Add scrypt PBE algorithm code.
[openssl.git] / Configure
index 5e5205c2edf085fb7419d1afb2e77b5f6e4f0440..f0a8accaa47aa045c585b605b03d114b994c1741 100755 (executable)
--- a/Configure
+++ b/Configure
@@ -14,7 +14,7 @@ use File::Spec::Functions;
 
 # see INSTALL for instructions.
 
-my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimental-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-dso] [no-krb5] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--test-sanity] [--config=FILE] os/compiler[:flags]\n";
+my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimental-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-dso] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--test-sanity] [--config=FILE] os/compiler[:flags]\n";
 
 # Options:
 #
@@ -30,18 +30,6 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimenta
 #               default).  This needn't be set in advance, you can
 #               just as well use "make INSTALL_PREFIX=/whatever install".
 #
-# --with-krb5-dir  Declare where Kerberos 5 lives.  The libraries are expected
-#              to live in the subdirectory lib/ and the header files in
-#              include/.  A value is required.
-# --with-krb5-lib  Declare where the Kerberos 5 libraries live.  A value is
-#              required.
-#              (Default: KRB5_DIR/lib)
-# --with-krb5-include  Declare where the Kerberos 5 header files live.  A
-#              value is required.
-#              (Default: KRB5_DIR/include)
-# --with-krb5-flavor  Declare what flavor of Kerberos 5 is used.  Currently
-#              supported values are "MIT" and "Heimdal".  A value is required.
-#
 # --test-sanity Make a number of sanity checks on the data in this file.
 #               This is a debugging tool for OpenSSL developers.
 #
@@ -59,7 +47,6 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimenta
 # no-asm        do not use assembler
 # no-dso        do not compile in any native shared-library methods. This
 #               will ensure that all methods just return NULL.
-# no-krb5       do not compile in any KRB5 library or code.
 # [no-]zlib     [don't] compile support for zlib compression.
 # zlib-dynamic Like "zlib", but the zlib library is expected to be a shared
 #              library and will be loaded in run-time by the OpenSSL library.
@@ -110,9 +97,17 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimenta
 # Minimum warning options... any contributions to OpenSSL should at least get
 # past these.
 
-my $gcc_devteam_warn = "-Wall -pedantic -DPEDANTIC -Wno-long-long -Wsign-compare -Wmissing-prototypes -Wshadow -Wformat -Werror -DCRYPTO_MDEBUG_ALL -DCRYPTO_MDEBUG_ABORT -DREF_CHECK";
+my $gcc_devteam_warn = "-Wall -pedantic -DPEDANTIC -Wno-long-long -Wsign-compare -Wmissing-prototypes -Wshadow -Wformat -Wtype-limits -Werror -DCRYPTO_MDEBUG_ALL -DCRYPTO_MDEBUG_ABORT -DREF_CHECK -DDEBUG_UNUSED";
 
-my $clang_disabled_warnings = "-Wno-language-extension-token -Wno-extended-offsetof -Wno-padded -Wno-shorten-64-to-32 -Wno-format-nonliteral -Wno-missing-noreturn -Wno-unused-parameter -Wno-sign-conversion -Wno-unreachable-code -Wno-conversion -Wno-documentation -Wno-missing-variable-declarations -Wno-cast-align -Wno-incompatible-pointer-types-discards-qualifiers -Wno-missing-variable-declarations -Wno-missing-field-initializers -Wno-unused-macros -Wno-disabled-macro-expansion -Wno-conditional-uninitialized -Wno-switch-enum";
+# These are used in addition to $gcc_devteam_warn when the compiler is clang.
+# TODO(openssl-team): fix problems and investigate if (at least) the
+# following warnings can also be enabled: -Wconditional-uninitialized,
+# -Wswitch-enum, -Wunused-macros, -Wmissing-field-initializers,
+# -Wmissing-variable-declarations,
+# -Wincompatible-pointer-types-discards-qualifiers, -Wcast-align,
+# -Wunreachable-code -Wunused-parameter -Wlanguage-extension-token
+# -Wextended-offsetof
+my $clang_devteam_warn = "-Wno-unused-parameter -Wno-missing-field-initializers -Wno-language-extension-token -Wno-extended-offsetof";
 
 my $strict_warnings = 0;
 
@@ -121,37 +116,11 @@ my $x86_gcc_des="DES_PTR DES_RISC1 DES_UNROLL";
 # MD2_CHAR slags pentium pros
 my $x86_gcc_opts="RC4_INDEX MD2_INT";
 
-# MODIFY THESE PARAMETERS IF YOU ARE GOING TO USE THE 'util/speed.sh SCRIPT
-# Don't worry about these normally
-
-my $tcc="cc";
-my $tflags="-fast -Xa";
-my $tbn_mul="";
-my $tlib="-lnsl -lsocket";
 #$bits1="SIXTEEN_BIT ";
 #$bits2="THIRTY_TWO_BIT ";
 my $bits1="THIRTY_TWO_BIT ";
 my $bits2="SIXTY_FOUR_BIT ";
 
