Add mem_clr.c explicity for no-asm builds.
[openssl.git] / Configure
index e2efb5b..b30e47c 100755 (executable)
--- a/Configure
+++ b/Configure
@@ -166,7 +166,7 @@ my %table=(
 # Our development configs
 "purify",      "purify gcc:-g -DPURIFY -Wall::(unknown)::-lsocket -lnsl::::",
 "debug",       "gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DOPENSSL_NO_ASM -ggdb -g2 -Wformat -Wshadow -Wmissing-prototypes -Wmissing-declarations -Werror::(unknown)::-lefence::::",
-"debug-ben",   "gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown):::::bn86-elf.o co86-elf.o",
+"debug-ben",   "gcc:$gcc_devteam_warn -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DDEBUG_SAFESTACK -O2 -pipe::(unknown):::::",
 "debug-ben-openbsd","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -DOPENSSL_OPENBSD_DEV_CRYPTO -DOPENSSL_NO_ASM -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown)::::",
 "debug-ben-openbsd-debug","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -DOPENSSL_OPENBSD_DEV_CRYPTO -DOPENSSL_NO_ASM -g3 -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown)::::",
 "debug-ben-debug",     "gcc:$gcc_devteam_warn -DBN_DEBUG -DCONF_DEBUG -DDEBUG_SAFESTACK -g3 -O2 -pipe::(unknown)::::::",
@@ -398,6 +398,10 @@ my %table=(
 "linux-alpha-ccc","ccc:-fast -readonly_strings -DL_ENDIAN -DTERMIO::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${alpha_asm}",
 "linux-alpha+bwx-ccc","ccc:-fast -readonly_strings -DL_ENDIAN -DTERMIO::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${alpha_asm}",
 
