aboutsummaryrefslogtreecommitdiffstats
path: root/Configure
Commit message (Collapse)AuthorAgeFilesLines
* Add mandoc output support for manpagesEnji Cooper2026-07-201-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change modifies the Makefile generator to support mandoc format manpages, in lieu of \*roff format manpages. After this commit the user has the ability of specifying the manpage format to the `--manpage-format` flag. The 2 supported manpage formats as of writing are "mdoc" and "roff" and the default remains the "roff" format for legacy and portability reasons. The mandoc format requires pod2mdoc to be installed, whereas the roff output format requires pod2man to be installed. The former requires an additional utility be installed, whereas the latter uses pod2man, a utility that has been present with perl distributions for well over a decade. mandoc format support is being added as it is an easier/arguably more structured manpage format to parse, making it easier for downstream consumers like FreeBSD to implement OS-specific build support, as the minimum dependencies for the OpenSSL build process are more involved than the tools available for the FreeBSD OS bootstrapping process. Signed-off-by: Enji Cooper <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jul 20 09:52:29 2026 (Merged from https://github.com/openssl/openssl/pull/28450)
* test: add Windows unit tests setup and initial dgram testJakub Zelenka2026-07-151-9/+62
| | | | | | | | | | | | | | | | | This adds an initial setup for unit testing on Windows that allows mocking of system functions using Detour library. This works only for library functions and not object function like wrap so it is a bit limited but it is still useful for BIO mocking. An initial BIO bss_dgram test is added covering the Windows specific parts. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Igor Ustinov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Wed Jul 15 16:00:35 2026 (Merged from https://github.com/openssl/openssl/pull/31915)
* Add unit testing cmocka based frameworkJakub Zelenka2026-07-091-1/+31
| | | | | | | | | | | | | | | This adds the unit testing framework that extends the build so it can be enabled and tests are built. It is executed as part of the test using a recipe which executes all unit tests. The documentation is added with more info about writing the unit tests. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Jul 9 17:39:14 2026 (Merged from https://github.com/openssl/openssl/pull/30788)
* Add WRAP build.info variableJakub Zelenka2026-07-091-0/+13
| | | | | | | | | | This is used for adding per target --wrap ld flags for each listed function. Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Jul 9 17:39:12 2026 (Merged from https://github.com/openssl/openssl/pull/30788)
* Suppress function pointer type validation in clang ubsanNeil Horman2026-07-081-1/+5
| | | | | | | | | | | | | | | | | | | | | | | We've been concerned about ubsan errors comming with more recent versions of clang. specifically versions of clang later than 17 generate hundreds of function pointer type validation errors, i.e. assigning a function of type void (*)(TYPE *) to a function pointer of type void (*)(void *). Fixing these requires the creation of lots of thunk function that get littered through the code base, and are generally unpleasant to carry. A better fix requires siginficant code refactoring, and potentially large changes to our ABI, which we can't support until the next major release. So, for now, just suppress those ubsan errors, so we can more properly deal with the issue when we are able. Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Wed Jul 8 16:01:12 2026 (Merged from https://github.com/openssl/openssl/pull/31837)
* Configure, INSTALL.md: make atexit deprecated disablableEugene Syromiatnikov2026-06-181-2/+3
| | | | | | | | | | | | | | | | As the atexit handler was removed in [1], no-atexit configuration option has no effect, make that explicit by disallowing enabling atexit, and update the documentation accordingly. [1] https://github.com/openssl/openssl/pull/29385 References: https://github.com/openssl/openssl/issues/30742 Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Thu Jun 18 12:20:34 2026 (Merged from https://github.com/openssl/openssl/pull/30767)
* build: make enable-asan work for VC targetsJakub Zelenka2026-06-101-8/+11
| | | | | | | | | | | Configure assumed GCC/Clang sanitizer spellings, so enable-asan was a no-op on MSVC. Emit /fsanitize=address instead of -fsanitize=address on VC targets. Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> MergeDate: Wed Jun 10 12:53:11 2026 (Merged from https://github.com/openssl/openssl/pull/31366)
* Configure: update $apitable with the recent versionsEugene Syromiatnikov2026-05-191-9/+15
