summaryrefslogtreecommitdiffstats
path: root/lib/libcrypto/Makefile
AgeCommit message (Collapse)AuthorFilesLines
2020-09-13Add new x509 certificate chain validator in x509_verify.cbeck1-2/+3
The new validator finds multiple validated chains to handle the modern PKI cases which may frequently have multiple paths via different intermediates to different roots. It is loosely based on golang's x509 validator This includes integration so that the new validator can be used via X509_verify_cert() as well as a new api x509_verify() which will return multiple chains (similar to go). The new validator is not enabled by default with this commit, this will be changed in a follow on commit. The new public API is not yet exposed, and will be finalized and exposed with a man page and a library minor bump later. ok tb@ inoguchi@ jsing@
2020-09-11Add x509_constraints.c - a new implementation of x509 name constraints, withbeck1-2/+2
regression tests. The use of the new name constraints is not yet activated in x509_vfy.c and will be activated in a follow on commit ok jsing@
2020-09-11Add issuer cache, to be used by upcoming changes to validation code.beck1-1/+2
ok tb@ jsing@
2020-06-09The check_includes step is incorrect dependency management model forderaadt1-11/+1
how our tree gets built. If this was done in all the libraries (imagine sys/dev), it would disrupt the development process hugely. So it should not be done here either. use 'make includes' by hand instead.
2020-06-05One error file per directory is plenty.jsing1-2/+2
2020-06-04Collapse the x509v3 directory into x509.jsing1-10/+7
This avoids the need to grep across directories to find functions and prepares for further rototilling and chainsawing. Discussed with tb@ (who also tested the release build)
2020-01-22Add checks to ensure that lib{crypto,ssl,tls} public headers have actuallyjsing1-1/+11
been installed prior to building. Requested by and ok tb@
2020-01-22Simplify header installation by combining the HDRS and HDRS_GEN loops.jsing1-9/+2
ok beck@
2019-11-02Enable CMS in LibreSSL.jsing1-1/+6
ok bcook@ deraadt@ inoguchi@ job@ tb@
2019-09-09Install the openssl/cms.h header.jsing1-1/+3
This header includes OPENSSL_NO_CMS guards, so even if things find the header it provides no useful content (and other code should technically also be using OPENSSL_NO_CMS...). ok deraadt@ inoguchi@
2019-09-06Add various macros and controls for EC_PKEY_CTX.jsing1-1/+2
These are needed for the upcoming EC CMS support (nothing else appears to use them). This largely syncs our ec_pmeth.c with OpenSSL 1.1.1b. With input from inoguchi@ and tb@. ok inoguchi@ tb@
2019-09-05Build ecdh_kdf.cjsing1-2/+2
2019-03-17Add the SM4 block cipher from the Chinese standard GB/T 32907-2016.tb1-1/+7
This is an ISC licensed version based on the sources by Ribose Inc that were ported to OpenSSL in 2017. Patch from Daniel Wyatt with minor tweaks. ok inoguchi, jsing
2019-01-23No need to include <bsd.prog.mk> here.tb1-2/+1
ok bcook
2019-01-19Partial port of EC_KEY_METHOD from OpenSSL 1.1.tb1-3/+7
This commit adds init/free, support for signing, setting and getting the method, engine support as well as extra data. from markus
2018-11-11Add Ribose Inc's implementation of the SM3 hashing function withtb1-2/+7
tweaks from jsing and myself. The SM2/SM3/SM4 algorithms are mandatory for legal use of cryptography within China and [are] widely applied in the country, covering identification/financial cards, contactless, TPM 2.0 and PKI. ok beck inoguchi jsing
2018-11-11Add automatic threading initialization for libcrypto.bcook1-2/+2
This implements automatic thread support initialization in libcrypto. This does not remove any functions from the ABI, but does turn them into no-ops. Stub implementations of pthread_mutex_(init|lock|unlock) are provided for ramdisks. This does not implement the new OpenSSL 1.1 thread API internally, keeping the original CRYTPO_lock / CRYPTO_add_lock functions for library locking. For -portable, crypto_lock.c can be reimplemented with OS-specific primitives as needed. ok beck@, tb@, looks sane guenther@
2018-10-24Remove a bunch of ancient and highly crufty ASN.1 related code fromjsing1-4/+2
libcrypto (the "new" stuff replaced this back around 2000 or so...). ok tb@
2018-03-17Bring in compatibility for OpenSSL 1.1 style init functions.beck1-2/+2
This adds OPENSSL_init_crypto and OPENSSL_init_ssl, as well thread safety modifications for the existing LibreSSL init functions. The initialization routines are called automatically by the normal entry points into the library, as in newer OpenSSL ok jsing@, nits by tb@ and deraadt@
2018-03-17Add DSA_meth_{dup,free,new,set_{finish,sign}}()tb1-1/+2
As in RSA_meth_*, note that these functions return NULL in out-of-memory situations, but they do not set an error explicitly. ok jsing
2018-03-17Provide RSA_meth_{dup,free,new,set_{finish,priv_{dec,enc}}}()tb1-2/+2
Note that these functions return NULL in out-of-memory situations, but contrary to OpenSSL's versions they do not set an error. ok jsing
2018-02-17Provide BIO_meth_{free,new}() and BIO_meth_set_{create,crtl,destroy}()tb1-2/+2
and BIO_meth_set_{puts,read,write}(). ok jsing
2017-08-28Remove RSA_padding_add_SSLv23()/RSA_padding_check_SSLv23() and relatedjsing1-2/+2
code. We removed SSLv2/SSLv3 a long time ago... Discussed with doug@
2017-08-20sprinkle a few missing dependencies on perl scripts internal bits.espie1-3/+3
'it works' deraadt@
2017-08-13Switch to -Werror with clang for libressl.doug1-2/+2
Discussed with beck@ and jsing@ ok beck@
2017-07-10remove misc. depend and yacc nits that no longer matter.espie1-2/+1
okay millert@
2017-06-16mark files as BUILDFIRST, or write explicit dependencies, so that mostespie1-1/+2
programs will build even without a make depend first. okay tb@ millert@
2017-05-29Randomize link-order of libcrypto as we do with libc. This libraryderaadt1-1/+2
has many small functions without significant local storage, therefore less tail protection from -fstack-protector-strong to prevent their use as ROP gadgets. It is used in security contexts. Also many functions dribble pointers onto the stack, allowing discovery of gadgets via the fixed relative addresses, so let's randomly bias those. ok tedu jsing The rc script will soon need a strategy for skipping this step on machines with poor IO performance. Or maybe do it less often? However, I don't see many more libraries we'll do this with, these are the two most important ones.
