When experimental-store is enabled, it does not compile due to the
change to opaque data structures.

Change CRYPTO_add() to EVP_PKEY_up_ref() as needed.

Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>

RT: #4263, GH: #579

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>

The turn has come to have crypto/opensslconf.h.in get run through
util/dofile.pl.  The consequence is that a large number of variables
get moved to the %config table.

Also, the string variables $openssl_*, which were populated with cpp
lines, all being of the form "#define SOMETHING", were converted into
ARRAY refs in %config values, containing just the list of macros to be
defined.

Reviewed-by: Rich Salz <rsalz@openssl.org>

For this adaptation, the variables $options and $version needed to
move to %config in Configure, and why not move all other variables
holding diverse version numbers at the same time?

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>

This includes a start on how to install missing modules.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Reviewed-by: Rich Salz <rsalz@openssl.org>

Because we're using Text::Template and we know it's a non core Perl
module, we choose to bundle it into our source, for convenience.

external/perl/Downloaded.txt document what modules we choose to bundle
this way and exactly where we downloaded it from.

With this changes comes the transfer module for with_fallback.

Reviewed-by: Rich Salz <rsalz@openssl.org>

For our own convenience, we need a mechanism to be able to fall back
on bundled Perl modules.  It's a minimal package that's called like
this:

    use with_fallback qw(Module1 Module2 ...);

For each module, it will try to require them from the system
installation, and failing that, it will temporarly add external/perl
and try to require transfer::{ModuleName}.  It requires that each
bundled Perl modules is accompanied by a small transfer module
(external/perl/transfer/ModuleName.pm in our example) that knows
exactly what to load.

Reviewed-by: Rich Salz <rsalz@openssl.org>

apps/CA.pl and tools/c_rehash are built from template files.  So far,
this was done by Configure, which created its own problems as it
forced everyone to reconfigure just because one of the template files
had changed.
Instead, have those files created as part of the normal build in apps/
and in tools/.

Furthermore, this prepares for a future where Configure may produce
entirely other build files than Makefile, and the latter can't be
guaranteed to be the holder of all information for other scripts.
Instead, configdata.pm (described below) becomes the center of
configuration information.

This introduces a few new things:

%config         a hash table to hold all kinds of configuration data
                that can be used by any other script.
configdata.pm   a perl module that Configure writes.  It currently
                holds the hash tables %config and %target.
util/dofile.pl  a script that takes a template on STDIN and outputs
                the result after applying configuration data on it.
                It's supposed to be called like this:

                        perl -I$(TOP) -Mconfigdata < template > result

                or

                        perl -I$(TOP) -Mconfigdata templ1 templ2 ... > result

                Note: util/dofile.pl requires Text::Template.

As part of this changed, remove a number of variables that are really
just copies of entries in %target, and use %target directly.  The
exceptions are $target{cflags} and $target{lflags}, they do get copied
to $cflags and $lflags.  The reason for this is that those variable
potentially go through a lot of changes and would rather deserve a
place in %config.  That, however, is for another commit.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>

It's time for print_table_entry to get a bit of refreshment.  The way it
was put together, we needed to maintain the list of known configuration
keys of interest twice, in different shapes.  This is error prone, so
move the list of strings to a common list for all printing cases, and
use simple formatting of lines to do the actual printout based on that
list.

Reviewed-by: Rich Salz <rsalz@openssl.org>

The code is trying to interpolate the value of the BASE_SECTION macro,
but due to excess escaping, it instead prints the string "BASE_SECTION".

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>

Some things to ignore need to be properly rooted, and use a bit more
precision on ignoring 'lib', as that maybe be a perfectly valid
directory name to add into git elsewhere in the source tree.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Reviewed-by: Rich Salz <rsalz@openssl.org>

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>

Change to reflect changes in dynamic_fns

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>

Reviewed-by: Matt Caswell <matt@openssl.org>

Time to get rid of @MK1MF_Builds and introduce a more flexible
'build_scheme' configuration key.  Its value may be a string or an
array of strings, meaning we need to teach resolve_config how to
handle ARRAY referenses.

The build scheme is a word that selects a function to create the
appropriate result files for a certain configuration.  Currently valid
build schemes aer "mk1mf" and "unixmake", the plan is however to add
at least one other for a more universal build scheme.

Incidently, this also adds the functions 'add' and 'add_before', which
can be used in a configuration, so instead of having to repeatedly
write a sub like this:

	key1 => sub { join(" ", @_, "myvalues"); },
	key2 => sub { join(" ", "myvalues", @_); },

one could write this:

	key1 => add(" ", "myvalues"),
	key2 => add_before(" ", "myvalues"),

The good point with 'add' and 'add_before' is that they handle
inheritances where the values are a misture of scalars and ARRAYs.  If
there are any ARRAY to be found, the resulting value will be an ARRAY,
otherwise it will be a scalar with all the incoming valued joined
together with the separator given as first argument to add/add_before.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Move the documentation of the target configuration form to
Configurations/README.

Move initial assembler object templates to
Configurations/00-BASE-templates.conf.

