build.zig: update for v3.8.1

The default C flags for all build types other than 'Debug' sets -DNDEBUG
which disables assert(), and breaks tests. This switches tests to use
'Debug' instead, reenabling asserts.

.github/rust-openssl.patch

@@ -1,13 +1,13 @@
 diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs
-index ba149c17..5274dc44 100644
+index 21ccf3d0..1cf2d184 100644
 --- a/openssl-sys/build/main.rs
 +++ b/openssl-sys/build/main.rs
-@@ -285,7 +285,7 @@ See rust-openssl documentation for more information:
+@@ -272,7 +272,7 @@ See rust-openssl documentation for more information:
              (3, 7, 0) => ('3', '7', '0'),
              (3, 7, 1) => ('3', '7', '1'),
              (3, 7, _) => ('3', '7', 'x'),
--            _ => version_error(),
+-            (3, 8, 0) => ('3', '8', '0'),
-+            _ => ('3', '7', 'x'),
++            (3, 8, _) => ('3', '8', '0'),
+             _ => version_error(),
          };
  
-         println!("cargo:libressl=true");

.github/workflows/cifuzz.yml

@@ -1,5 +1,10 @@
 name: CIFuzz
-on: [pull_request]
+
+on:
+  workflow_dispatch:
+  schedule:
+  - cron: "0 0 * * *"
+
 jobs:
   Fuzzing:
     runs-on: ubuntu-latest

.github/workflows/cmake_config.yml

@@ -0,0 +1,85 @@
+name: cmake_config
+
+on: [push, pull_request]
+
+jobs:
+  cmake-check:
+    defaults:
+      run:
+        shell: bash
+    strategy:
+      matrix:
+        os: [windows-latest, macos-latest, ubuntu-latest]
+    runs-on: ${{ matrix.os }}
+    continue-on-error: false
+    name: ${{ matrix.os }}
+    steps:
+      - name: Setup Windows dependencies
+        if: runner.os == 'Windows'
+        uses: msys2/setup-msys2@v2
+        with:
+          update: true
+          install: >-
+            autoconf
+            automake
+            diffutils
+            libtool
+            gcc
+            git
+            patch
+            perl
+
+      - name: Setup macOS dependencies
+        if: runner.os == 'macOS'
+        run: brew install automake
+
+      - uses: actions/checkout@main
+
+      - name: Prepare source tree for build (Windows)
+        if: runner.os == 'Windows'
+        run: ./autogen.sh
+        shell: msys2 {0}
+
+      - name: Prepare source tree for build (Unix)
+        if: runner.os != 'Windows'
+        run: ./autogen.sh
+
+      - name: Configure
+        run: |
+          cmake -S . \
+                -B build \
+                -D CMAKE_BUILD_TYPE=Release \
+                -D CMAKE_INSTALL_PREFIX=$GITHUB_WORKSPACE/../local
+
+      - name: Build
+        run: cmake --build build --config Release --verbose
+
+      - name: Install
+        run: cmake --install build --config Release
+
+      - name: Consume from the build directory - Configure
+        run: |
+          cmake -S tests/cmake \
+                -B consumer-build \
+                -D CMAKE_BUILD_TYPE=Release \
+                -D LibreSSL_DIR=$GITHUB_WORKSPACE/build
+      - name: Consume from the build directory - Build
+        run: cmake --build consumer-build --config Release --verbose
+
+      - name: Consume from the install directory (CMAKE_PREFIX_PATH) - Configure
+        run: |
+          cmake -S tests/cmake \
+            -B consumer-install-prefix \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D CMAKE_PREFIX_PATH=$GITHUB_WORKSPACE/../local
+      - name: Consume from the install directory (CMAKE_PREFIX_PATH) - Build
+        run: cmake --build consumer-install-prefix --config Release --verbose
+
+      - name: Consume from the install directory (LibreSSL_DIR) - Configure
+        run: |
+          cmake -S tests/cmake \
+                -B consumer-install-dir \
+                -D CMAKE_BUILD_TYPE=Release \
+                -D LibreSSL_DIR=$GITHUB_WORKSPACE/../local/lib/cmake/LibreSSL
+      - name: Consume from the install directory (LibreSSL_DIR) - Build
+        run: cmake --build consumer-install-dir --config Release --verbose

.github/workflows/coverity.yml

@@ -9,20 +9,40 @@ jobs:
   scan:
     runs-on: ubuntu-latest
     if: ${{ github.repository_owner == 'libressl' }}
-    env:
-      COVERITY_SCAN_PROJECT_NAME: 'libressl-portable/portable'
-      COVERITY_SCAN_BRANCH_PATTERN: '*'
-      COVERITY_SCAN_NOTIFICATION_EMAIL: 'libressl-security@openbsd.org'
-      COVERITY_SCAN_BUILD_COMMAND_PREPEND: "./autogen.sh && ./configure && make dist && tar zxf libressl-*.tar.gz && rm libressl-*.tar.gz && cd libressl-* && mkdir build-static && mkdir build-shared && cmake -GNinja -DBUILD_SHARED_LIBS=ON .."
-      COVERITY_SCAN_BUILD_COMMAND: "ninja"
     steps:
     - uses: actions/checkout@main
     - name: Install apt dependencies
       run: |
         sudo apt-get update
         sudo apt-get install -y cmake ninja-build
-    - name: Run Coverity Scan
+    - name: Download Coverity build tool
-      env:
-        COVERITY_SCAN_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
       run: |
-        curl -fsSL "https://scan.coverity.com/scripts/travisci_build_coverity_scan.sh" | bash || true
+        wget -c -N https://scan.coverity.com/download/linux64 --post-data "token=${{ secrets.COVERITY_SCAN_TOKEN }}&project=libressl-portable%2Fportable" -O coverity_tool.tar.gz
+        mkdir coverity_tool
+        tar xzf coverity_tool.tar.gz --strip 1 -C coverity_tool
+    - name: Configure
+      run: |
+        ./autogen.sh
+        ./configure
+        make dist
+        tar zxf libressl-*.tar.gz
+        rm libressl-*.tar.gz
+        cd libressl-*
+        mkdir build-static
+        mkdir build-shared 
+        cmake -GNinja -DBUILD_SHARED_LIBS=ON ..
+    - name: Build with Coverity build tool
+      run: |
+        export PATH=`pwd`/coverity_tool/bin:$PATH
+        cd libressl-*
+        cov-build --dir cov-int ninja
+    - name: Submit build result to Coverity Scan
+      run: |
+        cd libressl-*
+        tar czvf cov.tar.gz cov-int
+        curl --form token=${{ secrets.COVERITY_SCAN_TOKEN }} \
+          --form email=libressl-security@openbsd.org \
+          --form file=@cov.tar.gz \
+          --form version="Commit $GITHUB_SHA" \
+          --form description="Build submitted via CI" \
+          https://scan.coverity.com/builds?project=libressl-portable%2Fportable

.github/workflows/fedora-rawhide.yml

@@ -0,0 +1,34 @@
+name: Fedora/Rawhide
+
+on:
+  workflow_dispatch:
+  schedule:
+  - cron: "0 0 * * *"
+
+permissions:
+  contents: read
+
+jobs:
+  build_and_test:
+    strategy:
+      matrix:
+        cc: [ gcc, clang ]
+    name: ${{ matrix.cc }}
+    runs-on: ubuntu-latest
+    container:
+      image: fedora:rawhide
+    steps:
+    - uses: actions/checkout@v3
+    - name: Install dependencies
+      run: |
+        dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch
+    - name: Pull upstream source
+      run: |
+        ./update.sh
+    - name: Build
+      run: |
+         CC=${{ matrix.cc }} cmake -GNinja -DBUILD_SHARED_LIBS=ON .
+         ninja
+    - name: Test
+      run: |
+         ninja test

.github/workflows/macos_test.yml

@@ -6,14 +6,13 @@ jobs:
   build-native:
     strategy:
       matrix:
-        os: [macos-12, macos-11]
+        os: [macos-13, macos-12]
-        compiler: [clang, gcc]
+        arch: [arm64, x86_64]
     runs-on: ${{ matrix.os }}
     continue-on-error: false
     env:
-      CC: ${{ matrix.compiler }}
+      ARCH: ${{ matrix.arch }}
-      ARCH: native
+    name: ${{ matrix.os }} - ${{ matrix.arch }}
-    name: ${{ matrix.compiler }} - ${{ matrix.os }}
     steps:
     - name: Install packages for macos
       run: brew install automake

.github/workflows/rust_regress.yml

@@ -1,4 +1,4 @@
-name: regress testing
+name: rust regress tests
 
 on:
   schedule:

.github/workflows/solaris_test.yml

@@ -0,0 +1,30 @@
+name: solaris_ci
+
+on:
+  workflow_dispatch:
+  schedule:
+  - cron: "0 0 * * *"
+
+jobs:
+  build-native:
+    strategy:
+      matrix:
+        release: [11.4]
+    runs-on: macos-12
+    continue-on-error: false
+    name: Solaris ${{ matrix.release }}
+    steps:
+    - name: Checkout source
+      uses: actions/checkout@main
+    - name: Configure source
+      run: |
+        brew install automake autoconf libtool
+        ./autogen.sh
+    - name: Build on VM
+      uses: vmactions/solaris-vm@v0
+      with:
+        prepare: |
+          pkg install gcc make
+        run: |
+          MAKE=gmake ./configure
+          gmake -j2 check || (cat tests/test-suite.log && exit 1)

.github/workflows/windows_test.yml

@@ -0,0 +1,45 @@
+name: windows_ci
+
+on: [push, pull_request]
+
+jobs:
+  build-native:
+    strategy:
+      matrix:
+        os: [windows-2019, windows-2022]
+        arch: [Win32, x64, ARM64]
+        include:
+          - generator: "Visual Studio 16 2019"
+            os: windows-2019
+          - generator: "Visual Studio 17 2022"
+            os: windows-2022
+    runs-on: ${{ matrix.os }}
+    continue-on-error: false
+    name: ${{ matrix.os }} - ${{ matrix.arch }}
+    steps:
+      - uses: msys2/setup-msys2@v2
+        with:
+          update: true
+          install: >-
+            autoconf
+            automake
+            diffutils
+            libtool
+            gcc
+            git
+            patch
+            perl
+      - uses: actions/checkout@main
+      - shell: msys2 {0}
+        run: ./autogen.sh
+      - shell: cmd
+        run: cmake -Bbuild -G "${{ matrix.generator }}" -A ${{ matrix.arch }} -DCMAKE_INSTALL_PREFIX=../local
+      - shell: cmd
+        run: cmake --build build --config Release
+      - shell: cmd
+        if: ${{ matrix.arch != 'ARM64' }}
+        run: ctest --test-dir build -C Release --output-on-failure
+      - uses: actions/upload-artifact@v3
+        with:
+          name: windows-build-results-${{ matrix.os }}-${{ matrix.arch }}
+          path: build

.gitignore

@@ -82,14 +82,17 @@ tests/bio_mem*
 tests/bnaddsub*
 tests/bn_add_sub*
 tests/bn_cmp*
+tests/bn_convert*
 tests/bn_gcd*
 tests/bn_isqrt*
 tests/bn_mod_exp*
 tests/bn_mod_exp_zero*
 tests/bn_mod_exp2_mont*
+tests/bn_mod_inverse*
 tests/bn_mod_sqrt*
 tests/bn_mont*
 tests/bn_primes*
+tests/bn_print*
 tests/bn_rand_interval*
 tests/bn_shift*
 tests/bn_to_string*
@@ -101,6 +104,7 @@ tests/constraints*
 tests/ctlog.conf
 tests/*.crt
 tests/ec_point_conversion*
+tests/ecc_cdh*
 tests/evp_pkey_check*
 tests/evp_pkey_cleanup*
 tests/explicit_bzero*

CMakeLists.txt

@@ -1,8 +1,6 @@
+cmake_minimum_required (VERSION 3.16.4)
 if(MSVC)
-	cmake_minimum_required (VERSION 3.16.4)
 	cmake_policy(SET CMP0091 NEW)
-else()
-	cmake_minimum_required (VERSION 3.0)
 endif()
 
 project (LibreSSL C ASM)
@@ -41,6 +39,7 @@ option(ENABLE_ASM "Enable assembly" ON)
 option(ENABLE_EXTRATESTS "Enable extra tests that may be unreliable on some platforms" OFF)
 option(ENABLE_NC "Enable installing TLS-enabled nc(1)" OFF)
 set(OPENSSLDIR ${OPENSSLDIR} CACHE PATH "Set the default openssl directory" FORCE)
+set(LIBRESSL_INSTALL_CMAKEDIR "${CMAKE_INSTALL_LIBDIR}/cmake/LibreSSL" CACHE STRING "Installation directory for the CMake targets")
 
 option(USE_STATIC_MSVC_RUNTIMES "Use /MT instead of /MD in MSVC" OFF)
 if(USE_STATIC_MSVC_RUNTIMES)
@@ -51,6 +50,24 @@ if(NOT LIBRESSL_SKIP_INSTALL)
 	set( ENABLE_LIBRESSL_INSTALL ON )
 endif(NOT LIBRESSL_SKIP_INSTALL)
 
+# Set a default build type if none was specified
+set(default_build_type "Release")
+
+if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
+  message(STATUS "Setting build type to '${default_build_type}' as none was specified.")
+  set(CMAKE_BUILD_TYPE "${default_build_type}" CACHE
+      STRING "Choose the type of build." FORCE)
+  # Set the possible values of build type for cmake-gui
+  set_property(CACHE CMAKE_BUILD_TYPE PROPERTY
+	  STRINGS "Debug" "Release" "MinSizeRel" "RelWithDebInfo")
+endif()
+
+# Enable asserts regardless of build type
+if(MSVC)
+	add_definitions(/UNDEBUG)
+else()
+	add_definitions(-UNDEBUG)
+endif()
 
 set(BUILD_NC true)
 
@@ -79,7 +96,7 @@ if(WIN32 OR (CMAKE_SYSTEM_NAME MATCHES "MINGW"))
 	add_definitions(-D__USE_MINGW_ANSI_STDIO)
 endif()
 
-set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -O2 -Wall")
+set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall")
 
 if(CMAKE_SYSTEM_NAME MATCHES "HP-UX")
 	if(CMAKE_C_COMPILER MATCHES "gcc")
@@ -121,7 +138,7 @@ if(WIN32)
 	if(NOT CMAKE_SYSTEM_NAME MATCHES "WindowsStore")
 		add_definitions(-D_WIN32_WINNT=0x0600)
 	endif()
-	set(PLATFORM_LIBS ${PLATFORM_LIBS} ws2_32 bcrypt)
+	set(PLATFORM_LIBS ${PLATFORM_LIBS} ws2_32 ntdll bcrypt)
 endif()
 
 if(MSVC)
@@ -176,6 +193,11 @@ if(HAVE_ASPRINTF)
 	add_definitions(-DHAVE_ASPRINTF)
 endif()
 
+check_function_exists(getopt HAVE_GETOPT)
+if(HAVE_GETOPT)
+	add_definitions(-DHAVE_GETOPT)
+endif()
+
 check_function_exists(reallocarray HAVE_REALLOCARRAY)
 if(HAVE_REALLOCARRAY)
 	add_definitions(-DHAVE_REALLOCARRAY)
@@ -306,6 +328,15 @@ if(HAVE_NETINET_IP_H)
 	add_definitions(-DHAVE_NETINET_IP_H)
 endif()
 
+# This isn't ready for universal binaries yet, since we do conditional
+# compilation based on the architecture, but this makes cross compiling for a
+# single architecture work on macOS at least.
+#
+# Don't set CMAKE_OSX_ARCHITECTURES to more than a single value for now.
+if(APPLE)
+	set(CMAKE_SYSTEM_PROCESSOR "${CMAKE_OSX_ARCHITECTURES}")
+endif()
+
 if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(aarch64|arm64)")
 	set(HOST_AARCH64 true)
 elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm")
@@ -348,7 +379,7 @@ if(ENABLE_ASM)
 	elseif(MSVC AND ("${CMAKE_GENERATOR}" MATCHES "Win64" OR "${CMAKE_GENERATOR_PLATFORM}" STREQUAL "x64"))
 		set(HOST_ASM_MASM_X86_64 true)
 		ENABLE_LANGUAGE(ASM_MASM)
-	elseif(CMAKE_SYSTEM_NAME MATCHES "MINGW" AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "x86_64")
+	elseif(MINGW AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "x86_64")
 		set(HOST_ASM_MINGW64_X86_64 true)
 	endif()
 endif()
@@ -416,6 +447,38 @@ if (BUILD_APPLE_XCFRAMEWORK)
 	endif(ENABLE_LIBRESSL_INSTALL)
 endif(BUILD_APPLE_XCFRAMEWORK)
 
+file(STRINGS "VERSION" VERSION LIMIT_COUNT 1)
+include(CMakePackageConfigHelpers)
+write_basic_package_version_file(
+	"LibreSSLConfigVersion.cmake"
+	VERSION "${VERSION}"
+	COMPATIBILITY SameMajorVersion
+)
+
+set(INCLUDE_DIRECTORY "${CMAKE_BINARY_DIR}/include")
+configure_package_config_file(
+  "${CMAKE_CURRENT_LIST_DIR}/LibreSSLConfig.cmake.in"
+  "${CMAKE_CURRENT_BINARY_DIR}/LibreSSLConfig.cmake"
+	PATH_VARS INCLUDE_DIRECTORY
+  INSTALL_DESTINATION "${CMAKE_CURRENT_BINARY_DIR}"
+	INSTALL_PREFIX "${CMAKE_CURRENT_BINARY_DIR}"
+)
+
+if(ENABLE_LIBRESSL_INSTALL)
+	set(INCLUDE_DIRECTORY "${CMAKE_INSTALL_INCLUDEDIR}")
+	configure_package_config_file(
+  	"${CMAKE_CURRENT_LIST_DIR}/LibreSSLConfig.cmake.in"
+  	"${CMAKE_CURRENT_BINARY_DIR}/install-config/LibreSSLConfig.cmake"
+		PATH_VARS INCLUDE_DIRECTORY
+  	INSTALL_DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}"
+	)
+	install(FILES
+		"${CMAKE_BINARY_DIR}/install-config/LibreSSLConfig.cmake"
+		"${CMAKE_BINARY_DIR}/LibreSSLConfigVersion.cmake"
+		DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}"
+	)
+endif()
+
 if(ENABLE_LIBRESSL_INSTALL)
 	if(NOT MSVC)
 		# Create pkgconfig files.
@@ -426,7 +489,6 @@ if(ENABLE_LIBRESSL_INSTALL)
 		if(PLATFORM_LIBS)
 			string(REGEX REPLACE ";" " -l" PLATFORM_LDADD ";${PLATFORM_LIBS}")
 		endif()
-		file(STRINGS    "VERSION" VERSION LIMIT_COUNT 1)
 		file(GLOB       OPENSSL_PKGCONFIGS "*.pc.in")
 		foreach(file ${OPENSSL_PKGCONFIGS})
 			get_filename_component(filename ${file} NAME)

ChangeLog

@@ -28,11 +28,103 @@ history is also available from Git.
 
 LibreSSL Portable Release Notes:
 
+3.8.1 - In development
+
+	* Portable changes
+	  - Applications bundled as part of the LibreSSL package internally,
+	    nc(1) and openssl(1), now are linked statically if static libraries
+	    are built.
+	  - Internal compatibility function symbols are no longer exported from
+	    libcrypto. Instead, the libcompat library is linked to libcrypto,
+	    libssl, and libtls separately. This increases size a little, but
+	    ensures that the libraries are not exporting symbols to programs
+	    unintentionally.
+	  - Selective removal of CET implementation on platforms where it is
+	    not supported (macOS).
+	  - Integrated four more tests.
+	  - Added Windows ARM64 architecture to tested platforms.
+	  - Removed Solaris 10 support, fixed Solaris 11.
+	  - libtls no longer links statically to libcrypto / libssl unless
+	    '--enable-libtls-only' is specified at configure time.
+	  - Improved Windows compatibility library, namely handling of files vs
+	    sockets, correcting an exception when operating on a closed socket.
+	  - CMake builds no longer hardcode '-O2' into the compiler flags, instead
+	    using flags from the CMake build type instead.
+	  - Set the CMake default build type to 'Release'. This can be overridden
+	    during configuration.
+	  - Fixed broken ASM support with MinGW builds.
+	* Internal improvements
+	  - Fixed alignment handling in SHA-512.
+	  - Moved the verified_chain to the correct internal struct.
+	  - Improved checks for commonName in libtls.
+	  - Fixed error check for X509_get_ext_d2i() failure in libtls.
+	  - Improved BIGNUM internals and performance.
+	  - Significantly improved Montgomery multiplication performance.
+	  - Initial cleanup passes for SHA-256 internals.
+	  - Converted more libcrypto internals API using CBB and CBS.
+	  - Removed code guarded by #ifdef ZLIB.
+	  - Changed ASN1_item_sign_ctx() and ASN1_item_verify() to work with
+	    Ed25519 and fixed a few bugs in there.
+	  - Fixed various issues with EVP_PKEY_CTX_{new,dup}().
+	  - Improved X.509 certificate version checks.
+	  - Cleaned up handling of elliptic curve cofactors.
+	  - Made BN_num_bits() independent of bn->top.
+	  - Rewrote and simplified bn_sqr().
+	  - Removed EC_GROUP precomp machinery.
+	  - Ensure no X.509v3 extensions appear more than once in certificates.
+	  - Cleaned up various ECDH, ECDSA and EC internals.
+	  - Replaced ASN1_bn_print with a cleaner internal implementation.
+	  - Simplified ASN1_item_sign_ctx().
+	  - Rewrote OBJ_find_sigid_algs() and OBJ_find_sigid_by_algs().
+	  - Various improvements in the 'simple' EC code.
+	  - Fix OPENSSL_cpuid_setup() invocations on arm/aarch64.
+	  - Reduced the dependency of hash implementations on many layers of
+	    macros. This results in significant speedups since modern compilers
+	    are now less confused.
+	  - Significantly simplified the BN_BLINDING internals used in RSA.
+	* New features
+	* Compatibility changes
+	  - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain
+	    valid UTF-8 without embedded NUL.
+	  - Moved libtls from ECDSA_METHOD to EC_KEY_METHOD.
+	  - Removed support for ECDH_METHOD and ECDSA_METHOD.
+	  - BN_is_prime{,_fasttest}_ex() refuse to check numbers larger than
+	    32 kbits for primality. This mitigates various DoS vectors.
+	  - Comp was removed.
+	  - Dynamic loading of conf modules is no longer supported.
+	  - DSO was removed and OPENSSL_NO_DSO is defined.
+	  - ENGINE support was removed and OPENSSL_NO_ENGINE is set. In spite
+	    of this, some stub functions are provided to avoid patching some
+	    applications that do not honor OPENSSL_NO_ENGINE.
+	  - It is no longer possible to make the library use your own error
+	    stack or ex_data implementation.
+	* Bug fixes
+	  - Fixed aliasing issue in BN_mod_inverse().
+	  - Made CRYPTO_get_ex_new_index() not return 0 to allow applications
+	    to use *_{get,set}_app_data() and *_{get,set}_ex_data() alongside
+	    each other.
+	  - Made EVP_PKEY_set1_hkdf_key() fail on a NULL key.
+	  - Plugged leaks in BIO_chain_dup().
+	  - Fixed numerous leaks and other minor bugs in RSA, DH, DSA and EC
+	    ASN.1 methods. Unified the coding style.
+	  - On socket errors in the poll loop, netcat could issue system calls
+	    on invalidated file descriptors.
+	* Documentation improvements
+	  - Made it very explicit that the verify callback should not be used.
+	  - Called out that the CRL lastUpdate is standardized as thisUpdate.
+	* Testing and Proactive Security
+	  - As always, new test coverage is added as bugs are fixed and subsystems
+	    are cleaned up.
+	* Security fixes
+	  - Disabled TLSv1.0 and TLSv1.1 in libssl so that they may no longer
+	    be selected for use.
+
 3.8.0 - Development release
 
 	* Portable changes
 	  - Extended the endian.h compat header with hto* and *toh macros.
 	  - Adapted more tests to the portable framework.
+	  - Internal tools are now statically linked.
 	* Internal improvements
 	  - Improved sieve of Eratosthenes script used for generating a table
 	    of small primes.
@@ -95,6 +187,14 @@ LibreSSL Portable Release Notes:
 	  - As always, new test coverage is added as bugs are fixed and subsystems
 	    are cleaned up.
 