+# Android: linux-* but without -DTERMIO and pointers to headers and libs.
+"android","gcc:-mandroid -I\$(ANDROID_DEV)/include -B\$(ANDROID_DEV)/lib -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"android-armv7","gcc:-march=armv7-a -mandroid -I\$(ANDROID_DEV)/include -B\$(ANDROID_DEV)/lib -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${armv4_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+
 #### *BSD [do see comment about ${BSDthreads} above!]
 "BSD-generic32","gcc:-DTERMIOS -O3 -fomit-frame-pointer -Wall::${BSDthreads}:::BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL:${no_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 "BSD-x86",     "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -Wall::${BSDthreads}:::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_asm}:a.out:dlfcn:bsd-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
@@ -510,8 +514,8 @@ my %table=(
 # Win64 targets, WIN64I denotes IA-64 and WIN64A - AMD64
 "VC-WIN64I","cl:-W3 -Gs0 -Gy -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DUNICODE -D_UNICODE -D_CRT_SECURE_NO_DEPRECATE:::WIN64I::SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT EXPORT_VAR_AS_FN:ia64cpuid.o:ia64.o ia64-mont.o::aes_core.o aes_cbc.o aes-ia64.o::md5-ia64.o:sha1-ia64.o sha256-ia64.o sha512-ia64.o:::::::ghash-ia64.o:ias:win32",
 "VC-WIN64A","cl:-W3 -Gs0 -Gy -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DUNICODE -D_UNICODE -D_CRT_SECURE_NO_DEPRECATE:::WIN64A::SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT EXPORT_VAR_AS_FN:x86_64cpuid.o:bn_asm.o x86_64-mont.o::aes-x86_64.o aesni-x86_64.o::md5-x86_64.o:sha1-x86_64.o sha256-x86_64.o sha512-x86_64.o::rc4-x86_64.o:::wp-x86_64.o:cmll-x86_64.o cmll_misc.o:ghash-x86_64.o:auto:win32",
-"debug-VC-WIN64I","cl:-W3 -Gs0 -Gy -Zi -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DUNICODE -D_UNICODE -D_CRT_SECURE_NO_DEPRECATE:::WIN64I::SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT EXPORT_VAR_AS_FN:ia64cpuid.o:ia64.o::aes_core.o aes_cbc.o aes-ia64.o::md5-ia64.o:sha1-ia64.o sha256-ia64.o sha512-ia64.o:::::::ias:win32",
-"debug-VC-WIN64A","cl:-W3 -Gs0 -Gy -Zi -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DUNICODE -D_UNICODE -D_CRT_SECURE_NO_DEPRECATE:::WIN64A::SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT EXPORT_VAR_AS_FN:x86_64cpuid.o:bn_asm.o x86_64-mont.o::aes-x86_64.o::md5-x86_64.o:sha1-x86_64.o sha256-x86_64.o sha512-x86_64.o::rc4-x86_64.o:::wp-x86_64.o:cmll-x86_64.o cmll_misc.o:auto:win32",
+"debug-VC-WIN64I","cl:-W3 -Gs0 -Gy -Zi -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DUNICODE -D_UNICODE -D_CRT_SECURE_NO_DEPRECATE:::WIN64I::SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT EXPORT_VAR_AS_FN:ia64cpuid.o:ia64.o::aes_core.o aes_cbc.o aes-ia64.o::md5-ia64.o:sha1-ia64.o sha256-ia64.o sha512-ia64.o:::::::ghash-ia64.o:ias:win32",
+"debug-VC-WIN64A","cl:-W3 -Gs0 -Gy -Zi -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DUNICODE -D_UNICODE -D_CRT_SECURE_NO_DEPRECATE:::WIN64A::SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT EXPORT_VAR_AS_FN:x86_64cpuid.o:bn_asm.o x86_64-mont.o::aes-x86_64.o::md5-x86_64.o:sha1-x86_64.o sha256-x86_64.o sha512-x86_64.o::rc4-x86_64.o:::wp-x86_64.o:cmll-x86_64.o cmll_misc.o:ghash-x86_64.o:auto:win32",
 # x86 Win32 target defaults to ANSI API, if you want UNICODE, complement
 # 'perl Configure VC-WIN32' with '-DUNICODE -D_UNICODE'
 "VC-WIN32","cl:-W3 -WX -Gs0 -GF -Gy -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -D_CRT_SECURE_NO_DEPRECATE:::WIN32::BN_LLONG RC4_INDEX EXPORT_VAR_AS_FN ${x86_gcc_opts}:${x86_asm}:win32n:win32",
@@ -647,6 +651,12 @@ my $openssldir="";
 my $exe_ext="";
 my $install_prefix= "$ENV{'INSTALL_PREFIX'}";
 my $cross_compile_prefix="";
+my $fipslibdir="/usr/local/ssl/fips-2.0/lib/";
+my $nofipscanistercheck=0;
+my $fipsdso=0;
+my $fipscanisterinternal="n";
+my $fipscanisteronly = 0;
+my $baseaddr="0xFB00000";
 my $no_threads=0;
 my $threads=0;
 my $no_shared=0; # but "no-shared" is default
@@ -681,11 +691,12 @@ my $cmll_enc="camellia.o cmll_misc.o cmll_cbc.o";
 my $processor="";
 my $default_ranlib;
 my $perl;
-
+my $fips=0;
 
 # All of the following is disabled by default (RC5 was enabled before 0.9.8):
 
 my %disabled = ( # "what"         => "comment" [or special keyword "experimental"]
+                "ec-nistp224-64-gcc-128" => "default",
                 "gmp"            => "default",
                  "jpake"          => "experimental",
                  "md2"            => "default",
@@ -698,6 +709,21 @@ my %disabled = ( # "what"         => "comment" [or special keyword "experimental
                );
 my @experimental = ();
 