Furthermore, remove all variables containing the names of the
non-assembler object files and make a BASE template of them instead.
The  values from this templates are used as defaults as is.  The
remaining manipulation of data when assembler modules are used is done
only when $no_asm is false.

While doing this, clean out some other related variables that aren't
used anywhere.

Also, we had to move the resolution of the chosen target a bit, or the
function 'asm' would never catch a true $no_asm...  this hasn't
mattered before we've moved it all to the BASE template, but now it
does.

At the same time, add the default for the 'unistd' key to the BASE
template.

Reviewed-by: Rich Salz <rsalz@openssl.org>

--prefix is now exclusively used for software and manual installation.
--openssldir is not exclusively used as a default location for certs,
keys and the default openssl.cnf.

This change is made to bring clarity, to have the two less
intertwined, and to be more compatible with the usual ways of software
installation.

Please change your habits and scripts to use --prefix rather than
--openssldir for installation location now.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>

It's time to refactor the handling of %disabled so that all
information of value is in the same place.  We have so far had a few
cascading disable rules in form of code, far away from %disabled.
Instead, bring that information to the array @disable_cascade, which
is a list of pairs of the form 'test => descendents'.  The test part
can be a string, and it's simply checked if that string is a key in
%disabled, or it can be a CODEref to do a more complex test.  If the
test comes true, then all descendents are disabled.  This check is
performed until there are no more things that need to be disabled.

Also, $default_depflags is constructed from the information in
%disabled instead of being a separate string.  While a string of its
own is visually appealing, it's much too easy to forget to update it
when something is changed in %disabled.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>

The way the "reconf"/"reconfigure" argument is handled is overly
complicated.  Just grep for it first, and if it is there in the
current arguments, get the old command line arguments from Makefile.

While we're at it, make the Makefile variable CONFIGURE_ARGS hold the
value as a perl list of strings.  This makes things much safer in case
one of the arguments would contain a space.  Since CONFIGURE_ARGS is
used for nothing else, there's no harm in this.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>

It is sometimes useful (especially in automated tests) to supply
multiple trusted or untrusted certificates via separate files rather
than have to prepare a single file containing them all.

To that end, change verify(1) to accept these options zero or more
times.  Also automatically set -no-CAfile and -no-CApath when
-trusted is specified.

Improve verify(1) documentation, which could still use some work.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Reviewed-by: Richard Levitte <levitte@openssl.org>

Still need tests for trusted-first and tests that probe construction
of alternate chains.

Reviewed-by: Richard Levitte <levitte@openssl.org>

Returning untrusted is enough for for full chains that end in
self-signed roots, because when explicit trust is specified it
suppresses the default blanket trust of self-signed objects.

But for partial chains, this is not enough, because absent a similar
trust-self-signed policy, non matching EKUs are indistinguishable
from lack of EKU constraints.

Therefore, failure to match any trusted purpose must trigger an
explicit reject.

Reviewed-by: Richard Levitte <levitte@openssl.org>

These can be re-generated via:

        cd test/certs; ./setup.sh

if need be.  The keys are all RSA 2048-bit keys, but it is possible
to change that via environment variables.

    cd test/certs
    rm -f *-key.pem *-key2.pem
    OPENSSL_KEYALG=rsa OPENSSL_KEYBITS=3072 ./setup.sh

    cd test/certs
    rm -f *-key.pem *-key2.pem
    OPENSSL_KEYALG=ecdsa OPENSSL_KEYBITS=secp384r1 ./setup.sh

    ...

Keys are re-used if already present, so the environment variables
are only used when generating any keys that are missing.  Hence
the "rm -f"

Reviewed-by: Richard Levitte <levitte@openssl.org>

Reviewed-by: Richard Levitte <levitte@openssl.org>

When DANE-EE(3) matches or either of DANE-EE/PKIX-EE fails, we don't
build a chain at all, but rather succeed or fail with just the leaf
certificate.  In either case also check for Suite-B violations.

As unlikely as it may seem that anyone would enable both DANE and
Suite-B, we should do what the application asks.

Took the opportunity to eliminate the "cb" variables in x509_vfy.c,
just call ctx->verify_cb(ok, ctx)

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>

Split the read_config function into read_config that ONLY reads the
configuration files but doesn't try to resolve any of the
inheritances, and resolve_config which resolves the inheritance chain
of a given target.  Move them to the bottom of Configure, with the
rest of the helpers.

Have a new small hash table, %target, which will hold the values for
the target the user requested.  This also means that all access to the
current target data can be reduced from '$table{$target}->{key}' to a
mere '$target{key}'.

While we're at it, the old string formatted configurations are getting
obsolete, so they may as well get deprecated entirely.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Get rid of the --test-sanity option.  Since we no longer have string
based configurations, we don't have the problem with miscounting
colons any more.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Start simple, removed some unused variables and change all '<<EOF' to
'<<"EOF"'.  The latter is because some code colorizers (notably, in
emacs) cannot recognise the here document end marker unless it's
quoted and therefore assume the rest of the file is part of the here
document.

Reviewed-by: Rich Salz <rsalz@openssl.org>

Reviewed-by: Ben Laurie <ben@openssl.org>

Reviewed-by: Ben Laurie <ben@openssl.org>