+3.7.3 - Bug and reliability fixes
+
+	* Bug fix
+	  - Hostflags in the verify parameters would not propagate from an
+	    SSL_CTX to newly created SSL.
+	* Reliability fix
+	  - A double free or use after free could occur after SSL_clear(3).
+
 3.7.2 - Stable release
 
 	* Portable changes
@@ -209,6 +309,20 @@ LibreSSL Portable Release Notes:
 	    support for EVP_PKEY_ED25519, EVP_PKEY_HMAC and EVP_PKEY_X25519.
 	    Poly1305 is not currently supported via this interface.
 
+3.6.3 - Bug and reliability fixes
+
+	* Bug fix
+	  - Hostflags in the verify parameters would not propagate from an
+	    SSL_CTX to newly created SSL.
+	* Reliability fix
+	  - A double free or use after free could occur after SSL_clear(3).
+
+3.6.2 - Security release
+
+	* Security fix
+	  - A malicious certificate revocation list or timestamp response token
+	    would allow an attacker to read arbitrary memory.
+
 3.6.1 - Stable release
 
 	* Bug fixes

LibreSSLConfig.cmake.in

@@ -0,0 +1,33 @@
+@PACKAGE_INIT@
+
+set(LIBRESSL_VERSION @VERSION@)
+set_and_check(LIBRESSL_INCLUDE_DIR @PACKAGE_INCLUDE_DIRECTORY@)
+
+if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-Crypto.cmake")
+  include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-Crypto.cmake")
+  set(LIBRESSL_CRYPTO_LIBRARY LibreSSL::Crypto)
+endif()
+
+if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-SSL.cmake")
+  include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-SSL.cmake")
+  set(LIBRESSL_SSL_LIBRARY LibreSSL::SSL)
+endif()
+
+if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-TLS.cmake")
+  include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-TLS.cmake")
+  set(LIBRESSL_TLS_LIBRARY LibreSSL::TLS)
+endif()
+
+set(LIBRESSL_LIBRARIES
+  ${LIBRESSL_CRYPTO_LIBRARY}
+  ${LIBRESSL_SSL_LIBRARY}
+  ${LIBRESSL_TLS_LIBRARY}
+)
+
+check_required_components(
+  Crypto
+  SSL
+  TLS
+)
+
+set(LIBRESSL_FOUND TRUE)

Makefile.am

@@ -11,7 +11,7 @@ pkgconfig_DATA += libcrypto.pc libssl.pc openssl.pc
 endif
 
 EXTRA_DIST = README.md README.windows VERSION config scripts
-EXTRA_DIST += CMakeLists.txt cmake_export_symbol.cmake cmake_uninstall.cmake.in FindLibreSSL.cmake
+EXTRA_DIST += CMakeLists.txt cmake_export_symbol.cmake cmake_uninstall.cmake.in FindLibreSSL.cmake LibreSSLConfig.cmake.in
 EXTRA_DIST += cert.pem openssl.cnf x509v3.cnf
 
 .PHONY: install_sw

README.md

@@ -4,7 +4,7 @@ This is a somewhat hacky port of the LibreSSL build system to Zig. It builds Lib
 
 Notes:
 
-1. In order for this to work, `.\update.sh` must have first been run to bring in the LibreSSL OpenBSD sources.
+1. In order for this to work, `.\update.sh` must have first been run to bring in the LibreSSL OpenBSD sources. (Or, if you trust me, you may use the `zig-3.8.1` branch which has the upstream sources committed to the repository, for ease of use with the Zig package manager).
 
 2. I don't know if this causes LibreSSL to be compiled in a way that Compromises Its Cryptographic Integrity. Hopefully it is not even possible to do such a thing in the first place. But I am not an expert, and I ain't looking to port the tests.
 

README.windows

@@ -55,11 +55,11 @@ cv2pdb to generate Visual Studio and windbg compatible debug files. cv2pdb is a
 tool developed for the D language and can be found here:
 https://github.com/rainers/cv2pdb
 
-Pre-built Windows binaries are available with LibreSSL releases if you do not
+The mingw-w64 code is largely, but not 100%, compatible with code built from
-have a mingw-w64 build environment. Mingw-w64 code is largely, but not 100%,
+Visual Studio. Notably, FILE * pointers cannot be shared between code built for
-compatible with code built from Visual Studio. Notably, FILE * pointers cannot
+Mingw-w64 and Visual Studio.
-be shared between code built for Mingw-w64 and Visual Studio.
 
-As of LibreSSL 2.2.2, Visual Studio Native builds can be produced using CMake.
+As of LibreSSL 2.2.2, Visual Studio Native builds can also be produced using
-This produces ABI-compatible libraries for linking with native code generated
+CMake. This produces ABI-compatible libraries for linking with native code
-by Visual Studio.
+generated by Visual Studio. Currently tested versions are VS 2019 and 2022,
+though earlier versions may work as well.

apps/nc/CMakeLists.txt

@@ -36,8 +36,14 @@ else()
 endif()
 
 add_executable(nc ${NC_SRC})
-target_include_directories(nc PUBLIC ../../include)
+target_include_directories(nc
-target_include_directories(nc PRIVATE . ./compat ../../include/compat)
+	PRIVATE
+		.
+		./compat
+		../../include/compat
+	PUBLIC
+		../../include
+		${CMAKE_BINARY_DIR}/include)
 target_link_libraries(nc ${LIBTLS_LIBS})
 
 if(ENABLE_NC)

apps/ocspcheck/CMakeLists.txt

@@ -8,9 +8,9 @@ set(
 
 check_function_exists(memmem HAVE_MEMMEM)
 if(HAVE_MEMMEM)
-        add_definitions(-DHAVE_MEMMEM)
+	add_definitions(-DHAVE_MEMMEM)
 else()
-        set(OCSPCHECK_SRC ${OCSPCHECK_SRC} compat/memmem.c)
+	set(OCSPCHECK_SRC ${OCSPCHECK_SRC} compat/memmem.c)
 endif()
 
 if(NOT "${OPENSSLDIR}" STREQUAL "")
@@ -20,8 +20,12 @@ else()
 endif()
 
 add_executable(ocspcheck ${OCSPCHECK_SRC})
-target_include_directories(ocspcheck PUBLIC ../../include)
+target_include_directories(ocspcheck
-target_include_directories(ocspcheck PRIVATE . ./compat ../../include/compat)
+	PRIVATE
+		../../include/compat
+	PUBLIC
+		../../include
+		${CMAKE_BINARY_DIR}/include)
 target_link_libraries(ocspcheck tls ${OPENSSL_LIBS})
 
 if(ENABLE_LIBRESSL_INSTALL)

apps/openssl/CMakeLists.txt

@@ -61,15 +61,20 @@ if(WIN32)
 endif()
 
 if(CMAKE_SYSTEM_NAME MATCHES "Darwin")
-        check_function_exists(clock_gettime HAVE_CLOCK_GETTIME)
+	check_function_exists(clock_gettime HAVE_CLOCK_GETTIME)
-        if(NOT HAVE_CLOCK_GETTIME)
+	if(NOT HAVE_CLOCK_GETTIME)
-                set(OPENSSL_SRC ${OPENSSL_SRC} compat/clock_gettime_osx.c)
+			set(OPENSSL_SRC ${OPENSSL_SRC} compat/clock_gettime_osx.c)
-        endif()
+	endif()
 endif()
 
 add_executable(openssl ${OPENSSL_SRC})
-target_include_directories(openssl PUBLIC ../../include)
+target_include_directories(openssl
-target_include_directories(openssl PRIVATE . ../../include/compat)
+	PRIVATE
+		.
+		../../include/compat
+	PUBLIC
+		../../include
+		${CMAKE_BINARY_DIR}/include)
 target_link_libraries(openssl ${OPENSSL_LIBS})
 
 if(ENABLE_LIBRESSL_INSTALL)

build.zig

@@ -234,23 +234,22 @@ pub fn libresslBuild(
         else => @panic("unsupported target OS"),
     }
 
-    const header = switch (tinfo.cpu.arch) {
+    const conf_header = switch (tinfo.cpu.arch) {
-        .aarch64, .aarch64_be, .aarch64_32 => install_header_prefix ++ "arch/aarch64/opensslconf.h",
+        .aarch64, .aarch64_be, .aarch64_32 => source_header_prefix ++ "arch/aarch64/opensslconf.h",
-        .x86 => install_header_prefix ++ "arch/i386/opensslconf.h",
+        .x86 => source_header_prefix ++ "arch/i386/opensslconf.h",
-        .riscv64 => install_header_prefix ++ "arch/riscv64/opensslconf.h",
+        .riscv64 => source_header_prefix ++ "arch/riscv64/opensslconf.h",
-        .x86_64 => install_header_prefix ++ "arch/amd64/opensslconf.h",
+        .x86_64 => source_header_prefix ++ "arch/amd64/opensslconf.h",
 
         else => @panic("unsupported target CPU arch"),
     };
 
-    // TODO: can we just add this as an install header instead? It's needed during this
+    libressl_libs.libcrypto.installHeader(conf_header, "openssl/opensslconf.h");
-    // build. This mutates the source tree, which is really gross.
+    libressl_libs.libssl.installHeader(conf_header, "openssl/opensslconf.h");
-    const include_dir = try b.build_root.handle.openDir(install_header_prefix ++ "openssl", .{});
+    libressl_libs.libtls.installHeader(conf_header, "openssl/opensslconf.h");
-    try b.build_root.handle.copyFile(header, include_dir, "opensslconf.h", .{});
 
     try libressl_libs.header_search(
         b,
-        install_header_prefix,
+        source_header_prefix,
         &.{
             .{ .starts_with = "compat" },
             .{ .starts_with = "arch" },
@@ -347,7 +346,7 @@ const SkipSpec = union(enum) {
 
 const base_src_prefix = "./";
 const libcrypto_src_prefix = base_src_prefix ++ "crypto/";
-const install_header_prefix = base_src_prefix ++ "include/";
+const source_header_prefix = base_src_prefix ++ "include/";
 const libssl_src_prefix = base_src_prefix ++ "ssl/";
 const libtls_src_prefix = base_src_prefix ++ "tls/";
 
@@ -381,8 +380,8 @@ const libcrypto_include_paths = [_][]const u8{
     // these are order-dependent and they have to go after the "hidden" directory
     // because the "openssl" include directory is masked inside the "hidden" directory
     // in the source tree. cool.
-    install_header_prefix ++ "compat",
+    source_header_prefix ++ "compat",
-    install_header_prefix,
+    source_header_prefix,
 };
 
 // these are used on armv4 with asm, or a nonasm build
@@ -534,7 +533,6 @@ const libcrypto_sources = [_][]const u8{
     libcrypto_src_prefix ++ "aes/aes_ctr.c",
     libcrypto_src_prefix ++ "aes/aes_ecb.c",
     libcrypto_src_prefix ++ "aes/aes_ige.c",
-    libcrypto_src_prefix ++ "aes/aes_misc.c",
     libcrypto_src_prefix ++ "aes/aes_ofb.c",
     libcrypto_src_prefix ++ "aes/aes_wrap.c",
     libcrypto_src_prefix ++ "asn1/a_bitstr.c",
@@ -571,7 +569,6 @@ const libcrypto_sources = [_][]const u8{
     libcrypto_src_prefix ++ "asn1/p5_pbev2.c",
     libcrypto_src_prefix ++ "asn1/p8_pkey.c",
     libcrypto_src_prefix ++ "asn1/t_crl.c",
-    libcrypto_src_prefix ++ "asn1/t_pkey.c",
     libcrypto_src_prefix ++ "asn1/t_req.c",
     libcrypto_src_prefix ++ "asn1/t_spki.c",
     libcrypto_src_prefix ++ "asn1/t_x509.c",
@@ -624,7 +621,6 @@ const libcrypto_sources = [_][]const u8{
     libcrypto_src_prefix ++ "bio/bss_null.c",
     libcrypto_src_prefix ++ "bio/bss_sock.c",
     libcrypto_src_prefix ++ "bn/bn_add.c",
-    libcrypto_src_prefix ++ "bn/bn_blind.c",
     libcrypto_src_prefix ++ "bn/bn_bpsw.c",
     libcrypto_src_prefix ++ "bn/bn_const.c",
     libcrypto_src_prefix ++ "bn/bn_convert.c",
@@ -641,6 +637,8 @@ const libcrypto_sources = [_][]const u8{
     libcrypto_src_prefix ++ "bn/bn_mont.c",
     libcrypto_src_prefix ++ "bn/bn_mul.c",
     libcrypto_src_prefix ++ "bn/bn_prime.c",
+    libcrypto_src_prefix ++ "bn/bn_primitives.c",
+    libcrypto_src_prefix ++ "bn/bn_print.c",
     libcrypto_src_prefix ++ "bn/bn_rand.c",
     libcrypto_src_prefix ++ "bn/bn_recp.c",
     libcrypto_src_prefix ++ "bn/bn_shift.c",
@@ -648,7 +646,6 @@ const libcrypto_sources = [_][]const u8{
     libcrypto_src_prefix ++ "bn/bn_sqr.c",
     libcrypto_src_prefix ++ "bn/bn_word.c",
     libcrypto_src_prefix ++ "buffer/buf_err.c",
-    libcrypto_src_prefix ++ "buffer/buf_str.c",
     libcrypto_src_prefix ++ "buffer/buffer.c",
     libcrypto_src_prefix ++ "bytestring/bs_ber.c",
     libcrypto_src_prefix ++ "bytestring/bs_cbb.c",
@@ -669,7 +666,6 @@ const libcrypto_sources = [_][]const u8{
     libcrypto_src_prefix ++ "cmac/cmac.c",
     libcrypto_src_prefix ++ "cms/cms_asn1.c",
     libcrypto_src_prefix ++ "cms/cms_att.c",
-    libcrypto_src_prefix ++ "cms/cms_cd.c",
     libcrypto_src_prefix ++ "cms/cms_dd.c",
     libcrypto_src_prefix ++ "cms/cms_enc.c",
     libcrypto_src_prefix ++ "cms/cms_env.c",
@@ -681,10 +677,6 @@ const libcrypto_sources = [_][]const u8{
     libcrypto_src_prefix ++ "cms/cms_pwri.c",
     libcrypto_src_prefix ++ "cms/cms_sd.c",
     libcrypto_src_prefix ++ "cms/cms_smime.c",
-    libcrypto_src_prefix ++ "comp/c_rle.c",
-    libcrypto_src_prefix ++ "comp/c_zlib.c",
-    libcrypto_src_prefix ++ "comp/comp_err.c",
-    libcrypto_src_prefix ++ "comp/comp_lib.c",
     libcrypto_src_prefix ++ "conf/conf_api.c",
     libcrypto_src_prefix ++ "conf/conf_def.c",
     libcrypto_src_prefix ++ "conf/conf_err.c",
@@ -744,11 +736,6 @@ const libcrypto_sources = [_][]const u8{
     libcrypto_src_prefix ++ "dsa/dsa_ossl.c",
     libcrypto_src_prefix ++ "dsa/dsa_pmeth.c",
     libcrypto_src_prefix ++ "dsa/dsa_prn.c",
-    libcrypto_src_prefix ++ "dso/dso_dlfcn.c",
-    libcrypto_src_prefix ++ "dso/dso_err.c",
-    libcrypto_src_prefix ++ "dso/dso_lib.c",
-    libcrypto_src_prefix ++ "dso/dso_null.c",
-    libcrypto_src_prefix ++ "dso/dso_openssl.c",
     libcrypto_src_prefix ++ "ec/ec_ameth.c",
     libcrypto_src_prefix ++ "ec/ec_asn1.c",
     libcrypto_src_prefix ++ "ec/ec_check.c",
@@ -767,38 +754,9 @@ const libcrypto_sources = [_][]const u8{
     libcrypto_src_prefix ++ "ec/ecp_oct.c",
     libcrypto_src_prefix ++ "ec/ecp_smpl.c",
     libcrypto_src_prefix ++ "ec/ecx_methods.c",
-    libcrypto_src_prefix ++ "ecdh/ecdh_kdf.c",
+    libcrypto_src_prefix ++ "ecdh/ecdh.c",
-    libcrypto_src_prefix ++ "ecdh/ech_err.c",
+    libcrypto_src_prefix ++ "ecdsa/ecdsa.c",
-    libcrypto_src_prefix ++ "ecdh/ech_key.c",
+    libcrypto_src_prefix ++ "engine/engine_stubs.c",
-    libcrypto_src_prefix ++ "ecdh/ech_lib.c",
-    libcrypto_src_prefix ++ "ecdsa/ecs_asn1.c",
-    libcrypto_src_prefix ++ "ecdsa/ecs_err.c",
-    libcrypto_src_prefix ++ "ecdsa/ecs_lib.c",
-    libcrypto_src_prefix ++ "ecdsa/ecs_ossl.c",
-    libcrypto_src_prefix ++ "engine/eng_all.c",
-    libcrypto_src_prefix ++ "engine/eng_cnf.c",
-    libcrypto_src_prefix ++ "engine/eng_ctrl.c",
-    libcrypto_src_prefix ++ "engine/eng_dyn.c",
-    libcrypto_src_prefix ++ "engine/eng_err.c",
-    libcrypto_src_prefix ++ "engine/eng_fat.c",
-    libcrypto_src_prefix ++ "engine/eng_init.c",
-    libcrypto_src_prefix ++ "engine/eng_lib.c",
-    libcrypto_src_prefix ++ "engine/eng_list.c",
-    libcrypto_src_prefix ++ "engine/eng_openssl.c",
-    libcrypto_src_prefix ++ "engine/eng_pkey.c",
-    libcrypto_src_prefix ++ "engine/eng_table.c",
-    libcrypto_src_prefix ++ "engine/tb_asnmth.c",
-    libcrypto_src_prefix ++ "engine/tb_cipher.c",
-    libcrypto_src_prefix ++ "engine/tb_dh.c",
-    libcrypto_src_prefix ++ "engine/tb_digest.c",
-    libcrypto_src_prefix ++ "engine/tb_dsa.c",
-    libcrypto_src_prefix ++ "engine/tb_ecdh.c",
-    libcrypto_src_prefix ++ "engine/tb_ecdsa.c",
-    libcrypto_src_prefix ++ "engine/tb_eckey.c",
-    libcrypto_src_prefix ++ "engine/tb_pkmeth.c",
-    libcrypto_src_prefix ++ "engine/tb_rand.c",
-    libcrypto_src_prefix ++ "engine/tb_rsa.c",
-    libcrypto_src_prefix ++ "engine/tb_store.c",
     libcrypto_src_prefix ++ "err/err.c",
     libcrypto_src_prefix ++ "err/err_all.c",
     libcrypto_src_prefix ++ "err/err_prn.c",
@@ -886,10 +844,8 @@ const libcrypto_sources = [_][]const u8{
     libcrypto_src_prefix ++ "kdf/kdf_err.c",
     libcrypto_src_prefix ++ "lhash/lh_stats.c",
     libcrypto_src_prefix ++ "lhash/lhash.c",
-    libcrypto_src_prefix ++ "md4/md4_dgst.c",
+    libcrypto_src_prefix ++ "md4/md4.c",
-    libcrypto_src_prefix ++ "md4/md4_one.c",
+    libcrypto_src_prefix ++ "md5/md5.c",
-    libcrypto_src_prefix ++ "md5/md5_dgst.c",
-    libcrypto_src_prefix ++ "md5/md5_one.c",
     libcrypto_src_prefix ++ "modes/cbc128.c",
     libcrypto_src_prefix ++ "modes/ccm128.c",
     libcrypto_src_prefix ++ "modes/cfb128.c",
@@ -954,12 +910,11 @@ const libcrypto_sources = [_][]const u8{
     libcrypto_src_prefix ++ "rc2/rc2_skey.c",
     libcrypto_src_prefix ++ "rc2/rc2cfb64.c",
     libcrypto_src_prefix ++ "rc2/rc2ofb64.c",
-    libcrypto_src_prefix ++ "ripemd/rmd_dgst.c",
+    libcrypto_src_prefix ++ "ripemd/ripemd.c",
-    libcrypto_src_prefix ++ "ripemd/rmd_one.c",
     libcrypto_src_prefix ++ "rsa/rsa_ameth.c",
     libcrypto_src_prefix ++ "rsa/rsa_asn1.c",
+    libcrypto_src_prefix ++ "rsa/rsa_blinding.c",
     libcrypto_src_prefix ++ "rsa/rsa_chk.c",
-    libcrypto_src_prefix ++ "rsa/rsa_crpt.c",
     libcrypto_src_prefix ++ "rsa/rsa_eay.c",
     libcrypto_src_prefix ++ "rsa/rsa_err.c",
     libcrypto_src_prefix ++ "rsa/rsa_gen.c",
@@ -1063,8 +1018,8 @@ const libssl_include_paths = [_][]const u8{
     // these are order-dependent and they have to go after the "hidden" directory
     // because the "openssl" include directory is masked inside the "hidden" directory
     // in the source tree. cool.
-    install_header_prefix ++ "compat",
+    source_header_prefix ++ "compat",
-    install_header_prefix,
+    source_header_prefix,
 };
 
