 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 7 Nov 2025 08:41:04 +0100 Subject: [PATCH 1111/1283] Remove macos-13 CI https://github.blog/changelog/2025-09-19-github-actions-macos-13-runner-image-is-closing-down/ --- .github/workflows/macos.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index ac29bc08d0..0c344e551b 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -21,7 +21,7 @@ jobs: strategy: fail-fast: false matrix: - os: ["macos-15", "macos-14", "macos-13"] + os: ["macos-15", "macos-14"] arch: ["arm64", "x86_64"] steps: - name: "Install required packages" From 8555e49c7c03de8a9b5422c467f42ef43a744469 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Thu, 18 Dec 2025 23:32:58 +1100 Subject: [PATCH 1112/1283] ci: update and pin github actions --- .github/workflows/android.yml | 2 +- .github/workflows/cifuzz.yml | 2 +- .github/workflows/cmake-config.yml | 4 ++-- .github/workflows/coverity.yml | 2 +- .github/workflows/emscripten.yml | 8 ++++---- .github/workflows/fedora-rawhide.yml | 2 +- .github/workflows/freebsd.yml | 8 ++++---- .github/workflows/linux.yml | 4 ++-- .github/workflows/macos.yml | 2 +- .github/workflows/release.yml | 10 +++++----- .github/workflows/rust-openssl.yml | 2 +- .github/workflows/solaris.yml | 4 ++-- .github/workflows/windows.yml | 6 +++--- 13 files changed, 28 insertions(+), 28 deletions(-) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index 7bc59c53ab..976f2d31cc 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -25,7 +25,7 @@ jobs: max-nal: 30 steps: - name: "Checkout repository" - uses: actions/checkout@v4 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Run CI script" run: ./scripts/test diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index f994f99d10..eaa0681afd 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -26,7 +26,7 @@ jobs: dry-run: false language: c++ - name: Upload Crash - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 if: failure() && steps.build.outcome == 'success' with: name: artifacts diff --git a/.github/workflows/cmake-config.yml b/.github/workflows/cmake-config.yml index 0988102b9f..0de7b4f310 100644 --- a/.github/workflows/cmake-config.yml +++ b/.github/workflows/cmake-config.yml @@ -24,11 +24,11 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@v4 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Setup Windows dependencies" if: runner.os == 'Windows' - uses: msys2/setup-msys2@v2 + uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0 with: update: true install: >- diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index ae43398357..3cc0560223 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -19,7 +19,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@v4 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Install dependencies" run: | diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml index 013480fa4e..2de51e090a 100644 --- a/.github/workflows/emscripten.yml +++ b/.github/workflows/emscripten.yml @@ -20,10 +20,10 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@v4 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Setup emsdk" - uses: mymindstorm/setup-emsdk@v14 + uses: mymindstorm/setup-emsdk@6ab9eb1bda2574c4ddb79809fc9247783eaf9021 # v14 with: version: "3.1.60" @@ -48,10 +48,10 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@v4 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Setup emsdk" - uses: mymindstorm/setup-emsdk@v14 + uses: mymindstorm/setup-emsdk@6ab9eb1bda2574c4ddb79809fc9247783eaf9021 # v14 with: version: "3.1.60" diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index dff4b6a54e..fbcf0556c2 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -23,7 +23,7 @@ jobs: container: image: fedora:rawhide steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: Install dependencies run: | dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index 850dbe2cc6..fe6c258f47 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -22,7 +22,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@v4 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Setup" run: | @@ -31,7 +31,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@v1 + uses: vmactions/freebsd-vm@670398e4236735b8b65805c3da44b7a511fb8b27 # v1.3.0 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false @@ -49,7 +49,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@v4 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Setup" run: | @@ -58,7 +58,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@v1 + uses: vmactions/freebsd-vm@670398e4236735b8b65805c3da44b7a511fb8b27 # v1.3.0 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index de9d8d3e58..d901cf9767 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -44,7 +44,7 @@ jobs: steps: - name: "Checkout repository" - uses: actions/checkout@v4 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Run tests" run: ./scripts/test || (status=$?; cat tests/test-suite.log; exit $status) @@ -66,7 +66,7 @@ jobs: os: ["ubuntu-24.04", "ubuntu-24.04-arm"] steps: - name: "Checkout repository" - uses: actions/checkout@v4 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Run tests" run: ./scripts/test diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index 0c344e551b..dad91e3674 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -28,7 +28,7 @@ jobs: run: brew install automake libtool - name: "Checkout repository" - uses: actions/checkout@v4 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Run tests" run: ./scripts/test diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c13592044f..a20bf7dad6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,7 +20,7 @@ jobs: upload_url: "${{ steps.create_release.outputs.upload_url }}" steps: - name: "Checkout repository" - uses: actions/checkout@v4 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Generate version changelog" run: .github/scripts/changelog.sh "$VERSION" > release-changelog.txt @@ -29,7 +29,7 @@ jobs: - name: "Create GitHub release" id: create_release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 with: body_path: "${{ github.workspace }}/release-changelog.txt" @@ -43,10 +43,10 @@ jobs: arch: [ "Win32", "x64", "ARM64" ] steps: - name: "Checkout repository" - uses: actions/checkout@v4 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Setup MSYS2" - uses: msys2/setup-msys2@v2 + uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0 with: update: true install: >- @@ -75,7 +75,7 @@ jobs: run: Compress-Archive -Path local\* "libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip" - name: "Upload release artifact" - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 with: files: | libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index 4ff41c00fb..ed77dbba60 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -19,7 +19,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@v4 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Build LibreSSL" run: | diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index 902e4887b6..a4355d0e65 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -19,7 +19,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@v4 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Setup" run: | @@ -28,7 +28,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/solaris-vm@v1 + uses: vmactions/solaris-vm@47bea106d03acaf91084e52548ee460556011602 # v1.1.8 with: prepare: | pkg install gcc make diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 7494a21ca2..3880a7bcbd 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -32,10 +32,10 @@ jobs: generator: "Visual Studio 17 2022" steps: - name: "Checkout repository" - uses: actions/checkout@v4 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Setup MSYS2" - uses: msys2/setup-msys2@v2 + uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0 with: update: true install: >- @@ -64,7 +64,7 @@ jobs: - name: "Upload build artifacts" if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: "${{ matrix.os }}-${{ matrix.arch }}${{ matrix.shared == 'ON' && '-shared' || '' }}-build-results" path: "build" From b31ec29518de245a15499e8249091b0d2d8425e3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 18 Dec 2025 07:45:54 -0700 Subject: [PATCH 1113/1283] refresh patches --- patches/speed.c.patch | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/patches/speed.c.patch b/patches/speed.c.patch index 32e42b42d3..0f29358185 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -1,8 +1,8 @@ ---- apps/openssl/speed.c.orig Sat May 31 03:18:05 2025 -+++ apps/openssl/speed.c Sat May 31 03:18:17 2025 +--- apps/openssl/speed.c.orig Thu Dec 18 07:45:00 2025 ++++ apps/openssl/speed.c Thu Dec 18 07:45:12 2025 @@ -154,7 +154,16 @@ static void pkey_print_message(const char *str, const char *str2, - long num, int bits, int sec); + int bits, int sec); static void print_result(int alg, int run_no, int count, double time_used); +#ifndef _WIN32 static int do_multi(int multi); @@ -15,9 +15,9 @@ +#define alarm(seconds) speed_alarm((seconds)) +#endif - #define ALGOR_NUM 31 #define SIZE_NUM 5 -@@ -1087,8 +1096,10 @@ speed_main(int argc, char **argv) + #define MAX_ECDH_SIZE 256 +@@ -1089,8 +1098,10 @@ speed_main(int argc, char **argv) const EVP_CIPHER *evp_cipher = NULL; const EVP_MD *evp_md = NULL; int decrypt = 0; @@ -28,7 +28,7 @@ const char *errstr = NULL; if (pledge("stdio proc", NULL) == -1) { -@@ -1163,6 +1174,7 @@ speed_main(int argc, char **argv) +@@ -1164,6 +1175,7 @@ speed_main(int argc, char **argv) decrypt = 1; j--; /* Otherwise, -decrypt gets confused with an * algorithm. */ @@ -36,7 +36,7 @@ } else if (argc > 0 && strcmp(*argv, "-multi") == 0) { argc--; argv++; -@@ -1177,6 +1189,7 @@ speed_main(int argc, char **argv) +@@ -1178,6 +1190,7 @@ speed_main(int argc, char **argv) } j--; /* Otherwise, -multi gets confused with an * algorithm. */ @@ -44,7 +44,7 @@ } else if (argc > 0 && strcmp(*argv, "-unaligned") == 0) { argc--; argv++; -@@ -1491,7 +1504,9 @@ speed_main(int argc, char **argv) +@@ -1492,7 +1505,9 @@ speed_main(int argc, char **argv) BIO_printf(bio_err, "-evp e use EVP e.\n"); BIO_printf(bio_err, "-decrypt time decryption instead of encryption (only EVP).\n"); BIO_printf(bio_err, "-mr produce machine readable output.\n"); @@ -54,7 +54,7 @@ BIO_printf(bio_err, "-unaligned n use buffers with offset n from proper alignment.\n"); goto end; } -@@ -1500,8 +1515,10 @@ speed_main(int argc, char **argv) +@@ -1501,8 +1516,10 @@ speed_main(int argc, char **argv) j++; } @@ -66,7 +66,7 @@ if (j == 0) { for (i = 0; i < ALGOR_NUM; i++) { @@ -1573,11 +1590,13 @@ speed_main(int argc, char **argv) - #define COND(c) (run && count<0x7fffffff) + #define COND (run && count<0x7fffffff) #define COUNT(d) (count) +#ifndef _WIN32 @@ -79,7 +79,7 @@ #ifndef OPENSSL_NO_MD4 if (doit[D_MD4]) { -@@ -2370,7 +2389,9 @@ speed_main(int argc, char **argv) +@@ -2362,7 +2381,9 @@ speed_main(int argc, char **argv) ecdh_doit[j] = 0; } } @@ -89,7 +89,7 @@ if (!mr) { fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION)); fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON)); -@@ -2526,11 +2547,15 @@ pkey_print_message(const char *str, const char *str2, +@@ -2518,11 +2539,15 @@ pkey_print_message(const char *str, const char *str2, static void print_result(int alg, int run_no, int count, double time_used) { @@ -105,7 +105,7 @@ static char * sstrsep(char **string, const char *delim) { -@@ -2731,5 +2756,6 @@ do_multi(int multi) +@@ -2723,5 +2748,6 @@ do_multi(int multi) free(fds); return 1; } From 166e80048c4b812b57c4ba083a1a6d3ebc61f2c1 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 18 Dec 2025 08:42:32 -0700 Subject: [PATCH 1114/1283] compat/netinet/ip.h: add compat define for IPTOS_DSCP_VA --- include/compat/netinet/ip.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/include/compat/netinet/ip.h b/include/compat/netinet/ip.h index 29f17f3f74..100e00665c 100644 --- a/include/compat/netinet/ip.h +++ b/include/compat/netinet/ip.h @@ -44,6 +44,10 @@ #define IPTOS_DSCP_AF43 0x98 #endif +#ifndef IPTOS_DSCP_VA +#define IPTOS_DSCP_VA 0xb0 +#endif + #ifndef IPTOS_DSCP_EF #define IPTOS_DSCP_EF 0xb8 #endif From 89e8315542459dbb719a3863600e23dc4adbf22d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 18 Dec 2025 09:24:24 -0700 Subject: [PATCH 1115/1283] emscripten: avoid oom in clienttest --- tests/CMakeLists.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 7f9b93c8ba..997fc44d4f 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -354,6 +354,7 @@ add_platform_test(cipherstest cipherstest) ## clienttest add_executable(clienttest clienttest.c) target_link_libraries(clienttest ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(clienttest) add_platform_test(clienttest clienttest) # cmstest From a989b7acb9a475fde656e48dbcb38289de519a1d Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 9 Jan 2026 02:35:10 -0700 Subject: [PATCH 1116/1283] ChangeLog: mention ML-KEM keyshares --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 9ef2bd76bf..cf77c2a4c4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -37,6 +37,8 @@ LibreSSL Portable Release Notes: * Compatibility changes - Expose X509_VERIFY_PARAM_set_hostflags() as a public symbol. - Provide SSL_SESSION_dup(). + * New features: support for MLKEM768_X25519 keyshare in TLS. + https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/ * Bug fixes - Ensure the group selected by a TLSv1.3 server for a HelloRetryRequest is not one for which the client has From 8f16070c759d929abb5b38a3bf19abf2de75b9ff Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 9 Jan 2026 11:18:01 +0100 Subject: [PATCH 1117/1283] Work around Windows build failure --- patches/stack.c.patch | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 patches/stack.c.patch diff --git a/patches/stack.c.patch b/patches/stack.c.patch new file mode 100644 index 0000000000..643ee075ca --- /dev/null +++ b/patches/stack.c.patch @@ -0,0 +1,11 @@ +--- crypto/stack/stack.c.orig Fri Jan 9 03:12:10 2026 ++++ crypto/stack/stack.c Fri Jan 9 03:15:42 2026 +@@ -201,7 +201,7 @@ + obj_bsearch_ex(const void *key, const void *base_, int num, int size, + int (*cmp)(const void *, const void *)) + { +- const void *base = base_; ++ const char *base = base_; /* XXX - error C2036: 'const void *': unknown size */ + int l, h, i, c; + + l = 0; From 655f5b9f6c5f2944c1c1e6ff35af21b917c56dc2 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 14 Jan 2026 18:47:46 +0100 Subject: [PATCH 1118/1283] Remove upstreamed stack.c workaround --- patches/stack.c.patch | 11 ----------- 1 file changed, 11 deletions(-) delete mode 100644 patches/stack.c.patch diff --git a/patches/stack.c.patch b/patches/stack.c.patch deleted file mode 100644 index 643ee075ca..0000000000 --- a/patches/stack.c.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- crypto/stack/stack.c.orig Fri Jan 9 03:12:10 2026 -+++ crypto/stack/stack.c Fri Jan 9 03:15:42 2026 -@@ -201,7 +201,7 @@ - obj_bsearch_ex(const void *key, const void *base_, int num, int size, - int (*cmp)(const void *, const void *)) - { -- const void *base = base_; -+ const char *base = base_; /* XXX - error C2036: 'const void *': unknown size */ - int l, h, i, c; - - l = 0; From 608555130e8abe649a6132e031dafd97e11f48b7 Mon Sep 17 00:00:00 2001 From: Joel Sing Date: Sat, 17 Jan 2026 00:15:13 +1100 Subject: [PATCH 1119/1283] Mop up various defines that are no longer used upstream BSAES_ASM, VPAES_ASM and OPENSSL_IA32_SSE2 were retired a while ago. --- crypto/CMakeLists.txt | 12 ------------ crypto/Makefile.am.elf-x86_64 | 3 --- crypto/Makefile.am.macosx-x86_64 | 3 --- crypto/Makefile.am.masm-x86_64 | 3 --- crypto/Makefile.am.mingw64-x86_64 | 3 --- 5 files changed, 24 deletions(-) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 137cf7005a..cb28fc3afe 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -53,9 +53,6 @@ if(HOST_ASM_ELF_X86_64) bn/arch/amd64/word_clz.S ) add_definitions(-DAES_ASM) - add_definitions(-DBSAES_ASM) - add_definitions(-DVPAES_ASM) - add_definitions(-DOPENSSL_IA32_SSE2) add_definitions(-DOPENSSL_BN_ASM_MONT) add_definitions(-DOPENSSL_BN_ASM_MONT5) add_definitions(-DGHASH_ASM) @@ -101,9 +98,6 @@ if(HOST_ASM_MACOSX_X86_64) bn/arch/amd64/word_clz.S ) add_definitions(-DAES_ASM) - add_definitions(-DBSAES_ASM) - add_definitions(-DVPAES_ASM) - add_definitions(-DOPENSSL_IA32_SSE2) add_definitions(-DOPENSSL_BN_ASM_MONT) add_definitions(-DOPENSSL_BN_ASM_MONT5) add_definitions(-DGHASH_ASM) @@ -128,9 +122,6 @@ if(HOST_ASM_MASM_X86_64) ) add_definitions(-Dendbr64=) add_definitions(-DAES_ASM) - add_definitions(-DBSAES_ASM) - add_definitions(-DVPAES_ASM) - add_definitions(-DOPENSSL_IA32_SSE2) #add_definitions(-DOPENSSL_BN_ASM_MONT) #add_definitions(-DOPENSSL_BN_ASM_MONT5) add_definitions(-DGHASH_ASM) @@ -155,9 +146,6 @@ if(HOST_ASM_MINGW64_X86_64) ) add_definitions(-Dendbr32=endbr64) add_definitions(-DAES_ASM) - add_definitions(-DBSAES_ASM) - add_definitions(-DVPAES_ASM) - add_definitions(-DOPENSSL_IA32_SSE2) #add_definitions(-DOPENSSL_BN_ASM_MONT) #add_definitions(-DOPENSSL_BN_ASM_MONT5) add_definitions(-DGHASH_ASM) diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index df67ad2374..c85deb195a 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -37,9 +37,6 @@ libcrypto_la_SOURCES += bn/arch/amd64/bn_arch.c libcrypto_la_SOURCES += modes/gcm128_amd64.c libcrypto_la_CPPFLAGS += -DAES_ASM -libcrypto_la_CPPFLAGS += -DBSAES_ASM -libcrypto_la_CPPFLAGS += -DVPAES_ASM -libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 libcrypto_la_CPPFLAGS += -DGHASH_ASM diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index 23e27e6d4d..7fa38abfcd 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -37,9 +37,6 @@ libcrypto_la_SOURCES += bn/arch/amd64/bn_arch.c libcrypto_la_SOURCES += modes/gcm128_amd64.c libcrypto_la_CPPFLAGS += -DAES_ASM -libcrypto_la_CPPFLAGS += -DBSAES_ASM -libcrypto_la_CPPFLAGS += -DVPAES_ASM -libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 libcrypto_la_CPPFLAGS += -DGHASH_ASM diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index bb94e3aaa6..b24df62bae 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -14,9 +14,6 @@ libcrypto_la_SOURCES += aes/aes_amd64.c libcrypto_la_SOURCES += modes/gcm128_amd64.c libcrypto_la_CPPFLAGS += -DAES_ASM -libcrypto_la_CPPFLAGS += -DBSAES_ASM -libcrypto_la_CPPFLAGS += -DVPAES_ASM -libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 libcrypto_la_CPPFLAGS += -DGHASH_ASM diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index efe2643ad7..cf761dc559 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -15,9 +15,6 @@ libcrypto_la_SOURCES += modes/gcm128_amd64.c libcrypto_la_CPPFLAGS += -Dendbr32=endbr64 libcrypto_la_CPPFLAGS += -DAES_ASM -libcrypto_la_CPPFLAGS += -DBSAES_ASM -libcrypto_la_CPPFLAGS += -DVPAES_ASM -libcrypto_la_CPPFLAGS += -DOPENSSL_IA32_SSE2 #libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT #libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 libcrypto_la_CPPFLAGS += -DGHASH_ASM From d4164d5a566945318021c9dc867693403d920b5a Mon Sep 17 00:00:00 2001 From: Joel Sing Date: Sun, 18 Jan 2026 00:57:55 +1100 Subject: [PATCH 1120/1283] Simplify update.sh slightly Produce a list of files from the various crypto/Makefile.am* files, rather than sourcing some from crypto/Makefile.am and manually copying the remainder. This will make it easier to add platform specific sources in the future, since they only need to be added to the appropriate Makefile.am* file. Remove symbols exclusion for OPENSSL_ia32cap_P - this disappeared from upstream in 2024. --- update.sh | 28 ++++------------------------ 1 file changed, 4 insertions(+), 24 deletions(-) diff --git a/update.sh b/update.sh index f2b46b7542..f27e3ec8b0 100755 --- a/update.sh +++ b/update.sh @@ -170,41 +170,21 @@ echo "LibreSSL version `cat VERSION`" echo copying libcrypto source rm -f crypto/*.c crypto/*.h touch crypto/empty.c -for i in `awk '/SOURCES|HEADERS/ { print $3 }' crypto/Makefile.am` ; do +crypto_files=`awk '/^ASM|SOURCES|HEADERS/ { print $3 }' crypto/Makefile.am* | grep -v '^\$(' | sort | uniq` +for i in $crypto_files; do dir=`dirname $i` mkdir -p crypto/$dir if [ $dir != "compat" ]; then - if [ -e $libcrypto_src/$i ]; then + if [ -f $libcrypto_src/$i ]; then $CP $libcrypto_src/$i crypto/$i fi fi done -for arch in amd64 i386; do - $CP $libcrypto_src/aes/aes_${arch}.c crypto/aes/ - $CP $libcrypto_src/modes/gcm128_${arch}.c crypto/modes/ -done - -for i in $libcrypto_src/arch/*; do - arch=`basename $i` - mkdir -p crypto/arch/$arch - $CP $libcrypto_src/arch/$arch/crypto_arch.h crypto/arch/$arch/ - crypto_cpu_caps=$libcrypto_src/arch/$arch/crypto_cpu_caps.c - if [ -f "$crypto_cpu_caps" ]; then - $CP "$crypto_cpu_caps" crypto/arch/$arch/ - fi -done - -for i in $libcrypto_src/bn/arch/*; do - arch=`basename $i` - mkdir -p crypto/bn/arch/$arch - $CP $libcrypto_src/bn/arch/$arch/* crypto/bn/arch/$arch/ -done - $CP crypto/compat/b_win.c crypto/bio $CP crypto/compat/ui_openssl_win.c crypto/ui # add the libcrypto symbol export list -$GREP -v OPENSSL_ia32cap_P $libcrypto_src/Symbols.list | $GREP '^[A-Za-z0-9_]' > crypto/crypto.sym +$GREP '^[A-Za-z0-9_]' $libcrypto_src/Symbols.list > crypto/crypto.sym fixup_masm() { cpp -I./crypto -I./include/compat -D_MSC_VER -U__CET__ $1 \ From 3e1e0632f15abb9714c02a3e9a95186c6074b7ce Mon Sep 17 00:00:00 2001 From: Joel Sing Date: Sun, 18 Jan 2026 14:30:43 +1100 Subject: [PATCH 1121/1283] Revise portable to work with LIBRESSL_USE_*_ASSEMBLY defines --- crypto/CMakeLists.txt | 28 ++++++++++++++++------------ crypto/Makefile.am.elf-mips | 6 +++++- crypto/Makefile.am.elf-mips64 | 6 +++++- crypto/Makefile.am.elf-x86_64 | 9 ++++++--- crypto/Makefile.am.macosx-x86_64 | 9 ++++++--- crypto/Makefile.am.masm-x86_64 | 9 ++++++--- crypto/Makefile.am.mingw64-x86_64 | 10 +++++++--- patches/aarch64_crypto_arch.h.patch | 16 ---------------- patches/amd64_crypto_arch.h.patch | 18 ------------------ 9 files changed, 51 insertions(+), 60 deletions(-) delete mode 100644 patches/aarch64_crypto_arch.h.patch delete mode 100644 patches/amd64_crypto_arch.h.patch diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index cb28fc3afe..1cacbf402a 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -52,11 +52,12 @@ if(HOST_ASM_ELF_X86_64) bn/arch/amd64/bignum_sub.S bn/arch/amd64/word_clz.S ) - add_definitions(-DAES_ASM) + add_definitions(-DLIBRESSL_USE_AES_ASSEMBLY) + add_definitions(-DLIBRESSL_USE_BN_ASSEMBLY) + add_definitions(-DLIBRESSL_USE_GCM_ASSEMBLY) + add_definitions(-DLIBRESSL_USE_RC4_ASSEMBLY) add_definitions(-DOPENSSL_BN_ASM_MONT) add_definitions(-DOPENSSL_BN_ASM_MONT5) - add_definitions(-DGHASH_ASM) - add_definitions(-DRSA_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_ELF_SRC}) endif() @@ -97,11 +98,12 @@ if(HOST_ASM_MACOSX_X86_64) bn/arch/amd64/bignum_sub.S bn/arch/amd64/word_clz.S ) - add_definitions(-DAES_ASM) + add_definitions(-DLIBRESSL_USE_AES_ASSEMBLY) + add_definitions(-DLIBRESSL_USE_BN_ASSEMBLY) + add_definitions(-DLIBRESSL_USE_GCM_ASSEMBLY) + add_definitions(-DLIBRESSL_USE_RC4_ASSEMBLY) add_definitions(-DOPENSSL_BN_ASM_MONT) add_definitions(-DOPENSSL_BN_ASM_MONT5) - add_definitions(-DGHASH_ASM) - add_definitions(-DRSA_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MACOSX_SRC}) set_property(SOURCE ${ASM_X86_64_MACOSX_SRC} PROPERTY XCODE_EXPLICIT_FILE_TYPE "sourcecode.asm") endif() @@ -121,11 +123,12 @@ if(HOST_ASM_MASM_X86_64) rc4/rc4-masm-x86_64.S ) add_definitions(-Dendbr64=) - add_definitions(-DAES_ASM) + add_definitions(-DLIBRESSL_USE_AES_ASSEMBLY) + #add_definitions(-DLIBRESSL_USE_BN_ASSEMBLY) + add_definitions(-DLIBRESSL_USE_GCM_ASSEMBLY) + add_definitions(-DLIBRESSL_USE_RC4_ASSEMBLY) #add_definitions(-DOPENSSL_BN_ASM_MONT) #add_definitions(-DOPENSSL_BN_ASM_MONT5) - add_definitions(-DGHASH_ASM) - add_definitions(-DRSA_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MASM_SRC}) set_property(SOURCE ${ASM_X86_64_MASM_SRC} PROPERTY LANGUAGE ASM_MASM) endif() @@ -145,11 +148,12 @@ if(HOST_ASM_MINGW64_X86_64) rc4/rc4-mingw64-x86_64.S ) add_definitions(-Dendbr32=endbr64) - add_definitions(-DAES_ASM) + add_definitions(-DLIBRESSL_USE_AES_ASSEMBLY) + #add_definitions(-DLIBRESSL_USE_BN_ASSEMBLY) + add_definitions(-DLIBRESSL_USE_GCM_ASSEMBLY) + add_definitions(-DLIBRESSL_USE_RC4_ASSEMBLY) #add_definitions(-DOPENSSL_BN_ASM_MONT) #add_definitions(-DOPENSSL_BN_ASM_MONT5) - add_definitions(-DGHASH_ASM) - add_definitions(-DRSA_ASM) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_MINGW64_SRC}) endif() diff --git a/crypto/Makefile.am.elf-mips b/crypto/Makefile.am.elf-mips index f7a44f20eb..2276991070 100644 --- a/crypto/Makefile.am.elf-mips +++ b/crypto/Makefile.am.elf-mips @@ -8,7 +8,11 @@ ASM_MIPS_ELF += sha/sha256-mips.S EXTRA_DIST += $(ASM_MIPS_ELF) if HOST_ASM_ELF_MIPS -libcrypto_la_CPPFLAGS += -DAES_ASM +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_AES_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_BN_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_SHA_ASSEMBLY + libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT + libcrypto_la_SOURCES += $(ASM_MIPS_ELF) endif diff --git a/crypto/Makefile.am.elf-mips64 b/crypto/Makefile.am.elf-mips64 index 7d90bc0725..c6727b3b88 100644 --- a/crypto/Makefile.am.elf-mips64 +++ b/crypto/Makefile.am.elf-mips64 @@ -8,7 +8,11 @@ ASM_MIPS64_ELF += sha/sha256-mips.S EXTRA_DIST += $(ASM_MIPS64_ELF) if HOST_ASM_ELF_MIPS64 -libcrypto_la_CPPFLAGS += -DAES_ASM +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_AES_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_BN_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_SHA_ASSEMBLY + libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT + libcrypto_la_SOURCES += $(ASM_MIPS64_ELF) endif diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index c85deb195a..d1b067dd73 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -36,10 +36,13 @@ libcrypto_la_SOURCES += aes/aes_amd64.c libcrypto_la_SOURCES += bn/arch/amd64/bn_arch.c libcrypto_la_SOURCES += modes/gcm128_amd64.c -libcrypto_la_CPPFLAGS += -DAES_ASM +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_AES_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_BN_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_GCM_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_RC4_ASSEMBLY + libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 -libcrypto_la_CPPFLAGS += -DGHASH_ASM -libcrypto_la_CPPFLAGS += -DRSA_ASM + libcrypto_la_SOURCES += $(ASM_X86_64_ELF) endif diff --git a/crypto/Makefile.am.macosx-x86_64 b/crypto/Makefile.am.macosx-x86_64 index 7fa38abfcd..7a26649b2b 100644 --- a/crypto/Makefile.am.macosx-x86_64 +++ b/crypto/Makefile.am.macosx-x86_64 @@ -36,10 +36,13 @@ libcrypto_la_SOURCES += aes/aes_amd64.c libcrypto_la_SOURCES += bn/arch/amd64/bn_arch.c libcrypto_la_SOURCES += modes/gcm128_amd64.c -libcrypto_la_CPPFLAGS += -DAES_ASM +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_AES_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_BN_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_GCM_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_RC4_ASSEMBLY + libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 -libcrypto_la_CPPFLAGS += -DGHASH_ASM -libcrypto_la_CPPFLAGS += -DRSA_ASM + libcrypto_la_SOURCES += $(ASM_X86_64_MACOSX) endif diff --git a/crypto/Makefile.am.masm-x86_64 b/crypto/Makefile.am.masm-x86_64 index b24df62bae..249f86bef8 100644 --- a/crypto/Makefile.am.masm-x86_64 +++ b/crypto/Makefile.am.masm-x86_64 @@ -13,10 +13,13 @@ if HOST_ASM_MASM_X86_64 libcrypto_la_SOURCES += aes/aes_amd64.c libcrypto_la_SOURCES += modes/gcm128_amd64.c -libcrypto_la_CPPFLAGS += -DAES_ASM +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_AES_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_BN_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_GCM_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_RC4_ASSEMBLY + libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 -libcrypto_la_CPPFLAGS += -DGHASH_ASM -libcrypto_la_CPPFLAGS += -DRSA_ASM + libcrypto_la_SOURCES += $(ASM_X86_64_MASM) endif diff --git a/crypto/Makefile.am.mingw64-x86_64 b/crypto/Makefile.am.mingw64-x86_64 index cf761dc559..e725a05012 100644 --- a/crypto/Makefile.am.mingw64-x86_64 +++ b/crypto/Makefile.am.mingw64-x86_64 @@ -14,10 +14,14 @@ libcrypto_la_SOURCES += aes/aes_amd64.c libcrypto_la_SOURCES += modes/gcm128_amd64.c libcrypto_la_CPPFLAGS += -Dendbr32=endbr64 -libcrypto_la_CPPFLAGS += -DAES_ASM + +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_AES_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_BN_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_GCM_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_RC4_ASSEMBLY + #libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT #libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 -libcrypto_la_CPPFLAGS += -DGHASH_ASM -libcrypto_la_CPPFLAGS += -DRSA_ASM + libcrypto_la_SOURCES += $(ASM_X86_64_MINGW64) endif diff --git a/patches/aarch64_crypto_arch.h.patch b/patches/aarch64_crypto_arch.h.patch deleted file mode 100644 index e6a8cbfe37..0000000000 --- a/patches/aarch64_crypto_arch.h.patch +++ /dev/null @@ -1,16 +0,0 @@ ---- crypto/arch/aarch64/crypto_arch.h.orig Sun Jun 29 03:49:56 2025 -+++ crypto/arch/aarch64/crypto_arch.h Sun Jun 29 04:00:13 2025 -@@ -34,11 +34,13 @@ extern uint64_t crypto_cpu_caps_aarch64; - #define CRYPTO_CPU_CAPS_AARCH64_SHA3 (1ULL << 5) - - #ifndef OPENSSL_NO_ASM -+#if 0 - - #define HAVE_SHA1_BLOCK_DATA_ORDER - #define HAVE_SHA256_BLOCK_DATA_ORDER - #define HAVE_SHA512_BLOCK_DATA_ORDER - -+#endif - #endif - - #endif diff --git a/patches/amd64_crypto_arch.h.patch b/patches/amd64_crypto_arch.h.patch deleted file mode 100644 index e31f988b1b..0000000000 --- a/patches/amd64_crypto_arch.h.patch +++ /dev/null @@ -1,18 +0,0 @@ ---- crypto/arch/amd64/crypto_arch.h.orig Fri Oct 24 07:06:10 2025 -+++ crypto/arch/amd64/crypto_arch.h Fri Oct 24 07:06:21 2025 -@@ -53,6 +53,7 @@ extern uint64_t crypto_cpu_caps_amd64; - #define HAVE_RC4_INTERNAL - #define HAVE_RC4_SET_KEY_INTERNAL - -+#if 0 - #define HAVE_SHA1_BLOCK_DATA_ORDER - #define HAVE_SHA1_BLOCK_GENERIC - -@@ -61,6 +62,7 @@ extern uint64_t crypto_cpu_caps_amd64; - - #define HAVE_SHA512_BLOCK_DATA_ORDER - #define HAVE_SHA512_BLOCK_GENERIC -+#endif - - #endif - From 47342118f5533df3e30032d1a7c2454cda32cdaf Mon Sep 17 00:00:00 2001 From: Joel Sing Date: Mon, 19 Jan 2026 02:28:05 +1100 Subject: [PATCH 1122/1283] Enable SHA assembly for elf-x86_64 builds --- crypto/CMakeLists.txt | 8 ++++++++ crypto/Makefile.am.elf-x86_64 | 10 ++++++++++ 2 files changed, 18 insertions(+) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 1cacbf402a..2723d4c5a0 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -19,6 +19,7 @@ if(HOST_ASM_ELF_X86_64) set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c) set(CRYPTO_SRC ${CRYPTO_SRC} bn/arch/amd64/bn_arch.c) set(CRYPTO_SRC ${CRYPTO_SRC} modes/gcm128_amd64.c) + set(CRYPTO_SRC ${CRYPTO_SRC} sha/sha1_amd64.c sha/sha256_amd64.c sha/sha512_amd64.c) set( ASM_X86_64_ELF_SRC @@ -51,11 +52,18 @@ if(HOST_ASM_ELF_X86_64) bn/arch/amd64/bignum_sqr_8_16_alt.S bn/arch/amd64/bignum_sub.S bn/arch/amd64/word_clz.S + + sha/sha1_amd64_shani.S + sha/sha1_amd64_generic.S + sha/sha256_amd64_generic.S + sha/sha256_amd64_shani.S + sha/sha512_amd64_generic.S ) add_definitions(-DLIBRESSL_USE_AES_ASSEMBLY) add_definitions(-DLIBRESSL_USE_BN_ASSEMBLY) add_definitions(-DLIBRESSL_USE_GCM_ASSEMBLY) add_definitions(-DLIBRESSL_USE_RC4_ASSEMBLY) + add_definitions(-DLIBRESSL_USE_SHA_ASSEMBLY) add_definitions(-DOPENSSL_BN_ASM_MONT) add_definitions(-DOPENSSL_BN_ASM_MONT5) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_X86_64_ELF_SRC}) diff --git a/crypto/Makefile.am.elf-x86_64 b/crypto/Makefile.am.elf-x86_64 index d1b067dd73..450e96ac8c 100644 --- a/crypto/Makefile.am.elf-x86_64 +++ b/crypto/Makefile.am.elf-x86_64 @@ -29,17 +29,27 @@ ASM_X86_64_ELF += bn/arch/amd64/bignum_sqr_8_16_alt.S ASM_X86_64_ELF += bn/arch/amd64/bignum_sub.S ASM_X86_64_ELF += bn/arch/amd64/word_clz.S +ASM_X86_64_ELF += sha/sha1_amd64_generic.S +ASM_X86_64_ELF += sha/sha1_amd64_shani.S +ASM_X86_64_ELF += sha/sha256_amd64_generic.S +ASM_X86_64_ELF += sha/sha256_amd64_shani.S +ASM_X86_64_ELF += sha/sha512_amd64_generic.S + EXTRA_DIST += $(ASM_X86_64_ELF) if HOST_ASM_ELF_X86_64 libcrypto_la_SOURCES += aes/aes_amd64.c libcrypto_la_SOURCES += bn/arch/amd64/bn_arch.c libcrypto_la_SOURCES += modes/gcm128_amd64.c +libcrypto_la_SOURCES += sha/sha1_amd64.c +libcrypto_la_SOURCES += sha/sha256_amd64.c +libcrypto_la_SOURCES += sha/sha512_amd64.c libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_AES_ASSEMBLY libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_BN_ASSEMBLY libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_GCM_ASSEMBLY libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_RC4_ASSEMBLY +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_SHA_ASSEMBLY libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT libcrypto_la_CPPFLAGS += -DOPENSSL_BN_ASM_MONT5 From a9f3c5a1d6f26739d8857076bc3a5d3f612ed2e3 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 23 Jan 2026 01:05:57 -0700 Subject: [PATCH 1123/1283] Link bn_ffdh test to build --- .gitignore | 1 + tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 3 files changed, 11 insertions(+) diff --git a/.gitignore b/.gitignore index 03f44eb187..5db07be3de 100644 --- a/.gitignore +++ b/.gitignore @@ -87,6 +87,7 @@ tests/bn_add_sub* tests/bn_bits* tests/bn_cmp* tests/bn_convert* +tests/bn_ffdh* tests/bn_gcd* tests/bn_isqrt* tests/bn_mod_exp* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 997fc44d4f..fd50dd5da9 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -243,6 +243,11 @@ add_executable(bn_convert bn_convert.c) target_link_libraries(bn_convert ${OPENSSL_TEST_LIBS}) add_platform_test(bn_convert bn_convert) +# bn_ffdh +add_executable(bn_ffdh bn_cmp.c) +target_link_libraries(bn_ffdh ${OPENSSL_TEST_LIBS}) +add_platform_test(bn_ffdh bn_ffdh) + # bn_gcd add_executable(bn_gcd bn_cmp.c) target_link_libraries(bn_gcd ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 7ba6c076c5..22e3dee6f0 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -265,6 +265,11 @@ TESTS += bn_convert check_PROGRAMS += bn_convert bn_convert_SOURCES = bn_convert.c +# bn_ffdh +TESTS += bn_ffdh +check_PROGRAMS += bn_ffdh +bn_ffdh_SOURCES = bn_ffdh.c + # bn_gcd TESTS += bn_gcd check_PROGRAMS += bn_gcd From 022cafc5dc114c731f06f9b73508d001ddc4f825 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 23 Jan 2026 01:18:18 -0700 Subject: [PATCH 1124/1283] cmake tests: fix two copy-paste errors --- tests/CMakeLists.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index fd50dd5da9..eaf4ed198a 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -244,12 +244,12 @@ target_link_libraries(bn_convert ${OPENSSL_TEST_LIBS}) add_platform_test(bn_convert bn_convert) # bn_ffdh -add_executable(bn_ffdh bn_cmp.c) +add_executable(bn_ffdh bn_ffdh.c) target_link_libraries(bn_ffdh ${OPENSSL_TEST_LIBS}) add_platform_test(bn_ffdh bn_ffdh) # bn_gcd -add_executable(bn_gcd bn_cmp.c) +add_executable(bn_gcd bn_gcd.c) target_link_libraries(bn_gcd ${OPENSSL_TEST_LIBS}) add_platform_test(bn_gcd bn_gcd) From 3474d66b13bec7b9c04c797296091ae6a12df05a Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Sun, 25 Jan 2026 03:46:28 +1100 Subject: [PATCH 1125/1283] scripts/test: fix missing env vars for cross-compilation --- scripts/test | 58 +++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 44 insertions(+), 14 deletions(-) diff --git a/scripts/test b/scripts/test index a7ce1ea83d..1c00e61f5d 100755 --- a/scripts/test +++ b/scripts/test @@ -12,6 +12,33 @@ fi ENABLE_ASM="${ENABLE_ASM:=ON}" +# setup_cross_compiler sets up environment variables for cross-compilation with the given prefix. +setup_cross_compiler() { + cross_prefix=$1 + + # Use unversioned symlink if available, otherwise find versioned binary + if command -v "${cross_prefix}-gcc" >/dev/null 2>&1; then + CC=${cross_prefix}-gcc + CXX=${cross_prefix}-g++ + else + gcc_ver=$(find /usr/bin -maxdepth 1 -name "${cross_prefix}-gcc-[0-9]*" 2>/dev/null \ + | sed "s/.