Add some extra comments following alert changes
[openssl.git] / Configure
index 4404963..24dbde8 100755 (executable)
--- a/Configure
+++ b/Configure
@@ -9,7 +9,7 @@
 
 ##  Configure -- OpenSSL source tree configuration script
 
 
 ##  Configure -- OpenSSL source tree configuration script
 
-require 5.10.0;
+use 5.10.0;
 use strict;
 use Config;
 use File::Basename;
 use strict;
 use Config;
 use File::Basename;
@@ -119,6 +119,9 @@ my $gcc_devteam_warn = "-DDEBUG_UNUSED"
         . " -Wswitch"
         . " -DPEDANTIC -pedantic -Wno-long-long"
         . " -Wall"
         . " -Wswitch"
         . " -DPEDANTIC -pedantic -Wno-long-long"
         . " -Wall"
+        . " -Wextra"
+        . " -Wno-unused-parameter"
+        . " -Wno-missing-field-initializers"
         . " -Wsign-compare"
         . " -Wmissing-prototypes"
         . " -Wshadow"
         . " -Wsign-compare"
         . " -Wmissing-prototypes"
         . " -Wshadow"
@@ -138,17 +141,13 @@ my $gcc_devteam_warn = "-DDEBUG_UNUSED"
 #       -Wextended-offsetof -- no, needed in CMS ASN1 code
 my $clang_devteam_warn = ""
         . " -Qunused-arguments"
 #       -Wextended-offsetof -- no, needed in CMS ASN1 code
 my $clang_devteam_warn = ""
         . " -Qunused-arguments"
-        . " -Wextra"
-        . " -Wswitch -Wswitch-default"
-        . " -Wno-unused-parameter"
+        . " -Wswitch-default"
         . " -Wno-parentheses-equality"
         . " -Wno-parentheses-equality"
-        . " -Wno-missing-field-initializers"
         . " -Wno-language-extension-token"
         . " -Wno-extended-offsetof"
         . " -Wconditional-uninitialized"
         . " -Wincompatible-pointer-types-discards-qualifiers"
         . " -Wmissing-variable-declarations"
         . " -Wno-language-extension-token"
         . " -Wno-extended-offsetof"
         . " -Wconditional-uninitialized"
         . " -Wincompatible-pointer-types-discards-qualifiers"
         . " -Wmissing-variable-declarations"
-        . " -Wundef"
         ;
 
 # This adds backtrace information to the memory leak info.  Is only used
         ;
 
 # This adds backtrace information to the memory leak info.  Is only used
@@ -302,12 +301,8 @@ $config{openssldir}="";
 $config{processor}="";
 $config{libdir}="";
 $config{cross_compile_prefix}="";
 $config{processor}="";
 $config{libdir}="";
 $config{cross_compile_prefix}="";
-$config{fipslibdir}="/usr/local/ssl/fips-2.0/lib/";
-my $nofipscanistercheck=0;
-$config{baseaddr}="0xFB00000";
 my $auto_threads=1;    # enable threads automatically? true by default
 my $default_ranlib;
 my $auto_threads=1;    # enable threads automatically? true by default
 my $default_ranlib;
-$config{fips}=0;
 
 # Top level directories to build
 $config{dirs} = [ "crypto", "ssl", "engines", "apps", "test", "util", "tools", "fuzz" ];
 
