aboutsummaryrefslogtreecommitdiff
path: root/configure.ac (follow)
Commit message (Collapse)AuthorAgeFilesLines
* implement compatibility shim for __warn_referencesBrent Cook2015-07-171-0/+12
| | | | This will allow us to warn about deprecated function references at link-time.
* fixup how OPENSSLDIR is derived and expandedBrent Cook2015-07-151-4/+3
| | | | | | | | As per http://www.gnu.org/software/autoconf/manual/autoconf-2.69/html_node/Installation-Directory-Variables.html we should not try to expand variables like sysconfdir in the configure script, but rather derive the correct value in the Makefiles instead. This fixes missing expansions as the preprocessor define.
* Improve automatic handling of OPENSSLDIRBrent Cook2015-07-121-1/+4
| | | | | Install a default cert.pem, openssl.cnf, x509v3.cnf in OPENSSLDIR, which is derived by default from sysconfdir and the prefix setting.
* remove unused --with-enginesdir configuration parameterBrent Cook2015-07-081-6/+0
|
* set 'foreign' flag in automakeBrent Cook2015-06-131-1/+1
| | | | | Avoid warnings about following GNU standards, since this is not a GNU project. Thanks to Doug Hogan for pointing this out.
* refactor configure into separate m4 macrosBrent Cook2015-05-231-263/+32
| | | | this allows for some reusability with libtls
* adding support for bitrigDave Huseby2015-05-141-1/+1
|
* use the same gcc test for AIX as HP-UXBrent Cook2015-04-271-1/+1
|
* modify for HP-UX build, choose correct CFLAGS for gcc.kinichiro2015-04-271-1/+1
|
* remove unneeded check for sys/sysctl.hBrent Cook2015-04-191-1/+1
|
* use alternate cflags on AIX and HP-UX vendor compilersBrent Cook2015-04-191-1/+11
|
* Revert configure-time checks for -Wall/-std=gnu99Brent Cook2015-04-141-36/+14
| | | | | There is a problem with these on some compilers, revert while a solution is found.
* make compiler checks for -Wall and -std=gnu99Brent Cook2015-04-141-14/+36
| | | | Yes, there are compilers that do not understand or need these.
* remove issetuigid wrappers, now that all getenv calls are gone.Brent Cook2015-04-141-7/+1
| | | | | | | | | | | From deraadt@ upstream: Remove all getenv() calls, especially those wrapped by issetugid(). getenv()'s wrapped by issetugid() are safe, but issetugid() is ... difficult to impliment on many operating systems. By accident, a grand experiment was run over the last year, where issetugid() returned 1 (the safe value) on a few operating systems. Noone noticed & complained that certain environment variables were not working.......
* Add experimental AIX support.Brent Cook2015-03-311-0/+5
| | | | | This includes a WIP failsafe issetugid for now, while research continues on the proper way to do this in a race-free fashion in AIX.
* move define to CPPFLAGSBrent Cook2015-03-221-1/+1
|
* Merged support for using _OPENBSD_SOURCE on NetBSD 8.xBrent Cook2015-03-221-0/+1
|\
| * Reuse _OPENBSD_SOURCE namespace on NetBSD (>=8.x)Kamil Rytarowski2015-03-081-0/+1
| |
* | rework CFLAGS/CPPFLAGS settings during configurationBrent Cook2015-03-221-9/+13
| | | | | | | | | | | | Move define adjustments to CPPFLAGS. Adjust user CFLAGS directly, do not override during configuration. USER_CFLAGS is not necessary to build libcompat_noopt correctly.
* | move clang flags adjustment next to the check, fix typoBrent Cook2015-03-221-3/+3
| |
* | check for build tools earlier in configurationBrent Cook2015-03-221-7/+6
| |
* | Merge native cygwin supportBrent Cook2015-03-211-0/+8
|\ \
| * | rework tests Makefile.amBrent Cook2015-03-211-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | There are so many test exceptions that need handling that it is easier to simply edit it directly rather than doing autogeneration anymore. This also puts biotest and pidwraptest behind a new --enable-extratests option, so they are easy to run but are not enabled by default.
| * | Drop test for adding -lssp again, not required with latest libtoolCorinna Vinschen2015-03-031-1/+1
| | | | | | | | | | | | Signed-off-by: Corinna Vinschen <github@cygwin.de>
| * | Add preliminary Cygwin supportCorinna Vinschen2015-03-031-1/+5
| |/ | | | | | | Signed-off-by: Corinna Vinschen <github@cygwin.de>
* | enable libtls by defaultBrent Cook2015-03-191-5/+1
| | | | | | | | | | | | | | | | The API/ABI for the LibreSSL 2.1.x series is now fixed, so we can safely enable libtls it by default. This is useful for new OpenNTPD and OpenSMTPD releases as well. ok deraadt@ beck@ sthen@
* | update __STRICT_ALIGNMENT checkBrent Cook2015-03-081-3/+7
| |
* | specify -static-libgcc for mingw buildsBrent Cook2015-03-081-1/+2
| | | | | | | | Avoid external external dependencies on 32-bit windows builds.