*${cross_prefix}-gcc-//" | sort -V | tail -1) + CC=${cross_prefix}-gcc-${gcc_ver} + CXX=${cross_prefix}-g++-${gcc_ver} + fi + + if ! command -v "${CC}" >/dev/null 2>&1; then + echo "##### Error: ${CC} not found in PATH" + exit 1 + fi + + AR=${cross_prefix}-ar + STRIP=${cross_prefix}-strip + RANLIB=${cross_prefix}-ranlib + + echo "##### Using $($CC --version | head -1)" +} + if type apt-get >/dev/null 2>&1; then sudo apt-get update sudo apt-get install -y cmake ninja-build @@ -87,7 +114,7 @@ elif [ "$ARCH" = "native" ]; then ninja test ) -elif [ "$ARCH" = "mingw32" -o "$ARCH" = "mingw64" ]; then +elif [ "$ARCH" = "mingw32" ] || [ "$ARCH" = "mingw64" ]; then CPU=i686 if [ "$ARCH" = "mingw64" ]; then CPU=x86_64 @@ -115,54 +142,57 @@ elif [ "$ARCH" = "mingw32" -o "$ARCH" = "mingw64" ]; then ninja -j 4 ) -elif [ "$ARCH" = "arm32" -o "$ARCH" = "arm64" ]; then +elif [ "$ARCH" = "arm32" ] || [ "$ARCH" = "arm64" ]; then sudo apt-get install -y qemu-user-static binfmt-support if [ "$ARCH" = "arm32" ]; then sudo apt-get install -y g++-arm-linux-gnueabihf sudo ln -sf /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.3 /lib/ + setup_cross_compiler arm-linux-gnueabihf + ./configure --host=arm-linux-gnueabihf LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib make -j 4 check else sudo apt-get install -y g++-aarch64-linux-gnu sudo ln -sf /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.1 /lib/ + setup_cross_compiler aarch64-linux-gnu + ./configure --host=aarch64-linux-gnu LD_LIBRARY_PATH=/usr/aarch64-linux-gnu/lib make -j 4 check fi - file apps/openssl/.libs/openssl + file apps/openssl/openssl elif [ "$ARCH" = "loong64" ]; then sudo apt install -y qemu-user-static binfmt-support g++-14-loongarch64-linux-gnu sudo ln -sf /usr/loongarch64-linux-gnu/lib64/ld-linux-loongarch-lp64d.so.1 /lib64 - - CC=loongarch64-linux-gnu-gcc-14 - CXX=loongarch64-linux-gnu++-14 - AR=loongarch64-linux-gnu-ar - STRIP=loongarch64-linux-gnu-strip-14 - RANLIB=loongarch64-linux-gnu-ranlib + setup_cross_compiler loongarch64-linux-gnu ./configure --host=loongarch64-linux-gnu LD_LIBRARY_PATH=/usr/loongarch64-linux-gnu/lib make -j 4 check file apps/openssl/openssl -elif [ "$ARCH" = "mips32" -o "$ARCH" = "mips64" ]; then +elif [ "$ARCH" = "mips32" ] || [ "$ARCH" = "mips64" ]; then sudo apt-get install -y qemu-user-static binfmt-support if [ "$ARCH" = "mips32" ]; then sudo apt-get install -y g++-mips-linux-gnu - sudo ln -sf /usr/mipsel-linux-gnu/lib/ld.so.1 /lib/ - ./configure --host=mipsel-linux-gnu - LD_LIBRARY_PATH=/usr/mipsel-linux-gnu/lib make -j 4 check + sudo ln -sf /usr/mips-linux-gnu/lib/ld.so.1 /lib/ + setup_cross_compiler mips-linux-gnu + + ./configure --host=mips-linux-gnu + LD_LIBRARY_PATH=/usr/mips-linux-gnu/lib make -j 4 check else sudo apt-get install -y g++-mips64el-linux-gnuabi64 sudo ln -sf /usr/mips64el-linux-gnuabi64/lib64/ld.so.1 /lib64 + setup_cross_compiler mips64el-linux-gnuabi64 + ./configure --host=mips64el-linux-gnuabi64 LD_LIBRARY_PATH=/usr/mips64el-linux-gnuabi64/lib make -j 4 check fi - file apps/openssl/.libs/openssl + file apps/openssl/openssl elif [ "$ARCH" = "android" ]; then export TC_FILE=$ANDROID_NDK_HOME/build/cmake/android.toolchain.cmake From 1c945c2e11776c78c7e49e86c5a5aac23f48434b Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Sun, 25 Jan 2026 16:10:09 +1100 Subject: [PATCH 1126/1283] scripts/test: remove non-standard sort, tail and find flags --- scripts/test | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/test b/scripts/test index 1c00e61f5d..5e95dfd412 100755 --- a/scripts/test +++ b/scripts/test @@ -21,8 +21,8 @@ setup_cross_compiler() { CC=${cross_prefix}-gcc CXX=${cross_prefix}-g++ else - gcc_ver=$(find /usr/bin -maxdepth 1 -name "${cross_prefix}-gcc-[0-9]*" 2>/dev/null \ - | sed "s/.*${cross_prefix}-gcc-//" | sort -V | tail -1) + gcc_ver=$(find /usr/bin -name "${cross_prefix}-gcc-[0-9]*" -prune 2>/dev/null \ + | sed "s/.*${cross_prefix}-gcc-//" | sort -n | tail -n 1) CC=${cross_prefix}-gcc-${gcc_ver} CXX=${cross_prefix}-g++-${gcc_ver} fi From 09c99a505f255164de53a404b81d1aaf3f8c6a23 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Sun, 25 Jan 2026 16:10:55 +1100 Subject: [PATCH 1127/1283] scripts/test: check all binaries for cross-compile Probably safer to check all of them instead of just CC, since previously it seems the loongarch64 RANLIB variable could have been wrong. I am not sure if a missing binary could cause unexpected behaviour. --- scripts/test | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/scripts/test b/scripts/test index 5e95dfd412..d874b646e7 100755 --- a/scripts/test +++ b/scripts/test @@ -27,15 +27,18 @@ setup_cross_compiler() { CXX=${cross_prefix}-g++-${gcc_ver} fi - if ! command -v "${CC}" >/dev/null 2>&1; then - echo "##### Error: ${CC} not found in PATH" - exit 1 - fi - AR=${cross_prefix}-ar STRIP=${cross_prefix}-strip RANLIB=${cross_prefix}-ranlib + # Check all binaries actually exist. + for c in "$CC" "$CXX" "$AR" "$STRIP" "$RANLIB"; do + if ! command -v "$c" >/dev/null 2>&1; then + echo "##### Error: $c not found" + exit 1 + fi + done + echo "##### Using $($CC --version | head -1)" } From 836c23eb15c1d4c2d408f22c7e2e34e87a3697c2 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Sun, 25 Jan 2026 20:06:32 +1100 Subject: [PATCH 1128/1283] scripts/test: reorder setup_cross_compiler, fix head -1 --- scripts/test | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/scripts/test b/scripts/test index d874b646e7..2148d528d3 100755 --- a/scripts/test +++ b/scripts/test @@ -16,21 +16,20 @@ ENABLE_ASM="${ENABLE_ASM:=ON}" setup_cross_compiler() { cross_prefix=$1 - # Use unversioned symlink if available, otherwise find versioned binary - if command -v "${cross_prefix}-gcc" >/dev/null 2>&1; then - CC=${cross_prefix}-gcc - CXX=${cross_prefix}-g++ - else - gcc_ver=$(find /usr/bin -name "${cross_prefix}-gcc-[0-9]*" -prune 2>/dev/null \ - | sed "s/.*${cross_prefix}-gcc-//" | sort -n | tail -n 1) - CC=${cross_prefix}-gcc-${gcc_ver} - CXX=${cross_prefix}-g++-${gcc_ver} - fi - + CC=${cross_prefix}-gcc + CXX=${cross_prefix}-g++ AR=${cross_prefix}-ar STRIP=${cross_prefix}-strip RANLIB=${cross_prefix}-ranlib + # If the unversioned symlink for gcc doesn't exist, find versioned binary. + if ! command -v "$CC" >/dev/null 2>&1; then + gcc_ver=$(find /usr/bin -name "${CC}-[0-9]*" -prune 2>/dev/null \ + | sed "s/.*${CC}-//" | sort -n | tail -n 1) + CC=${CC}-${gcc_ver} + CXX=${CXX}-${gcc_ver} + fi + # Check all binaries actually exist. for c in "$CC" "$CXX" "$AR" "$STRIP" "$RANLIB"; do if ! command -v "$c" >/dev/null 2>&1; then @@ -39,7 +38,7 @@ setup_cross_compiler() { fi done - echo "##### Using $($CC --version | head -1)" + echo "##### Using $($CC --version | head -n 1)" } if type apt-get >/dev/null 2>&1; then From 3531763af72712ba96bd810728c338ebf7250194 Mon Sep 17 00:00:00 2001 From: Joel Sing Date: Mon, 19 Jan 2026 23:51:03 +1100 Subject: [PATCH 1129/1283] Enable SHA assembly for elf-aarch64 --- configure.ac | 2 ++ crypto/CMakeLists.txt | 12 ++++++++++++ crypto/Makefile.am | 3 +++ crypto/Makefile.am.elf-aarch64 | 15 +++++++++++++++ 4 files changed, 32 insertions(+) create mode 100644 crypto/Makefile.am.elf-aarch64 diff --git a/configure.ac b/configure.ac index 8d347b0e85..eb2b9ceae9 100644 --- a/configure.ac +++ b/configure.ac @@ -115,6 +115,8 @@ AC_ARG_ENABLE([asm], AS_HELP_STRING([--disable-asm], [Disable assembly])) AM_CONDITIONAL([OPENSSL_NO_ASM], [test "x$enable_asm" = "xno"]) # Conditionally enable assembly by default +AM_CONDITIONAL([HOST_ASM_ELF_AARCH64], + [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "aarch64" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_ELF_MIPS], [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "mips" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_ELF_MIPS64], diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 2723d4c5a0..d566182a33 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -15,6 +15,18 @@ add_definitions(-DLIBRESSL_CRYPTO_INTERNAL) +if(HOST_ASM_ELF_AARCH64) + set(CRYPTO_SRC ${CRYPTO_SRC} sha/sha1_aarch64.c sha/sha256_aarch64.c sha/sha512_aarch64.c) + + set( + ASM_AARCH64_ELF_SRC + sha/sha1_aarch64_ce.S + sha/sha256_aarch64_ce.S + sha/sha256_aarch64_ce.S + ) + set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_AARCH64_ELF_SRC}) +endif() + if(HOST_ASM_ELF_X86_64) set(CRYPTO_SRC ${CRYPTO_SRC} aes/aes_amd64.c) set(CRYPTO_SRC ${CRYPTO_SRC} bn/arch/amd64/bn_arch.c) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 1acf0f4650..b03347a006 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -205,6 +205,7 @@ include Makefile.am.arc4random libcrypto_la_SOURCES = EXTRA_libcrypto_la_SOURCES = +include Makefile.am.elf-aarch64 include Makefile.am.elf-mips include Makefile.am.elf-mips64 include Makefile.am.elf-x86_64 @@ -212,6 +213,7 @@ include Makefile.am.macosx-x86_64 include Makefile.am.masm-x86_64 include Makefile.am.mingw64-x86_64 +if !HOST_ASM_ELF_AARCH64 if !HOST_ASM_ELF_MIPS if !HOST_ASM_ELF_MIPS64 if !HOST_ASM_ELF_X86_64 @@ -225,6 +227,7 @@ endif endif endif endif +endif if HOST_AARCH64 if HOST_DARWIN diff --git a/crypto/Makefile.am.elf-aarch64 b/crypto/Makefile.am.elf-aarch64 new file mode 100644 index 0000000000..650e6c6538 --- /dev/null +++ b/crypto/Makefile.am.elf-aarch64 @@ -0,0 +1,15 @@ +ASM_AARCH64_ELF = sha/sha1_aarch64_ce.S +ASM_AARCH64_ELF += sha/sha256_aarch64_ce.S +ASM_AARCH64_ELF += sha/sha512_aarch64_ce.S + +EXTRA_DIST += $(ASM_AARCH64_ELF) + +if HOST_ASM_ELF_AARCH64 +libcrypto_la_SOURCES += sha/sha1_aarch64.c +libcrypto_la_SOURCES += sha/sha256_aarch64.c +libcrypto_la_SOURCES += sha/sha512_aarch64.c + +libcrypto_la_CPPFLAGS += -DLIBRESSL_USE_SHA_ASSEMBLY + +libcrypto_la_SOURCES += $(ASM_AARCH64_ELF) +endif From 6786cbb9e34dfff2e029ac8e45f2f0cede00350c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 8 Feb 2026 12:35:42 +0100 Subject: [PATCH 1130/1283] Revert "cmake: disable ARM64 ASM on Windows" Undoes the merge of #1211, which is no longer needed as @vszakats confirmed by testing in the curl CI. This reverts commit fad962e027842e224d32b31533a61f65cbc13727. --- CMakeLists.txt | 3 --- 1 file changed, 3 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 1fc845c88d..7ab04ab081 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -412,9 +412,6 @@ endif() if(CMAKE_SYSTEM_PROCESSOR MATCHES "(aarch64|arm64|ARM64)") set(HOST_AARCH64 true) - if(WIN32) - set(ENABLE_ASM false) - endif() elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm") set(HOST_ARM true) if(APPLE) From 43a1f7c7e6578bc38d130b235d75916e5e58f335 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Fri, 20 Feb 2026 13:56:58 +0900 Subject: [PATCH 1131/1283] Fix remote branch fetching and revision lookup in update.sh This patch changes to: - add `--no-single-branch` to git clone to ensure all remote branches are tracked, allowing the script to switch between OpenBSD versions. - use origin/ prefix for $openbsd_branch to fix revision lookup At initial setup, the branch only exists as a "remote-tracking" reference. Since a local branch hasn't been created yet, git cannot find it by name alone. Adding the origin/ prefix explicitly tells git to look into the remote data we just fetched. This ensures the script can correctly identify the commit hash based on the release timestamp even on a fresh shallow clone. Fix https://github.com/libressl/portable/issues/1233 --- update.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/update.sh b/update.sh index f27e3ec8b0..e4377d3c38 100755 --- a/update.sh +++ b/update.sh @@ -21,7 +21,7 @@ openbsd_branch=`cat OPENBSD_BRANCH` # pull in latest upstream code echo "pulling upstream openbsd source" if [ ! -d openbsd ]; then - LIBRESSL_GIT_OPTIONS="${LIBRESSL_GIT_OPTIONS:- --depth=8}" + LIBRESSL_GIT_OPTIONS="${LIBRESSL_GIT_OPTIONS:- --depth=8 --no-single-branch}" LIBRESSL_GIT="${LIBRESSL_GIT:- https://github.com/libressl}" git clone $LIBRESSL_GIT_OPTIONS $LIBRESSL_GIT/openbsd fi @@ -32,7 +32,7 @@ tag=`git describe --exact-match --tags HEAD 2>/dev/null` is_tag=$? # adjust for 9 hour time delta between trees release_ts=$((`git show -s --format=%ct $tag|tail -1` + 32400)) -commit=`git -C openbsd rev-list -n 1 --before=$release_ts $openbsd_branch` +commit=`git -C openbsd rev-list -n 1 --before=$release_ts origin/$openbsd_branch` git -C openbsd fetch if [ $is_tag -eq 0 ]; then echo "This is tag $tag, trying OpenBSD tag libressl-$tag" From 10fd3d1868f5d8e7e282aba2be99ec0cf75431e4 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Fri, 20 Feb 2026 17:07:36 +0900 Subject: [PATCH 1132/1283] Add definition of ssize_t to cms.h for Windows MSVC does not define ssize_t. Hence, this patch adds a typedef for compatibility when LIBRESSL_INTERNAL is not defined. Fix https://github.com/libressl/portable/issues/1232 --- patches/cms.h.patch | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 patches/cms.h.patch diff --git a/patches/cms.h.patch b/patches/cms.h.patch new file mode 100644 index 0000000000..5d403cdb8e --- /dev/null +++ b/patches/cms.h.patch @@ -0,0 +1,16 @@ +--- include/openssl/cms.h.orig 2026-02-20 16:35:58 ++++ include/openssl/cms.h 2026-02-20 16:36:09 +@@ -67,6 +67,13 @@ + extern "C" { + #endif + ++#ifdef _MSC_VER ++#ifndef LIBRESSL_INTERNAL ++#include ++typedef SSIZE_T ssize_t; ++#endif ++#endif ++ + typedef struct CMS_ContentInfo_st CMS_ContentInfo; + typedef struct CMS_SignerInfo_st CMS_SignerInfo; + typedef struct CMS_CertificateChoices CMS_CertificateChoices; From 0ebd329b08ff781380441fad2587ccfc9e1eb388 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Sun, 1 Mar 2026 14:48:40 +1100 Subject: [PATCH 1133/1283] ci: run tests on macos-26 --- .github/workflows/macos.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index dad91e3674..abd577d2c6 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -21,7 +21,7 @@ jobs: strategy: fail-fast: false matrix: - os: ["macos-15", "macos-14"] + os: ["macos-26", "macos-15", "macos-14"] arch: ["arm64", "x86_64"] steps: - name: "Install required packages" From e5dcc309e7dcdf7c08a656fe31e76f7304556459 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sun, 8 Mar 2026 16:45:26 +0900 Subject: [PATCH 1134/1283] Avoid integer overflow in posix_open on Windows If open() fails, return the error value immediately. Adding the high bit to -1 results in a large positive integer, which causes callers like tls_config_load_file() to bypass their error checks. Fix https://github.com/libressl/portable/issues/1239 --- crypto/compat/posix_win.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index 572e5275f8..00d3d82cd3 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -89,6 +89,9 @@ posix_open(const char *path, ...) flags &= ~O_NONBLOCK; const int fh = open(path, flags, mode); + if (fh < 0) { + return fh; + } // Set high bit to mark file descriptor as a file handle return fh + 0x80000000; From 9f8d14709476c22ada6ea26c3406fd0471deaee8 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sun, 8 Mar 2026 17:03:02 +0900 Subject: [PATCH 1135/1283] Verify -1 instead of negative value --- crypto/compat/posix_win.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index 00d3d82cd3..bc0fa36448 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -89,7 +89,7 @@ posix_open(const char *path, ...) flags &= ~O_NONBLOCK; const int fh = open(path, flags, mode); - if (fh < 0) { + if (fh == -1) { return fh; } From b15807a5f881290fb1a7c2a0f817dce36307f8fe Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 13 Mar 2026 09:11:00 -0600 Subject: [PATCH 1136/1283] regen patches --- patches/netcat.c.patch | 20 ++++++++++---------- patches/openssl.c.patch | 6 +++--- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/patches/netcat.c.patch b/patches/netcat.c.patch index c6b9f68d39..0383034187 100644 --- a/patches/netcat.c.patch +++ b/patches/netcat.c.patch @@ -1,5 +1,5 @@ ---- apps/nc/netcat.c.orig Fri Oct 24 07:06:13 2025 -+++ apps/nc/netcat.c Fri Oct 24 07:06:22 2025 +--- apps/nc/netcat.c.orig Fri Mar 13 09:08:38 2026 ++++ apps/nc/netcat.c Fri Mar 13 09:08:46 2026 @@ -93,9 +93,13 @@ int zflag; /* Port Scan Flag */ int Dflag; /* sodebug */ int Iflag; /* TCP receive buffer size */ @@ -53,7 +53,7 @@ /* Cruft to make sure options are clean, and used properly. */ if (argc == 1 && family == AF_UNIX) { -@@ -928,7 +938,10 @@ remote_connect(const char *host, const char *port, str +@@ -930,7 +940,10 @@ remote_connect(const char *host, const char *port, str char *ipaddr) { struct addrinfo *res, *res0; @@ -65,7 +65,7 @@ if ((error = getaddrinfo(host, port, &hints, &res0))) errx(1, "getaddrinfo for host \"%s\" port %s: %s", host, -@@ -943,8 +956,10 @@ remote_connect(const char *host, const char *port, str +@@ -945,8 +958,10 @@ remote_connect(const char *host, const char *port, str if (sflag || pflag) { struct addrinfo ahints, *ares; @@ -76,7 +76,7 @@ memset(&ahints, 0, sizeof(struct addrinfo)); ahints.ai_family = res->ai_family; ahints.ai_socktype = uflag ? SOCK_DGRAM : SOCK_STREAM; -@@ -1036,7 +1051,10 @@ int +@@ -1038,7 +1053,10 @@ int local_listen(const char *host, const char *port, struct addrinfo hints) { struct addrinfo *res, *res0; @@ -88,7 +88,7 @@ int error; /* Allow nodename to be null. */ -@@ -1057,9 +1075,11 @@ local_listen(const char *host, const char *port, struc +@@ -1059,9 +1077,11 @@ local_listen(const char *host, const char *port, struc res->ai_protocol)) == -1) continue; @@ -100,7 +100,7 @@ set_common_sockopts(s, res->ai_family); -@@ -1569,11 +1589,13 @@ set_common_sockopts(int s, int af) +@@ -1571,11 +1591,13 @@ set_common_sockopts(int s, int af) { int x = 1; @@ -114,7 +114,7 @@ if (Dflag) { if (setsockopt(s, SOL_SOCKET, SO_DEBUG, &x, sizeof(x)) == -1) -@@ -1584,9 +1606,16 @@ set_common_sockopts(int s, int af) +@@ -1586,9 +1608,16 @@ set_common_sockopts(int s, int af) IP_TOS, &Tflag, sizeof(Tflag)) == -1) err(1, "set IP ToS"); @@ -131,7 +131,7 @@ } if (Iflag) { if (setsockopt(s, SOL_SOCKET, SO_RCVBUF, -@@ -1610,13 +1639,17 @@ set_common_sockopts(int s, int af) +@@ -1612,13 +1641,17 @@ set_common_sockopts(int s, int af) } if (minttl != -1) { @@ -150,7 +150,7 @@ } } -@@ -1846,15 +1879,19 @@ help(void) +@@ -1849,15 +1882,19 @@ help(void) \t-P proxyuser\tUsername for proxy authentication\n\ \t-p port\t Specify local port for remote connects\n\ \t-R CAfile CA bundle\n\ diff --git a/patches/openssl.c.patch b/patches/openssl.c.patch index 60ea9a77c8..078b3ae07d 100644 --- a/patches/openssl.c.patch +++ b/patches/openssl.c.patch @@ -1,6 +1,6 @@ ---- apps/openssl/openssl.c.orig Sat May 31 03:18:05 2025 -+++ apps/openssl/openssl.c Sat May 31 03:18:17 2025 -@@ -341,7 +341,9 @@ BIO *bio_err = NULL; +--- apps/openssl/openssl.c.orig Fri Mar 13 09:08:38 2026 ++++ apps/openssl/openssl.c Fri Mar 13 09:08:46 2026 +@@ -345,7 +345,9 @@ BIO *bio_err = NULL; static void openssl_startup(void) { From f08fd7cd65734604598abf8a115ab54de748bb7c Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 18 Mar 2026 02:07:30 -0600 Subject: [PATCH 1137/1283] remove ecdsa_local.h --- crypto/Makefile.am | 1 - 1 file changed, 1 deletion(-) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index b03347a006..58f1557838 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -609,7 +609,6 @@ libcrypto_la_SOURCES += ecdh/ecdh.c # ecdsa libcrypto_la_SOURCES += ecdsa/ecdsa.c -noinst_HEADERS += ecdsa/ecdsa_local.h # engine libcrypto_la_SOURCES += engine/engine_stubs.c From bbc25e09f1c306a407e8ec6efd97dc1b3da126e8 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Wed, 18 Mar 2026 18:03:16 +0900 Subject: [PATCH 1138/1283] Update patches/speed.c.patch --- patches/speed.c.patch | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/patches/speed.c.patch b/patches/speed.c.patch index 0f29358185..b649e8e458 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -1,6 +1,6 @@ ---- apps/openssl/speed.c.orig Thu Dec 18 07:45:00 2025 -+++ apps/openssl/speed.c Thu Dec 18 07:45:12 2025 -@@ -154,7 +154,16 @@ static void +--- apps/openssl/speed.c.orig 2026-03-18 18:00:10 ++++ apps/openssl/speed.c 2026-03-18 18:00:28 +@@ -156,7 +156,16 @@ static void print_result(int alg, int run_no, int coun pkey_print_message(const char *str, const char *str2, int bits, int sec); static void print_result(int alg, int run_no, int count, double time_used); @@ -17,7 +17,7 @@ #define SIZE_NUM 5 #define MAX_ECDH_SIZE 256 -@@ -1089,8 +1098,10 @@ speed_main(int argc, char **argv) +@@ -1110,8 +1119,10 @@ speed_main(int argc, char **argv) const EVP_CIPHER *evp_cipher = NULL; const EVP_MD *evp_md = NULL; int decrypt = 0; @@ -28,7 +28,7 @@ const char *errstr = NULL; if (pledge("stdio proc", NULL) == -1) { -@@ -1164,6 +1175,7 @@ speed_main(int argc, char **argv) +@@ -1187,6 +1198,7 @@ speed_main(int argc, char **argv) decrypt = 1; j--; /* Otherwise, -decrypt gets confused with an * algorithm. */ @@ -36,7 +36,7 @@ } else if (argc > 0 && strcmp(*argv, "-multi") == 0) { argc--; argv++; -@@ -1178,6 +1190,7 @@ speed_main(int argc, char **argv) +@@ -1201,6 +1213,7 @@ speed_main(int argc, char **argv) } j--; /* Otherwise, -multi gets confused with an * algorithm. */ @@ -44,7 +44,7 @@ } else if (argc > 0 && strcmp(*argv, "-unaligned") == 0) { argc--; argv++; -@@ -1492,7 +1505,9 @@ speed_main(int argc, char **argv) +@@ -1524,7 +1537,9 @@ speed_main(int argc, char **argv) BIO_printf(bio_err, "-evp e use EVP e.\n"); BIO_printf(bio_err, "-decrypt time decryption instead of encryption (only EVP).\n"); BIO_printf(bio_err, "-mr produce machine readable output.\n"); @@ -54,7 +54,7 @@ BIO_printf(bio_err, "-unaligned n use buffers with offset n from proper alignment.\n"); goto end; } -@@ -1501,8 +1516,10 @@ speed_main(int argc, char **argv) +@@ -1533,8 +1548,10 @@ speed_main(int argc, char **argv) j++; } @@ -65,7 +65,7 @@ if (j == 0) { for (i = 0; i < ALGOR_NUM; i++) { -@@ -1573,11 +1590,13 @@ speed_main(int argc, char **argv) +@@ -1607,11 +1624,13 @@ speed_main(int argc, char **argv) #define COND (run && count<0x7fffffff) #define COUNT(d) (count) @@ -79,17 +79,17 @@ #ifndef OPENSSL_NO_MD4 if (doit[D_MD4]) { -@@ -2362,7 +2381,9 @@ speed_main(int argc, char **argv) - ecdh_doit[j] = 0; - } +@@ -2513,7 +2532,9 @@ speed_main(int argc, char **argv) + free(ss); } + +#ifndef _WIN32 - show_res: + show_res: +#endif if (!mr) { fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION)); fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON)); -@@ -2518,11 +2539,15 @@ pkey_print_message(const char *str, const char *str2, +@@ -2695,11 +2716,15 @@ print_result(int alg, int run_no, int count, double ti static void print_result(int alg, int run_no, int count, double time_used) { @@ -105,7 +105,7 @@ static char * sstrsep(char **string, const char *delim) { -@@ -2723,5 +2748,6 @@ do_multi(int multi) +@@ -2900,5 +2925,6 @@ do_multi(int multi) free(fds); return 1; } From 2da5e226269d564a16dc8503bbb4b058b9dce984 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 29 Mar 2026 05:08:28 -0600 Subject: [PATCH 1139/1283] ChangeLog through Dec 31 --- ChangeLog | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index cf77c2a4c4..017eb96bdb 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,15 +34,43 @@ LibreSSL Portable Release Notes: - Remove the unused sequence number from X509_REVOKED. - Replace a call to atoi() with strtonum() in nc(1) and replace a misleading use of ntohs() with htons(). + - openssl(1) speed now uses HMAC-SHA256 for its hmac benchmark. + - Reimplemented only use of ASN1_PRINTABLE_type() in openssl(1) ca. + The API will be removed in an upcoming release. + - Add curve NID to EC_POINT objects so the library has a clue on which + curve a given EC_POINT is supposed to live. + - Use curve NID to check for compatibility between group and points + in various EC API. This isn't 100% failsafe but good enough for sane + uses. + - Require SSE in order to use gcm_{gmult,ghash}_4bit_mmx(). + On rare i386 machines suporting MMX but not SSE this could result + in an illegal instruction. * Compatibility changes - Expose X509_VERIFY_PARAM_set_hostflags() as a public symbol. - Provide SSL_SESSION_dup(). - * New features: support for MLKEM768_X25519 keyshare in TLS. - https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/ + - BIGNUMs now use the C99 types uint64_t/uint32_t for the word width. + Fixes long-standing issues with 32-bit longs on 64-bit Windows. + - Many unused BN_* macros with incomprehensible names were removed: + BN_LONG, BN_BITS{,4}, BN_MASK2{,l,h,h1}, BN_TBIT, BN_DEC_CONV, + BN_{DEC,HEX}_FMT{1,2}, ... + - openssl(1) cms no longer accepts the unsupported -compress and + -uncompress switches. + - Added PKCS7_NO_DUAL_CONTENT flag/behavior. This is incorrect legacy + behavior but some language bindings decided to rely on it in 2025. + - Remove STABLE_FLAGS_MALLOC but keep STABLE_NO_MASK because there is + still one user... + * New features + - Support for MLKEM768_X25519 keyshare in TLS. + https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/ + - Added ML-KEM benchmarks to openssl(1) speed. * Bug fixes - Ensure the group selected by a TLSv1.3 server for a HelloRetryRequest is not one for which the client has already sent a key share. + - Plug memory leak in CMS_EncryptedData_encrypt(). + - Plug possible memory leak and double free in nref_nos(). + - Removed always zero test results for some no longer available + legacy primitives in openssl(1) speed. 4.2.0 - Stable release From 8eda195528304d713d4f76539fb4a20dbf5df654 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 29 Mar 2026 05:20:24 -0600 Subject: [PATCH 1140/1283] Add crypto_assembly.h --- crypto/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 58f1557838..f703e33cfc 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -267,6 +267,7 @@ libcrypto_la_SOURCES += compat/crypto_lock_win.c endif libcrypto_la_SOURCES += crypto_memory.c noinst_HEADERS += constant_time.h +noinst_HEADERS += crypto_assembly.h noinst_HEADERS += crypto_internal.h noinst_HEADERS += crypto_local.h noinst_HEADERS += x86_arch.h From 3871374f9ec83a56545e9c5721b841ce41b4fdfc Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 3 Apr 2026 01:32:13 -0600 Subject: [PATCH 1141/1283] ssl_packet.c is no more --- ssl/CMakeLists.txt | 1 - ssl/Makefile.am | 1 - 2 files changed, 2 deletions(-) diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 637e0f0b40..9ab7e43e95 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -34,7 +34,6 @@ set( ssl_kex.c ssl_lib.c ssl_methods.c - ssl_packet.c ssl_pkt.c ssl_rsa.c ssl_seclevel.c diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 3096749eca..4ec738cf39 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -85,7 +85,6 @@ libssl_la_SOURCES += ssl_init.c libssl_la_SOURCES += ssl_kex.c libssl_la_SOURCES += ssl_lib.c libssl_la_SOURCES += ssl_methods.c -libssl_la_SOURCES += ssl_packet.c libssl_la_SOURCES += ssl_pkt.c libssl_la_SOURCES += ssl_rsa.c libssl_la_SOURCES += ssl_seclevel.c From eb60ae89e2c296a4bd72e99b5b304fc9efe84b99 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 7 Apr 2026 10:42:15 -0600 Subject: [PATCH 1142/1283] Update ChangeLog --- ChangeLog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ChangeLog b/ChangeLog index 017eb96bdb..fd9abeaceb 100644 --- a/ChangeLog +++ b/ChangeLog @@ -45,6 +45,10 @@ LibreSSL Portable Release Notes: - Require SSE in order to use gcm_{gmult,ghash}_4bit_mmx(). On rare i386 machines suporting MMX but not SSE this could result in an illegal instruction. + - Cleaned up asn1t.h to make it somewhat readable. + - Further assembly macro improvements for -portable. + - Add fast path for well-known DH primes in DH_check() since some + projects still fiddle with this in 2025. * Compatibility changes - Expose X509_VERIFY_PARAM_set_hostflags() as a public symbol. - Provide SSL_SESSION_dup(). @@ -59,6 +63,8 @@ LibreSSL Portable Release Notes: behavior but some language bindings decided to rely on it in 2025. - Remove STABLE_FLAGS_MALLOC but keep STABLE_NO_MASK because there is still one user... + - Fix ASN1_ADB_END macro to have compatible signature with OpenSSL. + The adb_cb() argument is currently ignored. * New features - Support for MLKEM768_X25519 keyshare in TLS. https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/ From 2637bfad42d541372eedf3ea5e289f1c455800a0 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sun, 12 Apr 2026 11:12:40 +0900 Subject: [PATCH 1143/1283] speed: fix SIGALRM handler not registered on Windows --- patches/speed.c.patch | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/patches/speed.c.patch b/patches/speed.c.patch index b649e8e458..8e79f5cd08 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -1,5 +1,5 @@ ---- apps/openssl/speed.c.orig 2026-03-18 18:00:10 -+++ apps/openssl/speed.c 2026-03-18 18:00:28 +--- apps/openssl/speed.c.orig 2026-04-12 11:09:28 ++++ apps/openssl/speed.c 2026-04-12 11:11:18 @@ -156,7 +156,16 @@ static void print_result(int alg, int run_no, int coun pkey_print_message(const char *str, const char *str2, int bits, int sec); @@ -65,7 +65,7 @@ if (j == 0) { for (i = 0; i < ALGOR_NUM; i++) { -@@ -1607,11 +1624,13 @@ speed_main(int argc, char **argv) +@@ -1607,11 +1624,15 @@ speed_main(int argc, char **argv) #define COND (run && count<0x7fffffff) #define COUNT(d) (count) @@ -75,11 +75,13 @@ sa.sa_flags = SA_RESTART; sa.sa_handler = sig_done; sigaction(SIGALRM, &sa, NULL); ++#else ++ signal(SIGALRM, sig_done); +#endif #ifndef OPENSSL_NO_MD4 if (doit[D_MD4]) { -@@ -2513,7 +2532,9 @@ speed_main(int argc, char **argv) +@@ -2513,7 +2534,9 @@ speed_main(int argc, char **argv) free(ss); } @@ -89,7 +91,7 @@ if (!mr) { fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION)); fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON)); -@@ -2695,11 +2716,15 @@ print_result(int alg, int run_no, int count, double ti +@@ -2695,11 +2718,15 @@ print_result(int alg, int run_no, int count, double ti static void print_result(int alg, int run_no, int count, double time_used) { @@ -105,7 +107,7 @@ static char * sstrsep(char **string, const char *delim) { -@@ -2900,5 +2925,6 @@ do_multi(int multi) +@@ -2900,5 +2927,6 @@ do_multi(int multi) free(fds); return 1; } From ce45ee3510927e96baa597277dcdc44ae8bd2e50 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 12 Apr 2026 03:06:37 -0600 Subject: [PATCH 1144/1283] ChangeLog through Apr 7 --- ChangeLog | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 53 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index fd9abeaceb..1f17fb6c18 100644 --- a/ChangeLog +++ b/ChangeLog @@ -45,10 +45,27 @@ LibreSSL Portable Release Notes: - Require SSE in order to use gcm_{gmult,ghash}_4bit_mmx(). On rare i386 machines suporting MMX but not SSE this could result in an illegal instruction. - - Cleaned up asn1t.h to make it somewhat readable. + - Cleaned up asn1t.h to make it somewhat readable and more robust by + using C99 initializers in particular. - Further assembly macro improvements for -portable. - - Add fast path for well-known DH primes in DH_check() since some - projects still fiddle with this in 2025. + - Add fast path for well-known DH primes in DH_check() (including + those from RFC 7919). Some projects still fiddle with this in 2025. + - Rewrite ec_point_cmp() for readability and robustness. + - Improve EVP_{Open,Seal}Init() internals. This is legacy API that + cannot be removed since one scripting language still exposes it. + - ASN1_BIT_STRING_set_bit() now trims trailing zero bits itself rather + than relying on i2c_ASN1_BIT_STRING() doing that when encoding. + - Fix and add workarounds to libtls to improve const correctness and + to avoid warnings when compiling with OpenSSL 4. + - Prefix EC_KEY methods with ec_key_ to avoid problems in some static + links. + - Remove mac_packet, a leftover from accepting SSLv2 ClientHellos. + - Remove ssl_server_legacy_first_packet(). + - In addition to what was done in LibreSSL 4.0 for the version + handling, disable TLSv1.1 and lower also on the method level. + - Remove workaround for SSL 3.0/TLS 1.0 CBC vulnerability. + - Refactor ocsp_find_signer_sk() to avoid neglecting the ASN.1's + semantics by direct reaching into deeply nested OCSP structures. * Compatibility changes - Expose X509_VERIFY_PARAM_set_hostflags() as a public symbol. - Provide SSL_SESSION_dup(). @@ -65,10 +82,13 @@ LibreSSL Portable Release Notes: still one user... - Fix ASN1_ADB_END macro to have compatible signature with OpenSSL. The adb_cb() argument is currently ignored. + - Unexport ASN1_LONG_UNDEF. * New features - Support for MLKEM768_X25519 keyshare in TLS. https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/ - Added ML-KEM benchmarks to openssl(1) speed. + - Added support for starttls protocol sieve. + - Add support for RSASSA-PSS with pubkey OID RSASSA-PSS to libssl. * Bug fixes - Ensure the group selected by a TLSv1.3 server for a HelloRetryRequest is not one for which the client has @@ -77,6 +97,36 @@ LibreSSL Portable Release Notes: - Plug possible memory leak and double free in nref_nos(). - Removed always zero test results for some no longer available legacy primitives in openssl(1) speed. + - List SHA-3 digests in openssl(1) help output. + - Fix encoding of bit strings with trailing zeroes on which + ASN1_STRING_FLAG_BITS_LEFT is not set. + - Add missing NULL pointer check to PKCS12_item_decrypt_d2i(). + - Avoid type confusion leading to 1-byte read at address 0x00-0xff + in PKCS#12 parsing. + - Fix type confusion in timestamp response parsing for v2 signing + cert. + - Fix EVP_SealInit() to return 0 on error, not -1. + - Replace incorrect strncmp() with strcmp() in CRL distribution point + config parsing. + - openssl x509 -text writes its output to the file specified by -out + like all other openssl(1) subcommands. + - Stop Delta CRL processing in the verifier if the cRLNumber is + missing. This is flagged on deserialization, but nothing checks + that flag. This can lead to a NULL dereference if the verification + has enabled Delta CRL checking by setting X509_V_FLAG_USE_DELTAS. + - Fix NULL derefreence that can be triggered with malformed OAEP + parameter encoding for CMS decryption. + * Reliability fix + - Fix off-by-one error in the X.509 verifier depth checking. This can + lead to a 4-byte overwrite on heap allocated memory for clients + talking to a malicious server or for servers that have client + certificate verification enabled. In addition, the maximum depth + must be set to the maximum allowed value of 32. + Thanks to Calif.io in collaboration with Claude and Anthropic + Research, for reporting the issue. + * Testing and proactive security + - Port Wycheproof tests to testvectors_v1 and improve coverage + and correctness. Add tests for ML-KEM in particular. 