-my $x86_asm="x86cpuid.o:bn-586.o co-586.o x86-mont.o x86-gf2m.o:ecp_nistz256.o ecp_nistz256-x86.o:des-586.o crypt586.o:aes-586.o vpaes-x86.o aesni-x86.o:bf-586.o:md5-586.o:sha1-586.o sha256-586.o sha512-586.o:cast-586.o:rc4-586.o:rmd-586.o:rc5-586.o:wp_block.o wp-mmx.o:cmll-x86.o:ghash-x86.o:e_padlock-x86.o";
-
-my $x86_elf_asm="$x86_asm:elf";
-
-my $x86_64_asm="x86_64cpuid.o:x86_64-gcc.o x86_64-mont.o x86_64-mont5.o x86_64-gf2m.o rsaz_exp.o rsaz-x86_64.o rsaz-avx2.o:ecp_nistz256.o ecp_nistz256-x86_64.o::aes-x86_64.o vpaes-x86_64.o bsaes-x86_64.o aesni-x86_64.o aesni-sha1-x86_64.o aesni-sha256-x86_64.o aesni-mb-x86_64.o::md5-x86_64.o:sha1-x86_64.o sha256-x86_64.o sha512-x86_64.o sha1-mb-x86_64.o sha256-mb-x86_64.o::rc4-x86_64.o rc4-md5-x86_64.o:::wp-x86_64.o:cmll-x86_64.o cmll_misc.o:ghash-x86_64.o aesni-gcm-x86_64.o:e_padlock-x86_64.o";
-my $ia64_asm="ia64cpuid.o:bn-ia64.o ia64-mont.o:::aes_core.o aes_cbc.o aes-ia64.o::md5-ia64.o:sha1-ia64.o sha256-ia64.o sha512-ia64.o::rc4-ia64.o rc4_skey.o:::::ghash-ia64.o::void";
-my $sparcv9_asm="sparcv9cap.o sparccpuid.o:bn-sparcv9.o sparcv9-mont.o sparcv9a-mont.o vis3-mont.o sparct4-mont.o sparcv9-gf2m.o::des_enc-sparc.o fcrypt_b.o dest4-sparcv9.o:aes_core.o aes_cbc.o aes-sparcv9.o aest4-sparcv9.o::md5-sparcv9.o:sha1-sparcv9.o sha256-sparcv9.o sha512-sparcv9.o::::::camellia.o cmll_misc.o cmll_cbc.o cmllt4-sparcv9.o:ghash-sparcv9.o::void";
-my $sparcv8_asm=":sparcv8.o::des_enc-sparc.o fcrypt_b.o:::::::::::::void";
-my $alpha_asm="alphacpuid.o:bn_asm.o alpha-mont.o::::::sha1-alpha.o:::::::ghash-alpha.o::void";
-my $mips64_asm=":bn-mips.o mips-mont.o:::aes_cbc.o aes-mips.o:::sha1-mips.o sha256-mips.o sha512-mips.o::::::::";
-my $mips32_asm=$mips64_asm; $mips32_asm =~ s/\s*sha512\-mips\.o//;
-my $s390x_asm="s390xcap.o s390xcpuid.o:bn-s390x.o s390x-mont.o s390x-gf2m.o:::aes-s390x.o aes-ctr.o aes-xts.o:::sha1-s390x.o sha256-s390x.o sha512-s390x.o::rc4-s390x.o:::::ghash-s390x.o:";
-my $armv4_asm="armcap.o armv4cpuid.o:bn_asm.o armv4-mont.o armv4-gf2m.o:ecp_nistz256.o ecp_nistz256-armv4.o::aes_cbc.o aes-armv4.o bsaes-armv7.o aesv8-armx.o:::sha1-armv4-large.o sha256-armv4.o sha512-armv4.o:::::::ghash-armv4.o ghashv8-armx.o::void";
-my $aarch64_asm="armcap.o arm64cpuid.o mem_clr.o::::aes_core.o aes_cbc.o aesv8-armx.o:::sha1-armv8.o sha256-armv8.o sha512-armv8.o:::::::ghashv8-armx.o:";
-my $parisc11_asm="pariscid.o:bn_asm.o parisc-mont.o:::aes_core.o aes_cbc.o aes-parisc.o:::sha1-parisc.o sha256-parisc.o sha512-parisc.o::rc4-parisc.o:::::ghash-parisc.o::32";
-my $parisc20_asm="pariscid.o:pa-risc2W.o parisc-mont.o:::aes_core.o aes_cbc.o aes-parisc.o:::sha1-parisc.o sha256-parisc.o sha512-parisc.o::rc4-parisc.o:::::ghash-parisc.o::64";
-my $ppc64_asm="ppccpuid.o ppccap.o:bn-ppc.o ppc-mont.o ppc64-mont.o:::aes_core.o aes_cbc.o aes-ppc.o vpaes-ppc.o aesp8-ppc.o:::sha1-ppc.o sha256-ppc.o sha512-ppc.o sha256p8-ppc.o sha512p8-ppc.o:::::::ghashp8-ppc.o:";
-my $ppc32_asm=$ppc64_asm;
-
 # As for $BSDthreads. Idea is to maintain "collective" set of flags,
 # which would cover all BSD flavors. -pthread applies to them all,
 # but is treated differently. OpenBSD expands is as -D_POSIX_THREAD
@@ -161,7 +130,6 @@ my $ppc32_asm=$ppc64_asm;
 # seems to be sufficient?
 my $BSDthreads="-pthread -D_THREAD_SAFE -D_REENTRANT";
 