2017-05-06Bring in HKDF, from BoringSSL, with regress tests modified to bebeck1-1/+6
in C. Ride previous minor bump ok tom@ inoguchi@ jsing@
2017-04-30Only enable -Werror on libcrypto/libssl/libtls if we are building withjsing1-3/+6
gcc4. This should avoid failed builds while transitioning compilers. While here also make the CFLAGS blocks consistent across makefiles. Discussed with deraadt@, ok beck@
2017-02-28Add an EVP interface that provides concatenated MD5+SHA1 hashes, which arejsing1-1/+2
used in various parts of TLS 1.0/1.1. This will allow for code simplification in libssl. The same interface exists in OpenSSL 1.1. ok beck@ deraadt@ inoguchi@ millert@
2017-01-21Make explicit _ct and _nonct versions of bn_mod_exp funcitons thatbeck1-2/+3
matter for constant time, and make the public interface only used external to the library. This moves us to a model where the important things are constant time versions unless you ask for them not to be, rather than the opposite. I'll continue with this method by method. Add regress tests for same. ok jsing@
2016-12-21Explicitly export a list of symbols from libcrypto.jsing1-2/+10
Move the "internal" BN functions from bn.h to bn_lcl.h and stop exporting the bn_* symbols. These are documented as only being intended for internal use, so why they were placed in a public header is beyond me... This hides 363 previously exported symbols, most of which exist in headers that are not installed and were never intended to be public. This also removes a few crusty old things that should have died long ago (like _ossl_old_des_read_pw). But don't worry... there are still 3451 symbols exported from the library. With input and testing from inoguchi@. ok beck@ inoguchi@
2016-11-05after getting rid of the pod files, clean up the Makefiles; ok bcook@schwarze1-2/+5
2016-11-05Add support for X25519.jsing1-1/+6
This brings in code from BoringSSL, which is mostly taken from SUPERCOP. ok beck@ bcook@
2016-11-04Nuke the KRB5 ASN.1 code from orbit.jsing1-6/+1
ok beck@
2016-11-04No need to reach libssl private headers and to define TERMIOS anymore.miod1-4/+1
ok bcook@
2016-10-16Move libcrypto, librpcsvc and gnu/usr.bin/cc/include from RDIRS to PRDIRS,tb1-2/+4
and add prereq targets, so some header files are generated by BUILDUSER during 'make prereq' instead of by root during 'make includes'. Switch the order of 'make cleandir' and 'make includes' during 'make build' so we don't generate many files twice. Except for some machine@ symlinks from ${MACHINE}/stand, /usr/obj is now clean from files generated by root during 'make build'. Those will be cleaned up in a second step. help, testing & ok deraadt, input from natano, further testing rpe
2016-09-23Append to CLEANFILES instead of replacing it, so libcrypto.pc isnatano1-2/+2
deleted on make clean. ok millert
2016-09-14Generate pkg-config files at build time like everything else. Thisnatano1-2/+3
avoids permission problems due to the build and install stages being run by different users. ok deraadt jasper
2016-09-11Files in /etc/ssl belong to root. ok deraadtnatano1-4/+4
2016-09-04Remove cms.jsing1-8/+1
2016-09-04only regen pkg-config files when required; ok jaspernatano1-5/+5
2016-09-03Make tree build againbeck1-0/+449
2014-04-15we don't use these files for buildingtedu1-146/+0
2014-04-15remove FIPS mode support. people who require FIPS can buy something thattedu1-2/+2
meets their needs, but dumping it in here only penalizes the rest of us. ok beck deraadt
2014-04-15Send the rotIBM stream cipher (ebcdic) to Valhalla to party for eternitybeck1-3/+3
with the bearded ones... some API's that nobody should be using will dissapear with this commit.
2014-04-14remove auto-generated dependencies from the old unused build system, soderaadt1-19/+141
that it is easier to find code pieces. They are getting in the way. ok miod
2014-04-11Move build machinery for libcrypto from libssl/crypto to libcrypto, as wellmiod1-212/+19
as configuration files; split manpages and .pc files between libcrypto and libssl. No functional change, only there to make engineering easier, and libcrypto sources are still found in libssl/src/crypto at the moment. ok reyk@, also discussed with deraadt@ beck@ and the usual crypto suspects.
2012-10-13resolve conflictsdjm1-9/+25
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.