4.2.0 - Stable release From 230d258bcaaf584c1e0364359a651185b1a1abc8 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Mon, 13 Apr 2026 03:31:41 +1000 Subject: [PATCH 1145/1283] ci: improve cifuzz workflow --- .github/workflows/cifuzz.yml | 59 ++++++++++++++++++++++-------------- 1 file changed, 36 insertions(+), 23 deletions(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index eaa0681afd..91ee288327 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -1,4 +1,4 @@ -name: CIFuzz +name: "CIFuzz" on: workflow_dispatch: @@ -8,26 +8,39 @@ concurrency: cancel-in-progress: true jobs: - Fuzzing: - runs-on: ubuntu-24.04 + fuzz: + name: "Fuzz" + runs-on: "ubuntu-24.04" + permissions: + security-events: write steps: - - name: Build Fuzzers - id: build - uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master - with: - oss-fuzz-project-name: 'libressl' - dry-run: false - language: c++ - - name: Run Fuzzers - uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master - with: - oss-fuzz-project-name: 'libressl' - fuzz-seconds: 300 - dry-run: false - language: c++ - - name: Upload Crash - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 - if: failure() && steps.build.outcome == 'success' - with: - name: artifacts - path: ./out/artifacts + - name: "Build Fuzzers" + id: build + uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@1b73904cfccf3addafb6d599b8e0f32e710790cc + with: + oss-fuzz-project-name: 'libressl' + dry-run: false + language: c++ + + - name: "Run Fuzzers" + uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@1b73904cfccf3addafb6d599b8e0f32e710790cc + with: + oss-fuzz-project-name: 'libressl' + fuzz-seconds: 300 + dry-run: false + language: c++ + output-sarif: true + + - name: "Upload Crash" + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + if: failure() && steps.build.outcome == 'success' + with: + name: "artifacts" + path: "./out/artifacts" + + - name: "Upload SARIF" + uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 + if: always() && steps.build.outcome == 'success' + with: + sarif_file: "cifuzz-sarif/results.sarif" + category: "cifuzz-sarif" From ff82994abda92e985da7ae4fc1538ce6709c702a Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Mon, 13 Apr 2026 03:47:41 +1000 Subject: [PATCH 1146/1283] ci: add renovate-bot config --- .github/renovate.json5 | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .github/renovate.json5 diff --git a/.github/renovate.json5 b/.github/renovate.json5 new file mode 100644 index 0000000000..cf31aad664 --- /dev/null +++ b/.github/renovate.json5 @@ -0,0 +1,32 @@ +{ + $schema: 'https://docs.renovatebot.com/renovate-schema.json', + extends: [ + 'config:best-practices', + ':configMigration', + ':pinVersions', + ':rebaseStalePrs', + 'schedule:weekends', + 'customManagers:githubActionsVersions', + 'helpers:pinGitHubActionDigests', + ], + commitMessagePrefix: 'ci:', + commitMessageAction: 'update', + commitMessageTopic: '{{depName}}', + labels: [ + 'dependencies', + ], + minimumReleaseAge: '3 days', + packageRules: [ + { + matchUpdateTypes: ['pin', 'pinDigest'], + commitMessageAction: 'pin', + }, + ], + osvVulnerabilityAlerts: true, + vulnerabilityAlerts: { + enabled: true, + addLabels: [ + 'security', + ], + }, +} From d7e17c6e0901b6071ddb8541d48e87fc0ec4ee1f Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 12 Apr 2026 23:44:49 -0600 Subject: [PATCH 1147/1283] minor ChangeLog tweaks --- ChangeLog | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 1f17fb6c18..938f46c7b8 100644 --- a/ChangeLog +++ b/ChangeLog @@ -54,7 +54,7 @@ LibreSSL Portable Release Notes: - Improve EVP_{Open,Seal}Init() internals. This is legacy API that cannot be removed since one scripting language still exposes it. - ASN1_BIT_STRING_set_bit() now trims trailing zero bits itself rather - than relying on i2c_ASN1_BIT_STRING() doing that when encoding. + than relying on i2c_ASN1_BIT_STRING() to do that when encoding. - Fix and add workarounds to libtls to improve const correctness and to avoid warnings when compiling with OpenSSL 4. - Prefix EC_KEY methods with ec_key_ to avoid problems in some static @@ -104,7 +104,7 @@ LibreSSL Portable Release Notes: - Avoid type confusion leading to 1-byte read at address 0x00-0xff in PKCS#12 parsing. - Fix type confusion in timestamp response parsing for v2 signing - cert. + certs. - Fix EVP_SealInit() to return 0 on error, not -1. - Replace incorrect strncmp() with strcmp() in CRL distribution point config parsing. @@ -114,7 +114,7 @@ LibreSSL Portable Release Notes: missing. This is flagged on deserialization, but nothing checks that flag. This can lead to a NULL dereference if the verification has enabled Delta CRL checking by setting X509_V_FLAG_USE_DELTAS. - - Fix NULL derefreence that can be triggered with malformed OAEP + - Fix NULL dereference that can be triggered with malformed OAEP parameter encoding for CMS decryption. * Reliability fix - Fix off-by-one error in the X.509 verifier depth checking. This can From 0e49605df08028305aa63db3ebffe855638bda61 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 16 Apr 2026 04:17:34 -0600 Subject: [PATCH 1148/1283] Update ChangeLog --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 938f46c7b8..35dc421065 100644 --- a/ChangeLog +++ b/ChangeLog @@ -116,6 +116,9 @@ LibreSSL Portable Release Notes: has enabled Delta CRL checking by setting X509_V_FLAG_USE_DELTAS. - Fix NULL dereference that can be triggered with malformed OAEP parameter encoding for CMS decryption. + - Add missing length checks before BIO_new_mem_buf() in libtls. + - Improve libtls error reporting consistency, avoid reporting + unrelated errnos. * Reliability fix - Fix off-by-one error in the X.509 verifier depth checking. This can lead to a 4-byte overwrite on heap allocated memory for clients From 28f6810732328e36557b5220e51cad7eaba8dea9 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Thu, 16 Apr 2026 14:23:03 +0200 Subject: [PATCH 1149/1283] ChangeLog: add SAN dNSName fix --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 35dc421065..d8eea1c80b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -119,6 +119,9 @@ LibreSSL Portable Release Notes: - Add missing length checks before BIO_new_mem_buf() in libtls. - Improve libtls error reporting consistency, avoid reporting unrelated errnos. + - Fix SAN dNSName constraints: instead of substring matching, + match exactly and allow zero or more components in front of + the candidate. * Reliability fix - Fix off-by-one error in the X.509 verifier depth checking. This can lead to a 4-byte overwrite on heap allocated memory for clients From 7dadf8b5ae2d338ec7b70a4b8584373303beec5e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 19 Apr 2026 02:13:33 +0200 Subject: [PATCH 1150/1283] Add missing to tls_keypair.c Fixes #1249 #1250 --- patches/tls_keypair.c.patch | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 patches/tls_keypair.c.patch diff --git a/patches/tls_keypair.c.patch b/patches/tls_keypair.c.patch new file mode 100644 index 0000000000..edd0ee5d5f --- /dev/null +++ b/patches/tls_keypair.c.patch @@ -0,0 +1,11 @@ +--- tls/tls_keypair.c.orig Sun Apr 19 02:12:25 2026 ++++ tls/tls_keypair.c Sun Apr 19 02:12:33 2026 +@@ -15,6 +15,8 @@ + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + ++#include ++ + #include + #include + #include From 631631f7f8163c32050f6c78e6427bb4f4c72a72 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sat, 18 Apr 2026 19:22:39 -0500 Subject: [PATCH 1151/1283] LibreSSL 3.4.1 --- patches/opensslv.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 patches/opensslv.h diff --git a/patches/opensslv.h b/patches/opensslv.h new file mode 100644 index 0000000000..20a9261520 --- /dev/null +++ b/patches/opensslv.h @@ -0,0 +1,18 @@ +/* $OpenBSD: opensslv.h,v 1.82 2026/04/08 05:30:20 tb Exp $ */ +#ifndef HEADER_OPENSSLV_H +#define HEADER_OPENSSLV_H + +/* These will change with each release of LibreSSL-portable */ +#define LIBRESSL_VERSION_NUMBER 0x4030100fL +/* ^ Patch starts here */ +#define LIBRESSL_VERSION_TEXT "LibreSSL 4.3.1" + +/* These will never change */ +#define OPENSSL_VERSION_NUMBER 0x20000000L +#define OPENSSL_VERSION_TEXT LIBRESSL_VERSION_TEXT +#define OPENSSL_VERSION_PTEXT " part of " OPENSSL_VERSION_TEXT + +#define SHLIB_VERSION_HISTORY "" +#define SHLIB_VERSION_NUMBER "1.0.0" + +#endif /* HEADER_OPENSSLV_H */ From 87b017d54d7e5e9010d7126eefdad900425bce01 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sat, 18 Apr 2026 19:56:48 -0500 Subject: [PATCH 1152/1283] update for release --- ChangeLog | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index d8eea1c80b..6d5d8604c2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,7 +28,14 @@ history is also available from Git. LibreSSL Portable Release Notes: -4.3.0 - In development +4.4.0 - In Development + +4.3.1 - Development Release + + * Portable Changes + - Add missing to fix build on some OS. + +4.3.0 - Development Release * Internal improvements - Remove the unused sequence number from X509_REVOKED. From 47003a364c2f62482a0f8e8f9090269937384099 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 19 Apr 2026 12:07:09 +0200 Subject: [PATCH 1153/1283] Allow building on AIX From @AIIleG in #1116 Fixes #1116 --- include/compat/endian.h | 67 +++++++++++++++++++++++++++++++++++++++++ include/compat/syslog.h | 20 ++++++++++++ 2 files changed, 87 insertions(+) diff --git a/include/compat/endian.h b/include/compat/endian.h index af3664da4c..89c83fc715 100644 --- a/include/compat/endian.h +++ b/include/compat/endian.h @@ -158,4 +158,71 @@ #define htobe64(x) BE_64(x) #endif +#ifdef _AIX /* AIX is always big endian */ +#include +#include + +static inline uint64_t htole64(uint64_t x) { +#ifdef __BYTE_ORDER__ +#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ + return x; +#else + return ((uint64_t)x << 56) | + (((uint64_t)x & 0xFF00ULL) << 40) | + (((uint64_t)x & 0xFF0000ULL) << 24) | + (((uint64_t)x & 0xFF000000ULL) << 8) | + (((uint64_t)x & 0xFF00000000ULL) >> 8) | + (((uint64_t)x & 0xFF0000000000ULL) >> 24) | + (((uint64_t)x & 0xFF000000000000ULL) >> 40) | + ((uint64_t)x >> 56); +#endif +#else + /* Fallback for systems without __BYTE_ORDER__ */ + union { + uint64_t u64; + unsigned char bytes[8]; + } val; + val.u64 = x; + return ((uint64_t)val.bytes[0] << 56) | + ((uint64_t)val.bytes[1] << 48) | + ((uint64_t)val.bytes[2] << 40) | + ((uint64_t)val.bytes[3] << 32) | + ((uint64_t)val.bytes[4] << 24) | + ((uint64_t)val.bytes[5] << 16) | + ((uint64_t)val.bytes[6] << 8) | + (uint64_t)val.bytes[7]; +#endif +} + +#define be64toh(x) (x) +#define be32toh(x) (x) +#define be16toh(x) (x) +#define le32toh(x) \ + ((((x) & 0xff) << 24) | \ + (((x) & 0xff00) << 8) | \ + (((x) & 0xff0000) >> 8) | \ + (((x) & 0xff000000) >> 24)) +#define le64toh(x) \ + ((((x) & 0x00000000000000ffL) << 56) | \ + (((x) & 0x000000000000ff00L) << 40) | \ + (((x) & 0x0000000000ff0000L) << 24) | \ + (((x) & 0x00000000ff000000L) << 8) | \ + (((x) & 0x000000ff00000000L) >> 8) | \ + (((x) & 0x0000ff0000000000L) >> 24) | \ + (((x) & 0x00ff000000000000L) >> 40) | \ + (((x) & 0xff00000000000000L) >> 56)) +#ifndef htobe64 +#define htobe64(x) be64toh(x) +#endif +#ifndef htobe32 +#define htobe32(x) be32toh(x) +#endif +#ifndef htobe16 +#define htobe16(x) be16toh(x) +#endif +#ifndef htole32 +#define htole32(x) le32toh(x) +#endif +#endif + #endif diff --git a/include/compat/syslog.h b/include/compat/syslog.h index c7a2608bdc..3528eb36ac 100644 --- a/include/compat/syslog.h +++ b/include/compat/syslog.h @@ -36,3 +36,23 @@ void vsyslog_r(int, struct syslog_data *, const char *, va_list); #endif #endif + +#ifdef _AIX +#ifdef HAVE_SYSLOG +#include +void vsyslog(int facility_priority, const char *format, va_list arglist) { + char *msg = NULL; + vasprintf(&msg, format, arglist); + + if (!msg) + return; + + syslog(facility_priority, "%s", msg); + free(msg); +} +#endif /* HAVE_SYSLOG */ + +void vsyslog_r(int pri, struct syslog_data *data, const char *fmt, va_list ap) { + vsyslog(pri, fmt, ap); +} +#endif /* AIX */ From 4c2a9c2157b2b90c5d1a17ab3b9a0f6dce9f7a3b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 20 Apr 2026 06:35:45 +0200 Subject: [PATCH 1154/1283] remove upstreamed tls_keypair patch --- patches/tls_keypair.c.patch | 11 ----------- 1 file changed, 11 deletions(-) delete mode 100644 patches/tls_keypair.c.patch diff --git a/patches/tls_keypair.c.patch b/patches/tls_keypair.c.patch deleted file mode 100644 index edd0ee5d5f..0000000000 --- a/patches/tls_keypair.c.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- tls/tls_keypair.c.orig Sun Apr 19 02:12:25 2026 -+++ tls/tls_keypair.c Sun Apr 19 02:12:33 2026 -@@ -15,6 +15,8 @@ - * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. - */ - -+#include -+ - #include - #include - #include From ee50a4f4801da04db0d551b3abc6ee96849aa48e Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 20 Apr 2026 10:12:25 +0200 Subject: [PATCH 1155/1283] Remove upstreamed patch --- patches/mlkem_internal.h.patch | 11 ----------- 1 file changed, 11 deletions(-) delete mode 100644 patches/mlkem_internal.h.patch diff --git a/patches/mlkem_internal.h.patch b/patches/mlkem_internal.h.patch deleted file mode 100644 index ee25521020..0000000000 --- a/patches/mlkem_internal.h.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- crypto/mlkem/mlkem_internal.h.orig Fri Oct 24 07:06:10 2025 -+++ crypto/mlkem/mlkem_internal.h Fri Oct 24 07:06:22 2025 -@@ -20,7 +20,7 @@ - #define OPENSSL_HEADER_CRYPTO_MLKEM_INTERNAL_H - - #include "bytestring.h" --#include "mlkem.h" -+#include - - #if defined(__cplusplus) - extern "C" { From 70f2b01b072fb7afa86b0820b1a31dfacbc01715 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 20 Apr 2026 10:25:05 +0000 Subject: [PATCH 1156/1283] ci: update actions/checkout action to v6.0.2 --- .github/workflows/android.yml | 2 +- .github/workflows/cmake-config.yml | 2 +- .github/workflows/coverity.yml | 2 +- .github/workflows/emscripten.yml | 4 ++-- .github/workflows/fedora-rawhide.yml | 2 +- .github/workflows/freebsd.yml | 4 ++-- .github/workflows/linux.yml | 4 ++-- .github/workflows/macos.yml | 2 +- .github/workflows/release.yml | 4 ++-- .github/workflows/rust-openssl.yml | 2 +- .github/workflows/solaris.yml | 2 +- .github/workflows/windows.yml | 2 +- 12 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index 976f2d31cc..0f01e6be99 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -25,7 +25,7 @@ jobs: max-nal: 30 steps: - name: "Checkout repository" - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Run CI script" run: ./scripts/test diff --git a/.github/workflows/cmake-config.yml b/.github/workflows/cmake-config.yml index 0de7b4f310..5e896a88d2 100644 --- a/.github/workflows/cmake-config.yml +++ b/.github/workflows/cmake-config.yml @@ -24,7 +24,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Setup Windows dependencies" if: runner.os == 'Windows' diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 3cc0560223..09ab124c93 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -19,7 +19,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Install dependencies" run: | diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml index 2de51e090a..c0b4027118 100644 --- a/.github/workflows/emscripten.yml +++ b/.github/workflows/emscripten.yml @@ -20,7 +20,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Setup emsdk" uses: mymindstorm/setup-emsdk@6ab9eb1bda2574c4ddb79809fc9247783eaf9021 # v14 @@ -48,7 +48,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Setup emsdk" uses: mymindstorm/setup-emsdk@6ab9eb1bda2574c4ddb79809fc9247783eaf9021 # v14 diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index fbcf0556c2..0268853fd0 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -23,7 +23,7 @@ jobs: container: image: fedora:rawhide steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install dependencies run: | dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index fe6c258f47..2350b8ac5b 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -22,7 +22,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Setup" run: | @@ -49,7 +49,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Setup" run: | diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index d901cf9767..fa512f8765 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -44,7 +44,7 @@ jobs: steps: - name: "Checkout repository" - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Run tests" run: ./scripts/test || (status=$?; cat tests/test-suite.log; exit $status) @@ -66,7 +66,7 @@ jobs: os: ["ubuntu-24.04", "ubuntu-24.04-arm"] steps: - name: "Checkout repository" - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Run tests" run: ./scripts/test diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index abd577d2c6..595809223e 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -28,7 +28,7 @@ jobs: run: brew install automake libtool - name: "Checkout repository" - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Run tests" run: ./scripts/test diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a20bf7dad6..ea85c4f842 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,7 +20,7 @@ jobs: upload_url: "${{ steps.create_release.outputs.upload_url }}" steps: - name: "Checkout repository" - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Generate version changelog" run: .github/scripts/changelog.sh "$VERSION" > release-changelog.txt @@ -43,7 +43,7 @@ jobs: arch: [ "Win32", "x64", "ARM64" ] steps: - name: "Checkout repository" - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Setup MSYS2" uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0 diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index ed77dbba60..68fbb3339b 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -19,7 +19,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Build LibreSSL" run: | diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index a4355d0e65..ca70fa870a 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -19,7 +19,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Setup" run: | diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 3880a7bcbd..9863212692 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -32,7 +32,7 @@ jobs: generator: "Visual Studio 17 2022" steps: - name: "Checkout repository" - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Setup MSYS2" uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0 From ea055999738ca1077763d96880a487bde934f1e6 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 20 Apr 2026 10:25:12 +0000 Subject: [PATCH 1157/1283] ci: update github/codeql-action action to v4.35.2 --- .github/workflows/cifuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 91ee288327..49b4c70ab6 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -39,7 +39,7 @@ jobs: path: "./out/artifacts" - name: "Upload SARIF" - uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 + uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2 if: always() && steps.build.outcome == 'success' with: sarif_file: "cifuzz-sarif/results.sarif" From d9922f31a0968b8d8eef595071ebae939c853d90 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 20 Apr 2026 10:25:20 +0000 Subject: [PATCH 1158/1283] ci: update msys2/setup-msys2 action to v2.31.0 --- .github/workflows/cmake-config.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/windows.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cmake-config.yml b/.github/workflows/cmake-config.yml index 0de7b4f310..3bf6fc9582 100644 --- a/.github/workflows/cmake-config.yml +++ b/.github/workflows/cmake-config.yml @@ -28,7 +28,7 @@ jobs: - name: "Setup Windows dependencies" if: runner.os == 'Windows' - uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0 + uses: msys2/setup-msys2@cafece8e6baf9247cf9b1bf95097b0b983cc558d # v2.31.0 with: update: true install: >- diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a20bf7dad6..3b37876c36 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -46,7 +46,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Setup MSYS2" - uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0 + uses: msys2/setup-msys2@cafece8e6baf9247cf9b1bf95097b0b983cc558d # v2.31.0 with: update: true install: >- diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 3880a7bcbd..b1211b03dd 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -35,7 +35,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Setup MSYS2" - uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0 + uses: msys2/setup-msys2@cafece8e6baf9247cf9b1bf95097b0b983cc558d # v2.31.0 with: update: true install: >- From 5640b7610cf22b84a9fb7372c0730b2c6c9d24ca Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 20 Apr 2026 10:25:27 +0000 Subject: [PATCH 1159/1283] ci: update vmactions/freebsd-vm action to v1.4.5 --- .github/workflows/freebsd.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index fe6c258f47..1e744f0e7d 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -31,7 +31,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@670398e4236735b8b65805c3da44b7a511fb8b27 # v1.3.0 + uses: vmactions/freebsd-vm@d1e65811565151536c0c894fff74f06351ed26e6 # v1.4.5 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false @@ -58,7 +58,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@670398e4236735b8b65805c3da44b7a511fb8b27 # v1.3.0 + uses: vmactions/freebsd-vm@d1e65811565151536c0c894fff74f06351ed26e6 # v1.4.5 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false From da835f651fc01a8e0320d77093cd8a605c56d251 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 20 Apr 2026 10:25:35 +0000 Subject: [PATCH 1160/1283] ci: update vmactions/solaris-vm action to v1.3.3 --- .github/workflows/solaris.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index a4355d0e65..b2ab1cb4bb 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -28,7 +28,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/solaris-vm@47bea106d03acaf91084e52548ee460556011602 # v1.1.8 + uses: vmactions/solaris-vm@c20562b2c69737b06be9e828915761703e487373 # v1.3.3 with: prepare: | pkg install gcc make From d5481718c63e947095db839ff36708029c06f6ce Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 20 Apr 2026 10:25:43 +0000 Subject: [PATCH 1161/1283] ci: update actions/upload-artifact action to v7 --- .github/workflows/cifuzz.yml | 2 +- .github/workflows/windows.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 91ee288327..6d43c1de40 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -32,7 +32,7 @@ jobs: output-sarif: true - name: "Upload Crash" - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: failure() && steps.build.outcome == 'success' with: name: "artifacts" diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 3880a7bcbd..271e433de8 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -64,7 +64,7 @@ jobs: - name: "Upload build artifacts" if: always() - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: "${{ matrix.os }}-${{ matrix.arch }}${{ matrix.shared == 'ON' && '-shared' || '' }}-build-results" path: "build" From bffa7fe170a728fd2891b4df68ecf729718f2c37 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 20 Apr 2026 10:25:49 +0000 Subject: [PATCH 1162/1283] ci: update mymindstorm/setup-emsdk action to v16 --- .github/workflows/emscripten.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml index 2de51e090a..6d084766bd 100644 --- a/.github/workflows/emscripten.yml +++ b/.github/workflows/emscripten.yml @@ -23,7 +23,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Setup emsdk" - uses: mymindstorm/setup-emsdk@6ab9eb1bda2574c4ddb79809fc9247783eaf9021 # v14 + uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16 with: version: "3.1.60" @@ -51,7 +51,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Setup emsdk" - uses: mymindstorm/setup-emsdk@6ab9eb1bda2574c4ddb79809fc9247783eaf9021 # v14 + uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16 with: version: "3.1.60" From b5d127e82168b50ee391ea30cdf9eeb11a70940f Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 23 Apr 2026 13:11:18 +0000 Subject: [PATCH 1163/1283] ci: update softprops/action-gh-release action to v3 --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3dd39e079a..a12d34438b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -29,7 +29,7 @@ jobs: - name: "Create GitHub release" id: create_release - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3 with: body_path: "${{ github.workspace }}/release-changelog.txt" @@ -75,7 +75,7 @@ jobs: run: Compress-Archive -Path local\* "libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip" - name: "Upload release artifact" - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3 with: files: | libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip From 973bc613e1f9cfa50a0c34f1e0a00ed99c558060 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 25 Apr 2026 01:34:08 +0000 Subject: [PATCH 1164/1283] ci: pin fedora Docker tag to af8cdc4 --- .github/workflows/fedora-rawhide.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index 0268853fd0..1ee97a048b 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -21,7 +21,7 @@ jobs: runs-on: ubuntu-24.04 if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} container: - image: fedora:rawhide + image: fedora:rawhide@sha256:af8cdc432037f5e8e288bbc26c2b55b96000a911ec5b37959cd464d830f6cc5b steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install dependencies From e2f238a6d40cbfb77a214158b4405cbdd045f5e5 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 25 Apr 2026 01:34:16 +0000 Subject: [PATCH 1165/1283] ci: update msys2/setup-msys2 action to v2.31.1 --- .github/workflows/cmake-config.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/windows.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cmake-config.yml b/.github/workflows/cmake-config.yml index 3f11cb4b0e..32ec81cab0 100644 --- a/.github/workflows/cmake-config.yml +++ b/.github/workflows/cmake-config.yml @@ -28,7 +28,7 @@ jobs: - name: "Setup Windows dependencies" if: runner.os == 'Windows' - uses: msys2/setup-msys2@cafece8e6baf9247cf9b1bf95097b0b983cc558d # v2.31.0 + uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1 with: update: true install: >- diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3dd39e079a..5af7669bb2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -46,7 +46,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Setup MSYS2" - uses: msys2/setup-msys2@cafece8e6baf9247cf9b1bf95097b0b983cc558d # v2.31.0 + uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1 with: update: true install: >- diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 4a2ceadd94..59c1f0e17c 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -35,7 +35,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: "Setup MSYS2" - uses: msys2/setup-msys2@cafece8e6baf9247cf9b1bf95097b0b983cc558d # v2.31.0 + uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1 with: update: true install: >- From 00af7aededef2d32034cefaae9e23d8f3890b56a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 26 Apr 2026 01:44:04 -0600 Subject: [PATCH 1166/1283] Start ChangeLog for 4.4 --- ChangeLog | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/ChangeLog b/ChangeLog index 6d5d8604c2..a2802518dd 100644 --- a/ChangeLog +++ b/ChangeLog @@ -30,6 +30,16 @@ LibreSSL Portable Release Notes: 4.4.0 - In Development + * Internal improvements + - Minor code cleanup for PKCS#7. + * Compatibility changes + * New features + * Bug fixes + - Fix PKCS7_set_{un,}signed_attributes() to allow caller to free + on failure rather than risking a double free. + * Testing and proactive security + - Improved test coverage for DTLS. + 4.3.1 - Development Release * Portable Changes From 7fc4c0cc78e57b0146bd5f80ce0c4d50013d5974 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 26 Apr 2026 09:57:48 +0200 Subject: [PATCH 1167/1283] Link DTLS wire test to build --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index eaf4ed198a..a2c619273f 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -415,6 +415,11 @@ add_platform_test(dsatest dsatest) # set_tests_properties(dtlstest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # endif() +# dtls_wire_test +add_executable(dtls_wire_test dtls_wire_test.c) +target_link_libraries(dtls_wire_test ${OPENSSL_TEST_LIBS}) +add_platform_test(dtls_wire_test dtls_wire_test) + # ecc_cdh add_executable(ecc_cdh ecc_cdh.c) target_link_libraries(ecc_cdh ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 22e3dee6f0..d49b4314e6 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -431,6 +431,11 @@ dsatest_SOURCES = dsatest.c #endif #EXTRA_DIST += dtlstest.sh +# dtls_wire_test +TESTS += dtls_wire_test +check_PROGRAMS += dtls_wire_test +dtls_wire_test_SOURCES = dtls_wire_test.c + # ecc_cdh TESTS += ecc_cdh check_PROGRAMS += ecc_cdh From 75e62709f161d4f5f2bc1202bb7e4e906b4aaa91 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Thu, 30 Apr 2026 15:00:14 +0900 Subject: [PATCH 1168/1283] Do not override user CFLAGS/LDFLAGS in hardening flag detection `CHECK_CFLAG` / `CHECK_LDFLAG` overwrote `CFLAGS`/`LDFLAGS` with only the flag under test, so feature detection ran with a different target than the real build. For example `CFLAGS=-march=i586 ./configure` accepted `-fcf-protection=full` (detected under the toolchain's i686 default) but then failed to compile because GCC 15 rejects `-fcf-protection` on i586. Prepend `$USER_CFLAGS` / `$USER_LDFLAGS` (saved before `AC_PROG_CC`) to the detection command so the probe matches the real build. Fixes #1268 --- configure.ac | 1 + m4/check-hardening-options.m4 | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index eb2b9ceae9..c0ad0336c2 100644 --- a/configure.ac +++ b/configure.ac @@ -26,6 +26,7 @@ m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])]) # This must be saved before AC_PROG_CC USER_CFLAGS="$CFLAGS" +USER_LDFLAGS="$LDFLAGS" AC_PROG_CC([cc gcc]) AM_PROG_CC_C_O diff --git a/m4/check-hardening-options.m4 b/m4/check-hardening-options.m4 index 2cb3083788..401b7e46b0 100644 --- a/m4/check-hardening-options.m4 +++ b/m4/check-hardening-options.m4 @@ -3,7 +3,7 @@ AC_DEFUN([CHECK_CFLAG], [ AC_LANG_ASSERT(C) AC_MSG_CHECKING([if $saved_CC supports "$1"]) old_cflags="$CFLAGS" - CFLAGS="$1 -Wall -Werror" + CFLAGS="$USER_CFLAGS $1 -Wall -Werror" AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]], [[printf("Hello")]])], [AC_MSG_RESULT([yes]) CFLAGS=$old_cflags @@ -17,7 +17,7 @@ AC_DEFUN([CHECK_LDFLAG], [ AC_LANG_ASSERT(C) AC_MSG_CHECKING([if $saved_LD supports "$1"]) old_ldflags="$LDFLAGS" - LDFLAGS="$1 -Wall -Werror" + LDFLAGS="$USER_LDFLAGS $1 -Wall -Werror" AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]], [[printf("Hello")]])], [AC_MSG_RESULT([yes]) LDFLAGS=$old_ldflags From d916aefb321089ee19afd7473c0c6e8ef0c84dfa Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 2 May 2026 01:31:32 +0000 Subject: [PATCH 1169/1283] ci: update fedora:rawhide Docker digest to 8b838b3 --- .github/workflows/fedora-rawhide.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index 1ee97a048b..b551c5fb0f 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -21,7 +21,7 @@ jobs: runs-on: ubuntu-24.04 if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} container: - image: fedora:rawhide@sha256:af8cdc432037f5e8e288bbc26c2b55b96000a911ec5b37959cd464d830f6cc5b + image: fedora:rawhide@sha256:8b838b3253cb855b1e5c3e1366fd0cda28cd1cc4c3517d625847172fd4ac6869 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install dependencies From e0048ecd5f885d544de998ec03daf7aee63c958a Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sun, 3 May 2026 03:02:13 -0600 Subject: [PATCH 1170/1283] Update ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index a2802518dd..8446188a85 100644 --- a/ChangeLog +++ b/ChangeLog @@ -32,6 +32,8 @@ LibreSSL Portable Release Notes: * Internal improvements - Minor code cleanup for PKCS#7. + - Clear unused bits for the maximum of RFC 3779 IP address ranges. + - Cleanup passes over the DTLS code, avoiding many contortions. * Compatibility changes * New features * Bug fixes From 374b05d111979d32e18cf7326463b69282966d1c Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Mon, 4 May 2026 13:27:54 +0900 Subject: [PATCH 1171/1283] clean up speed alarm from timer stop on Windows The Windows speed alarm implementation owns thread and handle state that must be released after a benchmark run. Doing this from print_result() misses speed tests that report their results directly, which led to the leak reported in #1245. Release the Windows alarm resources from speed_timer_stop() after recording the elapsed time, so the cleanup follows the benchmark timer lifetime without affecting the measured result. Fix #1245 --- patches/speed.c.patch | 52 +++++++++++++++++++++++++------------------ 1 file changed, 30 insertions(+), 22 deletions(-) diff --git a/patches/speed.c.patch b/patches/speed.c.patch index 8e79f5cd08..1c3b1bf2f6 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -1,9 +1,9 @@ ---- apps/openssl/speed.c.orig 2026-04-12 11:09:28 -+++ apps/openssl/speed.c 2026-04-12 11:11:18 -@@ -156,7 +156,16 @@ static void print_result(int alg, int run_no, int coun - pkey_print_message(const char *str, const char *str2, - int bits, int sec); +--- apps/openssl/speed.c.orig 2026-05-04 13:18:12 ++++ apps/openssl/speed.c 2026-05-04 13:29:58 +@@ -158,7 +158,16 @@ static double speed_timer_stop(void); static void print_result(int alg, int run_no, int count, double time_used); + static void speed_timer_start(int seconds); + static double speed_timer_stop(void); +#ifndef _WIN32 static int do_multi(int multi); +#else @@ -17,7 +17,23 @@ #define SIZE_NUM 5 #define MAX_ECDH_SIZE 256 -@@ -1110,8 +1119,10 @@ speed_main(int argc, char **argv) +@@ -1008,7 +1017,15 @@ speed_timer_stop(void) + static double + speed_timer_stop(void) + { ++#ifndef _WIN32 + return time_f(STOP); ++#else ++ double elapsed; ++ ++ elapsed = time_f(STOP); ++ speed_alarm_free(run); ++ return elapsed; ++#endif + } + + static const int KDF1_SHA1_len = 20; +@@ -1126,8 +1143,10 @@ speed_main(int argc, char **argv) const EVP_CIPHER *evp_cipher = NULL; const EVP_MD *evp_md = NULL; int decrypt = 0; @@ -28,7 +44,7 @@ const char *errstr = NULL; if (pledge("stdio proc", NULL) == -1) { -@@ -1187,6 +1198,7 @@ speed_main(int argc, char **argv) +@@ -1203,6 +1222,7 @@ speed_main(int argc, char **argv) decrypt = 1; j--; /* Otherwise, -decrypt gets confused with an * algorithm. */ @@ -36,7 +52,7 @@ } else if (argc > 0 && strcmp(*argv, "-multi") == 0) { argc--; argv++; -@@ -1201,6 +1213,7 @@ speed_main(int argc, char **argv) +@@ -1217,6 +1237,7 @@ speed_main(int argc, char **argv) } j--; /* Otherwise, -multi gets confused with an * algorithm. */ @@ -44,7 +60,7 @@ } else if (argc > 0 && strcmp(*argv, "-unaligned") == 0) { argc--; argv++; -@@ -1524,7 +1537,9 @@ speed_main(int argc, char **argv) +@@ -1540,7 +1561,9 @@ speed_main(int argc, char **argv) BIO_printf(bio_err, "-evp e use EVP e.\n"); BIO_printf(bio_err, "-decrypt time decryption instead of encryption (only EVP).\n"); BIO_printf(bio_err, "-mr produce machine readable output.\n"); @@ -54,7 +70,7 @@ BIO_printf(bio_err, "-unaligned n use buffers with offset n from proper alignment.