aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.github/workflows/android.yml9
-rw-r--r--.github/workflows/cifuzz.yml2
-rw-r--r--.github/workflows/cmake-config.yml6
-rw-r--r--.github/workflows/coverity.yml7
-rw-r--r--.github/workflows/emscripten.yml28
-rw-r--r--.github/workflows/fedora-rawhide.yml11
-rw-r--r--.github/workflows/freebsd.yml18
-rw-r--r--.github/workflows/linux.yml47
-rw-r--r--.github/workflows/macos.yml11
-rw-r--r--.github/workflows/release.yml76
-rw-r--r--.github/workflows/rust-openssl.yml4
-rw-r--r--.github/workflows/solaris.yml8
-rw-r--r--.github/workflows/windows.yml56
-rw-r--r--.gitignore8
-rw-r--r--CMakeLists.txt283
-rw-r--r--ChangeLog12
-rw-r--r--apps/nc/compat/accept4.c10
-rw-r--r--apps/nc/compat/readpassphrase.c2
-rw-r--r--apps/openssl/compat/poll_win.c33
-rw-r--r--configure.ac21
-rw-r--r--crypto/CMakeLists.txt7
-rw-r--r--crypto/Makefile.am6
-rw-r--r--crypto/Makefile.am.elf-mips1
-rw-r--r--crypto/Makefile.am.elf-mips6412
-rw-r--r--crypto/arch/mips/crypto_arch.h18
-rw-r--r--crypto/bn/arch/mips/bn_arch.h19
-rw-r--r--crypto/compat/ftruncate.c17
-rw-r--r--crypto/compat/getdelim.c20
-rw-r--r--crypto/compat/getprogname_windows.c3
-rw-r--r--crypto/compat/posix_win.c11
-rw-r--r--crypto/compat/syslog_r.c11
-rw-r--r--include/compat/dirent_msvc.h13
-rw-r--r--include/compat/endian.h18
-rw-r--r--include/compat/pthread.h7
-rw-r--r--include/compat/stdio.h20
-rw-r--r--include/compat/syslog.h20
-rw-r--r--include/compat/unistd.h5
-rw-r--r--m4/check-hardening-options.m44
-rw-r--r--m4/check-libc.m45
-rw-r--r--man/links3
-rw-r--r--patches/netcat.c.patch10
-rw-r--r--patches/speed.c.patch52
-rw-r--r--patches/win32_arm64_bn_arch.h.patch23
-rwxr-xr-xscripts/test40
-rw-r--r--ssl/CMakeLists.txt1
-rw-r--r--ssl/Makefile.am2
-rw-r--r--tests/CMakeLists.txt102
-rw-r--r--tests/Makefile.am87
-rw-r--r--tests/compat/pipe2.c46
-rwxr-xr-xtests/ssl_tlstest.sh43
-rw-r--r--tests/ssl_verify.bat42
-rwxr-xr-xtests/ssl_verify.sh67
-rwxr-xr-xtests/x509_callbacks.sh94
-rwxr-xr-xtests/x509_verify.sh81
-rw-r--r--tls/CMakeLists.txt2
-rw-r--r--tls/compat/pread.c14
-rw-r--r--tls/compat/pwrite.c14
-rwxr-xr-xupdate.sh22
58 files changed, 1379 insertions, 235 deletions
diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 0f01e6b..d9d3b36 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -25,7 +25,14 @@ jobs:
25 max-nal: 30 25 max-nal: 30
26 steps: 26 steps:
27 - name: "Checkout repository" 27 - name: "Checkout repository"
28 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 28 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
29 with:
30 persist-credentials: false
31
32 - name: "Install build dependencies"
33 run: |
34 sudo apt-get update
35 sudo apt-get install -y cmake ninja-build
29 36
30 - name: "Run CI script" 37 - name: "Run CI script"
31 run: ./scripts/test 38 run: ./scripts/test
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index 51270ac..56da4ee 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -39,7 +39,7 @@ jobs:
39 path: "./out/artifacts" 39 path: "./out/artifacts"
40 40
41 - name: "Upload SARIF" 41 - name: "Upload SARIF"
42 uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2 42 uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
43 if: always() && steps.build.outcome == 'success' 43 if: always() && steps.build.outcome == 'success'
44 with: 44 with:
45 sarif_file: "cifuzz-sarif/results.sarif" 45 sarif_file: "cifuzz-sarif/results.sarif"
diff --git a/.github/workflows/cmake-config.yml b/.github/workflows/cmake-config.yml
index 3f11cb4..493242d 100644
--- a/.github/workflows/cmake-config.yml
+++ b/.github/workflows/cmake-config.yml
@@ -24,11 +24,13 @@ jobs:
24 contents: read 24 contents: read
25 steps: 25 steps:
26 - name: "Checkout repository" 26 - name: "Checkout repository"
27 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 27 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
28 with:
29 persist-credentials: false
28 30
29 - name: "Setup Windows dependencies" 31 - name: "Setup Windows dependencies"
30 if: runner.os == 'Windows' 32 if: runner.os == 'Windows'
31 uses: msys2/setup-msys2@cafece8e6baf9247cf9b1bf95097b0b983cc558d # v2.31.0 33 uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0
32 with: 34 with:
33 update: true 35 update: true
34 install: >- 36 install: >-
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 09ab124..33aba2e 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -13,13 +13,18 @@ concurrency:
13jobs: 13jobs:
14 scan: 14 scan:
15 name: "Scan" 15 name: "Scan"
16 environment:
17 name: "coverity"
18 deployment: false
16 runs-on: "ubuntu-24.04" 19 runs-on: "ubuntu-24.04"
17 if: github.repository_owner == 'libressl' # Prevent running on forks 20 if: github.repository_owner == 'libressl' # Prevent running on forks
18 permissions: 21 permissions:
19 contents: read 22 contents: read
20 steps: 23 steps:
21 - name: "Checkout repository" 24 - name: "Checkout repository"
22 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 25 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
26 with:
27 persist-credentials: false
23 28
24 - name: "Install dependencies" 29 - name: "Install dependencies"
25 run: | 30 run: |
diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml
index 0b46ef2..ba0eb02 100644
--- a/.github/workflows/emscripten.yml
+++ b/.github/workflows/emscripten.yml
@@ -20,7 +20,15 @@ jobs:
20 contents: read 20 contents: read
21 steps: 21 steps:
22 - name: "Checkout repository" 22 - name: "Checkout repository"
23 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 23 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
24 with:
25 persist-credentials: false
26
27 - name: "Install test dependencies"
28 run: |
29 sudo apt-get update
30 sudo apt-get install -y libio-socket-ssl-perl
31 perl -MIO::Socket::SSL::Utils -e 1
24 32
25 - name: "Setup emsdk" 33 - name: "Setup emsdk"
26 uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16 34 uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16
@@ -34,10 +42,10 @@ jobs:
34 run: emcmake cmake -Bbuild 42 run: emcmake cmake -Bbuild
35 43
36 - name: "Build" 44 - name: "Build"
37 run: cmake --build build --config Release 45 run: cmake --build build --config Release --parallel 4
38 46
39 - name: "Test" 47 - name: "Test"
40 run: ctest --test-dir build -C Release --output-on-failure 48 run: ctest --test-dir build -C Release --parallel --output-on-failure
41 49
42 # Test ASAN with and without ASM enabled. 50 # Test ASAN with and without ASM enabled.
43 test-asan: 51 test-asan:
@@ -48,7 +56,15 @@ jobs:
48 contents: read 56 contents: read
49 steps: 57 steps:
50 - name: "Checkout repository" 58 - name: "Checkout repository"
51 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 59 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
60 with:
61 persist-credentials: false
62
63 - name: "Install test dependencies"
64 run: |
65 sudo apt-get update
66 sudo apt-get install -y libio-socket-ssl-perl
67 perl -MIO::Socket::SSL::Utils -e 1
52 68
53 - name: "Setup emsdk" 69 - name: "Setup emsdk"
54 uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16 70 uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16
@@ -65,7 +81,7 @@ jobs:
65 LDFLAGS: "-fsanitize=address" 81 LDFLAGS: "-fsanitize=address"
66 82
67 - name: "Build" 83 - name: "Build"
68 run: cmake --build build --config Release 84 run: cmake --build build --config Release --parallel 4
69 85
70 - name: "Test" 86 - name: "Test"
71 run: ctest --test-dir build -C Release --output-on-failure 87 run: ctest --test-dir build -C Release --parallel --output-on-failure
diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml
index 0268853..4ae9158 100644
--- a/.github/workflows/fedora-rawhide.yml
+++ b/.github/workflows/fedora-rawhide.yml
@@ -21,12 +21,15 @@ jobs:
21 runs-on: ubuntu-24.04 21 runs-on: ubuntu-24.04
22 if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} 22 if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
23 container: 23 container:
24 image: fedora:rawhide 24 image: fedora:rawhide@sha256:0c1f63ed8fb818fad16cf6ae091598c410a21d2e1a9adf183beb93189299bfba
25 steps: 25 steps:
26 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 26 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
27 with:
28 persist-credentials: false
27 - name: Install dependencies 29 - name: Install dependencies
28 run: | 30 run: |
29 dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk 31 dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk perl-IO-Socket-SSL
32 perl -MIO::Socket::SSL::Utils -e 1
30 - name: Pull upstream source 33 - name: Pull upstream source
31 run: | 34 run: |
32 ./update.sh 35 ./update.sh
@@ -36,4 +39,4 @@ jobs:
36 ninja 39 ninja
37 - name: Test 40 - name: Test
38 run: | 41 run: |
39 ninja test 42 CTEST_PARALLEL_LEVEL="" ninja test
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index cce0f33..ecf705e 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -22,7 +22,9 @@ jobs:
22 contents: read 22 contents: read
23 steps: 23 steps:
24 - name: "Checkout repository" 24 - name: "Checkout repository"
25 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 25 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
26 with:
27 persist-credentials: false
26 28
27 - name: "Setup" 29 - name: "Setup"
28 run: | 30 run: |
@@ -31,13 +33,14 @@ jobs:
31 ./autogen.sh 33 ./autogen.sh
32 34
33 - name: "Build on VM" 35 - name: "Build on VM"
34 uses: vmactions/freebsd-vm@d1e65811565151536c0c894fff74f06351ed26e6 # v1.4.5 36 uses: vmactions/freebsd-vm@f0552d3b69211736abd97f02ff3d4674c56b73b1 # v1.5.5
35 with: 37 with:
36 release: "${{ env.FREEBSD_VERSION }}" 38 release: "${{ env.FREEBSD_VERSION }}"
37 copyback: false 39 copyback: false
38 prepare: | 40 prepare: |
39 pkg install -y autoconf automake libtool 41 pkg install -y autoconf automake libtool p5-IO-Socket-SSL
40 run: | 42 run: |
43 perl -MIO::Socket::SSL::Utils -e 1
41 ./configure 44 ./configure
42 make -j2 check || (cat tests/test-suite.log && exit 1) 45 make -j2 check || (cat tests/test-suite.log && exit 1)
43 46
@@ -49,7 +52,9 @@ jobs:
49 contents: read 52 contents: read
50 steps: 53 steps:
51 - name: "Checkout repository" 54 - name: "Checkout repository"
52 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 55 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
56 with:
57 persist-credentials: false
53 58
54 - name: "Setup" 59 - name: "Setup"
55 run: | 60 run: |
@@ -58,13 +63,14 @@ jobs:
58 ./autogen.sh 63 ./autogen.sh
59 64
60 - name: "Build on VM" 65 - name: "Build on VM"
61 uses: vmactions/freebsd-vm@d1e65811565151536c0c894fff74f06351ed26e6 # v1.4.5 66 uses: vmactions/freebsd-vm@f0552d3b69211736abd97f02ff3d4674c56b73b1 # v1.5.5
62 with: 67 with:
63 release: "${{ env.FREEBSD_VERSION }}" 68 release: "${{ env.FREEBSD_VERSION }}"
64 copyback: false 69 copyback: false
65 prepare: | 70 prepare: |
66 pkg install -y cmake ninja 71 pkg install -y cmake ninja p5-IO-Socket-SSL
67 run: | 72 run: |
73 perl -MIO::Socket::SSL::Utils -e 1
68 export CTEST_OUTPUT_ON_FAILURE=1 74 export CTEST_OUTPUT_ON_FAILURE=1
69 cmake -G Ninja -B build 75 cmake -G Ninja -B build
70 ninja -C build 76 ninja -C build
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index fa512f8..06dda17 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -35,6 +35,9 @@ jobs:
35 - os: "ubuntu-24.04" # loong64 35 - os: "ubuntu-24.04" # loong64
36 arch: "loong64" 36 arch: "loong64"
37 compiler: "gcc" 37 compiler: "gcc"
38 - os: "ubuntu-24.04"
39 arch: "riscv64"
40 compiler: "gcc"
38 - os: "ubuntu-24.04-arm" 41 - os: "ubuntu-24.04-arm"
39 arch: "native" 42 arch: "native"
40 compiler: "gcc" 43 compiler: "gcc"
@@ -44,7 +47,39 @@ jobs:
44 47
45 steps: 48 steps:
46 - name: "Checkout repository" 49 - name: "Checkout repository"
47 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 50 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
51 with:
52 persist-credentials: false
53
54 - name: "Install test dependencies"
55 run: |
56 packages=(cmake ninja-build libio-socket-ssl-perl)
57 case "${{ matrix.arch }}" in
58 mingw32|mingw64)
59 packages+=(mingw-w64)
60 ;;
61 arm32)
62 packages+=(qemu-user-static binfmt-support g++-arm-linux-gnueabihf)
63 ;;
64 arm64)
65 packages+=(qemu-user-static binfmt-support g++-aarch64-linux-gnu)
66 ;;
67 loong64)
68 packages+=(qemu-user-static binfmt-support g++-14-loongarch64-linux-gnu)
69 ;;
70 mips32)
71 packages+=(qemu-user-static binfmt-support g++-mipsel-linux-gnu)
72 ;;
73 mips64)
74 packages+=(qemu-user-static binfmt-support g++-mips64el-linux-gnuabi64)
75 ;;
76 riscv64)
77 packages+=(qemu-user-static binfmt-support g++-riscv64-linux-gnu)
78 ;;
79 esac
80 sudo apt-get update
81 sudo apt-get install -y "${packages[@]}"
82 perl -MIO::Socket::SSL::Utils -e 1
48 83
49 - name: "Run tests" 84 - name: "Run tests"
50 run: ./scripts/test || (status=$?; cat tests/test-suite.log; exit $status) 85 run: ./scripts/test || (status=$?; cat tests/test-suite.log; exit $status)
@@ -66,7 +101,15 @@ jobs:
66 os: ["ubuntu-24.04", "ubuntu-24.04-arm"] 101 os: ["ubuntu-24.04", "ubuntu-24.04-arm"]
67 steps: 102 steps:
68 - name: "Checkout repository" 103 - name: "Checkout repository"
69 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 104 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
105 with:
106 persist-credentials: false
107
108 - name: "Install test dependencies"
109 run: |
110 sudo apt-get update
111 sudo apt-get install -y cmake ninja-build libio-socket-ssl-perl
112 perl -MIO::Socket::SSL::Utils -e 1
70 113
71 - name: "Run tests" 114 - name: "Run tests"
72 run: ./scripts/test 115 run: ./scripts/test
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 5958092..1aabcd8 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -25,10 +25,17 @@ jobs:
25 arch: ["arm64", "x86_64"] 25 arch: ["arm64", "x86_64"]
26 steps: 26 steps:
27 - name: "Install required packages" 27 - name: "Install required packages"
28 run: brew install automake libtool 28 run: |
29 brew install automake libtool perl cpanminus
30 PERL="$(brew --prefix perl)/bin/perl"
31 "$PERL" "$(command -v cpanm)" --notest IO::Socket::SSL
32 echo "$(brew --prefix perl)/bin" >> "$GITHUB_PATH"
33 "$PERL" -MIO::Socket::SSL::Utils -e 1
29 34
30 - name: "Checkout repository" 35 - name: "Checkout repository"
31 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 36 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
37 with:
38 persist-credentials: false
32 39
33 - name: "Run tests" 40 - name: "Run tests"
34 run: ./scripts/test 41 run: ./scripts/test
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3dd39e0..86023cf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,49 +4,60 @@ name: "Release"
4on: 4on:
5 push: 5 push:
6 tags: [ "v*" ] 6 tags: [ "v*" ]
7 workflow_dispatch:
7 8
8concurrency: 9concurrency:
9 group: "${{ github.workflow }}-${{ github.event.number || github.ref }}" 10 group: "${{ github.workflow }}-${{ github.ref }}"
10 cancel-in-progress: true 11 cancel-in-progress: false
11 12
12permissions: 13permissions: {}
13 contents: write
14 14
15jobs: 15jobs:
16 release: 16 release:
17 name: "Release" 17 name: "Release"
18 runs-on: "ubuntu-24.04" 18 runs-on: "ubuntu-24.04"
19 outputs: 19 permissions:
20 upload_url: "${{ steps.create_release.outputs.upload_url }}" 20 contents: write # Required to create release.
21 steps: 21 steps:
22 - name: "Checkout repository" 22 - name: "Checkout repository"
23 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 23 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
24 with:
25 persist-credentials: false
24 26
25 - name: "Generate version changelog" 27 - name: "Generate version changelog"
26 run: .github/scripts/changelog.sh "$VERSION" > release-changelog.txt 28 run: .github/scripts/changelog.sh "$VERSION" > release-changelog.txt
27 env: 29 env:
28 VERSION: "${{ github.ref_name }}" 30 VERSION: "${{ github.ref_name }}"
29 31
30 - name: "Create GitHub release" 32 - name: "Create draft GitHub release"
31 id: create_release 33 env:
32 uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 34 GH_TOKEN: "${{ github.token }}"
33 with: 35 VERSION: "${{ github.ref_name }}"
34 body_path: "${{ github.workspace }}/release-changelog.txt" 36 run: |
37 gh release create "$VERSION" \
38 --repo "$GITHUB_REPOSITORY" \
39 --title "$VERSION" \
40 --notes-file release-changelog.txt \
41 --draft
35 42
36 build-windows: 43 build-windows:
37 name: "${{ matrix.os }}/${{ matrix.arch }}" 44 name: "${{ matrix.os }}/${{ matrix.arch }}"
38 runs-on: "${{ matrix.os }}" 45 runs-on: "${{ matrix.os }}"
39 needs: ["release"] 46 needs: ["release"]
47 permissions:
48 contents: write # Required to upload release assets.