-
 # table of known configurations, read in from files
 #
 # The content of each entry can take one of two forms:
@@ -218,14 +186,14 @@ my $BSDthreads="-pthread -D_THREAD_SAFE -D_REENTRANT";
 #      {
 #        cc => $cc,
 #        cflags => $cflags,
-#        "debug-cflags" => $debug_cflags,
-#        "nodebug-cflags" => $nodebug_cflags,
+#        debug_cflags => $debug_cflags,
+#        release_cflags => $release_cflags,
 #        unistd => $unistd,
 #        thread_cflag => $thread_cflag,
 #        sys_id => $sys_id,
 #        lflags => $lflags,
-#        "debug-lflags" => $debug_lflags,
-#        "nodebug-lflags" => $nodebug_lflags,
+#        debug_lflags => $debug_lflags,
+#        release_lflags => $release_lflags,
 #        bn_ops => $bn_ops,
 #        cpuid_obj => $cpuid_obj,
 #        bn_obj => $bn_obj,
@@ -259,48 +227,80 @@ my $BSDthreads="-pthread -D_THREAD_SAFE -D_REENTRANT";
 #
 # The configuration hashes can refer to templates in two different manners:
 #
-# - as part of the hash, one can have a key called 'base_templates' that
+# - as part of the hash, one can have a key called 'inherit_from' that
 #   indicate what other configuration hashes to inherit data from.
 #   These are resolved recursively.
 #
+#   Inheritance works as a set of default values that can be overriden
+#   by corresponding attribute values in the inheriting configuration.
+#
+#   If several configurations are given in the 'inherit_from' array, the
+#   values of same attribute are concatenated with space separation.
+#   With this, it's possible to have several smaller templates for
+#   different configuration aspects that can be combined into a complete
+#   configuration.
+#
 #   Example:
 #
+#      "foo" => {
+#              template => 1,
+#              haha => "haha",
+#              hoho => "ho"
+#      },
 #      "bar" => {
-#              haha => "haha"
+#              template => 1,
+#              hoho => "ho",
+#              hehe => "hehe"
 #      },
-#      "foo" => {
-#              base_templates => [ "bar" ],
-#              hoho => "hoho"
+#      "laughter" => {
+#              inherit_from => [ "foo", "bar" ],
 #      }
 #
 #      The entry for "foo" will become as follows after processing:
 #
-#      "foo" => {
+#      "laughter" => {
 #              haha => "haha",
-#              hoho => "hoho"
+#              hoho => "ho ho",
+#              hehe => "hehe"
 #      }
 #
 #   Note 1: any entry from the table can be used as a template.
 #   Note 2: pure templates have the attribute 'template => 1' and cannot
-#           be used as targets
+#           be used as targets.
 #
-# - as part of any string, one can have a template reference wrapped in
-#   double braces, and when processing templates, this will be replaced
-#   with the corresponding string from the template.
+# - instead of a string, one can have a code block of the form
+#   'sub { /* your code here */ }', where the arguments are the list of
+#   inherited values for that key.  In fact, the concatenation of strings
+#   is really done by using 'sub { join(" ",@_) }' on the list of inherited
+#   values.
 #
 #   Example:
 #
+#      "foo" => {
+#              template => 1,
+#              haha => "ha ha",
+#              hoho => "ho",
+#              ignored => "This should not appear in the end result",
+#      },
 #      "bar" => {
-#              haha => "haha"
+#              template => 1,
+#              haha => "ah",
+#              hoho => "haho",
+#              hehe => "hehe"
 #      },
-#      "foo" => {
-#              haha => "{{bar}} !!!!"
+#      "laughter" => {
+#              inherit_from => [ "foo", "bar" ],
+#              hehe => sub { join(" ",(@_,"!!!")) },
+#              ignored => "",
 #      }
 #
 #      The entry for "foo" will become as follows after processing:
 #
-#      "foo" => {
-#              haha => "haha !!!!"
+#      "laughter" => {
+#              haha => "ha ha ah",
+#              hoho => "ho haho",
+#              hehe => "hehe !!!",
+#              ignored => ""
 #      }
 #
 
@@ -312,28 +312,6 @@ my %table=(
     # Note: as long as someone might use old style configuration strings,
     # or we bother supporting that, those variables need to stay
 
-    # Filler used for when there are no asm files.
-    no_asm_filler => {
-       template        => 1,
-       cpuid_obj       => "",
-       bn_obj          => "",
-       ec_obj          => "",
-       des_obj         => "",
-       aes_obj         => "",
-       bf_obj          => "",
-       md5_obj         => "",
-       sha1_obj        => "",
-       cast_obj        => "",
-       rc4_obj         => "",
-       rmd160_obj      => "",
-       rc5_obj         => "",
-       wp_obj          => "",
-       cmll_obj        => "",
-       modes_obj       => "",
-       engines_obj     => "",
-       perlasm_scheme  => "void"
-    },
-
     x86_asm => {
        template        => 1,
        cpuid_obj       => "x86cpuid.o",
@@ -344,7 +322,6 @@ my %table=(
        bf_obj          => "bf-586.o",
        md5_obj         => "md5-586.o",
        sha1_obj        => "sha1-586.o sha256-586.o sha512-586.o",
-       cast_obj        => "cast-586.o",
        rc4_obj         => "rc4-586.o",
        rmd160_obj      => "rmd-586.o",
        rc5_obj         => "rc5-586.o",
@@ -355,10 +332,9 @@ my %table=(
     },
     x86_elf_asm => {
        template        => 1,
-       base_templates  => [ "x86_asm" ],
+       inherit_from    => [ "x86_asm" ],
        perlasm_scheme  => "elf"
     },
-
     x86_64_asm => {
        template        => 1,
        cpuid_obj       => "x86_64cpuid.o",
@@ -388,6 +364,7 @@ my %table=(
        template        => 1,
        cpuid_obj       => "sparcv9cap.o sparccpuid.o",
        bn_obj          => "bn-sparcv9.o sparcv9-mont.o sparcv9a-mont.o vis3-mont.o sparct4-mont.o sparcv9-gf2m.o",
+        ec_obj          => "ecp_nistz256.o ecp_nistz256-sparcv9.o",
        des_obj         => "des_enc-sparc.o fcrypt_b.o dest4-sparcv9.o",
        aes_obj         => "aes_core.o aes_cbc.o aes-sparcv9.o aest4-sparcv9.o",
        md5_obj         => "md5-sparcv9.o",
@@ -418,9 +395,9 @@ my %table=(
        sha1_obj        => "sha1-mips.o sha256-mips.o",
     },
     mips64_asm => {
-       base_templates  => [ "mips32_asm" ],
+       inherit_from    => [ "mips32_asm" ],
        template        => 1,
-       sha1_obj        => "{{mips32_asm}} sha512-mips.o",
+       sha1_obj        => sub { join(" ", @_, "sha512-mips.o") }
     },
     s390x_asm => {
        template        => 1,
@@ -444,7 +421,9 @@ my %table=(
     aarch64_asm => {
        template        => 1,
        cpuid_obj       => "armcap.o arm64cpuid.o mem_clr.o",
-       aes_obj         => "aes_core.o aes_cbc.o aesv8-armx.o",
+       ec_obj          => "ecp_nistz256.o ecp_nistz256-armv8.o",
+       bn_obj          => "bn_asm.o armv8-mont.o",
+       aes_obj         => "aes_core.o aes_cbc.o aesv8-armx.o vpaes-armv8.o",
        sha1_obj        => "sha1-armv8.o sha256-armv8.o sha512-armv8.o",
        modes_obj       => "ghashv8-armx.o",
     },
@@ -458,15 +437,11 @@ my %table=(
        modes_obj       => "ghash-parisc.o",
        perlasm_scheme  => "32"
     },
-    parisc20_asm => {
+    parisc20_64_asm => {
        template        => 1,
-       cpuid_obj       => "pariscid.o",
-       bn_obj          => "pa-risc2W.o parisc-mont.o",
-       aes_obj         => "aes_core.o aes_cbc.o aes-parisc.o",
-       sha1_obj        => "sha1-parisc.o sha256-parisc.o sha512-parisc.o",
-       rc4_obj         => "rc4-parisc.o",
-       modes_obj       => "ghash-parisc.o",
-       perlasm_scheme  => "64"
+       inherit_from    => [ "parisc11_asm" ],
+       bn_obj          => sub { my $r=join(" ",@_); $r=~s/bn_asm/pa-risc2W/; $r; },
+       perlasm_scheme  => "64",
     },
     ppc64_asm => {
        template        => 1,
@@ -477,11 +452,17 @@ my %table=(
        modes_obj       => "ghashp8-ppc.o",
     },
     ppc32_asm => {
-       base_templates  => [ "ppc64_asm" ],
+       inherit_from    => [ "ppc64_asm" ],
        template        => 1
     },
 );
 
