summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/Makefile (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Combine DES code into a smaller set of files.jsing2024-08-311-18/+5
| | | | Discussed with tb@
* Merge fcrypt_b.c into fcrypt.c.jsing2024-08-311-2/+1
| | | | | | | There is no need for these to be separate (presumably done due to assembly implementations, even though there are #ifdef as well). Discussed with tb@
* Unexport OPENSSL_cpuid_setup and OPENSSL_ia32cap_Ptb2024-08-311-5/+1
| | | | | | | | | This allows us in particular to get rid of the MD Symbols.list which were needed on amd64 and i386 for llvm 16 a while back. OPENSSL_ia32cap_P was never properly exported since the symbols were marked .hidden in the asm. ok beck jsing
* Nuke the whrlpool (named after the galaxy) from orbittb2024-08-311-7/+1
| | | | | | | It's just gross. Only used by a popular disk encryption utility on an all-too-popular OS one or two decades back. ok beck jsing
* Remove DES_enc_{read,write} and DES_rw_modetb2024-08-311-2/+1
| | | | | | | Unfortunately we'll probably never be able to get rid of DES entirely. One part of it that is old enough to be a grandparent can go, though. ok beck jsing
* Garbage collec UI_UTIL remnantstb2024-08-311-2/+1
| | | | ok beck jsing
* Retire conf_api.h and the API thereintb2024-08-311-2/+1
| | | | | | | This makes the _CONF_* layer of the conf module internal and gets rid of the entirely unused conf_api.h. ok beck jsing
* Make CONF_METHOD opaquetb2024-08-311-1/+2
| | | | | | | Much of conf is designed in such a way that you really have to reach into its structs. This one piece can be hidden. It might even be removed soon. ok beck jsing
* Implement X509_get_signature_info()tb2024-08-281-1/+2
| | | | | | | | | | | | | | | | This is a slightly strange combination of OBJ_find_sigid_algs() and the security level API necessary because OBJ_find_sigid_algs() on its own isn't smart enough for the special needs of RSA-PSS and EdDSA. The API extracts the hash's NID and the pubkey's NID from the certificate's signatureAlgorithm and invokes special handlers for RSA-PSS and EdDSA for retrieving the corresponding information. This isn't entirely free for RSA-PSS, but for now we don't cache this information. The security bits calculation is a bit hand-wavy, but that's something that comes along with this sort of numerology. ok jsing
* Remove the empty ui_compat.htb2024-08-101-2/+1
| | | | unused in ports and on codesearch
* Rewrite CRYPTO_EX_DATA.jsing2024-08-021-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | CRYPTO_EX_DATA exists as a way to allow an application to attach data to various components in libcrypto and libssl. The general idea is that there are various "classes" (e.g. RSA) and an application can get an "index" (which can have new/dup/free functions provided). The application can then use the index to store a pointer to some form of data within that class, for later retrieval. However, even by OpenSSL standards, this is an insane API. The current implementation allows for data to be set without calling new, indexes can be used without allocation, new can be called without actually getting an index and dup can be called either after new or without new (see regress and RSA_get_ex_new_index(3)/CRYPTO_set_ex_data(3) for more details). On top of this, the previous "overhaul" of the code was written to be infinitely extensible. For now, the rewrite intends to maintain the existing behaviour - once we bed this down we can attempt to ratchet the API requirements and require some sort of sensible sequence. The only intentional change is that there is now a hard limit on the number of indexes that can be allocated (previously there was none, relying only on ENOMEM). ok tb@
* Remove the static symbols.namespace, and just generate the _libre_beck2024-07-101-4/+3
| | | | | | symbols from symbols.list now that we have everything hidden ok tb@
* link tls1_prf.c to buildtb2024-07-091-1/+2
| | | | ok jsing
* Actually enable namespaced builds in both libcrypto and libsslbeck2024-07-091-8/+1
| | | | (instead of commiting only one part)
* Enable namespaced builds by default for libssl and libcrypto.beck2024-07-091-3/+3