\n"); goto end; } -@@ -1533,8 +1548,10 @@ speed_main(int argc, char **argv) +@@ -1549,8 +1572,10 @@ speed_main(int argc, char **argv) j++; } @@ -65,7 +81,7 @@ if (j == 0) { for (i = 0; i < ALGOR_NUM; i++) { -@@ -1607,11 +1624,15 @@ speed_main(int argc, char **argv) +@@ -1623,11 +1648,15 @@ speed_main(int argc, char **argv) #define COND (run && count<0x7fffffff) #define COUNT(d) (count) @@ -81,7 +97,7 @@ #ifndef OPENSSL_NO_MD4 if (doit[D_MD4]) { -@@ -2513,7 +2534,9 @@ speed_main(int argc, char **argv) +@@ -2529,7 +2558,9 @@ speed_main(int argc, char **argv) free(ss); } @@ -91,15 +107,7 @@ if (!mr) { fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION)); fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON)); -@@ -2695,11 +2718,15 @@ print_result(int alg, int run_no, int count, double ti - static void - print_result(int alg, int run_no, int count, double time_used) - { -+#ifdef _WIN32 -+ speed_alarm_free(run); -+#endif - BIO_printf(bio_err, mr ? "+R:%d:%s:%f\n" - : "%d %s in %.2fs\n", count, names[alg], time_used); +@@ -2714,6 +2745,7 @@ print_result(int alg, int run_no, int count, double ti results[alg][run_no] = ((double) count) / time_used * lengths[run_no]; } @@ -107,7 +115,7 @@ static char * sstrsep(char **string, const char *delim) { -@@ -2900,5 +2927,6 @@ do_multi(int multi) +@@ -2914,5 +2946,6 @@ do_multi(int multi) free(fds); return 1; } From 85f4c66646e91893eb80a4c75649511a7d3c33e6 Mon Sep 17 00:00:00 2001 From: Joshua Sing Date: Mon, 4 May 2026 20:01:30 +1000 Subject: [PATCH 1172/1283] ci: rework release workflow for immutable releases Switch the release workflow to create a draft release, and upload the build artifacts to the draft, using the gh CLI instead of softprops/action-gh-release. This prepares for enabling immutable releases, which require all assets to be uploaded prior to publishing. The release process now requires a maintainer to manually publish the draft release once all CI artifacts have been uploaded and any remaining assets (e.g. the source tarball, checksums and signatures files) have been attached. While modifying release.yml: - Tighten workflow permissions: default to no permissions and grant contents: write to both jobs. - Set persist-credentials: false on actions/checkout so the GITHUB_TOKEN is not left in .git/config during runs. - Set cancel-in-progress: false to prevent a second tag push from canceling an already-running workflow and leaving a dangling release. - Move all ${{ ... }} expressions in run blocks into env to avoid shell interpolation of workflow context values. - Add name key to every step in build-windows. --- .github/workflows/release.yml | 69 ++++++++++++++++++++++++----------- 1 file changed, 47 insertions(+), 22 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 96672a454d..976467c221 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,37 +6,45 @@ on: tags: [ "v*" ] concurrency: - group: "${{ github.workflow }}-${{ github.event.number || github.ref }}" - cancel-in-progress: true + group: "${{ github.workflow }}-${{ github.ref }}" + cancel-in-progress: false -permissions: - contents: write +permissions: {} jobs: release: name: "Release" runs-on: "ubuntu-24.04" - outputs: - upload_url: "${{ steps.create_release.outputs.upload_url }}" + permissions: + contents: write # Required to create release. steps: - name: "Checkout repository" uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: "Generate version changelog" run: .github/scripts/changelog.sh "$VERSION" > release-changelog.txt env: VERSION: "${{ github.ref_name }}" - - name: "Create GitHub release" - id: create_release - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3 - with: - body_path: "${{ github.workspace }}/release-changelog.txt" + - name: "Create draft GitHub release" + env: + GH_TOKEN: "${{ github.token }}" + VERSION: "${{ github.ref_name }}" + run: | + gh release create "$VERSION" \ + --repo "$GITHUB_REPOSITORY" \ + --title "$VERSION" \ + --notes-file release-changelog.txt \ + --draft build-windows: name: "${{ matrix.os }}/${{ matrix.arch }}" runs-on: "${{ matrix.os }}" needs: ["release"] + permissions: + contents: write # Required to upload release assets. strategy: matrix: os: [ "windows-2022" ] @@ -44,6 +52,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: "Setup MSYS2" uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1 @@ -59,23 +69,38 @@ jobs: patch perl - - shell: msys2 {0} + - name: "Run autogen" + shell: msys2 {0} run: ./autogen.sh - - shell: cmd - run: cmake -Bbuild -G "Visual Studio 17 2022" -A ${{ matrix.arch }} -DCMAKE_INSTALL_PREFIX=local + - name: "Configure" + shell: pwsh + env: + ARCH: "${{ matrix.arch }}" + run: cmake -Bbuild -G "Visual Studio 17 2022" -A "${env:ARCH}" -DCMAKE_INSTALL_PREFIX=local - - shell: cmd + - name: "Build" + shell: pwsh run: cmake --build build --config Release - - shell: cmd + - name: "Install" + shell: pwsh run: cmake --install build --config Release - - shell: pwsh - run: Compress-Archive -Path local\* "libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip" + - name: "Package release artifact" + shell: pwsh + env: + VERSION: "${{ github.ref_name }}" + ARCH: "${{ matrix.arch }}" + run: Compress-Archive -Path local\* "libressl_${env:VERSION}_windows_${env:ARCH}.zip" - name: "Upload release artifact" - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3 - with: - files: | - libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip + shell: bash + env: + GH_TOKEN: "${{ github.token }}" + VERSION: "${{ github.ref_name }}" + ARCH: "${{ matrix.arch }}" + run: | + gh release upload "$VERSION" \ + --repo "$GITHUB_REPOSITORY" \ + "libressl_${VERSION}_windows_${ARCH}.zip" From 9a9aa763301afb11c1cb4b5f99aa924238f59377 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Tue, 5 May 2026 10:36:34 +0900 Subject: [PATCH 1173/1283] update patch --- patches/speed.c.patch | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/patches/speed.c.patch b/patches/speed.c.patch index 1c3b1bf2f6..5149b4e6c2 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -1,9 +1,9 @@ ---- apps/openssl/speed.c.orig 2026-05-04 13:18:12 -+++ apps/openssl/speed.c 2026-05-04 13:29:58 -@@ -158,7 +158,16 @@ static double speed_timer_stop(void); +--- apps/openssl/speed.c.orig 2026-05-05 10:27:21 ++++ apps/openssl/speed.c 2026-05-05 10:34:44 +@@ -158,7 +158,16 @@ static double speed_timer_stop(int s); static void print_result(int alg, int run_no, int count, double time_used); static void speed_timer_start(int seconds); - static double speed_timer_stop(void); + static double speed_timer_stop(int s); +#ifndef _WIN32 static int do_multi(int multi); +#else @@ -17,23 +17,23 @@ #define SIZE_NUM 5 #define MAX_ECDH_SIZE 256 -@@ -1008,7 +1017,15 @@ speed_timer_stop(void) +@@ -1005,7 +1014,15 @@ speed_timer_stop(int s) static double - speed_timer_stop(void) + speed_timer_stop(int s) { +#ifndef _WIN32 - return time_f(STOP); + return time_f(s); +#else -+ double elapsed; ++ double elapsed; + -+ elapsed = time_f(STOP); ++ elapsed = time_f(s); + speed_alarm_free(run); + return elapsed; +#endif } static const int KDF1_SHA1_len = 20; -@@ -1126,8 +1143,10 @@ speed_main(int argc, char **argv) +@@ -1123,8 +1140,10 @@ speed_main(int argc, char **argv) const EVP_CIPHER *evp_cipher = NULL; const EVP_MD *evp_md = NULL; int decrypt = 0; @@ -44,7 +44,7 @@ const char *errstr = NULL; if (pledge("stdio proc", NULL) == -1) { -@@ -1203,6 +1222,7 @@ speed_main(int argc, char **argv) +@@ -1200,6 +1219,7 @@ speed_main(int argc, char **argv) decrypt = 1; j--; /* Otherwise, -decrypt gets confused with an * algorithm. */ @@ -52,7 +52,7 @@ } else if (argc > 0 && strcmp(*argv, "-multi") == 0) { argc--; argv++; -@@ -1217,6 +1237,7 @@ speed_main(int argc, char **argv) +@@ -1214,6 +1234,7 @@ speed_main(int argc, char **argv) } j--; /* Otherwise, -multi gets confused with an * algorithm. */ @@ -60,7 +60,7 @@ } else if (argc > 0 && strcmp(*argv, "-unaligned") == 0) { argc--; argv++; -@@ -1540,7 +1561,9 @@ speed_main(int argc, char **argv) +@@ -1537,7 +1558,9 @@ speed_main(int argc, char **argv) BIO_printf(bio_err, "-evp e use EVP e.\n"); BIO_printf(bio_err, "-decrypt time decryption instead of encryption (only EVP).\n"); BIO_printf(bio_err, "-mr produce machine readable output.\n"); @@ -70,7 +70,7 @@ BIO_printf(bio_err, "-unaligned n use buffers with offset n from proper alignment.\n"); goto end; } -@@ -1549,8 +1572,10 @@ speed_main(int argc, char **argv) +@@ -1546,8 +1569,10 @@ speed_main(int argc, char **argv) j++; } @@ -81,7 +81,7 @@ if (j == 0) { for (i = 0; i < ALGOR_NUM; i++) { -@@ -1623,11 +1648,15 @@ speed_main(int argc, char **argv) +@@ -1620,11 +1645,15 @@ speed_main(int argc, char **argv) #define COND (run && count<0x7fffffff) #define COUNT(d) (count) @@ -97,7 +97,7 @@ #ifndef OPENSSL_NO_MD4 if (doit[D_MD4]) { -@@ -2529,7 +2558,9 @@ speed_main(int argc, char **argv) +@@ -2526,7 +2555,9 @@ speed_main(int argc, char **argv) free(ss); } @@ -107,7 +107,7 @@ if (!mr) { fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION)); fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON)); -@@ -2714,6 +2745,7 @@ print_result(int alg, int run_no, int count, double ti +@@ -2711,6 +2742,7 @@ print_result(int alg, int run_no, int count, double ti results[alg][run_no] = ((double) count) / time_used * lengths[run_no]; } @@ -115,7 +115,7 @@ static char * sstrsep(char **string, const char *delim) { -@@ -2914,5 +2946,6 @@ do_multi(int multi) +@@ -2911,5 +2943,6 @@ do_multi(int multi) free(fds); return 1; } From a24d0f296057a861cafdd16167e1447a86f3eeaf Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Tue, 5 May 2026 10:52:02 +0900 Subject: [PATCH 1174/1283] tiny update --- patches/speed.c.patch | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/patches/speed.c.patch b/patches/speed.c.patch index 5149b4e6c2..4efc65c0db 100644 --- a/patches/speed.c.patch +++ b/patches/speed.c.patch @@ -1,8 +1,8 @@ ---- apps/openssl/speed.c.orig 2026-05-05 10:27:21 -+++ apps/openssl/speed.c 2026-05-05 10:34:44 +--- apps/openssl/speed.c.orig 2026-05-05 10:50:46 ++++ apps/openssl/speed.c 2026-05-05 10:51:24 @@ -158,7 +158,16 @@ static double speed_timer_stop(int s); static void print_result(int alg, int run_no, int count, double time_used); - static void speed_timer_start(int seconds); + static void speed_timer_start(int s); static double speed_timer_stop(int s); +#ifndef _WIN32 static int do_multi(int multi); From 9fc190a0f51740d4c182b99d2132ce7ba434f763 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 9 May 2026 01:50:19 +0000 Subject: [PATCH 1175/1283] ci: update github/codeql-action action to v4.35.3 --- .github/workflows/cifuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 51270ac83e..68b45d0752 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -39,7 +39,7 @@ jobs: path: "./out/artifacts" - name: "Upload SARIF" - uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2 + uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 if: always() && steps.build.outcome == 'success' with: sarif_file: "cifuzz-sarif/results.sarif" From 55da4b8038e43256d7a4321f314d8c5f72a5fe1b Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 10 May 2026 17:53:40 +0000 Subject: [PATCH 1176/1283] ci: update github/codeql-action action to v4.35.4 --- .github/workflows/cifuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 68b45d0752..1968b1c7c7 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -39,7 +39,7 @@ jobs: path: "./out/artifacts" - name: "Upload SARIF" - uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 + uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 if: always() && steps.build.outcome == 'success' with: sarif_file: "cifuzz-sarif/results.sarif" From f4362d1a84717d94d75b0a965dc951ec6af1de17 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Tue, 12 May 2026 09:09:59 +0200 Subject: [PATCH 1177/1283] CI: prepare move of COVERITY_SCAN_TOKEN to environment There is no need for this to be a repository secret as only the coverity workflow needs this. --- .github/workflows/coverity.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 09ab124c93..556dd433fe 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -13,6 +13,9 @@ concurrency: jobs: scan: name: "Scan" + environment: + name: "coverity" + deployment: false runs-on: "ubuntu-24.04" if: github.repository_owner == 'libressl' # Prevent running on forks permissions: From 11823973a1e4ee1ba3801fdca727f724218b5606 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 23 May 2026 01:47:18 +0000 Subject: [PATCH 1178/1283] ci: update github/codeql-action action to v4.35.5 --- .github/workflows/cifuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 1968b1c7c7..4dd9edc912 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -39,7 +39,7 @@ jobs: path: "./out/artifacts" - name: "Upload SARIF" - uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 + uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 if: always() && steps.build.outcome == 'success' with: sarif_file: "cifuzz-sarif/results.sarif" From 786c78db179eb2a2816aa4c458cf34508524c0e7 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Sat, 23 May 2026 00:01:43 -0600 Subject: [PATCH 1179/1283] Link dtls12_handshake_msg.c to the bulid --- ssl/CMakeLists.txt | 1 + ssl/Makefile.am | 2 ++ 2 files changed, 3 insertions(+) diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt index 9ab7e43e95..424d63918c 100644 --- a/ssl/CMakeLists.txt +++ b/ssl/CMakeLists.txt @@ -20,6 +20,7 @@ set( d1_lib.c d1_pkt.c d1_srtp.c + dtls12_handshake_msg.c pqueue.c s3_cbc.c s3_lib.c diff --git a/ssl/Makefile.am b/ssl/Makefile.am index 4ec738cf39..2a1c848db6 100644 --- a/ssl/Makefile.am +++ b/ssl/Makefile.am @@ -71,6 +71,7 @@ libssl_la_SOURCES += d1_both.c libssl_la_SOURCES += d1_lib.c libssl_la_SOURCES += d1_pkt.c libssl_la_SOURCES += d1_srtp.c +libssl_la_SOURCES += dtls12_handshake_msg.c libssl_la_SOURCES += pqueue.c libssl_la_SOURCES += s3_cbc.c libssl_la_SOURCES += s3_lib.c @@ -118,6 +119,7 @@ libssl_la_SOURCES += tls13_record_layer.c libssl_la_SOURCES += tls13_server.c noinst_HEADERS += srtp.h +noinst_HEADERS += dtls12_internal.h noinst_HEADERS += dtls_local.h noinst_HEADERS += ssl_local.h noinst_HEADERS += ssl_sigalgs.h From aa784ae2454998ef5abc17695ec2cfba513c55a1 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 25 May 2026 21:45:45 -0500 Subject: [PATCH 1180/1283] allow releases to be retriggered on failure This just gives us a manual rerun option. --- .github/workflows/release.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 976467c221..c4a57d85eb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,6 +4,7 @@ name: "Release" on: push: tags: [ "v*" ] + workflow_dispatch: concurrency: group: "${{ github.workflow }}-${{ github.ref }}" From 1db922515aeed606256567e3cd13555fcabfd816 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 27 May 2026 01:42:49 +0000 Subject: [PATCH 1181/1283] ci: update vmactions/solaris-vm action to v1.3.4 --- .github/workflows/solaris.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index 78c5901cbd..20658b3313 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -28,7 +28,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/solaris-vm@c20562b2c69737b06be9e828915761703e487373 # v1.3.3 + uses: vmactions/solaris-vm@970a329b471871f9a6765c8f166765fa4ddfb446 # v1.3.4 with: prepare: | pkg install gcc make From 3f01a1ee7730bcc543d4b81e8c83e4e66dbe6579 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 30 May 2026 00:49:30 +0000 Subject: [PATCH 1182/1283] ci: update fedora:rawhide Docker digest to 0c1f63e --- .github/workflows/fedora-rawhide.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index b551c5fb0f..0064e88911 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -21,7 +21,7 @@ jobs: runs-on: ubuntu-24.04 if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} container: - image: fedora:rawhide@sha256:8b838b3253cb855b1e5c3e1366fd0cda28cd1cc4c3517d625847172fd4ac6869 + image: fedora:rawhide@sha256:0c1f63ed8fb818fad16cf6ae091598c410a21d2e1a9adf183beb93189299bfba steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install dependencies From 36e720bddddb0d795a674079a488103193504d05 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 30 May 2026 00:49:38 +0000 Subject: [PATCH 1183/1283] ci: update vmactions/solaris-vm action to v1.3.6 --- .github/workflows/solaris.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index 20658b3313..0c37e66303 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -28,7 +28,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/solaris-vm@970a329b471871f9a6765c8f166765fa4ddfb446 # v1.3.4 + uses: vmactions/solaris-vm@3702ccf20b84c7f7c0a9bb68894aba7623f8301d # v1.3.6 with: prepare: | pkg install gcc make From fa9dd0230777d1da3aac6ebe55df69b5b8f224aa Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 30 May 2026 02:18:53 +0000 Subject: [PATCH 1184/1283] ci: update github/codeql-action action to v4.36.0 --- .github/workflows/cifuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 4dd9edc912..ecfb6e2957 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -39,7 +39,7 @@ jobs: path: "./out/artifacts" - name: "Upload SARIF" - uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 + uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 if: always() && steps.build.outcome == 'success' with: sarif_file: "cifuzz-sarif/results.sarif" From 9c7b4a90b8e942cf58f656a52cfe2ad48fee07fc Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 6 Jun 2026 02:47:03 +0000 Subject: [PATCH 1185/1283] ci: update actions/checkout action to v6.0.3 --- .github/workflows/android.yml | 2 +- .github/workflows/cmake-config.yml | 2 +- .github/workflows/coverity.yml | 2 +- .github/workflows/emscripten.yml | 4 ++-- .github/workflows/fedora-rawhide.yml | 2 +- .github/workflows/freebsd.yml | 4 ++-- .github/workflows/linux.yml | 4 ++-- .github/workflows/macos.yml | 2 +- .github/workflows/release.yml | 4 ++-- .github/workflows/rust-openssl.yml | 2 +- .github/workflows/solaris.yml | 2 +- .github/workflows/windows.yml | 2 +- 12 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index 0f01e6be99..0a4de58b1b 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -25,7 +25,7 @@ jobs: max-nal: 30 steps: - name: "Checkout repository" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: "Run CI script" run: ./scripts/test diff --git a/.github/workflows/cmake-config.yml b/.github/workflows/cmake-config.yml index 32ec81cab0..57125bccfd 100644 --- a/.github/workflows/cmake-config.yml +++ b/.github/workflows/cmake-config.yml @@ -24,7 +24,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: "Setup Windows dependencies" if: runner.os == 'Windows' diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 556dd433fe..068e73b637 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -22,7 +22,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: "Install dependencies" run: | diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml index 0b46ef2423..bddd4b7234 100644 --- a/.github/workflows/emscripten.yml +++ b/.github/workflows/emscripten.yml @@ -20,7 +20,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: "Setup emsdk" uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16 @@ -48,7 +48,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: "Setup emsdk" uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16 diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index 0064e88911..bcf0fe68d6 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -23,7 +23,7 @@ jobs: container: image: fedora:rawhide@sha256:0c1f63ed8fb818fad16cf6ae091598c410a21d2e1a9adf183beb93189299bfba steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Install dependencies run: | dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index cce0f332f0..589bea6b1a 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -22,7 +22,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: "Setup" run: | @@ -49,7 +49,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: "Setup" run: | diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index fa512f8765..1d531e150c 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -44,7 +44,7 @@ jobs: steps: - name: "Checkout repository" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: "Run tests" run: ./scripts/test || (status=$?; cat tests/test-suite.log; exit $status) @@ -66,7 +66,7 @@ jobs: os: ["ubuntu-24.04", "ubuntu-24.04-arm"] steps: - name: "Checkout repository" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: "Run tests" run: ./scripts/test diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index 595809223e..4383e3803c 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -28,7 +28,7 @@ jobs: run: brew install automake libtool - name: "Checkout repository" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: "Run tests" run: ./scripts/test diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c4a57d85eb..d4278b7b02 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,7 +20,7 @@ jobs: contents: write # Required to create release. steps: - name: "Checkout repository" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -52,7 +52,7 @@ jobs: arch: [ "Win32", "x64", "ARM64" ] steps: - name: "Checkout repository" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index 68fbb3339b..b378752cf2 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -19,7 +19,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: "Build LibreSSL" run: | diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index 0c37e66303..9f856c9e7c 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -19,7 +19,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: "Setup" run: | diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 59c1f0e17c..cdfdd2599e 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -32,7 +32,7 @@ jobs: generator: "Visual Studio 17 2022" steps: - name: "Checkout repository" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: "Setup MSYS2" uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1 From 3b4f26865a7c6ba9f9226426589f2b9ce127083e Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 6 Jun 2026 02:47:11 +0000 Subject: [PATCH 1186/1283] ci: update github/codeql-action action to v4.36.1 --- .github/workflows/cifuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index ecfb6e2957..e24e61ac83 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -39,7 +39,7 @@ jobs: path: "./out/artifacts" - name: "Upload SARIF" - uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 + uses: github/codeql-action/upload-sarif@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1 if: always() && steps.build.outcome == 'success' with: sarif_file: "cifuzz-sarif/results.sarif" From 4a08685482513d08e962512e5c2f1d0135cea78d Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 6 Jun 2026 05:11:21 +0000 Subject: [PATCH 1187/1283] ci: update vmactions/freebsd-vm action to v1.4.6 --- .github/workflows/freebsd.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index cce0f332f0..f22739189d 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -31,7 +31,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@d1e65811565151536c0c894fff74f06351ed26e6 # v1.4.5 + uses: vmactions/freebsd-vm@a6de9343ef5747433d9c25784c90e84998b9d69a # v1.4.6 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false @@ -58,7 +58,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@d1e65811565151536c0c894fff74f06351ed26e6 # v1.4.5 + uses: vmactions/freebsd-vm@a6de9343ef5747433d9c25784c90e84998b9d69a # v1.4.6 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false From 379277097842e54289a988ad13872d5a2963f5c1 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 7 Jun 2026 16:46:08 +0000 Subject: [PATCH 1188/1283] ci: update github/codeql-action action to v4.36.2 --- .github/workflows/cifuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index e24e61ac83..61baae2c34 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -39,7 +39,7 @@ jobs: path: "./out/artifacts" - name: "Upload SARIF" - uses: github/codeql-action/upload-sarif@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1 + uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 if: always() && steps.build.outcome == 'success' with: sarif_file: "cifuzz-sarif/results.sarif" From bbf42cdb10bf9371077791cd242e5ddc27a844ef Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 7 Jun 2026 22:26:09 +0000 Subject: [PATCH 1189/1283] ci: update vmactions/solaris-vm action to v1.3.7 --- .github/workflows/solaris.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index 9f856c9e7c..523afa3de2 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -28,7 +28,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/solaris-vm@3702ccf20b84c7f7c0a9bb68894aba7623f8301d # v1.3.6 + uses: vmactions/solaris-vm@d30dd6c228c8661ade859e36ead7660b9a62efcc # v1.3.7 with: prepare: | pkg install gcc make From ff8452b2697f8b0c9cb65b7814a1573ef9bf54b8 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Mon, 15 Jun 2026 08:14:39 +0900 Subject: [PATCH 1190/1283] ci: detect Visual Studio CMake generator on Windows Do not hard-code the Visual Studio generator in the Windows CI matrix. Detect the available Visual Studio generator from `cmake --help` and pass only the generator name to CMake. --- .github/workflows/windows.yml | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index cdfdd2599e..5b16c1cacc 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -13,7 +13,7 @@ concurrency: jobs: test: - name: "${{ matrix.os }}/${{ matrix.arch }} (${{ matrix.generator }}${{ matrix.shared == 'ON' && ', shared' || '' }})" + name: "${{ matrix.os }}/${{ matrix.arch }} (${{ matrix.shared == 'ON' && 'shared' || 'static' }})" runs-on: "${{ matrix.os }}" if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} permissions: @@ -24,12 +24,6 @@ jobs: os: ["windows-2022", "windows-2025"] arch: ["ARM64", "x64", "Win32"] shared: ["ON", "OFF"] - include: - - os: "windows-2022" - generator: "Visual Studio 17 2022" - - os: "windows-2025" - # XXX - use appropriate value - generator: "Visual Studio 17 2022" steps: - name: "Checkout repository" uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 @@ -50,8 +44,17 @@ jobs: run: ./update.sh - name: "Configure CMake" - shell: cmd - run: cmake -Bbuild -G "${{ matrix.generator }}" -A ${{ matrix.arch }} -D BUILD_SHARED_LIBS=${{ matrix.shared }} -D CMAKE_INSTALL_PREFIX=../local + shell: pwsh + run: | + $generator = cmake --help | + Select-String '^\s*\*?\s*(Visual Studio \d+ \d+)' | + Select-Object -First 1 | + ForEach-Object { $_.Matches[0].Groups[1].Value } + if (-not $generator) { + throw "No Visual Studio CMake generator found" + } + Write-Host "Using generator: $generator" + cmake -Bbuild -G "$generator" -A ${{ matrix.arch }} -D BUILD_SHARED_LIBS=${{ matrix.shared }} -D CMAKE_INSTALL_PREFIX=../local - name: "Build" shell: cmd From e2caafd9cf33c46f296666064bb8ed67d5724876 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Mon, 15 Jun 2026 08:56:05 +0900 Subject: [PATCH 1191/1283] ci: fix Coverity build tool download URL Coverity Scan now serves the C/C++ Linux build tool from /download/cxx/linux64. The old /download/linux64 endpoint returns 404, causing the Coverity workflow to fail before the build starts. Update the workflow to use the C/C++ download endpoint. --- .github/workflows/coverity.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 068e73b637..f1d6c88090 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -34,7 +34,7 @@ jobs: PROJECT: "libressl-portable%2Fportable" COVERITY_SCAN_TOKEN: "${{ secrets.COVERITY_SCAN_TOKEN }}" run: | - wget -nv https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$PROJECT" -O coverity_tool.tar.gz + wget -nv https://scan.coverity.com/download/cxx/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$PROJECT" -O coverity_tool.tar.gz mkdir coverity_tool tar xzf coverity_tool.tar.gz --strip 1 -C coverity_tool From afbf81afc42b8bce9987fe1a0715cb2fe2199e0c Mon Sep 17 00:00:00 2001 From: orbisai0security Date: Mon, 15 Jun 2026 01:30:15 +0000 Subject: [PATCH 1192/1283] fix: V-002 security vulnerability Automated security fix generated by OrbisAI Security --- include/compat/dirent_msvc.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/compat/dirent_msvc.h b/include/compat/dirent_msvc.h index 67f295f197..e8a095687b 100644 --- a/include/compat/dirent_msvc.h +++ b/include/compat/dirent_msvc.h @@ -165,7 +165,8 @@ _wopendir(const wchar_t *dirname) n = GetFullPathNameW(dirname, 0, NULL, NULL); /* Allocate room for absolute directory name and search pattern */ - dirp->patt =(wchar_t*) malloc(sizeof(wchar_t) * n + 16); + if (n <= (SIZE_MAX - 16) / sizeof(wchar_t)) + dirp->patt =(wchar_t*) malloc(sizeof(wchar_t) * n + 16); if (dirp->patt) { /* From c85e07d0d68129fc1b1c9039b266099c8d735c3d Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Mon, 15 Jun 2026 07:58:06 +0900 Subject: [PATCH 1193/1283] Allow overriding TLS_DEFAULT_CA_FILE in CMake builds The CMake build unconditionally defined `TLS_DEFAULT_CA_FILE` as `${OPENSSLDIR}/cert.pem`, so a value supplied with `-DTLS_DEFAULT_CA_FILE` was ignored. Add `TLS_DEFAULT_CA_FILE` as a cache variable and use it for the libtls definition, falling back to `${OPENSSLDIR}/cert.pem` when unset. --- CMakeLists.txt | 5 +++++ tls/CMakeLists.txt | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 7ab04ab081..d3424c7aba 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -55,6 +55,7 @@ option(ENABLE_ASM "Enable assembly" ON) option(ENABLE_EXTRATESTS "Enable extra tests that may be unreliable on some platforms" OFF) option(ENABLE_NC "Enable installing TLS-enabled nc(1)" OFF) set(OPENSSLDIR ${OPENSSLDIR} CACHE PATH "Set the default openssl directory" FORCE) +set(TLS_DEFAULT_CA_FILE ${TLS_DEFAULT_CA_FILE} CACHE PATH "Set the default CA file" FORCE) set(LIBRESSL_INSTALL_CMAKEDIR "${CMAKE_INSTALL_LIBDIR}/cmake/LibreSSL" CACHE STRING "Installation directory for the CMake targets") option(USE_STATIC_MSVC_RUNTIMES "Use /MT instead of /MD in MSVC" OFF) @@ -506,6 +507,10 @@ else() set(CONF_DIR "${OPENSSLDIR}") endif() +if(TLS_DEFAULT_CA_FILE STREQUAL "") + set(TLS_DEFAULT_CA_FILE "${OPENSSLDIR}/cert.pem") +endif() + add_subdirectory(include) add_subdirectory(crypto) add_subdirectory(ssl) diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt index a1b244ac1f..258cd95592 100644 --- a/tls/CMakeLists.txt +++ b/tls/CMakeLists.txt @@ -41,7 +41,7 @@ if(WIN32) set(TLS_COMPAT_SRC ${TLS_COMPAT_SRC} compat/pwrite.c) endif() -add_definitions(-DTLS_DEFAULT_CA_FILE=\"${OPENSSLDIR}/cert.pem\") +add_definitions(-DTLS_DEFAULT_CA_FILE=\"${TLS_DEFAULT_CA_FILE}\") file(COPY ${CMAKE_CURRENT_SOURCE_DIR}/tls.sym DESTINATION ${CMAKE_CURRENT_BINARY_DIR}) From 2a927546a53bf31d7d268d1fbabff9ad3ebce167 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Mon, 15 Jun 2026 10:37:08 +0900 Subject: [PATCH 1194/1283] Update explanation for TLS_DEFAULT_CA_FILE --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index d3424c7aba..a7e97d96b2 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -55,7 +55,7 @@ option(ENABLE_ASM "Enable assembly" ON) option(ENABLE_EXTRATESTS "Enable extra tests that may be unreliable on some platforms" OFF) option(ENABLE_NC "Enable installing TLS-enabled nc(1)" OFF) set(OPENSSLDIR ${OPENSSLDIR} CACHE PATH "Set the default openssl directory" FORCE) -set(TLS_DEFAULT_CA_FILE ${TLS_DEFAULT_CA_FILE} CACHE PATH "Set the default CA file" FORCE) +set(TLS_DEFAULT_CA_FILE ${TLS_DEFAULT_CA_FILE} CACHE PATH "Set the default CA file for libtls" FORCE) set(LIBRESSL_INSTALL_CMAKEDIR "${CMAKE_INSTALL_LIBDIR}/cmake/LibreSSL" CACHE STRING "Installation directory for the CMake targets") option(USE_STATIC_MSVC_RUNTIMES "Use /MT instead of /MD in MSVC" OFF) From 14715d71a60db8d8d9d8dd80af0c13a10a0d6431 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 15 Jun 2026 04:31:43 +0200 Subject: [PATCH 1195/1283] Link ssl_kex test to build --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index a2c619273f..4fc389eff8 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -810,6 +810,11 @@ target_link_libraries(ssl_get_shared_ciphers ${OPENSSL_TEST_LIBS}) prepare_emscripten_test_target(ssl_get_shared_ciphers) add_platform_test(ssl_get_shared_ciphers ssl_get_shared_ciphers) +# ssl_kex +add_executable(ssl_kex ssl_kex.c) +target_link_libraries(ssl_kex ${OPENSSL_TEST_LIBS}) +add_platform_test(ssl_kex ssl_kex) + # ssl_methods add_executable(ssl_methods ssl_methods.c) target_link_libraries(ssl_methods ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index d49b4314e6..953e122731 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -815,6 +815,11 @@ ssl_get_shared_ciphers_CPPFLAGS = $(AM_CPPFLAGS) -DCERTSDIR=\"$(srcdir)\" check_PROGRAMS += ssl_get_shared_ciphers ssl_get_shared_ciphers_SOURCES = ssl_get_shared_ciphers.c +# ssl_kex +TESTS += ssl_kex +check_PROGRAMS += ssl_kex +ssl_kex_SOURCES = ssl_kex.c + # ssl_methods TESTS += ssl_methods check_PROGRAMS += ssl_methods From 429bceda74c007bde07af0dd831896644b5fc7e7 Mon Sep 17 00:00:00 2001 From: OrbisAI Security Date: Mon, 15 Jun 2026 10:16:59 +0530 Subject: [PATCH 1196/1283] fix: address code review feedback on SIZE_MAX and errno - Include to ensure SIZE_MAX is defined for MSVC - Set errno to ENOMEM when malloc fails for better error reporting Addresses review comments: - https://github.com/libressl/portable/pull/1304#discussion_r3411021522 - https://github.com/libressl/portable/pull/1304#discussion_r3411041707 Co-Authored-By: Claude Sonnet 4.5 --- include/compat/dirent_msvc.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/compat/dirent_msvc.h b/include/compat/dirent_msvc.h index e8a095687b..0f36803124 100644 --- a/include/compat/dirent_msvc.h +++ b/include/compat/dirent_msvc.h @@ -47,6 +47,7 @@ #include #include +#include /* Indicates that d_type field is available in dirent structure */ #define _DIRENT_HAVE_D_TYPE @@ -215,6 +216,7 @@ _wopendir(const wchar_t *dirname) } else { /* Cannot allocate memory for search pattern */ + _set_errno(ENOMEM); error = 1; } From d6c6b060cdb14f6fa0e3bdc70683888bcbe51077 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 15 Jun 2026 00:19:28 -0600 Subject: [PATCH 1197/1283] Revert "ci: fix Coverity build tool download URL" This reverts commit e2caafd9cf33c46f296666064bb8ed67d5724876. --- .github/workflows/coverity.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index f1d6c88090..068e73b637 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -34,7 +34,7 @@ jobs: PROJECT: "libressl-portable%2Fportable" COVERITY_SCAN_TOKEN: "${{ secrets.COVERITY_SCAN_TOKEN }}" run: | - wget -nv https://scan.coverity.com/download/cxx/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$PROJECT" -O coverity_tool.tar.gz + wget -nv https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$PROJECT" -O coverity_tool.tar.gz mkdir coverity_tool tar xzf coverity_tool.tar.gz --strip 1 -C coverity_tool From b1034608a6d44a9b2ffc54506763657852d6b827 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 15 Jun 2026 08:22:51 +0200 Subject: [PATCH 1198/1283] Add tests/ssl_kex* to .gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index 5db07be3de..a3fea51657 100644 --- a/.gitignore +++ b/.gitignore @@ -126,6 +126,7 @@ tests/renegotiation_test* tests/rfc3779* tests/rfc5280time* tests/ssl_get_shared_ciphers* +tests/ssl_kex* tests/ssl_methods* tests/ssl_set_alpn_protos* tests/ssl_verify_param* From 19bb52a9885aaae3240689c842bf691653acccc0 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 20 Jun 2026 03:39:07 +0000 Subject: [PATCH 1199/1283] ci: update msys2/setup-msys2 action to v2.32.0 --- .github/workflows/cmake-config.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/windows.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cmake-config.yml b/.github/workflows/cmake-config.yml index 57125bccfd..5d3516a215 100644 --- a/.github/workflows/cmake-config.yml +++ b/.github/workflows/cmake-config.yml @@ -28,7 +28,7 @@ jobs: - name: "Setup Windows dependencies" if: runner.os == 'Windows' - uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1 + uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: update: true install: >- diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d4278b7b02..8ab9c8177e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,7 +57,7 @@ jobs: persist-credentials: false - name: "Setup MSYS2" - uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1 + uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: update: true install: >- diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 5b16c1cacc..ce8ccc6c0c 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -29,7 +29,7 @@ jobs: uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: "Setup MSYS2" - uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1 + uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: update: true install: >- From 8e4e8d693cce9f9a5ddd589da7999757ff38e286 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 21 Jun 2026 17:53:38 +0000 Subject: [PATCH 1200/1283] ci: update actions/checkout action to v7 --- .github/workflows/android.yml | 2 +- .github/workflows/cmake-config.yml | 2 +- .github/workflows/coverity.yml | 2 +- .github/workflows/emscripten.yml | 4 ++-- .github/workflows/fedora-rawhide.yml | 2 +- .github/workflows/freebsd.yml | 4 ++-- .github/workflows/linux.yml | 4 ++-- .github/workflows/macos.yml | 2 +- .github/workflows/release.yml | 4 ++-- .github/workflows/rust-openssl.yml | 2 +- .github/workflows/solaris.yml | 2 +- .github/workflows/windows.yml | 2 +- 12 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index 0a4de58b1b..38a5462553 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -25,7 +25,7 @@ jobs: max-nal: 30 steps: - name: "Checkout repository" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: "Run CI script" run: ./scripts/test diff --git a/.github/workflows/cmake-config.yml b/.github/workflows/cmake-config.yml index 57125bccfd..3a43b36b8a 100644 --- a/.github/workflows/cmake-config.yml +++ b/.github/workflows/cmake-config.yml @@ -24,7 +24,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: "Setup Windows dependencies" if: runner.os == 'Windows' diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 068e73b637..db0ca5bbba 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -22,7 +22,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: "Install dependencies" run: | diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml index bddd4b7234..fa5d8dfceb 100644 --- a/.github/workflows/emscripten.yml +++ b/.github/workflows/emscripten.yml @@ -20,7 +20,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: "Setup emsdk" uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16 @@ -48,7 +48,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: "Setup emsdk" uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16 diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index bcf0fe68d6..9dc48a1fb8 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -23,7 +23,7 @@ jobs: container: image: fedora:rawhide@sha256:0c1f63ed8fb818fad16cf6ae091598c410a21d2e1a9adf183beb93189299bfba steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install dependencies run: | dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index 67ad8e2069..ea53160dac 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -22,7 +22,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: "Setup" run: | @@ -49,7 +49,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: "Setup" run: | diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 1d531e150c..d6f5e2bd03 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -44,7 +44,7 @@ jobs: steps: - name: "Checkout repository" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: "Run tests" run: ./scripts/test || (status=$?; cat tests/test-suite.log; exit $status) @@ -66,7 +66,7 @@ jobs: os: ["ubuntu-24.04", "ubuntu-24.04-arm"] steps: - name: "Checkout repository" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: "Run tests" run: ./scripts/test diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index 4383e3803c..0cefdcc17b 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -28,7 +28,7 @@ jobs: run: brew install automake libtool - name: "Checkout repository" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: "Run tests" run: ./scripts/test diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d4278b7b02..11dfb3926e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,7 +20,7 @@ jobs: contents: write # Required to create release. steps: - name: "Checkout repository" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false @@ -52,7 +52,7 @@ jobs: arch: [ "Win32", "x64", "ARM64" ] steps: - name: "Checkout repository" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index b378752cf2..47791a7787 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -19,7 +19,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: "Build LibreSSL" run: | diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index 523afa3de2..223be20f8c 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -19,7 +19,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: "Setup" run: | diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 5b16c1cacc..8d7bdda3de 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -26,7 +26,7 @@ jobs: shared: ["ON", "OFF"] steps: - name: "Checkout repository" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: "Setup MSYS2" uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1 From 14ccaf8ad487d38c06a53be2a924bf2c3b1f704b Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Wed, 24 Jun 2026 12:19:58 +0200 Subject: [PATCH 1201/1283] link x509_crl test to the build --- .gitignore | 1 + tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 3 files changed, 11 insertions(+) diff --git a/.gitignore b/.gitignore index a3fea51657..79c7b5161d 100644 --- a/.gitignore +++ b/.gitignore @@ -146,6 +146,7 @@ tests/compat/*.c tests/verify* tests/x509_algor* tests/x509_asn1* +tests/x509_crl* tests/x509_extensions_test* tests/x509_info* tests/x509_name_test* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 4fc389eff8..f125849752 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -957,6 +957,11 @@ target_link_libraries(x509_asn1 ${OPENSSL_TEST_LIBS}) prepare_emscripten_test_target(x509_asn1) add_platform_test(x509_asn1 x509_asn1) +# x509_crl +add_executable(x509_crl x509_crl.c) +target_link_libraries(x509_crl ${OPENSSL_TEST_LIBS}) +add_platform_test(x509_crl x509_crl) + # x509_extensions_test add_executable(x509_extensions_test x509_extensions_test.c) target_link_libraries(x509_extensions_test ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 953e122731..5cd41c18dd 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -940,6 +940,11 @@ TESTS += x509_asn1 check_PROGRAMS += x509_asn1 x509_asn1_SOURCES = x509_asn1.c +# x509_crl +TESTS += x509_crl +check_PROGRAMS += x509_crl +x509_crl_SOURCES = x509_crl.c + # x509_extensions_test TESTS += x509_extensions_test check_PROGRAMS += x509_extensions_test From 9c3856146a75ac038ffa8e2c089965bb91720236 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Thu, 25 Jun 2026 22:00:26 +0530 Subject: [PATCH 1202/1283] fix out-of-bounds write in getdelim on undersized buffer --- crypto/compat/getdelim.