| | | | | | | | | | | | | | | Fill $apitable with all the major.minor.0 versions up to the current one in development. Note that while 3.5 hasn't had any APIs deprecated, it still makes sense to support passing it as an "API level". Resolves: https://github.com/openssl/openssl/issues/31196 Reported-by: Oliver Roberts <[email protected]> Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Tue May 19 09:33:49 2026 (Merged from https://github.com/openssl/openssl/pull/31198)
* Add valgrind CT support to ML-DSAViktor Dukhovni2026-04-221-0/+42
| | | | | | | | | | | Also slightly refactor the ML-KEM version to share the necesasry defines, and add a daily CI run to check both (presently, for just some platforms with known working valgrind support). Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Wed Apr 22 07:55:14 2026 (Merged from https://github.com/openssl/openssl/pull/30863)
* Add IKEV2KDF implementationHelen Zhang2026-03-241-1/+2
| | | | | | | | | | In compliance with RFC7296 and SP800-135 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Tue Mar 24 17:21:21 2026 (Merged from https://github.com/openssl/openssl/pull/30121)
* Configure: Re-add srtpkdf disablableTomas Mraz2026-03-171-0/+1
| | | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Tue Mar 17 11:16:00 2026 (Merged from https://github.com/openssl/openssl/pull/30446)
* ECDH and ECDSA cannot be really disabled standaloneTomas Mraz2026-03-171-3/+1
| | | | | | | | | We should not pretend it can. Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Tue Mar 17 11:15:59 2026 (Merged from https://github.com/openssl/openssl/pull/30446)
* feat: Disabled features are generated during configure automaticallyPaul Louvel2026-03-131-75/+104
| | | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Fri Mar 13 15:50:43 2026 (Merged from https://github.com/openssl/openssl/pull/30212)
* Copyright year updatesopenssl-machine2026-03-101-1/+1
| | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Tue Mar 10 14:37:54 2026 Release: yes
* ECH build artefacts and a bit of codeStephen Farrell2026-02-201-1/+2
| | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/25193)
* Remove remaining RAND_DRBG.Frederik Wedel-Heinen2026-02-171-2/+1
| | | | | | | | Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Tue Feb 17 14:09:07 2026 (Merged from https://github.com/openssl/openssl/pull/29782)
* Add abilty to use static vcruntimeNeil Horman2026-02-171-0/+2
| | | | | | | | | | | | Add a config option to selectively enable disable static vcruntime linkage (default disabled, implying dynamic vcruntime linkage) Fixes #12210 Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Tue Feb 17 09:43:37 2026 (Merged from https://github.com/openssl/openssl/pull/29995)
* Remove disabled-optimization warning againMilan Broz2026-01-231-1/+0
| | | | | | | | | | | | | | | | This warning does not play well in combination with sanitizers and its value is dubious. Instead of complicated decisions based on configuration flags just remove it from global list. Fixes: #29673 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Fri Jan 23 14:00:29 2026 (Merged from https://github.com/openssl/openssl/pull/29714)
* Add SRTPKDF implementationHelen Zhang2026-01-231-1/+2
| | | | | | | | | In compliance with RFC 3711, Section 4.3.3 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Fri Jan 23 10:19:32 2026 (Merged from https://github.com/openssl/openssl/pull/29435)
* Deprecate support of weak elliptic curves in TLS by defaultDmitry Belyavskiy2026-01-221-0/+1
| | | | | | | | | | | | See RFC 8422, section 5.1.1 Reviewed-by: Alicja Kario <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Thu Jan 22 10:00:08 2026 (Merged from https://github.com/openssl/openssl/pull/29658)
* Add float-conversion to default strict warningsMilan Broz2026-01-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | As discussed, bad-function-cast and conversion produces strange results. Add at least float-conversion - Warn for implicit conversions that reduce the precision of a real value. Also fix ct_test absolute value seconds calculation (without using math.h) and then converts is to time_t. (n.b. this is not stricly needed for the relaxed warnings, but it is more readable) Fixes: https://github.com/openssl/project/issues/1816 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Thu Jan 22 09:58:07 2026 (Merged from https://github.com/openssl/openssl/pull/29663)
* Fix type-limits and add this warning to default strict warningsMilan Broz2026-01-201-1/+1
| | | | | | | | | | | | | | One mistake recently introduced in commit b6aed64e47b. Fixes: https://github.com/openssl/project/issues/1815 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Tue Jan 20 18:44:58 2026 (Merged from https://github.com/openssl/openssl/pull/29662)
* Fix unterminated-string-initialization and add this warning to strict warningsMilan Broz2026-01-201-1/+0
| | | | | | | | | | | | | | | | | | | The -Wunterminated-string-initialization is a strange gcc warning, as C99 allows non-nul string initialization. Note, it is included in -Wextra, but does not exist in old gcc versions. However, it can report other real bugs. Fixes: https://github.com/openssl/project/issues/1814 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Tue Jan 20 18:43:39 2026 (Merged from https://github.com/openssl/openssl/pull/29661)