40 strategy: 49 strategy:
41 matrix: 50 matrix:
42 os: [ "windows-2022" ] 51 os: [ "windows-2022" ]
43 arch: [ "Win32", "x64", "ARM64" ] 52 arch: [ "Win32", "x64", "ARM64" ]
44 steps: 53 steps:
45 - name: "Checkout repository" 54 - name: "Checkout repository"
46 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 55 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
56 with:
57 persist-credentials: false
47 58
48 - name: "Setup MSYS2" 59 - name: "Setup MSYS2"
49 uses: msys2/setup-msys2@cafece8e6baf9247cf9b1bf95097b0b983cc558d # v2.31.0 60 uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0
50 with: 61 with:
51 update: true 62 update: true
52 install: >- 63 install: >-
@@ -59,23 +70,38 @@ jobs:
59 patch 70 patch
60 perl 71 perl
61 72
62 - shell: msys2 {0} 73 - name: "Run autogen"
74 shell: msys2 {0}
63 run: ./autogen.sh 75 run: ./autogen.sh
64 76
65 - shell: cmd 77 - name: "Configure"
66 run: cmake -Bbuild -G "Visual Studio 17 2022" -A ${{ matrix.arch }} -DCMAKE_INSTALL_PREFIX=local 78 shell: pwsh
79 env:
80 ARCH: "${{ matrix.arch }}"
81 run: cmake -Bbuild -G "Visual Studio 17 2022" -A "${env:ARCH}" -DCMAKE_INSTALL_PREFIX=local
67 82
68 - shell: cmd 83 - name: "Build"
84 shell: pwsh
69 run: cmake --build build --config Release 85 run: cmake --build build --config Release
70 86
71 - shell: cmd 87 - name: "Install"
88 shell: pwsh
72 run: cmake --install build --config Release 89 run: cmake --install build --config Release
73 90
74 - shell: pwsh 91 - name: "Package release artifact"
75 run: Compress-Archive -Path local\* "libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip" 92 shell: pwsh
93 env:
94 VERSION: "${{ github.ref_name }}"
95 ARCH: "${{ matrix.arch }}"
96 run: Compress-Archive -Path local\* "libressl_${env:VERSION}_windows_${env:ARCH}.zip"
76 97
77 - name: "Upload release artifact" 98 - name: "Upload release artifact"
78 uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 99 shell: bash
79 with: 100 env:
80 files: | 101 GH_TOKEN: "${{ github.token }}"
81 libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip 102 VERSION: "${{ github.ref_name }}"
103 ARCH: "${{ matrix.arch }}"
104 run: |
105 gh release upload "$VERSION" \
106 --repo "$GITHUB_REPOSITORY" \
107 "libressl_${VERSION}_windows_${ARCH}.zip"
diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml
index 68fbb33..600d15a 100644
--- a/.github/workflows/rust-openssl.yml
+++ b/.github/workflows/rust-openssl.yml
@@ -19,7 +19,9 @@ jobs:
19 contents: read 19 contents: read
20 steps: 20 steps:
21 - name: "Checkout repository" 21 - name: "Checkout repository"
22 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 22 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
23 with:
24 persist-credentials: false
23 25
24 - name: "Build LibreSSL" 26 - name: "Build LibreSSL"
25 run: | 27 run: |
diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml
index 78c5901..0241051 100644
--- a/.github/workflows/solaris.yml
+++ b/.github/workflows/solaris.yml
@@ -19,7 +19,9 @@ jobs:
19 contents: read 19 contents: read
20 steps: 20 steps:
21 - name: "Checkout repository" 21 - name: "Checkout repository"
22 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 22 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
23 with:
24 persist-credentials: false
23 25
24 - name: "Setup" 26 - name: "Setup"
25 run: | 27 run: |
@@ -28,10 +30,12 @@ jobs:
28 ./autogen.sh 30 ./autogen.sh
29 31
30 - name: "Build on VM" 32 - name: "Build on VM"
31 uses: vmactions/solaris-vm@c20562b2c69737b06be9e828915761703e487373 # v1.3.3 33 uses: vmactions/solaris-vm@96d8d976f9e67d82ec6c7e8ce9c1060731f9e21c # v1.3.9
32 with: 34 with:
33 prepare: | 35 prepare: |
34 pkg install gcc make 36 pkg install gcc make
37 PERL_MM_USE_DEFAULT=1 cpan -T IO::Socket::SSL
35 run: | 38 run: |
39 perl -MIO::Socket::SSL::Utils -e 1
36 MAKE=gmake ./configure 40 MAKE=gmake ./configure
37 gmake -j2 check || (cat tests/test-suite.log && exit 1) 41 gmake -j2 check || (cat tests/test-suite.log && exit 1)
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 4a2cead..7199214 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -13,7 +13,7 @@ concurrency:
13 13
14jobs: 14jobs:
15 test: 15 test:
16 name: "${{ matrix.os }}/${{ matrix.arch }} (${{ matrix.generator }}${{ matrix.shared == 'ON' && ', shared' || '' }})" 16 name: "${{ matrix.os }}/${{ matrix.arch }} (${{ matrix.shared == 'ON' && 'shared' || 'static' }})"
17 runs-on: "${{ matrix.os }}" 17 runs-on: "${{ matrix.os }}"
18 if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }} 18 if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
19 permissions: 19 permissions:
@@ -22,20 +22,24 @@ jobs:
22 fail-fast: false 22 fail-fast: false
23 matrix: 23 matrix:
24 os: ["windows-2022", "windows-2025"] 24 os: ["windows-2022", "windows-2025"]
25 arch: ["ARM64", "x64", "Win32"] 25 arch: ["x64", "Win32"]
26 shared: ["ON", "OFF"] 26 shared: ["ON", "OFF"]
27 include: 27 include:
28 - os: "windows-2022" 28 - os: "windows-11-vs2026-arm"
29 generator: "Visual Studio 17 2022" 29 arch: "ARM64"
30 - os: "windows-2025" 30 shared: "ON"
31 # XXX - use appropriate value 31 - os: "windows-11-vs2026-arm"
32 generator: "Visual Studio 17 2022" 32 arch: "ARM64"
33 shared: "OFF"
33 steps: 34 steps:
34 - name: "Checkout repository" 35 - name: "Checkout repository"
35 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 36 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
37 with:
38 persist-credentials: false
36 39
37 - name: "Setup MSYS2" 40 - name: "Setup MSYS2"
38 uses: msys2/setup-msys2@cafece8e6baf9247cf9b1bf95097b0b983cc558d # v2.31.0 41 id: msys2
42 uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0
39 with: 43 with:
40 update: true 44 update: true
41 install: >- 45 install: >-
@@ -44,23 +48,49 @@ jobs:
44 git 48 git
45 patch 49 patch
46 perl 50 perl
51 perl-IO-Socket-SSL
47 52
48 - name: "Update" 53 - name: "Update"
49 shell: msys2 {0} 54 shell: msys2 {0}
50 run: ./update.sh 55 run: ./update.sh
51 56
52 - name: "Configure CMake" 57 - name: "Configure CMake"
53 shell: cmd 58 shell: pwsh
54 run: cmake -Bbuild -G "${{ matrix.generator }}" -A ${{ matrix.arch }} -D BUILD_SHARED_LIBS=${{ matrix.shared }} -D CMAKE_INSTALL_PREFIX=../local 59 run: |
60 $perl = Join-Path '${{ steps.msys2.outputs.msys2-location }}' 'usr\bin\perl.exe'
61 & $perl -MIO::Socket::SSL::Utils -e 1
62 if ($LASTEXITCODE -ne 0) {
63 throw "IO::Socket::SSL::Utils is unavailable"
64 }
65
66 $vswhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
67 $component = if ('${{ matrix.arch }}' -eq 'ARM64') {
68 'Microsoft.VisualStudio.Component.VC.Tools.ARM64'
69 } else {
70 'Microsoft.VisualStudio.Component.VC.Tools.x86.x64'
71 }
72 $version = & $vswhere -latest -products * -requires $component -property installationVersion
73 if (-not $version) {
74 throw "No Visual Studio installation with $component found"
75 }
76 $major = $version.Split('.')[0]
77 $generator = cmake --help |
78 Select-String "^\s*\*?\s*(Visual Studio $major \d+)" |
79 Select-Object -First 1 |
80 ForEach-Object { $_.Matches[0].Groups[1].Value }
81 if (-not $generator) {
82 throw "No CMake generator found for Visual Studio $major"
83 }
84 Write-Host "Using generator: $generator"
85 cmake -Bbuild -G "$generator" -A ${{ matrix.arch }} -D BUILD_SHARED_LIBS=${{ matrix.shared }} -D CMAKE_INSTALL_PREFIX=../local "-DPERL_EXECUTABLE=$perl"
55 86
56 - name: "Build" 87 - name: "Build"
57 shell: cmd 88 shell: cmd
58 run: cmake --build build --config Release 89 run: cmake --build build --config Release
59 90
60 - name: "Test" 91 - name: "Test"
61 if: matrix.arch != 'ARM64'
62 shell: cmd 92 shell: cmd
63 run: ctest --test-dir build -C Release --output-on-failure 93 run: ctest --test-dir build -C Release --parallel --output-on-failure
64 94
65 - name: "Upload build artifacts" 95 - name: "Upload build artifacts"
66 if: always() 96 if: always()
diff --git a/.gitignore b/.gitignore
index 5db07be..d85df81 100644
--- a/.gitignore
+++ b/.gitignore
@@ -126,6 +126,7 @@ tests/renegotiation_test*
126tests/rfc3779* 126tests/rfc3779*
127tests/rfc5280time* 127tests/rfc5280time*
128tests/ssl_get_shared_ciphers* 128tests/ssl_get_shared_ciphers*
129tests/ssl_kex*
129tests/ssl_methods* 130tests/ssl_methods*
130tests/ssl_set_alpn_protos* 131tests/ssl_set_alpn_protos*
131tests/ssl_verify_param* 132tests/ssl_verify_param*
@@ -139,12 +140,19 @@ tests/test.h
139tests/*test.c 140tests/*test.c
140tests/pbkdf2* 141tests/pbkdf2*
141tests/*.pem 142tests/*.pem
143tests/certs/
144tests/create-libressl-test-certs.pl
145tests/make-dir-roots.pl
142tests/testssl 146tests/testssl
143tests/*.txt 147tests/*.txt
144tests/compat/*.c 148tests/compat/*.c
149tests/ssl_verify.c
145tests/verify* 150tests/verify*
151tests/x509_verify*
152!tests/x509_verify.sh
146tests/x509_algor* 153tests/x509_algor*
147tests/x509_asn1* 154tests/x509_asn1*
155tests/x509_crl*
148tests/x509_extensions_test* 156tests/x509_extensions_test*
149tests/x509_info* 157tests/x509_info*
150tests/x509_name_test* 158tests/x509_name_test*
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 7ab04ab..269038c 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -21,6 +21,7 @@ endif()
21 21
22project(LibreSSL LANGUAGES C ASM) 22project(LibreSSL LANGUAGES C ASM)
23 23
24include(CheckCSourceCompiles)
24include(CheckFunctionExists) 25include(CheckFunctionExists)
25include(CheckSymbolExists) 26include(CheckSymbolExists)
26include(CheckLibraryExists) 27include(CheckLibraryExists)
@@ -32,6 +33,16 @@ include(cmake_export_symbol)
32include(GNUInstallDirs) 33include(GNUInstallDirs)
33 34
34enable_testing() 35enable_testing()
36find_program(PERL_EXECUTABLE perl perl5)
37set(HAVE_PERL_IO_SOCKET_SSL_UTILS FALSE)
38if(PERL_EXECUTABLE)
39 execute_process(COMMAND ${PERL_EXECUTABLE} -MIO::Socket::SSL::Utils -e 1
40 RESULT_VARIABLE PERL_IO_SOCKET_SSL_UTILS_RESULT
41 OUTPUT_QUIET ERROR_QUIET)
42 if(PERL_IO_SOCKET_SSL_UTILS_RESULT EQUAL 0)
43 set(HAVE_PERL_IO_SOCKET_SSL_UTILS TRUE)
44 endif()
45endif()
35 46
36file(READ ${CMAKE_CURRENT_SOURCE_DIR}/ssl/VERSION SSL_VERSION) 47file(READ ${CMAKE_CURRENT_SOURCE_DIR}/ssl/VERSION SSL_VERSION)
37string(STRIP ${SSL_VERSION} SSL_VERSION) 48string(STRIP ${SSL_VERSION} SSL_VERSION)
@@ -55,6 +66,7 @@ option(ENABLE_ASM "Enable assembly" ON)
55option(ENABLE_EXTRATESTS "Enable extra tests that may be unreliable on some platforms" OFF) 66option(ENABLE_EXTRATESTS "Enable extra tests that may be unreliable on some platforms" OFF)
56option(ENABLE_NC "Enable installing TLS-enabled nc(1)" OFF) 67option(ENABLE_NC "Enable installing TLS-enabled nc(1)" OFF)
57set(OPENSSLDIR ${OPENSSLDIR} CACHE PATH "Set the default openssl directory" FORCE) 68set(OPENSSLDIR ${OPENSSLDIR} CACHE PATH "Set the default openssl directory" FORCE)
69set(TLS_DEFAULT_CA_FILE ${TLS_DEFAULT_CA_FILE} CACHE PATH "Set the default CA file for libtls" FORCE)
58set(LIBRESSL_INSTALL_CMAKEDIR "${CMAKE_INSTALL_LIBDIR}/cmake/LibreSSL" CACHE STRING "Installation directory for the CMake targets") 70set(LIBRESSL_INSTALL_CMAKEDIR "${CMAKE_INSTALL_LIBDIR}/cmake/LibreSSL" CACHE STRING "Installation directory for the CMake targets")
59 71
60option(USE_STATIC_MSVC_RUNTIMES "Use /MT instead of /MD in MSVC" OFF) 72option(USE_STATIC_MSVC_RUNTIMES "Use /MT instead of /MD in MSVC" OFF)
@@ -127,6 +139,7 @@ if(CMAKE_SYSTEM_NAME MATCHES "HP-UX")
127endif() 139endif()
128 140
129if(CMAKE_SYSTEM_NAME MATCHES "SunOS") 141if(CMAKE_SYSTEM_NAME MATCHES "SunOS")
142 set(SOLARIS TRUE)
130 set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -std=gnu99 -fno-strict-aliasing") 143 set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -std=gnu99 -fno-strict-aliasing")
131 set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -D__EXTENSIONS__") 144 set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -D__EXTENSIONS__")
132 set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -D_XOPEN_SOURCE=600") 145 set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -D_XOPEN_SOURCE=600")
@@ -146,6 +159,99 @@ if (CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang")
146 add_compile_options($<$<COMPILE_LANGUAGE:C>:-Wno-pointer-sign>) 159 add_compile_options($<$<COMPILE_LANGUAGE:C>:-Wno-pointer-sign>)
147endif() 160endif()
148 161
162# Exploit-mitigation flags, matching the default-on hardening the autotools
163# build applies (m4/check-hardening-options.m4). The CMake build shipped none
164# of these, so a cmake-built libcrypto/libssl/libtls and openssl(1) had no
165# stack protector, no _FORTIFY_SOURCE, no RELRO/BIND_NOW and no CET, and the
166# mingw DLLs missed the DEP/ASLR opt-ins. MSVC is left to its own toolchain
167# defaults, exactly as that m4 (which only drives gcc/clang/mingw flags) does.
168# Every flag is probed before use so unsupported targets simply skip it.
169option(ENABLE_HARDENING
170 "Enable options to frustrate memory corruption exploits" ON)
171option(ENABLE_WINDOWS_SSP
172 "Build stack smashing protection on Windows (requires libssp)" OFF)
173
174if(ENABLE_HARDENING AND NOT MSVC AND
175 (CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang"))
176 include(CheckCCompilerFlag)
177
178 macro(add_harden_cflag _flag _var)
179 check_c_compiler_flag("${_flag}" ${_var})
180 if(${_var})
181 add_compile_options($<$<COMPILE_LANGUAGE:C>:${_flag}>)
182 endif()
183 endmacro()
184
185 # CMake 3.16 predates check_linker_flag, so probe link flags by linking.
186 macro(add_harden_ldflag _flag _var)
187 set(_saved_link_options "${CMAKE_REQUIRED_LINK_OPTIONS}")
188 set(CMAKE_REQUIRED_LINK_OPTIONS "${_flag}")
189 check_c_source_compiles("int main(void){return 0;}" ${_var})
190 set(CMAKE_REQUIRED_LINK_OPTIONS "${_saved_link_options}")
191 if(${_var})
192 add_link_options("${_flag}")
193 endif()
194 endmacro()
195
196 # Do not optimize based on signed arithmetic overflow.
197 add_harden_cflag(-fno-strict-overflow HAVE_CFLAG_FNO_STRICT_OVERFLOW)
198
199 if(NOT WIN32)
200 # _FORTIFY_SOURCE needs an optimizing build and warns without one,
201 # so probe it at -O2 and only apply it to non-Debug C compiles.
202 set(_saved_req_flags "${CMAKE_REQUIRED_FLAGS}")
203 set(CMAKE_REQUIRED_FLAGS
204 "-O2 -Werror -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2")
205 check_c_source_compiles("#include <string.h>
206int main(void){char b[8];const char *s=\"x\";strcpy(b,s);return b[0];}"
207 HAVE_CFLAG_FORTIFY_SOURCE)
208 set(CMAKE_REQUIRED_FLAGS "${_saved_req_flags}")
209 if(HAVE_CFLAG_FORTIFY_SOURCE)
210 add_compile_options(
211 "$<$<AND:$<COMPILE_LANGUAGE:C>,$<NOT:$<CONFIG:Debug>>>:-U_FORTIFY_SOURCE>"
212 "$<$<AND:$<COMPILE_LANGUAGE:C>,$<NOT:$<CONFIG:Debug>>>:-D_FORTIFY_SOURCE=2>")
213 endif()
214
215 # Read-only relocations, resolved at load time. wasm has no
216 # ELF loader and wasm-ld only warns about unknown -z values,
217 # so the probe false-positives on Emscripten; skip it there.
218 if(NOT EMSCRIPTEN)
219 add_harden_ldflag(-Wl,-z,relro HAVE_LDFLAG_Z_RELRO)
220 add_harden_ldflag(-Wl,-z,now HAVE_LDFLAG_Z_NOW)
221 endif()
222 else()
223 # Windows (mingw) DEP, ASLR and high-entropy ASLR opt-ins.
224 add_harden_ldflag(-Wl,--nxcompat HAVE_LDFLAG_NXCOMPAT)
225 add_harden_ldflag(-Wl,--dynamicbase HAVE_LDFLAG_DYNAMICBASE)
226 add_harden_ldflag(-Wl,--high-entropy-va HAVE_LDFLAG_HIGH_ENTROPY_VA)
227 endif()
228
229 # Stack smashing protection. On Windows this pulls in libssp, so it is
230 # opt-in there, mirroring --enable-windows-ssp. Emscripten accepts the
231 # flag (and the frameless probe links), but its libc has no
232 # __stack_chk_guard/__stack_chk_fail, so any protected frame fails to
233 # link; it provides its own stack checks (-sSTACK_OVERFLOW_CHECK).
234 if(NOT EMSCRIPTEN AND (NOT WIN32 OR ENABLE_WINDOWS_SSP))
235 check_c_compiler_flag(-fstack-protector-strong
236 HAVE_CFLAG_STACK_PROTECTOR_STRONG)
237 if(HAVE_CFLAG_STACK_PROTECTOR_STRONG)
238 add_compile_options(
239 $<$<COMPILE_LANGUAGE:C>:-fstack-protector-strong>)
240 else()
241 add_harden_cflag(-fstack-protector-all
242 HAVE_CFLAG_STACK_PROTECTOR_ALL)
243 endif()
244 if(WIN32)
245 set(PLATFORM_LIBS ${PLATFORM_LIBS} ssp)
246 endif()
247 endif()
248
249 # Control-flow integrity (Intel CET); unsupported on Darwin.
250 if(NOT APPLE)
251 add_harden_cflag(-fcf-protection=full HAVE_CFLAG_CF_PROTECTION)
252 endif()
253endif()
254
149if(WIN32) 255if(WIN32)
150 add_definitions(-D_CRT_SECURE_NO_WARNINGS) 256 add_definitions(-D_CRT_SECURE_NO_WARNINGS)
151 add_definitions(-D_CRT_DEPRECATED_NO_WARNINGS) 257 add_definitions(-D_CRT_DEPRECATED_NO_WARNINGS)
@@ -295,7 +401,60 @@ if(HAVE_STRTONUM)
295 add_definitions(-DHAVE_STRTONUM) 401 add_definitions(-DHAVE_STRTONUM)
296endif() 402endif()
297 403
404#
405# arc4random on these platform versions falls back to a weak seed when it
406# cannot open /dev/random, so the builtin one is used there instead. Same
407# versions as the USE_BUILTIN_ARC4RANDOM checks in m4/check-os-options.m4.