 const libssl_sources = [_][]const u8{
@@ -1131,8 +1086,8 @@ const libssl_sources = [_][]const u8{
 
 const libtls_include_paths = [_][]const u8{
     libssl_src_prefix,
-    install_header_prefix ++ "compat",
+    source_header_prefix ++ "compat",
-    install_header_prefix,
+    source_header_prefix,
 };
 
 const libtls_sources = [_][]const u8{

crypto/CMakeLists.txt

@@ -111,6 +111,7 @@ if(HOST_ASM_MACOSX_X86_64)
 		bn/arch/amd64/word_clz.S
 		bn/arch/amd64/bn_arch.c
 	)
+	add_definitions(-Dendbr64=)
 	add_definitions(-DAES_ASM)
 	add_definitions(-DBSAES_ASM)
 	add_definitions(-DVPAES_ASM)
@@ -256,7 +257,6 @@ set(
 	aes/aes_ctr.c
 	aes/aes_ecb.c
 	aes/aes_ige.c
-	aes/aes_misc.c
 	aes/aes_ofb.c
 	aes/aes_wrap.c
 	asn1/a_bitstr.c
@@ -293,7 +293,6 @@ set(
 	asn1/p5_pbev2.c
 	asn1/p8_pkey.c
 	asn1/t_crl.c
-	asn1/t_pkey.c
 	asn1/t_req.c
 	asn1/t_spki.c
 	asn1/t_x509.c
@@ -346,7 +345,6 @@ set(
 	bio/bss_null.c
 	bio/bss_sock.c
 	bn/bn_add.c
-	bn/bn_blind.c
 	bn/bn_bpsw.c
 	bn/bn_const.c
 	bn/bn_convert.c
@@ -363,6 +361,8 @@ set(
 	bn/bn_mont.c
 	bn/bn_mul.c
 	bn/bn_prime.c
+	bn/bn_primitives.c
+	bn/bn_print.c
 	bn/bn_rand.c
 	bn/bn_recp.c
 	bn/bn_shift.c
@@ -370,7 +370,6 @@ set(
 	bn/bn_sqr.c
 	bn/bn_word.c
 	buffer/buf_err.c
-	buffer/buf_str.c
 	buffer/buffer.c
 	bytestring/bs_ber.c
 	bytestring/bs_cbb.c
@@ -391,7 +390,6 @@ set(
 	cmac/cmac.c
 	cms/cms_asn1.c
 	cms/cms_att.c
-	cms/cms_cd.c
 	cms/cms_dd.c
 	cms/cms_enc.c
 	cms/cms_env.c
@@ -403,10 +401,6 @@ set(
 	cms/cms_pwri.c
 	cms/cms_sd.c
 	cms/cms_smime.c
-	comp/c_rle.c
-	comp/c_zlib.c
-	comp/comp_err.c
-	comp/comp_lib.c
 	conf/conf_api.c
 	conf/conf_def.c
 	conf/conf_err.c
@@ -466,11 +460,6 @@ set(
 	dsa/dsa_ossl.c
 	dsa/dsa_pmeth.c
 	dsa/dsa_prn.c
-	dso/dso_dlfcn.c
-	dso/dso_err.c
-	dso/dso_lib.c
-	dso/dso_null.c
-	dso/dso_openssl.c
 	ec/ec_ameth.c
 	ec/ec_asn1.c
 	ec/ec_check.c
@@ -489,38 +478,9 @@ set(
 	ec/ecp_oct.c
 	ec/ecp_smpl.c
 	ec/ecx_methods.c
-	ecdh/ecdh_kdf.c
+	ecdh/ecdh.c
-	ecdh/ech_err.c
+	ecdsa/ecdsa.c
-	ecdh/ech_key.c
+	engine/engine_stubs.c
-	ecdh/ech_lib.c
-	ecdsa/ecs_asn1.c
-	ecdsa/ecs_err.c
-	ecdsa/ecs_lib.c
-	ecdsa/ecs_ossl.c
-	engine/eng_all.c
-	engine/eng_cnf.c
-	engine/eng_ctrl.c
-	engine/eng_dyn.c
-	engine/eng_err.c
-	engine/eng_fat.c
-	engine/eng_init.c
-	engine/eng_lib.c
-	engine/eng_list.c
-	engine/eng_openssl.c
-	engine/eng_pkey.c
-	engine/eng_table.c
-	engine/tb_asnmth.c
-	engine/tb_cipher.c
-	engine/tb_dh.c
-	engine/tb_digest.c
-	engine/tb_dsa.c
-	engine/tb_ecdh.c
-	engine/tb_ecdsa.c
-	engine/tb_eckey.c
-	engine/tb_pkmeth.c
-	engine/tb_rand.c
-	engine/tb_rsa.c
-	engine/tb_store.c
 	err/err.c
 	err/err_all.c
 	err/err_prn.c
@@ -608,10 +568,8 @@ set(
 	kdf/kdf_err.c
 	lhash/lh_stats.c
 	lhash/lhash.c
-	md4/md4_dgst.c
+	md4/md4.c
-	md4/md4_one.c
+	md5/md5.c
-	md5/md5_dgst.c
-	md5/md5_one.c
 	modes/cbc128.c
 	modes/ccm128.c
 	modes/cfb128.c
@@ -676,12 +634,11 @@ set(
 	rc2/rc2_skey.c
 	rc2/rc2cfb64.c
 	rc2/rc2ofb64.c
-	ripemd/rmd_dgst.c
+	ripemd/ripemd.c
-	ripemd/rmd_one.c
 	rsa/rsa_ameth.c
 	rsa/rsa_asn1.c
+	rsa/rsa_blinding.c
 	rsa/rsa_chk.c
-	rsa/rsa_crpt.c
 	rsa/rsa_eay.c
 	rsa/rsa_err.c
 	rsa/rsa_gen.c
@@ -818,6 +775,11 @@ if(NOT HAVE_FREEZERO)
 	set(EXTRA_EXPORT ${EXTRA_EXPORT} freezero)
 endif()
 
+if(NOT HAVE_GETOPT)
+	set(CRYPTO_SRC ${CRYPTO_SRC} compat/getopt_long.c)
+	set(EXTRA_EXPORT ${EXTRA_EXPORT} getopt)
+endif()
+
 if(NOT HAVE_GETPAGESIZE)
 	set(CRYPTO_SRC ${CRYPTO_SRC} compat/getpagesize.c)
 endif()
@@ -942,7 +904,7 @@ else()
 		   (NOT "${CMAKE_GENERATOR_PLATFORM}" STREQUAL "x64"))
 			add_definitions(-DOPENSSL_NO_ASM)
 		endif()
-	elseif(WIN32)
+	elseif(WIN32 AND NOT MINGW)
 		add_definitions(-DOPENSSL_NO_ASM)
 	endif()
 endif()
@@ -996,7 +958,8 @@ target_include_directories(crypto_obj
 		x509
 		../include/compat
 	PUBLIC
-		../include)
+		../include
+		${CMAKE_BINARY_DIR}/include)
 
 if(HOST_AARCH64)
 	target_include_directories(crypto_obj PRIVATE bn/arch/aarch64/)
@@ -1023,13 +986,33 @@ add_library(crypto $<TARGET_OBJECTS:crypto_obj> empty.c)
 export_symbol(crypto ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym)
 target_link_libraries(crypto ${PLATFORM_LIBS})
 if (WIN32)
-	set(CRYPTO_POSTFIX -${CRYPTO_MAJOR_VERSION})
+	set(CRYPTO_POSTFIX -${CRYPTO_MAJOR_VERSION} PARENT_SCOPE)
 endif()
 set_target_properties(crypto PROPERTIES
 	OUTPUT_NAME crypto${CRYPTO_POSTFIX}
-	ARCHIVE_OUTPUT_NAME crypto${CRYPTO_POSTFIX})
+	ARCHIVE_OUTPUT_NAME crypto${CRYPTO_POSTFIX}
-set_target_properties(crypto PROPERTIES VERSION
+	EXPORT_NAME Crypto
-	${CRYPTO_VERSION} SOVERSION ${CRYPTO_MAJOR_VERSION})
+	VERSION ${CRYPTO_VERSION}
+	SOVERSION ${CRYPTO_MAJOR_VERSION}
+)
+
+target_include_directories(
+	crypto
+	PUBLIC
+	$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/include>
+	$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
+)
+
+install(
+	TARGETS crypto
+	EXPORT Crypto-target
+)
+
+export(
+	EXPORT Crypto-target
+	FILE "${LibreSSL_BINARY_DIR}/LibreSSL-Crypto.cmake"
+	NAMESPACE LibreSSL::
+)
 
 if(ENABLE_LIBRESSL_INSTALL)
 	install(
@@ -1038,6 +1021,12 @@ if(ENABLE_LIBRESSL_INSTALL)
 		LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
 		RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
 	)
+	install(
+		EXPORT Crypto-target
+		FILE "LibreSSL-Crypto.cmake"
+		NAMESPACE LibreSSL::
+		DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}"
+	)
 endif(ENABLE_LIBRESSL_INSTALL)
 
 # build static library for regression test

crypto/Makefile.am

@@ -236,7 +236,6 @@ libcrypto_la_SOURCES += aes/aes_cfb.c
 libcrypto_la_SOURCES += aes/aes_ctr.c
 libcrypto_la_SOURCES += aes/aes_ecb.c
 libcrypto_la_SOURCES += aes/aes_ige.c
-libcrypto_la_SOURCES += aes/aes_misc.c
 libcrypto_la_SOURCES += aes/aes_ofb.c
 libcrypto_la_SOURCES += aes/aes_wrap.c
 noinst_HEADERS += aes/aes_local.h
@@ -276,7 +275,6 @@ libcrypto_la_SOURCES += asn1/p5_pbe.c
 libcrypto_la_SOURCES += asn1/p5_pbev2.c
 libcrypto_la_SOURCES += asn1/p8_pkey.c
 libcrypto_la_SOURCES += asn1/t_crl.c
-libcrypto_la_SOURCES += asn1/t_pkey.c
 libcrypto_la_SOURCES += asn1/t_req.c
 libcrypto_la_SOURCES += asn1/t_spki.c
 libcrypto_la_SOURCES += asn1/t_x509.c
@@ -348,7 +346,6 @@ noinst_HEADERS += bio/bio_local.h
 
 # bn
 libcrypto_la_SOURCES += bn/bn_add.c
-libcrypto_la_SOURCES += bn/bn_blind.c
 libcrypto_la_SOURCES += bn/bn_bpsw.c
 libcrypto_la_SOURCES += bn/bn_const.c
 libcrypto_la_SOURCES += bn/bn_convert.c
@@ -365,6 +362,8 @@ libcrypto_la_SOURCES += bn/bn_mod_sqrt.c
 libcrypto_la_SOURCES += bn/bn_mont.c
 libcrypto_la_SOURCES += bn/bn_mul.c
 libcrypto_la_SOURCES += bn/bn_prime.c
+libcrypto_la_SOURCES += bn/bn_primitives.c
+libcrypto_la_SOURCES += bn/bn_print.c
 libcrypto_la_SOURCES += bn/bn_rand.c
 libcrypto_la_SOURCES += bn/bn_recp.c
 libcrypto_la_SOURCES += bn/bn_shift.c
@@ -430,7 +429,6 @@ noinst_HEADERS += bn/arch/amd64/bn_arch.h
 
 # buffer
 libcrypto_la_SOURCES += buffer/buf_err.c
-libcrypto_la_SOURCES += buffer/buf_str.c
 libcrypto_la_SOURCES += buffer/buffer.c
 noinst_HEADERS += bytestring/bytestring.h
 
@@ -469,7 +467,6 @@ libcrypto_la_SOURCES += cmac/cmac.c
 # cms
 libcrypto_la_SOURCES += cms/cms_asn1.c
 libcrypto_la_SOURCES += cms/cms_att.c
-libcrypto_la_SOURCES += cms/cms_cd.c
 libcrypto_la_SOURCES += cms/cms_dd.c
 libcrypto_la_SOURCES += cms/cms_enc.c
 libcrypto_la_SOURCES += cms/cms_env.c
@@ -483,13 +480,6 @@ libcrypto_la_SOURCES += cms/cms_sd.c
 libcrypto_la_SOURCES += cms/cms_smime.c
 noinst_HEADERS += cms/cms_local.h
 
-# comp
-libcrypto_la_SOURCES += comp/c_rle.c
-libcrypto_la_SOURCES += comp/c_zlib.c
-libcrypto_la_SOURCES += comp/comp_err.c
-libcrypto_la_SOURCES += comp/comp_lib.c
-noinst_HEADERS += comp/comp_local.h
-
 # conf
 libcrypto_la_SOURCES += conf/conf_api.c
 libcrypto_la_SOURCES += conf/conf_def.c
@@ -570,13 +560,6 @@ libcrypto_la_SOURCES += dsa/dsa_pmeth.c
 libcrypto_la_SOURCES += dsa/dsa_prn.c
 noinst_HEADERS += dsa/dsa_local.h
 
-# dso
-libcrypto_la_SOURCES += dso/dso_dlfcn.c
-libcrypto_la_SOURCES += dso/dso_err.c
-libcrypto_la_SOURCES += dso/dso_lib.c
-libcrypto_la_SOURCES += dso/dso_null.c
-libcrypto_la_SOURCES += dso/dso_openssl.c
-
 # ec
 libcrypto_la_SOURCES += ec/ec_ameth.c
 libcrypto_la_SOURCES += ec/ec_asn1.c
@@ -599,45 +582,14 @@ libcrypto_la_SOURCES += ec/ecx_methods.c
 noinst_HEADERS += ec/ec_local.h
 
 # ecdh
-libcrypto_la_SOURCES += ecdh/ecdh_kdf.c
+libcrypto_la_SOURCES += ecdh/ecdh.c
-libcrypto_la_SOURCES += ecdh/ech_err.c
-libcrypto_la_SOURCES += ecdh/ech_key.c
-libcrypto_la_SOURCES += ecdh/ech_lib.c
-noinst_HEADERS += ecdh/ech_local.h
 
 # ecdsa
-libcrypto_la_SOURCES += ecdsa/ecs_asn1.c
+libcrypto_la_SOURCES += ecdsa/ecdsa.c
-libcrypto_la_SOURCES += ecdsa/ecs_err.c
+noinst_HEADERS += ecdsa/ecdsa_local.h
-libcrypto_la_SOURCES += ecdsa/ecs_lib.c
-libcrypto_la_SOURCES += ecdsa/ecs_ossl.c
-noinst_HEADERS += ecdsa/ecs_local.h
 
 # engine
-libcrypto_la_SOURCES += engine/eng_all.c
+libcrypto_la_SOURCES += engine/engine_stubs.c
-libcrypto_la_SOURCES += engine/eng_cnf.c
-libcrypto_la_SOURCES += engine/eng_ctrl.c
-libcrypto_la_SOURCES += engine/eng_dyn.c
-libcrypto_la_SOURCES += engine/eng_err.c
-libcrypto_la_SOURCES += engine/eng_fat.c
-libcrypto_la_SOURCES += engine/eng_init.c
-libcrypto_la_SOURCES += engine/eng_lib.c
-libcrypto_la_SOURCES += engine/eng_list.c
-libcrypto_la_SOURCES += engine/eng_openssl.c
-libcrypto_la_SOURCES += engine/eng_pkey.c
-libcrypto_la_SOURCES += engine/eng_table.c
-libcrypto_la_SOURCES += engine/tb_asnmth.c
-libcrypto_la_SOURCES += engine/tb_cipher.c
-libcrypto_la_SOURCES += engine/tb_dh.c
-libcrypto_la_SOURCES += engine/tb_digest.c
-libcrypto_la_SOURCES += engine/tb_dsa.c
-libcrypto_la_SOURCES += engine/tb_ecdh.c
-libcrypto_la_SOURCES += engine/tb_ecdsa.c
-libcrypto_la_SOURCES += engine/tb_eckey.c
-libcrypto_la_SOURCES += engine/tb_pkmeth.c
-libcrypto_la_SOURCES += engine/tb_rand.c
-libcrypto_la_SOURCES += engine/tb_rsa.c
-libcrypto_la_SOURCES += engine/tb_store.c
-noinst_HEADERS += engine/eng_int.h
 
 # err
 libcrypto_la_SOURCES += err/err.c
@@ -724,10 +676,46 @@ noinst_HEADERS += gost/gost_local.h
 
 # hidden
 noinst_HEADERS += hidden/crypto_namespace.h
+noinst_HEADERS += hidden/openssl/asn1.h
+noinst_HEADERS += hidden/openssl/asn1t.h
+noinst_HEADERS += hidden/openssl/bio.h
+noinst_HEADERS += hidden/openssl/bn.h
+noinst_HEADERS += hidden/openssl/buffer.h
+noinst_HEADERS += hidden/openssl/cast.h
+noinst_HEADERS += hidden/openssl/chacha.h
+noinst_HEADERS += hidden/openssl/cmac.h
+noinst_HEADERS += hidden/openssl/cms.h
+noinst_HEADERS += hidden/openssl/conf_api.h
+noinst_HEADERS += hidden/openssl/crypto.h
+noinst_HEADERS += hidden/openssl/ct.h
+noinst_HEADERS += hidden/openssl/curve25519.h
+noinst_HEADERS += hidden/openssl/dh.h
+noinst_HEADERS += hidden/openssl/dsa.h
+noinst_HEADERS += hidden/openssl/ec.h
+noinst_HEADERS += hidden/openssl/err.h
+noinst_HEADERS += hidden/openssl/gost.h
+noinst_HEADERS += hidden/openssl/hkdf.h
 noinst_HEADERS += hidden/openssl/hmac.h
+noinst_HEADERS += hidden/openssl/idea.h
+noinst_HEADERS += hidden/openssl/lhash.h
+noinst_HEADERS += hidden/openssl/md4.h
+noinst_HEADERS += hidden/openssl/md5.h
+noinst_HEADERS += hidden/openssl/modes.h
+noinst_HEADERS += hidden/openssl/objects.h
+noinst_HEADERS += hidden/openssl/ocsp.h
+noinst_HEADERS += hidden/openssl/pem.h
 noinst_HEADERS += hidden/openssl/pkcs12.h
 noinst_HEADERS += hidden/openssl/pkcs7.h
+noinst_HEADERS += hidden/openssl/poly1305.h
+noinst_HEADERS += hidden/openssl/rand.h
+noinst_HEADERS += hidden/openssl/rc2.h
+noinst_HEADERS += hidden/openssl/rsa.h
+noinst_HEADERS += hidden/openssl/sha.h
+noinst_HEADERS += hidden/openssl/sm3.h
+noinst_HEADERS += hidden/openssl/sm4.h
 noinst_HEADERS += hidden/openssl/stack.h
+noinst_HEADERS += hidden/openssl/ts.h
+noinst_HEADERS += hidden/openssl/txt_db.h
 noinst_HEADERS += hidden/openssl/ui.h
 noinst_HEADERS += hidden/openssl/x509.h
 noinst_HEADERS += hidden/openssl/x509_vfy.h
@@ -759,14 +747,10 @@ libcrypto_la_SOURCES += lhash/lh_stats.c
 libcrypto_la_SOURCES += lhash/lhash.c
 
 # md4
-libcrypto_la_SOURCES += md4/md4_dgst.c
+libcrypto_la_SOURCES += md4/md4.c
-libcrypto_la_SOURCES += md4/md4_one.c
-noinst_HEADERS += md4/md4_local.h
 
 # md5
-libcrypto_la_SOURCES += md5/md5_dgst.c
+libcrypto_la_SOURCES += md5/md5.c
-libcrypto_la_SOURCES += md5/md5_one.c
-noinst_HEADERS += md5/md5_local.h
 
 # modes
 libcrypto_la_SOURCES += modes/cbc128.c
@@ -785,7 +769,6 @@ libcrypto_la_SOURCES += objects/obj_err.c
 libcrypto_la_SOURCES += objects/obj_lib.c
 libcrypto_la_SOURCES += objects/obj_xref.c
 noinst_HEADERS += objects/obj_dat.h
-noinst_HEADERS += objects/obj_xref.h
 
 # ocsp
 libcrypto_la_SOURCES += ocsp/ocsp_asn.c
@@ -861,16 +844,13 @@ noinst_HEADERS += rc2/rc2_local.h
 noinst_HEADERS += rc4/rc4_local.h
 
 # ripemd
-libcrypto_la_SOURCES += ripemd/rmd_dgst.c
+libcrypto_la_SOURCES += ripemd/ripemd.c
-libcrypto_la_SOURCES += ripemd/rmd_one.c
-noinst_HEADERS += ripemd/rmd_local.h
-noinst_HEADERS += ripemd/rmdconst.h
 
 # rsa
 libcrypto_la_SOURCES += rsa/rsa_ameth.c
 libcrypto_la_SOURCES += rsa/rsa_asn1.c
+libcrypto_la_SOURCES += rsa/rsa_blinding.c
 libcrypto_la_SOURCES += rsa/rsa_chk.c
-libcrypto_la_SOURCES += rsa/rsa_crpt.c
 libcrypto_la_SOURCES += rsa/rsa_eay.c
 libcrypto_la_SOURCES += rsa/rsa_err.c
 libcrypto_la_SOURCES += rsa/rsa_gen.c
@@ -897,7 +877,6 @@ noinst_HEADERS += sha/sha3_internal.h
 