+# If ssl directory missing assume truncated FIPS tarball
+if (!-d "ssl")
+       {
+       print STDERR "Auto Configuring fipsonly\n";
+       $fips = 1;
+       $nofipscanistercheck = 1;
+       $fipslibdir="";
+       $fipscanisterinternal="y";
+       $fipscanisteronly = 2;
+       if (! -f "crypto/bn/bn_gf2m.c" )
+               {
+               $disabled{ec2m} = "forced";
+               }
+       }
+
 # This is what $depflags will look like with the above defaults
 # (we need this to see if we should advise the user to run "make depend"):
 my $default_depflags = " -DOPENSSL_NO_GMP -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MD2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_STORE";
@@ -827,12 +853,44 @@ PROCESS_ARGS:
                        }
                elsif (/^386$/)
                        { $processor=386; }
+               elsif (/^fips$/)
+                       {
+                       $fips=1;
+                       }
                elsif (/^rsaref$/)
                        {
                        # No RSAref support any more since it's not needed.
                        # The check for the option is there so scripts aren't
                        # broken
                        }
+               elsif (/^nofipscanistercheck$/)
+                       {
+                       $fips = 1;
+                       $nofipscanistercheck = 1;
+                       }
+               elsif (/^fipscanisteronly$/)
+                       {
+                       $fips = 1;
+                       $nofipscanistercheck = 1;
+                       $fipslibdir="";
+                       $fipscanisterinternal="y";
+                       $fipscanisteronly = 1;
+                       }
+               elsif (/^fipscanisterbuild$/)
+                       {
+                       $fips = 1;
+                       $nofipscanistercheck = 1;
+                       $fipslibdir="";
+                       $fipscanisterinternal="y";
+                       }
+               elsif (/^fipsdso$/)
+                       {
+                       $fips = 1;
+                       $nofipscanistercheck = 1;
+                       $fipslibdir="";
+                       $fipscanisterinternal="y";
+                       $fipsdso = 1;
+                       }
                elsif (/^[-+]/)
                        {
                        if (/^-[lL](.*)$/ or /^-Wl,/)
@@ -871,6 +929,14 @@ PROCESS_ARGS:
                                {
                                $withargs{"zlib-include"}="-I$1";
                                }
+                       elsif (/^--with-fipslibdir=(.*)$/)
+                               {
+                               $fipslibdir="$1/";
+                               }
+                       elsif (/^--with-baseaddr=(.*)$/)
+                               {
+                               $baseaddr="$1";
+                               }
                        elsif (/^--cross-compile-prefix=(.*)$/)
                                {
                                $cross_compile_prefix=$1;
@@ -965,6 +1031,12 @@ if (defined($disabled{"ec"}) || defined($disabled{"dsa"})
        $disabled{"gost"} = "forced";
        }
 
+# SRP requires TLSEXT
+if (defined($disabled{"tlsext"}))
+       {
+       $disabled{"srp"} = "forced";
+       }
+
 if ($target eq "TABLE") {
        foreach $target (sort keys %table) {
                print_table_entry($target);
@@ -988,6 +1060,10 @@ print "Configuring for $target\n";
 
 &usage if (!defined($table{$target}));
 
+if ($fips)
+       {
+       delete $disabled{"shared"} if ($disabled{"shared"} eq "default");
+       }
 
 foreach (sort (keys %disabled))
        {
@@ -1014,7 +1090,7 @@ foreach (sort (keys %disabled))
        else
                {
                my ($ALGO, $algo);
-               ($ALGO = $algo = $_) =~ tr/[a-z]/[A-Z]/;
+               ($ALGO = $algo = $_) =~ tr/[\-a-z]/[_A-Z]/;
 
                if (/^asm$/ || /^err$/ || /^hw$/ || /^hw-/)
                        {
@@ -1045,6 +1121,13 @@ foreach (sort (keys %disabled))
        }
 
 my $exp_cflags = "";
+
+if ($fipscanisteronly == 2)
+       {
+print STDERR "ADDING FIPSSYM\n";
+       $exp_cflags .= " -DOPENSSL_FIPSSYMS";
+       }
+
 foreach (sort @experimental)
        {
        my $ALGO;
@@ -1060,7 +1143,17 @@ my $IsMK1MF=scalar grep /^$target$/,@MK1MF_Builds;
 $exe_ext=".exe" if ($target eq "Cygwin" || $target eq "DJGPP" || $target =~ /^mingw/);
 $exe_ext=".nlm" if ($target =~ /netware/);
 $exe_ext=".pm"  if ($target =~ /vos/);
-$openssldir="/usr/local/ssl" if ($openssldir eq "" and $prefix eq "");
+if ($openssldir eq "" and $prefix eq "")
+       {
+       if ($fips)
+               {
+               $openssldir="/usr/local/ssl/fips-2.0";
+               }
+       else
+               {
+               $openssldir="/usr/local/ssl";
+               }
+       }
 $prefix=$openssldir if $prefix eq "";
 
 $default_ranlib= &which("ranlib") or $default_ranlib="true";
@@ -1131,6 +1224,12 @@ my ($prelflags,$postlflags)=split('%',$lflags);
 if (defined($postlflags))      { $lflags=$postlflags;  }
 else                           { $lflags=$prelflags; undef $prelflags; }
 
+if ($target =~ /^mingw/ && `$cc --target-help 2>&1` !~ m/\-mno\-cygwin/m)
+       {
+       $cflags =~ s/\-mno\-cygwin\s*//;
+       $shared_ldflag =~ s/\-mno\-cygwin\s*//;
+       }
+
 my $no_shared_warn=0;
 my $no_user_cflags=0;
 