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/crypto/compat/getdelim.c b/crypto/compat/getdelim.c index caec3f2005..2c5a8a0f88 100644 --- a/crypto/compat/getdelim.c +++ b/crypto/compat/getdelim.c @@ -38,10 +38,18 @@ getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp) char *ptr, *eptr; - if (*buf == NULL || *bufsiz == 0) { - *bufsiz = BUFSIZ; - if ((*buf = malloc(*bufsiz)) == NULL) + /* + * Ensure the buffer can hold at least one byte plus the NUL + * terminator before the loop writes to it. A caller-supplied + * buffer smaller than that is grown rather than overrun. + */ + if (*buf == NULL || *bufsiz < 2) { + char *nbuf; + size_t nbufsiz = BUFSIZ; + if ((nbuf = realloc(*buf, nbufsiz)) == NULL) return -1; + *buf = nbuf; + *bufsiz = nbufsiz; } for (ptr = *buf, eptr = *buf + *bufsiz;;) { From 8c8af254aa0d8ed50a4d99fe8c60450819f2cbf3 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Fri, 26 Jun 2026 13:24:53 +0530 Subject: [PATCH 1203/1283] getdelim: drop comment, give nbuf/nbufsiz function scope --- crypto/compat/getdelim.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/crypto/compat/getdelim.c b/crypto/compat/getdelim.c index 2c5a8a0f88..9bacf0c4f7 100644 --- a/crypto/compat/getdelim.c +++ b/crypto/compat/getdelim.c @@ -35,17 +35,12 @@ ssize_t getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp) { - char *ptr, *eptr; + char *ptr, *eptr, *nbuf; + size_t nbufsiz; - /* - * Ensure the buffer can hold at least one byte plus the NUL - * terminator before the loop writes to it. A caller-supplied - * buffer smaller than that is grown rather than overrun. - */ if (*buf == NULL || *bufsiz < 2) { - char *nbuf; - size_t nbufsiz = BUFSIZ; + nbufsiz = BUFSIZ; if ((nbuf = realloc(*buf, nbufsiz)) == NULL) return -1; *buf = nbuf; @@ -70,9 +65,8 @@ getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp) return ptr - *buf; } if (ptr + 2 >= eptr) { - char *nbuf; - size_t nbufsiz = *bufsiz * 2; ssize_t d = ptr - *buf; + nbufsiz = *bufsiz * 2; if ((nbuf = realloc(*buf, nbufsiz)) == NULL) return -1; *buf = nbuf; From d85fe21b8edb568a17e77daac2f9c7a5078091e0 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 27 Jun 2026 01:31:57 +0000 Subject: [PATCH 1204/1283] ci: update vmactions/freebsd-vm action to v1.4.8 --- .github/workflows/freebsd.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index ea53160dac..10f97ae034 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -31,7 +31,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@a6de9343ef5747433d9c25784c90e84998b9d69a # v1.4.6 + uses: vmactions/freebsd-vm@b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1.4.8 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false @@ -58,7 +58,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@a6de9343ef5747433d9c25784c90e84998b9d69a # v1.4.6 + uses: vmactions/freebsd-vm@b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1.4.8 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false From 58e99a5fc6c51cd225e09459b2c3b643a4502715 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 4 Jul 2026 00:27:39 +0000 Subject: [PATCH 1205/1283] ci: update vmactions/freebsd-vm action to v1.5.0 --- .github/workflows/freebsd.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index 10f97ae034..1373dc33f5 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -31,7 +31,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1.4.8 + uses: vmactions/freebsd-vm@5a72679103d223925653750faa878a143340fbd0 # v1.5.0 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false @@ -58,7 +58,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1.4.8 + uses: vmactions/freebsd-vm@5a72679103d223925653750faa878a143340fbd0 # v1.5.0 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false From 37fbc74d9d959b247457d1ceadfe217b9dc742b2 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 5 Jul 2026 14:50:20 +0000 Subject: [PATCH 1206/1283] ci: update github/codeql-action action to v4.36.3 --- .github/workflows/cifuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 61baae2c34..c1ed060042 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -39,7 +39,7 @@ jobs: path: "./out/artifacts" - name: "Upload SARIF" - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 if: always() && steps.build.outcome == 'success' with: sarif_file: "cifuzz-sarif/results.sarif" From 35a02a13a4013abfa7df0bd099a257bd4943da5f Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Tue, 7 Jul 2026 13:59:07 +0530 Subject: [PATCH 1207/1283] guard getdelim buffer growth against size_t overflow --- crypto/compat/getdelim.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/compat/getdelim.c b/crypto/compat/getdelim.c index 9bacf0c4f7..bf4889f4ac 100644 --- a/crypto/compat/getdelim.c +++ b/crypto/compat/getdelim.c @@ -27,6 +27,8 @@ * POSSIBILITY OF SUCH DAMAGE. */ +#include +#include #include #include @@ -66,6 +68,10 @@ getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp) } if (ptr + 2 >= eptr) { ssize_t d = ptr - *buf; + if (*bufsiz > SIZE_MAX / 2) { + errno = EOVERFLOW; + return -1; + } nbufsiz = *bufsiz * 2; if ((nbuf = realloc(*buf, nbufsiz)) == NULL) return -1; From af20f7bf0441419acd58ea0bf00db86bfa4cdb41 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Wed, 8 Jul 2026 20:35:30 +0530 Subject: [PATCH 1208/1283] handle GetModuleFileName failure in getprogname --- crypto/compat/getprogname_windows.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/crypto/compat/getprogname_windows.c b/crypto/compat/getprogname_windows.c index eb04ec0551..9de3cabcee 100644 --- a/crypto/compat/getprogname_windows.c +++ b/crypto/compat/getprogname_windows.c @@ -7,7 +7,8 @@ getprogname(void) { static char progname[MAX_PATH + 1]; DWORD length = GetModuleFileName(NULL, progname, sizeof (progname) - 1); - if (length < 0) + if (length == 0) return "?"; + progname[length] = '\0'; return progname; } From 9c15b8f4ad2ae3fde714a0cd29f9e0f4a6129395 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Fri, 10 Jul 2026 02:03:58 +0530 Subject: [PATCH 1209/1283] guard _wopendir against unchecked GetFullPathNameW result --- include/compat/dirent_msvc.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/include/compat/dirent_msvc.h b/include/compat/dirent_msvc.h index 0f36803124..2689399aaf 100644 --- a/include/compat/dirent_msvc.h +++ b/include/compat/dirent_msvc.h @@ -155,7 +155,7 @@ _wopendir(const wchar_t *dirname) /* Allocate new _WDIR structure */ dirp =(_WDIR*) malloc(sizeof(struct _WDIR)); if (dirp != NULL) { - DWORD n; + DWORD n, len; /* Reset _WDIR structure */ dirp->handle = INVALID_HANDLE_VALUE; @@ -175,12 +175,12 @@ _wopendir(const wchar_t *dirname) * allows rewinddir() to function correctly even when current * working directory is changed between opendir() and rewinddir(). */ - n = GetFullPathNameW(dirname, n, dirp->patt, NULL); - if (n > 0) { + len = GetFullPathNameW(dirname, n, dirp->patt, NULL); + if (len > 0 && len < n) { wchar_t *p; /* Append search pattern \* to the directory name */ - p = dirp->patt + n; + p = dirp->patt + len; if (dirp->patt < p) { switch(p[-1]) { case '\\': From b46676e30dd135dfa886d4ed8098a939b2e5e1de Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Fri, 10 Jul 2026 22:01:53 +0900 Subject: [PATCH 1210/1283] hook up x509/verify regress test Copy regress/lib/libcrypto/x509/verify.c as x509_verify.c to avoid the basename collision with x509/bettertls/verify.c when regress tests are flattened into tests. Also copy the libcrypto cert test data and make-dir-roots.pl, add a wrapper to prepare the CApath roots directory, and register the test for both autotools and CMake. Refs #1273 --- .gitignore | 4 +++ tests/CMakeLists.txt | 17 ++++++++++ tests/Makefile.am | 16 +++++++++ tests/x509_verify.sh | 77 ++++++++++++++++++++++++++++++++++++++++++++ update.sh | 10 ++++++ 5 files changed, 124 insertions(+) create mode 100755 tests/x509_verify.sh diff --git a/.gitignore b/.gitignore index 79c7b5161d..8a72400e2c 100644 --- a/.gitignore +++ b/.gitignore @@ -140,10 +140,14 @@ tests/test.h tests/*test.c tests/pbkdf2* tests/*.pem +tests/certs/ +tests/make-dir-roots.pl tests/testssl tests/*.txt tests/compat/*.c tests/verify* +tests/x509_verify* +!tests/x509_verify.sh tests/x509_algor* tests/x509_asn1* tests/x509_crl* diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index f125849752..c1f32a4b70 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -931,6 +931,23 @@ add_executable(valid_handshakes_terminate valid_handshakes_terminate.c) target_link_libraries(valid_handshakes_terminate ${OPENSSL_TEST_LIBS}) add_platform_test(valid_handshakes_terminate valid_handshakes_terminate) +# x509_verify +add_executable(x509_verify x509_verify.c) +target_link_libraries(x509_verify ${OPENSSL_TEST_LIBS}) +add_dependencies(x509_verify openssl) +if(NOT WIN32 AND NOT EMSCRIPTEN) + add_test(NAME x509_verify COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/x509_verify.sh + $ $) + set_tests_properties(x509_verify PROPERTIES + ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}" + WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}) + # This test depends on certificate times that can exceed 32-bit time_t + # range, so match the existing time tests and expect failure there. + if(SMALL_TIME_T) + set_property(TEST x509_verify PROPERTY WILL_FAIL TRUE) + endif() +endif() + # verifytest add_executable(verifytest verifytest.c) target_link_libraries(verifytest ${LIBTLS_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 5cd41c18dd..63739344d6 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -102,6 +102,9 @@ check_PROGRAMS = EXTRA_DIST = CMakeLists.txt DISTCLEANFILES = pidwraptest.txt +distclean-local: + rm -rf x509_verify-certs + # XXX - should probably be in their own static lib TEST_HELPER_SRC = test.c test_util.c noinst_HEADERS = test.h @@ -915,6 +918,19 @@ TESTS += valid_handshakes_terminate check_PROGRAMS += valid_handshakes_terminate valid_handshakes_terminate_SOURCES = valid_handshakes_terminate.c +# x509_verify +# This test depends on certificate times that can exceed 32-bit time_t +# range, so match the existing time tests and expect failure there. +if SMALL_TIME_T +XFAIL_TESTS += x509_verify.sh +endif +TESTS += x509_verify.sh +check_PROGRAMS += x509_verify +x509_verify_SOURCES = x509_verify.c +EXTRA_DIST += x509_verify.sh +EXTRA_DIST += make-dir-roots.pl +EXTRA_DIST += certs + # verifytest TESTS += verifytest check_PROGRAMS += verifytest diff --git a/tests/x509_verify.sh b/tests/x509_verify.sh new file mode 100755 index 0000000000..cc5446cdc1 --- /dev/null +++ b/tests/x509_verify.sh @@ -0,0 +1,77 @@ +#!/bin/sh +# +# Copyright (c) 2026 Kenjiro Nakayama +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + +set -e + +if [ -z "$srcdir" ]; then + srcdir=. +fi + +case "$srcdir" in +/*) + certs_path="$srcdir/certs" + make_dir_roots="$srcdir/make-dir-roots.pl" + openssl_conf="$srcdir/openssl.cnf" + ;; +*) + certs_path="`pwd`/$srcdir/certs" + make_dir_roots="`pwd`/$srcdir/make-dir-roots.pl" + openssl_conf="`pwd`/$srcdir/openssl.cnf" + ;; +esac + +if [ $# -ge 1 ]; then + verify_bin=$1 +else + verify_bin="`pwd`/x509_verify" + if [ -e ./x509_verify.exe ]; then + verify_bin="`pwd`/x509_verify.exe" + fi +fi + +if [ $# -ge 2 ]; then + openssl_dir=`dirname "$2"` +elif [ -d ../apps/openssl ]; then + openssl_dir="`pwd`/../apps/openssl" +else + openssl_dir="`pwd`/../apps" +fi + +PATH="$openssl_dir:$PATH" +export PATH + +if [ -f "$openssl_conf" ]; then + OPENSSL_CONF="$openssl_conf" + export OPENSSL_CONF +fi + +workdir=x509_verify-certs + +cleanup() +{ + rm -rf "$workdir" +} +trap cleanup EXIT + +rm -rf "$workdir" +mkdir "$workdir" + +perl "$make_dir_roots" "$certs_path" "$workdir" + +( + cd "$workdir" + "$verify_bin" "$certs_path" +) diff --git a/update.sh b/update.sh index e4377d3c38..31cd04dcf9 100755 --- a/update.sh +++ b/update.sh @@ -334,10 +334,20 @@ touch tests/empty.c for i in `find $libcrypto_regress -name '*.[ch]'`; do $CP "$i" tests done +# x509/verify.c collides with x509/bettertls/verify.c when flattened. +$CP $libcrypto_regress/x509/verify.c tests/x509_verify.c $CP $libcrypto_regress/evp/evptests.txt tests $CP $libcrypto_regress/aead/*.txt tests $CP $libcrypto_regress/ct/ctlog.conf tests $CP $libcrypto_regress/ct/*.crt tests +$CP $libcrypto_regress/x509/make-dir-roots.pl tests +rm -rf tests/certs +mkdir -p tests/certs +for i in $libcrypto_regress/certs/[0-9]*; do + if [ -d "$i" ]; then + $CP -R "$i" tests/certs + fi +done $CP $libcrypto_regress/x509/policy/*.pem tests $CP $libcrypto_regress/mlkem/*.txt tests From 649bf5d4f1d1991899f1a5fdad0e0d932110a521 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Sat, 11 Jul 2026 10:52:02 +0530 Subject: [PATCH 1211/1283] nul-terminate snprintf shim on pre-2015 msvc --- include/compat/stdio.h | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/include/compat/stdio.h b/include/compat/stdio.h index 2ccdeeb68e..d9b87253d2 100644 --- a/include/compat/stdio.h +++ b/include/compat/stdio.h @@ -57,7 +57,25 @@ int posix_rename(const char *oldpath, const char *newpath); #endif #if defined(_MSC_VER) && _MSC_VER < 1900 -#define snprintf _snprintf +#include + +static inline int +libressl_snprintf(char *str, size_t size, const char *format, ...) +{ + va_list ap; + int ret; + + va_start(ap, format); + ret = _vsnprintf(str, size, format, ap); + va_end(ap); + + /* _vsnprintf does not NUL-terminate when the output is truncated. */ + if (size != 0) + str[size - 1] = '\0'; + + return ret; +} +#define snprintf libressl_snprintf #endif #endif From 667b8861198f7b8d45e92cce0df65fd0e58daa32 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 11 Jul 2026 15:01:03 +0000 Subject: [PATCH 1212/1283] ci: update github/codeql-action action to v4.37.0 --- .github/workflows/cifuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index c1ed060042..3f9a33ce9a 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -39,7 +39,7 @@ jobs: path: "./out/artifacts" - name: "Upload SARIF" - uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 + uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 if: always() && steps.build.outcome == 'success' with: sarif_file: "cifuzz-sarif/results.sarif" From 341b07f0dd12b77aeafe4282144c9f8168f5f5bd Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Mon, 13 Jul 2026 01:32:03 +0530 Subject: [PATCH 1213/1283] fix htole64 fallback byte order in AIX endian shim --- include/compat/endian.h | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/include/compat/endian.h b/include/compat/endian.h index 89c83fc715..8022e0ed8e 100644 --- a/include/compat/endian.h +++ b/include/compat/endian.h @@ -182,15 +182,15 @@ static inline uint64_t htole64(uint64_t x) { uint64_t u64; unsigned char bytes[8]; } val; - val.u64 = x; - return ((uint64_t)val.bytes[0] << 56) | - ((uint64_t)val.bytes[1] << 48) | - ((uint64_t)val.bytes[2] << 40) | - ((uint64_t)val.bytes[3] << 32) | - ((uint64_t)val.bytes[4] << 24) | - ((uint64_t)val.bytes[5] << 16) | - ((uint64_t)val.bytes[6] << 8) | - (uint64_t)val.bytes[7]; + val.bytes[0] = (unsigned char)x; + val.bytes[1] = (unsigned char)(x >> 8); + val.bytes[2] = (unsigned char)(x >> 16); + val.bytes[3] = (unsigned char)(x >> 24); + val.bytes[4] = (unsigned char)(x >> 32); + val.bytes[5] = (unsigned char)(x >> 40); + val.bytes[6] = (unsigned char)(x >> 48); + val.bytes[7] = (unsigned char)(x >> 56); + return val.u64; #endif } From 991c2d765dc003e43b8814dc191b9e81140df4cd Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Tue, 14 Jul 2026 14:18:48 +0530 Subject: [PATCH 1214/1283] honor the requested timeout in the win32 poll shim --- apps/openssl/compat/poll_win.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/apps/openssl/compat/poll_win.c b/apps/openssl/compat/poll_win.c index 30f6b6071a..c518962223 100644 --- a/apps/openssl/compat/poll_win.c +++ b/apps/openssl/compat/poll_win.c @@ -249,8 +249,6 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms) wait_rc = WAIT_FAILED; looptime_ms = (timeout_ms > 100 || timeout_ms == -1) ? 100 : timeout_ms; - if (timeout_ms == -1) - timeout_ms = INFINITE; do { TIMEVAL tv; @@ -280,7 +278,7 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms) /* * If we signaled on a file handle, don't wait on the sockets. */ - if (wait_rc >= WAIT_OBJECT_0 && + if (num_handles && wait_rc >= WAIT_OBJECT_0 && (wait_rc <= WAIT_OBJECT_0 + num_handles - 1)) { tv.tv_usec = 0; handle_signaled = 1; @@ -298,7 +296,7 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms) timespent_ms += looptime_ms; - } while (timespent_ms < timeout_ms); + } while (timeout_ms == -1 || timespent_ms < timeout_ms); rc = 0; num_handles = 0; From b901cbc4d84bd4eb5dbb27dabc329ba03457274a Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Wed, 15 Jul 2026 15:48:00 +0530 Subject: [PATCH 1215/1283] poll_win: restore fd_sets before each select() retry select() strips not-ready descriptors from the fd_sets, so a timed-out pass leaves them empty and the next pass calls select() with three empty sets, which Windows rejects with WSAEINVAL. Keep a pristine copy and restore it before each retry so an idle socket waits out the timeout. --- apps/openssl/compat/poll_win.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/apps/openssl/compat/poll_win.c b/apps/openssl/compat/poll_win.c index c518962223..0d155227dc 100644 --- a/apps/openssl/compat/poll_win.c +++ b/apps/openssl/compat/poll_win.c @@ -166,6 +166,7 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms) * select machinery */ fd_set rfds, wfds, efds; + fd_set rfds_in, wfds_in, efds_in; int rc; int num_sockets; @@ -250,12 +251,27 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms) looptime_ms = (timeout_ms > 100 || timeout_ms == -1) ? 100 : timeout_ms; + /* + * select() clears every descriptor that is not ready from the + * fd_sets, so a pass that times out leaves them empty. Keep a + * pristine copy and restore it before each select(), otherwise the + * next pass hands select() three empty sets and Windows fails it with + * WSAEINVAL instead of waiting out the remaining timeout. + */ + rfds_in = rfds; + wfds_in = wfds; + efds_in = efds; + do { TIMEVAL tv; tv.tv_sec = 0; tv.tv_usec = looptime_ms * 1000; int handle_signaled = 0; + rfds = rfds_in; + wfds = wfds_in; + efds = efds_in; + /* * Check if any file handles have signaled */ From 43f336dd00b31182cbe54da31f89298dca9c43c4 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Wed, 15 Jul 2026 18:38:33 +0530 Subject: [PATCH 1216/1283] restore file offset on error in pread/pwrite shims --- tls/compat/pread.c | 14 +++++++++----- tls/compat/pwrite.c | 14 +++++++++----- 2 files changed, 18 insertions(+), 10 deletions(-) diff --git a/tls/compat/pread.c b/tls/compat/pread.c index b9d6b097a9..0b994f434e 100644 --- a/tls/compat/pread.c +++ b/tls/compat/pread.c @@ -8,21 +8,25 @@ #define NO_REDEF_POSIX_FUNCTIONS +#include #include ssize_t pread(int d, void *buf, size_t nbytes, off_t offset) { - off_t cpos, opos, rpos; + off_t cpos; ssize_t bytes; + int save_errno; + if((cpos = lseek(d, 0, SEEK_CUR)) == -1) return -1; - if((opos = lseek(d, offset, SEEK_SET)) == -1) - return -1; - if((bytes = read(d, buf, nbytes)) == -1) + if(lseek(d, offset, SEEK_SET) == -1) return -1; - if((rpos = lseek(d, cpos, SEEK_SET)) == -1) + bytes = read(d, buf, nbytes); + save_errno = errno; + if(lseek(d, cpos, SEEK_SET) == -1) return -1; + errno = save_errno; return bytes; } diff --git a/tls/compat/pwrite.c b/tls/compat/pwrite.c index 82f5f555be..ab8824125d 100644 --- a/tls/compat/pwrite.c +++ b/tls/compat/pwrite.c @@ -8,21 +8,25 @@ #define NO_REDEF_POSIX_FUNCTIONS +#include #include ssize_t pwrite(int d, const void *buf, size_t nbytes, off_t offset) { - off_t cpos, opos, rpos; + off_t cpos; ssize_t bytes; + int save_errno; + if((cpos = lseek(d, 0, SEEK_CUR)) == -1) return -1; - if((opos = lseek(d, offset, SEEK_SET)) == -1) - return -1; - if((bytes = write(d, buf, nbytes)) == -1) + if(lseek(d, offset, SEEK_SET) == -1) return -1; - if((rpos = lseek(d, cpos, SEEK_SET)) == -1) + bytes = write(d, buf, nbytes); + save_errno = errno; + if(lseek(d, cpos, SEEK_SET) == -1) return -1; + errno = save_errno; return bytes; } From 9082d30d64e6765f930dc320addd1fda134a78c1 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Thu, 16 Jul 2026 11:52:45 +0530 Subject: [PATCH 1217/1283] poll_win: cap the final wait pass at the remaining time The wait loop always sleeps in fixed 100ms slices, so a 250ms timeout runs three full passes and takes ~300ms. Clamp each pass to the time remaining so the total wait matches the requested timeout. --- apps/openssl/compat/poll_win.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/apps/openssl/compat/poll_win.c b/apps/openssl/compat/poll_win.c index 0d155227dc..8e283495bd 100644 --- a/apps/openssl/compat/poll_win.c +++ b/apps/openssl/compat/poll_win.c @@ -264,6 +264,14 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms) do { TIMEVAL tv; + + /* + * Cap the wait at the time remaining so the final pass + * does not overshoot the requested timeout. + */ + if (timeout_ms != -1 && timeout_ms - timespent_ms < looptime_ms) + looptime_ms = timeout_ms - timespent_ms; + tv.tv_sec = 0; tv.tv_usec = looptime_ms * 1000; int handle_signaled = 0; From 5c7dd432a6d2141a422b40c5e33ff2e43c1b9667 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Thu, 16 Jul 2026 19:33:10 +0530 Subject: [PATCH 1218/1283] honor SOCK_NONBLOCK in the accept4 shim --- apps/nc/compat/accept4.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/apps/nc/compat/accept4.c b/apps/nc/compat/accept4.c index dca42e935e..7818bc0ab4 100644 --- a/apps/nc/compat/accept4.c +++ b/apps/nc/compat/accept4.c @@ -5,12 +5,18 @@ int accept4(int s, struct sockaddr *addr, socklen_t *addrlen, int flags) { int rets = accept(s, addr, addrlen); + int fl; if (rets == -1) return rets; if (flags & SOCK_CLOEXEC) { - flags = fcntl(rets, F_GETFD); - fcntl(rets, F_SETFD, flags | FD_CLOEXEC); + fl = fcntl(rets, F_GETFD); + fcntl(rets, F_SETFD, fl | FD_CLOEXEC); + } + + if (flags & SOCK_NONBLOCK) { + fl = fcntl(rets, F_GETFL); + fcntl(rets, F_SETFL, fl | O_NONBLOCK); } return rets; From 3239ebf0dc848c37bd299808146d5ed6b0f5e90d Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Fri, 17 Jul 2026 22:25:07 +0530 Subject: [PATCH 1219/1283] set errno for unmapped codes in wsa_errno and wsa_select_errno --- apps/openssl/compat/poll_win.c | 3 +++ crypto/compat/posix_win.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/apps/openssl/compat/poll_win.c b/apps/openssl/compat/poll_win.c index 8e283495bd..1e3021a9cc 100644 --- a/apps/openssl/compat/poll_win.c +++ b/apps/openssl/compat/poll_win.c @@ -152,6 +152,9 @@ wsa_select_errno(int err) case WSAENETDOWN: errno = ENOMEM; break; + default: + errno = EIO; + break; } return -1; } diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index bc0fa36448..4e98643686 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -178,6 +178,9 @@ wsa_errno(int err) case WSAETIMEDOUT: errno = EPIPE; break; + default: + errno = EIO; + break; } return -1; } From bb72ae26c912e28ea828891ee1a721b831c10d59 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sat, 18 Jul 2026 15:19:03 +0900 Subject: [PATCH 1220/1283] Run x509_verify only when perl is available The x509_verify wrapper uses make-dir-roots.pl to prepare the hashed CApath roots directory. This introduced a perl dependency for running the test suite from release tarballs. Detect perl during configure and CMake configuration, and only register x509_verify when perl is available. --- CMakeLists.txt | 1 + configure.ac | 3 +++ tests/CMakeLists.txt | 4 ++-- tests/Makefile.am | 3 +++ tests/x509_verify.sh | 6 +++++- 5 files changed, 14 insertions(+), 3 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index a7e97d96b2..3a23b98acb 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -32,6 +32,7 @@ include(cmake_export_symbol) include(GNUInstallDirs) enable_testing() +find_program(PERL_EXECUTABLE perl perl5) file(READ ${CMAKE_CURRENT_SOURCE_DIR}/ssl/VERSION SSL_VERSION) string(STRIP ${SSL_VERSION} SSL_VERSION) diff --git a/configure.ac b/configure.ac index c0ad0336c2..9012535acd 100644 --- a/configure.ac +++ b/configure.ac @@ -32,6 +32,9 @@ AC_PROG_CC([cc gcc]) AM_PROG_CC_C_O LT_INIT([pic-only]) +AC_CHECK_PROGS([PERL], [perl perl5]) +AM_CONDITIONAL([HAVE_PERL], [test "x$PERL" != x]) + CHECK_OS_OPTIONS CHECK_C_HARDENING_OPTIONS diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index c1f32a4b70..5aaebd9c04 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -935,11 +935,11 @@ add_platform_test(valid_handshakes_terminate valid_handshakes_terminate) add_executable(x509_verify x509_verify.c) target_link_libraries(x509_verify ${OPENSSL_TEST_LIBS}) add_dependencies(x509_verify openssl) -if(NOT WIN32 AND NOT EMSCRIPTEN) +if(NOT WIN32 AND NOT EMSCRIPTEN AND PERL_EXECUTABLE) add_test(NAME x509_verify COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/x509_verify.sh $ $) set_tests_properties(x509_verify PROPERTIES - ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}" + ENVIRONMENT "srcdir=${TEST_SOURCE_DIR};PERL=${PERL_EXECUTABLE}" WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}) # This test depends on certificate times that can exceed 32-bit time_t # range, so match the existing time tests and expect failure there. diff --git a/tests/Makefile.am b/tests/Makefile.am index 63739344d6..96a850f563 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -94,6 +94,7 @@ libtest_la_SOURCES = empty.c LDADD = libtest.la $(PLATFORM_LDADD) $(PROG_LDADD) +TESTS_ENVIRONMENT = PERL='$(PERL)' TEST_LOG_DRIVER = env AM_TAP_AWK='$(AWK)' $(SHELL) $(top_srcdir)/tap-driver.sh TESTS = @@ -919,6 +920,7 @@ check_PROGRAMS += valid_handshakes_terminate valid_handshakes_terminate_SOURCES = valid_handshakes_terminate.c # x509_verify +if HAVE_PERL # This test depends on certificate times that can exceed 32-bit time_t # range, so match the existing time tests and expect failure there. if SMALL_TIME_T @@ -926,6 +928,7 @@ XFAIL_TESTS += x509_verify.sh endif TESTS += x509_verify.sh check_PROGRAMS += x509_verify +endif x509_verify_SOURCES = x509_verify.c EXTRA_DIST += x509_verify.sh EXTRA_DIST += make-dir-roots.pl diff --git a/tests/x509_verify.sh b/tests/x509_verify.sh index cc5446cdc1..b43063fef2 100755 --- a/tests/x509_verify.sh +++ b/tests/x509_verify.sh @@ -20,6 +20,10 @@ if [ -z "$srcdir" ]; then srcdir=. fi +if [ -z "$PERL" ]; then + PERL=perl +fi + case "$srcdir" in /*) certs_path="$srcdir/certs" @@ -69,7 +73,7 @@ trap cleanup EXIT rm -rf "$workdir" mkdir "$workdir" -perl "$make_dir_roots" "$certs_path" "$workdir" +"$PERL" "$make_dir_roots" "$certs_path" "$workdir" ( cd "$workdir" From 300778a568321f445d7ac78f7bf65eee0719a4cc Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sat, 18 Jul 2026 15:40:42 +0900 Subject: [PATCH 1221/1283] Install perl5 in FreeBSD CI Install perl5 in the FreeBSD jobs. --- .github/workflows/freebsd.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index 1373dc33f5..0828c5ad5e 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -63,7 +63,7 @@ jobs: release: "${{ env.FREEBSD_VERSION }}" copyback: false prepare: | - pkg install -y cmake ninja + pkg install -y cmake ninja perl5 run: | export CTEST_OUTPUT_ON_FAILURE=1 cmake -G Ninja -B build From 3465d07a88bf8308241b7e13f9cd57d0bfa1d3ba Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sun, 19 Jul 2026 16:49:14 +0900 Subject: [PATCH 1222/1283] Run dtls_handshake_msg_test --- tests/CMakeLists.txt | 5 +++++ tests/Makefile.am | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 5aaebd9c04..8daf7d8f95 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -415,6 +415,11 @@ add_platform_test(dsatest dsatest) # set_tests_properties(dtlstest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") # endif() +# dtls_handshake_msg_test +add_executable(dtls_handshake_msg_test dtls_handshake_msg_test.c) +target_link_libraries(dtls_handshake_msg_test ${OPENSSL_TEST_LIBS}) +add_platform_test(dtls_handshake_msg_test dtls_handshake_msg_test) + # dtls_wire_test add_executable(dtls_wire_test dtls_wire_test.c) target_link_libraries(dtls_wire_test ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 96a850f563..f98fac76ae 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -435,6 +435,11 @@ dsatest_SOURCES = dsatest.c #endif #EXTRA_DIST += dtlstest.sh +# dtls_handshake_msg_test +TESTS += dtls_handshake_msg_test +check_PROGRAMS += dtls_handshake_msg_test +dtls_handshake_msg_test_SOURCES = dtls_handshake_msg_test.c + # dtls_wire_test TESTS += dtls_wire_test check_PROGRAMS += dtls_wire_test From bc188e0882f3960abd00b4b5cfd840d421d241d5 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sun, 19 Jul 2026 16:53:59 +0900 Subject: [PATCH 1223/1283] Run bn_mul_div test Although it also contains benchmark code used with --benchmark, its normal execution path runs BN_sqr() regression checks. --- tests/CMakeLists.txt | 7 +++++++ tests/Makefile.am | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 5aaebd9c04..edc36434be 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -283,6 +283,13 @@ add_executable(bn_mont bn_mont.c) target_link_libraries(bn_mont ${OPENSSL_TEST_LIBS}) add_platform_test(bn_mont bn_mont) +# bn_mul_div +if(NOT (WIN32 OR EMSCRIPTEN)) + add_executable(bn_mul_div bn_mul_div.c) + target_link_libraries(bn_mul_div ${OPENSSL_TEST_LIBS}) + add_platform_test(bn_mul_div bn_mul_div) +endif() + # bn_primes add_executable(bn_primes bn_primes.c) target_link_libraries(bn_primes ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 96a850f563..5e8b72a1dd 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -307,6 +307,13 @@ TESTS += bn_mont check_PROGRAMS += bn_mont bn_mont_SOURCES = bn_mont.c +# bn_mul_div +if !HOST_WIN +TESTS += bn_mul_div +check_PROGRAMS += bn_mul_div +bn_mul_div_SOURCES = bn_mul_div.c +endif + # bn_primes TESTS += bn_primes check_PROGRAMS += bn_primes From 2754138027798d8c9f90be6be01e730e127b9255 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sun, 19 Jul 2026 17:07:52 +0900 Subject: [PATCH 1224/1283] Run libssl tlstest regress/lib/libssl/tls/tlstest.c and regress/lib/libtls/tls/tlstest.c have the same file name, so the flattened test copy only kept the libtls test. Copy the libssl test as ssl_tlstest.c, also add a wrapper script. Ref #1273 --- tests/CMakeLists.txt | 9 +++++++++ tests/Makefile.am | 6 ++++++ tests/ssl_tlstest.sh | 43 +++++++++++++++++++++++++++++++++++++++++++ update.sh | 2 ++ 4 files changed, 60 insertions(+) create mode 100755 tests/ssl_tlstest.sh diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 5aaebd9c04..51dcff0928 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -835,6 +835,15 @@ add_executable(ssl_versions ssl_versions.c) target_link_libraries(ssl_versions ${OPENSSL_TEST_LIBS}) add_platform_test(ssl_versions ssl_versions) +# ssl_tlstest +add_executable(ssl_tlstest ssl_tlstest.c) +target_link_libraries(ssl_tlstest ${OPENSSL_TEST_LIBS}) +prepare_emscripten_test_target(ssl_tlstest) +add_platform_test(ssl_tlstest $ + ${CMAKE_CURRENT_SOURCE_DIR}/server1-rsa.pem + ${CMAKE_CURRENT_SOURCE_DIR}/server1-rsa-chain.pem + ${CMAKE_CURRENT_SOURCE_DIR}/ca-root-rsa.pem) + # ssltest add_executable(ssltest ssltest.c) target_link_libraries(ssltest ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 96a850f563..748feaf0db 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -844,6 +844,12 @@ TESTS += ssl_versions check_PROGRAMS += ssl_versions ssl_versions_SOURCES = ssl_versions.c +# ssl_tlstest +TESTS += ssl_tlstest.sh +check_PROGRAMS += ssl_tlstest +ssl_tlstest_SOURCES = ssl_tlstest.c +EXTRA_DIST += ssl_tlstest.sh + # ssltest TESTS += ssltest.sh check_PROGRAMS += ssltest diff --git a/tests/ssl_tlstest.sh b/tests/ssl_tlstest.sh new file mode 100755 index 0000000000..cde8a4f8ef --- /dev/null +++ b/tests/ssl_tlstest.sh @@ -0,0 +1,43 @@ +#!/bin/sh +# +# Copyright (c) 2026 Kenjiro Nakayama +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + +set -e + +if [ $# -ge 1 ]; then + ssl_tlstest_bin=$1 +else + ssl_tlstest_bin=./ssl_tlstest + if [ -e ./ssl_tlstest.exe ]; then + ssl_tlstest_bin=./ssl_tlstest.exe + elif [ -e ./ssl_tlstest.js ]; then + ssl_tlstest_bin=./ssl_tlstest.js + fi +fi + +if [ -z "$srcdir" ]; then + srcdir=. +fi + +case "$ssl_tlstest_bin" in +*.js) + node "$ssl_tlstest_bin" "$srcdir/server1-rsa.pem" \ + "$srcdir/server1-rsa-chain.pem" "$srcdir/ca-root-rsa.pem" + ;; +*) + "$ssl_tlstest_bin" "$srcdir/server1-rsa.pem" \ + "$srcdir/server1-rsa-chain.pem" "$srcdir/ca-root-rsa.pem" + ;; +esac diff --git a/update.sh b/update.sh index 31cd04dcf9..a6d0ebd30f 100755 --- a/update.sh +++ b/update.sh @@ -369,6 +369,8 @@ $CP $libssl_regress/ssl/testssl tests for i in `find $libssl_regress -name '*.c'`; do $CP "$i" tests done +# tls/tlstest.c collides with libtls/tls/tlstest.c when flattened. +$CP $libssl_regress/tls/tlstest.c tests/ssl_tlstest.c $CP $libssl_regress/unit/tests.h tests $CP $libssl_regress/certs/*.pem tests $CP $libssl_regress/certs/*.crl tests From 65859144213c55105d73a2b13246d490b440194e Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 19 Jul 2026 16:48:00 +0000 Subject: [PATCH 1225/1283] ci: update github/codeql-action action to v4.37.1 --- .github/workflows/cifuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 3f9a33ce9a..6b70737377 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -39,7 +39,7 @@ jobs: path: "./out/artifacts" - name: "Upload SARIF" - uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 if: always() && steps.build.outcome == 'success' with: sarif_file: "cifuzz-sarif/results.sarif" From 8d13180cabb91022244310425144c168b0ac2ba9 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Mon, 20 Jul 2026 03:29:37 +0530 Subject: [PATCH 1226/1283] use raw CRT open/close in win32 socketpair sentinel --- tests/compat/pipe2.