| | | | | | | | | | | Some further refinements will happen to the build process to automatically generate the Symbols.namespace file, and to remove our last public unhidden symbol (which was a mistake, but waits for a major bump to get removed) But for now everything should be using this. ok tb@
* libcrypto: constify most error string tablestb2024-06-241-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | These constitute the bulk of the remaining global mutable state in libcrypto. This commit moves most of them into data.rel.ro, leaving out ERR_str_{functs,libraries,reasons} (which require a slightly different approach) and SYS_str_reasons which is populated on startup. The main observation is that if ERR_load_strings() is called with a 0 lib argument, the ERR_STRING_DATA argument is not actually modified. We could use this fact to cast away const on the caller side and be done with it. We can make this cleaner by adding a helper ERR_load_const_strings() which explicitly avoids the assignment to str->error overriding the error code already set in the table. In order for this to work, we need to sprinkle some const in err/err.c. CMS called ERR_load_strings() with non-0 lib argument, but this didn't actually modify the error data since it ored in the value already stored in the table. Annoyingly, we need to cast const away once, namely in the call to lh_insert() in int_err_set_item(). Fixing this would require changing the public API and is going to be tricky since it requires that the LHASH_DOALL_FN_* types adjust. ok jsing
* Stub out DES_enc_{read,write}(3)tb2024-05-241-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The most terrible code in OpenSSL has its roots in libdes, which came before SSLeay. Hello, LHASH. Hello speed app. Hello DES (obviously). There are some diary-style changelog comments dating all the way back to 1990. /* This has some uglies in it but it works - even over sockets. */ Well, kind of: * - This code cannot handle non-blocking sockets. Also: /* >output is a multiple of 8 byes, if len < rnum * >we must be careful. The user must be aware that this * >routine will write more bytes than he asked for. * >The length of the buffer must be correct. * FIXED - Should be ok now 18-9-90 - eay */ Or /* This is really a bad error - very bad * It will stuff-up both ends. */ Or #ifdef _LIBC extern unsigned long time(); extern int write(); #endif I can't even... Delete, delete, delete. ok jsing
* Take pem2.h behind the barntb2024-04-251-2/+1
| | | | | | | | | | | /* * This header only exists to break a circular dependency between pem and err * Ben 30 Jan 1999. */ 25 years of uselessness is about a quarter century more than enough. discussed with jsing
* Bye, bye, OPENSSL_str{,n}casecmp()tb2024-04-151-2/+1
| | | | ok jsing
* Consolidate cast code.jsing2024-03-291-6/+2
|
* Consolidate camellia code.jsing2024-03-291-7/+1
|
* Move camellia to primary Makefile.jsing2024-03-291-4/+4
| | | | These files are now built on all platforms.
* Move aes_core.c to the primary Makefile.jsing2024-03-291-2/+2
| | | | This is now built on all platforms.
* Consolidate idea into a single C file.jsing2024-03-291-6/+2
|
* Consolidate whirlpool into a single C file.jsing2024-03-291-3/+2
| | | | | | | Buy a vowel at the same time, since we're no longer limited to 8.3 file names. Discussed with tb@
* Move wp_block.c to the primary Makefile.jsing2024-03-291-2/+2
| | | | This is now built on all platforms.
* Merge aes_cbc.c into aes.c now that aes_cbc.c is used on all platforms.jsing2024-03-281-2/+1
|
* Nuke more leftover GOST tendrils.beck2024-03-281-2/+1
| | | | ok tb@
* Remove fallback files that are now always included in the build.jsing2024-03-281-5/+1
|
* Move rc4.c to primary Makefile.jsing2024-03-281-1/+4
| | | | This is now built on all platforms.
* Move des sources to primary Makefile.jsing2024-03-281-1/+3
| | | | | Now that all platforms use a C des implementation, move it to the primary Makefile.
* Consolidate most of the AES modes into a single C file.jsing2024-03-281-6/+2
| | | | Discussed with tb@
* Catch the blowfish that escaped.jsing2024-03-271-2/+2
|
* Consolidate rc4 code.jsing2024-03-271-3/+2
| | | | Discussed with tb@
* Consolidate blowfish code.jsing2024-03-271-6/+2
| | | | Requested by tb@
* Move bf_enc.c to the primary Makefile.jsing2024-03-271-1/+2
| | | | | Now that all architectures are using bf_enc.c, it does not make sense to have it in every Makefile.inc file.
