Provide LIBRESSL_USE_.*_ASSEMBLY defines.

Make life easier for portable by providing LIBRESSL_USE_.*_ASSEMBLY
defines, which enable/disable assembly for a specific algorithm. This
means that selected platforms can include the assembly files and specify
a define, rather than having to try to patch the crypto_arch.h headers.

Discussed with tb@

2 files changed, 18 insertions, 5 deletions

diff --git a/src/lib/libcrypto/arch/i386/Makefile.inc b/src/lib/libcrypto/arch/i386/Makefile.inc
index 26c3bc4568..a81b18880d 100644
--- a/src/lib/libcrypto/arch/i386/Makefile.inc
+++ b/src/lib/libcrypto/arch/i386/Makefile.inc
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile.inc,v 1.34 2026/01/17 14:53:09 jsing Exp $
+# $OpenBSD: Makefile.inc,v 1.35 2026/01/17 16:18:32 jsing Exp $
 
 # i386-specific libcrypto build rules
 
@@ -8,27 +8,33 @@ EXTRA_PL =  ${LCRYPTO_SRC}/perlasm/x86gas.pl ${LCRYPTO_SRC}/perlasm/x86asm.pl
 SRCS += crypto_cpu_caps.c
 
 # aes
+CFLAGS+= -DLIBRESSL_USE_AES_ASSEMBLY
 SSLASM+= aes aes-586
 SSLASM+= aes aesni-x86
 SRCS += aes_i386.c
 
 # bn
+CFLAGS+= -DLIBRESSL_USE_BN_ASSEMBLY
 SSLASM+= bn bn-586
 SSLASM+= bn co-586
 CFLAGS+= -DOPENSSL_BN_ASM_MONT
 SSLASM+= bn x86-mont
 
 # md5
+CFLAGS+= -DLIBRESSL_USE_MD5_ASSEMBLY
 SSLASM+= md5 md5-586
 
 # modes
+CFLAGS+= -DLIBRESSL_USE_GCM_ASSEMBLY
 SSLASM+= modes ghash-x86
 SRCS += gcm128_i386.c
 
 # rc4
+CFLAGS+= -DLIBRESSL_USE_RC4_ASSEMBLY
 SSLASM+= rc4 rc4-586
 
 # sha
+CFLAGS+= -DLIBRESSL_USE_SHA_ASSEMBLY
 SSLASM+= sha sha1-586
 SSLASM+= sha sha256-586
 SSLASM+= sha sha512-586
diff --git a/src/lib/libcrypto/arch/i386/crypto_arch.h b/src/lib/libcrypto/arch/i386/crypto_arch.h
index ff14881f36..dc3c591b0d 100644
--- a/src/lib/libcrypto/arch/i386/crypto_arch.h
+++ b/src/lib/libcrypto/arch/i386/crypto_arch.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: crypto_arch.h,v 1.16 2026/01/17 14:53:09 jsing Exp $ */
+/*      $OpenBSD: crypto_arch.h,v 1.17 2026/01/17 16:18:32 jsing Exp $ */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -33,11 +33,11 @@ extern uint64_t crypto_cpu_caps_i386;
 
 #ifndef OPENSSL_NO_ASM
 
+#ifdef LIBRESSL_USE_AES_ASSEMBLY
 #define HAVE_AES_SET_ENCRYPT_KEY_GENERIC
 #define HAVE_AES_SET_DECRYPT_KEY_GENERIC
 #define HAVE_AES_ENCRYPT_GENERIC
 #define HAVE_AES_DECRYPT_GENERIC
-
 #define HAVE_AES_SET_ENCRYPT_KEY_INTERNAL
 #define HAVE_AES_SET_DECRYPT_KEY_INTERNAL
 #define HAVE_AES_ENCRYPT_INTERNAL
@@ -47,24 +47,31 @@ extern uint64_t crypto_cpu_caps_i386;
 #define HAVE_AES_CTR32_ENCRYPT_INTERNAL
 #define HAVE_AES_ECB_ENCRYPT_INTERNAL
 #define HAVE_AES_XTS_ENCRYPT_INTERNAL
+#endif
 
+#ifdef LIBRESSL_USE_GCM_ASSEMBLY
 #define HAVE_GCM128_INIT
 #define HAVE_GCM_GHASH_4BIT
 #define HAVE_GCM_GMULT_4BIT
+#endif
 
+#ifdef LIBRESSL_USE_MD5_ASSEMBLY
 #define HAVE_MD5_BLOCK_DATA_ORDER
+#endif
 
+#ifdef LIBRESSL_USE_RC4_ASSEMBLY
 #define HAVE_RC4_INTERNAL
 #define HAVE_RC4_SET_KEY_INTERNAL
+#endif
 
+#ifdef LIBRESSL_USE_SHA_ASSEMBLY
 #define HAVE_SHA1_BLOCK_DATA_ORDER
 #define HAVE_SHA1_BLOCK_GENERIC
-
 #define HAVE_SHA256_BLOCK_DATA_ORDER
 #define HAVE_SHA256_BLOCK_GENERIC
-
 #define HAVE_SHA512_BLOCK_DATA_ORDER
 #define HAVE_SHA512_BLOCK_GENERIC
+#endif
 
 #endif