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/tests/compat/pipe2.c b/tests/compat/pipe2.c index d7b4062064..9d93a55ef1 100644 --- a/tests/compat/pipe2.c +++ b/tests/compat/pipe2.c @@ -38,16 +38,20 @@ static int setfl(int fd, int flag) /* * Have open() temporarily use up file descriptors until reaching beyond the * allocated sockets, then leak the ones conflicting with any of the latter. + * + * open()/close() are redefined to posix_open()/posix_close() in this file, + * which tag descriptors with the 0x80000000 bit. Use the raw CRT _open/_close + * so the values compare against the socket handles in the same namespace. */ static void create_issue_1069_sentinels(int socket_vector[2]) { - int fd = open("CONIN$", O_RDONLY); + int fd = _open("CONIN$", O_RDONLY); if (fd == -1 || (fd > socket_vector[0] && fd > socket_vector[1])) { return; } create_issue_1069_sentinels(socket_vector); if (fd != socket_vector[0] && fd != socket_vector[1]) { - close(fd); + _close(fd); } } From 940c69e96b9d53cc5108eda5e71d27dabc93d826 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Tue, 21 Jul 2026 15:33:20 +0900 Subject: [PATCH 1227/1283] Skip bn_mul_div on Solaris --- CMakeLists.txt | 1 + tests/CMakeLists.txt | 3 ++- tests/Makefile.am | 3 +++ 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 3a23b98acb..c988c1549e 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -129,6 +129,7 @@ if(CMAKE_SYSTEM_NAME MATCHES "HP-UX") endif() if(CMAKE_SYSTEM_NAME MATCHES "SunOS") + set(SOLARIS TRUE) set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -std=gnu99 -fno-strict-aliasing") set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -D__EXTENSIONS__") set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -D_XOPEN_SOURCE=600") diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 20d2faa549..b1a148707a 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -284,7 +284,8 @@ target_link_libraries(bn_mont ${OPENSSL_TEST_LIBS}) add_platform_test(bn_mont bn_mont) # bn_mul_div -if(NOT (WIN32 OR EMSCRIPTEN)) +# The benchmark code uses TIMEVAL_TO_TIMESPEC, which is unavailable on Solaris. +if(NOT (WIN32 OR EMSCRIPTEN OR SOLARIS)) add_executable(bn_mul_div bn_mul_div.c) target_link_libraries(bn_mul_div ${OPENSSL_TEST_LIBS}) add_platform_test(bn_mul_div bn_mul_div) diff --git a/tests/Makefile.am b/tests/Makefile.am index a029d4a80d..d0b3adf9de 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -308,11 +308,14 @@ check_PROGRAMS += bn_mont bn_mont_SOURCES = bn_mont.c # bn_mul_div +# The benchmark code uses TIMEVAL_TO_TIMESPEC, which is unavailable on Solaris. if !HOST_WIN +if !HOST_SOLARIS TESTS += bn_mul_div check_PROGRAMS += bn_mul_div bn_mul_div_SOURCES = bn_mul_div.c endif +endif # bn_primes TESTS += bn_primes From 3660f4215d3a52f20f541c2fe0aa267b7ca5f968 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Tue, 21 Jul 2026 15:39:38 +0900 Subject: [PATCH 1228/1283] SOLARIS CMake variable for other SunOS-specific checks --- CMakeLists.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index c988c1549e..699603b6bb 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -420,7 +420,7 @@ elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm") if(APPLE) set(ENABLE_ASM false) endif() -elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND CMAKE_SYSTEM_PROCESSOR MATCHES "i386") +elseif(SOLARIS AND CMAKE_SYSTEM_PROCESSOR MATCHES "i386") set(HOST_X86_64 true) elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|x64|amd64|AMD64)") set(HOST_X86_64 true) @@ -449,7 +449,7 @@ if(ENABLE_ASM) if(CMAKE_C_COMPILER_ABI STREQUAL "ELF") if(HOST_X86_64) set(HOST_ASM_ELF_X86_64 true) - elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND HOST_I386) + elseif(SOLARIS AND HOST_I386) set(HOST_ASM_ELF_X86_64 true) endif() add_definitions(-DHAVE_GNU_STACK) From 0701024d3a9e4873a551a307a14928235047d575 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Tue, 21 Jul 2026 20:32:42 +0900 Subject: [PATCH 1229/1283] disable bn_mul_div test bn_mul_div is mostly benchmark code and depends on non-portable timing interfaces such as TIMEVAL_TO_TIMESPEC. While its normal execution path only tests squaring 0, 1, and 2, the benchmark code is still compiled and causes portability issues on some platforms. --- tests/CMakeLists.txt | 15 ++++++++------- tests/Makefile.am | 19 ++++++++++--------- 2 files changed, 18 insertions(+), 16 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index b1a148707a..ede7463732 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -283,13 +283,14 @@ add_executable(bn_mont bn_mont.c) target_link_libraries(bn_mont ${OPENSSL_TEST_LIBS}) add_platform_test(bn_mont bn_mont) -# bn_mul_div -# The benchmark code uses TIMEVAL_TO_TIMESPEC, which is unavailable on Solaris. -if(NOT (WIN32 OR EMSCRIPTEN OR SOLARIS)) - add_executable(bn_mul_div bn_mul_div.c) - target_link_libraries(bn_mul_div ${OPENSSL_TEST_LIBS}) - add_platform_test(bn_mul_div bn_mul_div) -endif() +# bn_mul_div is mostly benchmark code with non-standard timing dependencies, +# while the non-benchmark test coverage is not worth the cross-platform fallout. +# # bn_mul_div +# if(NOT (WIN32 OR EMSCRIPTEN OR SOLARIS)) +# add_executable(bn_mul_div bn_mul_div.c) +# target_link_libraries(bn_mul_div ${OPENSSL_TEST_LIBS}) +# add_platform_test(bn_mul_div bn_mul_div) +# endif() # bn_primes add_executable(bn_primes bn_primes.c) diff --git a/tests/Makefile.am b/tests/Makefile.am index d0b3adf9de..9b58724261 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -307,15 +307,16 @@ TESTS += bn_mont check_PROGRAMS += bn_mont bn_mont_SOURCES = bn_mont.c -# bn_mul_div -# The benchmark code uses TIMEVAL_TO_TIMESPEC, which is unavailable on Solaris. -if !HOST_WIN -if !HOST_SOLARIS -TESTS += bn_mul_div -check_PROGRAMS += bn_mul_div -bn_mul_div_SOURCES = bn_mul_div.c -endif -endif +# bn_mul_div is mostly benchmark code with non-standard timing dependencies, +# while the non-benchmark test coverage is not worth the cross-platform fallout. +## bn_mul_div +#if !HOST_WIN +#if !HOST_SOLARIS +#TESTS += bn_mul_div +#check_PROGRAMS += bn_mul_div +#bn_mul_div_SOURCES = bn_mul_div.c +#endif +#endif # bn_primes TESTS += bn_primes From e0bc80493b02f53cb06e17820b3bbf59cdbb77a9 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 25 Jul 2026 00:25:35 +0000 Subject: [PATCH 1230/1283] ci: update actions/checkout action to v7.0.1 --- .github/workflows/android.yml | 2 +- .github/workflows/cmake-config.yml | 2 +- .github/workflows/coverity.yml | 2 +- .github/workflows/emscripten.yml | 4 ++-- .github/workflows/fedora-rawhide.yml | 2 +- .github/workflows/freebsd.yml | 4 ++-- .github/workflows/linux.yml | 4 ++-- .github/workflows/macos.yml | 2 +- .github/workflows/release.yml | 4 ++-- .github/workflows/rust-openssl.yml | 2 +- .github/workflows/solaris.yml | 2 +- .github/workflows/windows.yml | 2 +- 12 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index 38a5462553..5e5cf66f5e 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -25,7 +25,7 @@ jobs: max-nal: 30 steps: - name: "Checkout repository" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Run CI script" run: ./scripts/test diff --git a/.github/workflows/cmake-config.yml b/.github/workflows/cmake-config.yml index 9719aac47e..5b57b78c22 100644 --- a/.github/workflows/cmake-config.yml +++ b/.github/workflows/cmake-config.yml @@ -24,7 +24,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Setup Windows dependencies" if: runner.os == 'Windows' diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index db0ca5bbba..f00e2a2b76 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -22,7 +22,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Install dependencies" run: | diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml index fa5d8dfceb..2addcecfe7 100644 --- a/.github/workflows/emscripten.yml +++ b/.github/workflows/emscripten.yml @@ -20,7 +20,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Setup emsdk" uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16 @@ -48,7 +48,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Setup emsdk" uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16 diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index 9dc48a1fb8..1283c4ac56 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -23,7 +23,7 @@ jobs: container: image: fedora:rawhide@sha256:0c1f63ed8fb818fad16cf6ae091598c410a21d2e1a9adf183beb93189299bfba steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install dependencies run: | dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index 0828c5ad5e..186c8aaf52 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -22,7 +22,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Setup" run: | @@ -49,7 +49,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Setup" run: | diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index d6f5e2bd03..a44df9d914 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -44,7 +44,7 @@ jobs: steps: - name: "Checkout repository" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Run tests" run: ./scripts/test || (status=$?; cat tests/test-suite.log; exit $status) @@ -66,7 +66,7 @@ jobs: os: ["ubuntu-24.04", "ubuntu-24.04-arm"] steps: - name: "Checkout repository" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Run tests" run: ./scripts/test diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index 0cefdcc17b..9b9d5e4476 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -28,7 +28,7 @@ jobs: run: brew install automake libtool - name: "Checkout repository" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Run tests" run: ./scripts/test diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6c590a2195..86023cf4a9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,7 +20,7 @@ jobs: contents: write # Required to create release. steps: - name: "Checkout repository" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -52,7 +52,7 @@ jobs: arch: [ "Win32", "x64", "ARM64" ] steps: - name: "Checkout repository" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index 47791a7787..37d377fdbe 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -19,7 +19,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Build LibreSSL" run: | diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index 223be20f8c..0b37515059 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -19,7 +19,7 @@ jobs: contents: read steps: - name: "Checkout repository" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Setup" run: | diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 3383ff65ff..0cd342e3c2 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -26,7 +26,7 @@ jobs: shared: ["ON", "OFF"] steps: - name: "Checkout repository" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Setup MSYS2" uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 From ada4f0ce9b0eb946bd1385841a3257731e794600 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 25 Jul 2026 06:00:50 +0000 Subject: [PATCH 1231/1283] ci: update github/codeql-action action to v4.37.3 --- .github/workflows/cifuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 6b70737377..ba54f7a6ba 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -39,7 +39,7 @@ jobs: path: "./out/artifacts" - name: "Upload SARIF" - uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 if: always() && steps.build.outcome == 'success' with: sarif_file: "cifuzz-sarif/results.sarif" From aa0670a49581b37d81f9d40d735d28a5371eb867 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 25 Jul 2026 06:00:56 +0000 Subject: [PATCH 1232/1283] ci: update vmactions/freebsd-vm action to v1.5.2 --- .github/workflows/freebsd.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index 0828c5ad5e..c3051ad4ac 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -31,7 +31,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@5a72679103d223925653750faa878a143340fbd0 # v1.5.0 + uses: vmactions/freebsd-vm@77ed28d336d03fe19a3f4f7266c1d2c4714dd79d # v1.5.2 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false @@ -58,7 +58,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@5a72679103d223925653750faa878a143340fbd0 # v1.5.0 + uses: vmactions/freebsd-vm@77ed28d336d03fe19a3f4f7266c1d2c4714dd79d # v1.5.2 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false From 8ed7575b720b990c26007082badf7c03a430cf25 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 25 Jul 2026 06:01:04 +0000 Subject: [PATCH 1233/1283] ci: update vmactions/solaris-vm action to v1.3.8 --- .github/workflows/solaris.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index 223be20f8c..5070553ec4 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -28,7 +28,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/solaris-vm@d30dd6c228c8661ade859e36ead7660b9a62efcc # v1.3.7 + uses: vmactions/solaris-vm@315163f088b66e55bbcc45928bd224d4973b2312 # v1.3.8 with: prepare: | pkg install gcc make From 2cb6e4f5215cada460aca50346478725bf754231 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Sun, 26 Jul 2026 18:47:36 +0530 Subject: [PATCH 1234/1283] error out when nc minttl is unsupported in set_common_sockopts --- patches/netcat.c.patch | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/patches/netcat.c.patch b/patches/netcat.c.patch index 0383034187..680f02b802 100644 --- a/patches/netcat.c.patch +++ b/patches/netcat.c.patch @@ -131,7 +131,7 @@ } if (Iflag) { if (setsockopt(s, SOL_SOCKET, SO_RCVBUF, -@@ -1612,13 +1641,17 @@ set_common_sockopts(int s, int af) +@@ -1612,13 +1641,27 @@ set_common_sockopts(int s, int af) } if (minttl != -1) { @@ -139,6 +139,11 @@ if (af == AF_INET && setsockopt(s, IPPROTO_IP, IP_MINTTL, &minttl, sizeof(minttl))) err(1, "set IP min TTL"); ++#else ++ if (af == AF_INET) { ++ errno = ENOPROTOOPT; ++ err(1, "set IP min TTL not supported"); ++ } +#endif - else if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6, @@ -146,11 +151,16 @@ + if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6, IPV6_MINHOPCOUNT, &minttl, sizeof(minttl))) err(1, "set IPv6 min hop count"); ++#else ++ if (af == AF_INET6) { ++ errno = ENOPROTOOPT; ++ err(1, "set IPv6 min hop count not supported"); ++ } +#endif } } -@@ -1849,15 +1882,19 @@ help(void) +@@ -1849,15 +1892,19 @@ help(void) \t-P proxyuser\tUsername for proxy authentication\n\ \t-p port\t Specify local port for remote connects\n\ \t-R CAfile CA bundle\n\ From 77bf7f28ec393eae42719aea28b9191fa4c0d7cb Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Wed, 29 Jul 2026 16:16:59 +0530 Subject: [PATCH 1235/1283] use errx instead of setting errno for unsupported minttl --- patches/netcat.c.patch | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/patches/netcat.c.patch b/patches/netcat.c.patch index 680f02b802..216debc460 100644 --- a/patches/netcat.c.patch +++ b/patches/netcat.c.patch @@ -131,7 +131,7 @@ } if (Iflag) { if (setsockopt(s, SOL_SOCKET, SO_RCVBUF, -@@ -1612,13 +1641,27 @@ set_common_sockopts(int s, int af) +@@ -1612,13 +1641,23 @@ set_common_sockopts(int s, int af) } if (minttl != -1) { @@ -140,10 +140,8 @@ IP_MINTTL, &minttl, sizeof(minttl))) err(1, "set IP min TTL"); +#else -+ if (af == AF_INET) { -+ errno = ENOPROTOOPT; -+ err(1, "set IP min TTL not supported"); -+ } ++ if (af == AF_INET) ++ errx(1, "set IP min TTL not supported"); +#endif - else if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6, @@ -152,15 +150,13 @@ IPV6_MINHOPCOUNT, &minttl, sizeof(minttl))) err(1, "set IPv6 min hop count"); +#else -+ if (af == AF_INET6) { -+ errno = ENOPROTOOPT; -+ err(1, "set IPv6 min hop count not supported"); -+ } ++ if (af == AF_INET6) ++ errx(1, "set IPv6 min hop count not supported"); +#endif } } -@@ -1849,15 +1892,19 @@ help(void) +@@ -1849,15 +1888,19 @@ help(void) \t-P proxyuser\tUsername for proxy authentication\n\ \t-p port\t Specify local port for remote connects\n\ \t-R CAfile CA bundle\n\ From 2f042c86e9dfadd8d74f06fe2994dd0ed7023a03 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Wed, 29 Jul 2026 18:15:05 +0530 Subject: [PATCH 1236/1283] set close-on-exec on the tty descriptor in readpassphrase --- apps/nc/compat/readpassphrase.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/nc/compat/readpassphrase.c b/apps/nc/compat/readpassphrase.c index f3aa24868e..2a1e9ef1fb 100644 --- a/apps/nc/compat/readpassphrase.c +++ b/apps/nc/compat/readpassphrase.c @@ -94,6 +94,8 @@ readpassphrase(const char *prompt, char *buf, size_t bufsiz, int flags) } input = STDIN_FILENO; output = STDERR_FILENO; + } else { + (void)fcntl(input, F_SETFD, FD_CLOEXEC); } /* From df1ed6bb4ec3e72c20a7082cc168a45ae67704ba Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sun, 19 Jul 2026 18:08:07 +0900 Subject: [PATCH 1237/1283] add libssl verify test Copy regress/lib/libssl/verify/verify.c as ssl_verify.c to avoid basename collisions when regress tests are flattened into tests. Copy create-libressl-test-certs.pl and add a wrapper that generates the test certificates before running ssl_verify. Detect the required IO::Socket::SSL::Utils Perl module and register the test with both autotools and CMake when it is available. Also document x509/bettertls is not included. --- .gitignore | 2 ++ CMakeLists.txt | 9 +++++++ configure.ac | 11 ++++++++ tests/CMakeLists.txt | 11 ++++++++ tests/Makefile.am | 10 ++++++++ tests/ssl_verify.sh | 60 ++++++++++++++++++++++++++++++++++++++++++++ update.sh | 6 +++++ 7 files changed, 109 insertions(+) create mode 100755 tests/ssl_verify.sh diff --git a/.gitignore b/.gitignore index 8a72400e2c..d85df81568 100644 --- a/.gitignore +++ b/.gitignore @@ -141,10 +141,12 @@ tests/*test.c tests/pbkdf2* tests/*.pem tests/certs/ +tests/create-libressl-test-certs.pl tests/make-dir-roots.pl tests/testssl tests/*.txt tests/compat/*.c +tests/ssl_verify.c tests/verify* tests/x509_verify* !tests/x509_verify.sh diff --git a/CMakeLists.txt b/CMakeLists.txt index 699603b6bb..4ffe67bd49 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -33,6 +33,15 @@ include(GNUInstallDirs) enable_testing() find_program(PERL_EXECUTABLE perl perl5) +set(HAVE_PERL_IO_SOCKET_SSL_UTILS FALSE) +if(PERL_EXECUTABLE) + execute_process(COMMAND ${PERL_EXECUTABLE} -MIO::Socket::SSL::Utils -e 1 + RESULT_VARIABLE PERL_IO_SOCKET_SSL_UTILS_RESULT + OUTPUT_QUIET ERROR_QUIET) + if(PERL_IO_SOCKET_SSL_UTILS_RESULT EQUAL 0) + set(HAVE_PERL_IO_SOCKET_SSL_UTILS TRUE) + endif() +endif() file(READ ${CMAKE_CURRENT_SOURCE_DIR}/ssl/VERSION SSL_VERSION) string(STRIP ${SSL_VERSION} SSL_VERSION) diff --git a/configure.ac b/configure.ac index 9012535acd..23f0c38cbc 100644 --- a/configure.ac +++ b/configure.ac @@ -34,6 +34,17 @@ LT_INIT([pic-only]) AC_CHECK_PROGS([PERL], [perl perl5]) AM_CONDITIONAL([HAVE_PERL], [test "x$PERL" != x]) +AC_CACHE_CHECK([for IO::Socket::SSL::Utils], + [ac_cv_perl_io_socket_ssl_utils], + [if test "x$PERL" = x; then + ac_cv_perl_io_socket_ssl_utils=no + elif "$PERL" -MIO::Socket::SSL::Utils -e 1 >/dev/null 2>&1; then + ac_cv_perl_io_socket_ssl_utils=yes + else + ac_cv_perl_io_socket_ssl_utils=no + fi]) +AM_CONDITIONAL([HAVE_PERL_IO_SOCKET_SSL_UTILS], + [test "x$ac_cv_perl_io_socket_ssl_utils" = xyes]) CHECK_OS_OPTIONS diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index ede7463732..45681a15cf 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -844,6 +844,17 @@ add_executable(ssl_verify_param ssl_verify_param.c) target_link_libraries(ssl_verify_param ${OPENSSL_TEST_LIBS}) add_platform_test(ssl_verify_param ssl_verify_param) +# ssl_verify +add_executable(ssl_verify ssl_verify.c) +target_link_libraries(ssl_verify ${OPENSSL_TEST_LIBS}) +if(NOT WIN32 AND NOT EMSCRIPTEN AND HAVE_PERL_IO_SOCKET_SSL_UTILS) + add_test(NAME ssl_verify COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssl_verify.sh + $) + set_tests_properties(ssl_verify PROPERTIES + ENVIRONMENT "srcdir=${TEST_SOURCE_DIR};PERL=${PERL_EXECUTABLE}" + WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}) +endif() + # ssl_versions add_executable(ssl_versions ssl_versions.c) target_link_libraries(ssl_versions ${OPENSSL_TEST_LIBS}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 9b58724261..7d581c8fe0 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -104,6 +104,7 @@ EXTRA_DIST = CMakeLists.txt DISTCLEANFILES = pidwraptest.txt distclean-local: + rm -rf ssl_verify-certs rm -rf x509_verify-certs # XXX - should probably be in their own static lib @@ -855,6 +856,15 @@ TESTS += ssl_verify_param check_PROGRAMS += ssl_verify_param ssl_verify_param_SOURCES = ssl_verify_param.c +# ssl_verify +if HAVE_PERL_IO_SOCKET_SSL_UTILS +TESTS += ssl_verify.sh +check_PROGRAMS += ssl_verify +endif +ssl_verify_SOURCES = ssl_verify.c +EXTRA_DIST += ssl_verify.sh +EXTRA_DIST += create-libressl-test-certs.pl + # ssl_versions TESTS += ssl_versions check_PROGRAMS += ssl_versions diff --git a/tests/ssl_verify.sh b/tests/ssl_verify.sh new file mode 100755 index 0000000000..ed329117e9 --- /dev/null +++ b/tests/ssl_verify.sh @@ -0,0 +1,60 @@ +#!/bin/sh +# +# Copyright (c) 2026 Kenjiro Nakayama +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + +set -e + +if [ -z "$srcdir" ]; then + srcdir=. +fi + +if [ -z "$PERL" ]; then + PERL=perl +fi + +case "$srcdir" in +/*) + create_certs="$srcdir/create-libressl-test-certs.pl" + ;; +*) + create_certs="`pwd`/$srcdir/create-libressl-test-certs.pl" + ;; +esac + +if [ $# -ge 1 ]; then + verify_bin=$1 +else + verify_bin="`pwd`/ssl_verify" + if [ -e ./ssl_verify.exe ]; then + verify_bin="`pwd`/ssl_verify.exe" + fi +fi + +workdir=ssl_verify-certs + +cleanup() +{ + rm -rf "$workdir" +} +trap cleanup EXIT + +rm -rf "$workdir" +mkdir "$workdir" + +( + cd "$workdir" + "$PERL" "$create_certs" + "$verify_bin" +) diff --git a/update.sh b/update.sh index a6d0ebd30f..83864d3fd2 100755 --- a/update.sh +++ b/update.sh @@ -336,6 +336,8 @@ for i in `find $libcrypto_regress -name '*.[ch]'`; do done # x509/verify.c collides with x509/bettertls/verify.c when flattened. $CP $libcrypto_regress/x509/verify.c tests/x509_verify.c +# Do not copy x509/bettertls/verify.c: it requires the large bettertls +# certificate corpus, which is not worth bundling in release tarballs. $CP $libcrypto_regress/evp/evptests.txt tests $CP $libcrypto_regress/aead/*.txt tests $CP $libcrypto_regress/ct/ctlog.conf tests @@ -371,6 +373,10 @@ for i in `find $libssl_regress -name '*.c'`; do done # tls/tlstest.c collides with libtls/tls/tlstest.c when flattened. $CP $libssl_regress/tls/tlstest.c tests/ssl_tlstest.c +# verify/verify.c collides with other verify tests when flattened. +rm -f tests/verify.c +$CP $libssl_regress/verify/verify.c tests/ssl_verify.c +$CP $libssl_regress/verify/create-libressl-test-certs.pl tests $CP $libssl_regress/unit/tests.h tests $CP $libssl_regress/certs/*.pem tests $CP $libssl_regress/certs/*.crl tests From 686304f1581c4bbc49e8a87408e9e38d4b72445a Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Thu, 30 Jul 2026 06:42:58 +0900 Subject: [PATCH 1238/1283] ci: install the IO::Socket::SSL test dependency Install IO::Socket::SSL to enable the ssl_verify regress test. --- .github/workflows/fedora-rawhide.yml | 3 ++- .github/workflows/freebsd.yml | 6 ++++-- .github/workflows/linux.yml | 12 ++++++++++++ .github/workflows/macos.yml | 7 ++++++- .github/workflows/solaris.yml | 2 ++ 5 files changed, 26 insertions(+), 4 deletions(-) diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index 1283c4ac56..078bc028c7 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -26,7 +26,8 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install dependencies run: | - dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk + dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk perl-IO-Socket-SSL + perl -MIO::Socket::SSL::Utils -e 1 - name: Pull upstream source run: | ./update.sh diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index 64de2439fc..4e38efdf77 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -36,8 +36,9 @@ jobs: release: "${{ env.FREEBSD_VERSION }}" copyback: false prepare: | - pkg install -y autoconf automake libtool + pkg install -y autoconf automake libtool p5-IO-Socket-SSL run: | + perl -MIO::Socket::SSL::Utils -e 1 ./configure make -j2 check || (cat tests/test-suite.log && exit 1) @@ -63,8 +64,9 @@ jobs: release: "${{ env.FREEBSD_VERSION }}" copyback: false prepare: | - pkg install -y cmake ninja perl5 + pkg install -y cmake ninja p5-IO-Socket-SSL run: | + perl -MIO::Socket::SSL::Utils -e 1 export CTEST_OUTPUT_ON_FAILURE=1 cmake -G Ninja -B build ninja -C build diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index a44df9d914..197e8946f0 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -46,6 +46,12 @@ jobs: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: "Install test dependencies" + run: | + sudo apt-get update + sudo apt-get install -y libio-socket-ssl-perl + perl -MIO::Socket::SSL::Utils -e 1 + - name: "Run tests" run: ./scripts/test || (status=$?; cat tests/test-suite.log; exit $status) env: @@ -68,6 +74,12 @@ jobs: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: "Install test dependencies" + run: | + sudo apt-get update + sudo apt-get install -y libio-socket-ssl-perl + perl -MIO::Socket::SSL::Utils -e 1 + - name: "Run tests" run: ./scripts/test env: diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index 9b9d5e4476..c619b17110 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -25,7 +25,12 @@ jobs: arch: ["arm64", "x86_64"] steps: - name: "Install required packages" - run: brew install automake libtool + run: | + brew install automake libtool perl cpanminus + PERL="$(brew --prefix perl)/bin/perl" + "$PERL" "$(command -v cpanm)" --notest IO::Socket::SSL + echo "$(brew --prefix perl)/bin" >> "$GITHUB_PATH" + "$PERL" -MIO::Socket::SSL::Utils -e 1 - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index 24c4056661..0e50f5f723 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -32,6 +32,8 @@ jobs: with: prepare: | pkg install gcc make + PERL_MM_USE_DEFAULT=1 cpan -T IO::Socket::SSL run: | + perl -MIO::Socket::SSL::Utils -e 1 MAKE=gmake ./configure gmake -j2 check || (cat tests/test-suite.log && exit 1) From 0ffff5c1543b3c88640e8b61d52057e96c71da64 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Thu, 30 Jul 2026 08:01:17 +0900 Subject: [PATCH 1239/1283] Run libssl verify test on windows --- .github/workflows/windows.yml | 9 +++++++- tests/CMakeLists.txt | 13 ++++++++--- tests/Makefile.am | 1 + tests/ssl_verify.bat | 42 +++++++++++++++++++++++++++++++++++ 4 files changed, 61 insertions(+), 4 deletions(-) create mode 100644 tests/ssl_verify.bat diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 0cd342e3c2..4814ffa227 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -29,6 +29,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: "Setup MSYS2" + id: msys2 uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: update: true @@ -38,6 +39,7 @@ jobs: git patch perl + perl-IO-Socket-SSL - name: "Update" shell: msys2 {0} @@ -46,6 +48,11 @@ jobs: - name: "Configure CMake" shell: pwsh run: | + $perl = Join-Path '${{ steps.msys2.outputs.msys2-location }}' 'usr\bin\perl.exe' + & $perl -MIO::Socket::SSL::Utils -e 1 + if ($LASTEXITCODE -ne 0) { + throw "IO::Socket::SSL::Utils is unavailable" + } $generator = cmake --help | Select-String '^\s*\*?\s*(Visual Studio \d+ \d+)' | Select-Object -First 1 | @@ -54,7 +61,7 @@ jobs: throw "No Visual Studio CMake generator found" } Write-Host "Using generator: $generator" - cmake -Bbuild -G "$generator" -A ${{ matrix.arch }} -D BUILD_SHARED_LIBS=${{ matrix.shared }} -D CMAKE_INSTALL_PREFIX=../local + cmake -Bbuild -G "$generator" -A ${{ matrix.arch }} -D BUILD_SHARED_LIBS=${{ matrix.shared }} -D CMAKE_INSTALL_PREFIX=../local "-DPERL_EXECUTABLE=$perl" - name: "Build" shell: cmd diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 45681a15cf..d0093737f8 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -847,9 +847,16 @@ add_platform_test(ssl_verify_param ssl_verify_param) # ssl_verify add_executable(ssl_verify ssl_verify.c) target_link_libraries(ssl_verify ${OPENSSL_TEST_LIBS}) -if(NOT WIN32 AND NOT EMSCRIPTEN AND HAVE_PERL_IO_SOCKET_SSL_UTILS) - add_test(NAME ssl_verify COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssl_verify.sh - $) +if(NOT EMSCRIPTEN AND HAVE_PERL_IO_SOCKET_SSL_UTILS) + if(WIN32) + add_test(NAME ssl_verify COMMAND + ${CMAKE_CURRENT_SOURCE_DIR}/ssl_verify.bat + $) + else() + add_test(NAME ssl_verify COMMAND + ${CMAKE_CURRENT_SOURCE_DIR}/ssl_verify.sh + $) + endif() set_tests_properties(ssl_verify PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR};PERL=${PERL_EXECUTABLE}" WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}) diff --git a/tests/Makefile.am b/tests/Makefile.am index 7d581c8fe0..9d30359318 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -863,6 +863,7 @@ check_PROGRAMS += ssl_verify endif ssl_verify_SOURCES = ssl_verify.c EXTRA_DIST += ssl_verify.sh +EXTRA_DIST += ssl_verify.bat EXTRA_DIST += create-libressl-test-certs.pl # ssl_versions diff --git a/tests/ssl_verify.bat b/tests/ssl_verify.bat new file mode 100644 index 0000000000..1b8c1dc183 --- /dev/null +++ b/tests/ssl_verify.bat @@ -0,0 +1,42 @@ +@echo off +setlocal + +:: Copyright (c) 2026 Kenjiro Nakayama +:: +:: Permission to use, copy, modify, and distribute this software for any +:: purpose with or without fee is hereby granted, provided that the above +:: copyright notice and this permission notice appear in all copies. +:: +:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + +if "%~1" == "" exit /b 1 + +set "ssl_verify_bin=%~1" +set "ssl_verify_bin=%ssl_verify_bin:/=\%" +if not exist "%ssl_verify_bin%" exit /b 1 + +if not defined srcdir set "srcdir=." +if not defined PERL set "PERL=perl" + +set "workdir=ssl_verify-certs" +if exist "%workdir%" rmdir /s /q "%workdir%" +mkdir "%workdir%" || exit /b 1 +pushd "%workdir%" || exit /b 1 + +set "status=1" +"%PERL%" "%srcdir%/create-libressl-test-certs.pl" +if errorlevel 1 goto cleanup + +"%ssl_verify_bin%" +set "status=%errorlevel%" + +:cleanup +popd +rmdir /s /q "%workdir%" +exit /b %status% From a97b0679c2945d968373e8f68d96162df56960d4 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Thu, 30 Jul 2026 08:32:11 +0900 Subject: [PATCH 1240/1283] Run libssl verify test on Emscripten --- .github/workflows/emscripten.yml | 12 ++++++++++++ tests/CMakeLists.txt | 5 ++++- tests/ssl_verify.sh | 9 ++++++++- 3 files changed, 24 insertions(+), 2 deletions(-) diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml index 2addcecfe7..bd4c9a720f 100644 --- a/.github/workflows/emscripten.yml +++ b/.github/workflows/emscripten.yml @@ -22,6 +22,12 @@ jobs: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: "Install test dependencies" + run: | + sudo apt-get update + sudo apt-get install -y libio-socket-ssl-perl + perl -MIO::Socket::SSL::Utils -e 1 + - name: "Setup emsdk" uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16 with: @@ -50,6 +56,12 @@ jobs: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: "Install test dependencies" + run: | + sudo apt-get update + sudo apt-get install -y libio-socket-ssl-perl + perl -MIO::Socket::SSL::Utils -e 1 + - name: "Setup emsdk" uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16 with: diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index d0093737f8..03fe2267e5 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -847,7 +847,10 @@ add_platform_test(ssl_verify_param ssl_verify_param) # ssl_verify add_executable(ssl_verify ssl_verify.c) target_link_libraries(ssl_verify ${OPENSSL_TEST_LIBS}) -if(NOT EMSCRIPTEN AND HAVE_PERL_IO_SOCKET_SSL_UTILS) +if(EMSCRIPTEN) + set_target_properties(ssl_verify PROPERTIES LINK_FLAGS "-sNODERAWFS=1") +endif() +if(HAVE_PERL_IO_SOCKET_SSL_UTILS) if(WIN32) add_test(NAME ssl_verify COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/ssl_verify.bat diff --git a/tests/ssl_verify.sh b/tests/ssl_verify.sh index ed329117e9..bb090dbc22 100755 --- a/tests/ssl_verify.sh +++ b/tests/ssl_verify.sh @@ -56,5 +56,12 @@ mkdir "$workdir" ( cd "$workdir" "$PERL" "$create_certs" - "$verify_bin" + case "$verify_bin" in + *.js) + node "$verify_bin" + ;; + *) + "$verify_bin" + ;; + esac ) From 23a8457db83adaa9809b273fd2187df4507c47c1 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Thu, 30 Jul 2026 09:07:26 +0900 Subject: [PATCH 1241/1283] Add ALLOW_MEMORY_GROWTH on emscription --- tests/CMakeLists.