408#
409set(USE_BUILTIN_ARC4RANDOM FALSE)
410if(APPLE)
411 # getentropy(2) arrived in 10.12 but is not tagged as introduced
412 # there, so the deployment target has to be tested directly.
413 check_c_source_compiles("
414 #include <AvailabilityMacros.h>
415 #include <unistd.h>
416 #include <sys/random.h>
417 #ifndef MAC_OS_X_VERSION_10_12
418 #define MAC_OS_X_VERSION_10_12 101200
419 #endif
420 #if defined(MAC_OS_X_VERSION_MIN_REQUIRED)
421 #if MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_12
422 #error \"Targeting Mac OS X 10.11 or earlier\"
423 #endif
424 #endif
425 int main(void) { char buf[1]; return getentropy(buf, 1); }"
426 HAVE_MACOS_GETENTROPY)
427 if(NOT HAVE_MACOS_GETENTROPY)
428 set(USE_BUILTIN_ARC4RANDOM TRUE)
429 endif()
430elseif(CMAKE_SYSTEM_NAME MATCHES "FreeBSD")
431 check_c_source_compiles("
432 #include <sys/param.h>
433 #if __FreeBSD_version < 1200000
434 #error \"FreeBSD 11 or earlier\"
435 #endif
436 int main(void) { return 0; }"
437 HAVE_FREEBSD_ARC4RANDOM)
438 if(NOT HAVE_FREEBSD_ARC4RANDOM)
439 set(USE_BUILTIN_ARC4RANDOM TRUE)
440 endif()
441elseif(CMAKE_SYSTEM_NAME MATCHES "NetBSD")
442 check_c_source_compiles("
443 #include <sys/param.h>
444 #if __NetBSD_Version__ < 700000001
445 #error \"NetBSD 6 or earlier\"
446 #endif
447 int main(void) { return 0; }"
448 HAVE_NETBSD_ARC4RANDOM)
449 if(NOT HAVE_NETBSD_ARC4RANDOM)
450 set(USE_BUILTIN_ARC4RANDOM TRUE)
451 endif()
452endif()
453
298check_symbol_exists(arc4random_buf "stdlib.h" HAVE_ARC4RANDOM_BUF) 454check_symbol_exists(arc4random_buf "stdlib.h" HAVE_ARC4RANDOM_BUF)
455if(USE_BUILTIN_ARC4RANDOM)
456 set(HAVE_ARC4RANDOM_BUF FALSE)
457endif()
299if(HAVE_ARC4RANDOM_BUF) 458if(HAVE_ARC4RANDOM_BUF)
300 add_definitions(-DHAVE_ARC4RANDOM_BUF) 459 add_definitions(-DHAVE_ARC4RANDOM_BUF)
301endif() 460endif()
@@ -317,6 +476,10 @@ endif()
317 476
318# XXX macos fails to find getentropy with check_symbol_exists() 477# XXX macos fails to find getentropy with check_symbol_exists()
319check_function_exists(getentropy HAVE_GETENTROPY) 478check_function_exists(getentropy HAVE_GETENTROPY)
479if(APPLE AND NOT HAVE_MACOS_GETENTROPY)
480 # Weakly linked against the SDK, but absent at runtime before 10.12.
481 set(HAVE_GETENTROPY FALSE)
482endif()
320if(HAVE_GETENTROPY) 483if(HAVE_GETENTROPY)
321 add_definitions(-DHAVE_GETENTROPY) 484 add_definitions(-DHAVE_GETENTROPY)
322endif() 485endif()
@@ -331,6 +494,16 @@ if(HAVE_GETPROGNAME)
331 add_definitions(-DHAVE_GETPROGNAME) 494 add_definitions(-DHAVE_GETPROGNAME)
332endif() 495endif()
333 496
497check_symbol_exists(pledge "unistd.h" HAVE_PLEDGE)
498if(HAVE_PLEDGE)
499 add_definitions(-DHAVE_PLEDGE)
500endif()
501
502check_symbol_exists(unveil "unistd.h" HAVE_UNVEIL)
503if(HAVE_UNVEIL)
504 add_definitions(-DHAVE_UNVEIL)
505endif()
506
334check_symbol_exists(syslog_r "syslog.h;stdarg.h" HAVE_SYSLOG_R) 507check_symbol_exists(syslog_r "syslog.h;stdarg.h" HAVE_SYSLOG_R)
335if(HAVE_SYSLOG_R) 508if(HAVE_SYSLOG_R)
336 add_definitions(-DHAVE_SYSLOG_R) 509 add_definitions(-DHAVE_SYSLOG_R)
@@ -342,6 +515,11 @@ if(HAVE_SYSLOG)
342 add_definitions(-DHAVE_SYSLOG) 515 add_definitions(-DHAVE_SYSLOG)
343endif() 516endif()
344 517
518check_function_exists(vsyslog HAVE_VSYSLOG)
519if(HAVE_VSYSLOG)
520 add_definitions(-DHAVE_VSYSLOG)
521endif()
522
345check_symbol_exists(timespecsub sys/time.h HAVE_TIMESPECSUB) 523check_symbol_exists(timespecsub sys/time.h HAVE_TIMESPECSUB)
346if(HAVE_TIMESPECSUB) 524if(HAVE_TIMESPECSUB)
347 add_definitions(-DHAVE_TIMESPECSUB) 525 add_definitions(-DHAVE_TIMESPECSUB)
@@ -417,7 +595,7 @@ elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "arm")
417 if(APPLE) 595 if(APPLE)
418 set(ENABLE_ASM false) 596 set(ENABLE_ASM false)
419 endif() 597 endif()
420elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND CMAKE_SYSTEM_PROCESSOR MATCHES "i386") 598elseif(SOLARIS AND CMAKE_SYSTEM_PROCESSOR MATCHES "i386")
421 set(HOST_X86_64 true) 599 set(HOST_X86_64 true)
422elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|x64|amd64|AMD64)") 600elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "(x86_64|x64|amd64|AMD64)")
423 set(HOST_X86_64 true) 601 set(HOST_X86_64 true)
@@ -442,11 +620,104 @@ else()
442 set(ENABLE_ASM false) 620 set(ENABLE_ASM false)
443endif() 621endif()
444 622
623if(MSVC AND HOST_AARCH64 AND NOT CMAKE_CROSSCOMPILING AND
624 CMAKE_HOST_SYSTEM_PROCESSOR MATCHES "(aarch64|arm64|ARM64)")
625 set(BN_CT_TEST_SOURCE "${CMAKE_CURRENT_BINARY_DIR}/bn_ct_test.c")
626 file(WRITE "${BN_CT_TEST_SOURCE}" [=[
627#include <inttypes.h>
628#include <stdint.h>
629#include <stdio.h>
630
631typedef uint64_t BN_ULONG;
632
633#define BN_BITS2 64
634
635static __inline int
636bn_ct_ne_zero(BN_ULONG w)
637{
638 return (w | ~(w - 1)) >> (BN_BITS2 - 1);
639}
640
641static __inline void
642bn_addw(BN_ULONG a, BN_ULONG b, BN_ULONG *out_r1, BN_ULONG *out_r0)
643{
644 BN_ULONG c1, c2, r1, r0;
645
646 c1 = a | b;
647 c2 = a & b;
648 r0 = a + b;
649 r1 = ((c1 & ~r0) | c2) >> (BN_BITS2 - 1);
650
651 *out_r1 = r1;
652 *out_r0 = r0;
653}
654
655static __inline void
656bn_addw_addw(BN_ULONG a, BN_ULONG b, BN_ULONG c, BN_ULONG *out_r1,
657 BN_ULONG *out_r0)
658{
659 BN_ULONG carry, r1, r0;
660
661 bn_addw(a, b, &r1, &r0);
662 bn_addw(r0, c, &carry, &r0);
663 r1 += carry;
664
665 *out_r1 = r1;
666 *out_r0 = r0;
667}
668
669static BN_ULONG
670make_mask(BN_ULONG a, BN_ULONG b, BN_ULONG c, BN_ULONG borrow)
671{
672 BN_ULONG carry, ignored;
673
674 bn_addw_addw(a, b, c, &carry, &ignored);
675
676 return bn_ct_ne_zero(carry) - borrow;
677}
678
679static volatile BN_ULONG input_a = UINT64_MAX;
680static volatile BN_ULONG input_b = 1;
681static volatile BN_ULONG input_c = 0;
682static volatile BN_ULONG input_borrow = 0;
683
684int
685main(void)
686{
687 BN_ULONG actual, expected = 1;
688
689 actual = make_mask(input_a, input_b, input_c, input_borrow);
690 if (actual != expected) {
691 printf("FAIL: expected 0x%016" PRIx64 ", got 0x%016" PRIx64 "\n",
692 expected, actual);
693 return 1;
694 }
695
696 return 0;
697}
698]=])
699 set(BN_CT_SAVED_CONFIGURATION "${CMAKE_TRY_COMPILE_CONFIGURATION}")
700 set(CMAKE_TRY_COMPILE_CONFIGURATION Release)
701 try_run(BN_CT_RUN_RESULT BN_CT_COMPILED
702 "${CMAKE_CURRENT_BINARY_DIR}"
703 "${BN_CT_TEST_SOURCE}")
704 set(CMAKE_TRY_COMPILE_CONFIGURATION "${BN_CT_SAVED_CONFIGURATION}")
705 if(BN_CT_COMPILED AND BN_CT_RUN_RESULT EQUAL 0)
706 message(STATUS "MSVC ARM64 optimizer check passed; workaround disabled")
707 add_definitions(-DMSVC_ARM64_BN_CT_NE_ZERO_WORKS)
708 else()
709 message(STATUS "MSVC ARM64 optimizer check failed; workaround enabled "
710 "(compiled=${BN_CT_COMPILED}, result=${BN_CT_RUN_RESULT})")
711 endif()
712endif()
713
445if(ENABLE_ASM) 714if(ENABLE_ASM)
446 if(CMAKE_C_COMPILER_ABI STREQUAL "ELF") 715 if(CMAKE_C_COMPILER_ABI STREQUAL "ELF")
447 if(HOST_X86_64) 716 if(HOST_AARCH64)
717 set(HOST_ASM_ELF_AARCH64 true)
718 elseif(HOST_X86_64)
448 set(HOST_ASM_ELF_X86_64 true) 719 set(HOST_ASM_ELF_X86_64 true)
449 elseif(CMAKE_SYSTEM_NAME STREQUAL "SunOS" AND HOST_I386) 720 elseif(SOLARIS AND HOST_I386)
450 set(HOST_ASM_ELF_X86_64 true) 721 set(HOST_ASM_ELF_X86_64 true)
451 endif() 722 endif()
452 add_definitions(-DHAVE_GNU_STACK) 723 add_definitions(-DHAVE_GNU_STACK)
@@ -498,7 +769,7 @@ if(OPENSSLDIR STREQUAL "")
498 if(WIN32) 769 if(WIN32)
499 set(OPENSSLDIR "C:/Windows/libressl/ssl") 770 set(OPENSSLDIR "C:/Windows/libressl/ssl")
500 else() 771 else()
501 set(OPENSSLDIR "${CMAKE_INSTALL_SYSCONFDIR}/ssl") 772 set(OPENSSLDIR "${CMAKE_INSTALL_FULL_SYSCONFDIR}/ssl")
502 endif() 773 endif()
503 774
504 set(CONF_DIR "${CMAKE_INSTALL_SYSCONFDIR}/ssl") 775 set(CONF_DIR "${CMAKE_INSTALL_SYSCONFDIR}/ssl")
@@ -506,6 +777,10 @@ else()
506 set(CONF_DIR "${OPENSSLDIR}") 777 set(CONF_DIR "${OPENSSLDIR}")
507endif() 778endif()
508 779
780if(TLS_DEFAULT_CA_FILE STREQUAL "")
781 set(TLS_DEFAULT_CA_FILE "${OPENSSLDIR}/cert.pem")
782endif()
783
509add_subdirectory(include) 784add_subdirectory(include)
510add_subdirectory(crypto) 785add_subdirectory(crypto)
511add_subdirectory(ssl) 786add_subdirectory(ssl)
diff --git a/ChangeLog b/ChangeLog
index 6d5d860..8446188 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -30,6 +30,18 @@ LibreSSL Portable Release Notes:
30 30
314.4.0 - In Development 314.4.0 - In Development
32 32
33 * Internal improvements
34 - Minor code cleanup for PKCS#7.
35 - Clear unused bits for the maximum of RFC 3779 IP address ranges.
36 - Cleanup passes over the DTLS code, avoiding many contortions.
37 * Compatibility changes
38 * New features
39 * Bug fixes
40 - Fix PKCS7_set_{un,}signed_attributes() to allow caller to free
41 on failure rather than risking a double free.
42 * Testing and proactive security
43 - Improved test coverage for DTLS.
44
334.3.1 - Development Release 454.3.1 - Development Release
34 46
35 * Portable Changes 47 * Portable Changes
diff --git a/apps/nc/compat/accept4.c b/apps/nc/compat/accept4.c
index dca42e9..7818bc0 100644
--- a/apps/nc/compat/accept4.c
+++ b/apps/nc/compat/accept4.c
@@ -5,12 +5,18 @@ int
5accept4(int s, struct sockaddr *addr, socklen_t *addrlen, int flags) 5accept4(int s, struct sockaddr *addr, socklen_t *addrlen, int flags)
6{ 6{
7 int rets = accept(s, addr, addrlen); 7 int rets = accept(s, addr, addrlen);
8 int fl;
8 if (rets == -1) 9 if (rets == -1)
9 return rets; 10 return rets;
10 11
11 if (flags & SOCK_CLOEXEC) { 12 if (flags & SOCK_CLOEXEC) {
12 flags = fcntl(rets, F_GETFD); 13 fl = fcntl(rets, F_GETFD);
13 fcntl(rets, F_SETFD, flags | FD_CLOEXEC); 14 fcntl(rets, F_SETFD, fl | FD_CLOEXEC);
15 }
16
17 if (flags & SOCK_NONBLOCK) {
18 fl = fcntl(rets, F_GETFL);
19 fcntl(rets, F_SETFL, fl | O_NONBLOCK);
14 } 20 }
15 21
16 return rets; 22 return rets;
diff --git a/apps/nc/compat/readpassphrase.c b/apps/nc/compat/readpassphrase.c
index f3aa248..2a1e9ef 100644
--- a/apps/nc/compat/readpassphrase.c
+++ b/apps/nc/compat/readpassphrase.c
@@ -94,6 +94,8 @@ restart:
94 } 94 }
95 input = STDIN_FILENO; 95 input = STDIN_FILENO;
96 output = STDERR_FILENO; 96 output = STDERR_FILENO;
97 } else {
98 (void)fcntl(input, F_SETFD, FD_CLOEXEC);
97 } 99 }
98 100
99 /* 101 /*
diff --git a/apps/openssl/compat/poll_win.c b/apps/openssl/compat/poll_win.c
index 30f6b60..1e3021a 100644
--- a/apps/openssl/compat/poll_win.c
+++ b/apps/openssl/compat/poll_win.c
@@ -152,6 +152,9 @@ wsa_select_errno(int err)
152 case WSAENETDOWN: 152 case WSAENETDOWN:
153 errno = ENOMEM; 153 errno = ENOMEM;
154 break; 154 break;
155 default:
156 errno = EIO;
157 break;
155 } 158 }
156 return -1; 159 return -1;
157} 160}
@@ -166,6 +169,7 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms)
166 * select machinery 169 * select machinery
167 */ 170 */
168 fd_set rfds, wfds, efds; 171 fd_set rfds, wfds, efds;
172 fd_set rfds_in, wfds_in, efds_in;
169 int rc; 173 int rc;
170 int num_sockets; 174 int num_sockets;
171 175
@@ -249,15 +253,36 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms)
249 wait_rc = WAIT_FAILED; 253 wait_rc = WAIT_FAILED;
250 254
251 looptime_ms = (timeout_ms > 100 || timeout_ms == -1) ? 100 : timeout_ms; 255 looptime_ms = (timeout_ms > 100 || timeout_ms == -1) ? 100 : timeout_ms;
252 if (timeout_ms == -1) 256
253 timeout_ms = INFINITE; 257 /*
258 * select() clears every descriptor that is not ready from the
259 * fd_sets, so a pass that times out leaves them empty. Keep a
260 * pristine copy and restore it before each select(), otherwise the
261 * next pass hands select() three empty sets and Windows fails it with
262 * WSAEINVAL instead of waiting out the remaining timeout.
263 */
264 rfds_in = rfds;
265 wfds_in = wfds;
266 efds_in = efds;
254 267
255 do { 268 do {
256 TIMEVAL tv; 269 TIMEVAL tv;
270
271 /*
272 * Cap the wait at the time remaining so the final pass
273 * does not overshoot the requested timeout.
274 */
275 if (timeout_ms != -1 && timeout_ms - timespent_ms < looptime_ms)
276 looptime_ms = timeout_ms - timespent_ms;
277
257 tv.tv_sec = 0; 278 tv.tv_sec = 0;
258 tv.tv_usec = looptime_ms * 1000; 279 tv.tv_usec = looptime_ms * 1000;
259 int handle_signaled = 0; 280 int handle_signaled = 0;
260 281
282 rfds = rfds_in;
283 wfds = wfds_in;
284 efds = efds_in;
285
261 /* 286 /*
262 * Check if any file handles have signaled 287 * Check if any file handles have signaled
263 */ 288 */
@@ -280,7 +305,7 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms)
280 /* 305 /*
281 * If we signaled on a file handle, don't wait on the sockets. 306 * If we signaled on a file handle, don't wait on the sockets.