+{   my $no_asm_templates=0;
+    foreach (@ARGV) { $no_asm_templates=1 if (/^\-?no\-asm$/); }
+    sub asm { $no_asm_templates?():@_; }
+}
+
+
 sub stringtohash {
     my $in = shift @_;
     if (ref($in) eq "HASH") {
@@ -526,32 +507,6 @@ sub stringtohash {
     return { map { shift @stringsequence => $_ } split /:/, $in };
 };
 
-# Support function to look for and resolve template references.
-# It uses breadcrumbs to check for circular template references.
-#
-# Note: Any configuration value is also a template.
-sub lookup_templates {
-    my $tableref = shift;
-    my $target = shift;
-    my @breadcrumbs = @_;
-
-    if (grep { $_ eq $target } @breadcrumbs) {
-       die "Template loop!  target backtrace:\n  ",join("\n  ",
-                                                        $target,
-                                                        @breadcrumbs),"\n";
-    }
-
-    foreach my $key (keys %{$tableref->{$target}}) {
-       my $value = $tableref->{$target}->{$key};
-       while ($value =~ /{{([-\w]+)}}/) {
-           lookup_templates($tableref, $1, $target, @breadcrumbs);
-           $value = $`.$tableref->{$1}->{$key}.$';
-       }
-       $tableref->{$target}->{$key} = $value;
-    }
-};
-
-
 # Read configuration target stanzas from a file, so that people can have
 # local files with their own definitions
 sub read_config {
@@ -621,9 +576,9 @@ sub read_config {
                        # First, check that the non-debug variant isn't
                        # already built up with all it should have.
                        if ($nondebug->{debug_cflags}
-                           || $nondebug->{nodebug_cflags}
+                           || $nondebug->{release_cflags}
                            || $nondebug->{debug_lflags}
-                           || $nondebug->{nodebug_lflags}) {
+                           || $nondebug->{release_lflags}) {
                            warn "there's a debug target $debugkey to be merged with a target $nondebugkey, but the latter seems to already have both nodebug and debug information.  This requires human intervention.  Skipping $debugkey...";
                            next;
                        }
@@ -653,11 +608,11 @@ sub read_config {
                            # becomes the merged variant when we're done.
                            # for each of cflags and lflags, they are
                            # replaced with cflags, debug_cflags,
-                           # nodebug_cflags and similar for lflags.
+                           # release_cflags and similar for lflags.
                            #
                            # The purpose is that 'cflags' should be
                            # used together with 'debug_cflags' or
-                           # 'nodebug_cflags' depending on what the
+                           # 'release_cflags' depending on what the
                            # user asks for.
                            foreach (("cflags", "lflags")) {
                                my @list_d = split /\s+/, $debug->{$_};
@@ -693,57 +648,98 @@ sub read_config {
 
        %table = (%table, %targets);
 
-       # Go through all new targets and resolve template references.
-       foreach (keys %targets) {
-           # Start with resolving the base templates
-           my @breadcrumbs = ();
-           while (my @base_templates =
-                  $table{$_}->{base_templates} ?
-                  @{$table{$_}->{base_templates}} : ()) {
-               my %new_template_data = ();
-               my %new_base_templates = ();
-               foreach my $base_template (@base_templates) {
-                   if (grep { $_ eq $base_template } @breadcrumbs) {
-                       die "Base template loop!  target backtrace:\n  "
-                           ,$base_template,"\n  "
-                           ,join("\n  ",
-                                 map { "[ ".join(", ", @{$_})." ]" } @breadcrumbs)
-                           ,"\n";
+       # Local function to resolve inheritance
+       my $resolve_inheritance;
+       $resolve_inheritance =
+           sub {
+               my $target = shift;
+               my @breadcrumbs = @_;
+
+               if (grep { $_ eq $target } @breadcrumbs) {
+                   die "inherit_from loop!  target backtrace:\n  "
+                       ,$target,"\n  ",join("\n  ", @breadcrumbs),"\n";
+               }
+
+               # Recurse through all inheritances.  They will be resolved on
+               # the fly, so when this operation is done, they will all just
+               # be a bunch of attributes with string values.
+               # What we get here, though, are keys with references to lists
+               # of the combined values of them all.  We will deal with lists
+               # after this stage is done.
+               my %combined_inheritance = ();
+               if ($table{$target}->{inherit_from}) {
+                   foreach (@{$table{$target}->{inherit_from}}) {
+                       my %inherited_config =
+                           $resolve_inheritance->($_, $target, @breadcrumbs);
+
+                       # 'template' is a marker that's considered private to
+                       # the config that had it.
+                       delete $inherited_config{template};
+
+                       map {
+                           if (!$combined_inheritance{$_}) {
+                               $combined_inheritance{$_} = [];
+                           }
+                           push @{$combined_inheritance{$_}}, $inherited_config{$_};
+                       } keys %inherited_config;
                    }
+               }
 
