summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/Makefile (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Add new x509 certificate chain validator in x509_verify.cbeck2020-09-131-2/+3
| | | | | | | | | | | | | | | | | | | The new validator finds multiple validated chains to handle the modern PKI cases which may frequently have multiple paths via different intermediates to different roots. It is loosely based on golang's x509 validator This includes integration so that the new validator can be used via X509_verify_cert() as well as a new api x509_verify() which will return multiple chains (similar to go). The new validator is not enabled by default with this commit, this will be changed in a follow on commit. The new public API is not yet exposed, and will be finalized and exposed with a man page and a library minor bump later. ok tb@ inoguchi@ jsing@
* Add x509_constraints.c - a new implementation of x509 name constraints, withbeck2020-09-111-2/+2
| | | | | | | regression tests. The use of the new name constraints is not yet activated in x509_vfy.c and will be activated in a follow on commit ok jsing@
* Add issuer cache, to be used by upcoming changes to validation code.beck2020-09-111-1/+2
| | | | ok tb@ jsing@
* The check_includes step is incorrect dependency management model forderaadt2020-06-091-11/+1
| | | | | | how our tree gets built. If this was done in all the libraries (imagine sys/dev), it would disrupt the development process hugely. So it should not be done here either. use 'make includes' by hand instead.
* One error file per directory is plenty.jsing2020-06-051-2/+2
|
* Collapse the x509v3 directory into x509.jsing2020-06-041-10/+7
| | | | | | | This avoids the need to grep across directories to find functions and prepares for further rototilling and chainsawing. Discussed with tb@ (who also tested the release build)
* Add checks to ensure that lib{crypto,ssl,tls} public headers have actuallyjsing2020-01-221-1/+11
| | | | | | been installed prior to building. Requested by and ok tb@
* Simplify header installation by combining the HDRS and HDRS_GEN loops.jsing2020-01-221-9/+2
| | | | ok beck@
* Enable CMS in LibreSSL.jsing2019-11-021-1/+6
| | | | ok bcook@ deraadt@ inoguchi@ job@ tb@
* Install the openssl/cms.h header.jsing2019-09-091-1/+3
| | | | | | | | This header includes OPENSSL_NO_CMS guards, so even if things find the header it provides no useful content (and other code should technically also be using OPENSSL_NO_CMS...). ok deraadt@ inoguchi@
* Add various macros and controls for EC_PKEY_CTX.jsing2019-09-061-1/+2
| | | | | | | | | These are needed for the upcoming EC CMS support (nothing else appears to use them). This largely syncs our ec_pmeth.c with OpenSSL 1.1.1b. With input from inoguchi@ and tb@. ok inoguchi@ tb@
* Build ecdh_kdf.cjsing2019-09-051-2/+2
|
* Add the SM4 block cipher from the Chinese standard GB/T 32907-2016.tb2019-03-171-1/+7
| | | | | | | | This is an ISC licensed version based on the sources by Ribose Inc that were ported to OpenSSL in 2017. Patch from Daniel Wyatt with minor tweaks. ok inoguchi, jsing
* No need to include <bsd.prog.mk> here.tb2019-01-231-2/+1
| | | | ok bcook
* Partial port of EC_KEY_METHOD from OpenSSL 1.1.tb2019-01-191-3/+7
| | | | | | | This commit adds init/free, support for signing, setting and getting the method, engine support as well as extra data. from markus
* Add Ribose Inc's implementation of the SM3 hashing function withtb2018-11-111-2/+7
| | | | | | | | | tweaks from jsing and myself. The SM2/SM3/SM4 algorithms are mandatory for legal use of cryptography within China and [are] widely applied in the country, covering identification/financial cards, contactless, TPM 2.0 and PKI. ok beck inoguchi jsing
* Add automatic threading initialization for libcrypto.bcook2018-11-111-2/+2
| | | | | | | | | | | | | | This implements automatic thread support initialization in libcrypto. This does not remove any functions from the ABI, but does turn them into no-ops. Stub implementations of pthread_mutex_(init|lock|unlock) are provided for ramdisks. This does not implement the new OpenSSL 1.1 thread API internally, keeping the original CRYTPO_lock / CRYPTO_add_lock functions for library locking. For -portable, crypto_lock.c can be reimplemented with OS-specific primitives as needed. ok beck@, tb@, looks sane guenther@
* Remove a bunch of ancient and highly crufty ASN.1 related code fromjsing2018-10-241-4/+2
| | | | | | libcrypto (the "new" stuff replaced this back around 2000 or so...). ok tb@
* Bring in compatibility for OpenSSL 1.1 style init functions.beck2018-03-171-2/+2
| | | | | | | | | This adds OPENSSL_init_crypto and OPENSSL_init_ssl, as well thread safety modifications for the existing LibreSSL init functions. The initialization routines are called automatically by the normal entry points into the library, as in newer OpenSSL ok jsing@, nits by tb@ and deraadt@
* Add DSA_meth_{dup,free,new,set_{finish,sign}}()tb2018-03-171-1/+2
| | | | | | | As in RSA_meth_*, note that these functions return NULL in out-of-memory situations, but they do not set an error explicitly. ok jsing
* Provide RSA_meth_{dup,free,new,set_{finish,priv_{dec,enc}}}()tb2018-03-171-2/+2
| | | | | | | Note that these functions return NULL in out-of-memory situations, but contrary to OpenSSL's versions they do not set an error. ok jsing
* Provide BIO_meth_{free,new}() and BIO_meth_set_{create,crtl,destroy}()tb2018-02-171-2/+2
| | | | | | and BIO_meth_set_{puts,read,write}(). ok jsing
* Remove RSA_padding_add_SSLv23()/RSA_padding_check_SSLv23() and relatedjsing2017-08-281-2/+2
| | | | | | code. We removed SSLv2/SSLv3 a long time ago... Discussed with doug@
* sprinkle a few missing dependencies on perl scripts internal bits.espie2017-08-201-3/+3
| | | | 'it works' deraadt@
* Switch to -Werror with clang for libressl.doug2017-08-131-2/+2
| | | | | Discussed with beck@ and jsing@ ok beck@
* remove misc. depend and yacc nits that no longer matter.espie2017-07-101-2/+1
| | | | okay millert@
* mark files as BUILDFIRST, or write explicit dependencies, so that mostespie2017-06-161-1/+2
| | | | | programs will build even without a make depend first. okay tb@ millert@
* Randomize link-order of libcrypto as we do with libc. This libraryderaadt2017-05-291-1/+2
| | | | | | | | | | | | | | has many small functions without significant local storage, therefore less tail protection from -fstack-protector-strong to prevent their use as ROP gadgets. It is used in security contexts. Also many functions dribble pointers onto the stack, allowing discovery of gadgets via the fixed relative addresses, so let's randomly bias those. ok tedu jsing The rc script will soon need a strategy for skipping this step on machines with poor IO performance. Or maybe do it less often? However, I don't see many more libraries we'll do this with, these are the two most important ones.