282 */ 307 */
283 if (wait_rc >= WAIT_OBJECT_0 && 308 if (num_handles && wait_rc >= WAIT_OBJECT_0 &&
284 (wait_rc <= WAIT_OBJECT_0 + num_handles - 1)) { 309 (wait_rc <= WAIT_OBJECT_0 + num_handles - 1)) {
285 tv.tv_usec = 0; 310 tv.tv_usec = 0;
286 handle_signaled = 1; 311 handle_signaled = 1;
@@ -298,7 +323,7 @@ poll(struct pollfd *pfds, nfds_t nfds, int timeout_ms)
298 323
299 timespent_ms += looptime_ms; 324 timespent_ms += looptime_ms;
300 325
301 } while (timespent_ms < timeout_ms); 326 } while (timeout_ms == -1 || timespent_ms < timeout_ms);
302 327
303 rc = 0; 328 rc = 0;
304 num_handles = 0; 329 num_handles = 0;
diff --git a/configure.ac b/configure.ac
index eb2b9ce..7c6ac98 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,11 +26,26 @@ m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
26 26
27# This must be saved before AC_PROG_CC 27# This must be saved before AC_PROG_CC
28USER_CFLAGS="$CFLAGS" 28USER_CFLAGS="$CFLAGS"
29USER_LDFLAGS="$LDFLAGS"
29 30
30AC_PROG_CC([cc gcc]) 31AC_PROG_CC([cc gcc])
31AM_PROG_CC_C_O 32AM_PROG_CC_C_O
32LT_INIT([pic-only]) 33LT_INIT([pic-only])
33 34
35AC_CHECK_PROGS([PERL], [perl perl5])
36AM_CONDITIONAL([HAVE_PERL], [test "x$PERL" != x])
37AC_CACHE_CHECK([for IO::Socket::SSL::Utils],
38 [ac_cv_perl_io_socket_ssl_utils],
39 [if test "x$PERL" = x; then
40 ac_cv_perl_io_socket_ssl_utils=no
41 elif "$PERL" -MIO::Socket::SSL::Utils -e 1 >/dev/null 2>&1; then
42 ac_cv_perl_io_socket_ssl_utils=yes
43 else
44 ac_cv_perl_io_socket_ssl_utils=no
45 fi])
46AM_CONDITIONAL([HAVE_PERL_IO_SOCKET_SSL_UTILS],
47 [test "x$ac_cv_perl_io_socket_ssl_utils" = xyes])
48
34CHECK_OS_OPTIONS 49CHECK_OS_OPTIONS
35 50
36CHECK_C_HARDENING_OPTIONS 51CHECK_C_HARDENING_OPTIONS
@@ -79,8 +94,8 @@ AS_CASE([$host_cpu],
79 [*arm*], [host_cpu=arm], 94 [*arm*], [host_cpu=arm],
80 [*amd64*], [host_cpu=x86_64 HOSTARCH=intel], 95 [*amd64*], [host_cpu=x86_64 HOSTARCH=intel],
81 [i?86], [host_cpu=i386 HOSTARCH=intel enable_asm=no], 96 [i?86], [host_cpu=i386 HOSTARCH=intel enable_asm=no],
82 [mips64*], [host_cpu=mips64 enable_asm=no], 97 [mips64*], [host_cpu=mips64 enable_asm=${enable_asm-no}],
83 [mips*], [host_cpu=mips enable_asm=no], 98 [mips*], [host_cpu=mips enable_asm=${enable_asm-no}],
84 [powerpc*], [host_cpu=powerpc], 99 [powerpc*], [host_cpu=powerpc],
85 [ppc64*], [host_cpu=powerpc64], 100 [ppc64*], [host_cpu=powerpc64],
86 [x86_64], [HOSTARCH=intel] 101 [x86_64], [HOSTARCH=intel]
@@ -121,6 +136,8 @@ AM_CONDITIONAL([HOST_ASM_ELF_MIPS],
121 [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "mips" -a "x$enable_asm" != "xno"]) 136 [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "mips" -a "x$enable_asm" != "xno"])
122AM_CONDITIONAL([HOST_ASM_ELF_MIPS64], 137AM_CONDITIONAL([HOST_ASM_ELF_MIPS64],
123 [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "mips64" -a "x$enable_asm" != "xno"]) 138 [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "mips64" -a "x$enable_asm" != "xno"])
139AM_CONDITIONAL([HOST_ASM_ELF_RISCV64],
140 [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "riscv64" -a "x$enable_asm" != "xno"])
124AM_CONDITIONAL([HOST_ASM_ELF_X86_64], 141AM_CONDITIONAL([HOST_ASM_ELF_X86_64],
125 [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "x86_64" -a "x$enable_asm" != "xno"]) 142 [test "x$HOST_ABI" = "xelf" -a "$host_cpu" = "x86_64" -a "x$enable_asm" != "xno"])
126AM_CONDITIONAL([HOST_ASM_MACOSX_X86_64], 143AM_CONDITIONAL([HOST_ASM_MACOSX_X86_64],
diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt
index d566182..0698ab4 100644
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -22,8 +22,9 @@ if(HOST_ASM_ELF_AARCH64)
22 ASM_AARCH64_ELF_SRC 22 ASM_AARCH64_ELF_SRC
23 sha/sha1_aarch64_ce.S 23 sha/sha1_aarch64_ce.S
24 sha/sha256_aarch64_ce.S 24 sha/sha256_aarch64_ce.S
25 sha/sha256_aarch64_ce.S 25 sha/sha512_aarch64_ce.S
26 ) 26 )
27 add_definitions(-DLIBRESSL_USE_SHA_ASSEMBLY)
27 set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_AARCH64_ELF_SRC}) 28 set(CRYPTO_SRC ${CRYPTO_SRC} ${ASM_AARCH64_ELF_SRC})
28endif() 29endif()
29 30
@@ -636,10 +637,6 @@ if(NOT HAVE_FREEZERO)
636 set(COMPAT_SRC ${COMPAT_SRC} compat/freezero.c) 637 set(COMPAT_SRC ${COMPAT_SRC} compat/freezero.c)
637endif() 638endif()
638 639
639if(NOT HAVE_FTRUNCATE)
640 set(COMPAT_SRC ${COMPAT_SRC} compat/ftruncate.c)
641endif()
642
643if(NOT HAVE_GETDELIM) 640if(NOT HAVE_GETDELIM)
644 set(COMPAT_SRC ${COMPAT_SRC} compat/getdelim.c) 641 set(COMPAT_SRC ${COMPAT_SRC} compat/getdelim.c)
645endif() 642endif()
diff --git a/crypto/Makefile.am b/crypto/Makefile.am
index f703e33..a4a717d 100644
--- a/crypto/Makefile.am
+++ b/crypto/Makefile.am
@@ -148,10 +148,6 @@ if !HAVE_FREEZERO
148libcompat_la_SOURCES += compat/freezero.c 148libcompat_la_SOURCES += compat/freezero.c
149endif 149endif
150 150
151if !HAVE_FTRUNCATE
152libcompat_la_SOURCES += compat/ftruncate.c
153endif
154
155if !HAVE_GETDELIM 151if !HAVE_GETDELIM
156libcompat_la_SOURCES += compat/getdelim.c 152libcompat_la_SOURCES += compat/getdelim.c
157endif 153endif
@@ -216,6 +212,7 @@ include Makefile.am.mingw64-x86_64
216if !HOST_ASM_ELF_AARCH64 212if !HOST_ASM_ELF_AARCH64
217if !HOST_ASM_ELF_MIPS 213if !HOST_ASM_ELF_MIPS
218if !HOST_ASM_ELF_MIPS64 214if !HOST_ASM_ELF_MIPS64
215if !HOST_ASM_ELF_RISCV64
219if !HOST_ASM_ELF_X86_64 216if !HOST_ASM_ELF_X86_64
220if !HOST_ASM_MACOSX_X86_64 217if !HOST_ASM_MACOSX_X86_64
221if !HOST_ASM_MASM_X86_64 218if !HOST_ASM_MASM_X86_64
@@ -228,6 +225,7 @@ endif
228endif 225endif
229endif 226endif
230endif 227endif
228endif
231 229
232if HOST_AARCH64 230if HOST_AARCH64
233if HOST_DARWIN 231if HOST_DARWIN
diff --git a/crypto/Makefile.am.elf-mips b/crypto/Makefile.am.elf-mips
index 2276991..682fb5e 100644
--- a/crypto/Makefile.am.elf-mips
+++ b/crypto/Makefile.am.elf-mips
@@ -2,7 +2,6 @@ ASM_MIPS_ELF = aes/aes-mips.S
2ASM_MIPS_ELF += bn/bn-mips.S 2ASM_MIPS_ELF += bn/bn-mips.S
3ASM_MIPS_ELF += bn/mont-mips.S 3ASM_MIPS_ELF += bn/mont-mips.S
4ASM_MIPS_ELF += sha/sha1-mips.S 4ASM_MIPS_ELF += sha/sha1-mips.S
5ASM_MIPS_ELF += sha/sha512-mips.S
6ASM_MIPS_ELF += sha/sha256-mips.S 5ASM_MIPS_ELF += sha/sha256-mips.S
7 6
8EXTRA_DIST += $(ASM_MIPS_ELF) 7EXTRA_DIST += $(ASM_MIPS_ELF)
diff --git a/crypto/Makefile.am.elf-mips64 b/crypto/Makefile.am.elf-mips64
index c6727b3..7269d6e 100644
--- a/crypto/Makefile.am.elf-mips64
+++ b/crypto/Makefile.am.elf-mips64
@@ -1,9 +1,9 @@
1ASM_MIPS64_ELF = aes/aes-mips.S 1ASM_MIPS64_ELF = aes/aes-mips64.S
2ASM_MIPS64_ELF += bn/bn-mips.S 2ASM_MIPS64_ELF += bn/bn-mips64.S
3ASM_MIPS64_ELF += bn/mont-mips.S 3ASM_MIPS64_ELF += bn/mont-mips64.S
4ASM_MIPS64_ELF += sha/sha1-mips.S 4ASM_MIPS64_ELF += sha/sha1-mips64.S
5ASM_MIPS64_ELF += sha/sha512-mips.S 5ASM_MIPS64_ELF += sha/sha512-mips64.S
6ASM_MIPS64_ELF += sha/sha256-mips.S 6ASM_MIPS64_ELF += sha/sha256-mips64.S
7 7
8EXTRA_DIST += $(ASM_MIPS64_ELF) 8EXTRA_DIST += $(ASM_MIPS64_ELF)
9 9
diff --git a/crypto/arch/mips/crypto_arch.h b/crypto/arch/mips/crypto_arch.h
index 274879c..2407503 100644
--- a/crypto/arch/mips/crypto_arch.h
+++ b/crypto/arch/mips/crypto_arch.h
@@ -18,4 +18,22 @@
18#ifndef HEADER_CRYPTO_ARCH_H 18#ifndef HEADER_CRYPTO_ARCH_H
19#define HEADER_CRYPTO_ARCH_H 19#define HEADER_CRYPTO_ARCH_H
20 20
21#ifndef OPENSSL_NO_ASM
22
23#ifdef LIBRESSL_USE_AES_ASSEMBLY
24#define HAVE_AES_SET_ENCRYPT_KEY_INTERNAL
25#define HAVE_AES_SET_DECRYPT_KEY_INTERNAL
26#define HAVE_AES_ENCRYPT_INTERNAL
27#define HAVE_AES_DECRYPT_INTERNAL
28#endif
29
30#ifdef LIBRESSL_USE_SHA_ASSEMBLY
31#define HAVE_SHA1_BLOCK_DATA_ORDER
32#define HAVE_SHA1_BLOCK_GENERIC
33#define HAVE_SHA256_BLOCK_DATA_ORDER
34#define HAVE_SHA256_BLOCK_GENERIC
35#endif
36
37#endif
38
21#endif 39#endif
diff --git a/crypto/bn/arch/mips/bn_arch.h b/crypto/bn/arch/mips/bn_arch.h
index 4d6571f..a14b83b 100644
--- a/crypto/bn/arch/mips/bn_arch.h
+++ b/crypto/bn/arch/mips/bn_arch.h
@@ -20,5 +20,24 @@
20 20
21#ifndef OPENSSL_NO_ASM 21#ifndef OPENSSL_NO_ASM
22 22
23#ifdef LIBRESSL_USE_BN_ASSEMBLY
24
25#define HAVE_BN_ADD_WORDS
26
27#define HAVE_BN_DIV_WORDS
28#define HAVE_BN_DIV_3_WORDS
29
30#define HAVE_BN_MUL_COMBA4
31#define HAVE_BN_MUL_COMBA8
32#define HAVE_BN_MULW_ADD_WORDS
33#define HAVE_BN_MULW_WORDS
34
35#define HAVE_BN_SQR_COMBA4
36#define HAVE_BN_SQR_COMBA8
37
38#define HAVE_BN_SUB_WORDS
39
40#endif
41
23#endif 42#endif
24#endif 43#endif
diff --git a/crypto/compat/ftruncate.c b/crypto/compat/ftruncate.c
deleted file mode 100644
index e825e50..0000000
--- a/crypto/compat/ftruncate.c
+++ /dev/null
@@ -1,17 +0,0 @@
1/*
2 * Public domain
3 *
4 * Kinichiro Inoguchi <inoguchi@openbsd.org>
5 */
6
7#ifdef _WIN32
8
9#include <unistd.h>
10
11int
12ftruncate(int fd, off_t length)
13{
14 return _chsize(fd, length);
15}
16
17#endif
diff --git a/crypto/compat/getdelim.c b/crypto/compat/getdelim.c
index caec3f2..bf4889f 100644
--- a/crypto/compat/getdelim.c
+++ b/crypto/compat/getdelim.c
@@ -27,6 +27,8 @@
27 * POSSIBILITY OF SUCH DAMAGE. 27 * POSSIBILITY OF SUCH DAMAGE.
28 */ 28 */
29 29
30#include <errno.h>
31#include <stdint.h>
30#include <stdio.h> 32#include <stdio.h>
31#include <stdlib.h> 33#include <stdlib.h>
32 34
@@ -35,13 +37,16 @@
35ssize_t 37ssize_t
36getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp) 38getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp)
37{ 39{
38 char *ptr, *eptr; 40 char *ptr, *eptr, *nbuf;
41 size_t nbufsiz;
39 42
40 43
41 if (*buf == NULL || *bufsiz == 0) { 44 if (*buf == NULL || *bufsiz < 2) {
42 *bufsiz = BUFSIZ; 45 nbufsiz = BUFSIZ;
43 if ((*buf = malloc(*bufsiz)) == NULL) 46 if ((nbuf = realloc(*buf, nbufsiz)) == NULL)
44 return -1; 47 return -1;
48 *buf = nbuf;
49 *bufsiz = nbufsiz;
45 } 50 }
46 51
47 for (ptr = *buf, eptr = *buf + *bufsiz;;) { 52 for (ptr = *buf, eptr = *buf + *bufsiz;;) {
@@ -62,9 +67,12 @@ getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp)
62 return ptr - *buf; 67 return ptr - *buf;
63 } 68 }
64 if (ptr + 2 >= eptr) { 69 if (ptr + 2 >= eptr) {
65 char *nbuf;
66 size_t nbufsiz = *bufsiz * 2;
67 ssize_t d = ptr - *buf; 70 ssize_t d = ptr - *buf;
71 if (*bufsiz > SIZE_MAX / 2) {
72 errno = EOVERFLOW;
73 return -1;
74 }
75 nbufsiz = *bufsiz * 2;
68 if ((nbuf = realloc(*buf, nbufsiz)) == NULL) 76 if ((nbuf = realloc(*buf, nbufsiz)) == NULL)
69 return -1; 77 return -1;
70 *buf = nbuf; 78 *buf = nbuf;
diff --git a/crypto/compat/getprogname_windows.c b/crypto/compat/getprogname_windows.c
index eb04ec0..9de3cab 100644
--- a/crypto/compat/getprogname_windows.c
+++ b/crypto/compat/getprogname_windows.c
@@ -7,7 +7,8 @@ getprogname(void)
7{ 7{
8 static char progname[MAX_PATH + 1]; 8 static char progname[MAX_PATH + 1];
9 DWORD length = GetModuleFileName(NULL, progname, sizeof (progname) - 1); 9 DWORD length = GetModuleFileName(NULL, progname, sizeof (progname) - 1);
10 if (length < 0) 10 if (length == 0)
11 return "?"; 11 return "?";
12 progname[length] = '\0';
12 return progname; 13 return progname;
13} 14}
diff --git a/crypto/compat/posix_win.c b/crypto/compat/posix_win.c
index bc0fa36..60b2896 100644
--- a/crypto/compat/posix_win.c
+++ b/crypto/compat/posix_win.c
@@ -68,6 +68,14 @@ libressl_fstat(int fd, struct stat *statbuf)
68 return fstat(get_real_fd(fd), statbuf); 68 return fstat(get_real_fd(fd), statbuf);
69} 69}
70 70
71#ifndef HAVE_FTRUNCATE
72int
73ftruncate(int fd, off_t length)
74{
75 return _chsize(get_real_fd(fd), length);
76}
77#endif
78
71int 79int
72posix_open(const char *path, ...) 80posix_open(const char *path, ...)
73{ 81{
@@ -178,6 +186,9 @@ wsa_errno(int err)
178 case WSAETIMEDOUT: 186 case WSAETIMEDOUT:
179 errno = EPIPE; 187 errno = EPIPE;
180 break; 188 break;
189 default:
190 errno = EIO;
191 break;
181 } 192 }
182 return -1; 193 return -1;
183} 194}
diff --git a/crypto/compat/syslog_r.c b/crypto/compat/syslog_r.c
index d68169d..30841c1 100644
--- a/crypto/compat/syslog_r.c
+++ b/crypto/compat/syslog_r.c
@@ -1,3 +1,5 @@
1#include <stdio.h>
2#include <stdlib.h>
1#include <syslog.h> 3#include <syslog.h>
2 4
3void 5void
@@ -14,6 +16,15 @@ void
14vsyslog_r(int pri, struct syslog_data *data, const char *fmt, va_list ap) 16vsyslog_r(int pri, struct syslog_data *data, const char *fmt, va_list ap)
15{ 17{
16#ifdef HAVE_SYSLOG 18#ifdef HAVE_SYSLOG
19#ifdef HAVE_VSYSLOG
17 vsyslog(pri, fmt, ap); 20 vsyslog(pri, fmt, ap);
21#else
22 char *msg = NULL;
23
24 if (vasprintf(&msg, fmt, ap) == -1)
25 return;
26 syslog(pri, "%s", msg);
27 free(msg);
28#endif
18#endif 29#endif
19} 30}
diff --git a/include/compat/dirent_msvc.h b/include/compat/dirent_msvc.h
index 67f295f..2689399 100644
--- a/include/compat/dirent_msvc.h
+++ b/include/compat/dirent_msvc.h
@@ -47,6 +47,7 @@
47 47
48#include <stdarg.h> 48#include <stdarg.h>
49#include <sys/stat.h> 49#include <sys/stat.h>
50#include <stdint.h>
50 51
51/* Indicates that d_type field is available in dirent structure */ 52/* Indicates that d_type field is available in dirent structure */
52#define _DIRENT_HAVE_D_TYPE 53#define _DIRENT_HAVE_D_TYPE
@@ -154,7 +155,7 @@ _wopendir(const wchar_t *dirname)
154 /* Allocate new _WDIR structure */ 155 /* Allocate new _WDIR structure */
155 dirp =(_WDIR*) malloc(sizeof(struct _WDIR)); 156 dirp =(_WDIR*) malloc(sizeof(struct _WDIR));
156 if (dirp != NULL) { 157 if (dirp != NULL) {
157 DWORD n; 158 DWORD n, len;
158 159
159 /* Reset _WDIR structure */ 160 /* Reset _WDIR structure */
160 dirp->handle = INVALID_HANDLE_VALUE; 161 dirp->handle = INVALID_HANDLE_VALUE;
@@ -165,7 +166,8 @@ _wopendir(const wchar_t *dirname)
165 n = GetFullPathNameW(dirname, 0, NULL, NULL); 166 n = GetFullPathNameW(dirname, 0, NULL, NULL);
166 167
167 /* Allocate room for absolute directory name and search pattern */ 168 /* Allocate room for absolute directory name and search pattern */
168 dirp->patt =(wchar_t*) malloc(sizeof(wchar_t) * n + 16); 169 if (n <= (SIZE_MAX - 16) / sizeof(wchar_t))
170 dirp->patt =(wchar_t*) malloc(sizeof(wchar_t) * n + 16);
169 if (dirp->patt) { 171 if (dirp->patt) {
170 172
171 /* 173 /*
@@ -173,12 +175,12 @@ _wopendir(const wchar_t *dirname)
173 * allows rewinddir() to function correctly even when current 175 * allows rewinddir() to function correctly even when current
174 * working directory is changed between opendir() and rewinddir(). 176 * working directory is changed between opendir() and rewinddir().