-                   if ($table{$base_template}) {
-                       %new_base_templates =
-                           (
-                            %new_base_templates,
-                            map { $_ => 1 } @{$table{$base_template}->{base_templates}}
-                           );
-                       %new_template_data =
-                           (
-                            %new_template_data,
-                            %{$table{$base_template}}
-                           );
-                       delete $new_template_data{template};
+               # We won't need inherit_from in this target any more, since
+               # we've resolved all the inheritances that lead to this
+               delete $table{$target}->{inherit_from};
+
+               # Now is the time to deal with those lists.  Here's the place
+               # to decide what shall be done with those lists, all based on
+               # the values of the target we're currently dealing with.
+               # - If a value is a coderef, it will be executed with the list
+               #   of inherited values as arguments.
+               # - If the corresponding key doesn't have a value at all or is
+               #   the emoty string, the inherited value list will be run
+               #   through the default combiner (below), and the result
+               #   becomes this target's value.
+               # - Otherwise, this target's value is assumed to be a string
+               #   that will simply override the inherited list of values.
+               my $default_combiner = sub { join(' ',@_) };
+
+               my %all_keys =
+                   map { $_ => 1 } (keys %combined_inheritance,
+                                    keys %{$table{$target}});
+               foreach (sort keys %all_keys) {
+
+                   # Current target doesn't have a value for the current key?
+                   # Assign it the default combiner, the rest of this loop
+                   # body will handle it just like any other coderef.
+                   if (!exists $table{$target}->{$_}) {
+                       $table{$target}->{$_} = $default_combiner;
+                   }
+
+                   my $valuetype = ref($table{$target}->{$_});
+                   if ($valuetype eq "CODE") {
+                       # CODE reference, execute it with the inherited values
+                       # as arguments.
+                       $table{$target}->{$_} =
+                           $table{$target}->{$_}->(@{$combined_inheritance{$_}});
+                   } elsif ($valuetype eq "") {
+                       # Scalar, just leave it as is.
                    } else {
-                       # There are unresolved base templates.  That's no good
-                       warn "Target $_ has unresolved base templates.  Removing...";
-                       delete $table{$_};
-                       goto NEXT;
+                       # Some other type of reference that we don't handle.
+                       # Better to abort at this point.
+                       die "cannot handle reference type $valuetype,"
+                           ," found in target $target -> $_\n";
                    }
                }
 
-               @breadcrumbs = ( [ @base_templates ], @breadcrumbs );
-               # Now, we rebuild the target, using the newly fetched template
-               # data, overlaying that with the target's original data, and
-               # overlaying the new base template list on top of that
-               $table{$_} = {
-                   %new_template_data,
-                   %{$table{$_}},
-                   base_templates => [ keys %new_base_templates ]
-               }
-           }
+               # Finally done, return the result.
+               %{$table{$target}};
+       };
 
-           lookup_templates(\%table, $_);
-         NEXT:
+       # Go through all new targets and resolve inheritance and template
+       # references.
+       foreach (keys %targets) {
+           # We're ignoring the returned values here, they are only valuable
+           # to the inner recursion of this function.
+           $resolve_inheritance->($_);
        }
 }
 
@@ -773,7 +769,6 @@ my $no_threads=0;
 my $threads=0;
 my $no_shared=0; # but "no-shared" is default
 my $zlib=1;      # but "no-zlib" is default
-my $no_krb5=0;   # but "no-krb5" is implied unless "--with-krb5-..." is used
 my $no_rfc3779=1; # but "no-rfc3779" is default
 my $no_asm=0;
 my $no_dso=0;
@@ -781,13 +776,13 @@ my $no_gmp=0;
 my @skip=();
 my $Makefile="Makefile";
 my $des_locl="crypto/des/des_locl.h";
-my $des        ="crypto/des/des.h";
-my $bn ="crypto/bn/bn.h";
-my $md2        ="crypto/md2/md2.h";
-my $rc4        ="crypto/rc4/rc4.h";
+my $des        ="include/openssl/des.h";
+my $bn ="include/openssl/bn.h";
+my $md2        ="include/openssl/md2.h";
+my $rc4        ="include/openssl/rc4.h";
 my $rc4_locl="crypto/rc4/rc4_locl.h";
-my $idea       ="crypto/idea/idea.h";
-my $rc2        ="crypto/rc2/rc2.h";
+my $idea       ="include/openssl/idea.h";
+my $rc2        ="include/openssl/rc2.h";
 my $bf ="crypto/bf/bf_locl.h";
 my $bn_asm     ="bn_asm.o";
 my $des_enc="des_enc.o fcrypt_b.o";
@@ -847,12 +842,11 @@ my $openssl_thread_defines;
 my $openssl_sys_defines="";
 my $openssl_other_defines;
 my $libs;
-my $libkrb5="";
 my $target;
 my $options;
-my $symlink;
 my $make_depend=0;
 my %withargs=();
+my $build_prefix = "release_";
 
 my @argvcopy=@ARGV;
 my $argvstring="";
@@ -870,7 +864,6 @@ while($argv_unprocessed)
        $libs="";
        $target="";
        $options="";
-       $symlink=1;
 
        $argv_unprocessed=0;
        $argvstring=join(' ',@argvcopy);
@@ -927,10 +920,18 @@ PROCESS_ARGS:
                        {
                        exit(&test_sanity());
                        }
-               elsif (/^--strict-warnings/)
+               elsif (/^--strict-warnings$/)
                        {
                        $strict_warnings = 1;
                        }
+               elsif (/^--debug$/)
+                       {
+                       $build_prefix = "debug_";
+                       }
+               elsif (/^--release$/)
+                       {
+                       $build_prefix = "release_";
+                       }
                elsif (/^reconfigure/ || /^reconf/)
                        {
                        if (open(IN,"<$Makefile"))
@@ -989,10 +990,6 @@ PROCESS_ARGS:
                                {
                                $install_prefix=$1;
                                }
-                       elsif (/^--with-krb5-(dir|lib|include|flavor)=(.*)$/)
-                               {
-                               $withargs{"krb5-".$1}=$2;
-                               }
                        elsif (/^--with-zlib-lib=(.*)$/)
                                {
                                $withargs{"zlib-lib"}=$1;
@@ -1060,11 +1057,6 @@ if ($processor eq "386")
        $disabled{"sse2"} = "forced";
        }
 
