openssl/Configure, branch OpenSSL_1_0_2m

Add -Wundef to --strict-warnings options. Fix some warnings.

2017-02-23T15:07:21Z

Reviewed-by: Andy Polyakov Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/2714)

Allow parallell make in Configure

2017-01-31T17:47:53Z

If someone tries this: MAKE='make -j8' ./config then Configure ends up doing this: make -j8 links depend gentests Doing those three in parallell leads to a race condition that may very well cause issue such as tests not being run (because they all get linked to a dummy that does nothing instead of the real test). To mitigate this, execute the three targets in one make call each. Reviewed-by: Emilia Käsper (Merged from https://github.com/openssl/openssl/pull/2332)

INSTALL: clarify 386 and no-sse2 options.

2016-11-26T21:24:10Z

This is 1.0.2-specific reformat of 5ae5dc96610f0a598dac9d2f267b5c0ddd77b2e4. Reviewed-by: Rich Salz

Configure: Improve incremental build time

2016-11-16T07:08:27Z

When Makefile/opensslconf.h is unchanged, don't write it at all. Currently every time Configure is executed, these files are overwritten. Makefile leads to regeneration of buildinf.h, and opensslconf.h is itself a central header. As a result, Configure triggers full rebuild, even if nothing is changed. Reviewed-by: Rich Salz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/1370)

update default dependencies

2016-09-15T23:10:00Z

Reviewed-by: Richard Levitte

Improve the definition of STITCHED_CALL in e_rc4_hmac_md5.c

2016-08-26T19:19:18Z

The definition of STITCHED_CALL relies on OPENSSL_NO_ASM. However, when a configuration simply lacks the assembler implementation for RC4 (which is where we have implemented the stitched call), OPENSSL_NO_ASM isn't implemented. Better, then, to rely on specific macros that indicated that RC4 (and MD5) are implemented in assembler. For this to work properly, we must also make sure Configure adds the definition of RC4_ASM among the C flags. (partly cherry picked from commit 216e8d91033d237880cff7da0d02d46d47bae41b) Reviewed-by: Andy Polyakov

Fix the no-tls1 option

2016-08-26T12:38:50Z

This also fixes no-tls which is an alias for no-tls1 in 1.0.2 (it is not possible to do no-tls1_1 or no-tls1_2 in 1.0.2). Because it is not possible to disable TLS1.1 or TLS1.2 it no longer follows that disabling TLS1.0 should force the disabling of tlsext. Also a few missing ifdef guards. GitHub Iusse#935 Reviewed-by: Rich Salz

Add support for RC / WINDRES env variables

2016-05-17T15:18:25Z

RT#2558 Reviewed-by: Matt Caswell

Disable EXPORT and LOW SSLv3+ ciphers by default

2016-03-01T11:20:35Z

Reviewed-by: Emilia Käsper

Disable SSLv2 default build, default negotiation and weak ciphers.

2016-03-01T11:20:10Z

SSLv2 is by default disabled at build-time. Builds that are not configured with "enable-ssl2" will not support SSLv2. Even if "enable-ssl2" is used, users who want to negotiate SSLv2 via the version-flexible SSLv23_method() will need to explicitly call either of: SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2); or SSL_clear_options(ssl, SSL_OP_NO_SSLv2); as appropriate. Even if either of those is used, or the application explicitly uses the version-specific SSLv2_method() or its client or server variants, SSLv2 ciphers vulnerable to exhaustive search key recovery have been removed. Specifically, the SSLv2 40-bit EXPORT ciphers, and SSLv2 56-bit DES are no longer available. Mitigation for CVE-2016-0800 Reviewed-by: Emilia Käsper