* Bring in HKDF, from BoringSSL, with regress tests modified to bebeck2017-05-061-1/+6
| | | | | in C. Ride previous minor bump ok tom@ inoguchi@ jsing@
* Only enable -Werror on libcrypto/libssl/libtls if we are building withjsing2017-04-301-3/+6
| | | | | | | gcc4. This should avoid failed builds while transitioning compilers. While here also make the CFLAGS blocks consistent across makefiles. Discussed with deraadt@, ok beck@
* Add an EVP interface that provides concatenated MD5+SHA1 hashes, which arejsing2017-02-281-1/+2
| | | | | | | | | | used in various parts of TLS 1.0/1.1. This will allow for code simplification in libssl. The same interface exists in OpenSSL 1.1. ok beck@ deraadt@ inoguchi@ millert@
* Make explicit _ct and _nonct versions of bn_mod_exp funcitons thatbeck2017-01-211-2/+3
| | | | | | | | | | | | matter for constant time, and make the public interface only used external to the library. This moves us to a model where the important things are constant time versions unless you ask for them not to be, rather than the opposite. I'll continue with this method by method. Add regress tests for same. ok jsing@
* Explicitly export a list of symbols from libcrypto.jsing2016-12-211-2/+10
| | | | | | | | | | | | | | | | Move the "internal" BN functions from bn.h to bn_lcl.h and stop exporting the bn_* symbols. These are documented as only being intended for internal use, so why they were placed in a public header is beyond me... This hides 363 previously exported symbols, most of which exist in headers that are not installed and were never intended to be public. This also removes a few crusty old things that should have died long ago (like _ossl_old_des_read_pw). But don't worry... there are still 3451 symbols exported from the library. With input and testing from inoguchi@. ok beck@ inoguchi@
* after getting rid of the pod files, clean up the Makefiles; ok bcook@schwarze2016-11-051-2/+5
|
* Add support for X25519.jsing2016-11-051-1/+6
| | | | | | This brings in code from BoringSSL, which is mostly taken from SUPERCOP. ok beck@ bcook@
* Nuke the KRB5 ASN.1 code from orbit.jsing2016-11-041-6/+1
| | | | ok beck@
* No need to reach libssl private headers and to define TERMIOS anymore.miod2016-11-041-4/+1
| | | | ok bcook@
* Move libcrypto, librpcsvc and gnu/usr.bin/cc/include from RDIRS to PRDIRS,tb2016-10-161-2/+4
| | | | | | | | | | | | | | and add prereq targets, so some header files are generated by BUILDUSER during 'make prereq' instead of by root during 'make includes'. Switch the order of 'make cleandir' and 'make includes' during 'make build' so we don't generate many files twice. Except for some machine@ symlinks from ${MACHINE}/stand, /usr/obj is now clean from files generated by root during 'make build'. Those will be cleaned up in a second step. help, testing & ok deraadt, input from natano, further testing rpe
* Append to CLEANFILES instead of replacing it, so libcrypto.pc isnatano2016-09-231-2/+2
| | | | | | deleted on make clean. ok millert
* Generate pkg-config files at build time like everything else. Thisnatano2016-09-141-2/+3
| | | | | | | avoids permission problems due to the build and install stages being run by different users. ok deraadt jasper
* Files in /etc/ssl belong to root. ok deraadtnatano2016-09-111-4/+4
|
* Remove cms.jsing2016-09-041-8/+1
|
* only regen pkg-config files when required; ok jaspernatano2016-09-041-5/+5
|
* Make tree build againbeck2016-09-031-2/+427
|
* Move build machinery for libcrypto from libssl/crypto to libcrypto, as wellmiod2014-04-111-0/+24
as configuration files; split manpages and .pc files between libcrypto and libssl. No functional change, only there to make engineering easier, and libcrypto sources are still found in libssl/src/crypto at the moment. ok reyk@, also discussed with deraadt@ beck@ and the usual crypto suspects.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-21 07:38:18 +0000