-if (!defined($withargs{"krb5-flavor"}) || $withargs{"krb5-flavor"} eq "")
-       {
-       $disabled{"krb5"} = "krb5-flavor not specified";
-       }
-
 if (!defined($disabled{"zlib-dynamic"}))
        {
        # "zlib-dynamic" was specifically enabled, so enable "zlib"
@@ -1141,21 +1133,26 @@ if ($target =~ m/^CygWin32(-.*)$/) {
 
 print "Configuring for $target\n";
 
+# Support for legacy targets having a name starting with 'debug-'
 my ($d, $t) = $target =~ m/^(debug-)?(.*)$/;
-my $debug_prefix = "nodebug-";
 if ($d) {
-    $debug_prefix = "debug-";
+    $build_prefix = "debug_";
 
     # If we do not find debug-foo in the table, the target is set to foo,
-    # but only if the foo target has a noon-empty debug-cflags or debug-lflags
+    # but only if the foo target has a noon-empty debug_cflags or debug_lflags
     # attribute.
-    if (!$table{$target} && ($table{$t}->{"debug-cflags"}
-                            || $table{$t}->{"debug-lflags"})) {
+    if (!$table{$target} && ($table{$t}->{debug_cflags}
+                            || $table{$t}->{debug_lflags})) {
        $target = $t;
     }
 }
 
-&usage if (!defined($table{$target}) || $table{$target}->{template});
+&usage if (!defined($table{$target})
+          || $table{$target}->{template}
+          || ($build_prefix eq "debug_"
+              && $target !~ /^debug-/
+              && !($table{$target}->{debug_cflags}
+                   || $table{$target}->{debug_lflags})));
 
 if ($fips)
        {
@@ -1180,8 +1177,6 @@ foreach (sort (keys %disabled))
                { }
        elsif (/^zlib-dynamic$/)
                { }
-       elsif (/^symlinks$/)
-               { $symlink = 0; }
        elsif (/^sse2$/)
                { $no_sse2 = 1; }
        else
@@ -1204,19 +1199,14 @@ foreach (sort (keys %disabled))
                        $openssl_algorithm_defines .= "#define OPENSSL_NO_$ALGO\n";
                        print " OPENSSL_NO_$ALGO";
 
-                       if (/^krb5$/)
-                               { $no_krb5 = 1; }
-                       else
-                               {
-                               push @skip, $algo;
-                               # fix-up crypto/directory name(s)
-                               $skip[$#skip]="whrlpool" if $algo eq "whirlpool";
-                               $skip[$#skip]="ripemd" if $algo eq "rmd160";
+                       push @skip, $algo;
+                       # fix-up crypto/directory name(s)
+                       $skip[$#skip]="whrlpool" if $algo eq "whirlpool";
+                       $skip[$#skip]="ripemd" if $algo eq "rmd160";
 
-                               print " (skip dir)";
+                       print " (skip dir)";
 
-                               $depflags .= " -DOPENSSL_NO_$ALGO";
-                               }
+                       $depflags .= " -DOPENSSL_NO_$ALGO";
                        }
                }
 
@@ -1260,47 +1250,47 @@ $openssldir=$prefix . "/" . $openssldir if $openssldir !~ /(^\/|^[a-zA-Z]:[\\\/]
 print "IsMK1MF=$IsMK1MF\n";
 
 # Allow environment CC to override compiler...
-my $cc = $ENV{CC} || $table{$t}->{cc};
+my $cc = $ENV{CC} || $table{$target}->{cc};
 
-# For cflags and lflags, add the debug- or nodebug- attributes
+# For cflags and lflags, add the debug_ or release_ attributes
 # Do it in such a way that no spurious space is appended (hence the grep).
 my $cflags = join(" ",
-                 grep { $_ } ($table{$t}->{cflags},
-                              $table{$t}->{$debug_prefix."cflags"}));
+                 grep { $_ } ($table{$target}->{cflags},
+                              $table{$target}->{$build_prefix."cflags"}));
 my $lflags = join(" ",
-                 grep { $_ } ($table{$t}->{lflags},
-                              $table{$t}->{$debug_prefix."lflags"}));
-
-my $unistd = $table{$t}->{unistd};
-my $thread_cflag = $table{$t}->{thread_cflag};
-my $sys_id = $table{$t}->{sys_id};
-my $bn_ops = $table{$t}->{bn_ops};
-my $cpuid_obj = $table{$t}->{cpuid_obj};
-my $bn_obj = $table{$t}->{bn_obj};
-my $ec_obj = $table{$t}->{ec_obj};
-my $des_obj = $table{$t}->{des_obj};
-my $aes_obj = $table{$t}->{aes_obj};
-my $bf_obj = $table{$t}->{bf_obj};
-my $md5_obj = $table{$t}->{md5_obj};
-my $sha1_obj = $table{$t}->{sha1_obj};
-my $cast_obj = $table{$t}->{cast_obj};
-my $rc4_obj = $table{$t}->{rc4_obj};
-my $rmd160_obj = $table{$t}->{rmd160_obj};
-my $rc5_obj = $table{$t}->{rc5_obj};
-my $wp_obj = $table{$t}->{wp_obj};
-my $cmll_obj = $table{$t}->{cmll_obj};
-my $modes_obj = $table{$t}->{modes_obj};
-my $engines_obj = $table{$t}->{engines_obj};
-my $perlasm_scheme = $table{$t}->{perlasm_scheme};
-my $dso_scheme = $table{$t}->{dso_scheme};
-my $shared_target = $table{$t}->{shared_target};
-my $shared_cflag = $table{$t}->{shared_cflag};
-my $shared_ldflag = $table{$t}->{shared_ldflag};
-my $shared_extension = $table{$t}->{shared_extension};
-my $ranlib = $ENV{'RANLIB'} || $table{$t}->{ranlib};
+                 grep { $_ } ($table{$target}->{lflags},
+                              $table{$target}->{$build_prefix."lflags"}));
+
+my $unistd = $table{$target}->{unistd};
+my $thread_cflag = $table{$target}->{thread_cflag};
+my $sys_id = $table{$target}->{sys_id};
+my $bn_ops = $table{$target}->{bn_ops};
+my $cpuid_obj = $table{$target}->{cpuid_obj};
+my $bn_obj = $table{$target}->{bn_obj};
+my $ec_obj = $table{$target}->{ec_obj};
+my $des_obj = $table{$target}->{des_obj};
+my $aes_obj = $table{$target}->{aes_obj};
+my $bf_obj = $table{$target}->{bf_obj};
+my $md5_obj = $table{$target}->{md5_obj};
+my $sha1_obj = $table{$target}->{sha1_obj};
+my $cast_obj = $table{$target}->{cast_obj};
+my $rc4_obj = $table{$target}->{rc4_obj};
+my $rmd160_obj = $table{$target}->{rmd160_obj};
+my $rc5_obj = $table{$target}->{rc5_obj};
+my $wp_obj = $table{$target}->{wp_obj};
+my $cmll_obj = $table{$target}->{cmll_obj};
+my $modes_obj = $table{$target}->{modes_obj};
+my $engines_obj = $table{$target}->{engines_obj};
+my $perlasm_scheme = $table{$target}->{perlasm_scheme};
+my $dso_scheme = $table{$target}->{dso_scheme};
+my $shared_target = $table{$target}->{shared_target};
+my $shared_cflag = $table{$target}->{shared_cflag};
+my $shared_ldflag = $table{$target}->{shared_ldflag};
+my $shared_extension = $table{$target}->{shared_extension};
+my $ranlib = $ENV{'RANLIB'} || $table{$target}->{ranlib};
 my $ar = $ENV{'AR'} || "ar";
-my $arflags = $table{$t}->{arflags};
-my $multilib = $table{$t}->{multilib};
+my $arflags = $table{$target}->{arflags};
+my $multilib = $table{$target}->{multilib};
 