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 03fe2267e5..1fd3dc4308 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -848,7 +848,8 @@ add_platform_test(ssl_verify_param ssl_verify_param) add_executable(ssl_verify ssl_verify.c) target_link_libraries(ssl_verify ${OPENSSL_TEST_LIBS}) if(EMSCRIPTEN) - set_target_properties(ssl_verify PROPERTIES LINK_FLAGS "-sNODERAWFS=1") + set_target_properties(ssl_verify PROPERTIES LINK_FLAGS + "-sALLOW_MEMORY_GROWTH -sNODERAWFS=1") endif() if(HAVE_PERL_IO_SOCKET_SSL_UTILS) if(WIN32) From a63377faa2aabf5ab9b8e14ba9202950f5a00e62 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Thu, 30 Jul 2026 14:11:30 +0900 Subject: [PATCH 1242/1283] Update tests/CMakeLists.txt Co-authored-by: Theo Buehler --- tests/CMakeLists.txt | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 1fd3dc4308..92588cc1d9 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -847,10 +847,7 @@ add_platform_test(ssl_verify_param ssl_verify_param) # ssl_verify add_executable(ssl_verify ssl_verify.c) target_link_libraries(ssl_verify ${OPENSSL_TEST_LIBS}) -if(EMSCRIPTEN) - set_target_properties(ssl_verify PROPERTIES LINK_FLAGS - "-sALLOW_MEMORY_GROWTH -sNODERAWFS=1") -endif() +prepare_emscripten_test_target(ssl_verify) if(HAVE_PERL_IO_SOCKET_SSL_UTILS) if(WIN32) add_test(NAME ssl_verify COMMAND From 6c466fce38cca290c7760306a57ee32fe2b3ac4e Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Thu, 30 Jul 2026 13:19:47 +0530 Subject: [PATCH 1243/1283] verify the accepted peer in the win32 socketpair emulation --- tests/compat/pipe2.c | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/tests/compat/pipe2.c b/tests/compat/pipe2.c index 9d93a55ef1..c0189db151 100644 --- a/tests/compat/pipe2.c +++ b/tests/compat/pipe2.c @@ -74,8 +74,15 @@ int socketpair(int domain, int type, int protocol, int socket_vector[2]) .sin_port = 0, }; + struct sockaddr_in self, peer; int yes = 1, e; - if (setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, + + /* + * SO_REUSEADDR does not mean here what it means on unix: it lets any + * other process bind the same address and port and take over the + * rendezvous. SO_EXCLUSIVEADDRUSE is the flag that keeps the port ours. + */ + if (setsockopt(listener, SOL_SOCKET, SO_EXCLUSIVEADDRUSE, (void *)&yes, sizeof yes) == -1) goto err; @@ -104,6 +111,28 @@ int socketpair(int domain, int type, int protocol, int socket_vector[2]) if (socket_vector[1] == -1) goto err; + /* + * The listening port is enumerable by anything running as the user, so + * the connection we just accepted is not necessarily the one we made. + * Pair the two halves only if they are each other's peer. + */ + memset(&self, 0, sizeof self); + addrlen = sizeof self; + if (getsockname(socket_vector[0], (struct sockaddr *)&self, &addrlen) != 0) + goto err; + + memset(&peer, 0, sizeof peer); + addrlen = sizeof peer; + if (getpeername(socket_vector[1], (struct sockaddr *)&peer, &addrlen) != 0) + goto err; + + if (self.sin_family != peer.sin_family || + self.sin_addr.s_addr != peer.sin_addr.s_addr || + self.sin_port != peer.sin_port) { + WSASetLastError(WSAECONNREFUSED); + goto err; + } + closesocket(listener); create_issue_1069_sentinels(socket_vector); From 515955745b835904d20f90e431a92c598a24f5a5 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Fri, 31 Jul 2026 09:23:50 +0900 Subject: [PATCH 1244/1283] hook up the x509 callback tests Copy callback.pl and add a wrapper that prepares the hashed roots directory and checks the callback output. Register callback, callbackfailures, and expirecallback with both autotools and CMake. --- tests/CMakeLists.txt | 28 +++++++++++-- tests/Makefile.am | 20 +++++++-- tests/x509_callbacks.sh | 92 +++++++++++++++++++++++++++++++++++++++++ update.sh | 1 + 4 files changed, 133 insertions(+), 8 deletions(-) create mode 100755 tests/x509_callbacks.sh diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 92588cc1d9..ac9c5baeea 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -342,8 +342,30 @@ add_executable(bytestringtest bytestringtest.c) target_link_libraries(bytestringtest ${OPENSSL_TEST_LIBS}) add_platform_test(bytestringtest bytestringtest) -# callback -# callbackfailures +# x509_callbacks +add_executable(callback callback.c) +target_link_libraries(callback ${OPENSSL_TEST_LIBS}) +add_executable(callbackfailures callbackfailures.c) +target_link_libraries(callbackfailures ${OPENSSL_TEST_LIBS}) +add_executable(expirecallback expirecallback.c) +target_link_libraries(expirecallback ${OPENSSL_TEST_LIBS}) +add_dependencies(callback openssl) +if(NOT WIN32 AND NOT EMSCRIPTEN AND PERL_EXECUTABLE) + add_test(NAME x509_callbacks COMMAND + ${CMAKE_CURRENT_SOURCE_DIR}/x509_callbacks.sh + $ + $ + $ + $) + set_tests_properties(x509_callbacks PROPERTIES + ENVIRONMENT "srcdir=${TEST_SOURCE_DIR};PERL=${PERL_EXECUTABLE}" + WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}) + # These tests use the same certificate corpus as x509_verify and can + # exceed the range of a 32-bit time_t. + if(SMALL_TIME_T) + set_property(TEST x509_callbacks PROPERTY WILL_FAIL TRUE) + endif() +endif() # casttest add_executable(casttest casttest.c) @@ -503,8 +525,6 @@ add_executable(exdata_test exdata_test.c) target_link_libraries(exdata_test ${OPENSSL_TEST_LIBS}) add_platform_test(exdata_test exdata_test) -# expirecallback.c - # explicit_bzero # SA_ONSTACK is unavailable on Windows, sigsuspend is unavailable on Emscripten if(NOT (WIN32 OR EMSCRIPTEN)) diff --git a/tests/Makefile.am b/tests/Makefile.am index 9d30359318..aec438bb21 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -105,6 +105,7 @@ DISTCLEANFILES = pidwraptest.txt distclean-local: rm -rf ssl_verify-certs + rm -rf x509_callback-certs rm -rf x509_verify-certs # XXX - should probably be in their own static lib @@ -365,8 +366,21 @@ TESTS += bytestringtest check_PROGRAMS += bytestringtest bytestringtest_SOURCES = bytestringtest.c -# callback -# callbackfailures +# x509_callbacks +if HAVE_PERL +# These tests use the same certificate corpus as x509_verify and can exceed +# the range of a 32-bit time_t. +if SMALL_TIME_T +XFAIL_TESTS += x509_callbacks.sh +endif +TESTS += x509_callbacks.sh +check_PROGRAMS += callback callbackfailures expirecallback +endif +callback_SOURCES = callback.c +callbackfailures_SOURCES = callbackfailures.c +expirecallback_SOURCES = expirecallback.c +EXTRA_DIST += x509_callbacks.sh +EXTRA_DIST += callback.pl # casttest TESTS += casttest @@ -524,8 +538,6 @@ TESTS += exdata_test check_PROGRAMS += exdata_test exdata_test_SOURCES = exdata_test.c -# expirecallback.c - # explicit_bzero # explicit_bzero relies on SA_ONSTACK, which is unavailable on Windows if !HOST_WIN diff --git a/tests/x509_callbacks.sh b/tests/x509_callbacks.sh new file mode 100755 index 0000000000..7cc1376f54 --- /dev/null +++ b/tests/x509_callbacks.sh @@ -0,0 +1,92 @@ +#!/bin/sh +# +# Copyright (c) 2026 Kenjiro Nakayama +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + +set -e + +if [ -z "$srcdir" ]; then + srcdir=. +fi + +if [ -z "$PERL" ]; then + PERL=perl +fi + +case "$srcdir" in +/*) + certs_path="$srcdir/certs" + callback_check="$srcdir/callback.pl" + make_dir_roots="$srcdir/make-dir-roots.pl" + openssl_conf="$srcdir/openssl.cnf" + ;; +*) + certs_path="`pwd`/$srcdir/certs" + callback_check="`pwd`/$srcdir/callback.pl" + make_dir_roots="`pwd`/$srcdir/make-dir-roots.pl" + openssl_conf="`pwd`/$srcdir/openssl.cnf" + ;; +esac + +if [ $# -ge 3 ]; then + callback_bin=$1 + callbackfailures_bin=$2 + expirecallback_bin=$3 +else + callback_bin="`pwd`/callback" + callbackfailures_bin="`pwd`/callbackfailures" + expirecallback_bin="`pwd`/expirecallback" + if [ -e ./callback.exe ]; then + callback_bin="`pwd`/callback.exe" + callbackfailures_bin="`pwd`/callbackfailures.exe" + expirecallback_bin="`pwd`/expirecallback.exe" + fi +fi + +if [ $# -ge 4 ]; then + openssl_dir=`dirname "$4"` +elif [ -d ../apps/openssl ]; then + openssl_dir="`pwd`/../apps/openssl" +else + openssl_dir="`pwd`/../apps" +fi + +PATH="$openssl_dir:$PATH" +export PATH + +if [ -f "$openssl_conf" ]; then + OPENSSL_CONF="$openssl_conf" + export OPENSSL_CONF +fi + +workdir=x509_callback-certs + +cleanup() +{ + rm -rf "$workdir" +} +trap cleanup EXIT + +rm -rf "$workdir" +mkdir "$workdir" + +"$PERL" "$make_dir_roots" "$certs_path" "$workdir" + +( + cd "$workdir" + "$callback_bin" "$certs_path" + "$PERL" "$callback_check" callback.out + "$callbackfailures_bin" "$certs_path" + "$expirecallback_bin" "$certs_path" +) diff --git a/update.sh b/update.sh index 83864d3fd2..b863d4ac26 100755 --- a/update.sh +++ b/update.sh @@ -342,6 +342,7 @@ $CP $libcrypto_regress/evp/evptests.txt tests $CP $libcrypto_regress/aead/*.txt tests $CP $libcrypto_regress/ct/ctlog.conf tests $CP $libcrypto_regress/ct/*.crt tests +$CP $libcrypto_regress/x509/callback.pl tests $CP $libcrypto_regress/x509/make-dir-roots.pl tests rm -rf tests/certs mkdir -p tests/certs From a10cbdaf4fb6d11f741464ef162c1ffdeeb926b2 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Fri, 31 Jul 2026 10:24:59 +0900 Subject: [PATCH 1245/1283] pass the bundled CA file to callbackfailures Pass cert.pem using the optional roots file argument instead of relying on the /etc/ssl/cert.pem path. --- tests/x509_callbacks.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tests/x509_callbacks.sh b/tests/x509_callbacks.sh index 7cc1376f54..a48e638115 100755 --- a/tests/x509_callbacks.sh +++ b/tests/x509_callbacks.sh @@ -27,12 +27,14 @@ fi case "$srcdir" in /*) certs_path="$srcdir/certs" + ca_file="$srcdir/../cert.pem" callback_check="$srcdir/callback.pl" make_dir_roots="$srcdir/make-dir-roots.pl" openssl_conf="$srcdir/openssl.cnf" ;; *) certs_path="`pwd`/$srcdir/certs" + ca_file="`pwd`/$srcdir/../cert.pem" callback_check="`pwd`/$srcdir/callback.pl" make_dir_roots="`pwd`/$srcdir/make-dir-roots.pl" openssl_conf="`pwd`/$srcdir/openssl.cnf" @@ -87,6 +89,6 @@ mkdir "$workdir" cd "$workdir" "$callback_bin" "$certs_path" "$PERL" "$callback_check" callback.out - "$callbackfailures_bin" "$certs_path" + "$callbackfailures_bin" "$certs_path" "$ca_file" "$expirecallback_bin" "$certs_path" ) From 4445467b5ce6d39478918d17fe117511935452c0 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Sat, 1 Aug 2026 00:29:46 +0530 Subject: [PATCH 1246/1283] don't override pledge and unveil when the host provides them --- CMakeLists.txt | 10 ++++++++++ include/compat/unistd.h | 5 +++++ m4/check-libc.m4 | 2 +- 3 files changed, 16 insertions(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 4ffe67bd49..cae3cb9b37 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -343,6 +343,16 @@ if(HAVE_GETPROGNAME) add_definitions(-DHAVE_GETPROGNAME) endif() +check_symbol_exists(pledge "unistd.h" HAVE_PLEDGE) +if(HAVE_PLEDGE) + add_definitions(-DHAVE_PLEDGE) +endif() + +check_symbol_exists(unveil "unistd.h" HAVE_UNVEIL) +if(HAVE_UNVEIL) + add_definitions(-DHAVE_UNVEIL) +endif() + check_symbol_exists(syslog_r "syslog.h;stdarg.h" HAVE_SYSLOG_R) if(HAVE_SYSLOG_R) add_definitions(-DHAVE_SYSLOG_R) diff --git a/include/compat/unistd.h b/include/compat/unistd.h index 544cb27852..0ce66dde1a 100644 --- a/include/compat/unistd.h +++ b/include/compat/unistd.h @@ -75,8 +75,13 @@ int getentropy(void *buf, size_t buflen); int getpagesize(void); #endif +#ifndef HAVE_PLEDGE #define pledge(request, paths) 0 +#endif + +#ifndef HAVE_UNVEIL #define unveil(path, permissions) 0 +#endif #ifndef HAVE_PIPE2 int pipe2(int fildes[2], int flags); diff --git a/m4/check-libc.m4 b/m4/check-libc.m4 index eec3cb3887..42867cc133 100644 --- a/m4/check-libc.m4 +++ b/m4/check-libc.m4 @@ -61,7 +61,7 @@ AM_CONDITIONAL([HAVE_SYSLOG_R], [test "x$ac_cv_func_syslog_r" = xyes]) ]) AC_DEFUN([CHECK_SYSCALL_COMPAT], [ -AC_CHECK_FUNCS([accept4 pipe2 pledge poll socketpair]) +AC_CHECK_FUNCS([accept4 pipe2 pledge poll socketpair unveil]) AM_CONDITIONAL([HAVE_ACCEPT4], [test "x$ac_cv_func_accept4" = xyes]) AM_CONDITIONAL([HAVE_PIPE2], [test "x$ac_cv_func_pipe2" = xyes]) AM_CONDITIONAL([HAVE_PLEDGE], [test "x$ac_cv_func_pledge" = xyes]) From 07c4326f0b6f9016dfc0e323033ce99b9d81d4f8 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sat, 1 Aug 2026 08:02:48 +0900 Subject: [PATCH 1247/1283] cmake: use full sysconf path for OPENSSLDIR CMAKE_INSTALL_SYSCONFDIR is relative to the install prefix by default. Using it for OPENSSLDIR causes TLS_DEFAULT_CA_FILE to be set to the relative path `etc/ssl/cert.pem`. Use CMAKE_INSTALL_FULL_SYSCONFDIR for the runtime path while retaining CMAKE_INSTALL_SYSCONFDIR for the install destination. Fix #1346 --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index cae3cb9b37..98a02993c0 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -520,7 +520,7 @@ if(OPENSSLDIR STREQUAL "") if(WIN32) set(OPENSSLDIR "C:/Windows/libressl/ssl") else() - set(OPENSSLDIR "${CMAKE_INSTALL_SYSCONFDIR}/ssl") + set(OPENSSLDIR "${CMAKE_INSTALL_FULL_SYSCONFDIR}/ssl") endif() set(CONF_DIR "${CMAKE_INSTALL_SYSCONFDIR}/ssl") From 2959e39c51f45afb3ccb9d7a14124e7e6e81ce65 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 2 Aug 2026 09:59:31 +0000 Subject: [PATCH 1248/1283] ci: update github/codeql-action action to v4.37.4 --- .github/workflows/cifuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index ba54f7a6ba..88c6a2d271 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -39,7 +39,7 @@ jobs: path: "./out/artifacts" - name: "Upload SARIF" - uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 + uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 if: always() && steps.build.outcome == 'success' with: sarif_file: "cifuzz-sarif/results.sarif" From 314bbeab844d35890726515d464acda282fcf066 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Mon, 3 Aug 2026 17:06:47 +0530 Subject: [PATCH 1249/1283] cmake: use the builtin arc4random on weakly seeded platforms --- CMakeLists.txt | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index 98a02993c0..ac0ca31e6f 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -21,6 +21,7 @@ endif() project(LibreSSL LANGUAGES C ASM) +include(CheckCSourceCompiles) include(CheckFunctionExists) include(CheckSymbolExists) include(CheckLibraryExists) @@ -307,7 +308,60 @@ if(HAVE_STRTONUM) add_definitions(-DHAVE_STRTONUM) endif() +# +# arc4random on these platform versions falls back to a weak seed when it +# cannot open /dev/random, so the builtin one is used there instead. Same +# versions as the USE_BUILTIN_ARC4RANDOM checks in m4/check-os-options.m4. +# +set(USE_BUILTIN_ARC4RANDOM FALSE) +if(APPLE) + # getentropy(2) arrived in 10.12 but is not tagged as introduced + # there, so the deployment target has to be tested directly. + check_c_source_compiles(" + #include + #include + #include + #ifndef MAC_OS_X_VERSION_10_12 + #define MAC_OS_X_VERSION_10_12 101200 + #endif + #if defined(MAC_OS_X_VERSION_MIN_REQUIRED) + #if MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_12 + #error \"Targeting Mac OS X 10.11 or earlier\" + #endif + #endif + int main(void) { char buf[1]; return getentropy(buf, 1); }" + HAVE_MACOS_GETENTROPY) + if(NOT HAVE_MACOS_GETENTROPY) + set(USE_BUILTIN_ARC4RANDOM TRUE) + endif() +elseif(CMAKE_SYSTEM_NAME MATCHES "FreeBSD") + check_c_source_compiles(" + #include + #if __FreeBSD_version < 1200000 + #error \"FreeBSD 11 or earlier\" + #endif + int main(void) { return 0; }" + HAVE_FREEBSD_ARC4RANDOM) + if(NOT HAVE_FREEBSD_ARC4RANDOM) + set(USE_BUILTIN_ARC4RANDOM TRUE) + endif() +elseif(CMAKE_SYSTEM_NAME MATCHES "NetBSD") + check_c_source_compiles(" + #include + #if __NetBSD_Version__ < 700000001 + #error \"NetBSD 6 or earlier\" + #endif + int main(void) { return 0; }" + HAVE_NETBSD_ARC4RANDOM) + if(NOT HAVE_NETBSD_ARC4RANDOM) + set(USE_BUILTIN_ARC4RANDOM TRUE) + endif() +endif() + check_symbol_exists(arc4random_buf "stdlib.h" HAVE_ARC4RANDOM_BUF) +if(USE_BUILTIN_ARC4RANDOM) + set(HAVE_ARC4RANDOM_BUF FALSE) +endif() if(HAVE_ARC4RANDOM_BUF) add_definitions(-DHAVE_ARC4RANDOM_BUF) endif() @@ -329,6 +383,10 @@ endif() # XXX macos fails to find getentropy with check_symbol_exists() check_function_exists(getentropy HAVE_GETENTROPY) +if(APPLE AND NOT HAVE_MACOS_GETENTROPY) + # Weakly linked against the SDK, but absent at runtime before 10.12. + set(HAVE_GETENTROPY FALSE) +endif() if(HAVE_GETENTROPY) add_definitions(-DHAVE_GETENTROPY) endif() From e6f1677b72f9f53e1d5f7b5ba1f0fca706b7fb62 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 8 Aug 2026 01:42:50 +0000 Subject: [PATCH 1250/1283] ci: update github/codeql-action action to v4.37.6 --- .github/workflows/cifuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 88c6a2d271..cfcdfc57eb 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -39,7 +39,7 @@ jobs: path: "./out/artifacts" - name: "Upload SARIF" - uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 + uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 if: always() && steps.build.outcome == 'success' with: sarif_file: "cifuzz-sarif/results.sarif" From 9a60f6ed0ee51adcd12264b749dc6220be7e37a6 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sat, 8 Aug 2026 15:55:10 +0900 Subject: [PATCH 1251/1283] Build Emscripten targets in parallel Pass --parallel 4 to cmake --build for both the regular and ASAN Emscripten jobs. --- .github/workflows/emscripten.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml index bd4c9a720f..6087abac0c 100644 --- a/.github/workflows/emscripten.yml +++ b/.github/workflows/emscripten.yml @@ -40,7 +40,7 @@ jobs: run: emcmake cmake -Bbuild - name: "Build" - run: cmake --build build --config Release + run: cmake --build build --config Release --parallel 4 - name: "Test" run: ctest --test-dir build -C Release --output-on-failure @@ -77,7 +77,7 @@ jobs: LDFLAGS: "-fsanitize=address" - name: "Build" - run: cmake --build build --config Release + run: cmake --build build --config Release --parallel 4 - name: "Test" run: ctest --test-dir build -C Release --output-on-failure From 71aba26edb2c3951c5c9f9fcb2ae3bb40ac291c6 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sat, 8 Aug 2026 16:01:21 +0900 Subject: [PATCH 1252/1283] Install CI dependencies in workflows Move APT package installation from scripts/test to the CI workflows. Build the Linux package list based on the target architecture so that CMake, Ninja, QEMU, and the required cross-compilers are installed together. This makes the packages required by each target explicit and avoids repeated apt-get operations within each CI job. --- .github/workflows/android.yml | 5 +++++ .github/workflows/linux.yml | 25 +++++++++++++++++++++++-- scripts/test | 18 ------------------ 3 files changed, 28 insertions(+), 20 deletions(-) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index 5e5cf66f5e..a2faa94cfe 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -27,6 +27,11 @@ jobs: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: "Install build dependencies" + run: | + sudo apt-get update + sudo apt-get install -y cmake ninja-build + - name: "Run CI script" run: ./scripts/test env: diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 197e8946f0..ad13ed8dc5 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -48,8 +48,29 @@ jobs: - name: "Install test dependencies" run: | + packages=(cmake ninja-build libio-socket-ssl-perl) + case "${{ matrix.arch }}" in + mingw32|mingw64) + packages+=(mingw-w64) + ;; + arm32) + packages+=(qemu-user-static binfmt-support g++-arm-linux-gnueabihf) + ;; + arm64) + packages+=(qemu-user-static binfmt-support g++-aarch64-linux-gnu) + ;; + loong64) + packages+=(qemu-user-static binfmt-support g++-14-loongarch64-linux-gnu) + ;; + mips32) + packages+=(qemu-user-static binfmt-support g++-mips-linux-gnu) + ;; + mips64) + packages+=(qemu-user-static binfmt-support g++-mips64el-linux-gnuabi64) + ;; + esac sudo apt-get update - sudo apt-get install -y libio-socket-ssl-perl + sudo apt-get install -y "${packages[@]}" perl -MIO::Socket::SSL::Utils -e 1 - name: "Run tests" @@ -77,7 +98,7 @@ jobs: - name: "Install test dependencies" run: | sudo apt-get update - sudo apt-get install -y libio-socket-ssl-perl + sudo apt-get install -y cmake ninja-build libio-socket-ssl-perl perl -MIO::Socket::SSL::Utils -e 1 - name: "Run tests" diff --git a/scripts/test b/scripts/test index 2148d528d3..0e84b22201 100755 --- a/scripts/test +++ b/scripts/test @@ -41,11 +41,6 @@ setup_cross_compiler() { echo "##### Using $($CC --version | head -n 1)" } -if type apt-get >/dev/null 2>&1; then - sudo apt-get update - sudo apt-get install -y cmake ninja-build -fi - # generate source tree ./autogen.sh @@ -122,10 +117,6 @@ elif [ "$ARCH" = "mingw32" ] || [ "$ARCH" = "mingw64" ]; then CPU=x86_64 fi - if ! type i686-w64-mingw32-gcc > /dev/null; then - sudo apt-get install -y mingw-w64 - fi - ./configure --host=$CPU-w64-mingw32 make -j 4 @@ -145,17 +136,13 @@ elif [ "$ARCH" = "mingw32" ] || [ "$ARCH" = "mingw64" ]; then ) elif [ "$ARCH" = "arm32" ] || [ "$ARCH" = "arm64" ]; then - sudo apt-get install -y qemu-user-static binfmt-support - if [ "$ARCH" = "arm32" ]; then - sudo apt-get install -y g++-arm-linux-gnueabihf sudo ln -sf /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.3 /lib/ setup_cross_compiler arm-linux-gnueabihf ./configure --host=arm-linux-gnueabihf LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib make -j 4 check else - sudo apt-get install -y g++-aarch64-linux-gnu sudo ln -sf /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.1 /lib/ setup_cross_compiler aarch64-linux-gnu @@ -166,7 +153,6 @@ elif [ "$ARCH" = "arm32" ] || [ "$ARCH" = "arm64" ]; then file apps/openssl/openssl elif [ "$ARCH" = "loong64" ]; then - sudo apt install -y qemu-user-static binfmt-support g++-14-loongarch64-linux-gnu sudo ln -sf /usr/loongarch64-linux-gnu/lib64/ld-linux-loongarch-lp64d.so.1 /lib64 setup_cross_compiler loongarch64-linux-gnu @@ -176,17 +162,13 @@ elif [ "$ARCH" = "loong64" ]; then file apps/openssl/openssl elif [ "$ARCH" = "mips32" ] || [ "$ARCH" = "mips64" ]; then - sudo apt-get install -y qemu-user-static binfmt-support - if [ "$ARCH" = "mips32" ]; then - sudo apt-get install -y g++-mips-linux-gnu sudo ln -sf /usr/mips-linux-gnu/lib/ld.so.1 /lib/ setup_cross_compiler mips-linux-gnu ./configure --host=mips-linux-gnu LD_LIBRARY_PATH=/usr/mips-linux-gnu/lib make -j 4 check else - sudo apt-get install -y g++-mips64el-linux-gnuabi64 sudo ln -sf /usr/mips64el-linux-gnuabi64/lib64/ld.so.1 /lib64 setup_cross_compiler mips64el-linux-gnuabi64 From 2489ccf3d8af2299866276b4c58741a345a16d13 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Sat, 8 Aug 2026 17:37:40 +0530 Subject: [PATCH 1253/1283] fix double free of lock in pthread_mutex_destroy --- include/compat/pthread.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/include/compat/pthread.h b/include/compat/pthread.h index 8211dda327..7702dcd543 100644 --- a/include/compat/pthread.h +++ b/include/compat/pthread.h @@ -110,8 +110,11 @@ pthread_mutex_unlock(pthread_mutex_t *mutex) static inline int pthread_mutex_destroy(pthread_mutex_t *mutex) { - DeleteCriticalSection(mutex->lock); - free(mutex->lock); + if (mutex->lock != NULL) { + DeleteCriticalSection(mutex->lock); + free(mutex->lock); + mutex->lock = NULL; + } return 0; } From 27882f103d16faed6bf4a3b424711da4efafff9e Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sat, 8 Aug 2026 11:02:53 +0900 Subject: [PATCH 1254/1283] cmake: enable SHA assembly on ELF AArch64 Autotools already enables the AArch64 SHA assembly for ELF targets, while CMake does not enable the corresponding assembly path. Bring CMake in line with Autotools: - Enable HOST_ASM_ELF_AARCH64 for ELF AArch64 - Use the existing SHA-1 and SHA-256 assembly sources - Replace the duplicate SHA-256 entry with the missing SHA-512 source - Define LIBRESSL_USE_SHA_ASSEMBLY --- CMakeLists.txt | 4 +++- crypto/CMakeLists.txt | 3 ++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 98a02993c0..b65b4a28de 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -466,7 +466,9 @@ endif() if(ENABLE_ASM) if(CMAKE_C_COMPILER_ABI STREQUAL "ELF") - if(HOST_X86_64) + if(HOST_AARCH64) + set(HOST_ASM_ELF_AARCH64 true) + elseif(HOST_X86_64) set(HOST_ASM_ELF_X86_64 true) elseif(SOLARIS AND HOST_I386) set(HOST_ASM_ELF_X86_64 true) diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index d566182a33..491b9b4e4f 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -22,8 +22,9 @@ if(HOST_ASM_ELF_AARCH64) ASM_AARCH64_ELF_SRC sha/sha1_aarch64_ce.S sha/sha256_aarch64_ce.S - sha/sha256_aarch64_ce.S + sha/sha512_aarch64_ce.S ) + add_definitions(-DLIBRESSL_USE_SHA_ASSEMBLY) set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_AARCH64_ELF_SRC}) endif() From 201688e0e5297592281379a55568b16a13c0b8f0 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sat, 8 Aug 2026 09:34:10 +0900 Subject: [PATCH 1255/1283] ci: run Windows ARM64 tests on native runners Currently, ARM64 builds are cross-compiled on x64 Windows runners and the tests are skipped. With this change, static and shared ARM64 builds run on windows-11-arm runners, allowing the test suite to execute natively. Running the tests natively also exposes incorrect code generation by the MSVC ARM64 optimizer when the generic bn_ct_ne_zero() helper is inlined. Work around this by using the _CountLeadingZeros64() intrinsic on MSVC ARM64, avoiding the affected optimizer transformation and allowing the tests to pass. --- .github/workflows/windows.yml | 26 ++++++++++++++++++++++---- patches/win32_arm64_bn_arch.h.patch | 21 +++++++++++++++++++++ 2 files changed, 43 insertions(+), 4 deletions(-) create mode 100644 patches/win32_arm64_bn_arch.h.patch diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 4814ffa227..27e6633a05 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -22,8 +22,15 @@ jobs: fail-fast: false matrix: os: ["windows-2022", "windows-2025"] - arch: ["ARM64", "x64", "Win32"] + arch: ["x64", "Win32"] shared: ["ON", "OFF"] + include: + - os: "windows-11-arm" + arch: "ARM64" + shared: "ON" + - os: "windows-11-arm" + arch: "ARM64" + shared: "OFF" steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -53,12 +60,24 @@ jobs: if ($LASTEXITCODE -ne 0) { throw "IO::Socket::SSL::Utils is unavailable" } + + $vswhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe' + $component = if ('${{ matrix.arch }}' -eq 'ARM64') { + 'Microsoft.VisualStudio.Component.VC.Tools.ARM64' + } else { + 'Microsoft.VisualStudio.Component.VC.Tools.x86.x64' + } + $version = & $vswhere -latest -products * -requires $component -property installationVersion + if (-not $version) { + throw "No Visual Studio installation with $component found" + } + $major = $version.Split('.')[0] $generator = cmake --help | - Select-String '^\s*\*?\s*(Visual Studio \d+ \d+)' | + Select-String "^\s*\*?\s*(Visual Studio $major \d+)" | Select-Object -First 1 | ForEach-Object { $_.Matches[0].Groups[1].Value } if (-not $generator) { - throw "No Visual Studio CMake generator found" + throw "No CMake generator found for Visual Studio $major" } Write-Host "Using generator: $generator" cmake -Bbuild -G "$generator" -A ${{ matrix.arch }} -D BUILD_SHARED_LIBS=${{ matrix.shared }} -D CMAKE_INSTALL_PREFIX=../local "-DPERL_EXECUTABLE=$perl" @@ -68,7 +87,6 @@ jobs: run: cmake --build build --config Release - name: "Test" - if: matrix.arch != 'ARM64' shell: cmd run: ctest --test-dir build -C Release --output-on-failure diff --git a/patches/win32_arm64_bn_arch.h.patch b/patches/win32_arm64_bn_arch.h.patch new file mode 100644 index 0000000000..427ed948eb --- /dev/null +++ b/patches/win32_arm64_bn_arch.h.patch @@ -0,0 +1,21 @@ +--- crypto/bn/arch/aarch64/bn_arch.h.orig ++++ crypto/bn/arch/aarch64/bn_arch.h +@@ -20,4 +20,17 @@ + #ifndef HEADER_BN_ARCH_H + #define HEADER_BN_ARCH_H +- ++#if defined(_MSC_VER) && defined(_M_ARM64) ++ ++#include ++ ++#define HAVE_BN_CT_NE_ZERO ++ ++static inline int ++bn_ct_ne_zero(BN_ULONG w) ++{ ++ return 1U ^ (_CountLeadingZeros64((unsigned __int64)w) >> 6); ++} ++ ++#endif ++ + #ifndef OPENSSL_NO_ASM From b6be4f08fc83e11c8cae4b97ce2a5c90e9076883 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 9 Aug 2026 05:06:08 +0000 Subject: [PATCH 1256/1283] ci: update vmactions/freebsd-vm action to v1.5.3 --- .github/workflows/freebsd.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index 4e38efdf77..b0f8390c4a 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -31,7 +31,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@77ed28d336d03fe19a3f4f7266c1d2c4714dd79d # v1.5.2 + uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1.5.3 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false @@ -59,7 +59,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@77ed28d336d03fe19a3f4f7266c1d2c4714dd79d # v1.5.2 + uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1.5.3 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false From 2aaf4dbee62926f4b3149d2fd6e2d40b2f6e1dd0 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 10 Aug 2026 01:25:20 -0600 Subject: [PATCH 1257/1283] Update man links --- man/links | 1 - 1 file changed, 1 deletion(-) diff --git a/man/links b/man/links index 8af55887e7..87bd8055f0 100644 --- a/man/links +++ b/man/links @@ -1174,7 +1174,6 @@ MD5.3,MD5_Update.3 NAME_CONSTRAINTS_new.3,GENERAL_SUBTREE_free.3 NAME_CONSTRAINTS_new.3,GENERAL_SUBTREE_new.3 NAME_CONSTRAINTS_new.3,NAME_CONSTRAINTS_free.3 -OBJ_create.3,OBJ_add_object.3 OBJ_create.3,OBJ_cleanup.3 OBJ_create.3,OBJ_create_objects.3 OBJ_create.3,OBJ_new_nid.3 From 05b343edd8581d797522051f1e903063429d6601 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Mon, 10 Aug 2026 18:13:42 +0530 Subject: [PATCH 1258/1283] merge the ftruncate shim into posix_win.c ftruncate was the only fd shim that passed its descriptor to the CRT without stripping the posix_open() tag bit, so _chsize() rejected the negative fd with EBADF and the truncation failed. Move the shim into posix_win.c so it can use get_real_fd() like fstat, close, read and write, and drop the build glue for the separate ftruncate.c. --- crypto/CMakeLists.txt | 4 ---- crypto/Makefile.am | 4 ---- crypto/compat/ftruncate.c | 17 ----------------- crypto/compat/posix_win.c | 8 ++++++++ m4/check-libc.m4 | 1 - 5 files changed, 8 insertions(+), 26 deletions(-) delete mode 100644 crypto/compat/ftruncate.c diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 491b9b4e4f..0698ab44ce 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt @@ -637,10 +637,6 @@ if(NOT HAVE_FREEZERO) set(COMPAT_SRC ${COMPAT_SRC} compat/freezero.c) endif() -if(NOT HAVE_FTRUNCATE) - set(COMPAT_SRC ${COMPAT_SRC} compat/ftruncate.c) -endif() - if(NOT HAVE_GETDELIM) set(COMPAT_SRC ${COMPAT_SRC} compat/getdelim.c) endif() diff --git a/crypto/Makefile.am b/crypto/Makefile.am index f703e33cfc..7969aee772 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -148,10 +148,6 @@ if !HAVE_FREEZERO libcompat_la_SOURCES += compat/freezero.c endif -if !HAVE_FTRUNCATE -libcompat_la_SOURCES += compat/ftruncate.c -endif - if !HAVE_GETDELIM libcompat_la_SOURCES += compat/getdelim.c endif diff --git a/crypto/compat/ftruncate.c b/crypto/compat/ftruncate.c deleted file mode 100644 index e825e50452..0000000000 --- a/crypto/compat/ftruncate.c +++ /dev/null @@ -1,17 +0,0 @@ -/* - * Public domain - * - * Kinichiro Inoguchi - */ - -#ifdef _WIN32 - -#include - -int -ftruncate(int fd, off_t length) -{ - return _chsize(fd, length); -} - -#endif diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c index 4e98643686..60b2896adf 100644 --- a/crypto/compat/posix_win.c +++ b/crypto/compat/posix_win.c @@ -68,6 +68,14 @@ libressl_fstat(int fd, struct stat *statbuf) return fstat(get_real_fd(fd), statbuf); } +#ifndef HAVE_FTRUNCATE +int +ftruncate(int fd, off_t length) +{ + return _chsize(get_real_fd(fd), length); +} +#endif + int posix_open(const char *path, ...) { diff --git a/m4/check-libc.m4 b/m4/check-libc.m4 index 42867cc133..8ecc89a6fa 100644 --- a/m4/check-libc.m4 +++ b/m4/check-libc.m4 @@ -39,7 +39,6 @@ AC_CACHE_CHECK([for getpagesize], ac_cv_func_getpagesize, [ ]) AM_CONDITIONAL([HAVE_ASPRINTF], [test "x$ac_cv_func_asprintf" = xyes]) AM_CONDITIONAL([HAVE_FREEZERO], [test "x$ac_cv_func_freezero" = xyes]) -AM_CONDITIONAL([HAVE_FTRUNCATE], [test "x$ac_cv_func_ftruncate" = xyes]) AM_CONDITIONAL([HAVE_GETDELIM], [test "x$ac_cv_func_getdelim" = xyes]) AM_CONDITIONAL([HAVE_GETLINE], [test "x$ac_cv_func_getline" = xyes]) AM_CONDITIONAL([HAVE_GETPAGESIZE], [test "x$ac_cv_func_getpagesize" = xyes]) From ebdedf67ea07b3e4193d446179970b74764eab0b Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Tue, 11 Aug 2026 23:13:36 +0530 Subject: [PATCH 1259/1283] set cloexec on the socket handle in win32 socketpair setfd --- tests/compat/pipe2.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/tests/compat/pipe2.c b/tests/compat/pipe2.c index c0189db151..3e79575924 100644 --- a/tests/compat/pipe2.c +++ b/tests/compat/pipe2.c @@ -18,9 +18,10 @@ static int setfd(int fd, int flag) { int rc = -1; if (flag & FD_CLOEXEC) { - HANDLE h = (HANDLE)_get_osfhandle(fd); - if (h != NULL) - rc = SetHandleInformation(h, HANDLE_FLAG_INHERIT, 0) == 0 ? -1 : 0; + /* fd is a Winsock SOCKET, not a CRT descriptor: use it as a + * handle directly rather than translating with _get_osfhandle. */ + HANDLE h = (HANDLE)(LONG_PTR)fd; + rc = SetHandleInformation(h, HANDLE_FLAG_INHERIT, 0) == 0 ? -1 : 0; } return rc; } From 5c9fab02349c8c426840320867c6611b6755cd9d Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Wed, 12 Aug 2026 07:31:15 +0900 Subject: [PATCH 1260/1283] ci: use Visual Studio 2026 for Windows ARM64 The Visual Studio 2022 MSVC ARM64 optimizer miscompiles the inlined generic bn_ct_ne_zero() helper. The existing patch works around this by using the _CountLeadingZeros64() intrinsic. The issue is fixed in Visual Studio 2026 v18.8.2. Switch the ARM64 jobs to windows-11-vs2026-arm and remove the workaround. --- .github/workflows/windows.yml | 4 ++-- patches/win32_arm64_bn_arch.h.patch | 21 --------------------- 2 files changed, 2 insertions(+), 23 deletions(-) delete mode 100644 patches/win32_arm64_bn_arch.h.patch diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 27e6633a05..729ff464cf 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -25,10 +25,10 @@ jobs: arch: ["x64", "Win32"] shared: ["ON", "OFF"] include: - - os: "windows-11-arm" + - os: "windows-11-vs2026-arm" arch: "ARM64" shared: "ON" - - os: "windows-11-arm" + - os: "windows-11-vs2026-arm" arch: "ARM64" shared: "OFF" steps: diff --git a/patches/win32_arm64_bn_arch.h.patch b/patches/win32_arm64_bn_arch.h.patch deleted file mode 100644 index 427ed948eb..0000000000 --- a/patches/win32_arm64_bn_arch.h.patch +++ /dev/null @@ -1,21 +0,0 @@ ---- crypto/bn/arch/aarch64/bn_arch.h.orig -+++ crypto/bn/arch/aarch64/bn_arch.h -@@ -20,4 +20,17 @@ - #ifndef HEADER_BN_ARCH_H - #define HEADER_BN_ARCH_H -- -+#if defined(_MSC_VER) && defined(_M_ARM64) -+ -+#include -+ -+#define HAVE_BN_CT_NE_ZERO -+ -+static inline int -+bn_ct_ne_zero(BN_ULONG w) -+{ -+ return 1U ^ (_CountLeadingZeros64((unsigned __int64)w) >> 6); -+} -+ -+#endif -+ - #ifndef OPENSSL_NO_ASM From 2677aab92004fd799305093381eaf181ff8b7cd2 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Wed, 12 Aug 2026 08:57:45 +0900 Subject: [PATCH 1261/1283] update.sh: do not ignore git failures git describe is expected to fail when HEAD is not exactly at a tag. However, the set +e used for this check also allowed fetch, checkout, and pull failures to be ignored, causing less useful missing-file errors later in the script. Re-enable set -e immediately after recording the git describe result so that subsequent Git operations fail at the actual error. --- update.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/update.sh b/update.sh index b863d4ac26..ddd2cf35b9 100755 --- a/update.sh +++ b/update.sh @@ -30,6 +30,7 @@ fi set +e tag=`git describe --exact-match --tags HEAD 2>/dev/null` is_tag=$? +set -e # adjust for 9 hour time delta between trees release_ts=$((`git show -s --format=%ct $tag|tail -1` + 32400)) commit=`git -C openbsd rev-list -n 1 --before=$release_ts origin/$openbsd_branch` @@ -45,7 +46,6 @@ else git -C openbsd checkout $openbsd_branch git -C openbsd pull fi -set -e # setup source paths CWD=`pwd` From 3e403cfebd94cbff248e7acac5073a7a123c421b Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Wed, 12 Aug 2026 13:44:41 +0900 Subject: [PATCH 1262/1283] crypto: limit MSVC ARM64 workaround to older compilers Apply the ARM64 bn_ct_ne_zero() workaround to MSVC versions older than 19.51.36252. This compiler was verified to generate correct code without the workaround. --- patches/win32_arm64_bn_arch.h.patch | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 patches/win32_arm64_bn_arch.h.patch diff --git a/patches/win32_arm64_bn_arch.h.patch b/patches/win32_arm64_bn_arch.h.patch new file mode 100644 index 0000000000..0d0db42c82 --- /dev/null +++ b/patches/win32_arm64_bn_arch.h.patch @@ -0,0 +1,22 @@ +--- crypto/bn/arch/aarch64/bn_arch.h.orig ++++ crypto/bn/arch/aarch64/bn_arch.h +@@ -20,4 +20,18 @@ + #ifndef HEADER_BN_ARCH_H + #define HEADER_BN_ARCH_H +- ++/* See pull/1355. */ ++#if defined(_MSC_VER) && defined(_M_ARM64) && _MSC_FULL_VER < 195136252 ++ ++#include ++ ++#define HAVE_BN_CT_NE_ZERO ++ ++static inline int ++bn_ct_ne_zero(BN_ULONG w) ++{ ++ return 1U ^ (_CountLeadingZeros64((unsigned __int64)w) >> 6); ++} ++ ++#endif ++ + #ifndef OPENSSL_NO_ASM From c88ca1f5d3d910d1b1dc9c5f5fe30f261c078e90 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Thu, 13 Aug 2026 09:23:31 +0900 Subject: [PATCH 1263/1283] cmake: detect the MSVC ARM64 optimizer bug Run the reproducer when configuring native MSVC ARM64 builds and enable the bn_ct_ne_zero() workaround only when the test fails. Retain the workaround when cross-compiling, where the test cannot be run. Run the check in the Release configuration and report its result so the selected code path is visible in the configure log. --- CMakeLists.txt | 91 +++++++++++++++++++++++++++++ patches/win32_arm64_bn_arch.h.patch | 5 +- 2 files changed, 94 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 4b15da96d3..0a59ddc94a 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -522,6 +522,97 @@ else() set(ENABLE_ASM false) endif() +if(MSVC AND HOST_AARCH64 AND NOT CMAKE_CROSSCOMPILING AND + CMAKE_HOST_SYSTEM_PROCESSOR MATCHES "(aarch64|arm64|ARM64)") + set(BN_CT_TEST_SOURCE "${CMAKE_CURRENT_BINARY_DIR}/bn_ct_test.c") + file(WRITE "${BN_CT_TEST_SOURCE}" [=[ +#include +#include +#include + +typedef uint64_t BN_ULONG; + +#define BN_BITS2 64 + +static __inline int +bn_ct_ne_zero(BN_ULONG w) +{ + return (w | ~(w - 1)) >> (BN_BITS2 - 1); +} + +static __inline void +bn_addw(BN_ULONG a, BN_ULONG b, BN_ULONG *out_r1, BN_ULONG *out_r0) +{ + BN_ULONG c1, c2, r1, r0; + + c1 = a | b; + c2 = a & b; + r0 = a + b; + r1 = ((c1 & ~r0) | c2) >> (BN_BITS2 - 1); + + *out_r1 = r1; + *out_r0 = r0; +} + +static __inline void +bn_addw_addw(BN_ULONG a, BN_ULONG b, BN_ULONG c, BN_ULONG *out_r1, + BN_ULONG *out_r0) +{ + BN_ULONG carry, r1, r0; + + bn_addw(a, b, &r1, &r0); + bn_addw(r0, c, &carry, &r0); + r1 += carry; + + *out_r1 = r1; + *out_r0 = r0; +} + +static BN_ULONG +make_mask(BN_ULONG a, BN_ULONG b, BN_ULONG c, BN_ULONG borrow) +{ + BN_ULONG carry, ignored; + + bn_addw_addw(a, b, c, &carry, &ignored); + + return bn_ct_ne_zero(carry) - borrow; +} + +static volatile BN_ULONG input_a = UINT64_MAX; +static volatile BN_ULONG input_b = 1; +static volatile BN_ULONG input_c = 0; +static volatile BN_ULONG input_borrow = 0; + +int +main(void) +{ + BN_ULONG actual, expected = 1; + + actual = make_mask(input_a, input_b, input_c, input_borrow); + if (actual != expected) { + printf("FAIL: expected 0x%016" PRIx64 ", got 0x%016" PRIx64 "\n", + expected, actual); + return 1; + } + + return 0; +} +]=]) + set(BN_CT_SAVED_CONFIGURATION "${CMAKE_TRY_COMPILE_CONFIGURATION}") + set(CMAKE_TRY_COMPILE_CONFIGURATION Release) + try_run(BN_CT_RUN_RESULT BN_CT_COMPILED + "${CMAKE_CURRENT_BINARY_DIR}" + "${BN_CT_TEST_SOURCE}") + set(CMAKE_TRY_COMPILE_CONFIGURATION "${BN_CT_SAVED_CONFIGURATION}") + if(BN_CT_COMPILED AND BN_CT_RUN_RESULT EQUAL 0) + message(STATUS "MSVC ARM64 optimizer check passed; workaround disabled") + add_definitions(-DMSVC_ARM64_BN_CT_NE_ZERO_WORKS) + else() + message(STATUS "MSVC ARM64 optimizer check failed; workaround enabled " + "(compiled=${BN_CT_COMPILED}, result=${BN_CT_RUN_RESULT})") + endif() +endif() + if(ENABLE_ASM) if(CMAKE_C_COMPILER_ABI STREQUAL "ELF") if(HOST_AARCH64) diff --git a/patches/win32_arm64_bn_arch.h.patch b/patches/win32_arm64_bn_arch.h.patch index 0d0db42c82..c8071a84e4 100644 --- a/patches/win32_arm64_bn_arch.h.patch +++ b/patches/win32_arm64_bn_arch.h.patch @@ -1,11 +1,12 @@ --- crypto/bn/arch/aarch64/bn_arch.h.orig +++ crypto/bn/arch/aarch64/bn_arch.h -@@ -20,4 +20,18 @@ +@@ -20,4 +20,19 @@ #ifndef HEADER_BN_ARCH_H #define HEADER_BN_ARCH_H - +/* See pull/1355. */ -+#if defined(_MSC_VER) && defined(_M_ARM64) && _MSC_FULL_VER < 195136252 ++#if defined(_MSC_VER) && defined(_M_ARM64) && \ ++ !defined(MSVC_ARM64_BN_CT_NE_ZERO_WORKS) + +#include + From e0c8f345b8e118be7b77c93d9b64e56b83fed9c6 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Thu, 13 Aug 2026 13:29:38 +0900 Subject: [PATCH 1264/1283] Revert windows-11-vs2026-arm in workflow --- .github/workflows/windows.