@@ -1260,6 +1359,8 @@ if ($no_asm)
        $cpuid_obj=$bn_obj=
        $des_obj=$aes_obj=$bf_obj=$cast_obj=$rc4_obj=$rc5_obj=$cmll_obj=
        $modes_obj=$sha1_obj=$md5_obj=$rmd160_obj=$wp_obj="";
+       $cflags=~s/\-D[BL]_ENDIAN//             if ($fips);
+       $thread_cflags=~s/\-D[BL]_ENDIAN//      if ($fips);
        }
 
 if (!$no_shared)
@@ -1297,7 +1398,7 @@ if ($zlib)
 my $shared_mark = "";
 if ($shared_target eq "")
        {
-       $no_shared_warn = 1 if !$no_shared;
+       $no_shared_warn = 1 if !$no_shared && !$fips;
        $no_shared = 1;
        }
 if (!$no_shared)
@@ -1392,6 +1493,15 @@ $cflags.=" -DOPENSSL_IA32_SSE2" if (!$no_sse2 && $bn_obj =~ /86/);
 
 $cflags.=" -DOPENSSL_BN_ASM_MONT" if ($bn_obj =~ /-mont/);
 
+if ($fips)
+       {
+       $openssl_other_defines.="#define OPENSSL_FIPS\n";
+       if ($fipscanisterinternal eq "y")
+               {
+               $openssl_other_defines.="#define OPENSSL_FIPSCANISTER\n";
+               }
+       }
+
 $cpuid_obj="mem_clr.o" unless ($cpuid_obj =~ /\.o$/);
 $des_obj=$des_enc      unless ($des_obj =~ /\.o$/);
 $bf_obj=$bf_enc                unless ($bf_obj =~ /\.o$/);
@@ -1492,10 +1602,12 @@ if ($strict_warnings)
                }
        }
 
-open(IN,'<Makefile.org') || die "unable to read Makefile.org:$!\n";
+my $mforg = $fipscanisteronly ? "Makefile.fips" : "Makefile.org";
+
+open(IN,"<$mforg") || die "unable to read $mforg:$!\n";
 unlink("$Makefile.new") || die "unable to remove old $Makefile.new:$!\n" if -e "$Makefile.new";
 open(OUT,">$Makefile.new") || die "unable to create $Makefile.new:$!\n";
-print OUT "### Generated automatically from Makefile.org by Configure.\n\n";
+print OUT "### Generated automatically from $mforg by Configure.\n\n";
 my $sdirs=0;
 while (<IN>)
        {
@@ -1509,6 +1621,7 @@ while (<IN>)
                        }
                }
        $sdirs = 0 unless /\\$/;
+        s/fips // if (/^DIRS=/ && !$fips);
         s/engines // if (/^DIRS=/ && $disabled{"engine"});
        s/ccgost// if (/^ENGDIRS=/ && $disabled{"gost"});
        s/^VERSION=.*/VERSION=$version/;
@@ -1568,6 +1681,21 @@ while (<IN>)
        s/^LIBKRB5=.*/LIBKRB5=$withargs{"krb5-lib"}/;
        s/^LIBZLIB=.*/LIBZLIB=$withargs{"zlib-lib"}/;
        s/^ZLIB_INCLUDE=.*/ZLIB_INCLUDE=$withargs{"zlib-include"}/;
+       s/^FIPSLIBDIR=.*/FIPSLIBDIR=$fipslibdir/;
+       if ($fipsdso)
+               {
+               s/^FIPSCANLIB=.*/FIPSCANLIB=libfips/;
+               s/^SHARED_FIPS=.*/SHARED_FIPS=libfips\$(SHLIB_EXT)/;
+               s/^SHLIBDIRS=.*/SHLIBDIRS= crypto ssl fips/;
+               }
+       else
+               {
+               s/^FIPSCANLIB=.*/FIPSCANLIB=libcrypto/ if $fips;
+               s/^SHARED_FIPS=.*/SHARED_FIPS=/;
+               s/^SHLIBDIRS=.*/SHLIBDIRS= crypto ssl/;
+               }
+       s/^FIPSCANISTERINTERNAL=.*/FIPSCANISTERINTERNAL=$fipscanisterinternal/;
+       s/^BASEADDR=.*/BASEADDR=$baseaddr/;
        s/^SHLIB_TARGET=.*/SHLIB_TARGET=$shared_target/;
        s/^SHLIB_MARK=.*/SHLIB_MARK=$shared_mark/;
        s/^SHARED_LIBS=.*/SHARED_LIBS=\$(SHARED_CRYPTO) \$(SHARED_SSL)/ if (!$no_shared);
@@ -1590,6 +1718,10 @@ while (<IN>)
                s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.\$(SHLIB_MAJOR).dylib .dylib/;
                }
        s/^SHARED_LDFLAGS=.*/SHARED_LDFLAGS=$shared_ldflag/;
+       if ($fipscanisteronly == 2 && exists $disabled{"ec2m"})
+               {
+               next if (/ec2_/ || /bn_gf2m/);
+               }
        print OUT $_."\n";
        }
 close(IN);
@@ -1827,7 +1959,9 @@ EOF
        $make_targets .= " gentests" if $symlink;
        (system $make_command.$make_targets) == 0 or exit $?
                if $make_targets ne "";
-       if ( $perl =~ m@^/@) {
+       if ( $fipscanisteronly )
+               {}
+       elsif ( $perl =~ m@^/@) {
            &dofile("tools/c_rehash",$perl,'^#!/', '#!%s','^my \$dir;$', 'my $dir = "' . $openssldir . '";', '^my \$prefix;$', 'my $prefix = "' . $prefix . '";');
            &dofile("apps/CA.pl",$perl,'^#!/', '#!%s');
        } else {
@@ -1835,7 +1969,7 @@ EOF
            &dofile("tools/c_rehash",'/usr/local/bin/perl','^#!/', '#!%s','^my \$dir;$', 'my $dir = "' . $openssldir . '";',  '^my \$prefix;$', 'my $prefix = "' . $prefix . '";');
            &dofile("apps/CA.pl",'/usr/local/bin/perl','^#!/', '#!%s');
        }
-       if ($depflags ne $default_depflags && !$make_depend) {
+       if ($depflags ne $default_depflags && !$make_depend && $fipscanisteronly != 2) {
                print <<EOF;
 