 # if $prefix/lib$multilib is not an existing directory, then
 # assume that it's not searched by linker automatically, in
@@ -1335,62 +1325,6 @@ my $no_user_cflags=0;
 if ($flags ne "")      { $cflags="$flags$cflags"; }
 else                   { $no_user_cflags=1;       }
 
-# Kerberos settings.  The flavor must be provided from outside, either through
-# the script "config" or manually.
-if (!$no_krb5)
-       {
-       my ($lresolv, $lpath, $lext);
-       if ($withargs{"krb5-flavor"} =~ /^[Hh]eimdal$/)
-               {
-               die "Sorry, Heimdal is currently not supported\n";
-               }
-       ##### HACK to force use of Heimdal.
-       ##### WARNING: Since we don't really have adequate support for Heimdal,
-       #####          using this will break the build.  You'll have to make
-       #####          changes to the source, and if you do, please send
-       #####          patches to openssl-dev@openssl.org
-       if ($withargs{"krb5-flavor"} =~ /^force-[Hh]eimdal$/)
-               {
-               warn "Heimdal isn't really supported.  Your build WILL break\n";
-               warn "If you fix the problems, please send a patch to openssl-dev\@openssl.org\n";
-               $withargs{"krb5-dir"} = "/usr/heimdal"
-                       if $withargs{"krb5-dir"} eq "";
-               $withargs{"krb5-lib"} = "-L".$withargs{"krb5-dir"}.
-                       "/lib -lgssapi -lkrb5 -lcom_err"
-                       if $withargs{"krb5-lib"} eq "" && !$IsMK1MF;
-               $cflags="-DKRB5_HEIMDAL $cflags";
-               }
-       if ($withargs{"krb5-flavor"} =~ /^[Mm][Ii][Tt]/)
-               {
-               $withargs{"krb5-dir"} = "/usr/kerberos"
-                       if $withargs{"krb5-dir"} eq "";
-               $withargs{"krb5-lib"} = "-L".$withargs{"krb5-dir"}.
-                       "/lib -lgssapi_krb5 -lkrb5 -lcom_err -lk5crypto"
-                       if $withargs{"krb5-lib"} eq "" && !$IsMK1MF;
-               $cflags="-DKRB5_MIT $cflags";
-               $withargs{"krb5-flavor"} =~ s/^[Mm][Ii][Tt][._-]*//;
-               if ($withargs{"krb5-flavor"} =~ /^1[._-]*[01]/)
-                       {
-                       $cflags="-DKRB5_MIT_OLD11 $cflags";
-                       }
-               }
-       LRESOLV:
-       foreach $lpath ("/lib", "/usr/lib")
-               {
-               foreach $lext ("a", "so")
-                       {
-                       $lresolv = "$lpath/libresolv.$lext";
-                       last LRESOLV    if (-r "$lresolv");
-                       $lresolv = "";
-                       }
-               }
-       $withargs{"krb5-lib"} .= " -lresolv"
-               if ("$lresolv" ne "");
-       $withargs{"krb5-include"} = "-I".$withargs{"krb5-dir"}."/include"
-               if $withargs{"krb5-include"} eq "" &&
-                  $withargs{"krb5-dir"} ne "";
-       }
-
 # The DSO code currently always implements all functions so that no
 # applications will have to worry about that from a compilation point
 # of view. However, the "method"s may return zero unless that platform
@@ -1690,7 +1624,7 @@ my $shlib_version_history = "unknown";
 my $shlib_major = "unknown";
 my $shlib_minor = "unknown";
 