* | avoid doubling user-specified cflagsBrent Cook2015-03-071-2/+2
|/
* separate the BSWAP check from the actionBrent Cook2015-03-011-14/+17
| | | | checks need to be unconditional with autoconf
* check if the BSWAP assembly for ARM works before buildingBrent Cook2015-03-011-0/+8
|
* add windows-specific hardening optionsBrent Cook2015-02-241-8/+23
| | | | | | This enables DEP and ALSR capabilities. Stack protection is enabled optionally, there are some extra linking steps required that make it difficult to enable by default.
* remove openat requirement for building certhashBrent Cook2015-02-231-2/+2
|
* add missing line continuationBrent Cook2015-02-191-1/+1
|
* disable system issetugid on OS X since it is not fork-safeBrent Cook2015-02-171-0/+5
| | | | | Noticed while testing similar code for AIX. ok beck@
* add strsep fallback for libtlsBrent Cook2015-02-141-1/+2
|
* conditionally build certhash into openssl(1)Brent Cook2015-02-141-0/+2
| | | | | For now, look for openat and symlink. We may switch to just needing symlink later.
* add NetBSD shims for arc4randomBrent Cook2015-01-211-1/+8
| | | | | | The current NetBSD release, 6.1.5, fails to reseed arc4random fork. Work around it by providing arc4random/getentropy shims. Revisit when NetBSD 7 is available.
* catch GCC versions that only warn on unused flagsBrent Cook2015-01-061-3/+3
| | | | | Noticed while building with GCC 4.2 with HP-UX. Switching the ERROR to a WARN for a first release while we continue to survey the field.
* remove bash-style comparisons from testsBrent Cook2015-01-061-3/+3
|
* Add support for HP-UXkinichiro2015-01-061-0/+6
| | | | | | | | | | tested on: HP-UX 11.31 ia64, gcc 4.7.1(HP AllianceOne version) gcc 4.2.3(http://hpux.connect.org.uk) HP C/aC++ HP-UX defaults to use LP32 and it treats long as 32 bit (= 4 bytes). This build forces LP64 for treating long as 64 bit.
* quoting and ensure old_*flags are restored before the 'else'Brent Cook2015-01-051-8/+10
|
* preserve CFLAGS between hardening checks, enable mingwBrent Cook2015-01-051-26/+46
| | | | | | Allow hardening CFLAGS for mingw that do not cause link-time failures. Add proper quoting on flags for commas Check LDFLAGS for linker-only flags.
* simplify hardening check logic, disable for mingwBrent Cook2015-01-051-38/+33
| | | | | | | | | | | Rather than doing separate linker/compiler checks, just build a non-empty program with each so that the compiler will actually try to use the hardening features. Reduce redundancy in the macro calls by just setting the flag that was just tested. Also, disable hardening for mingw, since its trying to use a libssp-0.dll file that I can't find right now. The detected hardening flags break mingw builds currently.
* Change comments to remark on script not being needed for clang >= 5.1Jim Barlow2015-01-011-1/+1
|
* Fix typo causing output of clang test to read "CLANG" instead of yes/noJim Barlow2014-12-311-1/+1
|
* Merge recent upstream changes with compiler hardeningJim Barlow2014-12-301-4/+19
|\ | | | | | | | | Conflicts: configure.ac
| * enable __STRICT_ALIGNMENT on sparcBrent Cook2014-12-271-0/+6
| |
| * do not mark GNU_STACK WX in ELFs generated from assemblyBrent Cook2014-12-221-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | When generating ELF objects from assembly, gcc and clang mark the GNU_STACK program headers as RWX by default. This is a security issue, so we make sure it is marked only RW. This modifies Anthony G. Basile's original patch for Linux to set .note.GNU-stack whenever the assembler supports it. It is surprising that any modern toolchain would enable an executable stack without an explicit request. The number of programs that need an executable stack is surely much smaller than the number of programs that include assembly.
* | configure.ac: use executable hardening where availableJim Barlow2014-12-231-0/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Where available, enable stack smashing protection, fortify source, no-strict-overflow, and read only relocations. Many Linux distributions automatically enable most of these options. They are no brainers. The difference introduced here is in asking for a few more aggressive options. An option to disable the more aggressive options is provided (--disable-hardening). When set, configure will fall back to the default CFLAGS on the system - in many cases that will still be hardened. There is no point in going further than that. Options enabled are: -fstack-protector-strong is a relatively new GCC-4.9 feature that is supposed to give a better balance between performance and protection. -all is considered too aggressive, but was used in Chromium and other security critical systems until -strong became available. Follow their lead and use -strong when possible. clang 6.0 supports -all but not -strong. _FORTIFY_SOURCE replaces certain unsafe C str* and mem* functions with more robust equivalents when the compiler can determine the length of the buffers involved. -fno-strict-overflow instructs GCC to not make optimizations based on the assumption that signed arithmetic will wrap around on overflow (e.g. (short)0x7FFF + 1 == 0). This prevents the optimizer from doing some unexpected things. Further improvements should trap signed overflows and reduce the use of signed to refer to naturally unsigned quantities. I did not set -fPIE (position independent executables). The critical function of Open/LibreSSL is as a library, not an executable. Tested on Ubuntu Linux 14.04.1 LTS, OS X 10.10.1 with "make check". Signed-off-by: Jim Barlow <jim@purplerock.ca>
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-16 23:06:35 +0000