175 */ 177 */
176 n = GetFullPathNameW(dirname, n, dirp->patt, NULL); 178 len = GetFullPathNameW(dirname, n, dirp->patt, NULL);
177 if (n > 0) { 179 if (len > 0 && len < n) {
178 wchar_t *p; 180 wchar_t *p;
179 181
180 /* Append search pattern \* to the directory name */ 182 /* Append search pattern \* to the directory name */
181 p = dirp->patt + n; 183 p = dirp->patt + len;
182 if (dirp->patt < p) { 184 if (dirp->patt < p) {
183 switch(p[-1]) { 185 switch(p[-1]) {
184 case '\\': 186 case '\\':
@@ -214,6 +216,7 @@ _wopendir(const wchar_t *dirname)
214 216
215 } else { 217 } else {
216 /* Cannot allocate memory for search pattern */ 218 /* Cannot allocate memory for search pattern */
219 _set_errno(ENOMEM);
217 error = 1; 220 error = 1;
218 } 221 }
219 222
diff --git a/include/compat/endian.h b/include/compat/endian.h
index 89c83fc..8022e0e 100644
--- a/include/compat/endian.h
+++ b/include/compat/endian.h
@@ -182,15 +182,15 @@ static inline uint64_t htole64(uint64_t x) {
182 uint64_t u64; 182 uint64_t u64;
183 unsigned char bytes[8]; 183 unsigned char bytes[8];
184 } val; 184 } val;
185 val.u64 = x; 185 val.bytes[0] = (unsigned char)x;
186 return ((uint64_t)val.bytes[0] << 56) | 186 val.bytes[1] = (unsigned char)(x >> 8);
187 ((uint64_t)val.bytes[1] << 48) | 187 val.bytes[2] = (unsigned char)(x >> 16);
188 ((uint64_t)val.bytes[2] << 40) | 188 val.bytes[3] = (unsigned char)(x >> 24);
189 ((uint64_t)val.bytes[3] << 32) | 189 val.bytes[4] = (unsigned char)(x >> 32);
190 ((uint64_t)val.bytes[4] << 24) | 190 val.bytes[5] = (unsigned char)(x >> 40);
191 ((uint64_t)val.bytes[5] << 16) | 191 val.bytes[6] = (unsigned char)(x >> 48);
192 ((uint64_t)val.bytes[6] << 8) | 192 val.bytes[7] = (unsigned char)(x >> 56);
193 (uint64_t)val.bytes[7]; 193 return val.u64;
194#endif 194#endif
195} 195}
196 196
diff --git a/include/compat/pthread.h b/include/compat/pthread.h
index 8211dda..7702dcd 100644
--- a/include/compat/pthread.h
+++ b/include/compat/pthread.h
@@ -110,8 +110,11 @@ pthread_mutex_unlock(pthread_mutex_t *mutex)
110static inline int 110static inline int
111pthread_mutex_destroy(pthread_mutex_t *mutex) 111pthread_mutex_destroy(pthread_mutex_t *mutex)
112{ 112{
113 DeleteCriticalSection(mutex->lock); 113 if (mutex->lock != NULL) {
114 free(mutex->lock); 114 DeleteCriticalSection(mutex->lock);
115 free(mutex->lock);
116 mutex->lock = NULL;
117 }
115 return 0; 118 return 0;
116} 119}
117 120
diff --git a/include/compat/stdio.h b/include/compat/stdio.h
index 2ccdeeb..d9b8725 100644
--- a/include/compat/stdio.h
+++ b/include/compat/stdio.h
@@ -57,7 +57,25 @@ int posix_rename(const char *oldpath, const char *newpath);
57#endif 57#endif
58 58
59#if defined(_MSC_VER) && _MSC_VER < 1900 59#if defined(_MSC_VER) && _MSC_VER < 1900
60#define snprintf _snprintf 60#include <stdarg.h>
61
62static inline int
63libressl_snprintf(char *str, size_t size, const char *format, ...)
64{
65 va_list ap;
66 int ret;
67
68 va_start(ap, format);
69 ret = _vsnprintf(str, size, format, ap);
70 va_end(ap);
71
72 /* _vsnprintf does not NUL-terminate when the output is truncated. */
73 if (size != 0)
74 str[size - 1] = '\0';
75
76 return ret;
77}
78#define snprintf libressl_snprintf
61#endif 79#endif
62 80
63#endif 81#endif
diff --git a/include/compat/syslog.h b/include/compat/syslog.h
index 3528eb3..c7a2608 100644
--- a/include/compat/syslog.h
+++ b/include/compat/syslog.h
@@ -36,23 +36,3 @@ void vsyslog_r(int, struct syslog_data *, const char *, va_list);
36#endif 36#endif
37 37
38#endif 38#endif
39
40#ifdef _AIX
41#ifdef HAVE_SYSLOG
42#include <stdlib.h>
43void vsyslog(int facility_priority, const char *format, va_list arglist) {
44 char *msg = NULL;
45 vasprintf(&msg, format, arglist);
46
47 if (!msg)
48 return;
49
50 syslog(facility_priority, "%s", msg);
51 free(msg);
52}
53#endif /* HAVE_SYSLOG */
54
55void vsyslog_r(int pri, struct syslog_data *data, const char *fmt, va_list ap) {
56 vsyslog(pri, fmt, ap);
57}
58#endif /* AIX */
diff --git a/include/compat/unistd.h b/include/compat/unistd.h
index 544cb27..0ce66dd 100644
--- a/include/compat/unistd.h
+++ b/include/compat/unistd.h
@@ -75,8 +75,13 @@ int getentropy(void *buf, size_t buflen);
75int getpagesize(void); 75int getpagesize(void);
76#endif 76#endif
77 77
78#ifndef HAVE_PLEDGE
78#define pledge(request, paths) 0 79#define pledge(request, paths) 0
80#endif
81
82#ifndef HAVE_UNVEIL
79#define unveil(path, permissions) 0 83#define unveil(path, permissions) 0
84#endif
80 85
81#ifndef HAVE_PIPE2 86#ifndef HAVE_PIPE2
82int pipe2(int fildes[2], int flags); 87int pipe2(int fildes[2], int flags);
diff --git a/m4/check-hardening-options.m4 b/m4/check-hardening-options.m4
index 2cb3083..401b7e4 100644
--- a/m4/check-hardening-options.m4
+++ b/m4/check-hardening-options.m4
@@ -3,7 +3,7 @@ AC_DEFUN([CHECK_CFLAG], [
3 AC_LANG_ASSERT(C) 3 AC_LANG_ASSERT(C)
4 AC_MSG_CHECKING([if $saved_CC supports "$1"]) 4 AC_MSG_CHECKING([if $saved_CC supports "$1"])
5 old_cflags="$CFLAGS" 5 old_cflags="$CFLAGS"
6 CFLAGS="$1 -Wall -Werror" 6 CFLAGS="$USER_CFLAGS $1 -Wall -Werror"
7 AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>]], [[printf("Hello")]])], 7 AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>]], [[printf("Hello")]])],
8 [AC_MSG_RESULT([yes]) 8 [AC_MSG_RESULT([yes])
9 CFLAGS=$old_cflags 9 CFLAGS=$old_cflags
@@ -17,7 +17,7 @@ AC_DEFUN([CHECK_LDFLAG], [
17 AC_LANG_ASSERT(C) 17 AC_LANG_ASSERT(C)
18 AC_MSG_CHECKING([if $saved_LD supports "$1"]) 18 AC_MSG_CHECKING([if $saved_LD supports "$1"])
19 old_ldflags="$LDFLAGS" 19 old_ldflags="$LDFLAGS"
20 LDFLAGS="$1 -Wall -Werror" 20 LDFLAGS="$USER_LDFLAGS $1 -Wall -Werror"
21 AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>]], [[printf("Hello")]])], 21 AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>]], [[printf("Hello")]])],
22 [AC_MSG_RESULT([yes]) 22 [AC_MSG_RESULT([yes])
23 LDFLAGS=$old_ldflags 23 LDFLAGS=$old_ldflags
diff --git a/m4/check-libc.m4 b/m4/check-libc.m4
index eec3cb3..7ac1a10 100644
--- a/m4/check-libc.m4
+++ b/m4/check-libc.m4
@@ -26,7 +26,7 @@ AC_CHECK_FUNCS([asprintf freezero ftruncate getdelim getline memmem])
26AC_CHECK_FUNCS([readpassphrase reallocarray recallocarray]) 26AC_CHECK_FUNCS([readpassphrase reallocarray recallocarray])
27AC_CHECK_FUNCS([strcasecmp strlcat strlcpy strndup strnlen strsep strtonum]) 27AC_CHECK_FUNCS([strcasecmp strlcat strlcpy strndup strnlen strsep strtonum])
28AC_CHECK_FUNCS([timegm _mkgmtime timespecsub]) 28AC_CHECK_FUNCS([timegm _mkgmtime timespecsub])
29AC_CHECK_FUNCS([getopt getprogname syslog syslog_r]) 29AC_CHECK_FUNCS([getopt getprogname syslog syslog_r vsyslog])
30AC_CACHE_CHECK([for getpagesize], ac_cv_func_getpagesize, [ 30AC_CACHE_CHECK([for getpagesize], ac_cv_func_getpagesize, [
31 AC_LINK_IFELSE([AC_LANG_PROGRAM([[ 31 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
32#include <unistd.h> 32#include <unistd.h>
@@ -39,7 +39,6 @@ AC_CACHE_CHECK([for getpagesize], ac_cv_func_getpagesize, [
39]) 39])
40AM_CONDITIONAL([HAVE_ASPRINTF], [test "x$ac_cv_func_asprintf" = xyes]) 40AM_CONDITIONAL([HAVE_ASPRINTF], [test "x$ac_cv_func_asprintf" = xyes])
41AM_CONDITIONAL([HAVE_FREEZERO], [test "x$ac_cv_func_freezero" = xyes]) 41AM_CONDITIONAL([HAVE_FREEZERO], [test "x$ac_cv_func_freezero" = xyes])
42AM_CONDITIONAL([HAVE_FTRUNCATE], [test "x$ac_cv_func_ftruncate" = xyes])
43AM_CONDITIONAL([HAVE_GETDELIM], [test "x$ac_cv_func_getdelim" = xyes]) 42AM_CONDITIONAL([HAVE_GETDELIM], [test "x$ac_cv_func_getdelim" = xyes])
44AM_CONDITIONAL([HAVE_GETLINE], [test "x$ac_cv_func_getline" = xyes]) 43AM_CONDITIONAL([HAVE_GETLINE], [test "x$ac_cv_func_getline" = xyes])
45AM_CONDITIONAL([HAVE_GETPAGESIZE], [test "x$ac_cv_func_getpagesize" = xyes]) 44AM_CONDITIONAL([HAVE_GETPAGESIZE], [test "x$ac_cv_func_getpagesize" = xyes])
@@ -61,7 +60,7 @@ AM_CONDITIONAL([HAVE_SYSLOG_R], [test "x$ac_cv_func_syslog_r" = xyes])
61]) 60])
62 61
63AC_DEFUN([CHECK_SYSCALL_COMPAT], [ 62AC_DEFUN([CHECK_SYSCALL_COMPAT], [
64AC_CHECK_FUNCS([accept4 pipe2 pledge poll socketpair]) 63AC_CHECK_FUNCS([accept4 pipe2 pledge poll socketpair unveil])
65AM_CONDITIONAL([HAVE_ACCEPT4], [test "x$ac_cv_func_accept4" = xyes]) 64AM_CONDITIONAL([HAVE_ACCEPT4], [test "x$ac_cv_func_accept4" = xyes])
66AM_CONDITIONAL([HAVE_PIPE2], [test "x$ac_cv_func_pipe2" = xyes]) 65AM_CONDITIONAL([HAVE_PIPE2], [test "x$ac_cv_func_pipe2" = xyes])
67AM_CONDITIONAL([HAVE_PLEDGE], [test "x$ac_cv_func_pledge" = xyes]) 66AM_CONDITIONAL([HAVE_PLEDGE], [test "x$ac_cv_func_pledge" = xyes])
diff --git a/man/links b/man/links
index 8af5588..d08694b 100644
--- a/man/links
+++ b/man/links
@@ -520,6 +520,7 @@ CRYPTO_lock.3,CRYPTO_w_unlock.3
520CRYPTO_set_ex_data.3,CRYPTO_EX_dup.3 520CRYPTO_set_ex_data.3,CRYPTO_EX_dup.3
521CRYPTO_set_ex_data.3,CRYPTO_EX_free.3 521CRYPTO_set_ex_data.3,CRYPTO_EX_free.3
522CRYPTO_set_ex_data.3,CRYPTO_EX_new.3 522CRYPTO_set_ex_data.3,CRYPTO_EX_new.3
523CRYPTO_set_ex_data.3,CRYPTO_cleanup_all_ex_data.3
523CRYPTO_set_ex_data.3,CRYPTO_free_ex_data.3 524CRYPTO_set_ex_data.3,CRYPTO_free_ex_data.3
524CRYPTO_set_ex_data.3,CRYPTO_get_ex_data.3 525CRYPTO_set_ex_data.3,CRYPTO_get_ex_data.3
525CRYPTO_set_ex_data.3,CRYPTO_get_ex_new_index.3 526CRYPTO_set_ex_data.3,CRYPTO_get_ex_new_index.3
@@ -1174,7 +1175,6 @@ MD5.3,MD5_Update.3
1174NAME_CONSTRAINTS_new.3,GENERAL_SUBTREE_free.3 1175NAME_CONSTRAINTS_new.3,GENERAL_SUBTREE_free.3
1175NAME_CONSTRAINTS_new.3,GENERAL_SUBTREE_new.3 1176NAME_CONSTRAINTS_new.3,GENERAL_SUBTREE_new.3
1176NAME_CONSTRAINTS_new.3,NAME_CONSTRAINTS_free.3 1177NAME_CONSTRAINTS_new.3,NAME_CONSTRAINTS_free.3
1177OBJ_create.3,OBJ_add_object.3
1178OBJ_create.3,OBJ_cleanup.3 1178OBJ_create.3,OBJ_cleanup.3
1179OBJ_create.3,OBJ_create_objects.3 1179OBJ_create.3,OBJ_create_objects.3
1180OBJ_create.3,OBJ_new_nid.3 1180OBJ_create.3,OBJ_new_nid.3
@@ -1257,6 +1257,7 @@ OPENSSL_VERSION_NUMBER.3,OpenSSL_version_num.3
1257OPENSSL_VERSION_NUMBER.3,SSLeay.3 1257OPENSSL_VERSION_NUMBER.3,SSLeay.3
1258OPENSSL_VERSION_NUMBER.3,SSLeay_version.3 1258OPENSSL_VERSION_NUMBER.3,SSLeay_version.3
1259OPENSSL_config.3,OPENSSL_no_config.3 1259OPENSSL_config.3,OPENSSL_no_config.3
1260OPENSSL_init_crypto.3,OPENSSL_cleanup.3
1260OPENSSL_init_crypto.3,OPENSSL_init.3 1261OPENSSL_init_crypto.3,OPENSSL_init.3
1261OPENSSL_malloc.3,CRYPTO_free.3 1262OPENSSL_malloc.3,CRYPTO_free.3
1262OPENSSL_malloc.3,CRYPTO_malloc.3 1263OPENSSL_malloc.3,CRYPTO_malloc.3
diff --git a/patches/netcat.c.patch b/patches/netcat.c.patch
index 0383034..216debc 100644
--- a/patches/netcat.c.patch
+++ b/patches/netcat.c.patch
@@ -131,7 +131,7 @@
131 } 131 }
132 if (Iflag) { 132 if (Iflag) {
133 if (setsockopt(s, SOL_SOCKET, SO_RCVBUF, 133 if (setsockopt(s, SOL_SOCKET, SO_RCVBUF,
134@@ -1612,13 +1641,17 @@ set_common_sockopts(int s, int af) 134@@ -1612,13 +1641,23 @@ set_common_sockopts(int s, int af)
135 } 135 }
136 136
137 if (minttl != -1) { 137 if (minttl != -1) {
@@ -139,6 +139,9 @@
139 if (af == AF_INET && setsockopt(s, IPPROTO_IP, 139 if (af == AF_INET && setsockopt(s, IPPROTO_IP,
140 IP_MINTTL, &minttl, sizeof(minttl))) 140 IP_MINTTL, &minttl, sizeof(minttl)))
141 err(1, "set IP min TTL"); 141 err(1, "set IP min TTL");
142+#else
143+ if (af == AF_INET)
144+ errx(1, "set IP min TTL not supported");
142+#endif 145+#endif
143 146
144- else if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6, 147- else if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6,
@@ -146,11 +149,14 @@
146+ if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6, 149+ if (af == AF_INET6 && setsockopt(s, IPPROTO_IPV6,
147 IPV6_MINHOPCOUNT, &minttl, sizeof(minttl))) 150 IPV6_MINHOPCOUNT, &minttl, sizeof(minttl)))
148 err(1, "set IPv6 min hop count"); 151 err(1, "set IPv6 min hop count");
152+#else
153+ if (af == AF_INET6)
154+ errx(1, "set IPv6 min hop count not supported");
149+#endif 155+#endif
150 } 156 }
151 } 157 }
152 158
153@@ -1849,15 +1882,19 @@ help(void) 159@@ -1849,15 +1888,19 @@ help(void)
154 \t-P proxyuser\tUsername for proxy authentication\n\ 160 \t-P proxyuser\tUsername for proxy authentication\n\
155 \t-p port\t Specify local port for remote connects\n\ 161 \t-p port\t Specify local port for remote connects\n\
156 \t-R CAfile CA bundle\n\ 162 \t-R CAfile CA bundle\n\
diff --git a/patches/speed.c.patch b/patches/speed.c.patch
index 8e79f5c..4efc65c 100644
--- a/patches/speed.c.patch
+++ b/patches/speed.c.patch
@@ -1,9 +1,9 @@
1--- apps/openssl/speed.c.orig 2026-04-12 11:09:28 1--- apps/openssl/speed.c.orig 2026-05-05 10:50:46
2+++ apps/openssl/speed.c 2026-04-12 11:11:18 2+++ apps/openssl/speed.c 2026-05-05 10:51:24
3@@ -156,7 +156,16 @@ static void print_result(int alg, int run_no, int coun 3@@ -158,7 +158,16 @@ static double speed_timer_stop(int s);
4 pkey_print_message(const char *str, const char *str2,
5 int bits, int sec);
6 static void print_result(int alg, int run_no, int count, double time_used); 4 static void print_result(int alg, int run_no, int count, double time_used);
5 static void speed_timer_start(int s);
6 static double speed_timer_stop(int s);
7+#ifndef _WIN32 7+#ifndef _WIN32
8 static int do_multi(int multi); 8 static int do_multi(int multi);
9+#else 9+#else
@@ -17,7 +17,23 @@
17 17
18 #define SIZE_NUM 5 18 #define SIZE_NUM 5
19 #define MAX_ECDH_SIZE 256 19 #define MAX_ECDH_SIZE 256
20@@ -1110,8 +1119,10 @@ speed_main(int argc, char **argv) 20@@ -1005,7 +1014,15 @@ speed_timer_stop(int s)
21 static double
22 speed_timer_stop(int s)
23 {
24+#ifndef _WIN32
25 return time_f(s);
26+#else
27+ double elapsed;
28+
29+ elapsed = time_f(s);
30+ speed_alarm_free(run);
31+ return elapsed;