* KDF: Add configuration options to disable many of the KDF algorithms.slontis2026-01-191-5/+16
| | | | | | | | | This includes KDF's for ss,x963,hmac-drbg,KB,KRB5,PVK,SNMP,SSH and X942. SSKDF/X963KDF Changes: Modify code to handle algorithms being disabled via configuration options. Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29576)
* Disabling explicit EC curves encodingDmitry Belyavskiy2026-01-171-1/+3
| | | | | | | | In case the parameters don't exactly match the well-known ones Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Simo Sorce <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29639)
* Add disabled-optimization and pointer-arith to compiler warningsMilan Broz2026-01-151-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | These flags seems not to be part of -Wextra, but looks like could be useful in CI. According to gcc man page: disabled-optimization Warn if a requested optimization pass is disabled. pointer-arith Warn about anything that depends on the "size of" a function type or of "void". Fixes: https://github.com/openssl/project/issues/1809 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> MergeDate: Thu Jan 15 16:16:40 2026 (Merged from https://github.com/openssl/openssl/pull/29622)
* Allow enabling deprecated flags that haven't been removed yetAndrew Dinh2025-12-231-2/+3
| | | | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29338)
* Deprecate SSL3 Configure flagsAndrew Dinh2025-12-231-11/+11
| | | | | | | | | | | | Show a deprecated warning if users attempt to run Configure script with no-ssl3, no-ssl, or no-ssl3-method. Also adds a fix to the Configure script preventing users from enabling deprecated flags. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29338)
* Remove support for SSLv3Kurt Roeckx2025-12-231-1/+1
| | | | | | | | Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29338)
* Remove crypto-mdebug-backtrace option from configNeil Horman2025-12-131-3/+1
| | | | | | | | | | | | | | | | | | | | We still build with crypto-mdebug-backtrace enabled in a few ci jobs, but it does nothing. With the upcoming merge of feature/removesslv3, the code changes there prevent the use of this option (i.e. enabling it results in configuration failure). It seems the most sensible thing to do here, given we have a major release is to eliminate the option entirely, as it hasn't done anything since 1.0.2. Fixes openssl/project#1763 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29380)
* Make no-engine config permanently set.Milan Broz2025-12-041-4/+4
| | | | | | | | | | | | | | | | | | | It enables configuration defines: OPENSSL_NO_DYNAMIC_ENGINE OPENSSL_NO_STATIC_ENGINE OPENSSL_NO_ENGINE Fixes openssl/project#1711 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Remove engine-related testsMilan Broz2025-12-041-49/+3
| | | | | | | | | | | | | | | | | | | As engines are no longer included in test, these configuration options make no longer sense. All other test should be already enabled. Fixes openssl/project#1376 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Remove top-level engines dir.Milan Broz2025-12-041-1/+0
| | | | | | | | | | | | Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Configure: deprecate-disable engine related optionsNorbert Pocs2025-12-041-1/+8
| | | | | | | | | | | | Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Remove OPENSSL_NO_STATIC_ENGINE macroNorbert Pocs2025-12-041-14/+1
| | | | | | | | | | | | | | Resolves: https://github.com/openssl/project/issues/1364 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Remove OPENSSL_NO_DYNAMIC_ENGINENorbert Pocs2025-12-041-43/+10
| | | | | | | | | | | | | | | | | | Most of the ifdefs were removed, but we want to rewrite the dasync engine to a provider. Therefore that code was not removed; instead a new temporary macro was added named TODO_REWRITE_ME_DASYNC_PROVIDER. Resolves: https://github.com/openssl/project/issues/1363 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Engine removal: Silence the CI tests about enginesNorbert Pocs2025-12-041-0/+16
| | | | | | | | | | | | | | | | | | | As we can't do every change in one big PR (and we also don't want), therefore there always will be failing tests until everything is resolved/cleaned up. This way we silence the CI about engine tests and later we can reenable them to see what else needs to be fixed. Resolves: https://github.com/openssl/project/issues/1371 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Configure: Warn about deprecated option when enabledNorbert Pocs2025-11-281-0/+4
| | | | | | | | | | | | Currently the deprecated configure option is warned only when "(no|disabled)-feature" is used, but wasn't warning when "enable-feature" was passed as a config option. Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29229)
* Disable also argon2, scrypt and slh-dsa with no-bulkTomas Mraz2025-10-221-3/+3
| | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/28970)
* fix: Apply cascade-disables before showing statusBMDan2025-08-111-0/+2
| | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> (Merged from https://github.com/openssl/openssl/pull/22621)
* fix: restore missing --help in ConfigureBMDan2025-08-111-8/+60
| | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> (Merged from https://github.com/openssl/openssl/pull/22621)
* add a handshake memory failure testNeil Horman2025-08-061-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | We would like to be able to test our memory failure paths, but forcing malloc to return NULL at certain points in time. This test does that, by running a sepcific workload n+1 time. In this case the workload is a simple ssl handshake. We run 1 test which sets our malloc wrapper into record mode, in which it just acts as a pass through to the system malloc call and records the number of times it was called. Then we run a second test, which does the same handshake N times, where N is the number of times malloc was called in the previous test. For each iteration in i=0..N we fail the ith malloc operation. We don't check for functional failures in the second test (as we expect failures), we just want to make sure that (a) we don't crash and (b) asan doesn't report any errors. Currently, we get _lots_ of asan failures, but we can use this test to log issues for that and fix those up. Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/28078)
* Make LMS disabled by defaultPauli2025-07-101-0/+1
| | | | | | Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/27885)
* Add Configurable "lms" optionslontis2025-07-101-1/+2
| | | | | | | | | | This option will be used by the base code for enabling Leighton-Micali Signatures (LMS) Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/27885)
* Add branch coverage to our coveralls runNeil Horman2025-06-201-8/+0
| | | | | | | | | | | | Coveralls is capable of reporting not only covered lines in a build, but also the number of times a given branch was taken vs. not taken. This will help us identify locations where we might make better use of the openssl_likely and openssl_unlikely macros to optimize branch prediction when building openssl Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/27839)
* Add pgo build typeNeil Horman2025-06-201-0/+12
| | | | | | | | | | | | | | | | | | | One of the ways we can optimize our builds is with profile guided optimization. This entails doing several things: 1) Building with --coverage 2) Running an application against the openssl library from step (1) to generate profile data 3) rebuilding openssl using the input profile from step (2) to optimize the build. This new build configuration will let developers use the profiled data to see what type of optimizations might be possible, as well as giving end users the ability to squeeze a bit more performance out of openssl Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/27839)
* Disable unterminated-string-initialization in strict-warningsNeil Horman2025-05-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Recently updated to fedora 42, which includes an updated gcc, which triggers a new warning: test/afalgtest.c:44:9: error: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (18 chars into 17 available) [-Werror=unterminated-string-initialization] 44 | "\x53\x69\x6e\x67\x6c\x65\x20\x62\x6c\x6f\x63\x6b\x20\x6d\x73\x67" The warning occurs because in some locations we create char buffers of length X, and fill it with X bytes of data, truncating the NULL terminator. We could fix it by adding the nonstring attribute, but given that: 1) Adding attributes might impact other platforms that don't understand the attribute. 2) We often create char buffers that don't expect a NULL terminator. 3) Converting the unsigned char arrays to uint8_t, or other types that could be interpreted as non-strings has no impact, only applying the nonstring attribute silences the warning. It seems more sensible to just disable the warning entirely Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/27490)
* Copyright year updatesopenssl-machine2025-03-121-1/+1
| | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Release: yes
* x509: allow SAN URIs to contain userinfoIvan Stanković2025-03-041-1/+1
| | | | | | | | | | | | | | The way we're currently handling SAN URIs does not allow for userinfo, meaning the name constraint check on such URIs will fail. Fix this by skipping over the userinfo component: authority = [ userinfo "@" ] host [ ":" port ] (per RFC 3986). Reviewed-by: David von Oheimb <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> (Merged from https://github.com/openssl/openssl/pull/25861)
* Make RFC8422 deprecated TLS EC curves disablableViktor Dukhovni2025-02-261-2/+4
| | | | | | | | | Also move the deprecated curves to the end of the list, and order the soon most preferred groups first. Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/26873)
generated by cgit (git 2.51.2) at 2026-10-25 15:05:35 +0100