 # Top level directories to build
 $config{dirs} = [ "crypto", "ssl", "engines", "apps", "test", "util", "tools", "fuzz" ];
@@ -411,6 +406,7 @@ my @disablables = (
     "tests",
     "threads",
     "tls",
     "tests",
     "threads",
     "tls",
+    "tls13downgrade",
     "ts",
     "ubsan",
     "ui",
     "ts",
     "ubsan",
     "ui",
@@ -455,6 +451,7 @@ our %disabled = ( # "what"         => "comment"
                   "ubsan"              => "default",
           #TODO(TLS1.3): Temporarily disabled while this is a WIP
                  "tls1_3"              => "default",
                   "ubsan"              => "default",
           #TODO(TLS1.3): Temporarily disabled while this is a WIP
                  "tls1_3"              => "default",
+                 "tls13downgrade"      => "default",
                  "unit-test"           => "default",
                  "weak-ssl-ciphers"    => "default",
                  "zlib"                => "default",
                  "unit-test"           => "default",
                  "weak-ssl-ciphers"    => "default",
                  "zlib"                => "default",
@@ -685,7 +682,7 @@ while (@argvcopy)
                { $config{processor}=386; }
        elsif (/^fips$/)
                {
                { $config{processor}=386; }
        elsif (/^fips$/)
                {
-               $config{fips}=1;
+               die "FIPS mode not supported\n";
                }
        elsif (/^rsaref$/)
                {
                }
        elsif (/^rsaref$/)
                {
@@ -695,8 +692,7 @@ while (@argvcopy)
                }
        elsif (/^nofipscanistercheck$/)
                {
                }
        elsif (/^nofipscanistercheck$/)
                {
-               $config{fips} = 1;
-               $nofipscanistercheck = 1;
+               die "FIPS mode not supported\n";
                }
        elsif (/^[-+]/)
                {
                }
        elsif (/^[-+]/)
                {
@@ -734,14 +730,6 @@ while (@argvcopy)
                        {
                        $withargs{fuzzer_include}=$1;
                        }
                        {
                        $withargs{fuzzer_include}=$1;
                        }
-               elsif (/^--with-fipslibdir=(.*)$/)
-                       {
-                       $config{fipslibdir}="$1/";
-                       }
-               elsif (/^--with-baseaddr=(.*)$/)
-                       {
-                       $config{baseaddr}="$1";
-                       }
                elsif (/^--cross-compile-prefix=(.*)$/)
                        {
                        $config{cross_compile_prefix}=$1;
                elsif (/^--cross-compile-prefix=(.*)$/)
                        {
                        $config{cross_compile_prefix}=$1;
@@ -754,6 +742,10 @@ while (@argvcopy)
                        {
                        $libs.=$_." ";
                        }
                        {
                        $libs.=$_." ";
                        }
+               elsif (/^-framework$/)
+                       {
+                       $libs.=$_." ".shift(@argvcopy)." ";
+                       }
                elsif (/^-rpath$/ or /^-R$/)
                        # -rpath is the OSF1 rpath flag
                        # -R is the old Solaris rpath flag
                elsif (/^-rpath$/ or /^-R$/)
                        # -rpath is the OSF1 rpath flag
                        # -R is the old Solaris rpath flag
@@ -821,15 +813,6 @@ if ($libs =~ /(^|\s)-Wl,-rpath,/
        "***** any of asan, msan or ubsan\n";
 }
 
        "***** any of asan, msan or ubsan\n";
 }
 
-if ($config{fips})
-       {
-       delete $disabled{"shared"} if ($disabled{"shared"} =~ /^default/);
-       }
-else
-       {
-       @{$config{dirs}} = grep !/^fips$/, @{$config{dirs}};
-       }
-
 my @tocheckfor = (keys %disabled);
 while (@tocheckfor) {
     my %new_tocheckfor = ();
 my @tocheckfor = (keys %disabled);
 while (@tocheckfor) {
     my %new_tocheckfor = ();
@@ -1015,6 +998,25 @@ $target{build_scheme} = [ $target{build_scheme} ]
 my ($builder, $builder_platform, @builder_opts) =
     @{$target{build_scheme}};
 
 my ($builder, $builder_platform, @builder_opts) =
     @{$target{build_scheme}};
 
+foreach my $checker (($builder_platform."-".$target{build_file}."-checker.pm",
+                      $builder_platform."-checker.pm")) {
+    my $checker_path = catfile($srcdir, "Configurations", $checker);
+    if (-f $checker_path) {
+        my $fn = $ENV{CONFIGURE_CHECKER_WARN}
+            ? sub { warn $@; } : sub { die $@; };
+        if (! do $checker_path) {
+            if ($@) {
+                $fn->($@);
+            } elsif ($!) {
+                $fn->($!);
+            } else {
+                $fn->("The detected tools didn't match the platform\n");
+            }
+        }
+        last;
+    }
+}
+
 push @{$config{defines}}, "NDEBUG"    if $config{build_type} eq "release";
 
 if ($target =~ /^mingw/ && `$target{cc} --target-help 2>&1` =~ m/-mno-cygwin/m)
 push @{$config{defines}}, "NDEBUG"    if $config{build_type} eq "release";
 
 if ($target =~ /^mingw/ && `$target{cc} --target-help 2>&1` =~ m/-mno-cygwin/m)
@@ -1058,15 +1060,6 @@ if (!$disabled{dso} && $target{dso_scheme} ne "")
 
 $config{ex_libs}="$libs$config{ex_libs}" if ($libs ne "");
 
 
 $config{ex_libs}="$libs$config{ex_libs}" if ($libs ne "");
 