32+#endif
33 }
34
35 static const int KDF1_SHA1_len = 20;
36@@ -1123,8 +1140,10 @@ speed_main(int argc, char **argv)
21 const EVP_CIPHER *evp_cipher = NULL; 37 const EVP_CIPHER *evp_cipher = NULL;
22 const EVP_MD *evp_md = NULL; 38 const EVP_MD *evp_md = NULL;
23 int decrypt = 0; 39 int decrypt = 0;
@@ -28,7 +44,7 @@
28 const char *errstr = NULL; 44 const char *errstr = NULL;
29 45
30 if (pledge("stdio proc", NULL) == -1) { 46 if (pledge("stdio proc", NULL) == -1) {
31@@ -1187,6 +1198,7 @@ speed_main(int argc, char **argv) 47@@ -1200,6 +1219,7 @@ speed_main(int argc, char **argv)
32 decrypt = 1; 48 decrypt = 1;
33 j--; /* Otherwise, -decrypt gets confused with an 49 j--; /* Otherwise, -decrypt gets confused with an
34 * algorithm. */ 50 * algorithm. */
@@ -36,7 +52,7 @@
36 } else if (argc > 0 && strcmp(*argv, "-multi") == 0) { 52 } else if (argc > 0 && strcmp(*argv, "-multi") == 0) {
37 argc--; 53 argc--;
38 argv++; 54 argv++;
39@@ -1201,6 +1213,7 @@ speed_main(int argc, char **argv) 55@@ -1214,6 +1234,7 @@ speed_main(int argc, char **argv)
40 } 56 }
41 j--; /* Otherwise, -multi gets confused with an 57 j--; /* Otherwise, -multi gets confused with an
42 * algorithm. */ 58 * algorithm. */
@@ -44,7 +60,7 @@
44 } else if (argc > 0 && strcmp(*argv, "-unaligned") == 0) { 60 } else if (argc > 0 && strcmp(*argv, "-unaligned") == 0) {
45 argc--; 61 argc--;
46 argv++; 62 argv++;
47@@ -1524,7 +1537,9 @@ speed_main(int argc, char **argv) 63@@ -1537,7 +1558,9 @@ speed_main(int argc, char **argv)
48 BIO_printf(bio_err, "-evp e use EVP e.\n"); 64 BIO_printf(bio_err, "-evp e use EVP e.\n");
49 BIO_printf(bio_err, "-decrypt time decryption instead of encryption (only EVP).\n"); 65 BIO_printf(bio_err, "-decrypt time decryption instead of encryption (only EVP).\n");
50 BIO_printf(bio_err, "-mr produce machine readable output.\n"); 66 BIO_printf(bio_err, "-mr produce machine readable output.\n");
@@ -54,7 +70,7 @@
54 BIO_printf(bio_err, "-unaligned n use buffers with offset n from proper alignment.\n"); 70 BIO_printf(bio_err, "-unaligned n use buffers with offset n from proper alignment.\n");
55 goto end; 71 goto end;
56 } 72 }
57@@ -1533,8 +1548,10 @@ speed_main(int argc, char **argv) 73@@ -1546,8 +1569,10 @@ speed_main(int argc, char **argv)
58 j++; 74 j++;
59 } 75 }
60 76
@@ -65,7 +81,7 @@
65 81
66 if (j == 0) { 82 if (j == 0) {
67 for (i = 0; i < ALGOR_NUM; i++) { 83 for (i = 0; i < ALGOR_NUM; i++) {
68@@ -1607,11 +1624,15 @@ speed_main(int argc, char **argv) 84@@ -1620,11 +1645,15 @@ speed_main(int argc, char **argv)
69 #define COND (run && count<0x7fffffff) 85 #define COND (run && count<0x7fffffff)
70 #define COUNT(d) (count) 86 #define COUNT(d) (count)
71 87
@@ -81,7 +97,7 @@
81 97
82 #ifndef OPENSSL_NO_MD4 98 #ifndef OPENSSL_NO_MD4
83 if (doit[D_MD4]) { 99 if (doit[D_MD4]) {
84@@ -2513,7 +2534,9 @@ speed_main(int argc, char **argv) 100@@ -2526,7 +2555,9 @@ speed_main(int argc, char **argv)
85 free(ss); 101 free(ss);
86 } 102 }
87 103
@@ -91,15 +107,7 @@
91 if (!mr) { 107 if (!mr) {
92 fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION)); 108 fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION));
93 fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON)); 109 fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON));
94@@ -2695,11 +2718,15 @@ print_result(int alg, int run_no, int count, double ti 110@@ -2711,6 +2742,7 @@ print_result(int alg, int run_no, int count, double ti
95 static void
96 print_result(int alg, int run_no, int count, double time_used)
97 {
98+#ifdef _WIN32
99+ speed_alarm_free(run);
100+#endif
101 BIO_printf(bio_err, mr ? "+R:%d:%s:%f\n"
102 : "%d %s in %.2fs\n", count, names[alg], time_used);
103 results[alg][run_no] = ((double) count) / time_used * lengths[run_no]; 111 results[alg][run_no] = ((double) count) / time_used * lengths[run_no];
104 } 112 }
105 113
@@ -107,7 +115,7 @@
107 static char * 115 static char *
108 sstrsep(char **string, const char *delim) 116 sstrsep(char **string, const char *delim)
109 { 117 {
110@@ -2900,5 +2927,6 @@ do_multi(int multi) 118@@ -2911,5 +2943,6 @@ do_multi(int multi)
111 free(fds); 119 free(fds);
112 return 1; 120 return 1;
113 } 121 }
diff --git a/patches/win32_arm64_bn_arch.h.patch b/patches/win32_arm64_bn_arch.h.patch
new file mode 100644
index 0000000..c8071a8
--- /dev/null
+++ b/patches/win32_arm64_bn_arch.h.patch
@@ -0,0 +1,23 @@
1--- crypto/bn/arch/aarch64/bn_arch.h.orig
2+++ crypto/bn/arch/aarch64/bn_arch.h
3@@ -20,4 +20,19 @@
4 #ifndef HEADER_BN_ARCH_H
5 #define HEADER_BN_ARCH_H
6-
7+/* See pull/1355. */
8+#if defined(_MSC_VER) && defined(_M_ARM64) && \
9+ !defined(MSVC_ARM64_BN_CT_NE_ZERO_WORKS)
10+
11+#include <intrin.h>
12+
13+#define HAVE_BN_CT_NE_ZERO
14+
15+static inline int
16+bn_ct_ne_zero(BN_ULONG w)
17+{
18+ return 1U ^ (_CountLeadingZeros64((unsigned __int64)w) >> 6);
19+}
20+
21+#endif
22+
23 #ifndef OPENSSL_NO_ASM
diff --git a/scripts/test b/scripts/test
index 2148d52..b3386a8 100755
--- a/scripts/test
+++ b/scripts/test
@@ -11,6 +11,7 @@ if [ "$ARCH" = "mingw32" -o "$ARCH" = "mingw64" -o "$ARCH" = "arm32" ]; then
11fi 11fi
12 12
13ENABLE_ASM="${ENABLE_ASM:=ON}" 13ENABLE_ASM="${ENABLE_ASM:=ON}"
14export CTEST_PARALLEL_LEVEL="${CTEST_PARALLEL_LEVEL-}"
14 15
15# setup_cross_compiler sets up environment variables for cross-compilation with the given prefix. 16# setup_cross_compiler sets up environment variables for cross-compilation with the given prefix.
16setup_cross_compiler() { 17setup_cross_compiler() {
@@ -41,11 +42,6 @@ setup_cross_compiler() {
41 echo "##### Using $($CC --version | head -n 1)" 42 echo "##### Using $($CC --version | head -n 1)"
42} 43}
43 44
44if type apt-get >/dev/null 2>&1; then
45 sudo apt-get update
46 sudo apt-get install -y cmake ninja-build
47fi
48
49# generate source tree 45# generate source tree
50./autogen.sh 46./autogen.sh
51 47
@@ -122,10 +118,6 @@ elif [ "$ARCH" = "mingw32" ] || [ "$ARCH" = "mingw64" ]; then
122 CPU=x86_64 118 CPU=x86_64
123 fi 119 fi
124 120
125 if ! type i686-w64-mingw32-gcc > /dev/null; then
126 sudo apt-get install -y mingw-w64
127 fi
128
129 ./configure --host=$CPU-w64-mingw32 121 ./configure --host=$CPU-w64-mingw32
130 make -j 4 122 make -j 4
131 123
@@ -145,17 +137,13 @@ elif [ "$ARCH" = "mingw32" ] || [ "$ARCH" = "mingw64" ]; then
145 ) 137 )
146 138
147elif [ "$ARCH" = "arm32" ] || [ "$ARCH" = "arm64" ]; then 139elif [ "$ARCH" = "arm32" ] || [ "$ARCH" = "arm64" ]; then
148 sudo apt-get install -y qemu-user-static binfmt-support
149
150 if [ "$ARCH" = "arm32" ]; then 140 if [ "$ARCH" = "arm32" ]; then
151 sudo apt-get install -y g++-arm-linux-gnueabihf
152 sudo ln -sf /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.3 /lib/ 141 sudo ln -sf /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.3 /lib/
153 setup_cross_compiler arm-linux-gnueabihf 142 setup_cross_compiler arm-linux-gnueabihf
154 143
155 ./configure --host=arm-linux-gnueabihf 144 ./configure --host=arm-linux-gnueabihf
156 LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib make -j 4 check 145 LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib make -j 4 check
157 else 146 else
158 sudo apt-get install -y g++-aarch64-linux-gnu
159 sudo ln -sf /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.1 /lib/ 147 sudo ln -sf /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.1 /lib/
160 setup_cross_compiler aarch64-linux-gnu 148 setup_cross_compiler aarch64-linux-gnu
161 149
@@ -166,7 +154,6 @@ elif [ "$ARCH" = "arm32" ] || [ "$ARCH" = "arm64" ]; then
166 file apps/openssl/openssl 154 file apps/openssl/openssl
167 155
168elif [ "$ARCH" = "loong64" ]; then 156elif [ "$ARCH" = "loong64" ]; then
169 sudo apt install -y qemu-user-static binfmt-support g++-14-loongarch64-linux-gnu
170 sudo ln -sf /usr/loongarch64-linux-gnu/lib64/ld-linux-loongarch-lp64d.so.1 /lib64 157 sudo ln -sf /usr/loongarch64-linux-gnu/lib64/ld-linux-loongarch-lp64d.so.1 /lib64
171 setup_cross_compiler loongarch64-linux-gnu 158 setup_cross_compiler loongarch64-linux-gnu
172 159
@@ -175,22 +162,29 @@ elif [ "$ARCH" = "loong64" ]; then
175 162
176 file apps/openssl/openssl 163 file apps/openssl/openssl
177 164
178elif [ "$ARCH" = "mips32" ] || [ "$ARCH" = "mips64" ]; then 165elif [ "$ARCH" = "riscv64" ]; then
179 sudo apt-get install -y qemu-user-static binfmt-support 166 sudo ln -sf /usr/riscv64-linux-gnu/lib/ld-linux-riscv64-lp64d.so.1 /lib/
167 setup_cross_compiler riscv64-linux-gnu
168
169 ./configure --host=riscv64-linux-gnu
170 LD_LIBRARY_PATH=/usr/riscv64-linux-gnu/lib make -j 4 check
180 171
172 file apps/openssl/openssl
173
174elif [ "$ARCH" = "mips32" ] || [ "$ARCH" = "mips64" ]; then
181 if [ "$ARCH" = "mips32" ]; then 175 if [ "$ARCH" = "mips32" ]; then
182 sudo apt-get install -y g++-mips-linux-gnu 176 sudo ln -sf /usr/mipsel-linux-gnu/lib/ld.so.1 /lib/
183 sudo ln -sf /usr/mips-linux-gnu/lib/ld.so.1 /lib/ 177 setup_cross_compiler mipsel-linux-gnu
184 setup_cross_compiler mips-linux-gnu
185 178
186 ./configure --host=mips-linux-gnu 179 # MIPS32 assembly is disabled by default, so enable it for CI coverage.
187 LD_LIBRARY_PATH=/usr/mips-linux-gnu/lib make -j 4 check 180 ./configure --host=mipsel-linux-gnu --enable-asm
181 LD_LIBRARY_PATH=/usr/mipsel-linux-gnu/lib make -j 4 check
188 else 182 else
189 sudo apt-get install -y g++-mips64el-linux-gnuabi64
190 sudo ln -sf /usr/mips64el-linux-gnuabi64/lib64/ld.so.1 /lib64 183 sudo ln -sf /usr/mips64el-linux-gnuabi64/lib64/ld.so.1 /lib64
191 setup_cross_compiler mips64el-linux-gnuabi64 184 setup_cross_compiler mips64el-linux-gnuabi64
192 185
193 ./configure --host=mips64el-linux-gnuabi64 186 # MIPS assembly is disabled by default, so enable it for CI coverage.
187 ./configure --host=mips64el-linux-gnuabi64 --enable-asm
194 LD_LIBRARY_PATH=/usr/mips64el-linux-gnuabi64/lib make -j 4 check 188 LD_LIBRARY_PATH=/usr/mips64el-linux-gnuabi64/lib make -j 4 check
195 fi 189 fi
196 190
diff --git a/ssl/CMakeLists.txt b/ssl/CMakeLists.txt
index 9ab7e43..424d639 100644
--- a/ssl/CMakeLists.txt
+++ b/ssl/CMakeLists.txt
@@ -20,6 +20,7 @@ set(
20 d1_lib.c 20 d1_lib.c
21 d1_pkt.c 21 d1_pkt.c
22 d1_srtp.c 22 d1_srtp.c
23 dtls12_handshake_msg.c
23 pqueue.c 24 pqueue.c
24 s3_cbc.c 25 s3_cbc.c
25 s3_lib.c 26 s3_lib.c
diff --git a/ssl/Makefile.am b/ssl/Makefile.am
index 4ec738c..2a1c848 100644
--- a/ssl/Makefile.am
+++ b/ssl/Makefile.am
@@ -71,6 +71,7 @@ libssl_la_SOURCES += d1_both.c
71libssl_la_SOURCES += d1_lib.c 71libssl_la_SOURCES += d1_lib.c
72libssl_la_SOURCES += d1_pkt.c 72libssl_la_SOURCES += d1_pkt.c
73libssl_la_SOURCES += d1_srtp.c 73libssl_la_SOURCES += d1_srtp.c
74libssl_la_SOURCES += dtls12_handshake_msg.c
74libssl_la_SOURCES += pqueue.c 75libssl_la_SOURCES += pqueue.c
75libssl_la_SOURCES += s3_cbc.c 76libssl_la_SOURCES += s3_cbc.c
76libssl_la_SOURCES += s3_lib.c 77libssl_la_SOURCES += s3_lib.c
@@ -118,6 +119,7 @@ libssl_la_SOURCES += tls13_record_layer.c
118libssl_la_SOURCES += tls13_server.c 119libssl_la_SOURCES += tls13_server.c
119 120
120noinst_HEADERS += srtp.h 121noinst_HEADERS += srtp.h
122noinst_HEADERS += dtls12_internal.h
121noinst_HEADERS += dtls_local.h 123noinst_HEADERS += dtls_local.h
122noinst_HEADERS += ssl_local.h 124noinst_HEADERS += ssl_local.h
123noinst_HEADERS += ssl_sigalgs.h 125noinst_HEADERS += ssl_sigalgs.h
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index eaf4ed1..ac9c5ba 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -283,6 +283,15 @@ add_executable(bn_mont bn_mont.c)
283target_link_libraries(bn_mont ${OPENSSL_TEST_LIBS}) 283target_link_libraries(bn_mont ${OPENSSL_TEST_LIBS})
284add_platform_test(bn_mont bn_mont) 284add_platform_test(bn_mont bn_mont)
285 285
286# bn_mul_div is mostly benchmark code with non-standard timing dependencies,
287# while the non-benchmark test coverage is not worth the cross-platform fallout.
288# # bn_mul_div
289# if(NOT (WIN32 OR EMSCRIPTEN OR SOLARIS))
290# add_executable(bn_mul_div bn_mul_div.c)
291# target_link_libraries(bn_mul_div ${OPENSSL_TEST_LIBS})
292# add_platform_test(bn_mul_div bn_mul_div)
293# endif()
294
286# bn_primes 295# bn_primes
287add_executable(bn_primes bn_primes.c) 296add_executable(bn_primes bn_primes.c)
288target_link_libraries(bn_primes ${OPENSSL_TEST_LIBS}) 297target_link_libraries(bn_primes ${OPENSSL_TEST_LIBS})
@@ -333,8 +342,30 @@ add_executable(bytestringtest bytestringtest.c)
333target_link_libraries(bytestringtest ${OPENSSL_TEST_LIBS}) 342target_link_libraries(bytestringtest ${OPENSSL_TEST_LIBS})
334add_platform_test(bytestringtest bytestringtest) 343add_platform_test(bytestringtest bytestringtest)
335 344
336# callback 345# x509_callbacks
337# callbackfailures 346add_executable(callback callback.c)
347target_link_libraries(callback ${OPENSSL_TEST_LIBS})
348add_executable(callbackfailures callbackfailures.c)
349target_link_libraries(callbackfailures ${OPENSSL_TEST_LIBS})
350add_executable(expirecallback expirecallback.c)
351target_link_libraries(expirecallback ${OPENSSL_TEST_LIBS})
352add_dependencies(callback openssl)
353if(NOT WIN32 AND NOT EMSCRIPTEN AND PERL_EXECUTABLE)
354 add_test(NAME x509_callbacks COMMAND
355 ${CMAKE_CURRENT_SOURCE_DIR}/x509_callbacks.sh
356 $<TARGET_FILE:callback>
357 $<TARGET_FILE:callbackfailures>
358 $<TARGET_FILE:expirecallback>
359 $<TARGET_FILE:openssl>)
360 set_tests_properties(x509_callbacks PROPERTIES
361 ENVIRONMENT "srcdir=${TEST_SOURCE_DIR};PERL=${PERL_EXECUTABLE}"
362 WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
363 # These tests use the same certificate corpus as x509_verify and can
364 # exceed the range of a 32-bit time_t.