 # sm3
 libcrypto_la_SOURCES += sm3/sm3.c
-noinst_HEADERS += sm3/sm3_local.h
 
 # sm4
 libcrypto_la_SOURCES += sm4/sm4.c

crypto/Makefile.am.macosx-x86_64

@@ -34,6 +34,7 @@ ASM_X86_64_MACOSX += bn/arch/amd64/bn_arch.c
 EXTRA_DIST += $(ASM_X86_64_MACOSX)
 
 if HOST_ASM_MACOSX_X86_64
+libcrypto_la_CPPFLAGS += -Dendbr64=
 libcrypto_la_CPPFLAGS += -DAES_ASM
 libcrypto_la_CPPFLAGS += -DBSAES_ASM
 libcrypto_la_CPPFLAGS += -DVPAES_ASM

crypto/compat/getopt_long.c

@@ -0,0 +1,528 @@
+/*	$OpenBSD: getopt_long.c,v 1.32 2020/05/27 22:25:09 schwarze Exp $	*/
+/*	$NetBSD: getopt_long.c,v 1.15 2002/01/31 22:43:40 tv Exp $	*/
+
+/*
+ * Copyright (c) 2002 Todd C. Miller <millert@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * Sponsored in part by the Defense Advanced Research Projects
+ * Agency (DARPA) and Air Force Research Laboratory, Air Force
+ * Materiel Command, USAF, under agreement number F39502-99-1-0512.
+ */
+/*-
+ * Copyright (c) 2000 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Dieter Baron and Thomas Klausner.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <err.h>
+#include <errno.h>
+#include <getopt.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define no_argument        0
+#define required_argument  1
+#define optional_argument  2
+
+struct option {
+    /* name of long option */
+    const char *name;
+    /*
+     * one of no_argument, required_argument, and optional_argument:
+     * whether option takes an argument
+     */
+    int has_arg;
+    /* if not NULL, set *flag to val when option found */
+    int *flag;
+    /* if flag not NULL, value to set *flag to; else return value */
+    int val;
+};
+
+int	opterr = 1;		/* if error message should be printed */
+int	optind = 1;		/* index into parent argv vector */
+int	optopt = '?';		/* character checked for validity */
+int	optreset;		/* reset getopt */
+char    *optarg;		/* argument associated with option */
+
+#if 0
+/* DEF_* only work on initialized (non-COMMON) variables */
+#endif
+
+#define PRINT_ERROR	((opterr) && (*options != ':'))
+
+#define FLAG_PERMUTE	0x01	/* permute non-options to the end of argv */
+#define FLAG_ALLARGS	0x02	/* treat non-options as args to option "-1" */
+#define FLAG_LONGONLY	0x04	/* operate as getopt_long_only */
+
+/* return values */
+#define	BADCH		(int)'?'
+#define	BADARG		((*options == ':') ? (int)':' : (int)'?')
+#define	INORDER 	(int)1
+
+#define	EMSG		""
+
+static int getopt_internal(int, char * const *, const char *,
+			   const struct option *, int *, int);
+static int parse_long_options(char * const *, const char *,
+			      const struct option *, int *, int, int);
+static int gcd(int, int);
+static void permute_args(int, int, int, char * const *);
+
+static char *place = EMSG; /* option letter processing */
+
+/* XXX: set optreset to 1 rather than these two */
+static int nonopt_start = -1; /* first non option argument (for permute) */
+static int nonopt_end = -1;   /* first option after non options (for permute) */
+
+/* Error messages */
+static const char recargchar[] = "option requires an argument -- %c";
+static const char recargstring[] = "option requires an argument -- %s";
+static const char ambig[] = "ambiguous option -- %.*s";
+static const char noarg[] = "option doesn't take an argument -- %.*s";
+static const char illoptchar[] = "unknown option -- %c";
+static const char illoptstring[] = "unknown option -- %s";
+
+/*
+ * Compute the greatest common divisor of a and b.
+ */
+static int
+gcd(int a, int b)
+{
+	int c;
+
+	c = a % b;
+	while (c != 0) {
+		a = b;
+		b = c;
+		c = a % b;
+	}
+
+	return (b);
+}
+
+/*
+ * Exchange the block from nonopt_start to nonopt_end with the block
+ * from nonopt_end to opt_end (keeping the same order of arguments
+ * in each block).
+ */
+static void
+permute_args(int panonopt_start, int panonopt_end, int opt_end,
+	char * const *nargv)
+{
+	int cstart, cyclelen, i, j, ncycle, nnonopts, nopts, pos;
+	char *swap;
+
+	/*
+	 * compute lengths of blocks and number and size of cycles
+	 */
+	nnonopts = panonopt_end - panonopt_start;
+	nopts = opt_end - panonopt_end;
+	ncycle = gcd(nnonopts, nopts);
+	cyclelen = (opt_end - panonopt_start) / ncycle;
+
+	for (i = 0; i < ncycle; i++) {
+		cstart = panonopt_end+i;
+		pos = cstart;
+		for (j = 0; j < cyclelen; j++) {
+			if (pos >= panonopt_end)
+				pos -= nnonopts;
+			else
+				pos += nopts;
+			swap = nargv[pos];
+			((char **)nargv)[pos] = nargv[cstart];
+			((char **)nargv)[cstart] = swap;
+		}
+	}
+}
+
+/*
+ * parse_long_options --
+ *	Parse long options in argc/argv argument vector.
+ * Returns -1 if short_too is set and the option does not match long_options.
+ */
+static int
+parse_long_options(char * const *nargv, const char *options,
+	const struct option *long_options, int *idx, int short_too, int flags)
+{
+	char *current_argv, *has_equal;
+	size_t current_argv_len;
+	int i, match, exact_match, second_partial_match;
+
+	current_argv = place;
+	match = -1;
+	exact_match = 0;
+	second_partial_match = 0;
+
+	optind++;
+
+	if ((has_equal = strchr(current_argv, '=')) != NULL) {
+		/* argument found (--option=arg) */
+		current_argv_len = has_equal - current_argv;
+		has_equal++;
+	} else
+		current_argv_len = strlen(current_argv);
+
+	for (i = 0; long_options[i].name; i++) {
+		/* find matching long option */
+		if (strncmp(current_argv, long_options[i].name,
+		    current_argv_len))
+			continue;
+
+		if (strlen(long_options[i].name) == current_argv_len) {
+			/* exact match */
+			match = i;
+			exact_match = 1;
+			break;
+		}
+		/*
+		 * If this is a known short option, don't allow
+		 * a partial match of a single character.
+		 */
+		if (short_too && current_argv_len == 1)
+			continue;
+
+		if (match == -1)	/* first partial match */
+			match = i;
+		else if ((flags & FLAG_LONGONLY) ||
+		    long_options[i].has_arg != long_options[match].has_arg ||
+		    long_options[i].flag != long_options[match].flag ||
+		    long_options[i].val != long_options[match].val)
+			second_partial_match = 1;
+	}
+	if (!exact_match && second_partial_match) {
+		/* ambiguous abbreviation */
+		if (PRINT_ERROR)
+			warnx(ambig, (int)current_argv_len, current_argv);
+		optopt = 0;
+		return (BADCH);
+	}
+	if (match != -1) {		/* option found */
+		if (long_options[match].has_arg == no_argument
+		    && has_equal) {
+			if (PRINT_ERROR)
+				warnx(noarg, (int)current_argv_len,
+				     current_argv);
+			/*
+			 * XXX: GNU sets optopt to val regardless of flag
+			 */
+			if (long_options[match].flag == NULL)
+				optopt = long_options[match].val;
+			else
+				optopt = 0;
+			return (BADARG);
+		}
+		if (long_options[match].has_arg == required_argument ||
+		    long_options[match].has_arg == optional_argument) {
+			if (has_equal)
+				optarg = has_equal;
+			else if (long_options[match].has_arg ==
+			    required_argument) {
+				/*
+				 * optional argument doesn't use next nargv
+				 */
+				optarg = nargv[optind++];
+			}
+		}
+		if ((long_options[match].has_arg == required_argument)
+		    && (optarg == NULL)) {
+			/*
+			 * Missing argument; leading ':' indicates no error
+			 * should be generated.
+			 */
+			if (PRINT_ERROR)
+				warnx(recargstring,
+				    current_argv);
+			/*
+			 * XXX: GNU sets optopt to val regardless of flag
+			 */
+			if (long_options[match].flag == NULL)
+				optopt = long_options[match].val;
+			else
+				optopt = 0;
+			--optind;
+			return (BADARG);
+		}
+	} else {			/* unknown option */
+		if (short_too) {
+			--optind;
+			return (-1);
+		}
+		if (PRINT_ERROR)
+			warnx(illoptstring, current_argv);
+		optopt = 0;
+		return (BADCH);
+	}
+	if (idx)
+		*idx = match;
+	if (long_options[match].flag) {
+		*long_options[match].flag = long_options[match].val;
+		return (0);
+	} else
+		return (long_options[match].val);
+}
+
+/*
+ * getopt_internal --
+ *	Parse argc/argv argument vector.  Called by user level routines.
+ */
+static int
+getopt_internal(int nargc, char * const *nargv, const char *options,
+	const struct option *long_options, int *idx, int flags)
+{
+	char *oli;				/* option letter list index */
+	int optchar, short_too;
+	static int posixly_correct = -1;
+
+	if (options == NULL)
+		return (-1);
+
+	/*
+	 * XXX Some GNU programs (like cvs) set optind to 0 instead of
+	 * XXX using optreset.  Work around this braindamage.
+	 */
+	if (optind == 0)
+		optind = optreset = 1;
+
+	/*
+	 * Disable GNU extensions if POSIXLY_CORRECT is set or options
+	 * string begins with a '+'.
+	 */
+	if (posixly_correct == -1 || optreset)
+		posixly_correct = (getenv("POSIXLY_CORRECT") != NULL);
+	if (*options == '-')
+		flags |= FLAG_ALLARGS;
+	else if (posixly_correct || *options == '+')
+		flags &= ~FLAG_PERMUTE;
+	if (*options == '+' || *options == '-')
+		options++;
+
+	optarg = NULL;
+	if (optreset)
+		nonopt_start = nonopt_end = -1;
+start:
+	if (optreset || !*place) {		/* update scanning pointer */
+		optreset = 0;
+		if (optind >= nargc) {          /* end of argument vector */
+			place = EMSG;
+			if (nonopt_end != -1) {
+				/* do permutation, if we have to */
+				permute_args(nonopt_start, nonopt_end,
+				    optind, nargv);
+				optind -= nonopt_end - nonopt_start;
+			}
+			else if (nonopt_start != -1) {
+				/*
+				 * If we skipped non-options, set optind
+				 * to the first of them.
+				 */
+				optind = nonopt_start;
+			}
+			nonopt_start = nonopt_end = -1;
+			return (-1);
+		}
+		if (*(place = nargv[optind]) != '-' ||
+		    (place[1] == '\0' && strchr(options, '-') == NULL)) {
+			place = EMSG;		/* found non-option */
+			if (flags & FLAG_ALLARGS) {
+				/*
+				 * GNU extension:
+				 * return non-option as argument to option 1
+				 */
+				optarg = nargv[optind++];
+				return (INORDER);
+			}
+			if (!(flags & FLAG_PERMUTE)) {
+				/*
+				 * If no permutation wanted, stop parsing
+				 * at first non-option.
+				 */
+				return (-1);
+			}
+			/* do permutation */
+			if (nonopt_start == -1)
+				nonopt_start = optind;
+			else if (nonopt_end != -1) {
+				permute_args(nonopt_start, nonopt_end,
+				    optind, nargv);
+				nonopt_start = optind -
+				    (nonopt_end - nonopt_start);
+				nonopt_end = -1;
+			}
+			optind++;
+			/* process next argument */
+			goto start;
+		}
+		if (nonopt_start != -1 && nonopt_end == -1)
+			nonopt_end = optind;
+
+		/*
+		 * If we have "-" do nothing, if "--" we are done.
+		 */
+		if (place[1] != '\0' && *++place == '-' && place[1] == '\0') {
+			optind++;
+			place = EMSG;
+			/*
+			 * We found an option (--), so if we skipped
+			 * non-options, we have to permute.
+			 */
+			if (nonopt_end != -1) {
+				permute_args(nonopt_start, nonopt_end,
+				    optind, nargv);
+				optind -= nonopt_end - nonopt_start;
+			}
+			nonopt_start = nonopt_end = -1;
+			return (-1);
+		}
+	}
+
+	/*
+	 * Check long options if:
+	 *  1) we were passed some
+	 *  2) the arg is not just "-"
+	 *  3) either the arg starts with -- we are getopt_long_only()
+	 */
+	if (long_options != NULL && place != nargv[optind] &&
+	    (*place == '-' || (flags & FLAG_LONGONLY))) {
+		short_too = 0;
+		if (*place == '-')
+			place++;		/* --foo long option */
+		else if (*place != ':' && strchr(options, *place) != NULL)
+			short_too = 1;		/* could be short option too */
+
+		optchar = parse_long_options(nargv, options, long_options,
+		    idx, short_too, flags);
+		if (optchar != -1) {
+			place = EMSG;
+			return (optchar);
+		}
+	}
+
+	if ((optchar = (int)*place++) == (int)':' ||
+	    (oli = strchr(options, optchar)) == NULL) {
+		if (!*place)
+			++optind;
+		if (PRINT_ERROR)
+			warnx(illoptchar, optchar);
+		optopt = optchar;
+		return (BADCH);
+	}
+	if (long_options != NULL && optchar == 'W' && oli[1] == ';') {
+		/* -W long-option */
+		if (*place)			/* no space */
+			/* NOTHING */;
+		else if (++optind >= nargc) {	/* no arg */
+			place = EMSG;
+			if (PRINT_ERROR)
+				warnx(recargchar, optchar);
+			optopt = optchar;
+			return (BADARG);
+		} else				/* white space */
+			place = nargv[optind];
+		optchar = parse_long_options(nargv, options, long_options,
+		    idx, 0, flags);
+		place = EMSG;
+		return (optchar);
+	}
+	if (*++oli != ':') {			/* doesn't take argument */
+		if (!*place)
+			++optind;
+	} else {				/* takes (optional) argument */
+		optarg = NULL;
+		if (*place)			/* no white space */
+			optarg = place;
+		else if (oli[1] != ':') {	/* arg not optional */
+			if (++optind >= nargc) {	/* no arg */
+				place = EMSG;
+				if (PRINT_ERROR)
+					warnx(recargchar, optchar);
+				optopt = optchar;
+				return (BADARG);
+			} else
+				optarg = nargv[optind];
+		}
+		place = EMSG;
+		++optind;
+	}
+	/* dump back option letter */
+	return (optchar);
+}
+
+/*
+ * getopt --
+ *	Parse argc/argv argument vector.
+ */
+int
+getopt(int nargc, char * const *nargv, const char *options)
+{
+
+	/*
+	 * We don't pass FLAG_PERMUTE to getopt_internal() since
+	 * the BSD getopt(3) (unlike GNU) has never done this.
+	 *
+	 * Furthermore, since many privileged programs call getopt()
+	 * before dropping privileges it makes sense to keep things
+	 * as simple (and bug-free) as possible.
+	 */
+	return (getopt_internal(nargc, nargv, options, NULL, NULL, 0));
+}
+
+/*
+ * getopt_long --
+ *	Parse argc/argv argument vector.
+ */
+int
+getopt_long(int nargc, char * const *nargv, const char *options,
+    const struct option *long_options, int *idx)
+{
+
+	return (getopt_internal(nargc, nargv, options, long_options, idx,
+	    FLAG_PERMUTE));
+}
+
+/*
+ * getopt_long_only --
+ *	Parse argc/argv argument vector.
+ */
+int
+getopt_long_only(int nargc, char * const *nargv, const char *options,
+    const struct option *long_options, int *idx)
+{
+
+	return (getopt_internal(nargc, nargv, options, long_options, idx,
+	    FLAG_PERMUTE|FLAG_LONGONLY));
+}

crypto/compat/posix_win.c

@@ -148,6 +148,49 @@ wsa_errno(int err)
 	return -1;
 }
 
+/*
+ * Employ a similar trick to cpython (pycore_fileutils.h) where the CRT report
+ * handler is disabled while checking if a descriptor is a socket or a file
+ */
+#if defined _MSC_VER && _MSC_VER >= 1900
+
+#include <crtdbg.h>
+#include <stdlib.h>
+
+static void noop_handler(const wchar_t *expression,	const wchar_t *function,
+    const wchar_t *file, unsigned int line, uintptr_t pReserved)
+{
+	return;
+}
+
+#define BEGIN_SUPPRESS_IPH \
+	_invalid_parameter_handler old_handler = _set_thread_local_invalid_parameter_handler(noop_handler)
+#define END_SUPPRESS_IPH \
+	_set_thread_local_invalid_parameter_handler(old_handler)
+
+#else
+
+#define BEGIN_SUPPRESS_IPH
+#define END_SUPPRESS_IPH
+
+#endif
+
+static int
+is_socket(int fd)
+{
+	intptr_t hd;
+
+	BEGIN_SUPPRESS_IPH;
+	hd = _get_osfhandle(fd);
+	END_SUPPRESS_IPH;
+
+	if (hd == (intptr_t)INVALID_HANDLE_VALUE) {
+		return 1; /* fd is not file descriptor */
+	}
+
+	return 0;
+}
+
 int
 posix_connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
 {
@@ -160,24 +203,31 @@ posix_connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
 int
 posix_close(int fd)
 {
-	if (closesocket(fd) == SOCKET_ERROR) {
+	int rc;
-		int err = WSAGetLastError();
+
-		return (err == WSAENOTSOCK || err == WSAEBADF ||
+	if (is_socket(fd)) {
-		    err == WSANOTINITIALISED) ?
+		if ((rc = closesocket(fd)) == SOCKET_ERROR) {
-			close(fd) : wsa_errno(err);
+			int err = WSAGetLastError();
+			rc = wsa_errno(err);
+		}
+	} else {
+		rc = close(fd);
 	}
-	return 0;
+	return rc;
 }
 
 ssize_t
 posix_read(int fd, void *buf, size_t count)
 {
-	ssize_t rc = recv(fd, buf, count, 0);
+	ssize_t rc;
-	if (rc == SOCKET_ERROR) {
+
-		int err = WSAGetLastError();
+	if (is_socket(fd)) {
-		return (err == WSAENOTSOCK || err == WSAEBADF ||
+		if ((rc = recv(fd, buf, count, 0)) == SOCKET_ERROR) {
-		    err == WSANOTINITIALISED) ?
+			int err = WSAGetLastError();
-			read(fd, buf, count) : wsa_errno(err);
+			rc = wsa_errno(err);
+		}
+	} else {
+		rc = read(fd, buf, count);
 	}
 	return rc;
 }
@@ -185,12 +235,13 @@ posix_read(int fd, void *buf, size_t count)
 ssize_t
 posix_write(int fd, const void *buf, size_t count)
 {
-	ssize_t rc = send(fd, buf, count, 0);
+	ssize_t rc;
-	if (rc == SOCKET_ERROR) {
+	if (is_socket(fd)) {
-		int err = WSAGetLastError();
+		if ((rc = send(fd, buf, count, 0)) == SOCKET_ERROR) {
-		return (err == WSAENOTSOCK || err == WSAEBADF ||
+			rc = wsa_errno(WSAGetLastError());
-		    err == WSANOTINITIALISED) ?
+		}
-			write(fd, buf, count) : wsa_errno(err);
+	} else {
+		rc = write(fd, buf, count);
 	}
 	return rc;
 }
@@ -199,17 +250,32 @@ int
 posix_getsockopt(int sockfd, int level, int optname,
 	void *optval, socklen_t *optlen)
 {
-	int rc = getsockopt(sockfd, level, optname, (char *)optval, optlen);
+	int rc;
-	return rc == 0 ? 0 : wsa_errno(WSAGetLastError());
+	if (is_socket(sockfd)) {
-
+		rc = getsockopt(sockfd, level, optname, (char *)optval, optlen);
+		if (rc != 0) {
+			rc = wsa_errno(WSAGetLastError());
+		}
+	} else {
+		rc = -1;
+	}
+	return rc;
 }
 
 int
 posix_setsockopt(int sockfd, int level, int optname,
 	const void *optval, socklen_t optlen)
 {
-	int rc = setsockopt(sockfd, level, optname, (char *)optval, optlen);
+	int rc;
-	return rc == 0 ? 0 : wsa_errno(WSAGetLastError());
+	if (is_socket(sockfd)) {
+		rc = setsockopt(sockfd, level, optname, (char *)optval, optlen);
+		if (rc != 0) {
+			rc = wsa_errno(WSAGetLastError());
+		}
+	} else {
+		rc = -1;
+	}
+	return rc;
 }
 
 uid_t getuid(void)
@@ -241,5 +307,4 @@ int gettimeofday(struct timeval * tp, struct timezone * tzp)
 	tp->tv_usec = (long)(system_time.wMilliseconds * 1000);
 	return 0;
 }
-
 #endif

include/CMakeLists.txt

@@ -4,9 +4,20 @@ if(ENABLE_LIBRESSL_INSTALL)
 	        PATTERN "CMakeLists.txt" EXCLUDE
 	        PATTERN "compat" EXCLUDE
 	        PATTERN "pqueue.h" EXCLUDE
-	        PATTERN "Makefile*" EXCLUDE)
+	        PATTERN "Makefile*" EXCLUDE
+	        PATTERN "arch" EXCLUDE)
+	install(FILES ${CMAKE_BINARY_DIR}/include/openssl/opensslconf.h
+	        DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/openssl")
 endif(ENABLE_LIBRESSL_INSTALL)
 
+file(COPY .
+	DESTINATION "${CMAKE_BINARY_DIR}/include"
+	PATTERN "CMakeLists.txt" EXCLUDE
+	PATTERN "compat" EXCLUDE
+	PATTERN "pqueue.h" EXCLUDE
+	PATTERN "Makefile*" EXCLUDE
+	PATTERN "arch" EXCLUDE)
+
 if(HOST_AARCH64)
 	file(READ arch/aarch64/opensslconf.h OPENSSLCONF)
 elseif(HOST_ARM)
@@ -28,4 +39,4 @@ elseif(HOST_SPARC64)
 elseif(HOST_X86_64)
 	file(READ arch/amd64/opensslconf.h OPENSSLCONF)
 endif()
-file(WRITE openssl/opensslconf.h "${OPENSSLCONF}")
+file(WRITE ${CMAKE_BINARY_DIR}/include/openssl/opensslconf.h "${OPENSSLCONF}")

include/compat/endian.h

@@ -8,9 +8,9 @@
 
 #if defined(_WIN32)
 