-if ($disabled{asm})
-       {
-       if ($config{fips})
-               {
-               @{$config{defines}} = grep !/^[BL]_ENDIAN$/, @{$config{defines}};
-               @{$target{defines}} = grep !/^[BL]_ENDIAN$/, @{$target{defines}};
-               }
-       }
-
 # If threads aren't disabled, check how possible they are
 unless ($disabled{threads}) {
     if ($auto_threads) {
 # If threads aren't disabled, check how possible they are
 unless ($disabled{threads}) {
     if ($auto_threads) {
@@ -1107,8 +1100,7 @@ if (defined($disabled{"deprecated"})) {
 if ($target{shared_target} eq "")
        {
        $no_shared_warn = 1
 if ($target{shared_target} eq "")
        {
        $no_shared_warn = 1
-           if ((!$disabled{shared} || !$disabled{"dynamic-engine"})
-               && !$config{fips});
+           if (!$disabled{shared} || !$disabled{"dynamic-engine"});
        $disabled{shared} = "no-shared-target";
        $disabled{pic} = $disabled{shared} = $disabled{"dynamic-engine"} =
            "no-shared-target";
        $disabled{shared} = "no-shared-target";
        $disabled{pic} = $disabled{shared} = $disabled{"dynamic-engine"} =
            "no-shared-target";
@@ -1172,10 +1164,6 @@ unless ($disabled{asm}) {
     push @{$config{defines}}, "OPENSSL_BN_ASM_MONT5" if ($target{bn_asm_src} =~ /-mont5/);
     push @{$config{defines}}, "OPENSSL_BN_ASM_GF2m" if ($target{bn_asm_src} =~ /-gf2m/);
 
     push @{$config{defines}}, "OPENSSL_BN_ASM_MONT5" if ($target{bn_asm_src} =~ /-mont5/);
     push @{$config{defines}}, "OPENSSL_BN_ASM_GF2m" if ($target{bn_asm_src} =~ /-gf2m/);
 
-    if ($config{fips}) {
-       push @{$config{openssl_other_defines}}, "OPENSSL_FIPS";
-    }
-
     if ($target{sha1_asm_src}) {
        push @{$config{defines}}, "SHA1_ASM"   if ($target{sha1_asm_src} =~ /sx86/ || $target{sha1_asm_src} =~ /sha1/);
        push @{$config{defines}}, "SHA256_ASM" if ($target{sha1_asm_src} =~ /sha256/);
     if ($target{sha1_asm_src}) {
        push @{$config{defines}}, "SHA1_ASM"   if ($target{sha1_asm_src} =~ /sx86/ || $target{sha1_asm_src} =~ /sha1/);
        push @{$config{defines}}, "SHA256_ASM" if ($target{sha1_asm_src} =~ /sha256/);
@@ -1743,12 +1731,24 @@ EOF
             }
 
             # Additionally, we set up sharednames for libraries that don't
             }
 
             # Additionally, we set up sharednames for libraries that don't
-            # have any, as themselves.
-            foreach (keys %{$unified_info{libraries}}) {
+            # have any, as themselves.  Only for libraries that aren't
+            # explicitely static.
+            foreach (grep !/\.a$/, keys %{$unified_info{libraries}}) {
                 if (!defined $unified_info{sharednames}->{$_}) {
                     $unified_info{sharednames}->{$_} = $_
                 }
             }
                 if (!defined $unified_info{sharednames}->{$_}) {
                     $unified_info{sharednames}->{$_} = $_
                 }
             }
+
+            # Check that we haven't defined any library as both shared and
+            # explicitely static.  That is forbidden.
+            my @doubles = ();
+            foreach (grep /\.a$/, keys %{$unified_info{libraries}}) {
+                (my $l = $_) =~ s/\.a$//;
+                push @doubles, $l if defined $unified_info{sharednames}->{$l};
+            }
+            die "these libraries are both explicitely static and shared:\n  ",
+                join(" ", @doubles), "\n"
+                if @doubles;
         }
 
         foreach (keys %ordinals) {
         }
 
         foreach (keys %ordinals) {
@@ -2595,7 +2595,7 @@ sub isabsolute {
     # On non-platforms, we just use file_name_is_absolute().
     return file_name_is_absolute($file) unless $^O eq "VMS";
 
     # On non-platforms, we just use file_name_is_absolute().
     return file_name_is_absolute($file) unless $^O eq "VMS";
 
-    # If the file spec includes a device or a directpry spec,
+    # If the file spec includes a device or a directory spec,
     # file_name_is_absolute() is perfectly safe.
     return file_name_is_absolute($file) if $file =~ m|[:\[]|;
 
     # file_name_is_absolute() is perfectly safe.
     return file_name_is_absolute($file) if $file =~ m|[:\[]|;