 Since you've disabled or enabled at least one algorithm, you need to do
@@ -1878,9 +2012,16 @@ BEGIN
     BEGIN
        BLOCK "040904b0"
        BEGIN
+#if defined(FIPS)
+           VALUE "Comments", "WARNING: TEST VERSION ONLY ***NOT*** FIPS 140-2 VALIDATED.\\0"
+#endif
            // Required:            
            VALUE "CompanyName", "The OpenSSL Project, http://www.openssl.org/\\0"
+#if defined(FIPS)
+           VALUE "FileDescription", "TEST UNVALIDATED FIPS140-2 DLL\\0"
+#else
            VALUE "FileDescription", "OpenSSL Shared Library\\0"
+#endif
            VALUE "FileVersion", "$version\\0"
 #if defined(CRYPTO)
            VALUE "InternalName", "libeay32\\0"
@@ -1888,6 +2029,9 @@ BEGIN
 #elif defined(SSL)
            VALUE "InternalName", "ssleay32\\0"
            VALUE "OriginalFilename", "ssleay32.dll\\0"
+#elif defined(FIPS)
+           VALUE "InternalName", "libosslfips\\0"
+           VALUE "OriginalFilename", "libosslfips.dll\\0"
 #endif
            VALUE "ProductName", "The OpenSSL Toolkit\\0"
            VALUE "ProductVersion", "$version\\0"
@@ -1930,6 +2074,21 @@ libraries on this platform, they will at least look at it and try their best
 (but please first make sure you have tried with a current version of OpenSSL).
 EOF
 
+print <<\EOF if ($fipscanisterinternal eq "y");
+
+WARNING: OpenSSL has been configured using unsupported option(s) to internally
+generate a fipscanister.o object module for TESTING PURPOSES ONLY; that
+compiled module is NOT FIPS 140-2 validated and CANNOT be used to replace the
+OpenSSL FIPS Object Module as identified by the CMVP
+(http://csrc.nist.gov/cryptval/) in any application requiring the use of FIPS
+140-2 validated software. 
+
+This is an OpenSSL 1.1.0 test version.
+
+See the file README.FIPS for details of how to build a test library.
+
+EOF
+
 exit(0);
 
 sub usage