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 729ff464cf..27e6633a05 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -25,10 +25,10 @@ jobs: arch: ["x64", "Win32"] shared: ["ON", "OFF"] include: - - os: "windows-11-vs2026-arm" + - os: "windows-11-arm" arch: "ARM64" shared: "ON" - - os: "windows-11-vs2026-arm" + - os: "windows-11-arm" arch: "ARM64" shared: "OFF" steps: From 9a3899d3ea4289fb647c0440d94a1e743618d94f Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Thu, 13 Aug 2026 13:38:31 +0900 Subject: [PATCH 1265/1283] ci: use Visual Studio 2026 for Windows ARM64 Switch the static and shared ARM64 jobs to the windows-11-vs2026-arm runner. --- .github/workflows/windows.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 27e6633a05..729ff464cf 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -25,10 +25,10 @@ jobs: arch: ["x64", "Win32"] shared: ["ON", "OFF"] include: - - os: "windows-11-arm" + - os: "windows-11-vs2026-arm" arch: "ARM64" shared: "ON" - - os: "windows-11-arm" + - os: "windows-11-vs2026-arm" arch: "ARM64" shared: "OFF" steps: From 58698377353bd0ea06dd68cefcbd3aee05bb1622 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Thu, 13 Aug 2026 16:30:07 +0900 Subject: [PATCH 1266/1283] ci: test RISC-V with QEMU Cross-compile for riscv64 on Ubuntu 24.04 and run the test suite through QEMU, covering the RISC-V-specific crypto code. --- .github/workflows/linux.yml | 6 ++++++ scripts/test | 9 +++++++++ 2 files changed, 15 insertions(+) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index ad13ed8dc5..4fbe98750b 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -35,6 +35,9 @@ jobs: - os: "ubuntu-24.04" # loong64 arch: "loong64" compiler: "gcc" + - os: "ubuntu-24.04" + arch: "riscv64" + compiler: "gcc" - os: "ubuntu-24.04-arm" arch: "native" compiler: "gcc" @@ -68,6 +71,9 @@ jobs: mips64) packages+=(qemu-user-static binfmt-support g++-mips64el-linux-gnuabi64) ;; + riscv64) + packages+=(qemu-user-static binfmt-support g++-riscv64-linux-gnu) + ;; esac sudo apt-get update sudo apt-get install -y "${packages[@]}" diff --git a/scripts/test b/scripts/test index 0e84b22201..7e64bf1580 100755 --- a/scripts/test +++ b/scripts/test @@ -161,6 +161,15 @@ elif [ "$ARCH" = "loong64" ]; then file apps/openssl/openssl +elif [ "$ARCH" = "riscv64" ]; then + sudo ln -sf /usr/riscv64-linux-gnu/lib/ld-linux-riscv64-lp64d.so.1 /lib/ + setup_cross_compiler riscv64-linux-gnu + + ./configure --host=riscv64-linux-gnu + LD_LIBRARY_PATH=/usr/riscv64-linux-gnu/lib make -j 4 check + + file apps/openssl/openssl + elif [ "$ARCH" = "mips32" ] || [ "$ARCH" = "mips64" ]; then if [ "$ARCH" = "mips32" ]; then sudo ln -sf /usr/mips-linux-gnu/lib/ld.so.1 /lib/ From 9d9f450f475fa1fa0bf5efcddeccb24b2b68e929 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Thu, 13 Aug 2026 16:40:47 +0900 Subject: [PATCH 1267/1283] Enable RISC-V BN assembly with autotools Recognize ELF riscv64 as an assembly-capable target so the architecture-specific BN helpers are used unless assembly is explicitly disabled. --- configure.ac | 2 ++ crypto/Makefile.am | 2 ++ 2 files changed, 4 insertions(+) diff --git a/configure.ac b/configure.ac index 23f0c38cbc..c10a33fa52 100644 --- a/configure.ac +++ b/configure.ac @@ -136,6 +136,8 @@ AM_CONDITIONAL([HOST_ASM_ELF_MIPS], [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "mips" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_ELF_MIPS64], [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "mips64" -a "x$enable_asm" != "xno"]) +AM_CONDITIONAL([HOST_ASM_ELF_RISCV64], + [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "riscv64" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_ELF_X86_64], [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "x86_64" -a "x$enable_asm" != "xno"]) AM_CONDITIONAL([HOST_ASM_MACOSX_X86_64], diff --git a/crypto/Makefile.am b/crypto/Makefile.am index 7969aee772..a4a717d1cf 100644 --- a/crypto/Makefile.am +++ b/crypto/Makefile.am @@ -212,6 +212,7 @@ include Makefile.am.mingw64-x86_64 if !HOST_ASM_ELF_AARCH64 if !HOST_ASM_ELF_MIPS if !HOST_ASM_ELF_MIPS64 +if !HOST_ASM_ELF_RISCV64 if !HOST_ASM_ELF_X86_64 if !HOST_ASM_MACOSX_X86_64 if !HOST_ASM_MASM_X86_64 @@ -224,6 +225,7 @@ endif endif endif endif +endif if HOST_AARCH64 if HOST_DARWIN From 5630baeb4d32dbfc4461cf5a3475b701cdfb1d18 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Thu, 13 Aug 2026 15:34:00 +0900 Subject: [PATCH 1268/1283] ci: run CTest in parallel Run CTest with parallel jobs in the Windows, Emscripten, Fedora, and shared test-script paths to reduce test time. --- .github/workflows/emscripten.yml | 4 ++-- .github/workflows/fedora-rawhide.yml | 2 +- .github/workflows/windows.yml | 2 +- scripts/test | 1 + 4 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml index 6087abac0c..914446b0bd 100644 --- a/.github/workflows/emscripten.yml +++ b/.github/workflows/emscripten.yml @@ -43,7 +43,7 @@ jobs: run: cmake --build build --config Release --parallel 4 - name: "Test" - run: ctest --test-dir build -C Release --output-on-failure + run: ctest --test-dir build -C Release --parallel --output-on-failure # Test ASAN with and without ASM enabled. test-asan: @@ -80,4 +80,4 @@ jobs: run: cmake --build build --config Release --parallel 4 - name: "Test" - run: ctest --test-dir build -C Release --output-on-failure + run: ctest --test-dir build -C Release --parallel --output-on-failure diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index 078bc028c7..c3dd8a83cb 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -37,4 +37,4 @@ jobs: ninja - name: Test run: | - ninja test + CTEST_PARALLEL_LEVEL="" ninja test diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 729ff464cf..908e081c93 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -88,7 +88,7 @@ jobs: - name: "Test" shell: cmd - run: ctest --test-dir build -C Release --output-on-failure + run: ctest --test-dir build -C Release --parallel --output-on-failure - name: "Upload build artifacts" if: always() diff --git a/scripts/test b/scripts/test index 0e84b22201..6b51b1ebb8 100755 --- a/scripts/test +++ b/scripts/test @@ -11,6 +11,7 @@ if [ "$ARCH" = "mingw32" -o "$ARCH" = "mingw64" -o "$ARCH" = "arm32" ]; then fi ENABLE_ASM="${ENABLE_ASM:=ON}" +export CTEST_PARALLEL_LEVEL="${CTEST_PARALLEL_LEVEL-}" # setup_cross_compiler sets up environment variables for cross-compilation with the given prefix. setup_cross_compiler() { From e07df6da53a0ae5c07383546b7219577a68610cd Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Fri, 14 Aug 2026 14:50:12 +0200 Subject: [PATCH 1269/1283] zizmor: set persist-credentials MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit per zizmor, actions/checkout should be followed by removal of credentials that may have been saved to disk. Doing so fixes lots of whining such as: ``` warning[artipacked]: credential persistence through GitHub Actions artifacts --> ./.github/workflows/android.yml:27:9 | 27 | - name: "Checkout repository" | _________^ 28 | | uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |________________________________________________________________________________^ does not set persist-credentials: false | = note: audit confidence → Low = note: this finding has an auto-fix ``` --- .github/workflows/android.yml | 2 ++ .github/workflows/cmake-config.yml | 2 ++ .github/workflows/coverity.yml | 2 ++ .github/workflows/emscripten.yml | 4 ++++ .github/workflows/fedora-rawhide.yml | 2 ++ .github/workflows/freebsd.yml | 4 ++++ .github/workflows/linux.yml | 4 ++++ .github/workflows/macos.yml | 2 ++ .github/workflows/rust-openssl.yml | 2 ++ .github/workflows/solaris.yml | 2 ++ .github/workflows/windows.yml | 2 ++ 11 files changed, 28 insertions(+) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index a2faa94cfe..d9d3b3671a 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -26,6 +26,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Install build dependencies" run: | diff --git a/.github/workflows/cmake-config.yml b/.github/workflows/cmake-config.yml index 5b57b78c22..493242d3af 100644 --- a/.github/workflows/cmake-config.yml +++ b/.github/workflows/cmake-config.yml @@ -25,6 +25,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Setup Windows dependencies" if: runner.os == 'Windows' diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index f00e2a2b76..33aba2ef31 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -23,6 +23,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Install dependencies" run: | diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml index 914446b0bd..ba0eb021f5 100644 --- a/.github/workflows/emscripten.yml +++ b/.github/workflows/emscripten.yml @@ -21,6 +21,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Install test dependencies" run: | @@ -55,6 +57,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Install test dependencies" run: | diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml index c3dd8a83cb..4ae9158561 100644 --- a/.github/workflows/fedora-rawhide.yml +++ b/.github/workflows/fedora-rawhide.yml @@ -24,6 +24,8 @@ jobs: image: fedora:rawhide@sha256:0c1f63ed8fb818fad16cf6ae091598c410a21d2e1a9adf183beb93189299bfba steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install dependencies run: | dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk perl-IO-Socket-SSL diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index b0f8390c4a..d457941cdd 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -23,6 +23,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Setup" run: | @@ -51,6 +53,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Setup" run: | diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 4fbe98750b..a2a85e7411 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -48,6 +48,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Install test dependencies" run: | @@ -100,6 +102,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Install test dependencies" run: | diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index c619b17110..1aabcd8180 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -34,6 +34,8 @@ jobs: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Run tests" run: ./scripts/test diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml index 37d377fdbe..600d15a655 100644 --- a/.github/workflows/rust-openssl.yml +++ b/.github/workflows/rust-openssl.yml @@ -20,6 +20,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Build LibreSSL" run: | diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index 0e50f5f723..ddaca560e0 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -20,6 +20,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Setup" run: | diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 908e081c93..719921415a 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -34,6 +34,8 @@ jobs: steps: - name: "Checkout repository" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: "Setup MSYS2" id: msys2 From 54c75b5bf6bc58bd743afa359787a36b3a659fc1 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 16 Aug 2026 13:32:49 +0000 Subject: [PATCH 1270/1283] ci: update github/codeql-action action to v4.37.7 --- .github/workflows/cifuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index cfcdfc57eb..76b434fd71 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -39,7 +39,7 @@ jobs: path: "./out/artifacts" - name: "Upload SARIF" - uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 if: always() && steps.build.outcome == 'success' with: sarif_file: "cifuzz-sarif/results.sarif" From 039aab155b7d704888de096f4d2571683e19b816 Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Sun, 16 Aug 2026 22:55:55 +0530 Subject: [PATCH 1271/1283] cmake: apply the same exploit-mitigation flags as the autotools build --- CMakeLists.txt | 86 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 86 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index 0a59ddc94a..de242066f4 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -159,6 +159,92 @@ if (CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang") add_compile_options($<$:-Wno-pointer-sign>) endif() +# Exploit-mitigation flags, matching the default-on hardening the autotools +# build applies (m4/check-hardening-options.m4). The CMake build shipped none +# of these, so a cmake-built libcrypto/libssl/libtls and openssl(1) had no +# stack protector, no _FORTIFY_SOURCE, no RELRO/BIND_NOW and no CET, and the +# mingw DLLs missed the DEP/ASLR opt-ins. MSVC is left to its own toolchain +# defaults, exactly as that m4 (which only drives gcc/clang/mingw flags) does. +# Every flag is probed before use so unsupported targets simply skip it. +option(ENABLE_HARDENING + "Enable options to frustrate memory corruption exploits" ON) +option(ENABLE_WINDOWS_SSP + "Build stack smashing protection on Windows (requires libssp)" OFF) + +if(ENABLE_HARDENING AND NOT MSVC AND + (CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang")) + include(CheckCCompilerFlag) + + macro(add_harden_cflag _flag _var) + check_c_compiler_flag("${_flag}" ${_var}) + if(${_var}) + add_compile_options($<$:${_flag}>) + endif() + endmacro() + + # CMake 3.16 predates check_linker_flag, so probe link flags by linking. + macro(add_harden_ldflag _flag _var) + set(_saved_link_options "${CMAKE_REQUIRED_LINK_OPTIONS}") + set(CMAKE_REQUIRED_LINK_OPTIONS "${_flag}") + check_c_source_compiles("int main(void){return 0;}" ${_var}) + set(CMAKE_REQUIRED_LINK_OPTIONS "${_saved_link_options}") + if(${_var}) + add_link_options("${_flag}") + endif() + endmacro() + + # Do not optimize based on signed arithmetic overflow. + add_harden_cflag(-fno-strict-overflow HAVE_CFLAG_FNO_STRICT_OVERFLOW) + + if(NOT WIN32) + # _FORTIFY_SOURCE needs an optimizing build and warns without one, + # so probe it at -O2 and only apply it to non-Debug C compiles. + set(_saved_req_flags "${CMAKE_REQUIRED_FLAGS}") + set(CMAKE_REQUIRED_FLAGS + "-O2 -Werror -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2") + check_c_source_compiles("#include +int main(void){char b[8];const char *s=\"x\";strcpy(b,s);return b[0];}" + HAVE_CFLAG_FORTIFY_SOURCE) + set(CMAKE_REQUIRED_FLAGS "${_saved_req_flags}") + if(HAVE_CFLAG_FORTIFY_SOURCE) + add_compile_options( + "$<$,$>>:-U_FORTIFY_SOURCE>" + "$<$,$>>:-D_FORTIFY_SOURCE=2>") + endif() + + # Read-only relocations, resolved at load time. + add_harden_ldflag(-Wl,-z,relro HAVE_LDFLAG_Z_RELRO) + add_harden_ldflag(-Wl,-z,now HAVE_LDFLAG_Z_NOW) + else() + # Windows (mingw) DEP, ASLR and high-entropy ASLR opt-ins. + add_harden_ldflag(-Wl,--nxcompat HAVE_LDFLAG_NXCOMPAT) + add_harden_ldflag(-Wl,--dynamicbase HAVE_LDFLAG_DYNAMICBASE) + add_harden_ldflag(-Wl,--high-entropy-va HAVE_LDFLAG_HIGH_ENTROPY_VA) + endif() + + # Stack smashing protection. On Windows this pulls in libssp, so it is + # opt-in there, mirroring --enable-windows-ssp. + if(NOT WIN32 OR ENABLE_WINDOWS_SSP) + check_c_compiler_flag(-fstack-protector-strong + HAVE_CFLAG_STACK_PROTECTOR_STRONG) + if(HAVE_CFLAG_STACK_PROTECTOR_STRONG) + add_compile_options( + $<$:-fstack-protector-strong>) + else() + add_harden_cflag(-fstack-protector-all + HAVE_CFLAG_STACK_PROTECTOR_ALL) + endif() + if(WIN32) + set(PLATFORM_LIBS ${PLATFORM_LIBS} ssp) + endif() + endif() + + # Control-flow integrity (Intel CET); unsupported on Darwin. + if(NOT APPLE) + add_harden_cflag(-fcf-protection=full HAVE_CFLAG_CF_PROTECTION) + endif() +endif() + if(WIN32) add_definitions(-D_CRT_SECURE_NO_WARNINGS) add_definitions(-D_CRT_DEPRECATED_NO_WARNINGS) From 87c1738284ad9062cf344d038df2f3953030c1dd Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Wed, 19 Aug 2026 21:56:32 +0530 Subject: [PATCH 1272/1283] provide a vsyslog fallback in syslog_r instead of the header AIX has syslog but not vsyslog; the fallback lived in syslog.h as non-static function definitions, so it multiply-defined vsyslog_r (also defined in syslog_r.c) and pulled vasprintf in without stdio.h. Detect vsyslog and, when absent, format with vasprintf and call syslog directly from the shim. --- CMakeLists.txt | 5 +++++ crypto/compat/syslog_r.c | 11 +++++++++++ include/compat/syslog.h | 20 -------------------- m4/check-libc.m4 | 2 +- 4 files changed, 17 insertions(+), 21 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 0a59ddc94a..a9d2f3ef29 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -422,6 +422,11 @@ if(HAVE_SYSLOG) add_definitions(-DHAVE_SYSLOG) endif() +check_function_exists(vsyslog HAVE_VSYSLOG) +if(HAVE_VSYSLOG) + add_definitions(-DHAVE_VSYSLOG) +endif() + check_symbol_exists(timespecsub sys/time.h HAVE_TIMESPECSUB) if(HAVE_TIMESPECSUB) add_definitions(-DHAVE_TIMESPECSUB) diff --git a/crypto/compat/syslog_r.c b/crypto/compat/syslog_r.c index d68169ddd7..30841c1b70 100644 --- a/crypto/compat/syslog_r.c +++ b/crypto/compat/syslog_r.c @@ -1,3 +1,5 @@ +#include +#include #include void @@ -14,6 +16,15 @@ void vsyslog_r(int pri, struct syslog_data *data, const char *fmt, va_list ap) { #ifdef HAVE_SYSLOG +#ifdef HAVE_VSYSLOG vsyslog(pri, fmt, ap); +#else + char *msg = NULL; + + if (vasprintf(&msg, fmt, ap) == -1) + return; + syslog(pri, "%s", msg); + free(msg); +#endif #endif } diff --git a/include/compat/syslog.h b/include/compat/syslog.h index 3528eb36ac..c7a2608bdc 100644 --- a/include/compat/syslog.h +++ b/include/compat/syslog.h @@ -36,23 +36,3 @@ void vsyslog_r(int, struct syslog_data *, const char *, va_list); #endif #endif - -#ifdef _AIX -#ifdef HAVE_SYSLOG -#include -void vsyslog(int facility_priority, const char *format, va_list arglist) { - char *msg = NULL; - vasprintf(&msg, format, arglist); - - if (!msg) - return; - - syslog(facility_priority, "%s", msg); - free(msg); -} -#endif /* HAVE_SYSLOG */ - -void vsyslog_r(int pri, struct syslog_data *data, const char *fmt, va_list ap) { - vsyslog(pri, fmt, ap); -} -#endif /* AIX */ diff --git a/m4/check-libc.m4 b/m4/check-libc.m4 index 8ecc89a6fa..7ac1a103e6 100644 --- a/m4/check-libc.m4 +++ b/m4/check-libc.m4 @@ -26,7 +26,7 @@ AC_CHECK_FUNCS([asprintf freezero ftruncate getdelim getline memmem]) AC_CHECK_FUNCS([readpassphrase reallocarray recallocarray]) AC_CHECK_FUNCS([strcasecmp strlcat strlcpy strndup strnlen strsep strtonum]) AC_CHECK_FUNCS([timegm _mkgmtime timespecsub]) -AC_CHECK_FUNCS([getopt getprogname syslog syslog_r]) +AC_CHECK_FUNCS([getopt getprogname syslog syslog_r vsyslog]) AC_CACHE_CHECK([for getpagesize], ac_cv_func_getpagesize, [ AC_LINK_IFELSE([AC_LANG_PROGRAM([[ #include From 512e87dbb1f30b8d739be0cc5ca2d51823530afe Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sat, 22 Aug 2026 11:06:51 +0900 Subject: [PATCH 1273/1283] Enable MIPS assembly in CI Explicitly enable assembly for the MIPS32 and MIPS64 test jobs so that the existing AES, BN, and SHA implementations are exercised by make check. Also fix the MIPS64 build to reference the generated MIPS64 assembly sources instead of the MIPS32. --- crypto/Makefile.am.elf-mips64 | 12 ++++++------ scripts/test | 5 +++-- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/crypto/Makefile.am.elf-mips64 b/crypto/Makefile.am.elf-mips64 index c6727b3b88..7269d6e922 100644 --- a/crypto/Makefile.am.elf-mips64 +++ b/crypto/Makefile.am.elf-mips64 @@ -1,9 +1,9 @@ -ASM_MIPS64_ELF = aes/aes-mips.S -ASM_MIPS64_ELF += bn/bn-mips.S -ASM_MIPS64_ELF += bn/mont-mips.S -ASM_MIPS64_ELF += sha/sha1-mips.S -ASM_MIPS64_ELF += sha/sha512-mips.S -ASM_MIPS64_ELF += sha/sha256-mips.S +ASM_MIPS64_ELF = aes/aes-mips64.S +ASM_MIPS64_ELF += bn/bn-mips64.S +ASM_MIPS64_ELF += bn/mont-mips64.S +ASM_MIPS64_ELF += sha/sha1-mips64.S +ASM_MIPS64_ELF += sha/sha512-mips64.S +ASM_MIPS64_ELF += sha/sha256-mips64.S EXTRA_DIST += $(ASM_MIPS64_ELF) diff --git a/scripts/test b/scripts/test index 2cff531a6d..7d82a09863 100755 --- a/scripts/test +++ b/scripts/test @@ -172,17 +172,18 @@ elif [ "$ARCH" = "riscv64" ]; then file apps/openssl/openssl elif [ "$ARCH" = "mips32" ] || [ "$ARCH" = "mips64" ]; then + # MIPS assembly is disabled by default, so enable it for CI coverage. if [ "$ARCH" = "mips32" ]; then sudo ln -sf /usr/mips-linux-gnu/lib/ld.so.1 /lib/ setup_cross_compiler mips-linux-gnu - ./configure --host=mips-linux-gnu + ./configure --host=mips-linux-gnu --enable-asm LD_LIBRARY_PATH=/usr/mips-linux-gnu/lib make -j 4 check else sudo ln -sf /usr/mips64el-linux-gnuabi64/lib64/ld.so.1 /lib64 setup_cross_compiler mips64el-linux-gnuabi64 - ./configure --host=mips64el-linux-gnuabi64 + ./configure --host=mips64el-linux-gnuabi64 --enable-asm LD_LIBRARY_PATH=/usr/mips64el-linux-gnuabi64/lib make -j 4 check fi From c857e54a5562fd6f8804f70ed4ff530b77743265 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sat, 22 Aug 2026 12:26:26 +0900 Subject: [PATCH 1274/1283] Allow explicitly enabling MIPS assembly Keep assembly disabled by default on MIPS32 and MIPS64, but preserve an explicit `--enable-asm` setting. Previously, the architecture detection overwrote the command-line option with `enable_asm=no`. --- configure.ac | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index c10a33fa52..7c6ac98034 100644 --- a/configure.ac +++ b/configure.ac @@ -94,8 +94,8 @@ AS_CASE([$host_cpu], [*arm*], [host_cpu=arm], [*amd64*], [host_cpu=x86_64 HOSTARCH=intel], [i?86], [host_cpu=i386 HOSTARCH=intel enable_asm=no], - [mips64*], [host_cpu=mips64 enable_asm=no], - [mips*], [host_cpu=mips enable_asm=no], + [mips64*], [host_cpu=mips64 enable_asm=${enable_asm-no}], + [mips*], [host_cpu=mips enable_asm=${enable_asm-no}], [powerpc*], [host_cpu=powerpc], [ppc64*], [host_cpu=powerpc64], [x86_64], [HOSTARCH=intel] From 6ec7b45100067b151b76061eb737fa70b3fb47d5 Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sat, 22 Aug 2026 12:45:52 +0900 Subject: [PATCH 1275/1283] Build only for mips64 --- configure.ac | 2 +- scripts/test | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index 7c6ac98034..12703dd047 100644 --- a/configure.ac +++ b/configure.ac @@ -95,7 +95,7 @@ AS_CASE([$host_cpu], [*amd64*], [host_cpu=x86_64 HOSTARCH=intel], [i?86], [host_cpu=i386 HOSTARCH=intel enable_asm=no], [mips64*], [host_cpu=mips64 enable_asm=${enable_asm-no}], - [mips*], [host_cpu=mips enable_asm=${enable_asm-no}], + [mips*], [host_cpu=mips enable_asm=no], [powerpc*], [host_cpu=powerpc], [ppc64*], [host_cpu=powerpc64], [x86_64], [HOSTARCH=intel] diff --git a/scripts/test b/scripts/test index 7d82a09863..6d573e3856 100755 --- a/scripts/test +++ b/scripts/test @@ -172,17 +172,17 @@ elif [ "$ARCH" = "riscv64" ]; then file apps/openssl/openssl elif [ "$ARCH" = "mips32" ] || [ "$ARCH" = "mips64" ]; then - # MIPS assembly is disabled by default, so enable it for CI coverage. if [ "$ARCH" = "mips32" ]; then sudo ln -sf /usr/mips-linux-gnu/lib/ld.so.1 /lib/ setup_cross_compiler mips-linux-gnu - ./configure --host=mips-linux-gnu --enable-asm + ./configure --host=mips-linux-gnu LD_LIBRARY_PATH=/usr/mips-linux-gnu/lib make -j 4 check else sudo ln -sf /usr/mips64el-linux-gnuabi64/lib64/ld.so.1 /lib64 setup_cross_compiler mips64el-linux-gnuabi64 + # MIPS assembly is disabled by default, so enable it for CI coverage. ./configure --host=mips64el-linux-gnuabi64 --enable-asm LD_LIBRARY_PATH=/usr/mips64el-linux-gnuabi64/lib make -j 4 check fi From 66b2316045444c7dbf91139ae7ebe5f9b96a0a4a Mon Sep 17 00:00:00 2001 From: Kartik Naik Date: Mon, 24 Aug 2026 19:14:46 +0530 Subject: [PATCH 1276/1283] cmake: skip relro/now and ssp hardening flags on Emscripten wasm-ld only warns about unknown -z values, so the -Wl,-z,relro/now link probes false-positive under emcc and then warn on every link. The stack protector probe also passes (the probe program has no protected frame) but real objects fail to link since Emscripten's libc provides no __stack_chk_guard/__stack_chk_fail; it has its own stack checks. -fcf-protection already fails its probe cleanly there. --- CMakeLists.txt | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index de242066f4..18fb2620f5 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -212,9 +212,13 @@ int main(void){char b[8];const char *s=\"x\";strcpy(b,s);return b[0];}" "$<$,$>>:-D_FORTIFY_SOURCE=2>") endif() - # Read-only relocations, resolved at load time. - add_harden_ldflag(-Wl,-z,relro HAVE_LDFLAG_Z_RELRO) - add_harden_ldflag(-Wl,-z,now HAVE_LDFLAG_Z_NOW) + # Read-only relocations, resolved at load time. wasm has no + # ELF loader and wasm-ld only warns about unknown -z values, + # so the probe false-positives on Emscripten; skip it there. + if(NOT EMSCRIPTEN) + add_harden_ldflag(-Wl,-z,relro HAVE_LDFLAG_Z_RELRO) + add_harden_ldflag(-Wl,-z,now HAVE_LDFLAG_Z_NOW) + endif() else() # Windows (mingw) DEP, ASLR and high-entropy ASLR opt-ins. add_harden_ldflag(-Wl,--nxcompat HAVE_LDFLAG_NXCOMPAT) @@ -223,8 +227,11 @@ int main(void){char b[8];const char *s=\"x\";strcpy(b,s);return b[0];}" endif() # Stack smashing protection. On Windows this pulls in libssp, so it is - # opt-in there, mirroring --enable-windows-ssp. - if(NOT WIN32 OR ENABLE_WINDOWS_SSP) + # opt-in there, mirroring --enable-windows-ssp. Emscripten accepts the + # flag (and the frameless probe links), but its libc has no + # __stack_chk_guard/__stack_chk_fail, so any protected frame fails to + # link; it provides its own stack checks (-sSTACK_OVERFLOW_CHECK). + if(NOT EMSCRIPTEN AND (NOT WIN32 OR ENABLE_WINDOWS_SSP)) check_c_compiler_flag(-fstack-protector-strong HAVE_CFLAG_STACK_PROTECTOR_STRONG) if(HAVE_CFLAG_STACK_PROTECTOR_STRONG) From 5170cfc05dbe61e7e28a30f84cab9c4255ce2771 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 29 Aug 2026 01:01:03 +0000 Subject: [PATCH 1277/1283] ci: update github/codeql-action action to v4.37.8 --- .github/workflows/cifuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 76b434fd71..0caaae8e23 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -39,7 +39,7 @@ jobs: path: "./out/artifacts" - name: "Upload SARIF" - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 if: always() && steps.build.outcome == 'success' with: sarif_file: "cifuzz-sarif/results.sarif" From 205aff644bbe1aadd06051d200b8bb027eb6e620 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 29 Aug 2026 01:01:10 +0000 Subject: [PATCH 1278/1283] ci: update vmactions/freebsd-vm action to v1.5.4 --- .github/workflows/freebsd.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index d457941cdd..987ca9fefe 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -33,7 +33,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1.5.3 + uses: vmactions/freebsd-vm@d0518f912576ae759075aa00fb9fe27037940271 # v1.5.4 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false @@ -63,7 +63,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1.5.3 + uses: vmactions/freebsd-vm@d0518f912576ae759075aa00fb9fe27037940271 # v1.5.4 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false From d8945e54ccfe1f728188a6bc0e30466d7357aa30 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 29 Aug 2026 07:37:12 +0000 Subject: [PATCH 1279/1283] ci: update vmactions/freebsd-vm action to v1.5.5 --- .github/workflows/freebsd.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index 987ca9fefe..ecf705e323 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -33,7 +33,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@d0518f912576ae759075aa00fb9fe27037940271 # v1.5.4 + uses: vmactions/freebsd-vm@f0552d3b69211736abd97f02ff3d4674c56b73b1 # v1.5.5 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false @@ -63,7 +63,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/freebsd-vm@d0518f912576ae759075aa00fb9fe27037940271 # v1.5.4 + uses: vmactions/freebsd-vm@f0552d3b69211736abd97f02ff3d4674c56b73b1 # v1.5.5 with: release: "${{ env.FREEBSD_VERSION }}" copyback: false From c1acd93ebb1117a707aec61a162ab919aea28e86 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 29 Aug 2026 07:37:21 +0000 Subject: [PATCH 1280/1283] ci: update vmactions/solaris-vm action to v1.3.9 --- .github/workflows/solaris.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml index ddaca560e0..0241051ec2 100644 --- a/.github/workflows/solaris.yml +++ b/.github/workflows/solaris.yml @@ -30,7 +30,7 @@ jobs: ./autogen.sh - name: "Build on VM" - uses: vmactions/solaris-vm@315163f088b66e55bbcc45928bd224d4973b2312 # v1.3.8 + uses: vmactions/solaris-vm@96d8d976f9e67d82ec6c7e8ce9c1060731f9e21c # v1.3.9 with: prepare: | pkg install gcc make From a764ec929eec2abdedd76cb5b593c8ec6a6abcfd Mon Sep 17 00:00:00 2001 From: Kenjiro Nakayama Date: Sat, 22 Aug 2026 11:06:51 +0900 Subject: [PATCH 1281/1283] Enable supported MIPS32 assembly in CI Use the little endian MIPS32 toolchain since the generated assembly is little-endian, and define the architecture feature macros needed to select the AES, BN, SHA-1, and SHA-256 assembly implementations. Do not generate or build SHA-512 assembly for MIPS32. The generator accepts the O32 ABI, but the resulting implementation still uses 64-bit instructions and requires the MIPS64 ISA. It is therefore not valid for generic MIPS32 targets. --- .github/workflows/linux.yml | 2 +- configure.ac | 2 +- crypto/Makefile.am.elf-mips | 1 - crypto/arch/mips/crypto_arch.h | 18 ++++++++++++++++++ crypto/bn/arch/mips/bn_arch.h | 19 +++++++++++++++++++ scripts/test | 9 +++++---- update.sh | 1 - 7 files changed, 44 insertions(+), 8 deletions(-) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index a2a85e7411..06dda17674 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -68,7 +68,7 @@ jobs: packages+=(qemu-user-static binfmt-support g++-14-loongarch64-linux-gnu) ;; mips32) - packages+=(qemu-user-static binfmt-support g++-mips-linux-gnu) + packages+=(qemu-user-static binfmt-support g++-mipsel-linux-gnu) ;; mips64) packages+=(qemu-user-static binfmt-support g++-mips64el-linux-gnuabi64) diff --git a/configure.ac b/configure.ac index 12703dd047..7c6ac98034 100644 --- a/configure.ac +++ b/configure.ac @@ -95,7 +95,7 @@ AS_CASE([$host_cpu], [*amd64*], [host_cpu=x86_64 HOSTARCH=intel], [i?86], [host_cpu=i386 HOSTARCH=intel enable_asm=no], [mips64*], [host_cpu=mips64 enable_asm=${enable_asm-no}], - [mips*], [host_cpu=mips enable_asm=no], + [mips*], [host_cpu=mips enable_asm=${enable_asm-no}], [powerpc*], [host_cpu=powerpc], [ppc64*], [host_cpu=powerpc64], [x86_64], [HOSTARCH=intel] diff --git a/crypto/Makefile.am.elf-mips b/crypto/Makefile.am.elf-mips index 2276991070..682fb5e1d3 100644 --- a/crypto/Makefile.am.elf-mips +++ b/crypto/Makefile.am.elf-mips @@ -2,7 +2,6 @@ ASM_MIPS_ELF = aes/aes-mips.S ASM_MIPS_ELF += bn/bn-mips.S ASM_MIPS_ELF += bn/mont-mips.S ASM_MIPS_ELF += sha/sha1-mips.S -ASM_MIPS_ELF += sha/sha512-mips.S ASM_MIPS_ELF += sha/sha256-mips.S EXTRA_DIST += $(ASM_MIPS_ELF) diff --git a/crypto/arch/mips/crypto_arch.h b/crypto/arch/mips/crypto_arch.h index 274879c5e3..2407503b3b 100644 --- a/crypto/arch/mips/crypto_arch.h +++ b/crypto/arch/mips/crypto_arch.h @@ -18,4 +18,22 @@ #ifndef HEADER_CRYPTO_ARCH_H #define HEADER_CRYPTO_ARCH_H +#ifndef OPENSSL_NO_ASM + +#ifdef LIBRESSL_USE_AES_ASSEMBLY +#define HAVE_AES_SET_ENCRYPT_KEY_INTERNAL +#define HAVE_AES_SET_DECRYPT_KEY_INTERNAL +#define HAVE_AES_ENCRYPT_INTERNAL +#define HAVE_AES_DECRYPT_INTERNAL +#endif + +#ifdef LIBRESSL_USE_SHA_ASSEMBLY +#define HAVE_SHA1_BLOCK_DATA_ORDER +#define HAVE_SHA1_BLOCK_GENERIC +#define HAVE_SHA256_BLOCK_DATA_ORDER +#define HAVE_SHA256_BLOCK_GENERIC +#endif + +#endif + #endif diff --git a/crypto/bn/arch/mips/bn_arch.h b/crypto/bn/arch/mips/bn_arch.h index 4d6571f9cb..a14b83bf20 100644 --- a/crypto/bn/arch/mips/bn_arch.h +++ b/crypto/bn/arch/mips/bn_arch.h @@ -20,5 +20,24 @@ #ifndef OPENSSL_NO_ASM +#ifdef LIBRESSL_USE_BN_ASSEMBLY + +#define HAVE_BN_ADD_WORDS + +#define HAVE_BN_DIV_WORDS +#define HAVE_BN_DIV_3_WORDS + +#define HAVE_BN_MUL_COMBA4 +#define HAVE_BN_MUL_COMBA8 +#define HAVE_BN_MULW_ADD_WORDS +#define HAVE_BN_MULW_WORDS + +#define HAVE_BN_SQR_COMBA4 +#define HAVE_BN_SQR_COMBA8 + +#define HAVE_BN_SUB_WORDS + +#endif + #endif #endif diff --git a/scripts/test b/scripts/test index 6d573e3856..b3386a8b3e 100755 --- a/scripts/test +++ b/scripts/test @@ -173,11 +173,12 @@ elif [ "$ARCH" = "riscv64" ]; then elif [ "$ARCH" = "mips32" ] || [ "$ARCH" = "mips64" ]; then if [ "$ARCH" = "mips32" ]; then - sudo ln -sf /usr/mips-linux-gnu/lib/ld.so.1 /lib/ - setup_cross_compiler mips-linux-gnu + sudo ln -sf /usr/mipsel-linux-gnu/lib/ld.so.1 /lib/ + setup_cross_compiler mipsel-linux-gnu - ./configure --host=mips-linux-gnu - LD_LIBRARY_PATH=/usr/mips-linux-gnu/lib make -j 4 check + # MIPS32 assembly is disabled by default, so enable it for CI coverage. + ./configure --host=mipsel-linux-gnu --enable-asm + LD_LIBRARY_PATH=/usr/mipsel-linux-gnu/lib make -j 4 check else sudo ln -sf /usr/mips64el-linux-gnuabi64/lib64/ld.so.1 /lib64 setup_cross_compiler mips64el-linux-gnuabi64 diff --git a/update.sh b/update.sh index ddd2cf35b9..4b2c4ddf85 100755 --- a/update.sh +++ b/update.sh @@ -248,7 +248,6 @@ gen_asm_mips o32 bn mips bn-mips gen_asm_mips o32 bn mips-mont mont-mips gen_asm_mips o32 sha sha1-mips sha1-mips gen_asm_mips o32 sha sha512-mips sha256-mips -gen_asm_mips o32 sha sha512-mips sha512-mips echo generating mips64 ASM source for elf gen_asm_mips 64 aes aes-mips aes-mips64 From 144f96dc572088ab70a98f9785d87d037cb99422 Mon Sep 17 00:00:00 2001 From: Theo Buehler Date: Mon, 31 Aug 2026 08:28:10 -0600 Subject: [PATCH 1282/1283] Update man links --- man/links | 2 ++ 1 file changed, 2 insertions(+) diff --git a/man/links b/man/links index 87bd8055f0..d08694b0ba 100644 --- a/man/links +++ b/man/links @@ -520,6 +520,7 @@ CRYPTO_lock.3,CRYPTO_w_unlock.3 CRYPTO_set_ex_data.3,CRYPTO_EX_dup.3 CRYPTO_set_ex_data.3,CRYPTO_EX_free.3 CRYPTO_set_ex_data.3,CRYPTO_EX_new.3 +CRYPTO_set_ex_data.3,CRYPTO_cleanup_all_ex_data.3 CRYPTO_set_ex_data.3,CRYPTO_free_ex_data.3 CRYPTO_set_ex_data.3,CRYPTO_get_ex_data.3 CRYPTO_set_ex_data.3,CRYPTO_get_ex_new_index.3 @@ -1256,6 +1257,7 @@ OPENSSL_VERSION_NUMBER.3,OpenSSL_version_num.3 OPENSSL_VERSION_NUMBER.3,SSLeay.3 OPENSSL_VERSION_NUMBER.3,SSLeay_version.3 OPENSSL_config.3,OPENSSL_no_config.3 +OPENSSL_init_crypto.3,OPENSSL_cleanup.3 OPENSSL_init_crypto.3,OPENSSL_init.3 OPENSSL_malloc.3,CRYPTO_free.3 OPENSSL_malloc.3,CRYPTO_malloc.3 From 5118f30beedff734608035c056e8b9b38ee3d6e7 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 15:57:46 +0000 Subject: [PATCH 1283/1283] ci: update github/codeql-action action to v4.37.9 --- .github/workflows/cifuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 0caaae8e23..56da4ee5e7 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -39,7 +39,7 @@ jobs: path: "./out/artifacts" - name: "Upload SARIF" - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 if: always() && steps.build.outcome == 'success' with: sarif_file: "cifuzz-sarif/results.sarif"