-open(IN,'<crypto/opensslv.h') || die "unable to read opensslv.h:$!\n";
+open(IN,'<include/openssl/opensslv.h') || die "unable to read opensslv.h:$!\n";
 while (<IN>)
        {
        $version=$1 if /OPENSSL.VERSION.TEXT.*OpenSSL (\S+) /;
@@ -1715,12 +1649,21 @@ if ($shlib_version_number =~ /(^[0-9]*)\.([0-9\.]*)/)
 
 if ($strict_warnings)
        {
+       my $ecc = $cc;
+       $ecc = "clang" if `$cc --version 2>&1` =~ /clang/;
        my $wopt;
-       die "ERROR --strict-warnings requires gcc or clang" unless ($cc =~ /gcc$/ or $cc =~ /clang$/);
+       die "ERROR --strict-warnings requires gcc or clang" unless ($ecc =~ /gcc$/ or $ecc =~ /clang$/);
        foreach $wopt (split /\s+/, $gcc_devteam_warn)
                {
                $cflags .= " $wopt" unless ($cflags =~ /$wopt/)
                }
+       if ($ecc eq "clang")
+               {
+               foreach $wopt (split /\s+/, $clang_devteam_warn)
+                       {
+                       $cflags .= " $wopt" unless ($cflags =~ /$wopt/)
+                       }
+               }
        }
 
 open(IN,"<Makefile.org") || die "unable to read Makefile.org:$!\n";
@@ -1799,8 +1742,6 @@ while (<IN>)
        s/^PROCESSOR=.*/PROCESSOR= $processor/;
        s/^ARFLAGS=.*/ARFLAGS= $arflags/;
        s/^PERL=.*/PERL= $perl/;
-       s/^KRB5_INCLUDES=.*/KRB5_INCLUDES=$withargs{"krb5-include"}/;
-       s/^LIBKRB5=.*/LIBKRB5=$withargs{"krb5-lib"}/;
        s/^LIBZLIB=.*/LIBZLIB=$withargs{"zlib-lib"}/;
        s/^ZLIB_INCLUDE=.*/ZLIB_INCLUDE=$withargs{"zlib-include"}/;
        s/^FIPSLIBDIR=.*/FIPSLIBDIR=$fipslibdir/;
@@ -1859,8 +1800,6 @@ print "PROCESSOR     =$processor\n";
 print "RANLIB        =$ranlib\n";
 print "ARFLAGS       =$arflags\n";
 print "PERL          =$perl\n";
-print "KRB5_INCLUDES =",$withargs{"krb5-include"},"\n"
-       if $withargs{"krb5-include"} ne "";
 
 my $des_ptr=0;
 my $des_risc1=0;
@@ -1911,8 +1850,8 @@ foreach (sort split(/\s+/,$bn_ops))
        }
 
 open(IN,'<crypto/opensslconf.h.in') || die "unable to read crypto/opensslconf.h.in:$!\n";
-unlink("crypto/opensslconf.h.new") || die "unable to remove old crypto/opensslconf.h.new:$!\n" if -e "crypto/opensslconf.h.new";
-open(OUT,'>crypto/opensslconf.h.new') || die "unable to create crypto/opensslconf.h.new:$!\n";
+unlink("include/openssl/opensslconf.h.new") || die "unable to remove old include/openssl/opensslconf.h.new:$!\n" if -e "include/openssl/opensslconf.h.new";
+open(OUT,'>include/openssl/opensslconf.h.new') || die "unable to create include/openssl/opensslconf.h.new:$!\n";
 print OUT "/* opensslconf.h */\n";
 print OUT "/* WARNING: Generated automatically from opensslconf.h.in by Configure. */\n\n";
 
@@ -2027,8 +1966,8 @@ print OUT "#ifdef  __cplusplus\n";
 print OUT "}\n";
 print OUT "#endif\n";
 close(OUT);
-rename("crypto/opensslconf.h","crypto/opensslconf.h.bak") || die "unable to rename crypto/opensslconf.h\n" if -e "crypto/opensslconf.h";
-rename("crypto/opensslconf.h.new","crypto/opensslconf.h") || die "unable to rename crypto/opensslconf.h.new\n";
+rename("include/openssl/opensslconf.h","include/openssl/opensslconf.h.bak") || die "unable to rename include/openssl/opensslconf.h\n" if -e "include/openssl/opensslconf.h";
+rename("include/openssl/opensslconf.h.new","include/openssl/opensslconf.h") || die "unable to rename include/openssl/opensslconf.h.new\n";
 
 
 # Fix the date
@@ -2070,9 +2009,7 @@ EOF
 } else {
        my $make_command = "$make PERL=\'$perl\'";
        my $make_targets = "";
-       $make_targets .= " links" if $symlink;
        $make_targets .= " depend" if $depflags ne $default_depflags && $make_depend;
-       $make_targets .= " gentests" if $symlink;
        (system $make_command.$make_targets) == 0 or die "make $make_targets failed"
                if $make_targets ne "";
        if ( $perl =~ m@^/@) {
@@ -2251,11 +2188,6 @@ sub print_table_entry
        my $target = shift;
        my $type = shift;
 
-       my $debug_cflags = "debug-cflags";
-       my $nodebug_cflags = "nodebug-cflags";
-       my $debug_lflags = "debug-lflags";
-       my $nodebug_lflags = "nodebug-lflags";
-
        # Don't print the templates
        return if $table{$target}->{template};
 
@@ -2265,14 +2197,14 @@ sub print_table_entry
 *** $target
 \$cc           = $table{$target}->{cc}
 \$cflags       = $table{$target}->{cflags}
-\$debug_cflags   = $table{$target}->{$debug_cflags}
-\$nodebug_cflags = $table{$target}->{$nodebug_cflags}
+\$debug_cflags   = $table{$target}->{debug_cflags}
+\$release_cflags = $table{$target}->{release_cflags}
 \$unistd       = $table{$target}->{unistd}
 \$thread_cflag = $table{$target}->{thread_cflag}
 \$sys_id       = $table{$target}->{sys_id}
 \$lflags       = $table{$target}->{lflags}
-\$debug_lflags   = $table{$target}->{$debug_lflags}
-\$nodebug_lflags = $table{$target}->{$nodebug_lflags}
+\$debug_lflags   = $table{$target}->{debug_lflags}
+\$release_lflags = $table{$target}->{release_lflags}
 \$bn_ops       = $table{$target}->{bn_ops}
 \$cpuid_obj    = $table{$target}->{cpuid_obj}
 \$bn_obj       = $table{$target}->{bn_obj}
@@ -2304,14 +2236,14 @@ EOF
            my @sequence = (
                "cc",
                "cflags",
-               "debug-cflags",
-               "nodebug-cflags",
+               "debug_cflags",
+               "release_cflags",
                "unistd",
                "thread_cflag",
                "sys_id",
                "lflags",
-               "debug-lflags",
-               "nodebug-lflags",
+               "debug_lflags",
+               "release_lflags",
                "bn_ops",
                "cpuid_obj",
                "bn_obj",