* Move the OPENSSL_init() stub from o_init.c to crypto_init.ctb2024-03-191-2/+1
|
* Remove some GOST relicstb2024-03-021-2/+1
|
* Unhook and remove GOST and STREEBOGtb2024-03-021-21/+1
| | | | | | | | | | | | This stops compiling the GOST source. The current implementation is low quality and got in the way, especially in libssl. While we would be open for GOST support, it needs to be significantly better than what we have had and it also needs a maintainer. Add OPENSSL_NO_GOST to opensslfeatures and stop installing gost.h. Some code wrapped in #ifndef OPENSSL_NO_GOST will be removed later. ok jsing
* Make LHASH_OF() and STACK_OF() use opaque structstb2024-03-021-1/+3
| | | | | | | | | | | | | This removes internals of these two special snowflakes and will allow further simplifications. Unfortunately, there are some pieces of software that actually use LHASH_OF() (looking at you, pound, Ruby, and openssl(1)), so we get to keep exposing this garbage, at least for now. Expose lh_error() as a symbol to replace a macro reaching into _LHASH. lh_down_load() is no longer available. _LHASH and _STACK are now opaque, LHASH_NODE becomes internal-only. from jsing
* Remove lh statstb2024-03-021-2/+1
| | | | | | | This could have been removed in an earlier bump. Now it's time for it to say goodbye. ok jsing
* Remove RC4-HMAC-MD5 and AES-{128,256}-CBC-HMAC-SHA-1tb2024-03-021-3/+1
| | | | | | | "Stitched" mode AEADs were removed from libssl a long time ago. Nothing uses these CIPHERs anymore. ok jsing
* Remove the ameth libtb2024-03-021-2/+1
| | | | | | | | This is accessor API for ASN.1 methods needed for custom PKEYs. Nothing has ever used this. This has been neutered for months. The EVP_PKEY_asn1_* API that needs to stay was moved elsewhere. ok jsing
* Add posix_time.h from BoringSSLtb2024-02-181-1/+2
| | | | | | | | | | | | | | | | This is prepares to expose some internal API as OPENSSL_tm_to_posix() and OPENSSL_posix_to_tm(). They will be used in libtls and ocspcheck(8) to get rid of the portability nightmare that is timegm(). Also fix the location of OPENSSL_gmtime() and OPENSSL_timegm() (this API is not yet exposed). The former is from OpenSSL and surprisingly lives in crypto.h, not asn1.h, and the latter is BoringSSL API and lives in the new posix_time.h. Initial diff from beck, this pulls in further upstream work after review feedback. ok jsing
* Fold keyivgen functions into evp_pbe.ctb2024-01-271-4/+1
| | | | | These are only used by the EVP_PBE routines and will become internal in the next major bump.
* The OBJ_NAME API joins the party in evp_names.ctb2024-01-131-2/+1
| | | | ... and another file without license disappears.
* Move EVP_add_{cipher,digest}() to the trashcantb2024-01-131-2/+1
| | | | They will await their removal in the next major bump.
* Stub out {OpenSSL,OPENSSL}_add*tb2024-01-131-2/+1
| | | | | | | | | | | These serve no purpose anymore (and really haven't for many years) but will have to be kept since there's a number of software that still uses them because many years ago they had to. Relocate the stubs to crypto_init.c since library initialization's what they were there for. ok jsing
* Add a table of cipher names, ciphers and aliasestb2024-01-131-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | This arranges the data provided by dynamic library initialization in a static table and will help avoid gross code with missing error checking and other defects on every use of the library. This table isn't pretty due to various naming inconsistecies accumulated over the decades. It will significantly simplify the implementation of API such as EVP_get_cipherbyname() and EVP_CIPHER_do_all(). All the table does is map strings to ciphers, typically used on the openssl(1) command line or in code it's the mechanism that underlies the map from NID_chacha20 to the data returned by EVP_chacha20(). It's of course more complicated because it just had to be stupid. This is one of the places where the use of bsearch() is justified. The price to pay for the simplification is that adding custom aliases and custom ciphers to this table will no longer be supported. It is one significant user of the LHASH madness. That's just another piece of the awful "toolkit aspect"-guided misdesign that contributes to making this codebase so terrible. A corresponding table for the digests will be added in the next commit. ok jsing
* Merge the EVP_CIPHER_meth_* API into evp_cipher.ctb2023-12-291-2/+1
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-12-25 13:23:06 +0000