-#define LITTLE_ENDIAN  1234
+#define LITTLE_ENDIAN 1234
 #define BIG_ENDIAN 4321
-#define PDP_ENDIAN	3412
+#define PDP_ENDIAN 3412
 
 /*
  * Use GCC and Visual Studio compiler defines to determine endian.
@@ -28,8 +28,8 @@
 #include_next <machine/endian.h>
 
 #elif defined(__sun) || defined(_AIX) || defined(__hpux)
-#include <sys/types.h>
 #include <arpa/nameser_compat.h>
+#include <sys/types.h>
 
 #elif defined(__sgi)
 #include <standards.h>
@@ -39,10 +39,9 @@
 
 #ifndef __STRICT_ALIGNMENT
 #define __STRICT_ALIGNMENT
-#if defined(__i386)    || defined(__i386__)    || \
+#if defined(__i386) || defined(__i386__) || defined(__x86_64) ||               \
-    defined(__x86_64)  || defined(__x86_64__)  || \
+    defined(__x86_64__) || defined(__s390__) || defined(__s390x__) ||          \
-    defined(__s390__)  || defined(__s390x__)   || \
+    defined(__aarch64__) ||                                                    \
-    defined(__aarch64__)                       || \
     ((defined(__arm__) || defined(__arm)) && __ARM_ARCH >= 6)
 #undef __STRICT_ALIGNMENT
 #endif
@@ -52,7 +51,9 @@
 #include <libkern/OSByteOrder.h>
 #define be16toh(x) OSSwapBigToHostInt16((x))
 #define htobe16(x) OSSwapHostToBigInt16((x))
+#define le32toh(x) OSSwapLittleToHostInt32((x))
 #define be32toh(x) OSSwapBigToHostInt32((x))
+#define htole32(x) OSSwapHostToLittleInt32(x)
 #define htobe32(x) OSSwapHostToBigInt32(x)
 #define htole64(x) OSSwapHostToLittleInt64(x)
 #define htobe64(x) OSSwapHostToBigInt64(x)
@@ -65,15 +66,23 @@
 
 #define be16toh(x) ntohs((x))
 #define htobe16(x) htons((x))
+#define le32toh(x) (x)
 #define be32toh(x) ntohl((x))
+#define htole32(x) (x)
 #define htobe32(x) ntohl((x))
 #define be64toh(x) ntohll((x))
 
 #if !defined(ntohll)
-#define ntohll(x) ((1==htonl(1)) ? (x) : ((uint64_t)ntohl((x) & 0xFFFFFFFF) << 32) | ntohl((x) >> 32))
+#define ntohll(x)                                                              \
+  ((1 == htonl(1))                                                             \
+       ? (x)                                                                   \
+       : ((uint64_t)ntohl((x)&0xFFFFFFFF) << 32) | ntohl((x) >> 32))
 #endif
 #if !defined(htonll)
-#define htonll(x) ((1==ntohl(1)) ? (x) : ((uint64_t)htonl((x) & 0xFFFFFFFF) << 32) | htonl((x) >> 32))
+#define htonll(x)                                                              \
+  ((1 == ntohl(1))                                                             \
+       ? (x)                                                                   \
+       : ((uint64_t)htonl((x)&0xFFFFFFFF) << 32) | htonl((x) >> 32))
 #endif
 
 #define htobe64(x) ntohll((x))
@@ -81,13 +90,13 @@
 
 #ifdef __linux__
 #if !defined(betoh16)
-#define betoh16	be16toh
+#define betoh16(x) be16toh(x)
 #endif
 #if !defined(betoh32)
-#define betoh32	be32toh
+#define betoh32(x) be32toh(x)
 #endif
 #if !defined(betoh64)
-#define betoh64	be64toh
+#define betoh64(x) be64toh(x)
 #endif
 #endif /* __linux__ */
 
@@ -96,26 +105,38 @@
 #include <sys/endian.h>
 #endif
 #if !defined(betoh16)
-#define betoh16	be16toh
+#define betoh16(x) be16toh(x)
 #endif
 #if !defined(betoh32)
-#define betoh32	be32toh
+#define betoh32(x) be32toh(x)
 #endif
 #if !defined(betoh64)
-#define betoh64	be64toh
+#define betoh64(x) be64toh(x)
 #endif
 #endif
 
 #if defined(__NetBSD__)
 #if !defined(betoh16)
-#define betoh16	be16toh
+#define betoh16(x) be16toh(x)
 #endif
 #if !defined(betoh32)
-#define betoh32	be32toh
+#define betoh32(x) be32toh(x)
 #endif
 #if !defined(betoh64)
-#define betoh64	be64toh
+#define betoh64(x) be64toh(x)
 #endif
 #endif
 
+#if defined(__sun)
+#include <sys/byteorder.h>
+#define be16toh(x) BE_16(x)
+#define htobe16(x) BE_16(x)
+#define le32toh(x) LE_32(x)
+#define be32toh(x) BE_32(x)
+#define htole32(x) LE_32(x)
+#define htobe32(x) BE_32(x)
+#define be64toh(x) BE_64(x)
+#define htobe64(x) BE_64(x)
+#endif
+
 #endif

include/compat/getopt.h

@@ -0,0 +1,50 @@
+/*	$OpenBSD: getopt.h,v 1.3 2013/11/22 21:32:49 millert Exp $	*/
+/*	$NetBSD: getopt.h,v 1.4 2000/07/07 10:43:54 ad Exp $	*/
+
+/*-
+ * Copyright (c) 2000 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Dieter Baron and Thomas Klausner.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifdef HAVE_GETOPT
+
+#include_next <getopt.h>
+
+#else
+
+#ifndef _GETOPT_DEFINED_
+#define _GETOPT_DEFINED_
+int	 getopt(int, char * const *, const char *);
+
+extern   char *optarg;                  /* getopt(3) external variables */
+extern   int opterr;
+extern   int optind;
+extern   int optopt;
+extern   int optreset;
+#endif
+
+#endif /* HAVE_GETOPT */

include/compat/stdint.h

@@ -16,4 +16,16 @@
 #include <limits.h>
 #endif
 
+#if !defined(HAVE_ATTRIBUTE__BOUNDED__) && !defined(__bounded__)
+# define __bounded__(x, y, z)
+#endif
+
+#if !defined(HAVE_ATTRIBUTE__DEAD) && !defined(__dead)
+#ifdef _MSC_VER
+#define __dead      __declspec(noreturn)
+#else
+#define __dead      __attribute__((__noreturn__))
+#endif
+#endif
+
 #endif

include/compat/sys/types.h

@@ -45,18 +45,6 @@ typedef SSIZE_T ssize_t;
 
 #endif
 
-#if !defined(HAVE_ATTRIBUTE__BOUNDED__) && !defined(__bounded__)
-# define __bounded__(x, y, z)
-#endif
-
-#if !defined(HAVE_ATTRIBUTE__DEAD) && !defined(__dead)
-#ifdef _MSC_VER
-#define __dead      __declspec(noreturn)
-#else
-#define __dead      __attribute__((__noreturn__))
-#endif
-#endif
-
 #ifdef _WIN32
 #define __warn_references(sym,msg)
 #else

include/compat/unistd.h

@@ -64,6 +64,10 @@ int getentropy(void *buf, size_t buflen);
 #endif
 #endif
 
+#ifndef HAVE_GETOPT
+#include <getopt.h>
+#endif
+
 #ifndef HAVE_GETPAGESIZE
 int getpagesize(void);
 #endif

m4/check-libc.m4

@@ -11,7 +11,7 @@ AC_CHECK_FUNCS([asprintf freezero memmem])
 AC_CHECK_FUNCS([readpassphrase reallocarray recallocarray])
 AC_CHECK_FUNCS([strlcat strlcpy strndup strnlen strsep strtonum])
 AC_CHECK_FUNCS([timegm _mkgmtime timespecsub])
-AC_CHECK_FUNCS([getprogname syslog syslog_r])
+AC_CHECK_FUNCS([getopt getprogname syslog syslog_r])
 AC_CACHE_CHECK([for getpagesize], ac_cv_func_getpagesize, [
 	AC_LINK_IFELSE([AC_LANG_PROGRAM([[
 #include <unistd.h>
@@ -25,6 +25,7 @@ AC_CACHE_CHECK([for getpagesize], ac_cv_func_getpagesize, [
 AM_CONDITIONAL([HAVE_ASPRINTF], [test "x$ac_cv_func_asprintf" = xyes])
 AM_CONDITIONAL([HAVE_FREEZERO], [test "x$ac_cv_func_freezero" = xyes])
 AM_CONDITIONAL([HAVE_GETPAGESIZE], [test "x$ac_cv_func_getpagesize" = xyes])
+AM_CONDITIONAL([HAVE_GETOPT], [test "x$ac_cv_func_getopt" = xyes])
 AM_CONDITIONAL([HAVE_MEMMEM], [test "x$ac_cv_func_memmem" = xyes])
 AM_CONDITIONAL([HAVE_READPASSPHRASE], [test "x$ac_cv_func_readpassphrase" = xyes])
 AM_CONDITIONAL([HAVE_REALLOCARRAY], [test "x$ac_cv_func_reallocarray" = xyes])