365 if(SMALL_TIME_T)
366 set_property(TEST x509_callbacks PROPERTY WILL_FAIL TRUE)
367 endif()
368endif()
338 369
339# casttest 370# casttest
340add_executable(casttest casttest.c) 371add_executable(casttest casttest.c)
@@ -415,6 +446,16 @@ add_platform_test(dsatest dsatest)
415# set_tests_properties(dtlstest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}") 446# set_tests_properties(dtlstest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}")
416# endif() 447# endif()
417 448
449# dtls_handshake_msg_test
450add_executable(dtls_handshake_msg_test dtls_handshake_msg_test.c)
451target_link_libraries(dtls_handshake_msg_test ${OPENSSL_TEST_LIBS})
452add_platform_test(dtls_handshake_msg_test dtls_handshake_msg_test)
453
454# dtls_wire_test
455add_executable(dtls_wire_test dtls_wire_test.c)
456target_link_libraries(dtls_wire_test ${OPENSSL_TEST_LIBS})
457add_platform_test(dtls_wire_test dtls_wire_test)
458
418# ecc_cdh 459# ecc_cdh
419add_executable(ecc_cdh ecc_cdh.c) 460add_executable(ecc_cdh ecc_cdh.c)
420target_link_libraries(ecc_cdh ${OPENSSL_TEST_LIBS}) 461target_link_libraries(ecc_cdh ${OPENSSL_TEST_LIBS})
@@ -484,8 +525,6 @@ add_executable(exdata_test exdata_test.c)
484target_link_libraries(exdata_test ${OPENSSL_TEST_LIBS}) 525target_link_libraries(exdata_test ${OPENSSL_TEST_LIBS})
485add_platform_test(exdata_test exdata_test) 526add_platform_test(exdata_test exdata_test)
486 527
487# expirecallback.c
488
489# explicit_bzero 528# explicit_bzero
490# SA_ONSTACK is unavailable on Windows, sigsuspend is unavailable on Emscripten 529# SA_ONSTACK is unavailable on Windows, sigsuspend is unavailable on Emscripten
491if(NOT (WIN32 OR EMSCRIPTEN)) 530if(NOT (WIN32 OR EMSCRIPTEN))
@@ -805,6 +844,11 @@ target_link_libraries(ssl_get_shared_ciphers ${OPENSSL_TEST_LIBS})
805prepare_emscripten_test_target(ssl_get_shared_ciphers) 844prepare_emscripten_test_target(ssl_get_shared_ciphers)
806add_platform_test(ssl_get_shared_ciphers ssl_get_shared_ciphers) 845add_platform_test(ssl_get_shared_ciphers ssl_get_shared_ciphers)
807 846
847# ssl_kex
848add_executable(ssl_kex ssl_kex.c)
849target_link_libraries(ssl_kex ${OPENSSL_TEST_LIBS})
850add_platform_test(ssl_kex ssl_kex)
851
808# ssl_methods 852# ssl_methods
809add_executable(ssl_methods ssl_methods.c) 853add_executable(ssl_methods ssl_methods.c)
810target_link_libraries(ssl_methods ${OPENSSL_TEST_LIBS}) 854target_link_libraries(ssl_methods ${OPENSSL_TEST_LIBS})
@@ -820,11 +864,39 @@ add_executable(ssl_verify_param ssl_verify_param.c)
820target_link_libraries(ssl_verify_param ${OPENSSL_TEST_LIBS}) 864target_link_libraries(ssl_verify_param ${OPENSSL_TEST_LIBS})
821add_platform_test(ssl_verify_param ssl_verify_param) 865add_platform_test(ssl_verify_param ssl_verify_param)
822 866
867# ssl_verify
868add_executable(ssl_verify ssl_verify.c)
869target_link_libraries(ssl_verify ${OPENSSL_TEST_LIBS})
870prepare_emscripten_test_target(ssl_verify)
871if(HAVE_PERL_IO_SOCKET_SSL_UTILS)
872 if(WIN32)
873 add_test(NAME ssl_verify COMMAND
874 ${CMAKE_CURRENT_SOURCE_DIR}/ssl_verify.bat
875 $<TARGET_FILE:ssl_verify>)
876 else()
877 add_test(NAME ssl_verify COMMAND
878 ${CMAKE_CURRENT_SOURCE_DIR}/ssl_verify.sh
879 $<TARGET_FILE:ssl_verify>)
880 endif()
881 set_tests_properties(ssl_verify PROPERTIES
882 ENVIRONMENT "srcdir=${TEST_SOURCE_DIR};PERL=${PERL_EXECUTABLE}"
883 WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
884endif()
885
823# ssl_versions 886# ssl_versions
824add_executable(ssl_versions ssl_versions.c) 887add_executable(ssl_versions ssl_versions.c)
825target_link_libraries(ssl_versions ${OPENSSL_TEST_LIBS}) 888target_link_libraries(ssl_versions ${OPENSSL_TEST_LIBS})
826add_platform_test(ssl_versions ssl_versions) 889add_platform_test(ssl_versions ssl_versions)
827 890
891# ssl_tlstest
892add_executable(ssl_tlstest ssl_tlstest.c)
893target_link_libraries(ssl_tlstest ${OPENSSL_TEST_LIBS})
894prepare_emscripten_test_target(ssl_tlstest)
895add_platform_test(ssl_tlstest $<TARGET_FILE:ssl_tlstest>
896 ${CMAKE_CURRENT_SOURCE_DIR}/server1-rsa.pem
897 ${CMAKE_CURRENT_SOURCE_DIR}/server1-rsa-chain.pem
898 ${CMAKE_CURRENT_SOURCE_DIR}/ca-root-rsa.pem)
899
828# ssltest 900# ssltest
829add_executable(ssltest ssltest.c) 901add_executable(ssltest ssltest.c)
830target_link_libraries(ssltest ${OPENSSL_TEST_LIBS}) 902target_link_libraries(ssltest ${OPENSSL_TEST_LIBS})
@@ -921,6 +993,23 @@ add_executable(valid_handshakes_terminate valid_handshakes_terminate.c)
921target_link_libraries(valid_handshakes_terminate ${OPENSSL_TEST_LIBS}) 993target_link_libraries(valid_handshakes_terminate ${OPENSSL_TEST_LIBS})
922add_platform_test(valid_handshakes_terminate valid_handshakes_terminate) 994add_platform_test(valid_handshakes_terminate valid_handshakes_terminate)
923 995
996# x509_verify
997add_executable(x509_verify x509_verify.c)
998target_link_libraries(x509_verify ${OPENSSL_TEST_LIBS})
999add_dependencies(x509_verify openssl)
1000if(NOT WIN32 AND NOT EMSCRIPTEN AND PERL_EXECUTABLE)
1001 add_test(NAME x509_verify COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/x509_verify.sh
1002 $<TARGET_FILE:x509_verify> $<TARGET_FILE:openssl>)
1003 set_tests_properties(x509_verify PROPERTIES
1004 ENVIRONMENT "srcdir=${TEST_SOURCE_DIR};PERL=${PERL_EXECUTABLE}"
1005 WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
1006 # This test depends on certificate times that can exceed 32-bit time_t
1007 # range, so match the existing time tests and expect failure there.
1008 if(SMALL_TIME_T)
1009 set_property(TEST x509_verify PROPERTY WILL_FAIL TRUE)
1010 endif()
1011endif()
1012
924# verifytest 1013# verifytest
925add_executable(verifytest verifytest.c) 1014add_executable(verifytest verifytest.c)
926target_link_libraries(verifytest ${LIBTLS_TEST_LIBS}) 1015target_link_libraries(verifytest ${LIBTLS_TEST_LIBS})
@@ -947,6 +1036,11 @@ target_link_libraries(x509_asn1 ${OPENSSL_TEST_LIBS})
947prepare_emscripten_test_target(x509_asn1) 1036prepare_emscripten_test_target(x509_asn1)
948add_platform_test(x509_asn1 x509_asn1) 1037add_platform_test(x509_asn1 x509_asn1)
949 1038
1039# x509_crl
1040add_executable(x509_crl x509_crl.c)
1041target_link_libraries(x509_crl ${OPENSSL_TEST_LIBS})
1042add_platform_test(x509_crl x509_crl)
1043
950# x509_extensions_test 1044# x509_extensions_test
951add_executable(x509_extensions_test x509_extensions_test.c) 1045add_executable(x509_extensions_test x509_extensions_test.c)
952target_link_libraries(x509_extensions_test ${OPENSSL_TEST_LIBS}) 1046target_link_libraries(x509_extensions_test ${OPENSSL_TEST_LIBS})
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 22e3dee..aec438b 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -94,6 +94,7 @@ libtest_la_SOURCES = empty.c
94 94
95LDADD = libtest.la $(PLATFORM_LDADD) $(PROG_LDADD) 95LDADD = libtest.la $(PLATFORM_LDADD) $(PROG_LDADD)
96 96
97TESTS_ENVIRONMENT = PERL='$(PERL)'
97TEST_LOG_DRIVER = env AM_TAP_AWK='$(AWK)' $(SHELL) $(top_srcdir)/tap-driver.sh 98TEST_LOG_DRIVER = env AM_TAP_AWK='$(AWK)' $(SHELL) $(top_srcdir)/tap-driver.sh
98 99
99TESTS = 100TESTS =
@@ -102,6 +103,11 @@ check_PROGRAMS =
102EXTRA_DIST = CMakeLists.txt 103EXTRA_DIST = CMakeLists.txt
103DISTCLEANFILES = pidwraptest.txt 104DISTCLEANFILES = pidwraptest.txt
104 105
106distclean-local:
107 rm -rf ssl_verify-certs
108 rm -rf x509_callback-certs
109 rm -rf x509_verify-certs
110
105# XXX - should probably be in their own static lib 111# XXX - should probably be in their own static lib
106TEST_HELPER_SRC = test.c test_util.c 112TEST_HELPER_SRC = test.c test_util.c
107noinst_HEADERS = test.h 113noinst_HEADERS = test.h
@@ -303,6 +309,17 @@ TESTS += bn_mont
303check_PROGRAMS += bn_mont 309check_PROGRAMS += bn_mont
304bn_mont_SOURCES = bn_mont.c 310bn_mont_SOURCES = bn_mont.c
305 311
312# bn_mul_div is mostly benchmark code with non-standard timing dependencies,
313# while the non-benchmark test coverage is not worth the cross-platform fallout.
314## bn_mul_div
315#if !HOST_WIN
316#if !HOST_SOLARIS
317#TESTS += bn_mul_div
318#check_PROGRAMS += bn_mul_div
319#bn_mul_div_SOURCES = bn_mul_div.c
320#endif
321#endif
322
306# bn_primes 323# bn_primes
307TESTS += bn_primes 324TESTS += bn_primes
308check_PROGRAMS += bn_primes 325check_PROGRAMS += bn_primes
@@ -349,8 +366,21 @@ TESTS += bytestringtest
349check_PROGRAMS += bytestringtest 366check_PROGRAMS += bytestringtest
350bytestringtest_SOURCES = bytestringtest.c 367bytestringtest_SOURCES = bytestringtest.c
351 368
352# callback 369# x509_callbacks
353# callbackfailures 370if HAVE_PERL
371# These tests use the same certificate corpus as x509_verify and can exceed
372# the range of a 32-bit time_t.
373if SMALL_TIME_T
374XFAIL_TESTS += x509_callbacks.sh
375endif
376TESTS += x509_callbacks.sh
377check_PROGRAMS += callback callbackfailures expirecallback
378endif
379callback_SOURCES = callback.c
380callbackfailures_SOURCES = callbackfailures.c
381expirecallback_SOURCES = expirecallback.c
382EXTRA_DIST += x509_callbacks.sh
383EXTRA_DIST += callback.pl
354 384
355# casttest 385# casttest
356TESTS += casttest 386TESTS += casttest
@@ -431,6 +461,16 @@ dsatest_SOURCES = dsatest.c
431#endif 461#endif
432#EXTRA_DIST += dtlstest.sh 462#EXTRA_DIST += dtlstest.sh
433 463
464# dtls_handshake_msg_test
465TESTS += dtls_handshake_msg_test
466check_PROGRAMS += dtls_handshake_msg_test
467dtls_handshake_msg_test_SOURCES = dtls_handshake_msg_test.c
468
469# dtls_wire_test
470TESTS += dtls_wire_test
471check_PROGRAMS += dtls_wire_test
472dtls_wire_test_SOURCES = dtls_wire_test.c
473
434# ecc_cdh 474# ecc_cdh
435TESTS += ecc_cdh 475TESTS += ecc_cdh
436check_PROGRAMS += ecc_cdh 476check_PROGRAMS += ecc_cdh
@@ -498,8 +538,6 @@ TESTS += exdata_test
498check_PROGRAMS += exdata_test 538check_PROGRAMS += exdata_test
499exdata_test_SOURCES = exdata_test.c 539exdata_test_SOURCES = exdata_test.c
500 540
501# expirecallback.c
502
503# explicit_bzero 541# explicit_bzero
504# explicit_bzero relies on SA_ONSTACK, which is unavailable on Windows 542# explicit_bzero relies on SA_ONSTACK, which is unavailable on Windows
505if !HOST_WIN 543if !HOST_WIN
@@ -810,6 +848,11 @@ ssl_get_shared_ciphers_CPPFLAGS = $(AM_CPPFLAGS) -DCERTSDIR=\"$(srcdir)\"
810check_PROGRAMS += ssl_get_shared_ciphers 848check_PROGRAMS += ssl_get_shared_ciphers
811ssl_get_shared_ciphers_SOURCES = ssl_get_shared_ciphers.c 849ssl_get_shared_ciphers_SOURCES = ssl_get_shared_ciphers.c
812 850
851# ssl_kex
852TESTS += ssl_kex
853check_PROGRAMS += ssl_kex
854ssl_kex_SOURCES = ssl_kex.c
855
813# ssl_methods 856# ssl_methods
814TESTS += ssl_methods 857TESTS += ssl_methods
815check_PROGRAMS += ssl_methods 858check_PROGRAMS += ssl_methods
@@ -825,11 +868,27 @@ TESTS += ssl_verify_param
825check_PROGRAMS += ssl_verify_param 868check_PROGRAMS += ssl_verify_param
826ssl_verify_param_SOURCES = ssl_verify_param.c 869ssl_verify_param_SOURCES = ssl_verify_param.c
827 870
871# ssl_verify
872if HAVE_PERL_IO_SOCKET_SSL_UTILS
873TESTS += ssl_verify.sh
874check_PROGRAMS += ssl_verify
875endif
876ssl_verify_SOURCES = ssl_verify.c
877EXTRA_DIST += ssl_verify.sh
878EXTRA_DIST += ssl_verify.bat
879EXTRA_DIST += create-libressl-test-certs.pl
880
828# ssl_versions 881# ssl_versions
829TESTS += ssl_versions 882TESTS += ssl_versions
830check_PROGRAMS += ssl_versions 883check_PROGRAMS += ssl_versions
831ssl_versions_SOURCES = ssl_versions.c 884ssl_versions_SOURCES = ssl_versions.c
832 885
886# ssl_tlstest
887TESTS += ssl_tlstest.sh
888check_PROGRAMS += ssl_tlstest
889ssl_tlstest_SOURCES = ssl_tlstest.c
890EXTRA_DIST += ssl_tlstest.sh
891
833# ssltest 892# ssltest
834TESTS += ssltest.sh 893TESTS += ssltest.sh
835check_PROGRAMS += ssltest 894check_PROGRAMS += ssltest
@@ -905,6 +964,21 @@ TESTS += valid_handshakes_terminate
905check_PROGRAMS += valid_handshakes_terminate 964check_PROGRAMS += valid_handshakes_terminate
906valid_handshakes_terminate_SOURCES = valid_handshakes_terminate.c 965valid_handshakes_terminate_SOURCES = valid_handshakes_terminate.c
907 966
967# x509_verify
968if HAVE_PERL
969# This test depends on certificate times that can exceed 32-bit time_t
970# range, so match the existing time tests and expect failure there.
971if SMALL_TIME_T
972XFAIL_TESTS += x509_verify.sh
973endif
974TESTS += x509_verify.sh
975check_PROGRAMS += x509_verify
976endif
977x509_verify_SOURCES = x509_verify.c
978EXTRA_DIST += x509_verify.sh
979EXTRA_DIST += make-dir-roots.pl
980EXTRA_DIST += certs
981
908# verifytest 982# verifytest
909TESTS += verifytest 983TESTS += verifytest
910check_PROGRAMS += verifytest 984check_PROGRAMS += verifytest
@@ -930,6 +1004,11 @@ TESTS += x509_asn1
930check_PROGRAMS += x509_asn1 1004check_PROGRAMS += x509_asn1
931x509_asn1_SOURCES = x509_asn1.c 1005x509_asn1_SOURCES = x509_asn1.c
932 1006
1007# x509_crl
1008TESTS += x509_crl
1009check_PROGRAMS += x509_crl
1010x509_crl_SOURCES = x509_crl.c
1011
933# x509_extensions_test 1012# x509_extensions_test
934TESTS += x509_extensions_test 1013TESTS += x509_extensions_test
935check_PROGRAMS += x509_extensions_test 1014check_PROGRAMS += x509_extensions_test
diff --git a/tests/compat/pipe2.c b/tests/compat/pipe2.c
index d7b4062..3e79575 100644
--- a/tests/compat/pipe2.c
+++ b/tests/compat/pipe2.c
@@ -18,9 +18,10 @@ static int setfd(int fd, int flag)
18{ 18{
19 int rc = -1; 19 int rc = -1;
20 if (flag & FD_CLOEXEC) { 20 if (flag & FD_CLOEXEC) {
21 HANDLE h = (HANDLE)_get_osfhandle(fd); 21 /* fd is a Winsock SOCKET, not a CRT descriptor: use it as a
22 if (h != NULL) 22 * handle directly rather than translating with _get_osfhandle. */
23 rc = SetHandleInformation(h, HANDLE_FLAG_INHERIT, 0) == 0 ? -1 : 0; 23 HANDLE h = (HANDLE)(LONG_PTR)fd;
24 rc = SetHandleInformation(h, HANDLE_FLAG_INHERIT, 0) == 0 ? -1 : 0;
24 } 25 }
25 return rc; 26 return rc;
26} 27}
@@ -38,16 +39,20 @@ static int setfl(int fd, int flag)
38/* 39/*
39 * Have open() temporarily use up file descriptors until reaching beyond the 40 * Have open() temporarily use up file descriptors until reaching beyond the
40 * allocated sockets, then leak the ones conflicting with any of the latter. 41 * allocated sockets, then leak the ones conflicting with any of the latter.
42 *
43 * open()/close() are redefined to posix_open()/posix_close() in this file,
44 * which tag descriptors with the 0x80000000 bit. Use the raw CRT _open/_close
45 * so the values compare against the socket handles in the same namespace.
41 */ 46 */
42static void create_issue_1069_sentinels(int socket_vector[2]) 47static void create_issue_1069_sentinels(int socket_vector[2])
43{ 48{
44 int fd = open("CONIN$", O_RDONLY); 49 int fd = _open("CONIN$", O_RDONLY);
45 if (fd == -1 || (fd > socket_vector[0] && fd > socket_vector[1])) { 50 if (fd == -1 || (fd > socket_vector[0] && fd > socket_vector[1])) {
46 return; 51 return;
47 } 52 }
48 create_issue_1069_sentinels(socket_vector); 53 create_issue_1069_sentinels(socket_vector);
49 if (fd != socket_vector[0] && fd != socket_vector[1]) { 54 if (fd != socket_vector[0] && fd != socket_vector[1]) {
50 close(fd); 55 _close(fd);
51 } 56 }
52} 57}
53 58
@@ -70,8 +75,15 @@ int socketpair(int domain, int type, int protocol, int socket_vector[2])
70 .sin_port = 0, 75 .sin_port = 0,
71 }; 76 };
72 77
78 struct sockaddr_in self, peer;
73 int yes = 1, e; 79 int yes = 1, e;
74 if (setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, 80
81 /*
82 * SO_REUSEADDR does not mean here what it means on unix: it lets any
83 * other process bind the same address and port and take over the
84 * rendezvous. SO_EXCLUSIVEADDRUSE is the flag that keeps the port ours.
85 */
86 if (setsockopt(listener, SOL_SOCKET, SO_EXCLUSIVEADDRUSE,
75 (void *)&yes, sizeof yes) == -1) 87 (void *)&yes, sizeof yes) == -1)
76 goto err; 88 goto err;
77 89
@@ -100,6 +112,28 @@ int socketpair(int domain, int type, int protocol, int socket_vector[2])
100 if (socket_vector[1] == -1) 112 if (socket_vector[1] == -1)
101 goto err; 113 goto err;
102 114
115 /*
116 * The listening port is enumerable by anything running as the user, so
117 * the connection we just accepted is not necessarily the one we made.
118 * Pair the two halves only if they are each other's peer.