man/links

@@ -6,9 +6,6 @@ AES_encrypt.3,AES_cbc_encrypt.3
 AES_encrypt.3,AES_decrypt.3
 AES_encrypt.3,AES_set_decrypt_key.3
 AES_encrypt.3,AES_set_encrypt_key.3
-ASN1_BIT_STRING_num_asc.3,ASN1_BIT_STRING_name_print.3
-ASN1_BIT_STRING_num_asc.3,ASN1_BIT_STRING_set_asc.3
-ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_check.3
 ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_get_bit.3
 ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_set_bit.3
 ASN1_INTEGER_get.3,ASN1_ENUMERATED_get.3
@@ -148,7 +145,6 @@ BF_set_key.3,BF_decrypt.3
 BF_set_key.3,BF_ecb_encrypt.3
 BF_set_key.3,BF_encrypt.3
 BF_set_key.3,BF_ofb64_encrypt.3
-BF_set_key.3,BF_options.3
 BIO_accept.3,BIO_get_accept_socket.3
 BIO_accept.3,BIO_get_host_ip.3
 BIO_accept.3,BIO_get_port.3
@@ -179,11 +175,6 @@ BIO_dump.3,BIO_dump_fp.3
 BIO_dump.3,BIO_dump_indent.3
 BIO_dump.3,BIO_dump_indent_fp.3
 BIO_dup_chain.3,BIO_dup_state.3
-BIO_f_asn1.3,BIO_asn1_get_prefix.3
-BIO_f_asn1.3,BIO_asn1_get_suffix.3
-BIO_f_asn1.3,BIO_asn1_set_prefix.3
-BIO_f_asn1.3,BIO_asn1_set_suffix.3
-BIO_f_asn1.3,asn1_ps_func.3
 BIO_f_buffer.3,BIO_get_buffer_num_lines.3
 BIO_f_buffer.3,BIO_set_buffer_read_data.3
 BIO_f_buffer.3,BIO_set_buffer_size.3
@@ -230,12 +221,6 @@ BIO_get_ex_new_index.3,BIO_get_app_data.3
 BIO_get_ex_new_index.3,BIO_get_ex_data.3
 BIO_get_ex_new_index.3,BIO_set_app_data.3
 BIO_get_ex_new_index.3,BIO_set_ex_data.3
-BIO_get_ex_new_index.3,ECDH_get_ex_data.3
-BIO_get_ex_new_index.3,ECDH_get_ex_new_index.3
-BIO_get_ex_new_index.3,ECDH_set_ex_data.3
-BIO_get_ex_new_index.3,ECDSA_get_ex_data.3
-BIO_get_ex_new_index.3,ECDSA_get_ex_new_index.3
-BIO_get_ex_new_index.3,ECDSA_set_ex_data.3
 BIO_get_ex_new_index.3,EC_KEY_get_ex_data.3
 BIO_get_ex_new_index.3,EC_KEY_get_ex_new_index.3
 BIO_get_ex_new_index.3,EC_KEY_set_ex_data.3
@@ -359,39 +344,9 @@ BIO_should_retry.3,BIO_set_retry_reason.3
 BIO_should_retry.3,BIO_should_io_special.3
 BIO_should_retry.3,BIO_should_read.3
 BIO_should_retry.3,BIO_should_write.3
-BN_BLINDING_new.3,BN_BLINDING_convert.3
-BN_BLINDING_new.3,BN_BLINDING_convert_ex.3
-BN_BLINDING_new.3,BN_BLINDING_create_param.3
-BN_BLINDING_new.3,BN_BLINDING_free.3
-BN_BLINDING_new.3,BN_BLINDING_get_flags.3
-BN_BLINDING_new.3,BN_BLINDING_invert.3
-BN_BLINDING_new.3,BN_BLINDING_invert_ex.3
-BN_BLINDING_new.3,BN_BLINDING_set_flags.3
-BN_BLINDING_new.3,BN_BLINDING_thread_id.3
-BN_BLINDING_new.3,BN_BLINDING_update.3
 BN_CTX_new.3,BN_CTX_free.3
 BN_CTX_start.3,BN_CTX_end.3
 BN_CTX_start.3,BN_CTX_get.3
-BN_GF2m_add.3,BN_GF2m_arr2poly.3
-BN_GF2m_add.3,BN_GF2m_cmp.3
-BN_GF2m_add.3,BN_GF2m_mod.3
-BN_GF2m_add.3,BN_GF2m_mod_arr.3
-BN_GF2m_add.3,BN_GF2m_mod_div.3
-BN_GF2m_add.3,BN_GF2m_mod_div_arr.3
-BN_GF2m_add.3,BN_GF2m_mod_exp.3
-BN_GF2m_add.3,BN_GF2m_mod_exp_arr.3
-BN_GF2m_add.3,BN_GF2m_mod_inv.3
-BN_GF2m_add.3,BN_GF2m_mod_inv_arr.3
-BN_GF2m_add.3,BN_GF2m_mod_mul.3
-BN_GF2m_add.3,BN_GF2m_mod_mul_arr.3
-BN_GF2m_add.3,BN_GF2m_mod_solve_quad.3
-BN_GF2m_add.3,BN_GF2m_mod_solve_quad_arr.3
-BN_GF2m_add.3,BN_GF2m_mod_sqr.3
-BN_GF2m_add.3,BN_GF2m_mod_sqr_arr.3
-BN_GF2m_add.3,BN_GF2m_mod_sqrt.3
-BN_GF2m_add.3,BN_GF2m_mod_sqrt_arr.3
-BN_GF2m_add.3,BN_GF2m_poly2arr.3
-BN_GF2m_add.3,BN_GF2m_sub.3
 BN_add.3,BN_div.3
 BN_add.3,BN_exp.3
 BN_add.3,BN_gcd.3
@@ -447,10 +402,13 @@ BN_generate_prime.3,BN_GENCB_set_old.3
 BN_generate_prime.3,BN_generate_prime_ex.3
 BN_generate_prime.3,BN_is_prime_ex.3
 BN_generate_prime.3,BN_is_prime_fasttest_ex.3
-BN_get0_nist_prime_521.3,BN_get0_nist_prime_192.3
+BN_get_rfc3526_prime_8192.3,BN_get_rfc2409_prime_1024.3
-BN_get0_nist_prime_521.3,BN_get0_nist_prime_224.3
+BN_get_rfc3526_prime_8192.3,BN_get_rfc2409_prime_768.3
-BN_get0_nist_prime_521.3,BN_get0_nist_prime_256.3
+BN_get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_1536.3
-BN_get0_nist_prime_521.3,BN_get0_nist_prime_384.3
+BN_get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_2048.3
+BN_get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_3072.3
+BN_get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_4096.3
+BN_get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_6144.3
 BN_mod_mul_montgomery.3,BN_MONT_CTX_copy.3
 BN_mod_mul_montgomery.3,BN_MONT_CTX_free.3
 BN_mod_mul_montgomery.3,BN_MONT_CTX_new.3
@@ -458,19 +416,9 @@ BN_mod_mul_montgomery.3,BN_MONT_CTX_set.3
 BN_mod_mul_montgomery.3,BN_MONT_CTX_set_locked.3
 BN_mod_mul_montgomery.3,BN_from_montgomery.3
 BN_mod_mul_montgomery.3,BN_to_montgomery.3
-BN_mod_mul_reciprocal.3,BN_RECP_CTX_free.3
-BN_mod_mul_reciprocal.3,BN_RECP_CTX_init.3
-BN_mod_mul_reciprocal.3,BN_RECP_CTX_new.3
-BN_mod_mul_reciprocal.3,BN_RECP_CTX_set.3
-BN_mod_mul_reciprocal.3,BN_div_recp.3
-BN_mod_mul_reciprocal.3,BN_reciprocal.3
 BN_new.3,BN_clear.3
 BN_new.3,BN_clear_free.3
 BN_new.3,BN_free.3
-BN_nist_mod_521.3,BN_nist_mod_192.3
-BN_nist_mod_521.3,BN_nist_mod_224.3
-BN_nist_mod_521.3,BN_nist_mod_256.3
-BN_nist_mod_521.3,BN_nist_mod_384.3
 BN_num_bytes.3,BN_num_bits.3
 BN_num_bytes.3,BN_num_bits_word.3
 BN_rand.3,BN_pseudo_rand.3
@@ -493,8 +441,6 @@ BN_zero.3,BN_value_one.3
 BUF_MEM_new.3,BUF_MEM_free.3
 BUF_MEM_new.3,BUF_MEM_grow.3
 BUF_MEM_new.3,BUF_MEM_grow_clean.3
-BUF_MEM_new.3,BUF_reverse.3
-BUF_MEM_new.3,BUF_strdup.3
 CMAC_Init.3,CMAC_CTX_cleanup.3
 CMAC_Init.3,CMAC_CTX_copy.3
 CMAC_Init.3,CMAC_CTX_free.3
@@ -528,9 +474,11 @@ CMS_get0_RecipientInfos.3,CMS_RecipientInfo_type.3
 CMS_get0_SignerInfos.3,CMS_SignerInfo_cert_cmp.3
 CMS_get0_SignerInfos.3,CMS_SignerInfo_get0_signature.3
 CMS_get0_SignerInfos.3,CMS_SignerInfo_get0_signer_id.3
+CMS_get0_SignerInfos.3,CMS_SignerInfo_get_version.3
 CMS_get0_SignerInfos.3,CMS_SignerInfo_set1_signer_cert.3
 CMS_get0_type.3,CMS_get0_content.3
 CMS_get0_type.3,CMS_get0_eContentType.3
+CMS_get0_type.3,CMS_get_version.3
 CMS_get0_type.3,CMS_set1_eContentType.3
 CMS_get1_ReceiptRequest.3,CMS_ReceiptRequest_create0.3
 CMS_get1_ReceiptRequest.3,CMS_ReceiptRequest_get0_values.3
@@ -666,21 +614,14 @@ DSA_sign.3,DSA_sign_setup.3
 DSA_sign.3,DSA_verify.3
 DSA_size.3,DSA_bits.3
 ECDH_compute_key.3,ECDH_size.3
-ECDSA_SIG_new.3,ECDSA_OpenSSL.3
 ECDSA_SIG_new.3,ECDSA_SIG_free.3
 ECDSA_SIG_new.3,ECDSA_SIG_get0.3
 ECDSA_SIG_new.3,ECDSA_SIG_get0_r.3
 ECDSA_SIG_new.3,ECDSA_SIG_get0_s.3
 ECDSA_SIG_new.3,ECDSA_SIG_set0.3
 ECDSA_SIG_new.3,ECDSA_do_sign.3
-ECDSA_SIG_new.3,ECDSA_do_sign_ex.3
 ECDSA_SIG_new.3,ECDSA_do_verify.3
-ECDSA_SIG_new.3,ECDSA_get_default_method.3
-ECDSA_SIG_new.3,ECDSA_set_default_method.3
-ECDSA_SIG_new.3,ECDSA_set_method.3
 ECDSA_SIG_new.3,ECDSA_sign.3
-ECDSA_SIG_new.3,ECDSA_sign_ex.3
-ECDSA_SIG_new.3,ECDSA_sign_setup.3
 ECDSA_SIG_new.3,ECDSA_size.3
 ECDSA_SIG_new.3,ECDSA_verify.3
 ECDSA_SIG_new.3,d2i_ECDSA_SIG.3
@@ -699,10 +640,8 @@ EC_GROUP_copy.3,EC_GROUP_get_cofactor.3
 EC_GROUP_copy.3,EC_GROUP_get_curve_name.3
 EC_GROUP_copy.3,EC_GROUP_get_degree.3
 EC_GROUP_copy.3,EC_GROUP_get_order.3
-EC_GROUP_copy.3,EC_GROUP_get_pentanomial_basis.3
 EC_GROUP_copy.3,EC_GROUP_get_point_conversion_form.3
 EC_GROUP_copy.3,EC_GROUP_get_seed_len.3
-EC_GROUP_copy.3,EC_GROUP_get_trinomial_basis.3
 EC_GROUP_copy.3,EC_GROUP_method_of.3
 EC_GROUP_copy.3,EC_GROUP_order_bits.3
 EC_GROUP_copy.3,EC_GROUP_set_asn1_flag.3
@@ -814,8 +753,7 @@ ENGINE_ctrl.3,ENGINE_set_ctrl_function.3
 ENGINE_get_default_RSA.3,ENGINE_get_cipher_engine.3
 ENGINE_get_default_RSA.3,ENGINE_get_default_DH.3
 ENGINE_get_default_RSA.3,ENGINE_get_default_DSA.3
-ENGINE_get_default_RSA.3,ENGINE_get_default_ECDH.3
+ENGINE_get_default_RSA.3,ENGINE_get_default_EC.3
-ENGINE_get_default_RSA.3,ENGINE_get_default_ECDSA.3
 ENGINE_get_default_RSA.3,ENGINE_get_default_RAND.3
 ENGINE_get_default_RSA.3,ENGINE_get_digest_engine.3
 ENGINE_get_default_RSA.3,ENGINE_get_table_flags.3
@@ -855,8 +793,7 @@ ENGINE_set_RSA.3,ENGINE_CIPHERS_PTR.3
 ENGINE_set_RSA.3,ENGINE_DIGESTS_PTR.3
 ENGINE_set_RSA.3,ENGINE_get_DH.3
 ENGINE_set_RSA.3,ENGINE_get_DSA.3
-ENGINE_set_RSA.3,ENGINE_get_ECDH.3
+ENGINE_set_RSA.3,ENGINE_get_EC.3
-ENGINE_set_RSA.3,ENGINE_get_ECDSA.3
 ENGINE_set_RSA.3,ENGINE_get_RAND.3
 ENGINE_set_RSA.3,ENGINE_get_RSA.3
 ENGINE_set_RSA.3,ENGINE_get_STORE.3
@@ -866,8 +803,7 @@ ENGINE_set_RSA.3,ENGINE_get_digest.3
 ENGINE_set_RSA.3,ENGINE_get_digests.3
 ENGINE_set_RSA.3,ENGINE_set_DH.3
 ENGINE_set_RSA.3,ENGINE_set_DSA.3
-ENGINE_set_RSA.3,ENGINE_set_ECDH.3
+ENGINE_set_RSA.3,ENGINE_set_EC.3
-ENGINE_set_RSA.3,ENGINE_set_ECDSA.3
 ENGINE_set_RSA.3,ENGINE_set_RAND.3
 ENGINE_set_RSA.3,ENGINE_set_STORE.3
 ENGINE_set_RSA.3,ENGINE_set_ciphers.3
@@ -933,6 +869,11 @@ EVP_AEAD_CTX_init.3,EVP_aead_aes_128_gcm.3
 EVP_AEAD_CTX_init.3,EVP_aead_aes_256_gcm.3
 EVP_AEAD_CTX_init.3,EVP_aead_chacha20_poly1305.3
 EVP_AEAD_CTX_init.3,EVP_aead_xchacha20_poly1305.3
+EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_buf_noconst.3
+EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_set_cipher_data.3
+EVP_CIPHER_do_all.3,EVP_CIPHER_do_all_sorted.3
+EVP_CIPHER_do_all.3,EVP_MD_do_all.3
+EVP_CIPHER_do_all.3,EVP_MD_do_all_sorted.3
 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_dup.3
 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_free.3
 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_cleanup.3
@@ -952,6 +893,7 @@ EVP_DigestInit.3,EVP_DigestUpdate.3
 EVP_DigestInit.3,EVP_MAX_MD_SIZE.3
 EVP_DigestInit.3,EVP_MD_CTX_block_size.3
 EVP_DigestInit.3,EVP_MD_CTX_cleanup.3
+EVP_DigestInit.3,EVP_MD_CTX_clear_flags.3
 EVP_DigestInit.3,EVP_MD_CTX_copy.3
 EVP_DigestInit.3,EVP_MD_CTX_copy_ex.3
 EVP_DigestInit.3,EVP_MD_CTX_create.3
@@ -960,22 +902,25 @@ EVP_DigestInit.3,EVP_MD_CTX_destroy.3
 EVP_DigestInit.3,EVP_MD_CTX_free.3
 EVP_DigestInit.3,EVP_MD_CTX_init.3
 EVP_DigestInit.3,EVP_MD_CTX_md.3
+EVP_DigestInit.3,EVP_MD_CTX_md_data.3
 EVP_DigestInit.3,EVP_MD_CTX_new.3
+EVP_DigestInit.3,EVP_MD_CTX_pkey_ctx.3
 EVP_DigestInit.3,EVP_MD_CTX_reset.3
+EVP_DigestInit.3,EVP_MD_CTX_set_flags.3
+EVP_DigestInit.3,EVP_MD_CTX_set_pkey_ctx.3
 EVP_DigestInit.3,EVP_MD_CTX_size.3
+EVP_DigestInit.3,EVP_MD_CTX_test_flags.3
 EVP_DigestInit.3,EVP_MD_CTX_type.3
 EVP_DigestInit.3,EVP_MD_block_size.3
+EVP_DigestInit.3,EVP_MD_flags.3
 EVP_DigestInit.3,EVP_MD_pkey_type.3
 EVP_DigestInit.3,EVP_MD_size.3
 EVP_DigestInit.3,EVP_MD_type.3
 EVP_DigestInit.3,EVP_get_digestbyname.3
 EVP_DigestInit.3,EVP_get_digestbynid.3
 EVP_DigestInit.3,EVP_get_digestbyobj.3
-EVP_DigestInit.3,EVP_md5.3
-EVP_DigestInit.3,EVP_md5_sha1.3
 EVP_DigestInit.3,EVP_md_null.3
 EVP_DigestInit.3,EVP_ripemd160.3
-EVP_DigestInit.3,EVP_sha1.3
 EVP_DigestInit.3,EVP_sha224.3
 EVP_DigestInit.3,EVP_sha256.3
 EVP_DigestInit.3,EVP_sha384.3
@@ -1001,7 +946,9 @@ EVP_EncryptInit.3,EVP_CIPHER_CTX_block_size.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_cipher.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_cleanup.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_clear_flags.3
+EVP_EncryptInit.3,EVP_CIPHER_CTX_copy.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_ctrl.3
+EVP_EncryptInit.3,EVP_CIPHER_CTX_encrypting.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_flags.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_free.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_get_app_data.3
@@ -1055,7 +1002,6 @@ EVP_EncryptInit.3,EVP_cast5_cfb.3
 EVP_EncryptInit.3,EVP_cast5_cfb64.3
 EVP_EncryptInit.3,EVP_cast5_ecb.3
 EVP_EncryptInit.3,EVP_cast5_ofb.3
-EVP_EncryptInit.3,EVP_chacha20.3
 EVP_EncryptInit.3,EVP_enc_null.3
 EVP_EncryptInit.3,EVP_get_cipherbyname.3
 EVP_EncryptInit.3,EVP_get_cipherbynid.3
@@ -1072,6 +1018,18 @@ EVP_EncryptInit.3,EVP_rc2_cfb.3
 EVP_EncryptInit.3,EVP_rc2_cfb64.3
 EVP_EncryptInit.3,EVP_rc2_ecb.3
 EVP_EncryptInit.3,EVP_rc2_ofb.3
+EVP_MD_meth_new.3,EVP_MD_meth_dup.3
+EVP_MD_meth_new.3,EVP_MD_meth_free.3
+EVP_MD_meth_new.3,EVP_MD_meth_set_app_datasize.3
+EVP_MD_meth_new.3,EVP_MD_meth_set_cleanup.3
+EVP_MD_meth_new.3,EVP_MD_meth_set_copy.3
+EVP_MD_meth_new.3,EVP_MD_meth_set_ctrl.3
+EVP_MD_meth_new.3,EVP_MD_meth_set_final.3
+EVP_MD_meth_new.3,EVP_MD_meth_set_flags.3
+EVP_MD_meth_new.3,EVP_MD_meth_set_init.3
+EVP_MD_meth_new.3,EVP_MD_meth_set_input_blocksize.3
+EVP_MD_meth_new.3,EVP_MD_meth_set_result_size.3
+EVP_MD_meth_new.3,EVP_MD_meth_set_update.3
 EVP_OpenInit.3,EVP_OpenFinal.3
 EVP_OpenInit.3,EVP_OpenUpdate.3
 EVP_PKCS82PKEY.3,EVP_PKEY2PKCS8.3
@@ -1200,6 +1158,7 @@ EVP_PKEY_set1_RSA.3,EVP_PKEY_set1_DH.3
 EVP_PKEY_set1_RSA.3,EVP_PKEY_set1_DSA.3
 EVP_PKEY_set1_RSA.3,EVP_PKEY_set1_EC_KEY.3
 EVP_PKEY_set1_RSA.3,EVP_PKEY_set_type.3
+EVP_PKEY_set1_RSA.3,EVP_PKEY_set_type_str.3
 EVP_PKEY_set1_RSA.3,EVP_PKEY_type.3
 EVP_PKEY_sign.3,EVP_PKEY_sign_init.3
 EVP_PKEY_size.3,EVP_PKEY_bits.3
@@ -1214,6 +1173,11 @@ EVP_SignInit.3,EVP_SignUpdate.3
 EVP_VerifyInit.3,EVP_VerifyFinal.3
 EVP_VerifyInit.3,EVP_VerifyInit_ex.3
 EVP_VerifyInit.3,EVP_VerifyUpdate.3
+EVP_add_cipher.3,EVP_add_cipher_alias.3
+EVP_add_cipher.3,EVP_add_digest.3
+EVP_add_cipher.3,EVP_add_digest_alias.3
+EVP_add_cipher.3,EVP_delete_cipher_alias.3
+EVP_add_cipher.3,EVP_delete_digest_alias.3
 EVP_aes_128_cbc.3,EVP_aes_128_cbc_hmac_sha1.3
 EVP_aes_128_cbc.3,EVP_aes_128_ccm.3
 EVP_aes_128_cbc.3,EVP_aes_128_cfb.3
@@ -1270,6 +1234,7 @@ EVP_camellia_128_cbc.3,EVP_camellia_256_cfb128.3
 EVP_camellia_128_cbc.3,EVP_camellia_256_cfb8.3
 EVP_camellia_128_cbc.3,EVP_camellia_256_ecb.3
 EVP_camellia_128_cbc.3,EVP_camellia_256_ofb.3
+EVP_chacha20.3,EVP_chacha20_poly1305.3
 EVP_des_cbc.3,EVP_des_cfb.3
 EVP_des_cbc.3,EVP_des_cfb1.3
 EVP_des_cbc.3,EVP_des_cfb64.3
@@ -1293,6 +1258,12 @@ EVP_des_cbc.3,EVP_des_ofb.3
 EVP_des_cbc.3,EVP_desx_cbc.3
 EVP_rc4.3,EVP_rc4_40.3
 EVP_rc4.3,EVP_rc4_hmac_md5.3
+EVP_sha1.3,EVP_md4.3
+EVP_sha1.3,EVP_md5.3
+EVP_sha1.3,EVP_md5_sha1.3
+EVP_sha3_224.3,EVP_sha3_256.3
+EVP_sha3_224.3,EVP_sha3_384.3
+EVP_sha3_224.3,EVP_sha3_512.3
 EVP_sm4_cbc.3,EVP_sm4_cfb.3
 EVP_sm4_cbc.3,EVP_sm4_cfb128.3
 EVP_sm4_cbc.3,EVP_sm4_ctr.3
@@ -1334,15 +1305,13 @@ OBJ_NAME_add.3,OBJ_NAME_get.3
 OBJ_NAME_add.3,OBJ_NAME_init.3
 OBJ_NAME_add.3,OBJ_NAME_new_index.3
 OBJ_NAME_add.3,OBJ_NAME_remove.3
-OBJ_add_sigid.3,OBJ_find_sigid_algs.3
-OBJ_add_sigid.3,OBJ_find_sigid_by_algs.3
-OBJ_add_sigid.3,OBJ_sigid_free.3
 OBJ_create.3,OBJ_add_object.3
 OBJ_create.3,OBJ_cleanup.3
 OBJ_create.3,OBJ_create_objects.3
 OBJ_create.3,OBJ_new_nid.3
 OBJ_create.3,check_defer.3
 OBJ_create.3,obj_cleanup_defer.3
+OBJ_find_sigid_algs.3,OBJ_find_sigid_by_algs.3
 OBJ_nid2obj.3,OBJ_cmp.3
 OBJ_nid2obj.3,OBJ_dup.3
 OBJ_nid2obj.3,OBJ_ln2nid.3
@@ -1609,9 +1578,6 @@ POLICYINFO_new.3,POLICY_MAPPING_free.3
 POLICYINFO_new.3,POLICY_MAPPING_new.3
 POLICYINFO_new.3,USERNOTICE_free.3
 POLICYINFO_new.3,USERNOTICE_new.3
-PROXY_POLICY_new.3,PROXY_CERT_INFO_EXTENSION_free.3
-PROXY_POLICY_new.3,PROXY_CERT_INFO_EXTENSION_new.3
-PROXY_POLICY_new.3,PROXY_POLICY_free.3
 RAND_add.3,RAND_cleanup.3
 RAND_add.3,RAND_poll.3
 RAND_add.3,RAND_seed.3
@@ -2037,13 +2003,6 @@ SSL_want.3,SSL_want_read.3
 SSL_want.3,SSL_want_write.3
 SSL_want.3,SSL_want_x509_lookup.3
 SSL_write.3,SSL_write_ex.3
-SXNET_new.3,SXNETID_free.3
-SXNET_new.3,SXNETID_new.3
-SXNET_new.3,SXNET_free.3
-SXNET_new.3,d2i_SXNET.3
-SXNET_new.3,d2i_SXNETID.3
-SXNET_new.3,i2d_SXNET.3
-SXNET_new.3,i2d_SXNETID.3
 TS_REQ_new.3,TS_ACCURACY_free.3
 TS_REQ_new.3,TS_ACCURACY_new.3
 TS_REQ_new.3,TS_MSG_IMPRINT_free.3
@@ -2319,6 +2278,8 @@ X509_STORE_CTX_set_verify.3,X509_STORE_set_verify.3
 X509_STORE_CTX_set_verify.3,X509_STORE_set_verify_func.3
 X509_STORE_CTX_set_verify_cb.3,X509_STORE_CTX_get_verify_cb.3
 X509_STORE_CTX_set_verify_cb.3,X509_STORE_CTX_verify_cb.3
+X509_STORE_get_by_subject.3,X509_STORE_CTX_get1_certs.3
+X509_STORE_get_by_subject.3,X509_STORE_CTX_get1_crls.3
 X509_STORE_get_by_subject.3,X509_STORE_CTX_get1_issuer.3
 X509_STORE_get_by_subject.3,X509_STORE_CTX_get_by_subject.3
 X509_STORE_get_by_subject.3,X509_STORE_CTX_get_obj_by_subject.3
@@ -2464,14 +2425,6 @@ X509_new.3,X509_chain_up_ref.3
 X509_new.3,X509_dup.3
 X509_new.3,X509_free.3
 X509_new.3,X509_up_ref.3
-X509_policy_check.3,X509_policy_tree_free.3
-X509_policy_tree_get0_policies.3,X509_policy_tree_get0_user_policies.3
-X509_policy_tree_level_count.3,X509_policy_level_get0_node.3
-X509_policy_tree_level_count.3,X509_policy_level_node_count.3
-X509_policy_tree_level_count.3,X509_policy_node_get0_parent.3
-X509_policy_tree_level_count.3,X509_policy_node_get0_policy.3
-X509_policy_tree_level_count.3,X509_policy_node_get0_qualifiers.3
-X509_policy_tree_level_count.3,X509_policy_tree_get0_level.3
 X509_print_ex.3,X509_CERT_AUX_print.3
 X509_print_ex.3,X509_print.3
 X509_print_ex.3,X509_print_ex_fp.3
@@ -2548,6 +2501,8 @@ bn_dump.3,mul.3
 bn_dump.3,mul_add.3
 bn_dump.3,sqr.3
 d2i_ASN1_NULL.3,i2d_ASN1_NULL.3
+d2i_ASN1_OBJECT.3,OBJ_get0_data.3
+d2i_ASN1_OBJECT.3,OBJ_length.3
 d2i_ASN1_OBJECT.3,i2d_ASN1_OBJECT.3
 d2i_ASN1_OCTET_STRING.3,d2i_ASN1_BIT_STRING.3
 d2i_ASN1_OCTET_STRING.3,d2i_ASN1_BMPSTRING.3
@@ -2751,9 +2706,6 @@ d2i_POLICYINFO.3,i2d_NOTICEREF.3
 d2i_POLICYINFO.3,i2d_POLICYINFO.3
 d2i_POLICYINFO.3,i2d_POLICYQUALINFO.3
 d2i_POLICYINFO.3,i2d_USERNOTICE.3
-d2i_PROXY_POLICY.3,d2i_PROXY_CERT_INFO_EXTENSION.3
-d2i_PROXY_POLICY.3,i2d_PROXY_CERT_INFO_EXTENSION.3
-d2i_PROXY_POLICY.3,i2d_PROXY_POLICY.3
 d2i_PrivateKey.3,d2i_AutoPrivateKey.3
 d2i_PrivateKey.3,d2i_PrivateKey_bio.3
 d2i_PrivateKey.3,d2i_PrivateKey_fp.3
@@ -2867,21 +2819,6 @@ d2i_X509_SIG.3,i2d_X509_SIG.3
 des_read_pw.3,EVP_read_pw_string.3
 des_read_pw.3,EVP_read_pw_string_min.3
 des_read_pw.3,des_read_pw_string.3
-get_rfc3526_prime_8192.3,BN_get_rfc2409_prime_1024.3
-get_rfc3526_prime_8192.3,BN_get_rfc2409_prime_768.3
-get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_1536.3
-get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_2048.3
-get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_3072.3
-get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_4096.3
-get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_6144.3
-get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_8192.3
-get_rfc3526_prime_8192.3,get_rfc2409_prime_1024.3
-get_rfc3526_prime_8192.3,get_rfc2409_prime_768.3
-get_rfc3526_prime_8192.3,get_rfc3526_prime_1536.3
-get_rfc3526_prime_8192.3,get_rfc3526_prime_2048.3
-get_rfc3526_prime_8192.3,get_rfc3526_prime_3072.3
-get_rfc3526_prime_8192.3,get_rfc3526_prime_4096.3
-get_rfc3526_prime_8192.3,get_rfc3526_prime_6144.3
 i2a_ASN1_STRING.3,a2i_ASN1_ENUMERATED.3
 i2a_ASN1_STRING.3,a2i_ASN1_INTEGER.3
 i2a_ASN1_STRING.3,a2i_ASN1_STRING.3

patches/aeadtest.c.patch

@@ -1,15 +0,0 @@
---- tests/aeadtest.c.orig	Mon Sep  5 22:30:33 2022
-+++ tests/aeadtest.c	Mon Sep  5 23:51:27 2022
-@@ -48,6 +48,12 @@
- 
- #define BUF_MAX 1024
- 
-+#ifdef _MSC_VER
-+#ifdef IN
-+#undef IN
-+#endif
-+#endif
-+
- /* These are the different types of line that are found in the input file. */
- enum {
- 	AEAD = 0,	/* name of the AEAD algorithm. */

patches/bio.h.patch

@@ -1,35 +0,0 @@
---- include/openssl/bio.h.orig	Tue Nov 22 21:08:27 2022
-+++ include/openssl/bio.h	Tue Nov 22 21:08:48 2022
-@@ -667,8 +667,24 @@ void BIO_copy_next_retry(BIO *b);
- 
- /*long BIO_ghbn_ctrl(int cmd,int iarg,char *parg);*/
- 
-+#ifdef __MINGW_PRINTF_FORMAT
- int
- BIO_printf(BIO *bio, const char *format, ...)
-+	__attribute__((__format__(__MINGW_PRINTF_FORMAT, 2, 3), __nonnull__(2)));
-+int
-+BIO_vprintf(BIO *bio, const char *format, va_list args)
-+	__attribute__((__format__(__MINGW_PRINTF_FORMAT, 2, 0), __nonnull__(2)));
-+int
-+BIO_snprintf(char *buf, size_t n, const char *format, ...)
-+	__attribute__((__deprecated__, __format__(__MINGW_PRINTF_FORMAT, 3, 4),
-+	    __nonnull__(3)));
-+int
-+BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)
-+	__attribute__((__deprecated__, __format__(__MINGW_PRINTF_FORMAT, 3, 0),
-+	    __nonnull__(3)));
-+#else
-+int
-+BIO_printf(BIO *bio, const char *format, ...)
- 	__attribute__((__format__(__printf__, 2, 3), __nonnull__(2)));
- int
- BIO_vprintf(BIO *bio, const char *format, va_list args)
-@@ -681,6 +697,7 @@ int
- BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)
- 	__attribute__((__deprecated__, __format__(__printf__, 3, 0),
- 	    __nonnull__(3)));
-+#endif
- 
- void ERR_load_BIO_strings(void);
- 

patches/bn_isqrt.c.patch

@@ -1,18 +0,0 @@
---- tests/bn_isqrt.c.orig	Fri Dec  9 11:05:26 2022
-+++ tests/bn_isqrt.c	Fri Dec  9 11:12:37 2022
-@@ -306,6 +306,7 @@ main(int argc, char *argv[])
- 	int ch;
- 	int failed = 0, print = 0;
- 
-+#ifndef _MSC_VER
- 	while ((ch = getopt(argc, argv, "C")) != -1) {
- 		switch (ch) {
- 		case 'C':
-@@ -316,6 +317,7 @@ main(int argc, char *argv[])
- 			break;
- 		}
- 	}
-+#endif
- 
- 	if (print)
- 		return check_tables(1);

patches/handshake_table.c.patch

@@ -1,18 +0,0 @@
---- tests/handshake_table.c.orig	Tue Mar 15 11:37:03 2022
-+++ tests/handshake_table.c	Mon Mar 21 05:26:15 2022
-@@ -518,6 +518,7 @@
- 	unsigned int	depth = 0;
- 	int		ch, graphviz = 0, print = 0;
- 
-+#ifndef _MSC_VER
- 	while ((ch = getopt(argc, argv, "Cg")) != -1) {
- 		switch (ch) {
- 		case 'C':
-@@ -535,6 +536,7 @@
- 
- 	if (argc != 0)
- 		usage();
-+#endif
- 
- 	if (graphviz && print)
- 		usage();

patches/libcrypto.hidden.patch

@@ -1,120 +0,0 @@
-diff -u openbsd/src/lib/libcrypto/hidden/openssl/hmac.h crypto/hidden/openssl/hmac.h
---- openbsd/src/lib/libcrypto/hidden/openssl/hmac.h	2023-03-15 11:41:37.632580800 -0600
-+++ crypto/hidden/openssl/hmac.h	2023-03-15 16:49:29.144080400 -0600
-@@ -18,7 +18,11 @@
- #ifndef _LIBCRYPTO_HMAC_H_
- #define _LIBCRYPTO_HMAC_H_
- 
-+#ifdef _MSC_VER
-+#include <../include/openssl/hmac.h>
-+#else
- #include_next <openssl/hmac.h>
-+#endif
- #include "crypto_namespace.h"
- 
- LCRYPTO_USED(HMAC_CTX_new);
-diff -u openbsd/src/lib/libcrypto/hidden/openssl/pkcs12.h crypto/hidden/openssl/pkcs12.h
---- openbsd/src/lib/libcrypto/hidden/openssl/pkcs12.h	2023-03-15 11:41:37.648024900 -0600
-+++ crypto/hidden/openssl/pkcs12.h	2023-03-15 17:15:36.015981800 -0600
-@@ -18,7 +18,11 @@
- #ifndef _LIBCRYPTO_PKCS12_H
- #define _LIBCRYPTO_PKCS12_H
- 
-+#ifdef _MSC_VER
-+#include <../include/openssl/pkcs12.h>
-+#else
- #include_next <openssl/pkcs12.h>
-+#endif
- #include "crypto_namespace.h"
- 
- LCRYPTO_USED(PKCS12_SAFEBAG_get0_attr);
-diff -u openbsd/src/lib/libcrypto/hidden/openssl/pkcs7.h crypto/hidden/openssl/pkcs7.h
---- openbsd/src/lib/libcrypto/hidden/openssl/pkcs7.h	2023-03-15 11:41:37.663599200 -0600
-+++ crypto/hidden/openssl/pkcs7.h	2023-03-15 16:53:43.232866600 -0600
-@@ -18,7 +18,11 @@
- #ifndef _LIBCRYPTO_PKCS7_H
- #define _LIBCRYPTO_PKCS7_H
- 
-+#ifdef _MSC_VER
-+#include <../include/openssl/pkcs7.h>
-+#else
- #include_next <openssl/pkcs7.h>
-+#endif
- #include "crypto_namespace.h"
- 
- LCRYPTO_USED(PKCS7_ISSUER_AND_SERIAL_new);
-diff -u openbsd/src/lib/libcrypto/hidden/openssl/stack.h crypto/hidden/openssl/stack.h
---- openbsd/src/lib/libcrypto/hidden/openssl/stack.h	2023-03-15 11:41:37.680453800 -0600
-+++ crypto/hidden/openssl/stack.h	2023-03-15 16:49:29.200142600 -0600
-@@ -18,7 +18,11 @@
- #ifndef _LIBCRYPTO_STACK_H
- #define _LIBCRYPTO_STACK_H
- 
-+#ifdef _MSC_VER
-+#include <../include/openssl/stack.h>
-+#else
- #include_next <openssl/stack.h>
-+#endif
- #include "crypto_namespace.h"
- 
- LCRYPTO_USED(sk_num);
-diff -u openbsd/src/lib/libcrypto/hidden/openssl/ui.h crypto/hidden/openssl/ui.h
---- openbsd/src/lib/libcrypto/hidden/openssl/ui.h	2023-03-15 11:41:37.696291800 -0600
-+++ crypto/hidden/openssl/ui.h	2023-03-15 16:49:29.222310800 -0600
-@@ -18,7 +18,11 @@
- #ifndef _LIBCRYPTO_UI_H
- #define _LIBCRYPTO_UI_H
- 
-+#ifdef _MSC_VER
-+#include <../include/openssl/ui.h>
-+#else
- #include_next <openssl/ui.h>
-+#endif
- #include "crypto_namespace.h"
- 
- LCRYPTO_USED(UI_new);
-diff -u openbsd/src/lib/libcrypto/hidden/openssl/x509.h crypto/hidden/openssl/x509.h
---- openbsd/src/lib/libcrypto/hidden/openssl/x509.h	2023-03-15 11:41:37.713302600 -0600
-+++ crypto/hidden/openssl/x509.h	2023-03-15 16:49:29.238904200 -0600
-@@ -18,7 +18,11 @@
- #ifndef _LIBCRYPTO_X509_H
- #define _LIBCRYPTO_X509_H
- 
-+#ifdef _MSC_VER
-+#include <../include/openssl/x509.h>
-+#else
- #include_next <openssl/x509.h>
-+#endif
- #include "crypto_namespace.h"
- 
- LCRYPTO_USED(X509_CRL_up_ref);
-diff -u openbsd/src/lib/libcrypto/hidden/openssl/x509v3.h crypto/hidden/openssl/x509v3.h
---- openbsd/src/lib/libcrypto/hidden/openssl/x509v3.h	2023-03-15 11:41:37.756379100 -0600
-+++ crypto/hidden/openssl/x509v3.h	2023-03-15 16:49:29.264482800 -0600
-@@ -18,7 +18,11 @@
- #ifndef _LIBCRYPTO_X509V3_H
- #define _LIBCRYPTO_X509V3_H
- 
-+#ifdef _MSC_VER
-+#include <../include/openssl/x509v3.h>
-+#else
- #include_next <openssl/x509v3.h>
-+#endif
- #include "crypto_namespace.h"
- 
- LCRYPTO_USED(PROXY_POLICY_new);
-diff -u openbsd/src/lib/libcrypto/hidden/openssl/x509_vfy.h crypto/hidden/openssl/x509_vfy.h
---- openbsd/src/lib/libcrypto/hidden/openssl/x509_vfy.h	2023-03-15 11:41:37.735995100 -0600
-+++ crypto/hidden/openssl/x509_vfy.h	2023-03-15 16:49:29.300450300 -0600
-@@ -18,7 +18,11 @@
- #ifndef _LIBCRYPTO_X509_VFY_H
- #define _LIBCRYPTO_X509_VFY_H
- 
-+#ifdef _MSC_VER
-+#include <../include/openssl/x509_vfy.h>
-+#else
- #include_next <openssl/x509_vfy.h>
-+#endif
- #include "crypto_namespace.h"
- 
- LCRYPTO_USED(X509_STORE_set_depth);

patches/libssl.hidden.patch

@@ -1,15 +0,0 @@
-diff -u openbsd/src/lib/libssl/hidden/openssl/ssl.h ssl/hidden/openssl/ssl.h
---- openbsd/src/lib/libssl/hidden/openssl/ssl.h	2023-03-15 11:41:52.466146400 -0600
-+++ ssl/hidden/openssl/ssl.h	2023-03-15 16:49:29.358377300 -0600
-@@ -18,7 +18,11 @@
- #ifndef _LIBSSL_SSL_H_
- #define _LIBSSL_SSL_H_
- 
-+#ifdef _MSC_VER
-+#include <../include/openssl/ssl.h>
-+#else
- #include_next <openssl/ssl.h>
-+#endif
- #include "ssl_namespace.h"
- 
- LSSL_USED(BIO_f_ssl);

patches/modes_local.h.patch

@@ -1,19 +1,16 @@
---- crypto/modes/modes_local.h.orig	Tue Nov 14 10:25:15 2017
+--- crypto/modes/modes_local.h.orig	Sat Jul  8 14:03:53 2023
-+++ crypto/modes/modes_local.h	Sat Jan 19 22:19:23 2019
++++ crypto/modes/modes_local.h	Sat Jul  8 14:10:56 2023
-@@ -45,14 +45,16 @@
+@@ -45,6 +45,7 @@
- 			asm ("bswapl %0"		\
+ 			asm ("bswapl %0"				\
  			: "+r"(ret));	ret;		})
  # elif (defined(__arm__) || defined(__arm)) && !defined(__STRICT_ALIGNMENT)
--#  define BSWAP8(x) ({	u32 lo=(u64)(x)>>32,hi=(x);	\
 +#  if (__ARM_ARCH >= 6)
-+#   define BSWAP8(x) ({	u32 lo=(u64)(x)>>32,hi=(x);	\
+ #  define BSWAP8(x) ({	u32 lo=(u64)(x)>>32,hi=(x);			\
- 			asm ("rev %0,%0; rev %1,%1"	\
+ 			asm ("rev %0,%0; rev %1,%1"			\
- 			: "+r"(hi),"+r"(lo));		\
+ 			: "+r"(hi),"+r"(lo));				\
- 			(u64)hi<<32|lo;			})
+@@ -53,6 +54,7 @@
--#  define BSWAP4(x) ({	u32 ret;			\
+ 			asm ("rev %0,%1"				\
-+#   define BSWAP4(x) ({	u32 ret;			\
+ 			: "=r"(ret) : "r"((u32)(x)));			\
- 			asm ("rev %0,%1"		\
- 			: "=r"(ret) : "r"((u32)(x)));	\
  			ret;				})
 +#  endif
  # endif

patches/netcat.c.patch

@@ -1,5 +1,5 @@
---- apps/nc/netcat.c.orig	Thu Feb  9 18:42:55 2023
+--- apps/nc/netcat.c.orig	Tue Aug 15 15:17:28 2023
-+++ apps/nc/netcat.c	Thu Feb  9 18:43:08 2023
++++ apps/nc/netcat.c	Tue Aug 15 15:17:54 2023
 @@ -93,9 +93,13 @@ int	zflag;					/* Port Scan Flag */
  int	Dflag;					/* sodebug */
  int	Iflag;					/* TCP receive buffer size */
@@ -100,7 +100,7 @@
  
  		set_common_sockopts(s, res->ai_family);
  
-@@ -1557,11 +1577,13 @@ set_common_sockopts(int s, int af)
+@@ -1563,11 +1583,13 @@ set_common_sockopts(int s, int af)
  {
  	int x = 1;
  
@@ -114,7 +114,7 @@
  	if (Dflag) {
  		if (setsockopt(s, SOL_SOCKET, SO_DEBUG,
  		    &x, sizeof(x)) == -1)
-@@ -1572,9 +1594,16 @@ set_common_sockopts(int s, int af)
+@@ -1578,9 +1600,16 @@ set_common_sockopts(int s, int af)
  		    IP_TOS, &Tflag, sizeof(Tflag)) == -1)
  			err(1, "set IP ToS");
  
@@ -131,7 +131,7 @@
  	}
  	if (Iflag) {
  		if (setsockopt(s, SOL_SOCKET, SO_RCVBUF,
-@@ -1598,13 +1627,17 @@ set_common_sockopts(int s, int af)
+@@ -1604,13 +1633,17 @@ set_common_sockopts(int s, int af)
  	}
  
  	if (minttl != -1) {
@@ -150,7 +150,7 @@
  	}
  }
  
-@@ -1829,15 +1862,19 @@ help(void)
+@@ -1835,15 +1868,19 @@ help(void)
  	\t-P proxyuser\tUsername for proxy authentication\n\
  	\t-p port\t	Specify local port for remote connects\n\
  	\t-R CAfile	CA bundle\n\

patches/ocsp_test.c.patch

@@ -1,14 +0,0 @@
---- tests/ocsp_test.c.orig	2018-07-24 21:59:17.000000000 -0500
-+++ tests/ocsp_test.c	2018-11-07 18:44:43.000000000 -0600
-@@ -35,6 +35,11 @@
- 	hints.ai_family = AF_INET;
- 	hints.ai_socktype = SOCK_STREAM;
-
-+#ifdef _MSC_VER
-+	if (BIO_sock_init() != 1)
-+		exit(-1);
-+#endif
-+
- 	error = getaddrinfo(host, port, &hints, &res);
- 	if (error != 0) {
- 		perror("getaddrinfo()");

patches/openssl.c.patch

@@ -1,6 +1,6 @@
---- apps/openssl/openssl.c.orig	Tue Apr 25 16:50:41 2023
+--- apps/openssl/openssl.c.orig	Sat Jun 17 13:06:00 2023
-+++ apps/openssl/openssl.c	Tue Apr 25 16:51:01 2023
++++ apps/openssl/openssl.c	Sat Jun 24 04:44:55 2023
-@@ -358,7 +358,9 @@
+@@ -354,7 +354,9 @@
  static void
  openssl_startup(void)
  {

patches/opensslfeatures.h.patch

@@ -1,6 +1,6 @@
---- openbsd/src/lib/libcrypto/opensslfeatures.h	2023-03-15 11:41:47.301015100 -0600
+--- include/openssl/opensslfeatures.h.orig	Fri Jul 28 06:04:42 2023
-+++ include/openssl/opensslfeatures.h	2023-03-15 18:27:57.740024800 -0600
++++ include/openssl/opensslfeatures.h	Fri Jul 28 06:09:00 2023
-@@ -7,6 +7,13 @@
+@@ -8,6 +8,13 @@
  #define LIBRESSL_HAS_TLS1_3
  #define LIBRESSL_HAS_DTLS1_2
  

patches/speed.c.patch

@@ -1,5 +1,5 @@
---- apps/openssl/speed.c.orig	Sun May 21 12:13:46 2023
+--- apps/openssl/speed.c.orig	Fri Jul 28 06:04:45 2023
-+++ apps/openssl/speed.c	Sun May 21 12:31:50 2023
++++ apps/openssl/speed.c	Fri Jul 28 06:09:00 2023
 @@ -161,7 +161,16 @@ static void
  pkey_print_message(const char *str, const char *str2,
      long num, int bits, int sec);
@@ -74,7 +74,7 @@
  	if (!mr) {
  		fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION));
  		fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON));
-@@ -1915,11 +1934,15 @@ pkey_print_message(const char *str, const char *str2, 
+@@ -1898,11 +1917,15 @@ pkey_print_message(const char *str, const char *str2, 
  static void
  print_result(int alg, int run_no, int count, double time_used)
  {
@@ -90,7 +90,7 @@
  static char *
  sstrsep(char **string, const char *delim)
  {
-@@ -2126,4 +2149,5 @@ do_multi(int multi)
+@@ -2109,4 +2132,5 @@ do_multi(int multi)
  	free(fds);
  	return 1;
  }

patches/ssl_txt.c.patch

@@ -1,21 +0,0 @@
---- ssl/ssl_txt.c.orig	Wed Jun 22 11:37:59 2022
-+++ ssl/ssl_txt.c	Wed Jun 22 11:37:59 2022
-@@ -82,6 +82,7 @@
-  * OTHERWISE.
-  */
- 
-+#include <inttypes.h>
- #include <stdio.h>
- 
- #include <openssl/buffer.h>
-@@ -174,8 +174,8 @@
- 	}
- 
- 	if (x->time != 0) {
--		if (BIO_printf(bp, "\n    Start Time: %lld",
--		    (long long)x->time) <= 0)
-+		if (BIO_printf(bp, "\n    Start Time: %"PRId64,
-+		    (int64_t)x->time) <= 0)
- 			goto err;
- 	}
- 

patches/tlsexttest.c.patch

@@ -1,76 +0,0 @@
---- tests/tlsexttest.c.orig	Fri Apr 28 11:42:38 2023
-+++ tests/tlsexttest.c	Fri Apr 28 11:55:27 2023
-@@ -1775,7 +1775,9 @@
- };
- 
- static const unsigned char tlsext_sni_server[] = {
-+	0x00
- };
-+const size_t sizeof_tlsext_sni_server = 0;
- 
- static int
- test_tlsext_sni_client(void)
-@@ -1973,9 +1975,9 @@
- 	if (!CBB_finish(&cbb, &data, &dlen))
- 		errx(1, "failed to finish CBB");
- 
--	if (dlen != sizeof(tlsext_sni_server)) {
-+	if (dlen != sizeof_tlsext_sni_server) {
- 		FAIL("got server SNI with length %zu, "
--		    "want length %zu\n", dlen, sizeof(tlsext_sni_server));
-+		    "want length %zu\n", dlen, sizeof_tlsext_sni_server);
- 		goto err;
- 	}
- 
-@@ -1984,14 +1986,14 @@
- 		fprintf(stderr, "received:\n");
- 		hexdump(data, dlen);
- 		fprintf(stderr, "test data:\n");
--		hexdump(tlsext_sni_server, sizeof(tlsext_sni_server));
-+		hexdump(tlsext_sni_server, sizeof_tlsext_sni_server);
- 		goto err;
- 	}
- 
- 	free(ssl->session->tlsext_hostname);
- 	ssl->session->tlsext_hostname = NULL;
- 
--	CBS_init(&cbs, tlsext_sni_server, sizeof(tlsext_sni_server));
-+	CBS_init(&cbs, tlsext_sni_server, sizeof_tlsext_sni_server);
- 	if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
- 		FAIL("failed to parse server SNI\n");
- 		goto err;
-@@ -3196,7 +3198,10 @@
- 	0x04, 0x03, 0x02, 0x01, 0x02, 0x03,
- };
- 
--unsigned char tlsext_clienthello_disabled[] = {};
-+unsigned char tlsext_clienthello_disabled[] = {
-+	0x00
-+};
-+const size_t sizeof_tlsext_clienthello_disabled = 0;
- 
- static int
- test_tlsext_clienthello_build(void)
-@@ -3287,18 +3292,18 @@
- 		goto err;
- 	}
- 
--	if (dlen != sizeof(tlsext_clienthello_disabled)) {
-+	if (dlen != sizeof_tlsext_clienthello_disabled) {
- 		FAIL("got clienthello extensions with length %zu, "
- 		    "want length %zu\n", dlen,
--		    sizeof(tlsext_clienthello_disabled));
-+		    sizeof_tlsext_clienthello_disabled);
- 		compare_data(data, dlen, tlsext_clienthello_disabled,
--		    sizeof(tlsext_clienthello_disabled));
-+		    sizeof_tlsext_clienthello_disabled);
- 		goto err;
- 	}
- 	if (memcmp(data, tlsext_clienthello_disabled, dlen) != 0) {
- 		FAIL("clienthello extensions differs:\n");
- 		compare_data(data, dlen, tlsext_clienthello_disabled,
--		    sizeof(tlsext_clienthello_disabled));
-+		    sizeof_tlsext_clienthello_disabled);
- 		goto err;
- 	}
- 

patches/windows_headers.patch

@@ -60,10 +60,9 @@ diff -u include/openssl.orig/pkcs7.h include/openssl/pkcs7.h
  /*
  Encryption_ID		DES-CBC
  Digest_ID		MD5
-diff -u include/openssl.orig/x509.h include/openssl/x509.h
+--- include/openssl/x509.h.orig	Thu Aug  3 13:35:00 2023
---- include/openssl.orig/x509.h	Tue Apr 18 03:26:56 2023
++++ include/openssl/x509.h	Thu Aug  3 13:35:18 2023
-+++ include/openssl/x509.h	Tue Apr 18 03:27:14 2023
+@@ -100,6 +100,19 @@
-@@ -106,6 +106,19 @@
  extern "C" {
  #endif
  

scripts/test

@@ -10,46 +10,77 @@ if type apt-get >/dev/null 2>&1; then
 	sudo apt-get install -y cmake ninja-build
 fi
 
+# generate source tree
 ./autogen.sh
 
-if [ "x$ARCH" = "xnative" ]; then
+if [ "$ARCH" = "" ]; then
+	ARCH=`uname -m`
+fi
+
+# test macOS
+if [ `uname` = "Darwin" ]; then
 	# test autotools
 	./configure
-	make -j 4 distcheck
 
 	# make distribution
-	make dist
+	make -j 4 distcheck
+
+	# test cmake
+	tar zxvf libressl-*.tar.gz
+	cd libressl-*
+
+	(
+		mkdir build-static
+		cd build-static
+		cmake -DCMAKE_OSX_ARCHITECTURES=$ARCH ..
+		make -j 4
+		if [ "$ARCH" = "x86_64" ]; then
+			make test
+		fi
+	)
+
+	(
+		mkdir build-shared
+		cd build-shared
+		cmake -DBUILD_SHARED_LIBS=ON -DCMAKE_OSX_ARCHITECTURES=$ARCH ..
+		make -j 4
+		if [ "$ARCH" = "x86_64" ]; then
+			make test
+		fi
+	)
+
+# assuming Linux below
+elif [ "$ARCH" = "native" ]; then
+	# test autotools
+	./configure
+
+	# make distribution
+	make -j 4 distcheck
+
 	tar zxvf libressl-*.tar.gz
 	cd libressl-*
-	mkdir build-static
-	mkdir build-shared
 
-	cd build-static
 
 	# test cmake and ninja
-	if [ `uname` = "Darwin" ]; then
+	(
-		cmake -DENABLE_ASM=${ENABLE_ASM} ..
+		mkdir build-static
-		make -j 4
+		cd build-static
-		make test
-
-		cd ../build-shared
-		cmake -DBUILD_SHARED_LIBS=ON -DENABLE_ASM=${ENABLE_ASM} ..
-		make -j 4
-		make test
-	else
 		cmake -GNinja -DENABLE_ASM=${ENABLE_ASM} ..
-		ninja -j 4
+		ninja
 		ninja test
+	)
 
-		cd ../build-shared
+	(
+		mkdir build-shared
+		cd build-shared
 		cmake -GNinja -DBUILD_SHARED_LIBS=ON -DENABLE_ASM=${ENABLE_ASM} ..
-		ninja -j 4
+		ninja
 		ninja test
-	fi
+	)
 
-elif [ "x$ARCH" = "xmingw32" -o "x$ARCH" = "xmingw64" ]; then
+elif [ "$ARCH" = "mingw32" -o "$ARCH" = "mingw64" ]; then
 	CPU=i686
-	if [ "x$ARCH" = "xmingw64" ]; then
+	if [ "$ARCH" = "mingw64" ]; then
 		CPU=x86_64
 	fi
 
@@ -75,10 +106,10 @@ elif [ "x$ARCH" = "xmingw32" -o "x$ARCH" = "xmingw64" ]; then
 	 ninja -j 4
 	)
 
-elif [ "x$ARCH" = "xarm32" -o "x$ARCH" = "xarm64" ]; then
+elif [ "$ARCH" = "arm32" -o "$ARCH" = "arm64" ]; then
 	sudo apt-get install -y qemu-user-static binfmt-support
 
-	if [ "x$ARCH" = "xarm32" ]; then
+	if [ "$ARCH" = "arm32" ]; then
 		sudo apt-get install -y g++-arm-linux-gnueabihf
 		sudo ln -sf /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.3 /lib/
 		./configure --host=arm-linux-gnueabihf
@@ -92,10 +123,10 @@ elif [ "x$ARCH" = "xarm32" -o "x$ARCH" = "xarm64" ]; then
 
 	file apps/openssl/.libs/openssl
 
-elif [ "x$ARCH" = "xmips32" -o "x$ARCH" = "xmips64" ]; then
+elif [ "$ARCH" = "mips32" -o "$ARCH" = "mips64" ]; then
 	sudo apt-get install -y qemu-user-static binfmt-support
 
-	if [ "x$ARCH" = "xmips32" ]; then
+	if [ "$ARCH" = "mips32" ]; then
 		sudo apt-get install -y g++-mips-linux-gnu
 		sudo ln -sf /usr/mipsel-linux-gnu/lib/ld.so.1 /lib/
 		./configure --host=mipsel-linux-gnu
@@ -109,7 +140,7 @@ elif [ "x$ARCH" = "xmips32" -o "x$ARCH" = "xmips64" ]; then
 
 	file apps/openssl/.libs/openssl
 
-elif [ "x$ARCH" = "xandroid" ]; then
+elif [ "$ARCH" = "android" ]; then
 	export TC_FILE=$ANDROID_NDK_HOME/build/cmake/android.toolchain.cmake
 