119 */
120 memset(&self, 0, sizeof self);
121 addrlen = sizeof self;
122 if (getsockname(socket_vector[0], (struct sockaddr *)&self, &addrlen) != 0)
123 goto err;
124
125 memset(&peer, 0, sizeof peer);
126 addrlen = sizeof peer;
127 if (getpeername(socket_vector[1], (struct sockaddr *)&peer, &addrlen) != 0)
128 goto err;
129
130 if (self.sin_family != peer.sin_family ||
131 self.sin_addr.s_addr != peer.sin_addr.s_addr ||
132 self.sin_port != peer.sin_port) {
133 WSASetLastError(WSAECONNREFUSED);
134 goto err;
135 }
136
103 closesocket(listener); 137 closesocket(listener);
104 138
105 create_issue_1069_sentinels(socket_vector); 139 create_issue_1069_sentinels(socket_vector);
diff --git a/tests/ssl_tlstest.sh b/tests/ssl_tlstest.sh
new file mode 100755
index 0000000..cde8a4f
--- /dev/null
+++ b/tests/ssl_tlstest.sh
@@ -0,0 +1,43 @@
1#!/bin/sh
2#
3# Copyright (c) 2026 Kenjiro Nakayama
4#
5# Permission to use, copy, modify, and distribute this software for any
6# purpose with or without fee is hereby granted, provided that the above
7# copyright notice and this permission notice appear in all copies.
8#
9# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16
17set -e
18
19if [ $# -ge 1 ]; then
20 ssl_tlstest_bin=$1
21else
22 ssl_tlstest_bin=./ssl_tlstest
23 if [ -e ./ssl_tlstest.exe ]; then
24 ssl_tlstest_bin=./ssl_tlstest.exe
25 elif [ -e ./ssl_tlstest.js ]; then
26 ssl_tlstest_bin=./ssl_tlstest.js
27 fi
28fi
29
30if [ -z "$srcdir" ]; then
31 srcdir=.
32fi
33
34case "$ssl_tlstest_bin" in
35*.js)
36 node "$ssl_tlstest_bin" "$srcdir/server1-rsa.pem" \
37 "$srcdir/server1-rsa-chain.pem" "$srcdir/ca-root-rsa.pem"
38 ;;
39*)
40 "$ssl_tlstest_bin" "$srcdir/server1-rsa.pem" \
41 "$srcdir/server1-rsa-chain.pem" "$srcdir/ca-root-rsa.pem"
42 ;;
43esac
diff --git a/tests/ssl_verify.bat b/tests/ssl_verify.bat
new file mode 100644
index 0000000..1b8c1dc
--- /dev/null
+++ b/tests/ssl_verify.bat
@@ -0,0 +1,42 @@
1@echo off
2setlocal
3
4:: Copyright (c) 2026 Kenjiro Nakayama
5::
6:: Permission to use, copy, modify, and distribute this software for any
7:: purpose with or without fee is hereby granted, provided that the above
8:: copyright notice and this permission notice appear in all copies.
9::
10:: THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11:: WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12:: MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13:: ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14:: WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15:: ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16:: OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17
18if "%~1" == "" exit /b 1
19
20set "ssl_verify_bin=%~1"
21set "ssl_verify_bin=%ssl_verify_bin:/=\%"
22if not exist "%ssl_verify_bin%" exit /b 1
23
24if not defined srcdir set "srcdir=."
25if not defined PERL set "PERL=perl"
26
27set "workdir=ssl_verify-certs"
28if exist "%workdir%" rmdir /s /q "%workdir%"
29mkdir "%workdir%" || exit /b 1
30pushd "%workdir%" || exit /b 1
31
32set "status=1"
33"%PERL%" "%srcdir%/create-libressl-test-certs.pl"
34if errorlevel 1 goto cleanup
35
36"%ssl_verify_bin%"
37set "status=%errorlevel%"
38
39:cleanup
40popd
41rmdir /s /q "%workdir%"
42exit /b %status%
diff --git a/tests/ssl_verify.sh b/tests/ssl_verify.sh
new file mode 100755
index 0000000..bb090db
--- /dev/null
+++ b/tests/ssl_verify.sh
@@ -0,0 +1,67 @@
1#!/bin/sh
2#
3# Copyright (c) 2026 Kenjiro Nakayama
4#
5# Permission to use, copy, modify, and distribute this software for any
6# purpose with or without fee is hereby granted, provided that the above
7# copyright notice and this permission notice appear in all copies.
8#
9# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16
17set -e
18
19if [ -z "$srcdir" ]; then
20 srcdir=.
21fi
22
23if [ -z "$PERL" ]; then
24 PERL=perl
25fi
26
27case "$srcdir" in
28/*)
29 create_certs="$srcdir/create-libressl-test-certs.pl"
30 ;;
31*)
32 create_certs="`pwd`/$srcdir/create-libressl-test-certs.pl"
33 ;;
34esac
35
36if [ $# -ge 1 ]; then
37 verify_bin=$1
38else
39 verify_bin="`pwd`/ssl_verify"
40 if [ -e ./ssl_verify.exe ]; then
41 verify_bin="`pwd`/ssl_verify.exe"
42 fi
43fi
44
45workdir=ssl_verify-certs
46
47cleanup()
48{
49 rm -rf "$workdir"
50}
51trap cleanup EXIT
52
53rm -rf "$workdir"
54mkdir "$workdir"
55
56(
57 cd "$workdir"
58 "$PERL" "$create_certs"
59 case "$verify_bin" in
60 *.js)
61 node "$verify_bin"
62 ;;
63 *)
64 "$verify_bin"
65 ;;
66 esac
67)
diff --git a/tests/x509_callbacks.sh b/tests/x509_callbacks.sh
new file mode 100755
index 0000000..a48e638
--- /dev/null
+++ b/tests/x509_callbacks.sh
@@ -0,0 +1,94 @@
1#!/bin/sh
2#
3# Copyright (c) 2026 Kenjiro Nakayama
4#
5# Permission to use, copy, modify, and distribute this software for any
6# purpose with or without fee is hereby granted, provided that the above
7# copyright notice and this permission notice appear in all copies.
8#
9# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16
17set -e
18
19if [ -z "$srcdir" ]; then
20 srcdir=.
21fi
22
23if [ -z "$PERL" ]; then
24 PERL=perl
25fi
26
27case "$srcdir" in
28/*)
29 certs_path="$srcdir/certs"
30 ca_file="$srcdir/../cert.pem"
31 callback_check="$srcdir/callback.pl"
32 make_dir_roots="$srcdir/make-dir-roots.pl"
33 openssl_conf="$srcdir/openssl.cnf"
34 ;;
35*)
36 certs_path="`pwd`/$srcdir/certs"
37 ca_file="`pwd`/$srcdir/../cert.pem"
38 callback_check="`pwd`/$srcdir/callback.pl"
39 make_dir_roots="`pwd`/$srcdir/make-dir-roots.pl"
40 openssl_conf="`pwd`/$srcdir/openssl.cnf"
41 ;;
42esac
43
44if [ $# -ge 3 ]; then
45 callback_bin=$1
46 callbackfailures_bin=$2
47 expirecallback_bin=$3
48else
49 callback_bin="`pwd`/callback"
50 callbackfailures_bin="`pwd`/callbackfailures"
51 expirecallback_bin="`pwd`/expirecallback"
52 if [ -e ./callback.exe ]; then
53 callback_bin="`pwd`/callback.exe"
54 callbackfailures_bin="`pwd`/callbackfailures.exe"
55 expirecallback_bin="`pwd`/expirecallback.exe"
56 fi
57fi
58
59if [ $# -ge 4 ]; then
60 openssl_dir=`dirname "$4"`
61elif [ -d ../apps/openssl ]; then
62 openssl_dir="`pwd`/../apps/openssl"
63else
64 openssl_dir="`pwd`/../apps"
65fi
66
67PATH="$openssl_dir:$PATH"
68export PATH
69
70if [ -f "$openssl_conf" ]; then
71 OPENSSL_CONF="$openssl_conf"
72 export OPENSSL_CONF
73fi
74
75workdir=x509_callback-certs
76
77cleanup()
78{
79 rm -rf "$workdir"
80}
81trap cleanup EXIT
82
83rm -rf "$workdir"
84mkdir "$workdir"
85
86"$PERL" "$make_dir_roots" "$certs_path" "$workdir"
87
88(
89 cd "$workdir"
90 "$callback_bin" "$certs_path"
91 "$PERL" "$callback_check" callback.out
92 "$callbackfailures_bin" "$certs_path" "$ca_file"
93 "$expirecallback_bin" "$certs_path"
94)
diff --git a/tests/x509_verify.sh b/tests/x509_verify.sh
new file mode 100755
index 0000000..b43063f
--- /dev/null
+++ b/tests/x509_verify.sh
@@ -0,0 +1,81 @@
1#!/bin/sh
2#
3# Copyright (c) 2026 Kenjiro Nakayama
4#
5# Permission to use, copy, modify, and distribute this software for any
6# purpose with or without fee is hereby granted, provided that the above
7# copyright notice and this permission notice appear in all copies.
8#
9# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16
17set -e
18
19if [ -z "$srcdir" ]; then
20 srcdir=.
21fi
22
23if [ -z "$PERL" ]; then
24 PERL=perl
25fi
26
27case "$srcdir" in
28/*)
29 certs_path="$srcdir/certs"
30 make_dir_roots="$srcdir/make-dir-roots.pl"
31 openssl_conf="$srcdir/openssl.cnf"
32 ;;
33*)
34 certs_path="`pwd`/$srcdir/certs"
35 make_dir_roots="`pwd`/$srcdir/make-dir-roots.pl"
36 openssl_conf="`pwd`/$srcdir/openssl.cnf"
37 ;;
38esac
39
40if [ $# -ge 1 ]; then
41 verify_bin=$1
42else
43 verify_bin="`pwd`/x509_verify"
44 if [ -e ./x509_verify.exe ]; then
45 verify_bin="`pwd`/x509_verify.exe"
46 fi
47fi
48
49if [ $# -ge 2 ]; then
50 openssl_dir=`dirname "$2"`
51elif [ -d ../apps/openssl ]; then
52 openssl_dir="`pwd`/../apps/openssl"
53else
54 openssl_dir="`pwd`/../apps"
55fi
56
57PATH="$openssl_dir:$PATH"
58export PATH
59
60if [ -f "$openssl_conf" ]; then
61 OPENSSL_CONF="$openssl_conf"
62 export OPENSSL_CONF
63fi
64
65workdir=x509_verify-certs
66
67cleanup()
68{
69 rm -rf "$workdir"
70}
71trap cleanup EXIT
72
73rm -rf "$workdir"
74mkdir "$workdir"
75
76"$PERL" "$make_dir_roots" "$certs_path" "$workdir"
77
78(
79 cd "$workdir"
80 "$verify_bin" "$certs_path"
81)
diff --git a/tls/CMakeLists.txt b/tls/CMakeLists.txt
index a1b244a..258cd95 100644
--- a/tls/CMakeLists.txt
+++ b/tls/CMakeLists.txt
@@ -41,7 +41,7 @@ if(WIN32)
41 set(TLS_COMPAT_SRC ${TLS_COMPAT_SRC} compat/pwrite.c) 41 set(TLS_COMPAT_SRC ${TLS_COMPAT_SRC} compat/pwrite.c)
42endif() 42endif()
43 43
44add_definitions(-DTLS_DEFAULT_CA_FILE=\"${OPENSSLDIR}/cert.pem\") 44add_definitions(-DTLS_DEFAULT_CA_FILE=\"${TLS_DEFAULT_CA_FILE}\")
45 45
46file(COPY ${CMAKE_CURRENT_SOURCE_DIR}/tls.sym DESTINATION 46file(COPY ${CMAKE_CURRENT_SOURCE_DIR}/tls.sym DESTINATION
47 ${CMAKE_CURRENT_BINARY_DIR}) 47 ${CMAKE_CURRENT_BINARY_DIR})
diff --git a/tls/compat/pread.c b/tls/compat/pread.c
index b9d6b09..0b994f4 100644
--- a/tls/compat/pread.c
+++ b/tls/compat/pread.c
@@ -8,21 +8,25 @@
8 8
9#define NO_REDEF_POSIX_FUNCTIONS 9#define NO_REDEF_POSIX_FUNCTIONS
10 10
11#include <errno.h>
11#include <unistd.h> 12#include <unistd.h>
12 13
13ssize_t 14ssize_t
14pread(int d, void *buf, size_t nbytes, off_t offset) 15pread(int d, void *buf, size_t nbytes, off_t offset)
15{ 16{
16 off_t cpos, opos, rpos; 17 off_t cpos;
17 ssize_t bytes; 18 ssize_t bytes;
19 int save_errno;
20
18 if((cpos = lseek(d, 0, SEEK_CUR)) == -1) 21 if((cpos = lseek(d, 0, SEEK_CUR)) == -1)
19 return -1; 22 return -1;
20 if((opos = lseek(d, offset, SEEK_SET)) == -1) 23 if(lseek(d, offset, SEEK_SET) == -1)
21 return -1;
22 if((bytes = read(d, buf, nbytes)) == -1)
23 return -1; 24 return -1;
24 if((rpos = lseek(d, cpos, SEEK_SET)) == -1) 25 bytes = read(d, buf, nbytes);
26 save_errno = errno;
27 if(lseek(d, cpos, SEEK_SET) == -1)
25 return -1; 28 return -1;
29 errno = save_errno;
26 return bytes; 30 return bytes;
27} 31}
28 32
diff --git a/tls/compat/pwrite.c b/tls/compat/pwrite.c
index 82f5f55..ab88241 100644
--- a/tls/compat/pwrite.c
+++ b/tls/compat/pwrite.c
@@ -8,21 +8,25 @@
8 8
9#define NO_REDEF_POSIX_FUNCTIONS 9#define NO_REDEF_POSIX_FUNCTIONS
10 10
11#include <errno.h>
11#include <unistd.h> 12#include <unistd.h>
12 13
13ssize_t 14ssize_t
14pwrite(int d, const void *buf, size_t nbytes, off_t offset) 15pwrite(int d, const void *buf, size_t nbytes, off_t offset)
15{ 16{
16 off_t cpos, opos, rpos; 17 off_t cpos;
17 ssize_t bytes; 18 ssize_t bytes;
19 int save_errno;
20
18 if((cpos = lseek(d, 0, SEEK_CUR)) == -1) 21 if((cpos = lseek(d, 0, SEEK_CUR)) == -1)
19 return -1; 22 return -1;
20 if((opos = lseek(d, offset, SEEK_SET)) == -1) 23 if(lseek(d, offset, SEEK_SET) == -1)
21 return -1;
22 if((bytes = write(d, buf, nbytes)) == -1)
23 return -1; 24 return -1;
24 if((rpos = lseek(d, cpos, SEEK_SET)) == -1) 25 bytes = write(d, buf, nbytes);
26 save_errno = errno;
27 if(lseek(d, cpos, SEEK_SET) == -1)
25 return -1; 28 return -1;
29 errno = save_errno;
26 return bytes; 30 return bytes;
27} 31}
28 32
diff --git a/update.sh b/update.sh
index e4377d3..4b2c4dd 100755
--- a/update.sh
+++ b/update.sh
@@ -30,6 +30,7 @@ fi
30set +e 30set +e
31tag=`git describe --exact-match --tags HEAD 2>/dev/null` 31tag=`git describe --exact-match --tags HEAD 2>/dev/null`
32is_tag=$? 32is_tag=$?
33set -e
33# adjust for 9 hour time delta between trees 34# adjust for 9 hour time delta between trees
34release_ts=$((`git show -s --format=%ct $tag|tail -1` + 32400)) 35release_ts=$((`git show -s --format=%ct $tag|tail -1` + 32400))
35commit=`git -C openbsd rev-list -n 1 --before=$release_ts origin/$openbsd_branch` 36commit=`git -C openbsd rev-list -n 1 --before=$release_ts origin/$openbsd_branch`
@@ -45,7 +46,6 @@ else
45 git -C openbsd checkout $openbsd_branch 46 git -C openbsd checkout $openbsd_branch
46 git -C openbsd pull 47 git -C openbsd pull
47fi 48fi
48set -e
49 49
50# setup source paths 50# setup source paths
51CWD=`pwd` 51CWD=`pwd`
@@ -248,7 +248,6 @@ gen_asm_mips o32 bn mips bn-mips
248gen_asm_mips o32 bn mips-mont mont-mips 248gen_asm_mips o32 bn mips-mont mont-mips
249gen_asm_mips o32 sha sha1-mips sha1-mips 249gen_asm_mips o32 sha sha1-mips sha1-mips
250gen_asm_mips o32 sha sha512-mips sha256-mips 250gen_asm_mips o32 sha sha512-mips sha256-mips
251gen_asm_mips o32 sha sha512-mips sha512-mips
252 251
253echo generating mips64 ASM source for elf 252echo generating mips64 ASM source for elf
254gen_asm_mips 64 aes aes-mips aes-mips64 253gen_asm_mips 64 aes aes-mips aes-mips64
@@ -334,10 +333,23 @@ touch tests/empty.c
334for i in `find $libcrypto_regress -name '*.[ch]'`; do 333for i in `find $libcrypto_regress -name '*.[ch]'`; do
335 $CP "$i" tests 334 $CP "$i" tests
336done 335done
336# x509/verify.c collides with x509/bettertls/verify.c when flattened.
337$CP $libcrypto_regress/x509/verify.c tests/x509_verify.c
338# Do not copy x509/bettertls/verify.c: it requires the large bettertls
339# certificate corpus, which is not worth bundling in release tarballs.
337$CP $libcrypto_regress/evp/evptests.txt tests 340$CP $libcrypto_regress/evp/evptests.txt tests
338$CP $libcrypto_regress/aead/*.txt tests 341$CP $libcrypto_regress/aead/*.txt tests
339$CP $libcrypto_regress/ct/ctlog.conf tests 342$CP $libcrypto_regress/ct/ctlog.conf tests
340$CP $libcrypto_regress/ct/*.crt tests 343$CP $libcrypto_regress/ct/*.crt tests
344$CP $libcrypto_regress/x509/callback.pl tests
345$CP $libcrypto_regress/x509/make-dir-roots.pl tests
346rm -rf tests/certs
347mkdir -p tests/certs
348for i in $libcrypto_regress/certs/[0-9]*; do
349 if [ -d "$i" ]; then
350 $CP -R "$i" tests/certs
351 fi
352done
341$CP $libcrypto_regress/x509/policy/*.pem tests 353$CP $libcrypto_regress/x509/policy/*.pem tests
342$CP $libcrypto_regress/mlkem/*.txt tests 354$CP $libcrypto_regress/mlkem/*.txt tests
343 355
@@ -359,6 +371,12 @@ $CP $libssl_regress/ssl/testssl tests
359for i in `find $libssl_regress -name '*.c'`; do 371for i in `find $libssl_regress -name '*.c'`; do
360 $CP "$i" tests 372 $CP "$i" tests
361done 373done
374# tls/tlstest.c collides with libtls/tls/tlstest.c when flattened.
375$CP $libssl_regress/tls/tlstest.c tests/ssl_tlstest.c
376# verify/verify.c collides with other verify tests when flattened.
377rm -f tests/verify.c
378$CP $libssl_regress/verify/verify.c tests/ssl_verify.c
379$CP $libssl_regress/verify/create-libressl-test-certs.pl tests
362$CP $libssl_regress/unit/tests.h tests 380$CP $libssl_regress/unit/tests.h tests
363$CP $libssl_regress/certs/*.pem tests 381$CP $libssl_regress/certs/*.pem tests
364$CP $libssl_regress/certs/*.crl tests 382$CP $libssl_regress/certs/*.crl tests
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-09-03 07:38:44 +0000