 	# set target API level and architecture

ssl/CMakeLists.txt

@@ -69,7 +69,8 @@ target_include_directories(ssl_obj
 		../crypto/bio
 		../include/compat
 	PUBLIC
-		../include)
+		../include
+		${CMAKE_BINARY_DIR}/include)
 
 add_library(bs_obj OBJECT ${BS_SRC})
 target_include_directories(bs_obj
@@ -86,13 +87,33 @@ endif()
 export_symbol(ssl ${CMAKE_CURRENT_SOURCE_DIR}/ssl.sym)
 target_link_libraries(ssl crypto ${PLATFORM_LIBS})
 if (WIN32)
-	set(SSL_POSTFIX -${SSL_MAJOR_VERSION})
+	set(SSL_POSTFIX -${SSL_MAJOR_VERSION} PARENT_SCOPE)
 endif()
 set_target_properties(ssl PROPERTIES
 	OUTPUT_NAME ssl${SSL_POSTFIX}
-	ARCHIVE_OUTPUT_NAME ssl${SSL_POSTFIX})
+	ARCHIVE_OUTPUT_NAME ssl${SSL_POSTFIX}
-set_target_properties(ssl PROPERTIES VERSION ${SSL_VERSION}
+	EXPORT_NAME SSL
-	SOVERSION ${SSL_MAJOR_VERSION})
+	VERSION ${SSL_VERSION}
+	SOVERSION ${SSL_MAJOR_VERSION}
+)
+
+target_include_directories(
+	ssl
+	PUBLIC
+	$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/include>
+	$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
+)
+
+install(
+	TARGETS ssl
+	EXPORT SSL-target
+)
+
+export(
+	EXPORT SSL-target
+	FILE "${LibreSSL_BINARY_DIR}/LibreSSL-SSL.cmake"
+	NAMESPACE LibreSSL::
+)
 
 if(ENABLE_LIBRESSL_INSTALL)
 	install(
@@ -101,6 +122,12 @@ if(ENABLE_LIBRESSL_INSTALL)
 		LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
 		RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
 	)
+	install(
+		EXPORT SSL-target
+		FILE "LibreSSL-SSL.cmake"
+		NAMESPACE LibreSSL::
+		DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}"
+	)
 endif(ENABLE_LIBRESSL_INSTALL)
 
 # build static library for regression test

ssl/Makefile.am

@@ -46,6 +46,8 @@ libbs_la_SOURCES += bs_cbs.c
 noinst_HEADERS = bytestring.h
 
 noinst_HEADERS += hidden/ssl_namespace.h
+noinst_HEADERS += hidden/openssl/srtp.h
+noinst_HEADERS += hidden/openssl/tls1.h
 noinst_HEADERS += hidden/openssl/ssl.h
 
 libssl_la_SOURCES = bio_ssl.c

tests/CMakeLists.txt

@@ -13,6 +13,7 @@ include_directories(
 	../apps/openssl
 	../apps/openssl/compat
 	../include
+	${CMAKE_BINARY_DIR}/include
 	../include/compat
 )
 
@@ -153,6 +154,11 @@ add_executable(bn_cmp bn_cmp.c)
 target_link_libraries(bn_cmp ${OPENSSL_TEST_LIBS})
 add_test(bn_cmp bn_cmp)
 
+# bn_convert
+add_executable(bn_convert bn_convert.c)
+target_link_libraries(bn_convert ${OPENSSL_TEST_LIBS})
+add_test(bn_convert bn_convert)
+
 # bn_gcd
 add_executable(bn_gcd bn_cmp.c)
 target_link_libraries(bn_gcd ${OPENSSL_TEST_LIBS})
@@ -172,6 +178,11 @@ set_source_files_properties(bn_mod_exp.c PROPERTIES COMPILE_FLAGS
 target_link_libraries(bn_mod_exp ${OPENSSL_TEST_LIBS})
 add_test(bn_mod_exp bn_mod_exp)
 
+# bn_mod_inverse
+add_executable(bn_mod_inverse bn_mod_inverse.c)
+target_link_libraries(bn_mod_inverse ${OPENSSL_TEST_LIBS})
+add_test(bn_mod_inverse bn_mod_inverse)
+
 # bn_mod_sqrt
 add_executable(bn_mod_sqrt bn_mod_sqrt.c)
 target_link_libraries(bn_mod_sqrt ${OPENSSL_TEST_LIBS})
@@ -187,10 +198,10 @@ add_executable(bn_primes bn_primes.c)
 target_link_libraries(bn_primes ${OPENSSL_TEST_LIBS})
 add_test(bn_primes bn_primes)
 
-# bn_rand_interval
+# bn_print
-add_executable(bn_rand_interval bn_rand_interval.c)
+add_executable(bn_print bn_print.c)
-target_link_libraries(bn_rand_interval ${OPENSSL_TEST_LIBS})
+target_link_libraries(bn_print ${OPENSSL_TEST_LIBS})
-add_test(bn_rand_interval bn_rand_interval)
+add_test(bn_print bn_print)
 
 # bn_shift
 add_executable(bn_shift bn_shift.c)
@@ -303,6 +314,11 @@ add_test(dsatest dsatest)
 # 	set_tests_properties(dtlstest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}")
 # endif()
 
+# ecc_cdh
+add_executable(ecc_cdh ecc_cdh.c)
+target_link_libraries(ecc_cdh ${OPENSSL_TEST_LIBS})
+add_test(ecc_cdh ecc_cdh)
+
 # ec_asn1_test
 add_executable(ec_asn1_test ec_asn1_test.c)
 target_link_libraries(ec_asn1_test ${OPENSSL_TEST_LIBS})
@@ -585,14 +601,23 @@ add_executable(sha_test sha_test.c)
 target_link_libraries(sha_test ${OPENSSL_TEST_LIBS})
 add_test(sha_test sha_test)
 
-# XXX HAVE_SOCKETPAIR
 # signertest
-# add_executable(signertest signertest.c)
+if(NOT CMAKE_SYSTEM_NAME MATCHES "WindowsStore")
-# target_link_libraries(signertest ${LIBTLS_TEST_LIBS})
+	set(SIGNERTEST_SRC signertest.c)
-# target_include_directories(signertest BEFORE PUBLIC ../tls)
+	check_function_exists(pipe2 HAVE_PIPE2)
-# set_source_files_properties(signertest.c PROPERTIES COMPILE_FLAGS
+	if(HAVE_PIPE2)
-#	-DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\")
+		add_definitions(-DHAVE_PIPE2)
-# add_test(signertest signertest)
+	else()
+		set(SIGNERTEST_SRC ${SIGNERTEST_SRC} compat/pipe2.c)
+	endif()
+
+	set_source_files_properties(signertest.c PROPERTIES COMPILE_FLAGS
+	      -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\")
+	add_executable(signertest ${SIGNERTEST_SRC})
+	target_link_libraries(signertest ${LIBTLS_TEST_LIBS})
+	target_include_directories(signertest BEFORE PUBLIC ../tls)
+	add_test(signertest signertest)
+endif()
 
 # sm2crypttest
 # sm2evptest

tests/Makefile.am

@@ -170,6 +170,11 @@ TESTS += bn_cmp
 check_PROGRAMS += bn_cmp
 bn_cmp_SOURCES = bn_cmp.c
 
+# bn_convert
+TESTS += bn_convert
+check_PROGRAMS += bn_convert
+bn_convert_SOURCES = bn_convert.c
+
 # bn_gcd
 TESTS += bn_gcd
 check_PROGRAMS += bn_gcd
@@ -188,6 +193,11 @@ check_PROGRAMS += bn_mod_exp
 bn_mod_exp_CPPFLAGS = $(AM_CPPFLAGS) -ULIBRESSL_INTERNAL
 bn_mod_exp_SOURCES = bn_mod_exp.c
 
+# bn_mod_inverse
+TESTS += bn_mod_inverse
+check_PROGRAMS += bn_mod_inverse
+bn_mod_inverse_SOURCES = bn_mod_inverse.c
+
 # bn_mod_sqrt
 TESTS += bn_mod_sqrt
 check_PROGRAMS += bn_mod_sqrt
@@ -203,10 +213,10 @@ TESTS += bn_primes
 check_PROGRAMS += bn_primes
 bn_primes_SOURCES = bn_primes.c
 
-# bn_rand_interval
+# bn_print
-TESTS += bn_rand_interval
+TESTS += bn_print
-check_PROGRAMS += bn_rand_interval
+check_PROGRAMS += bn_print
-bn_rand_interval_SOURCES = bn_rand_interval.c
+bn_print_SOURCES = bn_print.c
 
 # bn_shift
 TESTS += bn_shift
@@ -321,6 +331,11 @@ dsatest_SOURCES = dsatest.c
 #endif
 #EXTRA_DIST += dtlstest.sh
 
+# ecc_cdh
+TESTS += ecc_cdh
+check_PROGRAMS += ecc_cdh
+ecc_cdh_SOURCES = ecc_cdh.c
+
 # ec_asn1_test
 TESTS += ec_asn1_test
 check_PROGRAMS += ec_asn1_test
@@ -616,12 +631,14 @@ TESTS += sha_test
 check_PROGRAMS += sha_test
 sha_test_SOURCES = sha_test.c
 
-# XXX HAVE_SOCKETPAIR
 # signertest
-# TESTS += signertest
+TESTS += signertest
-# check_PROGRAMS += signertest
+check_PROGRAMS += signertest
-# signertest_CPPFLAGS = -I $(top_srcdir)/tls $(AM_CPPFLAGS) -DCERTSDIR=\"$(srcdir)\"
+signertest_CPPFLAGS = -I $(top_srcdir)/tls $(AM_CPPFLAGS) -DCERTSDIR=\"$(srcdir)\"
-# signertest_SOURCES = signertest.c
+signertest_SOURCES = signertest.c
+if !HAVE_PIPE2
+signertest_SOURCES += compat/pipe2.c
+endif
 
 # sm2crypttest
 # sm2evptest
@@ -681,7 +698,6 @@ EXTRA_DIST += server2-ecdsa.pem server2-rsa-chain.pem server2-rsa.pem
 EXTRA_DIST += server3-ecdsa-chain.pem server3-ecdsa.pem server3-rsa-chain.pem
 EXTRA_DIST += server3-rsa.pem
 
-
 # string_table
 TESTS += string_table
 check_PROGRAMS += string_table

tests/cmake/CMakeLists.txt

@@ -0,0 +1,37 @@
+cmake_minimum_required(VERSION 3.5)
+
+project(LibreSSL_Consumer LANGUAGES C)
+
+find_package(
+  LibreSSL
+  CONFIG
+  REQUIRED
+  COMPONENTS Crypto SSL TLS
+)
+
+set(RESULTS_TO_CHECK
+  "LIBRESSL_VERSION"
+  "LIBRESSL_FOUND"
+  "LIBRESSL_INCLUDE_DIR"
+  "LIBRESSL_LIBRARIES"
+  "LIBRESSL_CRYPTO_LIBRARY"
+  "LIBRESSL_SSL_LIBRARY"
+  "LIBRESSL_TLS_LIBRARY"
+)
+
+foreach(RESULT_VAR IN LISTS RESULTS_TO_CHECK)
+  if(${RESULT_VAR})
+    message(STATUS "${RESULT_VAR}: ${${RESULT_VAR}}")
+  else()
+    message(FATAL_ERROR "${RESULT_VAR} was not set by the package.")
+  endif()
+endforeach()
+
+add_executable(crypto crypto.c)
+target_link_libraries(crypto PRIVATE LibreSSL::Crypto)
+
+add_executable(ssl ssl.c)
+target_link_libraries(ssl PRIVATE LibreSSL::SSL)
+
+add_executable(tls tls.c)
+target_link_libraries(tls PRIVATE LibreSSL::TLS)

tests/cmake/crypto.c

@@ -0,0 +1,7 @@
+#include <openssl/crypto.h>
+
+int main(void) {
+  OPENSSL_init_crypto(0, NULL);
+  OPENSSL_cleanup();
+  return 0;
+}

tests/cmake/ssl.c

@@ -0,0 +1,6 @@
+#include <openssl/ssl.h>
+
+int main(void) {
+  SSL_library_init();
+  return 0;
+}

tests/cmake/tls.c

@@ -0,0 +1,6 @@
+#include <tls.h>
+
+int main(void) {
+  tls_init();
+  return 0;
+}

tests/testssl.bat

@@ -1,4 +1,4 @@
-@echo off
+@echo on
 setlocal enabledelayedexpansion
 REM	testssl.bat
 
@@ -88,8 +88,7 @@ for /f "usebackq" %%s in (`%openssl% no-dh`) do set nodh=%%s
 if %nodh%==no-dh (
   echo skipping anonymous DH tests
 ) else (
-  echo test tls1 with 1024bit anonymous DH, multiple handshakes
+  echo skipping tls1 tests.
-  %ssltest% -v -bio_pair -tls1 -cipher ADH -dhe1024dsa -num 10 -f -time %extra% & if !errorlevel! neq 0 exit /b 1
 )
 
 REM #for /f "usebackq" %%s in (`%openssl% no-rsa`) do set norsa=%%s
@@ -112,24 +111,24 @@ REM #
 REM # DTLS tests
 REM #
 
-echo test dtlsv1
+echo test dtlsv1_2
-%ssltest% -dtls1 %extra% & if !errorlevel! neq 0 exit /b 1
+%ssltest% -dtls1_2 %extra% & if !errorlevel! neq 0 exit /b 1
 
-echo test dtlsv1 with server authentication
+echo test dtlsv1_2 with server authentication
-%ssltest% -dtls1 -server_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1
+%ssltest% -dtls1_2 -server_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1
 
-echo test dtlsv1 with client authentication
+echo test dtlsv1_2 with client authentication
-%ssltest% -dtls1 -client_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1
+%ssltest% -dtls1_2 -client_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1
 
-echo test dtlsv1 with both client and server authentication
+echo test dtlsv1_2 with both client and server authentication
-%ssltest% -dtls1 -server_auth -client_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1
+%ssltest% -dtls1_2 -server_auth -client_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1
 
 echo "Testing DTLS ciphersuites"
 for %%p in ( SSLv3 ) do (
   echo "Testing ciphersuites for %%p"
   for /f "usebackq" %%c in (`%openssl% ciphers -v "RSA+%%p:-RC4" ^| find "%%p"`) do (
     echo "Testing %%c"
-    %ssltest% -cipher %%c -dtls1
+    %ssltest% -cipher %%c -dtls1_2
     if !errorlevel! neq 0 (
       echo "Failed %%c"
       exit /b 1
@@ -141,19 +140,19 @@ REM #
 REM # ALPN tests
 REM #
 echo "Testing ALPN..."
-%ssltest% -bio_pair -tls1 -alpn_client foo -alpn_server bar & if !errorlevel! neq 0 exit /b 1
+%ssltest% -bio_pair -alpn_client foo -alpn_server bar & if !errorlevel! neq 0 exit /b 1
-%ssltest% -bio_pair -tls1 -alpn_client foo -alpn_server foo ^
+%ssltest% -bio_pair -alpn_client foo -alpn_server foo ^
   -alpn_expected foo & if !errorlevel! neq 0 exit /b 1
-%ssltest% -bio_pair -tls1 -alpn_client foo,bar -alpn_server foo ^
+%ssltest% -bio_pair -alpn_client foo,bar -alpn_server foo ^
   -alpn_expected foo & if !errorlevel! neq 0 exit /b 1
-%ssltest% -bio_pair -tls1 -alpn_client bar,foo -alpn_server foo ^
+%ssltest% -bio_pair -alpn_client bar,foo -alpn_server foo ^
   -alpn_expected foo & if !errorlevel! neq 0 exit /b 1
-%ssltest% -bio_pair -tls1 -alpn_client bar,foo -alpn_server foo,bar ^
+%ssltest% -bio_pair -alpn_client bar,foo -alpn_server foo,bar ^
   -alpn_expected foo & if !errorlevel! neq 0 exit /b 1
-%ssltest% -bio_pair -tls1 -alpn_client bar,foo -alpn_server bar,foo ^
+%ssltest% -bio_pair -alpn_client bar,foo -alpn_server bar,foo ^
   -alpn_expected bar & if !errorlevel! neq 0 exit /b 1
-%ssltest% -bio_pair -tls1 -alpn_client foo,bar -alpn_server bar,foo ^
+%ssltest% -bio_pair -alpn_client foo,bar -alpn_server bar,foo ^
   -alpn_expected bar & if !errorlevel! neq 0 exit /b 1
-%ssltest% -bio_pair -tls1 -alpn_client baz -alpn_server bar,foo & if !errorlevel! neq 0 exit /b 1
+%ssltest% -bio_pair -alpn_client baz -alpn_server bar,foo & if !errorlevel! neq 0 exit /b 1
 
 endlocal

tls/CMakeLists.txt

@@ -45,7 +45,8 @@ target_include_directories(tls_obj
 		.
 		../include/compat
 	PUBLIC
-		../include)
+		../include
+		${CMAKE_BINARY_DIR}/include)
 
 add_library(tls $<TARGET_OBJECTS:tls_obj> $<TARGET_OBJECTS:ssl_obj>
 	$<TARGET_OBJECTS:crypto_obj> empty.c)
@@ -53,13 +54,33 @@ add_library(tls $<TARGET_OBJECTS:tls_obj> $<TARGET_OBJECTS:ssl_obj>
 export_symbol(tls ${CMAKE_CURRENT_BINARY_DIR}/tls.sym)
 target_link_libraries(tls ${PLATFORM_LIBS})
 if (WIN32)
-	set(TLS_POSTFIX -${TLS_MAJOR_VERSION})
+	set(TLS_POSTFIX -${TLS_MAJOR_VERSION} PARENT_SCOPE)
 endif()
 set_target_properties(tls PROPERTIES
 	OUTPUT_NAME tls${TLS_POSTFIX}
-	ARCHIVE_OUTPUT_NAME tls${TLS_POSTFIX})
+	ARCHIVE_OUTPUT_NAME tls${TLS_POSTFIX}
-set_target_properties(tls PROPERTIES VERSION ${TLS_VERSION}
+	EXPORT_NAME TLS
-	SOVERSION ${TLS_MAJOR_VERSION})
+	VERSION ${TLS_VERSION}
+	SOVERSION ${TLS_MAJOR_VERSION}
+)
+
+target_include_directories(
+	tls
+	PUBLIC
+	$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/include>
+	$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
+)
+
+install(
+	TARGETS tls
+	EXPORT TLS-target
+)
+
+export(
+	EXPORT TLS-target
+	FILE "${LibreSSL_BINARY_DIR}/LibreSSL-TLS.cmake"
+	NAMESPACE LibreSSL::
+)
 
 if(ENABLE_LIBRESSL_INSTALL)
 	install(
@@ -68,6 +89,12 @@ if(ENABLE_LIBRESSL_INSTALL)
 		LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
 		RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
 	)
+	install(
+		EXPORT TLS-target
+		FILE "LibreSSL-TLS.cmake"
+		NAMESPACE LibreSSL::
+		DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}"
+	)
 endif(ENABLE_LIBRESSL_INSTALL)
 
 # build static library for regression test

tls/Makefile.am

@@ -20,10 +20,17 @@ libtls_la_objects.mk: Makefile
 	  > libtls_la_objects.mk
 
 libtls_la_LDFLAGS = -version-info @LIBTLS_VERSION@ -no-undefined -export-symbols $(top_srcdir)/tls/tls.sym
+
+if ENABLE_LIBTLS_ONLY
 libtls_la_LIBADD = $(libcrypto_la_objects)
+libtls_la_LIBADD += $(libssl_la_objects)
+else
+libtls_la_LIBADD = $(abs_top_builddir)/crypto/libcrypto.la
+libtls_la_LIBADD += $(abs_top_builddir)/ssl/libssl.la
+endif
+
 libtls_la_LIBADD += $(libcompat_la_objects)
 libtls_la_LIBADD += $(libcompatnoopt_la_objects)
-libtls_la_LIBADD += $(libssl_la_objects)
 libtls_la_LIBADD += $(PLATFORM_LDADD)
 
 libtls_la_CPPFLAGS = $(AM_CPPFLAGS)

update.sh

@@ -18,7 +18,7 @@ set +e
 tag=`git describe --exact-match --tags HEAD 2>/dev/null`
 is_tag=$?
 # adjust for 9 hour time delta between trees
-release_ts=$((`git show -s --format=%ct $tag|tail -n1` + 32400))
+release_ts=$((`git show -s --format=%ct $tag|tail -1` + 32400))
 commit=`git -C openbsd rev-list -n 1 --before=$release_ts $openbsd_branch`
 git -C openbsd fetch
 if [ $is_tag -eq 0 ]; then
@@ -133,7 +133,7 @@ copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h
 	ecdh/ecdh.h rsa/rsa.h sha/sha.h x509/x509_vfy.h pkcs7/pkcs7.h pem/pem.h
 	pem/pem2.h hkdf/hkdf.h hmac/hmac.h rand/rand.h md5/md5.h
 	x509/x509v3.h conf/conf.h ocsp/ocsp.h
-	aes/aes.h modes/modes.h asn1/asn1t.h dso/dso.h bf/blowfish.h
+	aes/aes.h modes/modes.h asn1/asn1t.h bf/blowfish.h
 	bio/bio.h cast/cast.h cmac/cmac.h cms/cms.h conf/conf_api.h des/des.h dh/dh.h
 	dsa/dsa.h engine/engine.h ui/ui.h pkcs12/pkcs12.h ts/ts.h
 	md4/md4.h ripemd/ripemd.h whrlpool/whrlpool.h idea/idea.h
@@ -194,11 +194,6 @@ fixup_masm() {
 		> $2
 }
 
-fixup_macosx() {
-	echo Fixing up $2
-	sed -e 's/endbr64//' $1 > $2
-}
-
 # generate assembly crypto algorithms
 asm_src=$libcrypto_src
 gen_asm_stdout() {
@@ -210,8 +205,6 @@ gen_asm_stdout() {
 	EOF
 	if [ $1 = "masm" ]; then
 		fixup_masm crypto/$3.tmp crypto/$3
-	elif [ $1 = "macosx" ]; then
-		fixup_macosx crypto/$3.tmp crypto/$3
 	else
 		$MV crypto/$3.tmp crypto/$3
 	fi
@@ -238,8 +231,6 @@ gen_asm() {
 	EOF
 	if [ $1 = "masm" ]; then
 		fixup_masm crypto/$3.tmp crypto/$3
-	elif [ $1 = "macosx" ]; then
-		fixup_macosx crypto/$3.tmp crypto/$3
 	else
 		$MV crypto/$3.tmp crypto/$3
 	fi